HOTSPOT You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a Windows device named Device1. You investigate Device1 for malicious activity and discover a suspicious file named File1.exe. You collect an investigation package from Device1. You need to review the following forensic data points:
• Is an attacker currently accessing Device1 remotely?
• When was File1.exe first executed? Which folder in the investigation package should you review for each data point? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
Select one answer.
Purchase Full Access to view answer options & explanation
The first 125 questions in this bank are completely free. Unlock Full Access on the exam page to view all answer choices, verified answers, explanations, and community discussions for all 415 questions.
