Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Security Operations Analyst Associate · Microsoft
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
First we enable live response feature then make sure , defender portal users have right permissions to initiate the live response. So correct answer is C. https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/live-response?view=o365-worldwide#before-you-begin
The Live Response option in Defender literally says "Allows users with appropriate RBAC permissions to investigate devices..." https://learn.microsoft.com/en-us/defender-endpoint/live-response?view=o365-worldwide#before-you-begin Option C is the Automatically resolve alerts, not related to initiating remote shell connection. It's D.
Should be D where C need permission