You have a Microsoft 365 E5 subscription that contains a device named Device1.

Vendor: Microsoft
Product: SC-200
Update on: Jul 30, 2025
Questions: 370

Microsoft SC-200 Question Answer

You have a Microsoft 365 E5 subscription that contains a device named Device1. From the Microsoft Defender portal, you discover that an alert was triggered for Device1. From the Device inventory page, you isolate Device1. You need to collect a list of installed programs on Device1. What should you do?

Run an advanced hunting query against the DeviceTvmlnfoGathering table.

Initiate a live response session and run the processes command.

Run an advanced hunting query against the DeviceTvmSoftwarelnventory table.

Run an advanced hunting query against the DeviceProcessEvents table.