MS-102 Question 208

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 2

  B. an indicator In Microsoft Defender for Endpoint, indicators can be used to specify files, URLs, or IP addresses that should be allowed or blocked across your organization. By creating a file indicator for File1.exe and setting it to "block," you can prevent users from downloading this specific file.

• 3

  Documentation here confirms the answer most people have given: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/advanced-features?view=o365-worldwide To turn Allow or block files on: In the navigation pane, select Settings > Endpoints > General > Advanced features > Allow or block file. Toggle the setting between On and Off. Select Save preferences at the bottom of the page. After turning on this feature, you can block files via the ****Add Indicator**** tab on a file's profile page.

• 8

  To block users from downloading a file named File1.exe in Microsoft Defender for Endpoint, you should use an **indicator** (B). An indicator in Microsoft Defender for Endpoint is a security tool that allows you to block or allow files, URLs, domains, and IP addresses. Here's how you can do it: 1. Sign in to the Microsoft 365 Defender portal. 2. Under Endpoints, go to Settings. 3. Under the Rules heading, you will find the Indicators option. 4. Here, you can add the file (File1.exe) that you want to block. Please note that a suppression rule (A) is used to stop alerts from being triggered by known safe files and behaviors. A device configuration profile (C) is used to manage settings and features on devices in your organization.