Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Security Operations Analyst Associate · Microsoft
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
12:10 PMClaude responded: A and DA and D Why: The goal is to prevent (block) the behavior, which means the _Actions value must be Enabled — not AuditMode. AuditMode only logs the activity without blocking it, so B and C are immediately eliminated regardless of the cmdlet used. That leaves A and D, which both use Enabled and the same correct rule GUID (D4F940AB-401B-4EFC-AADC-AD5F3C50688A — the "Block Office applications from creating child processes" ASR rule). The difference is just the cmdlet: A uses Add-MpPreference — appends the rule to any existing ASR configuration D uses Set-MpPreference — sets/replaces the ASR configuration Both achieve the goal of enabling the blocking rule, which is why each is a complete solution on its own.
AD A → Add-MpPreference + Enabled (correct) B → Set-MpPreference + AuditMode (incorrect - only logs, doesn’t block) C → Add-MpPreference + AuditMode (incorrect -same as B) D → Set-MpPreference + Enabled (Correct)
A and B 1. Enable ASR rule to block Office from creating child processes 2. Set ASR rule via Group Policy or Intune (PowerShell example for audit mode) -❌ Incorrect Options (C and D): These are placeholders and not valid commands unless they also target the same ASR rule with correct syntax.