Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Security Operations Analyst Associate · Microsoft
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-compatibility#passive-mode-or-edr-in-block-mode In passive mode, Microsoft Defender Antivirus isn't used as the antivirus app, and threats aren't* remediated by Microsoft Defender Antivirus. However, Endpoint detection and response (EDR) in block mode can remediate threats. Files are scanned by EDR, and reports are provided for threat detections that are shared with the Defender for Endpoint service. You might see alerts showing Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in passive mode.
ChetGTP: ✅ Yes, the solution meets the goal. 🛡️ Explanation: EDR in block mode allows Microsoft Defender for Endpoint to block and remediate threats, even when Microsoft Defender Antivirus is in passive mode. So, even though a third-party antivirus is the primary AV, EDR in block mode will: Detect threats using Defender for Endpoint's telemetry. Automatically block or remediate threats that the third-party AV missed. Provide real-time protection against malicious artifacts.
B. No. EDR in block mode is a reactive measure. It acts after malicious activity is detected. The goal is to protect against malicious artifacts undetected by the third-party antivirus. EDR won't necessarily detect a file that the antivirus missed unless that file is executed and exhibits suspicious behavior. The scenario requires a proactive approach to find these undetected artifacts.