Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Security Operations Analyst Associate · Microsoft
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
ChatGTP: ❌ No, the solution does NOT meet the goal. 🛡️ Explanation: Automated Investigation and Response (AIR) helps reduce alert volume and investigation time by automatically analyzing alerts and taking remediation actions — but only if Microsoft Defender Antivirus is active or running in EDR in block mode.
Could someone explain if this answer is correct
Answer: B. No Enabling automated investigation and response (AIR) alone does not meet the goal. While AIR can investigate and respond to threats, it requires that Microsoft Defender Antivirus is active or that other components of Microsoft Defender for Endpoint, such as endpoint detection and response (EDR), are operational. Since Microsoft Defender Antivirus is in passive mode, it cannot actively scan and detect malicious artifacts that were missed by the third-party antivirus. To achieve the goal, you need to enable EDR in block mode in addition to AIR. EDR in block mode works even when Microsoft Defender Antivirus is in passive mode, allowing Microsoft Defender for Endpoint to detect and remediate threats that the third-party antivirus missed. Thus, simply enabling AIR is not sufficient to protect the devices in this scenario.