Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Security Operations Analyst Associate · Microsoft
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Live Response allows security analysts to manually connect to a device and run commands for investigation and remediation. It is a manual tool, not an automated protection mechanism. It does not proactively detect or block malicious artifacts. It requires analyst intervention, which does not scale to 1,000 devices for continuous protection.
ChatGTP: B. No ⚠️ Explanation: Live Response is a feature in Microsoft Defender for Endpoint that allows administrators to interact with and respond to security incidents by performing actions on devices remotely (e.g., investigating alerts, killing processes, or quarantining files). However: Live Response is not designed to prevent or block threats proactively. It is used for investigation and response after an incident is detected. It does not provide real-time protection from malicious artifacts that are undetected by the third-party antivirus product. For proactive protection from undetected threats, you should enable EDR in block mode, which allows Microsoft Defender for Endpoint to automatically block and remediate threats (even when Defender Antivirus is in passive mode).
Live Response in Microsoft Defender for Endpoint (MDE) is a tool used for investigating and remediating threats manually through an interactive remote shell. However, it does not automatically block or remediate threats missed by the third-party antivirus. To ensure protection from undetected threats, you need to enable EDR in Block Mode, which allows Defender for Endpoint to automatically block and remediate threats, even when Microsoft Defender Antivirus is in passive mode.