Question 740 Users frequently execute scripts downloaded from untrusted email attachments. Which feature family can block risky process behaviors? Supported Defender attack surface reduction rules with staged policy targeting Only Secure Score reporting without enforcement Block sender domains in Exchange but leave locally downloaded script execution rules unchanged Only Microsoft 365 usage statistics Explanation Correct Answer A:ASR rules can prevent selected risky execution patterns. Incorrect Answers B:Posture reports cannot block individual processes. C:Mail controls can limit one delivery route, while endpoint attack surface reduction directly addresses untrusted script behavior. D:Adoption reports do not control process execution.
Question 741 An organization worries a new ASR rule may block line-of-business macros. What rollout approach reduces disruption? Apply blocking tenant-wide immediately without observing effect Deploy the rule in audit mode to a representative pilot before blocking Exclude all Office executables permanently Exclude all managed Windows devices from antivirus policies until the team completes a pilot of the new endpoint protection control Explanation Correct Answer B:Audit telemetry can expose legitimate impact. Incorrect Answers A:Untested controls can interrupt business applications. C:Broad exclusions defeat attack surface reduction. D:Broadly disabling protection creates avoidable exposure; pilot targeted configuration under supported security settings instead.
Question 742 An internal signed application is blocked by a specific ASR rule in one department. What remediation should be tested? Assume code signing guarantees no malicious behavior Give users local admin rights to bypass ASR Disable every ASR rule organization-wide Validate the behavior then apply the narrowest supported exclusion or configuration change Explanation Correct Answer D:Scoped exceptions protect the rest of the fleet. Incorrect Answers A:Signed software can still be abused. B:Excess privilege does not safely remediate policy conflicts. C:A single issue does not justify broad bypass.
Question 743 Attackers with local admin rights attempt to disable endpoint antivirus configuration. Which feature helps resist unauthorized modifications? Rely on local administrator policy preferences to protect antivirus settings from a local administrator Only a Microsoft 365 license assignment report Microsoft Defender tamper protection where supported Assign a sensitivity label to Windows antivirus files and assume a local administrator can no longer tamper with security settings Explanation Correct Answer C:Protected settings cannot be casually changed by malware. Incorrect Answers A:Privileged local accounts can often modify unmanaged settings; supported tamper protection provides resistance to unauthorized changes. B:Licensing inventory is not a tamper prevention control. D:Data classification does not create Defender Antivirus tamper protection against a local administrative attacker.
Question 744 A device reports real-time protection turned off following a policy migration. What should administrators examine? Only the default verified tenant domain Review only the endpoint's antivirus signature age and assume that determines real-time protection state Effective security policy, conflicting management sources and tamper protection state Reinstall the endpoint sensor before checking which management policy disabled protection Explanation Correct Answer C:Conflicting configuration can suppress protection. Incorrect Answers A:Domain suffix does not activate antivirus. B:Definitions can be current while effective configuration from competing policies leaves real-time protection disabled. D:Reinstallation can be wasteful or ineffective if an active conflicting configuration continues to turn protection off.
Question 745 A device has recent signatures but an old antivirus engine version. What should be considered? Signature age and engine version are always identical Engine and platform component currency in addition to intelligence updates A modern signature means the device cannot be compromised Treat recent threat-intelligence signatures as proof that the antivirus engine itself is current Explanation Correct Answer B:Signatures alone do not prove all protection components are current. Incorrect Answers A:Components can update separately. C:Definitions do not guarantee prevention. D:Security intelligence versions and platform or engine versions are distinct components with independent servicing.
Question 746 A device handles new malware variants that were unknown when local signatures were last downloaded. What setting can help? Apply Exchange Online mailbox mail-flow restrictions as the endpoint's antivirus cloud protection strategy Only removing all network connectivity permanently Cloud-delivered Defender protection with supported connectivity and policies Only local file archive age Explanation Correct Answer C:Cloud intelligence can supplement local definitions. Incorrect Answers A:Exchange transport policies do not configure device antivirus cloud-delivered protection or endpoint telemetry. B:Offline status may reduce cloud intelligence access. D:Archive metadata does not provide new threat verdicts.
Question 747 An attacker adds the operating system's entire program directory to antivirus exclusions. What should security do? Review and remove the overbroad exclusion under controlled policy management Disable tamper protection so exclusions are easier to edit Rename the excluded directory to a safer label Leave it to improve application performance Explanation Correct Answer A:Broad exclusions create major detection gaps. Incorrect Answers B:Lowering protection increases risk. C:Names do not change excluded coverage. D:Performance alone does not justify lost coverage.
Question 748 A device reports Defender for Endpoint sensor health but another antivirus product is primary. What must be distinguished? Change Defender for Office 365 Safe Attachments policy and infer that third-party endpoint antivirus now runs in active mode The sensor must be absent whenever third-party antivirus runs Endpoint detection and response sensor onboarding versus antivirus active/passive mode A license always forces Defender antivirus active mode Explanation Correct Answer C:MDE telemetry and antivirus roles can be separate. Incorrect Answers A:Cloud email attachment scanning is distinct from the local Defender Antivirus operational mode with another antivirus product. B:Supported coexistence depends on mode and platform. D:Configuration and platform affect mode.
Question 749 A malicious file was quarantined locally but expected events are absent from the portal. What should be examined? Only the user's mail forwarding rule Only the file's display icon Device sensor connectivity, ingestion, licensing and effective detection telemetry Only the tenant's billing address Explanation Correct Answer C:Local antivirus action may not imply portal data appeared. Incorrect Answers A:Forwarding cannot upload endpoint telemetry. B:Icons do not indicate sensor event routing. D:Business profile does not determine EDR ingestion.
Question 750 The security team wants high-impact server responses restricted to server administrators. What design matters? Rely only on the employee's department field Assign the operator a standard Entra Group Owner role and assume that provides supported live response privileges on every endpoint Give every analyst unrestricted isolation rights for servers Defender device groups and role-based permissions for authorized responders Explanation Correct Answer D:Scope controls protect sensitive fleets. Incorrect Answers A:A department value is not sufficient device response authorization. B:Group ownership is not the same as the Defender for Endpoint RBAC authorization required for privileged response actions. C:Broad response privilege can disrupt production.
