Question 750 The security team wants high-impact server responses restricted to server administrators. What design matters? Rely only on the employee's department field Assign the operator a standard Entra Group Owner role and assume that provides supported live response privileges on every endpoint Give every analyst unrestricted isolation rights for servers Defender device groups and role-based permissions for authorized responders Explanation Correct Answer D:Scope controls protect sensitive fleets. Incorrect Answers A:A department value is not sufficient device response authorization. B:Group ownership is not the same as the Defender for Endpoint RBAC authorization required for privileged response actions. C:Broad response privilege can disrupt production.
Question 751 Two machines have the same vulnerable software, but one hosts critical identity services. How should remediation priority differ? Fix only the machine with the shorter hostname Account for device criticality and exposure path, not CVE score alone Ignore the identity server because it rarely reboots Assume identical CVEs always imply identical urgency Explanation Correct Answer B:Business impact changes risk priority. Incorrect Answers A:Names are unrelated to impact. C:Patch inconvenience does not remove risk. D:Asset role and exposure change priority.
Question 752 Security sees a CVE assigned to a product version on endpoints, but IT says the patch installed. What should be compared? Only the IT ticket's status field Detected software versions, exposure evidence and patch deployment verification Only the device's email alias Only the tenant's phishing simulation score Explanation Correct Answer B:Inventory may lag or reveal failed installations. Incorrect Answers A:Administrative closure is not technical proof. C:Aliases do not identify installed binaries. D:Training does not establish software version.
Question 753 An internet-facing workstation has an actively exploited vulnerability, while another device has a higher numeric CVSS but no exploit path. What should be considered? Always ignore vulnerabilities with workarounds Always choose only the largest CVSS value Only Secure Score points determine patch order Active exploitation evidence, reachability, business role and compensating controls Explanation Correct Answer D:Context can outweigh a raw severity number. Incorrect Answers A:Compensating controls need evaluation, not automatic dismissal. B:Score alone omits exposure and exploit activity. C:Posture scoring is not an asset-specific exploit model.
Question 754 Defender Vulnerability Management recommends removing an obsolete browser plug-in from 200 devices. What should admins do after software deployment? Mark complete as soon as a deployment is scheduled Remove all devices from Defender inventory Change endpoint display names to reflect patching Verify the vulnerable component is absent or updated on affected device inventory Explanation Correct Answer D:Deployment intent is not remediation evidence. Incorrect Answers A:Uninstalled updates leave exposure. B:Hiding devices does not remove the plug-in. C:Renaming is not software removal.
Question 755 A server's OS is unsupported for the planned sensor, so Defender Vulnerability Management shows incomplete app inventory. What should be documented? Every endpoint automatically has the same coverage Missing software data proves the server has no applications Platform support, available telemetry limits and alternative asset discovery coverage Deploy the Windows-only endpoint sensor to all unsupported network appliances and infer comprehensive software inventory from the attempt Explanation Correct Answer C:Unsupported devices may need compensating inventory methods. Incorrect Answers A:Platform and license capability vary. B:Absence of telemetry is not absence of programs. D:Some devices require supported discovery or network-device approaches rather than direct installation of a Windows sensor.
Question 756 Defender sees network activity from hosts not yet onboarded and the organization wants to inventory them. What feature is relevant? Assume every unmanaged device is already inventoried because employee Entra sign-ins were logged from those machines Deploy an endpoint onboarding policy to unknown network appliances without checking supported discovery and operating system prerequisites Supported device discovery and inventory review in Defender for Endpoint Infer endpoint inventory from the company's approved mail gateways instead of analyzing Defender's discovered network and device evidence Explanation Correct Answer C:Discovery can surface unmanaged network devices. Incorrect Answers A:Sign-in logs may identify clients but do not substitute for supported Defender device discovery and inventory correlation. B:Unmanaged or unsupported endpoints may require network-device discovery rather than direct sensor onboarding. D:Mail sender allow lists do not identify all active endpoint devices observed from network telemetry.
Question 757 An unmanaged printer appears through device discovery but has no endpoint process telemetry. What explains this? A discovered device is always Intune compliant Discovery visibility does not mean an MDE sensor runs on the device Mailboxes automatically onboard all devices named after users All discovered devices must have full DeviceProcessEvents data Explanation Correct Answer B:Discovered assets can lack onboarded telemetry. Incorrect Answers A:Network observation is not compliance evaluation. C:Mail accounts do not install sensors. D:Unsupported devices cannot emit standard agent events.
Question 758 A remote laptop cannot connect to Defender endpoints through a corporate proxy. What should networking staff verify? Reinstall the endpoint sensor before validating the corporate proxy and TLS inspection behavior Only the user's preferred language Check only general Internet reachability while ignoring required Defender service endpoints and proxy authentication Supported service URL reachability, proxy authentication and sensor connectivity requirements Explanation Correct Answer D:Outbound connectivity is necessary for cloud telemetry. Incorrect Answers A:Reinstalling cannot address a persistent network intermediary blocking the sensor's required service communications. B:Language does not resolve proxy policy. C:A host can browse the Internet yet fail to reach the specific supported MDE URLs or authenticate through a proxy.
Question 759 A workstation is active in a ransomware incident, but its local staff wants to power it off immediately. What should the responder consider? Always disable all XDR monitoring first Never isolate a device even during active spread Authorized containment, forensic evidence and business criticality before disruptive action Reset only the affected user's password while leaving the actively compromised device connected Explanation Correct Answer C:Immediate shutdown can erase volatile evidence while leaving other risks. Incorrect Answers A:Removing telemetry hinders response. B:No containment can increase damage. D:Credential rotation does not contain device-level ransomware activity or preserve the host evidence needed for response.
Question 760 A suspected malware infection requires a deeper inspection of a device beyond quick scanning. What should admins choose? A Microsoft 365 adoption report Run only a remote quick scan despite the request for deeper investigation of a persistent infection A phishing simulation campaign for the user An appropriate full or offline scan method under the incident plan Explanation Correct Answer D:Broader scanning can detect threats missed by a quick scan. Incorrect Answers A:Usage statistics are not malware scanning. B:A quick scan may miss areas checked by full or offline scans appropriate to the incident response plan. C:Training does not inspect installed malware.
