Question 760 A suspected malware infection requires a deeper inspection of a device beyond quick scanning. What should admins choose? A Microsoft 365 adoption report Run only a remote quick scan despite the request for deeper investigation of a persistent infection A phishing simulation campaign for the user An appropriate full or offline scan method under the incident plan Explanation Correct Answer D:Broader scanning can detect threats missed by a quick scan. Incorrect Answers A:Usage statistics are not malware scanning. B:A quick scan may miss areas checked by full or offline scans appropriate to the incident response plan. C:Training does not inspect installed malware.
Question 761 A device is reconnected after offline work, and Defender detects malicious binaries that were not scanned while it lacked connectivity. What should be evaluated? A successful later upload proves nothing happened before The device is safe because it was offline Offline protection state, local signatures and subsequent cloud telemetry/sync Assume an offline workstation had live access to every cloud protection verdict before reconnecting Explanation Correct Answer C:Connectivity affects cloud intelligence and event reporting. Incorrect Answers A:Later reporting may include delayed events. B:Malware can execute without internet. D:Offline operation can have different protection and telemetry limits; post-reconnect cloud data must be distinguished from local state.
Question 762 A security baseline was applied to the wrong device group, leaving finance laptops with old antivirus settings. What should be checked? Reassign all finance users a higher cloud license without checking device-policy targeting Device group membership, policy targeting and effective per-device configuration Edit antivirus signature-update intervals while leaving the baseline's assignment scope unchanged Change the team's Microsoft 365 group membership without verifying affected device identities Explanation Correct Answer B:Assignment errors explain inconsistent protection. Incorrect Answers A:License upgrades do not fix a security baseline accidentally assigned to the wrong device group. C:Signature cadence does not correct an entire mis-targeted endpoint configuration policy. D:User collaboration groups are not sufficient evidence for which managed devices received the baseline.
Question 763 One endpoint receives an ASR setting from Intune and a contradictory local GPO. What is the right diagnostic focus? Give the user domain admin credentials to change registry Effective policy precedence and supported conflict resolution for the setting Delete the device from all inventory to clear conflict Assume the newest timestamp always wins universally Explanation Correct Answer B:Conflicting management channels can lead to unexpected state. Incorrect Answers A:Excess privileges are not safe configuration management. C:Removing visibility does not resolve settings. D:Precedence varies by management and control.
Question 764 A team wants to deploy an ASR rule used on Windows to a macOS fleet. What should it verify? Force the Windows ASR rule GUID onto macOS without confirming that control is supported there Rule applicability and supported security features for the macOS platform Using the same device hostname means the same protections All Windows ASR rules function identically on every OS Explanation Correct Answer B:Endpoint capabilities differ across operating systems. Incorrect Answers A:Windows rule IDs and behavior cannot be assumed portable to a platform with different endpoint protection capabilities. C:Names do not add capabilities. D:Cross-platform parity cannot be assumed.
Question 765 An endpoint uses a third-party antivirus product but the organization wants Defender to help remediate malicious artifacts detected through EDR. Which feature should be evaluated? EDR in block mode with supported prerequisites and configuration Uninstall the third-party AV and immediately assume Defender's EDR in block mode is running A Purview sensitivity label on device objects Only a Safe Links URL policy Explanation Correct Answer A:EDR can perform some blocking alongside another antivirus. Incorrect Answers B:Changing antivirus vendors is not the same as meeting Defender licensing, onboarding, policy and EDR-in-block-mode prerequisites. C:Labels do not activate EDR remediation. D:Email link inspection cannot clean local malware.
Question 766 A legitimate deployment tool is blocked on only one device after a custom file indicator was added. What should admins compare? The exact hash indicator, its action and the device's supported enforcement scope Only the tool's filename across the whole company Only a tenant-wide phishing simulation campaign Change the affected user's directory group membership without inspecting the file indicator's effective action Explanation Correct Answer A:Indicator configuration can cause targeted blocks. Incorrect Answers B:Filenames can hide different binaries. C:Training does not determine hash enforcement. D:A specific file hash indicator can cause the block independently of an unrelated user-directory membership edit.
Question 767 A mixed laptop fleet has some devices using an old Defender endpoint sensor build after a management policy change. What should be reviewed? Only the company's default domain suffix Only user license assignment timestamps Sensor version and platform servicing status for the affected devices Update malware signatures only while leaving the outdated endpoint sensor component unchanged Explanation Correct Answer C:Outdated agents can lose functionality or telemetry quality. Incorrect Answers A:Sign-in namespaces do not install sensor versions. B:Licenses do not prove agent binaries updated. D:Intelligence signatures do not independently update an obsolete sensor or underlying security platform build.
Question 768 A malicious PowerShell process was terminated. What should the responder inspect to determine whether it relaunched? Only the employee's Outlook sent items Device timeline or hunting for subsequent process executions and persistence events Only an organization's Secure Score trend Only the device display name Explanation Correct Answer B:Termination alone may not remove persistence. Incorrect Answers A:Mail history cannot show local relaunches. C:Posture score lacks process-level sequence. D:Names do not prove process recurrence.
Question 769 An unmanaged appliance appears in device inventory but isolate action is unavailable. What is a likely explanation? Enable device isolation on the unmanaged appliance without checking its supported response capabilities Every discovered device supports every live response action A device must be in a Microsoft 365 Group to isolate Isolation requires supported endpoint onboarding and response capability Explanation Correct Answer D:A discovered asset may lack the response agent. Incorrect Answers A:Visibility through device discovery does not confer the same response actions as supported, onboarded endpoints. B:Discovery does not install agents. C:Groups do not add agent capability.
Question 770 A device has been reimaged and now appears twice in Defender inventory, one record inactive. What should the admin assess? Delete the recently active device record because its creation date is newer Delete both records without identifying the active sensor Device identity, onboarding identifiers and supported stale record cleanup behavior Give the user a new primary sign-in identity without reviewing the two device onboarding records Explanation Correct Answer C:Reimaging can create new inventory identities. Incorrect Answers A:Age alone is not a safe basis for removing duplicate records; online status and unique onboarding identity are relevant. B:The live record contains useful telemetry. D:Renaming a user's sign-in does not reconcile duplicate endpoint inventory identities after a reimage.
