Question 770 A device has been reimaged and now appears twice in Defender inventory, one record inactive. What should the admin assess? Delete the recently active device record because its creation date is newer Delete both records without identifying the active sensor Device identity, onboarding identifiers and supported stale record cleanup behavior Give the user a new primary sign-in identity without reviewing the two device onboarding records Explanation Correct Answer C:Reimaging can create new inventory identities. Incorrect Answers A:Age alone is not a safe basis for removing duplicate records; online status and unique onboarding identity are relevant. B:The live record contains useful telemetry. D:Renaming a user's sign-in does not reconcile duplicate endpoint inventory identities after a reimage.
Question 771 Vulnerability dashboard lists a critical software weakness on a server without malware alerts. What should management understand? Every vulnerability automatically means active ransomware A backup job completion removes the software flaw No malware alert means the software needs no patch Exposure describes a weakness that attackers might exploit, not proven infection Explanation Correct Answer D:Preventive remediation is warranted without a detected breach. Incorrect Answers A:Vulnerability and compromise are distinct. B:Backup cannot patch the vulnerable component. C:Unexploited vulnerabilities still pose risk.
Question 772 An endpoint has both old and new versions of the same runtime installed. Why might Defender still report exposure? Treat the newly installed version as proof the older vulnerable runtime was automatically removed Having any newer version guarantees all older files are gone The antivirus signature date creates a false app version A vulnerable older installation remains present despite a newer version Explanation Correct Answer D:Inventory can detect multiple installed builds. Incorrect Answers A:Coexisting vulnerable binaries can remain discoverable and exploitable even after an updated runtime is added. B:Side-by-side versions may coexist. C:Signatures are not app package inventory.
Question 773 A legacy workstation cannot receive security updates but performs a critical function. What should the risk owner plan? Mark vulnerability findings false positive without evidence Delete the device from Defender inventory Isolation or compensating controls with approved replacement timeline Continue internet access unrestricted indefinitely Explanation Correct Answer C:Unsupported systems need risk mitigation beyond normal patching. Incorrect Answers A:Unsupported software remains exposed. B:Visibility removal is not risk mitigation. D:Open exposure increases potential compromise.
Question 774 Automated endpoint remediation is enabled but some actions require approval in the configured workflow. What should analysts track? Change the device's malware severity score without reviewing the queued action's approval requirement Assume every automated remediation action has executed because its corresponding alert is closed Assume every recommendation is already completed Pending remediation actions and approval status in the response queue Explanation Correct Answer D:A proposed action may not have executed. Incorrect Answers A:Risk-score adjustments do not approve or execute remediation operations waiting in the response action queue. B:An alert closure does not prove a pending response-queue action received required administrator approval. C:Recommendations and executed actions differ.
Question 775 An automated investigation detects suspicious registry changes but remediation was not completed. What should the analyst do? Review evidence and pending action state, then approve or act per policy Ignore remaining artifacts because investigation ran Disable endpoint sensor until the case closes Rename the incident to 'resolved' Explanation Correct Answer A:Automation results need appropriate disposition. Incorrect Answers B:Execution alone does not prove cleanup. C:Telemetry should be preserved. D:A title change is not remediation.
Question 776 A laptop connects to unknown outbound destinations despite normal antivirus status. Which endpoint control deserves consideration? Only a tenant-level billing permission Supported host firewall settings and network connection policy alongside EDR An Outlook junk mail setting Only a Purview label for documents Explanation Correct Answer B:Antivirus detection and network egress controls are distinct. Incorrect Answers A:Billing has no endpoint network enforcement role. C:Mailboxes cannot enforce host firewall rules. D:Labels do not control arbitrary outbound connections.
Question 777 Endpoint telemetry shows a spreadsheet launching PowerShell unexpectedly. What should the analyst prioritize? Ignore the event because the document was signed Review only the user's license count Parent-child process lineage, command line and associated file indicators Assume PowerShell is always malicious Explanation Correct Answer C:Office-to-script chains can indicate malicious execution. Incorrect Answers A:Signed content can be abused. B:Licensing does not establish process intent. D:Administrators use PowerShell legitimately.
Question 778 Security blocks a hash, but newly compiled variants with different hashes appear. What should detection strategy add? Behavioral or rule-based protections beyond one exact file-hash indicator Keep adding the same old hash repeatedly Disable cloud-delivered protection to reduce alerts Assume file names will always change with hashes Explanation Correct Answer A:Hash-only blocking misses modified binaries. Incorrect Answers B:The modified binary has a new hash. C:Removing behavioral intelligence weakens defense. D:Names do not reliably identify content.
Question 779 A managed device repeatedly contacts known malicious web destinations from a browser. Which endpoint capability should be evaluated? Delete the browser history on the affected device while leaving endpoint network protection unchanged Disable the user's browser extensions without verifying blocked destinations or configured network protection Use email anti-phishing detections alone to block endpoint web destinations Network protection or supported web content filtering with clear scope Explanation Correct Answer D:Endpoint policies can block malicious destinations. Incorrect Answers A:Erasing history removes evidence but does not prevent subsequent connections to the same malicious destinations. B:Extension removal might affect browser behavior but does not configure supported threat-domain enforcement against malicious traffic. C:Email filtering cannot reliably enforce network connections initiated directly from a managed browser or application.
Question 780 A required business site is blocked under a broad web category policy. What should the admin do? Validate the site's category and use a narrowly scoped exception if justified Disable all categories for the entire fleet Assume all classified sites are malicious Use an email alias to bypass the browser block Explanation Correct Answer A:Targeted tuning balances productivity and protection. Incorrect Answers B:Global removal increases exposure. C:Categories include legitimate business resources. D:Aliases do not change endpoint web policy.
