Question 790 A user reports unwanted browser redirects but Defender has no active incident. What is an appropriate next step? Assume no action is required because alerts are absent Investigate browser extensions, device processes and network telemetry with supported endpoint tools Reset the user's browser profile and clear history before preserving suspicious extension and process evidence Disable antivirus to reproduce the redirect Explanation Correct Answer B:No current alert does not rule out malicious behavior. Incorrect Answers A:Detection can miss unknown activity. C:Immediate broad resets can remove investigation evidence and do not test which extension, process or network redirection caused the behavior. D:Weakening protection is unnecessary.
Question 791 A device blocks legitimate automation when an ASR rule is set to block, while the same rule in audit mode causes no interruption. What does this demonstrate? Audit mode always provides identical protection to block mode An email spam threshold determines ASR action Enforcement mode controls whether detected behavior is prevented versus only logged Block mode automatically deletes every existing script file Explanation Correct Answer C:Audit evidence can guide a safe transition. Incorrect Answers A:Audit does not stop the action. B:Mail filtering does not set local enforcement. D:Rule action is not universal file deletion.
Question 792 A company wants to restrict removable USB storage but still allow authorized encrypted drives. Which capability is relevant? An Entra named location only Disable all USB ports without allowing supported exceptions for authorized encrypted devices Supported Defender for Endpoint device control policies with scoped allow rules A Safe Links URL policy only Explanation Correct Answer C:Device control can govern peripheral access. Incorrect Answers A:IP location does not classify USB devices. B:A blanket USB ban does not meet the policy requirement to allow the approved encrypted-device category. D:URL protection does not manage USB media.
Question 793 An approved encrypted USB drive is denied on one laptop after a device-control update. What should be investigated? Device-control rule evaluation and actual hardware identifiers or group scope Reassign the device to a different user instead of validating the hardware ID against the allow rule Only a PDF sensitivity label on an unrelated file Treat disk encryption on the laptop as automatic approval of any inserted removable drive Explanation Correct Answer A:Misclassified media or policy precedence can cause denial. Incorrect Answers B:The device-control decision depends on effective identifiers and policy targeting, not merely the enrolled user's label. C:Document labels are not the hardware decision. D:OS disk encryption does not establish whether the external USB device meets the scoped allow-list conditions.
Question 794 The organization has Windows, macOS and Linux devices and wants consistent protection. What should the design avoid? Assuming identical features and settings across all supported platforms Using centrally tracked platform inventories Documenting operating-system differences Piloting security policy updates Explanation Correct Answer A:Policies must reflect platform-specific capabilities. Incorrect Answers B:Inventories help choose compatible controls. C:Differences inform scoped configuration. D:Pilot rollout is a protective approach.
Question 795 An endpoint has a vulnerable third-party app whose vendor has not released a fix. Which mitigation might reduce risk? Assume no vendor patch means no risk exists Supported attack surface reduction, isolation or removal of the risky app where feasible Change only the app's displayed name Suppress all alerts for the affected app Explanation Correct Answer B:Compensating controls can reduce exposure pending a patch. Incorrect Answers A:Unpatched vulnerabilities may remain exploitable. C:Renaming does not remove vulnerable code. D:Hiding alerts does not mitigate exploitation.
Question 796 A Defender onboarding test generates a known benign verification event that appears in the portal. What does that validate? Basic end-to-end sensor reporting, not full security coverage of every feature No malware can bypass the device Every ASR rule has been individually exercised All historical device activity has been backfilled Explanation Correct Answer A:One test confirms a telemetry path. Incorrect Answers B:Reporting health is not immunity. C:One signal does not test all rules. D:New onboarding does not reconstruct the past.
Question 797 An analyst queues an endpoint action while the laptop is offline. What should they understand? Assume the queued endpoint response ran instantly even though the device remained offline Action execution may wait until the device reconnects and meets prerequisites Queued means the action already completed locally Offline devices can always be isolated in real time Explanation Correct Answer B:Offline agents cannot immediately receive cloud commands. Incorrect Answers A:Remote response actions generally require the managed device to reconnect and meet the action's execution prerequisites. C:Scheduling and execution are distinct. D:Network connection is relevant for remote commands.
Question 798 A device was isolated after a false positive and the investigation confirms it is safe. What should be verified before release? Release without recording the investigation Every isolated device should remain disconnected forever Incident disposition, remediation status and authorized release-from-isolation action Disable Defender sensor after release Explanation Correct Answer C:Restoring network access should follow documented safety checks. Incorrect Answers A:Auditability matters for a false positive. B:Containment is not a permanent default. D:Removing telemetry is not necessary.
Question 799 An application developer requests exclusions for an entire system drive because a build runs slowly. What is a safer response? Measure the bottleneck and choose minimal path/process exclusions only when justified Exclude every file created by the developer tool without identifying the specific conflicting scan behavior Approve the entire drive exclusion automatically Turn off cloud-delivered protection for all devices Explanation Correct Answer A:Broad scan exclusions create substantial exposure. Incorrect Answers B:An entire workload exclusion is broader than necessary and can create avoidable detection blind spots. C:Disabling coverage broadly is risky. D:Global weakening does not fix one build.
Question 800 A security baseline was correct last week but a local administrator changed a protected setting on three laptops. What should investigators compare? Only the devices' color labels in inventory Only a tenant-wide Secure Score value Only the employee's Outlook sent-folder size Device configuration history, tamper alerts and effective management policy Explanation Correct Answer D:Evidence distinguishes legitimate updates from unauthorized drift. Incorrect Answers A:Display tags do not establish who changed settings. B:Aggregate scoring may hide device-level drift. C:Mail usage does not show endpoint security edits.
