Exam CAS-003 topic 1 question 255 discussion

I tried to get onboard with C&D - but, it does not make sense. The requirement states "due to limited security resources" - whether that is for staff or tools, implementing EDR requires a lot of overhead, configuring, etc. Plus, unless you tell it to block hashes and similar, it won't do much but detect and report. That, in my mind, isn't active protection. I am an SME for EDR at my company and I wouldn't use it for this case scenario, AV would've done a better job here, especially if you're using something modern like Windows Defender that allows a great level of granularity. "D" - well, that's obvious to all of us. Again, feel free to disagree but I don't "C" as a solution here.

Answers given are correct, ignore this tater tot C. Due to limited security resources, implement active protection capabilities Support server, laptop, and desktop infrastructure D. Provide users with the ability to self-service classify information and apply policies

Maybe: A. Data loss prevention ? - implements active protection capabilities - protects data-at-rest, data-in-use, and data-in-motion