Exam MS-102 topic 1 question 336 discussion

The correct answer is: C. Enable troubleshooting mode. Enabling troubleshooting mode in Microsoft Defender for Endpoint allows you to configure settings, including antivirus and real-time protection, on a device that has tamper protection enabled. This mode helps ensure that necessary changes can be made without interference from existing security measures.

To configure antivirus and real-time protection for Device1 in the Microsoft Defender portal, you should create a device group and assign the appropriate security policies to it.

When tamper protection is enabled, certain security settings, including antivirus and real-time protection, are locked to prevent unauthorized changes. Troubleshooting Mode: Enabling troubleshooting mode allows you to temporarily disable tamper protection so that you can make necessary configuration changes, such as adjusting antivirus and real-time protection settings.

Answer C. https://learn.microsoft.com/en-us/defender-endpoint/manage-tamper-protection-microsoft-365-defender#important-points-to-keep-in-mind "When you enable tamper protection in the Microsoft Defender portal, the setting is applied tenant wide and restricts tamper-protected settings to their secure defaults. Any changes made to tamper-protected settings are ignored. Depending on your particular scenario, you have several options available: If you must make changes to a device and those changes are blocked by tamper protection, you can use troubleshooting mode to temporarily disable tamper protection on the device."

Troubleshooting mode Local admins, with appropriate permissions, can change configurations on individual endpoints that are usually locked by policy. Having a device in troubleshooting mode can be helpful when diagnosing Microsoft Defender Antivirus performance and compatibility scenarios. Local admins can't turn off Microsoft Defender Antivirus, or uninstall it. Local admins can configure all other security settings in the Microsoft Defender Antivirus suite (for example, cloud protection, tamper protection). Device groups: evice groups and use them to: Limit access to related alerts and data to specific Microsoft Entra user groups with assigned RBAC roles Configure different auto-remediation settings for different sets of devices Assign specific remediation levels to apply during automated investigations In an investigation, filter the Devices list to specific device groups by using the Group filter.

C. Enable troubleshooting mode.