Exam SC-200 topic 1 question 64 discussion

Actual exam question from Microsoft's SC-200

Question #: 64
Topic #: 1

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

You have a Microsoft 365 subscription.

You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.

You need to ensure that the devices are protected from malicious artifacts that were undetected by the third-party antivirus product.

Solution: You enable automated investigation and response (AIR).

Does this meet the goal?

A. Yes
B. No

Show Suggested Answer

Suggested Answer: B 🗳️

by Madzius at Dec. 30, 2024, 8:03 a.m.

Comments

Submit Cancel

a_kto_to

2 months, 1 week ago

Selected Answer: B

ChatGTP: ❌ No, the solution does NOT meet the goal. 🛡️ Explanation: Automated Investigation and Response (AIR) helps reduce alert volume and investigation time by automatically analyzing alerts and taking remediation actions — but only if Microsoft Defender Antivirus is active or running in EDR in block mode.

upvoted 2 times

...

Madzius

5 months, 2 weeks ago

Selected Answer: B

Could someone explain if this answer is correct

upvoted 1 times

Shingie

5 months, 2 weeks ago

Answer: B. No Enabling automated investigation and response (AIR) alone does not meet the goal. While AIR can investigate and respond to threats, it requires that Microsoft Defender Antivirus is active or that other components of Microsoft Defender for Endpoint, such as endpoint detection and response (EDR), are operational. Since Microsoft Defender Antivirus is in passive mode, it cannot actively scan and detect malicious artifacts that were missed by the third-party antivirus. To achieve the goal, you need to enable EDR in block mode in addition to AIR. EDR in block mode works even when Microsoft Defender Antivirus is in passive mode, allowing Microsoft Defender for Endpoint to detect and remediate threats that the third-party antivirus missed. Thus, simply enabling AIR is not sufficient to protect the devices in this scenario.

upvoted 4 times

...