Exam SC-200 topic 1 question 4 discussion

I echo, as the requirement is not for audit, but to prevent. So the answer should be A & D.

A,D. These are 2 complete solutions on their own. Not a step by step by step. 1) Add the rule and enable it. 2) Add the rule, set the rule to overwrite existing rules, and enable it. "Set-MpPreference will always overwrite the existing set of rules. If you want to add to the existing set, use Add-MpPreference instead." https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction?view=o365-worldwide#powershell The command does not need to mention anything about block because the GUID references a Rule with already set actions. Configuration Manager name: Block Office application from creating child processes GUID: d4f940ab-401b-4efc-aadc-ad5f3c50688a https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?source=recommendations&view=o365-worldwide#block-all-office-applications-from-creating-child-processes

I agree, A and D

agree @JohnAvlakiotis A,D... The question or task is to PREVENT. Audits do not accomplish this task.

Yes, normally we add a new audit policy with Add-MpPreference and change the policy to enabled with Set-MpPreference, but in this case, each correct answers presents a complete solution, A&D Right, cause Set can change and create policies too, and Add-MpPreference can only add new policies.