Microsoft Security Operations Analyst — Question 64

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

You have a Microsoft 365 subscription.

You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.

You need to ensure that the devices are protected from malicious artifacts that were undetected by the third-party antivirus product.

Solution: You enable automated investigation and response (AIR).

Does this meet the goal?

Answer options

Correct answer: B

Explanation

The solution does not meet the goal because enabling automated investigation and response (AIR) does not provide real-time protection against threats; it only investigates and responds to incidents after they occur. The devices still rely on the third-party antivirus in passive mode, which may fail to detect certain malicious artifacts, leaving them vulnerable.