MENU
You have a Microsoft 365 E5 subscription that contains 500 Windows 11 devices.
You have a Microsoft Defender for Endpoint deployment that has the following settings:
Discovery mode: Basic
Live Response: Disabled
Enable EDR in block mode: Off
Tamper Protection: Off
You need to implement automatic attack disruption in Microsoft Defender XDR.
What should you do?
Microsoft Defender XDR's Automatic attack disruption requires EDR in block mode to be enabled. This feature allows Defender for Endpoint to block or contain malicious activities, even when the primary antivirus engine fails to detect or block them initially.
According to Microsoft Defender documentation, attack disruption relies on real-time EDR response capabilities and EDR in block mode to isolate compromised users or devices automatically. Without EDR in block mode, Defender can only alert --- not stop --- ongoing attacks.
Enabling EDR in block mode integrates the EDR layer with Microsoft Defender Antivirus to automatically contain lateral movement and credential theft activities. While Tamper Protection, Live Response, and Standard Discovery are valuable, they do not directly enable automatic attack disruption.
Correct Answe r: A. Set Enable EDR in block mode to On