Questions

To test your knowledge of protecting Windows clients and servers with Microsoft Defender for Endpoint, you can try answering the following questions. The answers can be found toward the end of this book:

1. A developer is generating test versions of their new application and reports it is not launching successfully. You run Get-MpPreference and discover that its CloudBlockLevel is 6. What does this mean?
   1. Block at first sight is in zero-tolerance mode
   2. Block at first sight is in high plus mode
   3. Block at first sight is in its default configuration
2. A bad actor has local administrative rights to a Windows 11 device and is trying to evade defenses using PowerShell. You have enabled tamper protection on the device using Intune. Which of the following can the attacker not disable or evade? Choose all that apply.
   1. Real-time protection
   2. Cloud-delivered protection
   3. Default action based on threat ID
   4. Attack surface reduction rules
3. You are migrating Windows Server 2016 from a well-known...