MS-102 Practice Question 3063
Exam: MS-102
Domain: Manage security and threats using Microsoft Defender XDR
Difficulty: hard
You are reviewing an incident in the Microsoft Defender XDR portal. How does Defender for Endpoint Automated Investigation and Response (AIR) handle remediation when configured in Full Remediation mode?
Answer Options
A
Remediate threats automatically without waiting for analyst approval
B
Send an email notification and take zero corrective action
C
Immediately format the endpoint hard drive and reinstall Windows
D
Block the user in Microsoft Entra ID permanently with no rollback
Correct Answer
A: Remediate threats automatically without waiting for analyst approval
Explanation
In Full Remediation mode, AIR takes remediation actions (quarantining files, stopping malicious processes, deleting registry keys) automatically without waiting for analyst approval.