Exam MS-101 topic 2 question 32 discussion

Actual exam question from Microsoft's MS-101

Question #: 32
Topic #: 2

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint.
From Microsoft Defender for Endpoint, you turn on the Allow or block file advanced feature.
You need to block users from downloading a file named File1.exe.
What should you use?

A. a suppression rule
B. an indicator
C. a device configuration profile

Show Suggested Answer

Suggested Answer: B 🗳️

by gxsh at Dec. 15, 2021, 10:39 a.m.

Comments

Submit Cancel

venwaik

Highly Voted 2 years, 11 months ago

Selected Answer: B

Answer B. Came on exam 09-05-2022

upvoted 12 times

...

gxsh

Highly Voted 3 years, 4 months ago

Answer is correct. https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/respo nd-file-alerts#allow-or-block-file

upvoted 6 times

[Removed]

3 years, 4 months ago

Agree: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/respond-file-alerts?view=o365-worldwide#allow-or-block-file When you add an indicator hash for a file, you can choose to raise an alert and block the file whenever a device in your organization attempts to run it. Files automatically blocked by an indicator won't show up in the file's Action center, but the alerts will still be visible in the Alerts queue.

upvoted 8 times

...

Amir1909

Most Recent 1 year, 2 months ago

B is correct

upvoted 1 times

...

VictorSaiz

2 years, 8 months ago

Hello Everyone!! Could anybody explain how to access the Microsoft Defender for Endpoint or wherever the Indicators are? Which is the URL? I cannot find this in Microsoft 365 Defender portal. Thank you very much in advance!

upvoted 2 times

...

JAPo123

3 years, 2 months ago

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/indicator-file?view=o365-worldwide#create-an-indicator-for-files-from-the-settings-page