Question

Your organization uses Microsoft Defender for Endpoint. The SOC lead wants brand-new, never-before-seen executable files that arrive on endpoints to be automatically inspected in the cloud and blocked within seconds if they are determined to be malicious, before the file is allowed to run. Which combination of settings must be configured on the managed devices to enable this capability?

Accepted Answer

Enable cloud-delivered protection with Block at first sight, and set the cloud extended timeout so files are held while cloud analysis completes

Answer

Set the Defender for Endpoint automation level to 'Full - remediate threats automatically' on the device group

Answer

Enable the Attack Surface Reduction rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' in block mode

Answer

Configure a custom detection rule with a 'Block file' response action scoped to the affected device group