An analyst wants to scan one suspicious download directory on a live session host. There is no current need to scan the entire host or restart it, and the investigation should limit I/O scope. Which scan type best fits?

✓ Correct answer

• A custom scan of the specified directory.

A custom scan targets the specified file or directory and matches the limited investigation scope. Full and offline scans add unnecessary scope or disruption here. Option explanations: A. A custom scan of the specified directory.: A custom scan directly targets the suspicious directory. B. The next scheduled quick scan, with a guarantee that it exhaustively scans that directory.: A quick scan focuses on common malware locations; it does not supply the stated exhaustive directory-specific guarantee. C. A full scan of the entire system and attached storage.: A full scan has broader scope and potentially larger I/O cost than the requirement. D. An offline scan requiring a restart.: Offline scanning introduces a restart that the stated investigation does not require. Sources: Microsoft Defender Antivirus full scan considerations and best practices — https://learn.microsoft.com/en-us/defender-endpoint/mdav-scan-best-practices

Read the source reference