Controlled Folder Access is configured as Enabled, but testing shows untrusted applications can still modify the selected protected folder. Defender Antivirus is in passive mode and EDR block mode is enabled. What prerequisite must the administrator correct?

✓ Correct answer

• Use a supported configuration with Defender Antivirus active and real-time protection enabled.

CFA requires Defender Antivirus active mode with real-time protection. Passive mode, including EDR block mode, does not meet this requirement; fix the supported protection configuration and repeat audit/enforcement testing. Option explanations: A. Use EDR block mode as the supported replacement for active antivirus in CFA.: EDR block mode does not make CFA function in passive antivirus mode. B. Allow every application through the CFA allowed-applications list.: A broad allowed-applications list weakens protection and does not fix the antivirus prerequisite. C. Trust the folder path in App Control for Business.: App Control code-trust policy does not activate CFA file-write protection. D. Use a supported configuration with Defender Antivirus active and real-time protection enabled.: These are the operating prerequisites stated for CFA. Sources: Controlled folder access overview and requirements — https://learn.microsoft.com/en-us/defender-endpoint/controlled-folder-access-overview

Read the source reference