StudyByteLearn
← SC-100: Microsoft Cybersecurity Architect
SC-100 · Hybrid multicloud posture and exposure

Practice question 244 of 498 · hard

A team wants to replace every VM EDR agent with agentless disk scanning to reduce deployment overhead. Its requirement includes continuous suspicious-process detection. What should the architect recommend?

Choose the single best answer.

  1. A.Remove EDR because disk snapshots capture every process in real time
  2. B.Use only the regulatory compliance dashboard
  3. C.Use EASM as the exclusive detector of internal processes
  4. D.Retain suitable EDR telemetry and use agentless scanning as complementary posture coverage
Show the answer and explanation

✓ Correct answer

  • Retain suitable EDR telemetry and use agentless scanning as complementary posture coverage

EDR supports continuous process telemetry, while agentless scanning provides complementary supported findings. Snapshots do not record every real-time process. Compliance checks evaluate posture, and EASM observes the external surface rather than internal process execution.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.