AZ-801 · Question #33
You have an Azure virtual machine named VM1. You enable Microsoft Defender SmartScreen on VM1. You need to ensure that the SmartScreen messages displayed to users are logged. What should you do?
The correct answer is C. From Event Viewer, enable the Debug log. To ensure Microsoft Defender SmartScreen messages displayed to users are logged on an Azure virtual machine, you should enable the Debug log in Event Viewer.
Question
Options
- AFrom a command prompt, run WinRM quickconfig.
- BFrom the local Group Policy, modify the Advanced Audit Policy Configuration settings.
- CFrom Event Viewer, enable the Debug log.
- DFrom the Windows Security app, configure the Virus & threat protection settings.
How the community answered
(45 responses)- A4% (2)
- B9% (4)
- C84% (38)
- D2% (1)
Why each option
To ensure Microsoft Defender SmartScreen messages displayed to users are logged on an Azure virtual machine, you should enable the Debug log in Event Viewer.
Running WinRM quickconfig configures Windows Remote Management, which is unrelated to logging SmartScreen messages.
Modifying Advanced Audit Policy Configuration settings from local Group Policy configures security auditing, not the operational logging of SmartScreen messages.
SmartScreen events, including messages displayed to users, are typically recorded in the Event Viewer. Enabling the specific Debug or Analytical log for SmartScreen in Event Viewer provides a more detailed level of logging necessary to capture these messages.
Configuring Virus & threat protection settings in the Windows Security app allows managing SmartScreen behavior but does not enable the logging of its displayed messages.
Concept tested: Microsoft Defender SmartScreen event logging
Source: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/threat-protection-events?view=o365-worldwide
Topics
Community Discussion
No community discussion yet for this question.