Which selection is an ASR (attack surface reduction) rule that can be implemented and blocked?

The correct answer is C. Process creations initiating from WMI and PSExec commands. Option A is incorrect. This is not an ASR rule that can be implemented and blocked. Option B is incorrect. .ps1 execution cannot be blocked with an ASR rule. Option C is correct. This is an ASR rule that can be implemented and blocked…

Submitted by certguy· Apr 18, 2026Manage threat mitigation using Microsoft Defender for Endpoint

Question

Options

AContent from mobile devices
BPowerShell from executing
CProcess creations initiating from WMI and PSExec commands
DNone of the above

How the community answered

(41 responses)

A
2% (1)
B
7% (3)
C
88% (36)
D
2% (1)

Explanation

Option A is incorrect. This is not an ASR rule that can be implemented and blocked. Option B is incorrect. .ps1 execution cannot be blocked with an ASR rule. Option C is correct. This is an ASR rule that can be implemented and blocked. https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface- reduction?view=o365-worldwide

Topics

#Attack Surface Reduction#ASR rules#Microsoft Defender for Endpoint#Endpoint security

Community Discussion

No community discussion yet for this question.

Full SC-200 Practice