Microsoft Security Operations AnalystMitigate threats using Microsoft Defender XDRMedium
A security engineer is configuring Microsoft Defender for Endpoint for a critical server that hosts sensitive financial data. Due to the high sensitivity and strict compliance requirements, the engineer wants to ensure that any detected threats are immediately quarantined with minimal human intervention, but also wants to prevent any automated actions that might disrupt the server's critical operations without prior approval. Which Automated Investigation and Remediation (AIR) automation level should be configured for this server group?
- ASemi-Full - require approval for remediation
- BFull - remediate threats automatically
- CNo automated response
- DPartial - require approval for remediation
Show answer & explanationAnswer & explanation
Correct answer: D. Partial - require approval for remediation
The 'Partial - require approval for remediation' automation level allows for automated investigation and immediate quarantining (initial remediation steps) but requires explicit approval before any potentially disruptive remediation actions are taken, balancing rapid response with operational control for critical systems.
Why the other options are wrong
- A. Semi-Full automation is a valid level, but 'Partial' is more precise for 'minimal human intervention' for initial steps while 'requiring approval' for disruptive ones.
- B. Full automation remediates automatically, which risks disrupting critical operations without approval.
- C. No automated response would require manual intervention for all steps, which contradicts the 'minimal human intervention' for immediate quarantining.
AIR Automation Levels
Automated Investigation and Remediation (AIR) in Microsoft Defender for Endpoint defines how automatically threats are investigated and remediated.
- Levels range from no automation to full automation.
- Partial automation allows initial steps but requires approval for disruptive actions.
- Configured per device group or globally.
Memory trick: Think of automation levels like driving modes: 'Full' is autopilot, 'Partial' is cruise control with driver override, 'No' is manual.