220-1102 Question 358
Single answerUpdate definitionsA small office uses Microsoft Defender Antivirus on several Windows 11 PCs. One user reports that a downloaded test file from the internet was not detected on their PC, while the same file was blocked on another workstation. During troubleshooting, you find that real-time protection is enabled on both systems, but the affected PC has not received new security intelligence for several weeks. Which action should the technician take FIRST to address the issue?
- A
Update the antivirus definitions/security intelligence on the affected PC
- B
Disable real-time protection, reboot the PC, and then re-enable it
- C
Run Disk Cleanup to remove temporary files before scanning again
- D
Replace Microsoft Defender Antivirus with a third-party antimalware product
Show answer and explanation
Correct answer: A
Explanation
This question tests the practical purpose of update definitions in endpoint security. Antivirus software relies on current definitions, also called security intelligence, to detect newly identified malware. If two similar systems behave differently and the main difference is that one has outdated definitions, the most appropriate first step is to update those definitions. This aligns with standard security best practices: confirm protection features are enabled, verify the software is current, and then retest. Microsoft documentation for Microsoft Defender Antivirus refers to these updates as security intelligence updates and emphasizes keeping them current to maintain effective protection.
- A. Correct.
Correct. If Microsoft Defender Antivirus has outdated definitions, it may fail to identify newer threats that are detected on systems with current security intelligence. The first corrective action is to update the definitions so the engine can recognize the latest malware signatures and indicators.
- B. Incorrect.
Incorrect. Disabling real-time protection reduces security and does not address the root cause: outdated definitions. Rebooting may be part of general troubleshooting in some cases, but it is not the first or most appropriate step here.
- C. Incorrect.
Incorrect. Removing temporary files can free disk space and sometimes improve performance, but it does not update malware signatures or improve detection of new threats. This option reflects a common misconception that general system maintenance fixes security detection gaps.
- D. Incorrect.
Incorrect. Replacing the antivirus product is unnecessary based on the scenario. The evidence points to stale definitions, not a failure of the antivirus platform itself. Best practice is to verify and update the current product before considering replacement.