220-1102 Question 468
Single answer8. Schedule scans and run updatesA small accounting office reports that several Windows 11 PCs become very slow every weekday at 10:00 A.M., when employees are actively using bookkeeping software. You discover that Microsoft Defender Antivirus is starting a full scan at that time on each system. The office manager wants malware protection to remain enabled, but the disruption during business hours must stop. Which action should the technician take FIRST to best meet this requirement?
- A
Disable Microsoft Defender Antivirus real-time protection during office hours and re-enable it at the end of the day
- B
Reschedule the Defender scheduled scan to run outside business hours, such as overnight or during lunch when systems are idle
- C
Remove Microsoft Defender Antivirus and replace it with Windows Firewall only
- D
Configure System Restore to create a restore point before users log in each morning
Show answer and explanation
Correct answer: B
Explanation
The best first step is to adjust the scan schedule so full scans run when users are less likely to be affected. In real-world support, technicians should preserve security controls while reducing operational impact. Microsoft security best practices support keeping Microsoft Defender Antivirus enabled and managing scan timing through scheduling rather than disabling core protections. Firewall settings and System Restore do not solve this problem because they serve different purposes. The scenario specifically concerns scheduling scans and maintaining updates/protection without interrupting users, which is why rescheduling the scan is the most appropriate action.
- A. Incorrect.
This is incorrect because disabling real-time protection reduces active malware defense and does not address the underlying problem of poorly timed scheduled scans. Real-time protection is intended to remain on in normal business environments. A common misconception is that turning off protection temporarily is an acceptable performance fix, but it creates unnecessary risk.
- B. Correct.
This is correct because the issue is caused by a scheduled full scan running during peak usage. Best practice is to keep antimalware protection enabled while scheduling intensive scans and update tasks for off-hours or other low-impact times. This meets the manager's requirement to maintain protection while minimizing disruption.
- C. Incorrect.
This is incorrect because Windows Firewall does not replace antivirus or antimalware functionality. Removing Defender would leave the systems without proper malware scanning protection. This distractor reflects the common confusion between network filtering and endpoint malware protection.
- D. Incorrect.
This is incorrect because System Restore is used to roll back certain system changes and is not a tool for malware scanning performance management. Creating restore points will not prevent Defender from running scans during work hours or improve the scheduling issue.