220-1102 Question 626
Single answerFalse alerts regarding antivirus protectionA user reports that Windows Security shows a red warning stating their antivirus protection is turned off. However, the company uses a centrally managed third-party antivirus product, and its management console shows the endpoint is healthy, signatures are current, and real-time protection is enabled. The user can also open the third-party antivirus client and see that protection is active. What is the MOST likely cause of the Windows Security alert?
- A
The third-party antivirus is not properly registering its status with the Windows Security Center
- B
The antivirus signatures are outdated, so Windows Security is overriding the vendor's status
- C
The user account lacks local administrator rights, so Windows Security cannot detect antivirus software
- D
The system must have both Microsoft Defender Antivirus and the third-party antivirus enabled at the same time to clear the alert
Show answer and explanation
Correct answer: A
Explanation
This scenario describes a false alert: Windows Security indicates antivirus protection is off, but the third-party security product is clearly functioning and centrally reporting a healthy state. In real-world support, this usually points to a status reporting or registration issue between the antivirus product and Windows Security Center rather than an actual loss of protection. A technician should verify the third-party client service status, confirm the product is supported on that Windows version, and check whether the vendor's software is correctly registered with Windows Security. Best practice is to confirm protection status from the vendor management console and local client before taking disruptive actions such as uninstalling the product. Microsoft documentation for Windows Security and antivirus integration notes that compatible third-party antivirus products register with Windows so security status can be displayed correctly; if that registration fails or becomes inconsistent, users may see inaccurate warnings.
- A. Correct.
Correct. A common cause of a false antivirus warning in Windows is that the installed security product is functioning normally but is not correctly reporting its status to Windows Security Center (also called Windows Security/Action Center depending on version). In that case, Windows may incorrectly display that antivirus protection is off even though the vendor console and local client show protection is active. This is the best explanation when the endpoint is healthy in the vendor's management tools.
- B. Incorrect.
Incorrect. If signatures were actually outdated, the vendor console and local client would typically also show a warning or noncompliant state. In the scenario, both the central console and local antivirus client report current signatures and active protection, which makes outdated definitions an unlikely explanation. This distractor reflects the common assumption that any antivirus alert must be caused by old definitions.
- C. Incorrect.
Incorrect. Standard user permissions do not normally prevent Windows Security from detecting whether a registered antivirus product is installed and active. While admin rights may be needed to change settings, lack of elevation is not the most likely reason for a false alert when the product is otherwise working and centrally reporting healthy status.
- D. Incorrect.
Incorrect. Windows does not require both Microsoft Defender Antivirus and a third-party antivirus product to be active simultaneously. In fact, when a compatible third-party antivirus product is installed and properly registered, Microsoft Defender Antivirus typically disables itself or enters a passive state to avoid conflicts. This option reflects a misunderstanding about how Windows handles multiple antivirus products.