Cert Master

KT-EPS Antivirus status

EDR shows 'protected' but Windows Defender is disabled via GPO conflict. What should you do?

Multiple choice — select one answer

Answer choices

  1. a. Disable logging to reduce tickets, without security or identity team coordination per policy.
  2. b. Reconcile GPO and EDR policy so one compliant agent is active and reporting
  3. c. Leave both disabled if users complain, without security or identity team coordination per policy.
  4. d. Hide status in the console, without security or identity team coordination per policy.

Architectural breakdown & explanation

Conflicting policies cause false confidence; one managed agent should report health.

Correct answer(s): b. Reconcile GPO and EDR policy so one compliant agent is active and reporting

Exam domain: Antivirus status (20% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Endpoint Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications