A.Assign device groups

B.Manage alert thresholds

C.Reconstruct attack activity and scope

D.Apply content updates

A.It focuses only on network traffic

B.It is limited to initial access prevention

C.It replaces detection and response

D.It minimizes exploitable endpoint behaviors

A.Enforce least-privilege execution

B.Reduce alerting thresholds

C.Allow all applications by default

D.Disable endpoint telemetry

A.Which outcome is expected after detecting an AD-based threat?

B.Immediate endpoint agent removal

C.Automatic policy deletion

D.Investigation and remediation of identity risks

A.Reduced endpoint storage usage

B.Elimination of endpoint agents

C.Faster response to emerging threats

D.Manual administrator control