SC-200 Certification Practice Question #219

Question

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains a Windows device named Device1.

Twenty files on Device1 are quarantined by custom indicators as part of an investigation.

You need to release the 20 files from quarantine.

How should you complete the command? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Releasing files quarantined by custom indicators is done with the Microsoft Defender Antivirus command-line tool **MpCmdRun.exe** using the **-Restore** command. The image's fixed suffix `-Name EUS:Win32/CustomEnterpriseBlock -All` matches the documented custom-block restore: `-Name ` targets the threat and `-All` restores all matching files (needed here because 20 files were quarantined). MS Learn confirms both the executable and the `-Restore -Name -All` syntax, and notes the CustomEnterpriseBlock threat name for custom-indicator quarantines. The other executables (MsMpEng.exe, Start-MpRollback) and the other arguments (-GetFiles, -RemoveDefinitions, -ResetPlatform) do not restore quarantined files. Community is unanimous (14 👍 Highly Voted plus a 3 👍 confirmation). Confidence 94% — strong agreement and direct MS Learn confirmation.

More SC-200 practice questions