A city purple team must brief leadership before any AI-assisted evasion tests on lab endpoints. What should they explain first about Windows Defender in that authorized validation context?
Select an answer to reveal the explanation.
Short Explanation
Defender is not one light switch—it is a stack of sensors and policies. Before anyone talks 'evasion' in a city lab, the team should map those layers so tests stay scoped and useful. Uninstalling production protection is not a briefing outcome.
Full Explanation
Before AI-assisted evasion tests on lab endpoints, a city purple team should explain first that Windows Defender includes multiple architectural layers and control surfaces that defenders and testers must understand before scoped validation. Cloud-delivered protection, real-time protection, attack-surface reduction, tamper protection, and related components interact; treating Defender as a single switch produces misleading tests and unsafe recommendations. Leadership briefings should map those layers so authorized evasion work stays scoped, measurable, and relevant to production civic configurations.
Describing Defender as a single on/off antivirus toggle with no layered components is architecturally false and undermines test design. Uninstalling production Defender citywide to simplify purple-team scheduling is an unacceptable operational and risk outcome. Claiming Defender architecture is irrelevant because only firewall rules matter ignores endpoint detection realities for municipal workstations.
Exam caveat: pre-test briefing items emphasize understanding layered controls and scope—not weakening production protection for convenience.
Operational check for city purple teams: inventory Defender features in lab and production baselines; brief leadership on layered surfaces; keep AI-assisted evasion inside written ROE on isolated ranges; never recommend production uninstalls; and report findings against the actual control stack that civic endpoints run.