A court IT security review asks whether 'disable real-time protection' advice belongs in production remediation for municipal judges' workstations. What is the correct stance?
Select an answer to reveal the explanation.
Short Explanation
You should reject disabling real-time protection as production remediation: keep it enabled on court workstations, even when scan delays recur. Keep bypass discussion in authorized labs, not in a standing overnight policy or clerk-controlled toggle without change control.
Full Explanation
Court IT security reviews must separate troubleshooting folklore from production remediation. Guidance to disable real-time protection on municipal judges’ workstations does not belong in production fix paths. Real-time protection is a core Defender control against active malware; turning it off to chase performance tickets creates a high-value exposure window on systems handling sensitive judicial data. Temporarily suspending protection across court workstations whenever scan delays recur institutionalizes risk for a performance complaint. A standing overnight disable policy and clerk toggles without change control likewise remove continuous protection and auditability. Bypass techniques and disable discussions belong only in authorized, isolated lab contexts under ROE when purple teams intentionally validate detection gaps—not as standing court remediation. The correct stance is to reject disable guidance for production and confine bypass discussion to authorized labs. Exam caveat: the question concerns production remediation, not whether labs may ever study bypasses. Practical check: court SOPs should explicitly forbid end-user or L1 disabling of real-time protection. Any lab validation of bypasses requires written authorization, isolated images, and restoration verification before reconnecting anything resembling a judge’s production build.