A ransomware incident targeted a Windows Server 2019 file server. You must enable Controlled folder access in block mode, add D:\Shares\Payroll and E:\FinanceData as protected folders, and allow C:\Program Files\LegacyBackup\agent.exe to write to those folders. Which set of PowerShell commands should you run?

The correct answer uses Set-MpPreference -EnableControlledFolderAccess Enabled to activate Controlled Folder Access in block mode, as required. It then uses Add-MpPreference -ControlledFolderAccessProtectedFolders to specify the folders to protect, D:\Shares\Payroll and E:\FinanceData. Finally, Add-MpPreference -ControlledFolderAccessAllowedApplications is used to whitelist C:\Program Files\LegacyBackup\agent.exe, allowing it to write to the protected folders. The first incorrect option uses AuditMode instead of Enabled, which would only log events, not block access. It also incorrectly uses ControlledFolderAccessAllowedFolders instead of ControlledFolderAccessProtectedFolders. The second incorrect option uses EnableNetworkProtection which is unrelated to Controlled Folder Access. The third incorrect option attempts to disable Controlled Folder Access at the end, contradicting the requirement to enable it.