You deploy the Endpoint Protection client in Microsoft System Center 2012 R2 Configuration Manager to all client computers. You plan to deploy an antimalware
policy to the users in the research department.
You need to ensure that the research department users can exclude some processes from the Endpoint Protection client manually. Which settings should you
modify in the antimalware policy?

A.
real-lime protection

B.
default actions

C.
threat overrides

D.
advanced

Explanation:
http://gerryhampsoncm.blogspot.co.uk/2013/08/config-mgr-2012-endpoint-protection.html