You deploy the Endpoint Protection client in Microsoft System Center 2012 R2 Configuration Manager to all
client computers. You plan to deploy an antimalware policy to the users in the research department.
You need to ensure that the research department users can exclude some processes from the Endpoint
Protection client manually. Which settings should you modify in the antimalware policy?

A.
real-lime protection

B.
default actions

C.
threat overrides

D.
advanced

Explanation:
http://gerryhampsoncm.blogspot.co.uk/2013/08/config-mgr-2012-endpoint-protection.html