Option A is correct. EDR with block mode can be used with third-party AV. Option B is incorrect. The "Allow or block file" feature requires Defender AV. Option C is incorrect. Automated investigations do not block files. Reference: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-compatibility?view=o365-worldwide