SC-900 · Domain 3: Describe the capabilities of Microsoft security solutions · 37% of the exam
Task 3.4: Describe threat protection with Microsoft Defender XDR
The Defender XDR suite: Defender for Office 365, Endpoint, Cloud Apps and Identity, Defender Vulnerability Management, Microsoft threat intelligence and the Microsoft Defender portal.
Study it
The Defender XDR suite and its cross-product capabilities
Lesson coming
Defender for Office 365, Endpoint, Cloud Apps and Identity
Lesson coming
Defender Vulnerability Management, threat intelligence and the Microsoft Defender portal
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
Defender for Office 365 should open files that arrive in email, after they pass the antivirus scan, in a virtual environment to see what they do before users receive them. Which feature is this?
ASafe Links
BZero-hour auto purge
CSafe Attachments
DAttack simulation training
Show the answer and why
ASafe Links
Incorrect
Safe Links protects against malicious URLs used in phishing and other attacks.
BZero-hour auto purge
Incorrect
ZAP retroactively removes malicious messages that were already delivered.
CSafe Attachments
Correct
After the common virus scan, Safe Attachments opens files in a virtual environment to see what happens, a process called detonation.
DAttack simulation training
Incorrect
Attack simulation runs realistic phishing scenarios to train users.
Safe Attachments in Microsoft Defender for Office 365 provides an extra layer of protection against malware. After the common virus detection engine in Microsoft 365 scans files, Safe Attachments opens them in a virtual environment and observes what happens, which is called detonation.
A laptop starts encrypting files the way ransomware does. The SOC wants a near-real-time alert showing the full scope of the breach on the device, response actions it can take there, and an automated investigation that remediates what it finds. Which product provides this?
AMicrosoft Defender for Identity
BMicrosoft Defender for Cloud Apps
CMicrosoft Defender Vulnerability Management
DMicrosoft Defender for Endpoint
Show the answer and why
AMicrosoft Defender for Identity
Incorrect
Defender for Identity works from signals on domain controllers and other identity servers, not from the laptop itself.
BMicrosoft Defender for Cloud Apps
Incorrect
Defender for Cloud Apps protects SaaS applications and their data, not a device under attack.
CMicrosoft Defender Vulnerability Management
Incorrect
Vulnerability management finds and prioritizes weaknesses to fix; it doesn't investigate an attack in progress.
DMicrosoft Defender for Endpoint
Correct
Its endpoint detection and response and automated investigation and remediation detect, scope and fix breaches on devices.
Microsoft Defender for Endpoint protects devices by preventing, detecting, investigating and responding to advanced threats. Its endpoint detection and response gives near-real-time, actionable detections with the full scope of a breach and response actions, and automated investigation and remediation examines alerts and acts to resolve breaches.
Employees have started using dozens of unapproved cloud storage and AI apps. Security wants to find out which apps are in use from network traffic, assess each against risk indicators and then set policies that monitor them. Which product fits?
AMicrosoft Defender for Endpoint
BMicrosoft Defender for Cloud Apps
CMicrosoft Defender for Cloud
DMicrosoft Purview Data Loss Prevention
Show the answer and why
AMicrosoft Defender for Endpoint
Incorrect
Defender for Endpoint protects devices; its network protection blocks malicious domains rather than inventorying and rating cloud apps.
BMicrosoft Defender for Cloud Apps
Correct
As a CASB, it identifies apps from network traffic and its app catalog, rates them on over 90 risk indicators and lets you set policies.
CMicrosoft Defender for Cloud
Incorrect
Defender for Cloud protects the company's own cloud workloads, not the SaaS apps employees sign up for.
DMicrosoft Purview Data Loss Prevention
Incorrect
DLP protects sensitive items from being shared; it doesn't inventory and rate the apps people use.
Microsoft Defender for Cloud Apps includes cloud access security broker (CASB) capabilities such as discovery of cloud app usage and shadow IT. It identifies apps from network traffic and an extensive app catalog, assesses them against more than 90 risk indicators and lets you manage them with policies that alert on anomalous behavior.
A company that syncs its on-premises Active Directory to Microsoft Entra ID wants to detect attackers who perform reconnaissance against its on-premises Active Directory, attempt brute-force attacks on domain accounts and move laterally between servers, using signals from the domain controllers themselves. Which product should it use?
AMicrosoft Defender for Identity
BMicrosoft Entra ID Protection
CMicrosoft Defender for Cloud Apps
DMicrosoft Defender for Cloud
Show the answer and why
AMicrosoft Defender for Identity
Correct
Defender for Identity uses sensors on domain controllers and other identity servers to detect reconnaissance, compromised credentials, lateral movement and domain dominance.
BMicrosoft Entra ID Protection
Incorrect
ID Protection detects risk in Microsoft Entra sign-ins and accounts; it doesn't read domain controller signals.
CMicrosoft Defender for Cloud Apps
Incorrect
Defender for Cloud Apps protects SaaS apps and their data, not on-premises Active Directory.
DMicrosoft Defender for Cloud
Incorrect
Defender for Cloud protects cloud workloads and their posture, not the on-premises directory.
Microsoft Defender for Identity is a cloud-based identity threat detection and response solution. Sensors on domain controllers and AD FS and AD CS servers feed it signals, and it identifies threats across the kill chain: reconnaissance, compromised credentials, lateral movements and domain dominance. Microsoft Entra ID Protection works alongside it to protect cloud identities.
A company has deployed Microsoft Defender for Endpoint Plan 2 on all its devices. Its IT lead asks whether it must buy a separate product before it can discover, assess and prioritize vulnerabilities and misconfigurations on those devices using a risk-based approach. What's the answer?
AYes, Microsoft Defender for Cloud with the Defender CSPM plan, alongside Defender for Endpoint
BNo, core Defender Vulnerability Management capabilities are built into Defender for Endpoint
CYes, Microsoft Purview Compliance Manager
DYes, Microsoft Defender for Cloud Apps
Show the answer and why
AYes, Microsoft Defender for Cloud with the Defender CSPM plan, alongside Defender for Endpoint
Incorrect
Defender CSPM manages the posture of cloud resources; it isn't the prerequisite for endpoint vulnerability management.
BNo, core Defender Vulnerability Management capabilities are built into Defender for Endpoint
Correct
Defender for Endpoint Plan 2 includes core vulnerability management with risk-based discovery, assessment, prioritization and remediation of endpoint vulnerabilities.
CYes, Microsoft Purview Compliance Manager
Incorrect
Compliance Manager tracks regulatory controls and improvement actions, not device vulnerabilities.
DYes, Microsoft Defender for Cloud Apps
Incorrect
Defender for Cloud Apps protects SaaS apps and their configuration, not software on devices.
Microsoft Defender for Endpoint includes core Defender Vulnerability Management capabilities that use a risk-based approach to discover, assess, prioritize and remediate endpoint vulnerabilities and misconfigurations; they come with Defender for Endpoint Plan 2. Defender Vulnerability Management, part of the Defender XDR suite, adds continuous asset visibility and built-in remediation tools; in the Defender portal it sits under Exposure management.
A malicious file is detected on one employee's laptop. The same file arrived as an email attachment and sits in other users' mailboxes. With Microsoft Defender XDR in place, what happens to those messages without anyone acting?
ANothing until an analyst runs a search and delete in eDiscovery
BDefender for Office 365 scans for the file and removes it from messages across the organization
CDefender for Cloud Apps quarantines the messages through its app connector
DMicrosoft Sentinel runs a playbook that a SOC engineer must build first
Show the answer and why
ANothing until an analyst runs a search and delete in eDiscovery
Incorrect
Defender XDR shares the detection across products and acts without waiting for manual work.
BDefender for Office 365 scans for the file and removes it from messages across the organization
Correct
When one product detects a threat it shares it, and Defender for Endpoint instructs Defender for Office 365 to remove the file from all messages.
CDefender for Cloud Apps quarantines the messages through its app connector
Incorrect
Defender for Cloud Apps protects SaaS apps; removing malicious files from mail is Defender for Office 365's job.
DMicrosoft Sentinel runs a playbook that a SOC engineer must build first
Incorrect
This cross-product response is built into Defender XDR, without a custom playbook.
In Microsoft Defender XDR, when one product detects a threat it immediately shares that information with the others. For example, if Defender for Endpoint detects a malicious file on a device, it instructs Defender for Office 365 to scan and remove the file from all email messages in the organization, so the file is blocked on sight across the suite.
A user forwards a suspicious email that got past filtering. The admin wants to send that message to Microsoft for analysis from the Microsoft Defender portal. Where does she do it?
AThreat Explorer
BThe quarantine review page
CThe Submissions page
DThe Action center
Show the answer and why
AThreat Explorer
Incorrect
Explorer helps investigate, hunt for and remediate threats in email; sending items to Microsoft is done elsewhere.
BThe quarantine review page
Incorrect
Review manages quarantined items and restricted senders.
CThe Submissions page
Correct
Admins use the Submissions page to submit messages, URLs and attachments to Microsoft for analysis.
DThe Action center
Incorrect
The Action center isn't where messages, URLs or attachments are sent to Microsoft for analysis.
In organizations with Exchange Online mailboxes, admins use the Submissions page in the Microsoft Defender portal to submit messages, URLs and attachments to Microsoft for analysis. Explorer is for investigating and hunting, and the Review area manages quarantine; neither of them, nor the Action center, sends items to Microsoft.
Attackers send emails that appear to come from the company's CEO to trick staff into revealing sensitive information. Which Defender for Office 365 feature targets this kind of spoofed message?
AOutbound spam filtering
BConnection filtering
CQuarantine policies
DAnti-phishing (spoofing) protection
Show the answer and why
AOutbound spam filtering
Incorrect
Outbound filtering checks mail the organization sends.
BConnection filtering
Incorrect
Connection filtering identifies good or bad source email servers by IP address.
CQuarantine policies
Incorrect
Quarantine policies don't detect spoofed senders.
DAnti-phishing (spoofing) protection
Correct
It protects against phishing attacks that try to steal information with messages that appear to be from legitimate or trusted senders.
Defender for Office 365 prevents and detects email threats with anti-malware, anti-spam, anti-phishing (spoofing) protection, outbound spam filtering, connection filtering, quarantine policies, Safe Attachments and Safe Links. Anti-phishing protection targets spoofed messages that appear to come from legitimate or trusted senders.
Which Microsoft Defender for Endpoint capability provides Microsoft Defender Antivirus, with behavior-based, real-time and cloud-delivered defenses against emerging threats?
ANext-generation protection
BAttack surface reduction
CEndpoint detection and response
DMicrosoft Defender Experts Hunting
Show the answer and why
ANext-generation protection
Correct
Next-generation protection includes Microsoft Defender Antivirus and its behavior-based, real-time and cloud-delivered protection.
BAttack surface reduction
Incorrect
Attack surface reduction hardens configuration and applies exploit mitigations as the first layer of defense.
CEndpoint detection and response
Incorrect
EDR isn't the antivirus component.
DMicrosoft Defender Experts Hunting
Incorrect
Defender Experts Hunting isn't an antivirus capability.
Next-generation protection in Defender for Endpoint is designed to catch emerging threats. It centers on Microsoft Defender Antivirus, with behavior-based, heuristic and real-time protection, cloud-delivered protection and regular updates.
AA unified suite that coordinates defense across endpoints, identities, email and apps
BA compliance tool that tracks the organization's progress toward regulations and standards
CA managed service that filters network traffic for Azure virtual networks
DAn identity governance service for access reviews
Show the answer and why
AA unified suite that coordinates defense across endpoints, identities, email and apps
Correct
Defender XDR natively coordinates detection, prevention, investigation and response across those areas.
BA compliance tool that tracks the organization's progress toward regulations and standards
Incorrect
That describes Microsoft Purview Compliance Manager.
CA managed service that filters network traffic for Azure virtual networks
Incorrect
That describes Azure Firewall.
DAn identity governance service for access reviews
Incorrect
That describes Microsoft Entra ID Governance.
Microsoft Defender XDR is a unified pre- and post-breach enterprise defense suite. It brings together Defender for Endpoint, Defender Vulnerability Management, Defender for Office 365, Defender for Identity, Defender for Cloud Apps and more, so security teams get a correlated view of an attack and coordinated response.
A company with its own SOC wants to find technology partners whose products integrate with the Microsoft Defender platform, and professional services firms that can help strengthen its detection, investigation and threat intelligence work. Where in the Microsoft Defender portal should it look?
AThe Defender Experts Overview and Messages pages
BThe Threat intelligence tab
CThe partner catalog in Investigation & response
DConnected applications, under Partners and APIs
Show the answer and why
AThe Defender Experts Overview and Messages pages
Incorrect
Defender Experts is Microsoft's own managed service, sold separately; these pages track that service's activity and conversations, not third-party partners.
BThe Threat intelligence tab
Incorrect
This tab opens Microsoft Defender Threat Intelligence, Microsoft's intelligence about threats, not a list of partners and services.
CThe partner catalog in Investigation & response
Correct
The partner catalog lists supported technology partners and professional services that help enhance the platform's detection, investigation and threat intelligence capabilities.
DConnected applications, under Partners and APIs
Incorrect
This Defender for Endpoint page shows the Microsoft Entra applications already connected in the organization, not a catalog of partners to choose from.
The Investigation & response area of the Microsoft Defender portal includes incidents and alerts, hunting, actions and submissions, and a partner catalog. The partner catalog lists supported technology partners and professional services that can help an organization enhance the platform's detection, investigation and threat intelligence capabilities. Defender Experts, by contrast, is Microsoft's own managed service.