Endpoint Security and Microsoft Defender for Endpoint Flashcards

What is Microsoft Defender for Endpoint's 'Controlled Folder Access' designed to protect against?

Answer: Ransomware and untrusted apps modifying protected folder contents

Controlled Folder Access protects designated folders (Documents, Desktop, etc.) from being modified by untrusted applications, blocking ransomware from encrypting user files.

Which Intune security baseline type provides pre-configured security settings based on Microsoft security guidance for Windows 10/11?

Answer: Microsoft Security Baseline for Windows 10/11 in Endpoint security

Microsoft Security Baselines in Intune Endpoint security provide preconfigured, Microsoft-recommended security settings for Windows 10/11, covering hundreds of hardening configurations.

What is 'Tamper Protection' in Microsoft Defender Antivirus, and why is it important?

Answer: A feature that prevents unauthorized changes to Defender Antivirus settings by malware or users

Tamper Protection prevents malware and unauthorized users from disabling or modifying Microsoft Defender Antivirus settings, ensuring security tools remain active.

An organization onboards devices to Microsoft Defender for Endpoint. Which Intune policy type deploys the MDE onboarding configuration package?

Answer: Endpoint detection and response (EDR) policy under Endpoint security

The Endpoint detection and response policy in Intune Endpoint security deploys the MDE onboarding package that connects devices to the MDE service.

What information does the Microsoft Defender for Endpoint 'Device Inventory' in the Microsoft 365 Defender portal provide?

Answer: A comprehensive list of onboarded devices with risk level, OS version, and last seen information

The Device Inventory in Microsoft 365 Defender shows all MDE-onboarded devices with risk levels, exposure scores, OS details, and last activity timestamps.

Which Microsoft Defender for Endpoint capability scores and prioritizes device security misconfigurations and vulnerabilities?

Answer: Microsoft Defender Vulnerability Management (MDVM) with Secure Score for Devices

Microsoft Defender Vulnerability Management provides a Secure Score for Devices that quantifies the organization's security posture and prioritizes misconfigurations and CVEs to remediate.