Endpoint Security and Microsoft Defender for Endpoint Flashcards

Which Intune integration enables security administrators to manage Microsoft Defender for Endpoint settings directly from the Intune admin center?

Answer: Microsoft Defender for Endpoint — Intune connector via security settings management

The Microsoft Defender for Endpoint connector in Intune enables MDE security settings management, allowing Intune to push Defender configurations to onboarded devices.

What is the purpose of Microsoft Defender for Endpoint's 'Attack Surface Reduction (ASR)' rules?

Answer: To prevent specific behaviors commonly exploited by malware, such as Office macro spawning processes

ASR rules block specific attack vectors used by malware, such as Office applications spawning child processes, executing content from email, and credential theft from LSASS.

Which Intune endpoint security policy type configures Microsoft Defender Antivirus scan settings and exclusions?

Answer: Antivirus policy under Endpoint security

Endpoint security Antivirus policies in Intune configure Microsoft Defender Antivirus settings including scan type, schedule, exclusions, and cloud protection level.

What does Microsoft Defender for Endpoint's 'Endpoint Detection and Response (EDR)' capability primarily provide?

Answer: Post-breach detection, investigation, and response capabilities for advanced threats

EDR provides advanced post-breach detection by continuously monitoring device behavior, enabling security teams to investigate and respond to threats that bypassed prevention.

An administrator configures an ASR rule in 'Audit mode'. What is the effect on devices?

Answer: The rule logs what would have been blocked without actually preventing the action

Audit mode logs ASR rule trigger events to Windows Event Log and Microsoft Defender for Endpoint without blocking the action, allowing testing before enforcement.

Which Microsoft Defender for Endpoint feature provides network-level protection by blocking connections to malicious IPs and URLs?

Answer: Network Protection

Network Protection extends SmartScreen to block outbound connections to malicious IPs, domains, and URLs at the network layer on managed endpoints.