Threat Protection & Security Operations Flashcards

Which Microsoft 365 Defender service protects against malicious links and attachments in email?

Answer: Microsoft Defender for Office 365

Microsoft Defender for Office 365 provides Safe Links and Safe Attachments to protect users from malicious URLs and email attachments.

What does Microsoft Defender for Identity primarily monitor?

Answer: On-premises Active Directory signals for identity-based attacks

Microsoft Defender for Identity monitors on-premises Active Directory activity to detect identity-based attacks like pass-the-hash and lateral movement.

Which feature in Microsoft Defender for Office 365 detonates suspicious attachments in a sandbox before delivery?

Answer: Safe Attachments

Safe Attachments detonates email attachments in a virtual sandbox environment to check for malicious behavior before delivering them to users.

An alert fires in Microsoft 365 Defender indicating a compromised user account. What is the first recommended action?

Answer: Disable the account and reset the password

When an account is suspected compromised, immediately disabling it and forcing a password reset stops the attacker while preserving the account for investigation.

Which Microsoft 365 Defender portal provides a unified view of incidents across all Defender services?

Answer: Microsoft 365 Defender portal (security.microsoft.com)

The Microsoft 365 Defender portal at security.microsoft.com aggregates incidents, alerts, and investigations from all Defender services into a single unified console.

What is the purpose of Attack Simulation Training in Microsoft Defender for Office 365?

Answer: Run simulated phishing campaigns to train users to recognize attacks

Attack Simulation Training allows security teams to launch simulated phishing and social engineering campaigns to measure and improve user security awareness.