Microsoft Defender for Endpoint Flashcards

Which Microsoft Defender for Endpoint capability is designed to discover, prioritize, and remediate software vulnerabilities and misconfigurations on devices?

Answer: Threat & Vulnerability Management

Threat & Vulnerability Management provides a risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations. It helps organizations reduce their overall exposure to threats.

An analyst observes suspicious process creation and lateral movement activities on a workstation. Which Defender for Endpoint feature provides the detailed event timeline and process tree to investigate these activities?

Answer: Endpoint Detection and Response (EDR)

Endpoint Detection and Response (EDR) capabilities provide near real-time and actionable detections of threats. It collects and analyzes behavioral signals from endpoints, allowing security analysts to investigate the full scope of a breach through detailed timelines and process information.

What is the primary goal of Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint?

Answer: To prevent malware from running by blocking common malicious behaviors.

Attack Surface Reduction (ASR) rules are designed to prevent common attack techniques used by malware. They target specific software behaviors, such as Office apps creating executable content or scripts launching downloaded payloads, to stop attacks at the pre-execution stage.

A security alert is triggered on a device, and Defender for Endpoint automatically quarantines a malicious file and stops a suspicious process. Which capability performed these actions?

Answer: Automated Investigation and Remediation (AIR)

Automated Investigation and Remediation (AIR) is designed to mimic the actions of a security analyst at machine speed and scale. When an alert is triggered, AIR can automatically investigate the alert, determine the root cause, and apply remediation actions like quarantining files or stopping processes.

Which component of Microsoft Defender for Endpoint uses cloud-based machine learning, behavior analysis, and heuristics to provide real-time malware protection?

Answer: Next-generation protection

Next-generation protection is the real-time antivirus and antimalware component of Defender for Endpoint. It goes beyond traditional signature-based detection, using advanced cloud-powered techniques to block new and emerging threats.

A security operations team wants to proactively search for signs of compromise across all their onboarded devices using custom Kusto Query Language (KQL) queries. Which Defender for Endpoint feature should they use?

Answer: Advanced hunting

Advanced hunting is a query-based threat hunting tool that lets you explore up to 30 days of raw event data from your endpoints. You can use Kusto Query Language (KQL) to proactively hunt for threats, anomalies, and indicators of compromise.