Microsoft Defender for Endpoint Flashcards

Which portal serves as the unified security console for managing Microsoft Defender for Endpoint?

Answer: Microsoft 365 Defender portal (security.microsoft.com)

The Microsoft 365 Defender portal at security.microsoft.com is the unified console for managing Defender for Endpoint alongside other Microsoft security products.

What is the primary purpose of Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint?

Answer: To block behaviors commonly used by malware before malicious activity occurs

ASR rules proactively block specific behaviors commonly exploited by malware — such as running obfuscated scripts or launching executable content from email — preventing attacks before they can execute.

In Microsoft Defender for Endpoint, what is the relationship between an 'alert' and an 'incident'?

Answer: An alert represents a single suspicious event; an incident is a collection of correlated alerts

An alert represents a single suspicious activity detection, while an incident is Microsoft Defender's grouping of correlated alerts that together describe a broader attack story.

What does the 'Live Response' feature in Microsoft Defender for Endpoint enable a security analyst to do?

Answer: Access a remote shell to investigate and remediate a device in real time

Live Response provides an interactive remote shell connection to a device, allowing analysts to run commands, collect forensic artifacts, and perform remediation actions without physically accessing the machine.

Which onboarding method is recommended for deploying Microsoft Defender for Endpoint sensors to a large number of Windows enterprise devices managed by Microsoft Endpoint Configuration Manager?

Answer: Microsoft Endpoint Configuration Manager

Microsoft Endpoint Configuration Manager is the recommended method for large-scale enterprise onboarding because it provides centralized, scalable deployment and management of the Defender for Endpoint sensor package.

Which Microsoft Defender for Endpoint capability uses behavioral analysis and machine learning to detect advanced threats that evade signature-based antivirus?

Answer: Endpoint Detection and Response (EDR)

Endpoint Detection and Response (EDR) uses behavioral analytics and machine learning to detect sophisticated threats — such as fileless attacks — that traditional signature-based antivirus cannot identify.

What is the primary function of 'Automated Investigation and Remediation' (AIR) in Microsoft Defender for Endpoint?

Answer: Automatically investigating alerts and taking remediation actions to reduce analyst workload

AIR automatically investigates alerts using the same decision logic a security analyst would apply and takes remediation actions such as quarantining malicious files, significantly reducing the volume of alerts requiring manual investigation.