Microsoft Security Operations AnalystMitigate threats using Microsoft Defender XDRMedium
A security auditor requires proof that all endpoints managed by Microsoft Defender for Endpoint are regularly checking for and applying the latest security updates and configurations. The auditor specifically wants to see a report detailing the security posture and compliance of devices against Microsoft's recommended security baselines. Which feature within Microsoft Defender for Endpoint should the security team leverage to meet this audit requirement?
- AAdvanced Hunting
- BDevice inventory
- CAutomated Investigation and Remediation (AIR)
- DSecurity recommendations (Threat and Vulnerability Management)
Show answer & explanationAnswer & explanation
Correct answer: D. Security recommendations (Threat and Vulnerability Management)
Security recommendations, part of Threat and Vulnerability Management (TVM) in Defender for Endpoint, provides actionable insights into device security posture, identifies misconfigurations, and tracks compliance against security baselines, directly addressing the auditor's requirement.
Why the other options are wrong
- A. Advanced Hunting is for proactive threat hunting using KQL, not for generating reports on security posture compliance against baselines.
- B. Device inventory lists devices but does not provide insights into their security configuration compliance.
- C. AIR focuses on automating threat response, not security posture assessment or compliance reporting.
MDE Security Recommendations (TVM)
Security recommendations, part of Threat and Vulnerability Management (TVM) in MDE, identifies security misconfigurations and vulnerabilities on endpoints.
- Provides actionable recommendations to improve security posture.
- Tracks compliance against security baselines.
- Helps prioritize remediation efforts.
Memory trick: To know if you're 'secure' and 'compliant', you need 'recommendations' from TVM, not just a list of devices.