Microsoft Security Operations AnalystMitigate threats using Microsoft Defender XDRMedium
A security operations center (SOC) team is using Microsoft Defender XDR. They observe an increasing number of alerts related to credential theft attempts and suspicious lateral movement activities within their on-premises Active Directory environment. The team wants to gain deeper visibility into these identity-based attacks, understand their kill chain, and receive specific recommendations to improve the security of their Active Directory. Which Microsoft Defender XDR component is specifically designed to provide this enhanced identity protection and insights?
- AMicrosoft Defender for Office 365
- BMicrosoft Defender for Cloud Apps
- CMicrosoft Defender for Identity
- DMicrosoft Defender for Endpoint
Show answer & explanationAnswer & explanation
Correct answer: C. Microsoft Defender for Identity
Microsoft Defender for Identity specifically monitors on-premises Active Directory for advanced threats like credential theft, lateral movement, and other identity-based attacks, providing insights into the attack kill chain and security recommendations.
Why the other options are wrong
- A. Defender for Office 365 protects email and collaboration services, not on-premises Active Directory.
- B. Defender for Cloud Apps monitors SaaS application usage and data, not on-premises Active Directory.
- D. Defender for Endpoint focuses on securing endpoints (workstations, servers), not the Active Directory infrastructure itself for identity-based attacks.
Microsoft Defender for Identity
A cloud-based security solution that leverages on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions.
- Protects hybrid identity environments.
- Detects credential theft, lateral movement, domain dominance.
- Provides security posture assessments for Active Directory.
Memory trick: Each Defender Protects a Specific Domain.