Microsoft Security Operations AnalystMitigate threats using Microsoft Defender XDRMedium
A security operations team wants to proactively identify and remediate vulnerabilities in third-party applications installed on their managed endpoints. They need a centralized view of software inventories, known vulnerabilities associated with each application, and actionable recommendations to address these risks. Which Microsoft Defender for Endpoint capability provides these insights?
- AAutomated Investigation and Remediation (AIR)
- BNetwork protection
- CAttack Surface Reduction (ASR) rules
- DThreat and Vulnerability Management (TVM)
Show answer & explanationAnswer & explanation
Correct answer: D. Threat and Vulnerability Management (TVM)
Threat and Vulnerability Management (TVM) in Microsoft Defender for Endpoint provides a comprehensive solution for discovering, prioritizing, and remediating vulnerabilities and misconfigurations across the organization's endpoints, including third-party software.
Why the other options are wrong
- A. AIR automates the response to detected threats, it doesn't proactively identify software vulnerabilities.
- B. Network protection blocks access to malicious domains/IPs, it doesn't assess software vulnerabilities.
- C. ASR rules prevent specific attack behaviors, they don't identify software vulnerabilities.
MDE Threat and Vulnerability Management (TVM)
Threat and Vulnerability Management (TVM) in Microsoft Defender for Endpoint helps organizations discover, prioritize, and remediate software vulnerabilities and misconfigurations.
- Provides a software inventory.
- Identifies CVEs and security recommendations.
- Prioritizes remediation based on risk.
Memory trick: To manage 'Threats' and 'Vulnerabilities', you need 'TVM', like a doctor for your endpoints.