Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the capabilities of Microsoft Security solutionsMedium
A security analyst is investigating a suspicious activity report involving a user's workstation. They need to quickly identify if the workstation has been compromised, isolate it from the network, and remediate any detected threats. Which component of Microsoft 365 Defender provides these advanced endpoint detection and response (EDR) capabilities?
- AMicrosoft Defender for Identity
- BMicrosoft Defender for Cloud Apps
- CMicrosoft Defender for Office 365
- DMicrosoft Defender for Endpoint
Show answer & explanationAnswer & explanation
Correct answer: D. Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is the component of Microsoft 365 Defender that provides advanced EDR capabilities, allowing for detection, investigation, and response to threats on endpoints like workstations.
Why the other options are wrong
- A. Microsoft Defender for Identity protects identity infrastructure.
- B. Microsoft Defender for Cloud Apps is a CASB for cloud application security.
- C. Microsoft Defender for Office 365 focuses on email and collaboration security.
Microsoft Defender for Endpoint
An enterprise endpoint security platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats.
- Provides Endpoint Detection and Response (EDR).
- Includes vulnerability management and attack surface reduction.
- Automates security incidents and responses.
Memory trick: Each Defender component protects its unique domain.