Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Microsoft 365 Fundamentals MS-900 > Describe threat protection with Microsoft Defender XDR > Flashcards

Describe threat protection with Microsoft Defender XDR Flashcards

1
Q

Microsoft Defender XDR

A

enterprise defense suite that protects against sophisticated cyberattacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

t or f

With Microsoft Defender XDR, you can natively coordinate the detection, prevention, investigation, and response to threats across endpoints, identities, email, and applications.

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Microsoft Defender XDR allows admins to assess threat signals from

A

endpoints
applications
email
identities
to determine an attacks scope and impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Microsoft Defender XDR suite protects:

A

Endpoints with Microsoft Defender for Endpoint

Assets with Defender Vulnerability Management

Email and collaboration with Microsoft Defender for Office 365

Identities with Microsoft Defender for Identity

Applications with Microsoft Defender for Cloud Apps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Endpoints with Microsoft Defender for Endpoint

A

unified endpoint platform for preventative protection, post-breach detection, automated investigation, and response.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Assets with Defender Vulnerability Management

A

delivers continuous asset visibility, intelligent risk-based assessments, and built-in remediation tools to help your security and IT teams prioritize and address critical vulnerabilities and misconfigurations across your organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Email and collaboration with Microsoft Defender for Office 365

A

safeguards your organization against malicious threats posed by email messages, links (URLs), and collaboration tools.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Identities with Microsoft Defender for Identity

A

uses Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Applications with Microsoft Defender for Cloud Apps

A

comprehensive cross-SaaS solution that brings deep visibility, strong data controls, and enhanced threat protection to your cloud apps.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

subscribers to Microsoft Defender Threat Intelligence (Defender TI) can now access threat intelligence from

A

inside the Microsoft Defender portal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Microsoft Defender TI helps streamline

A

security analyst triage, incident response, threat hunting, and vulnerability management workflows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Microsoft Defender for Office 365

A

a seamless integration into your Office 365 subscription that provides protection against threats, like phishing and malware that arrive in email links (URLs), attachments, or collaboration tools like SharePoint, Teams, and Outlook

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

t or f

Defender for Office 365 does not provides real-time views of threats

A

false. it does provide real time views of threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Microsoft Defender for Office 365 safeguards organizations against malicious threats by providing admins and security operations (sec ops) teams a wide range of capabilities

A

Preset security policies
Threat protection policies
Reports
Threat investigation and response capabilities
Automated investigation and response capabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

preset security policies

A

allow you to apply protection features to users based on Microsoft recommended settings

A use case for preset security policies is during installation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Threat protection policies

A

define threat protection policies to set the appropriate level of protection for your organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Reports

A

view real time reports to monitor Microsoft Defender for Office 365 performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Threat investigation and response capabilities:

A

use leading-edge tools to investigate, understand, simulate, and prevent threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Automated investigation and response capabilities

A

Save time and effort investigating and mitigating threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Microsoft Defender for Office 365 is available in two plans

A

Plan 1
Plan 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

The security services of Defender for Office 365 are built on the core protections offered by

A

EOP - Exchange Online Protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

EOP - Exchange Online Protection

A

helps prevent broad, volume-based, known attacks and is present in any subscription where Exchange Online mailboxes can be found

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Microsoft Defender for Office 365 P1 contains

A

EOP in it plus protects email and collaboration from zero-day malware, phish, and business email compromise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Defender for Office 365 P2

A

contains P1 and EOP and adds post-breach investigation, hunting, response, automation, and training simulation.

The structure is cumulative.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Microsoft Defender for Endpoint

A

a platform designed to help enterprise networks protect endpoints including laptops, phones, tablets, PCs, access points, routers, and firewalls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Microsoft Defender for Endpoint tech includes

A

Endpoint behavioral sensors
Cloud Security analytics
Threat intelligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Microsoft Defender for Endpoint includes

A

Core Defender Vulnerability Management
Attack Surface reduction
Next generation protection
Endpoint detection and response
Automated investigation and remediation (AIR)
Microsoft Secure Score for Devices
Microsoft Threat Experts
Management and APIs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Core Defender Vulnerability Management:

A

use a risk based approach to the discovery, assessment, prioritization, and remediation of endpoint vulnerabilities and misconfigurations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Attack surface reduction

A

first line defense in the stack

By ensuring configuration settings are properly set and exploit mitigation techniques are applied, the capabilities resist attacks and exploitation.

also includes network protection and web protection, which regulate access to malicious IP addresses, domains, and URLs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Next generation protection

A

designed to catch all types of emerging threats

behavior based, heuristic, & real time antivirus protection

cloud delivered protection - includes near instant detection and blocking of new and emerging threats

dedicated protection and product updates - includes updates related to keeping Microsoft Defender Antivirus up to date

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Endpoint detection and response

A

Provides advanced attack detections that are near real time and actionable

Security analysts can prioritize alerts, see the full scope of a breach, and take response actions to remediate threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Automated investigation and remediation (AIR)

A

capabilities are designed to examine alerts and take immediate action to resolve breaches

significantly reduce alert volume, allowing security operations to focus on more sophisticated threats and other high-value initiatives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Microsoft Secure Score for Devices

A

helps you dynamically assess the security state of your enterprise network, identify unprotected systems, and take recommended actions to improve the overall security of your organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Microsoft Threat Experts

A

provides proactive hunting, prioritization, and additional context and insights that further empower Security operation centers (SOCs) to identify and respond to threats quickly and accurately.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Management and APIs

A

offers an API model designed to expose entities and capabilities through a standard Microsoft Entra ID based authentication and authorization model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

t or f

Microsoft Defender for Endpoint also integrates with various components in the Microsoft Defender suite, and with other Microsoft solutions including Intune and Microsoft Defender for Cloud.

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

How many plans are available for Microsoft Defender for Cloud?

A

2

plan 1 and plan 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

t or f

Microsoft Defender for Cloud Apps delivers full protection for SaaS applications

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Microsoft Defender for Cloud Apps helps monitor and protect app data with

A

Fundamental cloud access security broker (CASB)

SaaS security posture management (SSPM)

Advanced threat protection

app to app protection

40
Q

Fundamental cloud access security broker (CASB)

A

acts as a gatekeeper to broker real-time access between your enterprise users and the cloud resources they use

41
Q

SaaS security posture management (SSPM)

A

enable security teams to improve the organization’s security posture

42
Q

Advanced threat protection

A

enabling powerful correlation of signal and visibility across the full kill chain of advanced attacks

43
Q

app to app protection

A

extending the core threat scenarios to OAuth-enabled apps that have permissions and privileges to critical data and resources

44
Q

Defender for Cloud Apps shows the full picture with

A

Identify
Assess
Manage

45
Q

t or f

Defender for Cloud Apps connects to SaaS apps to scan for files containing sensitive data uncovering which data is stored where and who is accessing it

A

true

46
Q

How can Defender for Cloud apps protect data?

A

apply a sensitivity label

block downloads to an unmanaged device

remove external collaborators on confidential files

47
Q

The Defender for Cloud Apps integration with Microsoft Purview also enables

A

security teams to leverage out-of-the-box data classification types in their information protection policies and control sensitive information with data loss protection (DLP) features.

48
Q

SaaS Security Posture Management (SSPM)

A

Defender for Cloud Apps automatically provides SSPM data in Microsoft Secure Score, for any supported and connected app

49
Q

Defender for Cloud Apps offers built in

A

adaptive access control (AAC)

50
Q

OAuth

A

an open standard for token-based authentication and authorization, enables a user’s account information to be used by third-party services, without exposing the user’s password

51
Q

Microsoft Defender for Identity

A

cloud based security solution

uses your on-premises Active Directory data (called signals) to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization.

52
Q

Microsoft Defender for Identity provides security professionals managing hybrid environments functionality to:

A

monitor users, entity behavior, & activities with learning based analytics

protect user identities and credentials stored in AD

identify and investigate suspicious activities & advanced attacks

provide clear incident information on a simple timeline for fast triage

53
Q

t or f? Defender for Identity identifies anomalies with adaptive built in intelligence

A

true

54
Q

t or f

Defender for Identity gives insights into suspicious activities and events, revealing the advanced threats, compromised users, and insider threats facing your organization.

A

true

55
Q

kill chain:

A

reconnaissnce
compromised credentials
lateral movements
domain dominance

56
Q

Defender Vulnerability Management

A

delivers asset visibility, intelligent assessments, and built in remediation tools for Windows, macOS, Linux, Android, iOS, and network devices

57
Q

t or f

Defender Vulnerability Management rapidly and continuously prioritizes the biggest vulnerabilities on your most critical assets and provides security recommendations to mitigate risk

A

true

58
Q

t or f

Defender Vulnerability Management built-in and agentless scanners continuously monitor and detect risk in your organization even when devices aren’t connected to the corporate network.

A

true

59
Q

what does consolidated inventories provide real time views of?

A

visibility into software & vulnerabilities

network share assessment

browser extensions assessment

digital certificates assessment

60
Q

Risk-based intelligent prioritization

A

focuses on emerging threats to align the prioritization of security recommendations with vulnerabilities currently being exploited in the wild and emerging threats that pose the highest risk

61
Q

Risk-based intelligent prioritization pinpoints

A

active breaches and protects high value assets

62
Q

Remediation request sent to IT

A

create a remediation task in Microsoft Intune from a specific security recommendation

63
Q

Block vulnerable applications

A

mitigate risk with the ability to block vulnerable applications for specific device groups

64
Q

Alternate mitigations

A

gain insights on other mitigations, such as configuration changes that can reduce risk associated with software vulnerabilities

65
Q

Real time remediation status

A

real time monitoring of the status and progress of remediation activities across the organization

66
Q

You can use the vulnerability management capability in the Microsoft Defender portal to

A

view exposure score & Microsoft Secure Score

correlate endpoint detection and response (EDR)

select & track remediation options

select & track exception options

67
Q

Microsoft Defender Threat Intelligence (Defender TI)

A

helps streamline security analyst triage, incident response, threat hinting, and vulnerability management workflows

68
Q

Defender TI Articles

A

provide insight into threat actors, tooling, attacks, and vulnerabilities

69
Q

t or f

Defender TI Articles link actionable content and key indicators of compromise to help users take action

A

True

70
Q

Vulnerability articles

A

provide key context behind CVEs of interest

71
Q

t or f

Vulnerability Articles also include a Defender TI Priority Score and severity indicator (high, medium, low)

A

True

72
Q

Defender TI Priority Score

A

unique algorithm that reflects the priority of a CVE based on the Common Vulnerability Scoring System (CVSS) score, exploits, chatter, and linkage to malware

73
Q

internet data is categorized into two groups

A

traditional
advanced

74
Q

Traditional data sets

A

include Resolutions
WHOIS
SSL Certifications
Subdomains
DNS
Reserve DNS
Services

75
Q

How are Trackers, Components, Host Pairs, and Cookies data sets collected?

A

observing the Document Object Model (DOM) of web pages crawled.

76
Q

Defender TI provides proprietary reputation scores for any

A

host
domain
IP address

77
Q

Insights are meant to be

A

small facts or observations about a domain or IP address to determine if an indication is malicious, suspicious or benign

78
Q

Microsoft Defender portal combines

A

protection
detection
investigation
response to devices, identities, endpoints, email &collaboration and cloud apps in a central place

79
Q

Microsoft Defender portal is designed to

A

meet the needs of security teams
emphasize quick access to info
simpler layouts

80
Q

t or f

Through the Microsoft Defender portal you can view the security health of your organization.

A

true

81
Q

t or f

Microsoft defender portal is role based accessed

A

true

82
Q

What does it mean for Microsoft defender portal being role based accessed

A

every role will see cards that are more meaningful to their day to day jobs

83
Q

t or f

Admins can customize the navigation pane to show or hide functions and services based on their specific preferences

A

true

84
Q

t or f

Microsoft 365 services and apps create alerts when they detect a suspicious or malicious event or activity

A

true

85
Q

Selecting an incident name displays a summary of the incident and provides access to tabs with additional information, including:

A

full story of the attack - alerts, assets, remediation taken

all alerts
all assets
all automated investigations triggered
all the supported evidence and response

86
Q

Hunting

A

query-based threat hunting tool that lets you proactively inspect events in your organization to locate threat indicators and entities

87
Q

T OR F

You can build custom detection rules and hunt for specific threats in your environment.

A

true

88
Q

threat intelligence

A

threat analytics
intel profiles
intel explorer

89
Q

secure score in Microsoft Defender for Cloud

A

measure of the security posture of your Azure subscriptions

90
Q

Secure score in the Microsoft Defender portal

A

measure of the security posture of the organization across your apps, devices, and identities.

91
Q

Learning hub

A

bubbles up official guidance from resources

92
Q

reports

A

security reports
specific reports - endpoints, email & collab

93
Q

A lead admin for an organization is looking to protect against malicious threats posed by email messages, links (URLs), and collaboration tools. Which solution from the Microsoft Defender XDR suite is best suited for this purpose?

A

Microsoft Defender for Office 365.

94
Q

A cloud access security broker (CASB) provides protection across 4 areas/pillars: visibility to detect all cloud services, data security, threat protection, and compliance. These pillars represent the basis of the Cloud App Security framework upon which Microsoft Defender for Cloud Apps is built. Which pillar is responsible for identifying and controlling sensitive information?

A

data security

95
Q

Which of the following is a cloud-based security solution that identifies, detects, and helps to investigate advanced threats, compromised identities, and malicious insider actions directed at your organization?

A

microsoft defender for identity

96
Q

Admins in the organization are using the Microsoft Defender portal every day. They want to quickly get an understanding of the organization’s current security posture. Which capability in the Microsoft Defender portal will they use?

A

secure score

97
Q

Your security and IT teams want to implement a solution that helps address critical vulnerabilities and misconfigurations across your organization. Which solution in the Microsoft Defender XDR suite can help address these requirements?

A

Microsoft Defender Vulnerability Management.

Microsoft 365 Fundamentals MS-900 (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions