Match each Microsoft 365 Defender feature to its description.
Drag a concept onto its matching description — or click a concept then click the description.
Endpoint detection and response (EDR) and antivirus
Protection for email and collaboration tools
Detect and investigate advanced attacks on-premises
Cloud access security broker (CASB) for SaaS apps
Identify and remediate vulnerabilities
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Microsoft Defender for Endpoint: Provides endpoint detection and response (EDR) and antivirus across devices
The correct matches are: Microsoft Defender for Endpoint (endpoint protection), Microsoft Defender for Office 365 (email/collaboration protection), Microsoft Defender for Identity (on-premises threat detection via AD), and Microsoft Defender for Cloud Apps (SaaS security via CASB). The distractors swap the definitions of Endpoint and Office 365.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Microsoft Defender for Endpoint: Provides endpoint detection and response (EDR) and antivirus across devices
Why this is correct
Microsoft Defender for Endpoint is designed to protect endpoints with EDR and antivirus capabilities.
Microsoft Defender for Office 365: Protects email and collaboration tools from threats like phishing and malware
Why this is correct
Microsoft Defender for Office 365 safeguards email and collaboration platforms against phishing and malware.
Microsoft Defender for Identity: Identifies and investigates advanced threats on-premises using Active Directory signals
Why this is correct
Microsoft Defender for Identity uses AD signals to detect and investigate advanced threats in on-premises environments.
Microsoft Defender for Cloud Apps: Provides cloud access security broker (CASB) capabilities for SaaS applications
Why this is correct
Microsoft Defender for Cloud Apps acts as a CASB to secure SaaS applications.
Microsoft Defender for Endpoint: Protects email and collaboration tools
Why it's wrong here
Incorrect — this describes Microsoft Defender for Office 365, not Defender for Endpoint.
Microsoft Defender for Office 365: Provides endpoint detection and response
Why it's wrong here
Incorrect — this describes Microsoft Defender for Endpoint, not Defender for Office 365.
Go deeper
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise-grade security platform that protects devices, servers, and networks from advanced cyber threats by combining antivirus, endpoint detection and response, and automated investigation and remediation.
Key term
Anti-phishing policy
An anti-phishing policy is a set of rules and technical controls that organizations use to detect, block, and respond to email or message-based attacks that trick users into revealing sensitive information.
About these practice questions
Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.