Manage security and threats by using Microsoft Defender XDR →mediumMultiple ChoiceObjective-mapped

MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

A security analyst has identified a new malware sample with a specific SHA256 hash. The analyst needs to immediately block this file from executing on any managed endpoint across the organization, including prevention of future execution. Which Microsoft Defender for Endpoint capability should the analyst use?

⚠ Common exam trap

Many exam-takers confuse ASR rules (which block behaviors) with IoC-based blocking (which blocks specific file hashes), or they assume custom detection rules can directly block execution when they only generate alerts or run limited response actions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Indicators (IoCs) for file hashes

Indicators of Compromise (IoCs) for file hashes in Microsoft Defender for Endpoint allow an analyst to create a block indicator for a specific SHA256 hash. This action immediately prevents the file from executing on any managed endpoint and persists across reboots, effectively blocking future execution attempts. Unlike other capabilities, IoCs provide a direct, hash-based block that is enforced by the Microsoft Defender Antivirus engine at the point of execution.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Attack surface reduction (ASR) rules
Why it's wrong here
ASR rules apply to behavior-based attack techniques rather than file identity. For example, they can block Office applications from spawning child processes or block scripts from launching download payloads, but they have no mechanism to match a concrete file SHA-256 value. Therefore, a specific malware sample's hash cannot be added to ASR rules to prevent execution.
✓
Indicators (IoCs) for file hashes
Why this is correct
File hash indicators are the correct solution because Microsoft Defender for Endpoint supports creating a file hash indicator with the action 'Block and Remediate,' which prevents the file from running and automatically removes matching files from protected devices. The indicator is honored by both the anti-malware engine and the behavior monitoring layer, so execution is stopped preemptively even before the process starts. This gives an immediate, global block across all onboarded endpoints.
✗
Custom detection rules via advanced hunting
Why it's wrong here
Custom detections built on advanced hunting are strictly reactive: they run scheduled queries against stored telemetry and produce alerts when the query matches conditions. They do not have a built-in remediation action, such as forcing the OS to deny execution of a file hash, and cannot quarantine the file at rest. Their purpose is to highlight suspicious activity, not to block a known-bad hash in real time.
✗
Microsoft Defender Vulnerability Management
Why it's wrong here
Microsoft Defender Vulnerability Management focuses on reducing organizational risk by identifying software vulnerabilities, misconfigurations, and exposed attack surface. It provides security recommendations and remediation efforts for CVEs and configuration weaknesses, but it has no feature to ingest a file hash and block it from executing. Its role is proactive hardening, not acting as a denial list for a specific malware binary.

Go deeper

MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Why each option matters

Option-by-option breakdown

Related to this question