MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Block executable files from running unless they meet a prevalence, age, or trusted list criterion.

  Why this is correct

  This is the correct Attack Surface Reduction (ASR) rule, GUID 01443614-cd74-433a-b99e-2ecdc07bfc25, which blocks executables that lack sufficient prevalence, age, or a trusted-list entry. It leverages cloud-delivered reputation checks and admin-defined trusted files to stop unknown binaries that commonly execute from writable system directories such as %TEMP%, %APPDATA%, and C:\Users\Public, where persistence mechanisms are often planted. This directly enforces the requirement to block executable files from running from writable system locations while still allowing known legitimate software.

• ✗

  Block Office communication application from creating child processes.

  Why it's wrong here

  This ASR rule prevents Office communication applications such as Outlook, Skype for Business, and Teams from spawning child processes like PowerShell or cmd.exe, which is a common post-exploitation technique for phishing payloads. However, it is scoped to process creation from Office communication software and does not evaluate the location or writability of the executable itself. It therefore fails to address the stem's requirement of blocking executable files from running from writable system directories, so it is not the correct rule.

• ✗

  Block credential stealing from the Windows local security authority subsystem (lsass.exe).

  Why it's wrong here

  This ASR rule, also known as Block credential stealing from the Windows local security authority subsystem (lsass.exe), mitigates credential dumping by preventing suspicious processes from opening LSASS memory handles or accessing it in ways consistent with Mimikatz and other dumping tools. It targets Credential Guard and LSA protection bypass attempts, not the execution of arbitrary executables sourced from writable system paths. Since it does not restrict where binaries launch from, it cannot satisfy the given requirement.

• ✗

  Block executable content from email client and webmail.

  Why it's wrong here

  This ASR rule blocks executable content such as .exe, .scr, .js, and .cmd files from being launched from email clients and webmail applications, primarily to stop malicious attachments that arrive via phishing emails. The rule is tied to the email client as the delivery vector, not to the file system location from which an executable runs. It does not provide any protection for writable system directories as a source of execution, making it an incorrect match for the stem.

Go deeper

Related to this question