MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Attack surface reduction (ASR) rules

  Why it's wrong here

  ASR rules are designed to mitigate specific attack techniques—such as blocking Office apps from creating child processes, preventing script obfuscation, or stopping credential theft—rather than controlling general network egress. They evaluate process behavior and file/script actions on the endpoint, not the destination IP address or port of an outbound connection. A compromised Windows machine attempting to beacon to a command-and-control (C2) server on an arbitrary IP would not be blocked by an ASR rule because that action does not match the rule's behavior-based conditions. Therefore, while ASR reduces initial infection vectors and some post-exploitation actions, it is not a network-layer egress control.

• ✗

  Custom detection rules (advanced hunting)

  Why it's wrong here

  Custom detection rules in advanced hunting let you create scheduled queries that generate alerts when specific events or patterns are found in log telemetry. However, the output of a custom detection rule is strictly alerting and incident-triggering; it has no enforcement or remediation capability to stop a network connection at the moment it occurs. You would still need to integrate with a separate response action, such as an automated playbook or a firewall rule, to actually block the traffic. Since the requirement is to block outbound connections from an already compromised device, a rule that only notifies after the fact cannot prevent the communication.

• ✓

  Network protection

  Why this is correct

  Network protection in Microsoft Defender for Endpoint works at the network layer and is specifically designed to block outbound connections to malicious domains, IP addresses, and URLs. It intercepts traffic from applications and the OS, inspecting connections against Microsoft's cloud-based threat intelligence feed, and if a match is found, the connection is dropped and a warning is shown to the user. In the context of a compromised Windows device, this provides the necessary automatic blocking of outbound callbacks to attacker-controlled infrastructure. It can also be deployed in block mode or audit mode, and when enabled it leverages the Windows Filtering Platform rather than only DNS-based filtering, so direct IP connections are covered.

• ✗

  Web protection (web threat protection)

  Why it's wrong here

  Web protection (part of Microsoft Defender for SmartScreen and Microsoft Defender for Endpoint) focuses on URL and domain reputation—blocking browser-based access to phishing sites, malicious downloads, and category-based restrictions like gambling or adult content. Its enforcement is primarily HTTP/HTTPS-centric and it does not natively control outbound connections to arbitrary IP addresses on non-standard ports, nor does it govern non-browser processes such as malware making a raw socket connection. Network protection is the correct feature for IP-level egress control because it operates below the application layer and inspects all outbound traffic, including the compromised process's direct connections to C2 infrastructure.

Go deeper

Related to this question