MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
A security administrator needs to block outbound network connections from a compromised Windows device to command-and-control servers. The solution must work at the network layer and be centrally managed via Microsoft 365 Defender. Which feature should the administrator enable?
⚠ Common exam trap
Many exam-takers confuse 'network layer blocking' with Windows Firewall, but the question specifically requires a solution centrally managed via Microsoft 365 Defender, which Network Protection fulfills through the Defender for Endpoint security configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network Protection
Network Protection in Microsoft Defender for Endpoint blocks outbound connections to command-and-control (C2) servers at the network layer by inspecting traffic using the Windows Filtering Platform (WFP). It is centrally managed via Microsoft 365 Defender policies and does not require per-device firewall rule configuration, making it the correct choice for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Network Protection
Why this is correct
Network Protection in Microsoft Defender for Endpoint explicitly blocks outbound connections to malicious IP addresses, domains, and URLs using the Windows Filtering Platform. Unlike a static firewall rule, it dynamically enforces cloud-sourced threat intelligence, cutting off command-and-control traffic from a compromised device in real time. It is centrally configured and monitored through Microsoft 365 Defender, making it the correct tool for this network-layer containment scenario.
- ✗
Attack Surface Reduction rules
Why it's wrong here
Attack Surface Reduction rules are designed to prevent exploit techniques that originate on the host, such as blocking Office applications from creating child processes, executing macro payloads, or writing to removable drives. They do not inspect or filter TCP/IP packets or DNS queries destined for external endpoints, so they cannot interrupt an already active outbound communication channel. While they could block the initial compromise chain, they are ineffective once the device is compromised and needs network egress contained.
- ✗
Session control in Defender for Cloud Apps
Why it's wrong here
Session control in Defender for Cloud Apps operates as a reverse proxy for monitored SaaS applications, intercepting and applying conditional access policies at the HTTP/HTTPS session layer. It can restrict actions like downloads or uploads within a cloud app based on user and device risk, but it is transparent to traffic going to non-SaaS destinations and does not touch the bare network sockets or IP flows from the device. Thus, it cannot block an outbound connection from the system to a malicious endpoint regardless of the app involved.
- ✗
Windows Firewall with Advanced Security
Why it's wrong here
Windows Firewall with Advanced Security can indeed block outbound connections by creating rules for ports, programs, or IP address ranges, but it is not natively managed through the Microsoft 365 Defender portal. In a Windows domain, firewall policies are typically pushed via Group Policy, and in modern endpoint management via Configuration Manager or PowerShell, requiring separate, siloed administration. More importantly, it lacks the dynamic, cloud-sourced threat intelligence feeds that network protection uses, so its outbound rules are static and cannot automatically adapt to newly discovered malicious infrastructure during an incident.
Visual reference
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Firewall rule
A firewall rule is a set of conditions that tells a firewall which network traffic to allow or block based on attributes like source, destination, port, and protocol.
About these practice questions
This MS-102 question is part of Courseiva's 241-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.