MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Block credential stealing from the Windows local security authority subsystem (lsass.exe).

  Why this is correct

  LSASS is the Windows Local Security Authority Subsystem, which stores or caches credentials for single sign-on. Attackers use tools like Mimikatz or process injection to read the memory of lsass.exe and extract password hashes or plaintext credentials. The Block credential stealing from the Windows local security authority subsystem (lsass.exe) ASR rule prevents untrusted and non-signed processes from accessing lsass.exe, directly disrupting this credential-theft technique before it can succeed.

• ✗

  Block executable files from running unless they meet a prevalence, age, or trusted list criterion.

  Why it's wrong here

  The ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' restricts execution of unknown or untrusted executables, which helps stop malicious binaries and ransomware payloads. However, it does not specifically protect lsass.exe because credential theft can be performed using built-in, signed Microsoft tools such as PowerShell or a remote administration utility that are already trusted. An attacker with local administrator rights can also use a driver or reflective DLL that bypasses this generic executable block, leaving LSASS memory exposed. This rule is a general anti-malware control, not a targeted countermeasure for credential theft.

• ✗

  Block Office applications from creating child processes.

  Why it's wrong here

  Blocking Office applications from creating child processes is designed to prevent phishing attacks where malicious documents use macros to spawn PowerShell, cmd.exe, or other scripting engines. While this does stop one lateral-movement and payload-download chain, credential stealers do not rely on Office child processes to access LSASS. An attacker can directly call APIs such as NtOpenProcess and MiniDumpWriteDump on lsass.exe from a standalone process, or use a service like Local Security Authority (LSA) protection bypass, without launching any child from an Office app. Thus this rule addresses a different attack vector and does not mitigate LSASS credential theft.

• ✗

  Block persistence through Windows Management Instrumentation (WMI) event subscription.

  Why it's wrong here

  The WMI event subscription rule blocks attackers from creating permanent WMI event consumers and filters to achieve persistence, which is a technique for surviving reboots and maintaining a foothold on the system. Credential theft from LSASS occurs in the 'credential access' phase of the attack chain, not the 'persistence' phase. An attacker on a compromised host may already have elevated privileges and can run Mimikatz or a custom tool directly, without needing any WMI subscription. Therefore, while this rule is valuable for defense-in-depth against persistence, it is unrelated to preventing the theft of credentials stored in lsass.exe.

Go deeper

Related to this question