MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
A security administrator wants to prevent malware from using Office macros to spawn malicious processes. Specifically, they want to block Excel, Word, and PowerPoint from creating child processes. Which Microsoft Defender for Endpoint capability should be configured?
⚠ Common exam trap
Test-takers frequently confuse Attack Surface Reduction rules with other Defender for Endpoint capabilities like Network Protection or Web Protection, mistakenly thinking that blocking network traffic is equivalent to blocking local process creation, when ASR rules are the only option that directly controls child process spawning from Office apps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attack Surface Reduction (ASR) rules
Attack Surface Reduction (ASR) rules are a Microsoft Defender for Endpoint capability specifically designed to block common malware behaviors, such as Office applications (Excel, Word, PowerPoint) from creating child processes. This rule (GUID: 26190899-1602-49e8-8b27-eb1d0a1ce869) prevents macros from spawning cmd.exe, powershell.exe, or other executables, directly addressing the administrator's requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Threat & Vulnerability Management
Why it's wrong here
Threat & Vulnerability Management (TVM) in Microsoft Defender Vulnerability Management is designed to discover, assess, and prioritize software vulnerabilities and security misconfigurations across endpoints. It provides risk-based ranking and remediation recommendations, but it does not enforce real-time execution controls. Because it does not inspect or block child process creation from Office applications, it cannot prevent macro-spawned malicious processes.
- ✓
Attack Surface Reduction (ASR) rules
Why this is correct
Attack Surface Reduction (ASR) rules are the correct control because they specifically target common attack techniques, including the rule 'Block Office applications from creating child processes.' This rule, identified by GUID e6db97e8-5c6a-4b3f-b3a4-6c3e2f3d4e5f (actual GUID: d4f6c3e7-4c1a-4f2b-9a5b-9d3f2a1c6b4e), uses behavior-based monitoring to prevent Office executables like WINWORD.EXE or EXCEL.EXE from launching other processes such as PowerShell or cmd.exe. This directly stops macro malware from executing its payload, including zero-day variants that no signature would catch.
- ✗
Web Protection
Why it's wrong here
Web Protection in Microsoft Defender for Endpoint protects users from malicious websites by using SmartScreen and custom URL indicators to block unsafe browsing. It operates at the HTTP/HTTPS layer, preventing access to phishing sites or drive-by download hosts. However, it has no visibility into local process creation: when an Office macro spawns a child process, no URL is involved, so Web Protection cannot intercept that activity.
- ✗
Network Protection
Why it's wrong here
Network Protection is a Defender for Endpoint feature that uses the Windows Filtering Platform to block outbound connections to malicious IP addresses, domains, and URLs. It is effective at stopping command-and-control traffic or remote payload retrieval after an infection, but it does not control local process execution. A macro can create a malicious child process entirely offline before any network connection is attempted, so Network Protection is unable to block the initial process spawn.
Go deeper
Related to this question
Learn chapter
Anti-Spam and Anti-Malware Policies
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Attack surface reduction
Attack surface reduction is a set of security practices that minimizes the number of ways an attacker can access or exploit a system by removing unnecessary features, locking down configurations, and controlling software behavior.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.