MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Attack surface reduction rules

  Why this is correct

  Attack surface reduction (ASR) rules are a Windows Defender Exploit Guard capability that can specifically block process creation from common temporary folders (such as %Temp% and %AppData%) using a predefined rule like 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' or the explicit temp-folder rule, preventing malware from launching from file paths where droppers commonly execute. ASR rules are client-side, configured via Microsoft Intune, Configuration Manager, or GPO, and operate before the executable is allowed to spawn by intercepting process creation in the kernel and user-mode. This makes ASR the correct choice because it directly restricts executable execution based on file location and reputation, rather than merely restricting network or data access.

• ✗

  Network protection

  Why it's wrong here

  Network protection, also part of Windows Defender Exploit Guard, is designed to block outbound HTTP(S), DNS, or other connections to malicious IP addresses, URLs, and domains by inspecting network traffic using Microsoft's threat-intelligence feed. It does not evaluate local file paths, nor does it intercept CreateProcess calls, so an executable inside the temporary folders will launch and run normally until it attempts a network connection to a blocked endpoint. Therefore, while network protection can disrupt command-and-control traffic after infection, it cannot prevent the initial execution of a file from Temp, making it incorrect for this requirement.

• ✗

  Exploit protection

  Why it's wrong here

  Exploit protection is a suite of vulnerability-mitigation techniques, including Data Execution Prevention, Address Space Layout Randomization, Control Flow Guard, and Structured Exception Handler Overwrite Protection, that make memory-corruption bugs harder to exploit. These mitigations are applied to processes as they run, but they do not impose any restriction on which executable files can start or where they are located; the file from a temporary folder will execute and only then may have mitigations enforced on it. Although exploit protection can prevent some consequences of running a malicious binary, it cannot block the binary's execution from a temp path in the first place, so it is not the right mechanism.

• ✗

  Controlled folder access

  Why it's wrong here

  Controlled folder access is a Windows Defender Exploit Guard feature that protects specified folders, typically user documents and data directories, from unauthorized modifications by requiring applications to be explicitly trusted or as a known whitelisted process before they can write, delete, or rename files in those protected locations. It is a data-integrity safeguard focused on file-system writes, so a malicious executable in a temporary folder is not blocked from launching, and it can even run and execute before any attempt to modify a protected folder occurs. The feature does not filter process creation, and therefore it fails to satisfy a requirement to prevent users from running executables from the Windows temp folder.

Go deeper

Related to this question