CCNA Defender Xdr Security Questions

DeviceNetworkEvents is the advanced hunting table in Microsoft Defender XDR that records each network connection event on monitored endpoints, including LocalIP, RemoteIP, LocalPort, RemotePort, Protocol, and ActionType (e.g., ConnectionAttempt, ConnectionSuccess). For a custom detection rule that needs to flag suspicious outbound connectivity, this table is the authoritative source because every row represents an actual device-initiated or accepted network connection with the exact destination endpoint needed for threshold or indicator matching.

Custom indicators in Microsoft Defender for Endpoint let you define allow entries that override block decisions for specific URLs, files or certificates. Adding the business URL to the allow list permits access while the rest of the indicator and protection stack stays enforced, satisfying the requirement to unblock one legitimate site.

LSASS is the Windows Local Security Authority Subsystem, which stores or caches credentials for single sign-on. Attackers use tools like Mimikatz or process injection to read the memory of lsass.exe and extract password hashes or plaintext credentials. The Block credential stealing from the Windows local security authority subsystem (lsass.exe) ASR rule prevents untrusted and non-signed processes from accessing lsass.exe, directly disrupting this credential-theft technique before it can succeed.

DeviceInfo is the core table in Microsoft Defender for Endpoint's Advanced Hunting that maintains a comprehensive inventory of all onboarded devices, including device ID, device name, OS platform, OS version, and last seen timestamp. It is the authoritative source for answering questions like 'which devices run Windows 11' or 'what OS versions are present.' By querying DeviceInfo and filtering on the OSVersion column, you can quickly retrieve the required device details.

Anomaly Detection policies are the correct selection because they leverage User and Entity Behavior Analytics (UEBA) in Microsoft Defender for Cloud Apps to establish a baseline of normal user behavior and then generate alerts for deviations such as impossible travel, anonymous IP access, or mass file download. These policies employ machine learning to detect suspicious activities and can automatically trigger governance actions, directly meeting the security administrator's goal.

Automated investigation and response (AIR) in Microsoft Defender XDR automatically investigates alerts across endpoints, email, and identities, then applies remediation actions without analyst input. This directly satisfies the stem's requirement for hands-off response spanning all three workloads, unlike standalone playbooks or manual triage.

User impersonation protection compares the sender's display name and address against a defined list, so adding the CEO and CFO as protected users blocks spoofed messages impersonating those executives, directly meeting the stated targeting of frequent executive targets.

Safe Attachments detonates email attachments in a sandbox before delivery, and files found malicious are quarantined. Since the stem confirms Microsoft Defender for Office 365 quarantined the SharePoint file, malware detection by Safe Attachments is the mechanism that satisfies this constraint.

EmailEvents in Microsoft 365 Defender Advanced Hunting does not contain a column named SenderDomain; the domain can be accessed through SenderMailFromDomain (envelope domain) or SenderFromDomain (display domain). Because the query references an invalid schema field, the entire query fails with a recognized column not found error before any rows can be processed. Using the correct domain column would allow the hunt to run.

Enabling the 'Automatically resolve alerts' option instructs Defender for Endpoint's automated investigation engine to execute appropriate remediation actions and then close the alert when the investigation reaches a conclusion. This setting is the key to connecting determined threat severity with response steps, allowing alert incidents to be resolved without manual triage. It ensures that if remediation succeeds, the alert is automatically marked as resolved.

A domain user account with no privileges is the correct honeytoken because Microsoft Defender for Identity treats any authentication attempt using this account as suspicious. Since the account is a real Active Directory object, MDI can monitor and alert on its activity, and because it lacks any privileged group memberships or legitimate permissions, there is no valid reason for it to authenticate to any resource. This ensures that any authentication event involving the account is a high-confidence indicator of attacker activity, minimizing false positives while maximizing detection value.

Network Protection in Microsoft Defender for Endpoint explicitly blocks outbound connections to malicious IP addresses, domains, and URLs using the Windows Filtering Platform. Unlike a static firewall rule, it dynamically enforces cloud-sourced threat intelligence, cutting off command-and-control traffic from a compromised device in real time. It is centrally configured and monitored through Microsoft 365 Defender, making it the correct tool for this network-layer containment scenario.

DeviceFileEvents records file creation, modification and deletion activity on endpoints, so it surfaces the file writes and drops that malware typically performs. Including it in the advanced hunting query satisfies the requirement to gather device-level file telemetry alongside the other chosen sources.

Safe Links for Microsoft Teams rewrites and detonates URLs at click time, blocking malicious destinations even after delivery. This satisfies the stem's requirement to prevent future incidents, since the threat arrived via Teams chat rather than email, where Safe Links policies for Teams specifically apply.

DeviceNetworkEvents is the Advanced Hunting table that records network connections observed on a device, with dedicated columns such as RemoteIP, RemotePort, LocalIP, LocalPort, Protocol, and the initiating process details (InitiatingProcessId, InitiatingProcessFileName). To identify the specific process that made a given network connection, an analyst can query this table and filter by the remote endpoint or timestamp, then read the initiating process information directly. This is the only table in the Advanced Hunting schema purpose-built for correlating process activity with network endpoints.

File hash indicators are the correct solution because Microsoft Defender for Endpoint supports creating a file hash indicator with the action 'Block and Remediate,' which prevents the file from running and automatically removes matching files from protected devices. The indicator is honored by both the anti-malware engine and the behavior monitoring layer, so execution is stopped preemptively even before the process starts. This gives an immediate, global block across all onboarded endpoints.

Conditional Access App Control proxies sessions through Defender for Cloud Apps, enabling real-time inline enforcement such as blocking downloads to unmanaged devices. Session policies alone cannot block in real time, so this component satisfies the real-time blocking constraint for Salesforce.

Cloud-delivered protection is the core mechanism connecting Microsoft Defender for Endpoint to Microsoft's cloud security intelligence. When enabled, the endpoint sends telemetry to the cloud and receives near-real-time responses, including newly generated signatures, 'block at first sight' decisions, and behavioral detections. This low-latency, dynamic channel is exactly what ensures the device gets real-time signature updates, beyond the static definitions delivered by Microsoft Update.

Defender for Office 365 protects Exchange Online, SharePoint, OneDrive, and Microsoft Teams through features like anti-phishing, anti-spam, Safe Attachments, and Safe Links. It directly filters email traffic and inspects collaboration workloads for malicious content. This makes it the core email and collaboration protection component in Microsoft Defender XDR.

Adding the partner domain to the Tenant Allow/Block List overrides the quarantine verdict for that sender, satisfying the requirement that legitimate partner mail be delivered. Entries here take precedence over filtering verdicts, so messages bypass quarantine while spoofing and malware protection remain active for all other senders.

DeviceProcessEvents records process creation events with process, command-line and device details across endpoints, so filtering on a specific process name triggers alerts when it appears on multiple devices. This matches the stem's requirement for process-creation detection across endpoints.

AIR can automatically contain devices based on incident severity.

Anomaly detection policies detect unusual file download activity.

EmailEvents records the delivery outcome of each message, including whether it reached the inbox, satisfying the phishing-delivery half of the correlation. Joining it to UrlClickEvents on the NetworkMessageId links that delivered message to the subsequent click on the malicious URL, giving the advanced hunting query both required events.

Indicators of compromise let analysts submit a file hash as a custom indicator, and Defender for Endpoint enforces block or allow actions across all onboarded endpoints. This satisfies the requirement to block the file organisation-wide immediately.

Microsoft Defender for Endpoint device control is the correct capability because it is purpose-built to enforce flexible policies on peripheral devices, especially USB storage. Device control policies define rules based on device instance IDs, hardware IDs, or device classes, and support actions such as allow, deny, or audit. This allows an administrator to create a policy that permits only company-approved USB devices (matched by their hardware IDs) while blocking all other USB devices, meeting the stated requirement directly.

Safe Attachments and Safe Links with Block action automatically block malicious content based on real-time threat intelligence. Safe Attachments detonates attachments in a sandbox, and Safe Links checks URLs at time of click, blocking access if malicious. This provides automatic protection without manual intervention, directly meeting the requirement.

IdentityDirectoryEvents captures directory-level changes, including account disablement, from Microsoft Defender for Identity. By joining with DeviceLogonEvents, you can correlate the disabled account with active sessions on devices. This combination directly addresses the scenario's requirement to detect when a disabled user still has an active device session, making it the correct approach for the custom detection rule.

The query aggregates encoded command usage per device, so its purpose is surfacing endpoints whose PowerShell or shell activity is heavily encoded. High encoded-command counts frequently indicate obfuscated malicious execution, making this a threat-hunting signal rather than a compliance or inventory check.

DeviceProcessEvents captures process creation, including PowerShell command lines, satisfying the requirement to detect script execution. However, it does not record network connections, so pairing it with DeviceNetworkEvents is necessary to identify the connection to the known malicious IP address.

Activity policies in Microsoft Defender for Cloud Apps inspect user activity events and raise alerts on matching conditions. Configuring one with an anonymous IP filter detects access from anonymising proxies or Tor, satisfying the stem's requirement to alert on anonymous IP access.

Alert suppression rules in Microsoft Defender for Endpoint let you suppress specific alerts for defined scopes, such as a device group, file hash, IP address, or URL. Scoping the rule to the custom application and the affected devices stops the noisy alert while leaving all other detections active, which matches the requirement to keep investigating other alerts.

A submission policy in the Microsoft 365 Defender portal defines how user-reported messages are handled, including automatic submission to Microsoft for analysis and configuring notifications back to the reporting user. This directly satisfies the requirement to submit reported phishing emails and notify users of the verdict.

This ASR rule blocks executables from running in common writable folders, including %TEMP%, unless the executable is prevalent, old enough, or on an allowlist. It uses cloud-based reputation to evaluate the file's prevalence and age, allowing trusted files while blocking unknown or untrusted ones. Since the scenario requires blocking .exe and .ps1 files from launching in the temporary folder, this reputation-based filter is the correct mitigation.

Automated Investigation and Response (AIR) in Microsoft 365 Defender orchestrates security playbooks across endpoints, email, and identity signals, automatically collecting evidence, initiating investigations, and executing remediation actions such as quarantining files, suspending accounts, and blocking URLs. AIR leverages AI and predefined automation rules to contain low-impact threats in real time, with optional human approval for destructive actions.

Advanced hunting in Microsoft Defender XDR is a KQL-based query tool that gives you access to raw telemetry stored in a structured schema, including tables such as DeviceProcessEvents, DeviceNetworkEvents, and EmailAttachmentInfo. You can run a query on a suspicious script hash, process name, or command line to identify every endpoint and mailbox where that script may have appeared, enabling cross-domain threat hunting. This direct access to historical, correlated data makes it the correct choice for a cross-device investigation.

A honeytoken account is a decoy identity with no legitimate purpose, so any authentication attempt against it signals malicious reconnaissance or credential misuse. Defender for Identity alerts on such activity, exposing attackers probing Active Directory without generating false positives from real users.

Logging into multiple servers with one compromised account is classic lateral movement; Microsoft Defender for Identity detects this via its account reconnaissance and lateral movement detections, correlating authentication events across domain controllers to flag abnormal spread that satisfies the monitoring scenario.

Advanced Hunting's Kusto Query Language results can be saved as custom detection rules, which run on a schedule and trigger alerts or automated response actions. This satisfies the stem's requirement for an action available directly within Microsoft Defender XDR, rather than relying on a separate portal or service.

Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that discovers sanctioned and unsanctioned cloud apps, assesses risk via the Cloud App Catalog, and enforces real-time session and access policies. It can restrict risky app usage using conditional access app controls, block downloads, or apply DLP checks across thousands of third-party SaaS services — capabilities no workload-specific Defender product can provide.

Enabling 'Send reported messages to Microsoft' and 'Notify users when analysis completes' in the User reported messages settings routes reports automatically and returns verdicts to users, satisfying the minimal administrative effort constraint without custom flows or policies.

This setting allows you to define a list of specific users (e.g., executives) whose email addresses are protected from being impersonated in inbound emails. When impersonation is detected, the action defined in the policy is applied.

IdentityLogonEvents is the correct table because it records authentication and logon events, including those that occur when an account attempts to replicate domain data via DRSUAPI. During a DCSync attack, the attacker's replication request appears as a logon event with specific attributes, such as a particular logon type or the use of replication privileges. Running a KQL query against IdentityLogonEvents allows you to filter for these suspicious patterns, such as account names, source IPs, and timing, making it the proper source for identifying replication attempts in Advanced Hunting.

This session policy works through the Microsoft Defender for Cloud Apps reverse proxy, which intercepts and inspects user requests in real time. By combining a 'device as unmanaged' condition with a sensitivity-label file filter, it can block the actual download action at the moment it occurs while still letting the user access the file in the browser. This is the only option that fulfills the requirement of allowing access but preventing a download from an unmanaged device.

Custom indicators in Defender for Endpoint allow you to define file hashes or certificates to block or allow. By setting the action to 'Block and remediate' and scoping to all devices, you ensure the file is blocked organization-wide. This directly meets the requirement.

Attack Simulation Training is the dedicated feature in Microsoft Defender for Office 365 designed to create realistic phishing simulations and assign targeted training to users who interact with them. It provides prebuilt simulation templates, tracks metrics like click rate and credential submission, and automates follow-up training to improve user resilience. This matches the requirement to simulate a phishing attack and measure user response, so it is the correct answer.

Safe Attachments routes email attachments to a hypervisor-isolated detonation chamber where files are opened and executed in a virtual environment to observe behavioral indicators. The resulting signals, combined with global threat intelligence, identify zero-day malware and trigger actions such as blocking, replacing, or alerting before delivery to the user.

AIR action policies allow administrators to define automatic responses to specific alert types. By setting the isolation action for high-severity alerts from Microsoft Defender for Endpoint, the device can be isolated automatically without manual intervention.

An Activity policy is the correct choice because it gives you full control to create a conditional rule that matches a specific activity, such as downloading a file, and then combines it with parameters like the user, device, IP address, or even a repeated-activity threshold. You can set the policy to trigger when a user performs more than a defined number of downloads within a short period, which directly detects mass download behavior. This is the standard mechanism in Defender for Cloud Apps for defining custom, business-specific activity monitoring.

The Microsoft 365 Defender portal at security.microsoft.com provides a unified incidents queue that aggregates alerts from Microsoft Defender for Endpoint, Office 365, Identity, and Cloud Apps. This is the central location for cross-domain incident management, meeting the analyst's need for a unified view.

Activity policies in Microsoft Defender for Cloud Apps evaluate user activity against filters such as anonymous IP proxy, generating alerts when a sanctioned app is accessed from an anonymising source. This matches the detection requirement precisely.

This is precisely the purpose of Microsoft Purview DLP: it uses sensitive information types, trainable classifiers, and exact data match to detect and prevent the unauthorized sharing of sensitive data across email, SharePoint, OneDrive, Teams, and endpoints. When a policy match occurs, DLP can block transmission, notify users with tips, or restrict access, thereby protecting regulated data such as financial and health information. DLP's scope extends beyond email to multiple channels, making this the accurate description of its core functionality.

AIR can automatically remediate endpoint artefacts by removing or quarantining malicious files that Defender for Endpoint detects, directly containing ransomware payloads without analyst intervention. This satisfies the scenario's requirement to contain the threat across affected endpoints.

DeviceNetworkEvents records network connections including remote IPs. IPReputation provides Microsoft's threat intelligence score for IP addresses, allowing the rule to filter for connections to flagged IPs. These tables can be joined on the RemoteIP column.

DeviceNetworkEvents is the correct table because it records actual network connection events, including TCP, UDP, and ICMP traffic, with fields such as RemoteIP, RemotePort, LocalIP, LocalPort, and Protocol. A custom detection rule can filter directly on RemoteIP to flag connections to a known malicious IP address. It also provides DeviceId and other machine identifiers, enabling correlation with process and user context. This table is specifically designed for hunting network-based threats, making it the appropriate choice for IP-based detection rules.

The policy applies only when both the user risk and sign-in risk conditions are satisfied at the same time, because the conditions are joined with AND logic. For example, even if user risk is High, a sign-in risk of Low prevents the policy from triggering. This simultaneous requirement is the key to understanding when the block control will be enforced.

Session policies are the correct mechanism to prevent uploads because they utilize the Conditional Access App Control reverse proxy to intercept every HTTP request and response within an active cloud app session. The reverse proxy inspects the request payload and can identify a file upload attempt to unsanctioned storage, then block the action in real time or prompt the user with a warning. This capability is session-scoped, meaning it can allow other activities like reading or downloading while specifically blocking uploads. Thus a session policy provides the precise, real-time enforcement the requirement demands.

The Security Administrator role in Microsoft Entra ID grants the permissions needed to configure automated investigation and remediation settings in the Microsoft 365 Defender portal, satisfying the requirement to manage Defender XDR automation across email, endpoints and identities.

Verifying with the user confirms whether the failed logons are genuine mistyping or credential-stuffing before escalating. This satisfies the recommended first step, since contacting the account owner quickly establishes legitimacy without prematurely disabling a Finance user's access.

Isolate the affected device using Microsoft Defender for Endpoint's device isolation capability. Containment blocks all network traffic to and from the endpoint, including SMB and RDP, while preserving the management channel so Defender can continue telemetry and remediation. This immediately halts ransomware propagation, lateral movement, and command-and-control communication, giving responders time to analyze and remediate safely.

Automated investigation and response for email is the correct capability because it directly addresses threats found in email messages, including phishing, malware, and spam. When a suspicious email is detected, this AIR capability automatically launches an investigation, gathers evidence, and can take built-in remediation actions such as soft-deleting the message from all mailboxes, quarantining it, or blocking the sender. This is the only AIR workflow specifically tuned for email-borne threats in Microsoft 365 Defender.

Advanced hunting in Microsoft Defender for Endpoint allows you to write KQL queries against raw event data, and custom detection rules can be created from these queries to run on a schedule, such as hourly, and generate alerts when conditions are met. This is the correct method to detect process execution like mimikatz.exe.

Attack simulation training in Microsoft Defender for Office 365 is the dedicated capability for creating and launching realistic phishing simulations. It provides pre-built payload templates and enables you to target specific users or groups, then track who clicked, submitted credentials, or reported the simulated message. This is the only option that actively generates simulated threats rather than enforcing protection on live traffic.

Cloud Discovery is the feature in Microsoft Defender for Cloud Apps that ingests and analyzes traffic logs from network proxies and firewalls to identify all cloud apps in use, including unsanctioned shadow IT. It assigns risk scores to each discovered app and allows you to sanction or unsanction them based on organizational policy. This analysis is the foundational step for any subsequent control, such as Conditional Access App Control.

Microsoft 365 Defender portal (security.microsoft.com) is the single security operations console that aggregates alerts and incidents from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. Its unified incident queue correlates related alerts into a single incident, enabling triage, investigation, and response across all Microsoft 365 Defender workloads. This portal is the correct destination for viewing a unified incident queue.

The 'Activity from risky IP address' template is a built-in anomaly detection policy in Microsoft Defender for Cloud Apps that leverages Microsoft threat intelligence to identify IP addresses associated with malicious activity, such as anonymous proxies, Tor exit nodes, or known botnets. When a user performs an activity from one of these IPs, the policy generates an alert, giving security teams immediate visibility into the potentially compromised session. This is exactly the alerting capability needed in this scenario.

Together, these tables provide a complete attack chain: IdentityLogonEvents records sign-in and logon attempts, revealing suspicious authentication patterns tied to a specific account; EmailEvents tracks email send/receive activity, enabling correlation of a phishing email or malicious attachment; and DeviceProcessEvents logs process creation, which exposes lateral movement when a compromised account launches a remote service, script, or executable. Joining these tables on user SID and device ID lets an investigator reconstruct the timeline from email receipt to identity compromise to endpoint execution.

Submissions in Microsoft Defender XDR lets administrators send user-reported or suspicious emails, including attachments, for automated investigation and rescanning. It satisfies the requirement because the message was delivered, so it must be submitted manually rather than relying on EOP blocking.

The Incident summary report is a built-in Defender XDR report that aggregates incident classifications, including true positive, false positive and benign counts, over a selectable period such as 30 days. It satisfies the no-custom-queries constraint directly, unlike advanced hunting or custom workbooks.

Threat Explorer provides message trace, detection technology and delivery location per email, letting you determine which anti-phishing control failed and why. It is the Microsoft Defender for Office 365 tool built for investigating individual messages.

Automated Investigation and Response (AIR) is a premium Plan 2 capability that uses orchestration and automation to investigate alerts, analyze threat signals, and take recommended or automated remediation actions. It goes beyond passive detection by proactively resolving incidents without requiring continuous manual oversight, making it a key differentiator for Plan 2 licensing.

The query returned zero rows because no antivirus detection events with a filename containing the exact term 'ransomware' or 'encrypt' were logged in the last 7 days. This is a valid, actionable result; it does not mean the query is flawed. To uncover broader suspicious activity, reduce reliance on the filename term match or use contains for substring matching, and consider expanding the time range or adding related tables like DeviceFileEvents.

Content inspection, such as DLP, examines the file payload to confirm it actually contains sensitive data, satisfying the stem's sensitive-data condition. Sharing filters alone cannot determine content; inspection is what distinguishes a genuine sensitive-data exposure from an ordinary external share.

This Attack Surface Reduction (ASR) rule, identified by rule GUID 26190899-1602-49e8-8b27-eb1d0a1ce869, specifically targets the parent-child relationship where winword.exe, excel.exe, or powerpnt.exe attempts to launch any secondary executable. By blocking the creation of child processes such as cmd.exe, powershell.exe, or wscript.exe, it directly neutralizes the described macro-based attack chain before the payload can execute. This is the only option among these that was designed to stop exactly this process-spawn behavior.