Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

A security team needs to detect and automatically respond to ransomware attacks on Windows servers and desktops. They require the solution to automatically isolate affected devices from the network and, if necessary, roll back files that have been modified by ransomware using a built-in recovery feature. Which Microsoft security solution provides these specific capabilities?

⚠ Common exam trap

A common mix-up: candidates confuse Microsoft Defender for Cloud Apps (a CASB) with endpoint protection, or assume that Defender for Office 365 covers all ransomware scenarios, when in fact only Defender for Endpoint provides the specific combination of device isolation and file rollback on Windows endpoints.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Microsoft Defender for Endpoint

Microsoft Defender for Endpoint (MDE) provides automated investigation and remediation capabilities that include network containment (isolating a device from the network) and rollback of files modified by ransomware using its built-in recovery feature. This is achieved through MDE's endpoint detection and response (EDR) and automated investigation capabilities, which can trigger device isolation and file restoration from Volume Shadow Copy or MDE's own rollback mechanism.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing visibility, control, and protection for cloud applications and data. Its primary role involves discovering shadow IT, enforcing data loss prevention policies across SaaS apps, and identifying risky usage patterns. It operates at the cloud service layer, not on individual endpoint devices, meaning it cannot perform device isolation or roll back files on a local machine.
✓
Microsoft Defender for Endpoint
Why this is correct
Microsoft Defender for Endpoint is a comprehensive Endpoint Detection and Response (EDR) solution designed to protect devices from advanced threats. It offers robust capabilities for automated investigation and remediation, including isolating compromised endpoints from the network to contain threats. Furthermore, it provides advanced features like file rollback, crucial for recovering from ransomware attacks by restoring files to their pre-attack state using cloud-delivered protection.
✗
Microsoft Defender for Office 365
Why it's wrong here
Microsoft Defender for Office 365 specializes in protecting an organization's email, collaboration, and productivity services within the Microsoft 365 suite. It safeguards against phishing, malware, spam, and other threats targeting Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. This service focuses on content and communication security within the cloud environment and does not extend to managing or remediating issues on endpoint devices like desktops or servers.
✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity is an identity-based security solution focused on detecting advanced threats and anomalous activities targeting on-premises Active Directory and other identity sources. It monitors user behavior, identifies suspicious authentications, and detects lateral movement techniques to protect against identity compromise. While critical for securing the identity plane, it does not provide direct endpoint device management, isolation, or file system recovery capabilities.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Why each option matters

Option-by-option breakdown

Related to this question