- A
Microsoft Defender Antivirus
Why wrong: Antivirus detects and removes known malware but does not block behaviors like Office creating child processes or execution from %TEMP%.
- B
Attack surface reduction rules
These rules target specific malware techniques, such as blocking Office applications from creating child processes and blocking executable files from running from common temporary folders.
- C
Network protection
Why wrong: Network protection prevents connections to malicious IPs or domains, not local process behaviors.
- D
Controlled folder access
Why wrong: Controlled folder access protects files in specified folders from ransomware and other unauthorized changes, but does not block the described process behaviors.
Question 74 of 1,411
SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
This SC-900 practice question tests your understanding of describe the capabilities of microsoft security solutions. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company wants to reduce the attack surface on its Windows devices by blocking common techniques used by malware, such as preventing Office applications from creating child processes or blocking executable files from running from the %TEMP% folder. Which Microsoft Defender for Endpoint feature should be configured?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attack surface reduction rules
Attack surface reduction (ASR) rules are a feature of Microsoft Defender for Endpoint that specifically target common malware behaviors, such as blocking Office applications from creating child processes and preventing executable files from running from the %TEMP% folder. These rules are designed to reduce the attack surface by enforcing policies that stop suspicious or malicious actions at the process level, without relying solely on signature-based detection.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender Antivirus
Why it's wrong here
Antivirus detects and removes known malware but does not block behaviors like Office creating child processes or execution from %TEMP%.
When this WOULD be correct
A question asking which Microsoft Defender for Endpoint component provides real-time antivirus scanning, signature-based detection, and remediation of known malware on Windows devices would have Microsoft Defender Antivirus as the correct answer.
- ✓
Attack surface reduction rules
Why this is correct
These rules target specific malware techniques, such as blocking Office applications from creating child processes and blocking executable files from running from common temporary folders.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Network protection
Why it's wrong here
Network protection prevents connections to malicious IPs or domains, not local process behaviors.
When this WOULD be correct
A question asking for a feature that blocks outbound connections to malicious URLs or IP addresses, such as preventing a device from contacting a known command-and-control server.
- ✗
Controlled folder access
Why it's wrong here
Controlled folder access protects files in specified folders from ransomware and other unauthorized changes, but does not block the described process behaviors.
When this WOULD be correct
A question asks: 'Which Microsoft Defender for Endpoint feature should be configured to prevent unauthorized applications from modifying files in protected folders, such as Documents and Pictures?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Attack surface reduction rulesCorrect answer▾
Why this is correct
These rules target specific malware techniques, such as blocking Office applications from creating child processes and blocking executable files from running from common temporary folders.
✗Microsoft Defender AntivirusWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender Antivirus provides real-time protection against malware by scanning files and processes, but it does not specifically block behaviors like Office apps creating child processes or executables running from %TEMP%. Those are behavioral restrictions enforced by Attack Surface Reduction (ASR) rules.
★ When this WOULD be the correct answer
A question asking which Microsoft Defender for Endpoint component provides real-time antivirus scanning, signature-based detection, and remediation of known malware on Windows devices would have Microsoft Defender Antivirus as the correct answer.
Why candidates choose this
Candidates may think antivirus is the primary tool to block malware techniques, not realizing that ASR rules are specifically designed to reduce attack surface by blocking common malware behaviors beyond traditional signature-based detection.
✗Network protectionWrong answer — click to see why▾
Why this is wrong here
Network protection prevents connections to malicious IPs/domains, not local process behaviors like Office apps creating child processes or executables running from %TEMP%.
★ When this WOULD be the correct answer
A question asking for a feature that blocks outbound connections to malicious URLs or IP addresses, such as preventing a device from contacting a known command-and-control server.
Why candidates choose this
Candidates may confuse network-level blocking with endpoint behavioral controls, assuming 'network protection' covers all malware-related restrictions.
✗Controlled folder accessWrong answer — click to see why▾
Why this is wrong here
Controlled folder access protects files in specific folders from unauthorized changes by ransomware and other threats, but it does not block Office apps from creating child processes or prevent executables from running from the %TEMP% folder.
★ When this WOULD be the correct answer
A question asks: 'Which Microsoft Defender for Endpoint feature should be configured to prevent unauthorized applications from modifying files in protected folders, such as Documents and Pictures?'
Why candidates choose this
Candidates may confuse controlled folder access with general attack surface reduction because both aim to block malicious behaviors, but controlled folder access focuses on file protection rather than process and execution restrictions.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse Attack surface reduction rules with Microsoft Defender Antivirus or Controlled folder access, assuming that any 'blocking' feature is part of the antivirus or that folder protection covers execution, when in fact ASR rules are the only feature that enforces behavior-based policies on process creation and execution from specific locations.
Detailed technical explanation
How to think about this question
ASR rules are implemented as Group Policy Objects or via Microsoft Intune and are evaluated by the Windows Defender Advanced Threat Protection (WDATP) service at the kernel level. Each rule corresponds to a specific GUID (e.g., 'Block Office applications from creating child processes' uses GUID D4F940AB-401B-4EFC-AADC-AD5F3C50688A), and they can be configured in audit mode for testing before enforcement. In a real-world scenario, an attacker might use a malicious macro in Word to spawn PowerShell.exe from %TEMP%; an ASR rule would block that process creation immediately, whereas traditional antivirus might miss it if the payload is fileless or obfuscated.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Describe the capabilities of Microsoft security solutions — study guide chapter
Learn the concepts, then practise the questions
- →
Describe the capabilities of Microsoft security solutions practice questions
Targeted practice on this topic area only
- →
All SC-900 questions
1,411 questions across all exam domains
- →
Microsoft Security, Compliance, and Identity Fundamentals SC-900 study guide
Full concept coverage aligned to exam objectives
- →
SC-900 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related SC-900 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Describe the capabilities of Microsoft Entra practice questions
Practise SC-900 questions linked to Describe the capabilities of Microsoft Entra.
Describe the capabilities of Microsoft security solutions practice questions
Practise SC-900 questions linked to Describe the capabilities of Microsoft security solutions.
Describe the capabilities of Microsoft compliance solutions practice questions
Practise SC-900 questions linked to Describe the capabilities of Microsoft compliance solutions.
Describe the concepts of security, compliance, and identity practice questions
Practise SC-900 questions linked to Describe the concepts of security, compliance, and identity.
SC-900 fundamentals practice questions
Practise SC-900 questions linked to SC-900 fundamentals.
SC-900 scenario practice questions
Practise SC-900 questions linked to SC-900 scenario.
SC-900 troubleshooting practice questions
Practise SC-900 questions linked to SC-900 troubleshooting.
Practice this exam
Start a free SC-900 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this SC-900 question test?
Describe the capabilities of Microsoft security solutions — This question tests Describe the capabilities of Microsoft security solutions — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Attack surface reduction rules — Attack surface reduction (ASR) rules are a feature of Microsoft Defender for Endpoint that specifically target common malware behaviors, such as blocking Office applications from creating child processes and preventing executable files from running from the %TEMP% folder. These rules are designed to reduce the attack surface by enforcing policies that stop suspicious or malicious actions at the process level, without relying solely on signature-based detection.
What should I do if I get this SC-900 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More SC-900 practice questions
- An organization uses Microsoft Purview Compliance Manager to track compliance with regulations. The compliance officer n…
- A company uses Microsoft Teams and wants to ensure that messages containing offensive language are flagged for review. W…
- A financial services firm uses Microsoft Purview Information Barriers to prevent traders from communicating with investm…
- A company uses a cloud-based SaaS (Software as a Service) application for customer relationship management. According to…
- A company has a document management system. The security policy requires that a user in the Sales department can only vi…
- A company implements a security measure to ensure that only authorized employees can view sensitive customer records. Wh…
Last reviewed: Jun 11, 2026
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.