SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Microsoft Defender Antivirus

  Why it's wrong here

  Microsoft Defender Antivirus primarily operates by detecting, quarantining, and removing known malware based on signatures, heuristics, and machine learning models. Its core strength lies in identifying and neutralizing malicious files and processes that match established threat intelligence. However, it does not inherently block legitimate applications, such as Microsoft Office, from performing actions like creating child processes or executing files from common temporary folders, unless those specific actions are part of a detected malicious payload or a known malicious file signature.

  When this WOULD be correct

  A question asking which Microsoft Defender for Endpoint component provides real-time antivirus scanning, signature-based detection, and remediation of known malware on Windows devices would have Microsoft Defender Antivirus as the correct answer.

• ✓

  Attack surface reduction rules

  Why this is correct

  Attack surface reduction (ASR) rules are a core component of Microsoft Defender for Endpoint, specifically designed to prevent common malware and ransomware techniques by blocking suspicious behaviors at the endpoint. These rules operate by preventing specific actions, such as Office applications creating executable child processes or scripts executing from temporary folders, which are frequently exploited by attackers. By proactively blocking these known exploit techniques, ASR rules significantly reduce the attack surface, enhancing endpoint security beyond traditional signature-based detection.

• ✗

  Network protection

  Why it's wrong here

  Network protection, a feature within Microsoft Defender for Endpoint, primarily functions at the network layer to prevent devices from connecting to known malicious IP addresses, domains, and URLs. Its purpose is to block access to phishing sites, command-and-control servers, and other threat sources by inspecting network traffic. However, network protection does not govern or block local process behaviors, such as an Office application spawning a child process or an executable running from a temporary directory, as its scope is network communication, not internal process execution.

  When this WOULD be correct

  A question asking for a feature that blocks outbound connections to malicious URLs or IP addresses, such as preventing a device from contacting a known command-and-control server.

• ✗

  Controlled folder access

  Why it's wrong here

  Controlled folder access is a security feature within Microsoft Defender for Endpoint focused on protecting sensitive data by preventing unauthorized applications from making changes to files within designated protected folders. It primarily safeguards against ransomware and other malicious attempts to encrypt or modify user documents and system files. While crucial for data integrity, this feature does not block specific process behaviors like an Office application creating a child process or an executable running from a temporary folder, as its scope is file modification control, not general process execution behavior.

  When this WOULD be correct

  A question asks: 'Which Microsoft Defender for Endpoint feature should be configured to prevent unauthorized applications from modifying files in protected folders, such as Documents and Pictures?'

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”