SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your company uses Microsoft Defender for Endpoint. You need to configure attack surface reduction (ASR) rules. Which TWO of the following are ASR rules?
⚠ Common exam trap
Many exam-takers confuse ASR rules with other Windows security features like AppLocker, Windows Firewall, or Exploit Guard, leading them to select options that are valid security controls but not specifically ASR rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block executable content from email client and webmail
ASR rules are designed to block common attack vectors by controlling specific behaviors. 'Block executable content from email client and webmail' prevents malicious scripts or executables from running when delivered via email, which is a primary infection vector. Option E is correct because 'Block Office applications from creating child processes' stops attackers from using Office apps (like Word or Excel) to spawn malicious processes (e.g., PowerShell or cmd.exe), a classic technique for code execution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Block executable content from email client and webmail
Why this is correct
This is a correct answer because "Block executable content from email client and webmail" is a specific Attack Surface Reduction (ASR) rule designed to prevent malware from being launched directly from email applications or webmail services. This rule targets common infection vectors by blocking the execution of files like .exe, .dll, or .js that originate from email clients (e.g., Outlook) or popular web browsers when accessing webmail. It helps mitigate phishing and drive-by download attacks by restricting the initial execution phase.
- ✗
Allow only signed executables
Why it's wrong here
This option is incorrect because "Allow only signed executables" describes a function of application control policies, such as Windows Defender Application Control (WDAC) or AppLocker, rather than an Attack Surface Reduction (ASR) rule. Application control explicitly defines which applications are permitted to run based on criteria like digital signatures, publishers, or file paths, providing a strict allowlist. ASR rules, conversely, focus on blocking specific malicious behaviors or actions performed by legitimate applications.
- ✗
Block inbound connections from the internet
Why it's wrong here
This option is incorrect because "Block inbound connections from the internet" is a fundamental capability of a network firewall, such as Windows Defender Firewall, not an Attack Surface Reduction (ASR) rule. Firewalls operate at the network layer, controlling traffic flow based on ports, protocols, and IP addresses to prevent unauthorized access. ASR rules, in contrast, operate at the endpoint level, focusing on the behavior of applications and scripts to prevent common attack techniques.
- ✗
Block untrusted fonts
Why it's wrong here
This option is incorrect because "Block untrusted fonts" is a specific operating system hardening feature, often managed through Group Policy or MDM, designed to mitigate vulnerabilities in font parsing that attackers could exploit. While it enhances security, it is not categorized as an Attack Surface Reduction (ASR) rule. ASR rules specifically target common attack vectors by preventing applications from performing suspicious actions, whereas font blocking addresses a particular class of software vulnerability.
- ✓
Block Office applications from creating child processes
Why this is correct
This is a correct answer because "Block Office applications from creating child processes" is a crucial Attack Surface Reduction (ASR) rule. This rule prevents Microsoft Office applications, such as Word, Excel, or PowerPoint, from launching new executable processes, which is a common technique used by malware delivered via malicious macros or exploits. By restricting this behavior, the rule significantly reduces the risk of attackers using Office documents to execute payloads or establish persistence on an endpoint.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Attack surface reduction
Attack surface reduction is a set of security practices that minimizes the number of ways an attacker can access or exploit a system by removing unnecessary features, locking down configurations, and controlling software behavior.
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.