Microsoft Defender for Endpoint Quiz

What you'll be asked

1. Which component of Microsoft Defender for Endpoint is primarily responsible for performing behavioral analysis and detecting sophisticated attacks on a device?
2. An administrator needs to prevent Office applications from creating child processes that often lead to malware execution. Which feature should they configure?
3. What is the primary purpose of the 'Automated Investigation and Remediation' (AIR) capability in Microsoft Defender for Endpoint?
4. When onboarding non-Windows devices (such as Linux servers) to Microsoft Defender for Endpoint, which configuration management tool is the recommended method for deploying the configuration package?
5. You are investigating a device that is currently isolated via Microsoft Defender for Endpoint. Which of the following actions is still possible while the device is in this state?

Answers and explanations come after you submit.