MS-102 · Question #327
You have a Microsoft 365 subscription that includes Microsoft Intune and Microsoft Defender XDR. All users have devices that run Windows 11. From the Microsoft Defender portal, you review the…
The correct answer is D. Create an attack surface reduction (ASR) policy. Creating an Attack Surface Reduction (ASR) policy (D) is the correct solution. ASR rules are specifically designed to harden endpoints against common attack techniques, and one of the built-in ASR rules is 'Block all Office applications from creating child processes' (rule…
Question
You have a Microsoft 365 subscription that includes Microsoft Intune and Microsoft Defender XDR. All users have devices that run Windows 11. From the Microsoft Defender portal, you review the Microsoft Secure Score recommendations. One of the top recommendations is to block all Microsoft Office applications from creating child processes. You need to increase the secure score by addressing the recommendation. What should you do?
Options
- ASelect Safe Documents for Office clients.
- BCreate a policy for Office applications.
- CConfigure an endpoint detection and response (EDR) policy.
- DCreate an attack surface reduction (ASR) policy.
How the community answered
(55 responses)- A7% (4)
- B4% (2)
- C16% (9)
- D73% (40)
Explanation
Creating an Attack Surface Reduction (ASR) policy (D) is the correct solution. ASR rules are specifically designed to harden endpoints against common attack techniques, and one of the built-in ASR rules is 'Block all Office applications from creating child processes' (rule GUID: d4f940ab-401b-4efc-aadc-ad5f3c50688a). This rule prevents Office apps like Word and Excel from spawning processes like cmd.exe or PowerShell - a common malware technique. In the Microsoft Defender portal under Endpoint security, you create an ASR policy and enable this rule, which is then deployed to Windows 11 devices via Intune. Safe Documents (A) is for document sandboxing, EDR policies (C) focus on detection/response, and creating a policy 'for Office applications' (B) is too vague.
Topics
Community Discussion
No community discussion yet for this question.