SOC workflows

Section 1: Overview of Microsoft Defender for Endpoint (MDE) Q1. Which MDE capability is primarily designed to reduce the number of ways malware can run on endpoints? A. EDRB. ASRC. AIRD. Vulnerability management Answer: BExplanation: Attack surface reduction (ASR) reduces exploitable behaviors (for example, blocking risky process creation patterns and hardening common attack vectors). EDR…