Study workspace

Prepare for SC-200 with a reference that remembers your progress.

All nine learning paths now run in the new architecture. Select one to reveal its brief and modules.

09 / 09

Choose a learning path

0/404 units
02Microsoft Defender for Endpoint9 modules · 60 units · 5 hr 49 min · Deployment, attack surface reduction, investigations, response, automation, detections, and vulnerability management0/60 units complete−
Learning path 02 · Microsoft Defender for Endpoint ↗

9 modules · 60 units · 5 hr 49 min · Deployment, attack surface reduction, investigations, response, automation, detections, and vulnerability management

0%

Study focus

Endpoint readiness

Deploy, onboard, configure, and harden devices with Microsoft Defender for Endpoint.

Investigation and response

Investigate devices and evidence, take response actions, automate remediation, and tune detections.

9 modules · 60 units

Select one or more modules

Each click adds or removes a module from your workspace. Units remain closed until you open them.

01Protect against threats with Microsoft Defender for Endpoint0/4 units−
01

Module 1

Protect against threats with Microsoft Defender for Endpoint

Focus: the Defender for Endpoint architecture, security stack, administration, and advanced hunting.
0/4
01 / 04Introduction to Microsoft Defender for Endpoint

Microsoft Defender for Endpoint is an enterprise endpoint security platform for prevention, detection, investigation, and response. Its telemetry pipeline combines built-in endpoint behavioral sensors, cloud security analytics, and Microsoft threat intelligence.

  • Behavioral sensors: collect operating-system signals and send them to the tenant's isolated cloud service.
  • Cloud analytics: transform telemetry into detections, insights, and recommended actions.
  • Threat intelligence: recognizes attacker tools, techniques, procedures, and infrastructure.
Exam takeaway: remember the protection stack: Vulnerability Management, attack surface reduction, next-generation protection, EDR, automated investigation and remediation, and Microsoft threat experts.
Official lessonMDE architecture and capabilities
02 / 04Practice security administration
CapabilityPurpose
Vulnerability ManagementContinuously discover, prioritize, and remediate vulnerabilities and misconfigurations.
Attack surface reductionReduce exploitable paths with application control, exploit protection, network protection, controlled folder access, ASR rules, and firewall.
Next-generation protectionUse cloud-delivered protection, machine learning, real-time scanning, and security intelligence updates.
EDRContinuously collect behavioral telemetry, correlate alerts into incidents, and support investigation.
AIRAutomate analyst-like investigation and remediation to reduce alert volume.

The MDE sensor communicates in the LocalSystem context through WinHTTP. WinHTTP proxy configuration is separate from user-browser WinINet settings.

Official lesson and walkthroughSecurity administration capabilities
03 / 04Hunt threats within your network

Advanced hunting uses Kusto Query Language (KQL) to query endpoint and cross-domain telemetry proactively. Results can reveal indicators, affected entities, behavior patterns, and candidates for custom detection rules.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("downloadstring", "invoke-webrequest")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| top 100 by Timestamp desc
  • Filter time and high-selectivity columns early.
  • Prefer has for whole tokens over contains.
  • Project only required columns before joins.
  • Place the smaller table on the left side of a join.
Exam takeaway: hunting is proactive; custom detections operationalize a useful query so it runs automatically.
Official lessonKQL hunting and query performance
04 / 04Summary and knowledge check

Review the sensor-cloud-intelligence architecture, the six major MDE capability areas, incident correlation, and the role of KQL in advanced hunting.

Official moduleAssessment and summary
End of learning pathMicrosoft Defender for Endpoint
↑