Study workspace

Prepare for SC-200 with a reference that remembers your progress.

All nine learning paths now run in the new architecture. Select one to reveal its brief and modules.

09 / 09

Choose a learning path

0/404 units
02Microsoft Defender for Endpoint9 modules · 60 units · 5 hr 49 min · Deployment, attack surface reduction, investigations, response, automation, detections, and vulnerability management0/60 units complete−
Learning path 02 · Microsoft Defender for Endpoint ↗

9 modules · 60 units · 5 hr 49 min · Deployment, attack surface reduction, investigations, response, automation, detections, and vulnerability management

0%

Study focus

Endpoint readiness

Deploy, onboard, configure, and harden devices with Microsoft Defender for Endpoint.

Investigation and response

Investigate devices and evidence, take response actions, automate remediation, and tune detections.

9 modules · 60 units

Select one or more modules

Each click adds or removes a module from your workspace. Units remain closed until you open them.

03Implement Windows security enhancements with Microsoft Defender for Endpoint0/5 units−
03

Module 3

Implement Windows security enhancements with Microsoft Defender for Endpoint

Focus: attack surface reduction concepts, rule deployment, operating modes, exclusions, and validation.
0/5
01 / 05Introduction

Attack surface reduction (ASR) limits the behaviors and application paths attackers commonly abuse, especially Office applications, scripts, email content, credential theft, and executable content.

Official moduleASR objectives
02 / 05Understand attack surface reduction

ASR rules target risky behaviors rather than only known malware signatures. They complement antivirus, EDR, exploit protection, application control, network protection, and controlled folder access. Rules have unique GUIDs and can be managed individually.

  • Block: prevent the behavior and generate an event.
  • Audit: allow the behavior but record what would have been blocked.
  • Warn: show a user warning that can be bypassed.
  • Disabled / Not configured: do not enforce the rule.
Official lessonASR concepts and rule modes
03 / 05Enable attack surface reduction rules

Deploy ASR rules with Microsoft Intune, Configuration Manager, Group Policy, PowerShell, or MDM CSP. A safe rollout starts in audit mode, reviews telemetry and line-of-business impact, adds narrow justified exclusions, then moves selected rules to warn or block in controlled rings.

Set-MpPreference -AttackSurfaceReductionRules_Ids <rule-guid> `
  -AttackSurfaceReductionRules_Actions AuditMode
Exam takeaway: exclusions reduce protection and should be narrow, documented, and tested; monitor ASR events through reports and advanced hunting.
Official lessonDeployment, modes, and exclusions
04 / 05Module assessment

Be able to choose the correct ASR mode for evaluation versus enforcement and recognize the management channels used to deploy rules.

Official assessmentASR knowledge check
05 / 05Summary and resources

ASR reduces attacker opportunity before EDR response is required. Treat deployment as a measured control change: audit, analyze, pilot, enforce, and continuously tune.

Official moduleSummary and resources
End of learning pathMicrosoft Defender for Endpoint
↑