Ransomware encrypts files on a clerk's city laptop. Which Microsoft Defender product should the fundamentals candidate name for endpoint threat protection in that scenario?
Select an answer to reveal the explanation.
Short Explanation
Ransomware on a laptop is an endpoint crime scene. Defender for Endpoint is the product built to detect and respond on the device. Forms logic, DL moderation, and Viva Engage posts live in other lanes.
Full Explanation
Microsoft Defender for Endpoint is the fundamentals product to name when ransomware encrypts files on a clerk’s city laptop and the question asks for endpoint threat protection. Defender for Endpoint is built for device-level detection and response against malware and ransomware-style endpoint threats affecting municipal endpoints. Mapping ransomware-on-a-laptop scenarios to Defender for Endpoint—not to Forms, distribution lists, or social communities—is an MS-900 staple.
Microsoft Forms branching logic gathers survey answers and does not provide endpoint ransomware protection. Exchange Online distribution list moderation manages mail group approvals, not endpoint encryption attacks. Microsoft Viva Engage community posts support employee conversation and are not an endpoint threat protection product.
An exam caveat is that backups, least privilege, and email filtering also matter in ransomware resilience, but the Defender product named for endpoint threat protection remains Defender for Endpoint. Operationally, confirm the clerk’s laptop is onboarded to Defender for Endpoint, isolate or investigate the device from the Defender portal, and review related detections so the city SOC can contain spread beyond that single endpoint.