A parks IT analyst says Microsoft Defender XDR is basically the same thing as Azure Firewall. How should a fundamentals candidate correct that?
Select an answer to reveal the explanation.
Short Explanation
XDR is the big investigation brain that correlates alerts across email, identity, endpoints, and apps. Azure Firewall is network filtering. Different jobs—do not swap the name tags.
Full Explanation
Microsoft Defender XDR correlates and investigates threat-protection signals across Defender workloads—email, identity, endpoints, and cloud apps—so security teams see a broader attack story. It is not a network firewall product. A parks IT analyst who equates Defender XDR with Azure Firewall is mixing an investigation and correlation plane with network packet/filtering controls. For municipal fundamentals answers, keep XDR in the threat-protection and signal-correlation lane.
Defender XDR is not a SharePoint storage quota tool, so storage management answers are unrelated. It is not a pricing SKU for Microsoft Project, which is work management. It does not replace Entra ID as the directory service; identity remains in Microsoft Entra, while Defender XDR consumes and correlates security signals including identity-related alerts.
Exam caveat: Azure Firewall still matters for network segmentation and filtering, and Defender products still generate the underlying alerts—XDR amplifies cross-workload investigation rather than deleting the need for those controls. Operational check: in a city security operations review, show an incident that stitches email and endpoint alerts in the Defender XDR portal, then contrast that view with Azure Firewall logs to reinforce the different jobs.