This is the domain that decides your exam: 35–40% of the questions. It is also the one where people lose points for a silly reason — there are nine products whose names start with "Microsoft Defender," and under pressure they blur together.
The fix is not more memorization. It's one mental model: every Defender product protects a different surface.
New to the series? Start with Part 0 — how the exam works and how to build a free lab. Parts 1 and 2 cover the concepts and Microsoft Entra.
Objectives updated July 28, 2026. Product names in this area change often; verify on Microsoft Learn before your exam.
1. The Defender XDR family: who protects what
XDR stands for extended detection and response. Microsoft Defender XDR is the umbrella that correlates signals from all of these into a single incident, so an analyst sees one story instead of five alerts:
| Product | Protects | Typical signal |
|---|---|---|
| Defender for Endpoint | Devices (Windows, macOS, Linux, mobile) | Malicious process, ransomware behaviour, EDR detection |
| Defender for Office 365 | Email and collaboration (Exchange, Teams, SharePoint, OneDrive) | Phishing message, malicious link, unsafe attachment |
| Defender for Identity | On-premises Active Directory | Lateral movement, pass-the-hash, reconnaissance |
| Defender for Cloud Apps | SaaS applications (CASB) | Shadow IT discovery, risky OAuth app, session control |
| Defender Vulnerability Management | Weaknesses across devices and software | Missing patch, risky configuration |
| Defender Threat Intelligence | External threat context | Attacker infrastructure, indicators |
Memory hook, in the order of a real attack: email arrives (Office 365) → user clicks (Endpoint) → attacker moves to AD (Identity) → exfiltrates to a SaaS app (Cloud Apps).
⚠️ The classic trap: Defender for Identity protects on-premises Active Directory. It is not the product that protects cloud identities — that's Microsoft Entra ID Protection. Different product, different domain of the exam.
2. Microsoft Defender for Cloud vs Microsoft Sentinel
These two get confused constantly. The clean split:
Microsoft Defender for Cloud answers "how secure is my cloud infrastructure right now?"
- CSPM (cloud security posture management): continuously assesses Azure, AWS and GCP resources
- Secure Score: a percentage plus a prioritized list of recommendations
- CWPP (cloud workload protection): plans that protect servers, containers, databases, storage, App Service
- Regulatory compliance dashboard: maps your posture to standards
Microsoft Sentinel answers "what happened across my whole estate, and what do we do about it?"
- SIEM: collects and correlates logs from anything — cloud, on-prem, third-party
- Detects with analytics rules, visualizes with workbooks
- Hunting queries for proactive searching, UEBA for behavioural anomalies
- SOAR: automated response with playbooks (built on Azure Logic Apps)
- Priced mainly by data ingested and retained — a common exam detail
Rule of thumb: Defender for Cloud hardens. Sentinel investigates. And yes, Defender for Cloud's alerts can be fed into Sentinel.
3. Azure network security building blocks
You need to recognize these by purpose, not configure them:
| Service | What it does |
|---|---|
| Network security group (NSG) | Basic allow/deny rules on traffic to subnets and NICs (layer 3/4) |
| Azure Firewall | Managed, stateful firewall with threat intelligence, FQDN filtering, and a static public IP |
| Web Application Firewall (WAF) | Protects web apps from OWASP-style attacks (SQL injection, XSS); runs on Application Gateway or Front Door |
| Azure DDoS Protection | Absorbs and mitigates volumetric attacks |
| Azure Bastion | Secure RDP/SSH through the portal without exposing public IPs |
| Network segmentation | Virtual networks and subnets to limit lateral movement |
Encryption in Azure: data at rest is encrypted by default in storage; Azure Key Vault stores keys, secrets and certificates.
4. Microsoft Defender for Cloud's Secure Score
Worth understanding as a concept because it appears in scenarios: a percentage that reflects how many recommended controls you've implemented, with each recommendation weighted by impact. Improving it is a prioritization tool, not a compliance certificate.
Don't confuse it with Microsoft Secure Score (in the Defender portal), which measures the security posture of your Microsoft 365 identities, apps and devices. Two different scores, similar names.
🧪 Lab 1: read the Defender portal like an analyst
Time: 20 minutes. Needs: Microsoft 365 E5 trial (or your work tenant if you have read access — do not change anything there).
- Go to security.microsoft.com.
- Open Incidents & alerts → Incidents. Pick any incident.
- For each alert inside it, write down which product generated it: Endpoint, Office 365, Identity or Cloud Apps.
- Open the attack story tab and follow the sequence of events.
- Open Secure Score and pick one recommendation. Read what it improves and what it might break.
Expected result: you can say out loud "this incident started as a phishing email caught by Defender for Office 365, and the device signal came from Defender for Endpoint." That sentence is domain 3 in a nutshell.
🧪 Lab 2: Defender for Cloud Secure Score
Time: 15 minutes. Needs: Azure free account.
- Deploy something trivial — a storage account is enough.
- Open Microsoft Defender for Cloud → Recommendations.
- Note your Secure Score and pick one recommendation, for example "Secure transfer to storage accounts should be enabled."
- Apply the fix.
- Come back later and see the score move.
This is also a perfect example of the method from any performance work: measure, change one thing, measure again.
Then check yourself
The "which Defender catches this?" exercise and the Azure network security one are both on the interactive practice page — they grade every row and explain the misses. If you only do one thing from this post, do that first lab.
⚠️ Exam traps in this domain
- Defender for Identity = on-premises AD. Entra ID Protection = cloud identities.
- Defender for Cloud ≠ Defender for Cloud Apps. The first protects infrastructure posture; the second is a CASB for SaaS.
- Sentinel is SIEM + SOAR, and it's billed by ingestion. If a question mentions "collect logs from third-party sources," it's Sentinel.
- Secure Score (Defender for Cloud) measures Azure posture; Microsoft Secure Score measures Microsoft 365 posture.
- NSG vs Azure Firewall: NSG is basic allow/deny rules; Azure Firewall is a managed service with threat intelligence and FQDN rules.
- WAF protects web applications, not the network perimeter in general.
🎯 Now practise it: 12 questions + both labs
This is the domain where you don't discover the gap by reading. You discover it when a scenario says "an attacker performs reconnaissance against a domain controller" and, for a second, you're not sure whether that's Defender for Identity or Entra ID Protection.
So the practice lives in an interactive page instead of a list you can scroll past:
👉 Take the Part 3 quiz and labs
What you get:
- 12 exam-style questions. Pick an answer and you immediately see why it's right — and why each of the other three is wrong. The distractors are the pairs that actually cost people points: Defender for Cloud vs Defender for Cloud Apps, Sentinel vs Defender for Cloud, Secure Score vs Microsoft Secure Score, Bastion vs just-in-time VM access.
- Options shuffled on every attempt, so retaking it tests the concept instead of the position you memorized.
- Lab 5 — which Defender catches this? Six incidents, six products. This is the single most useful five minutes you can spend on the domain.
- Lab 6 — Azure network security. Six requirements; pick NSG, Azure Firewall, WAF, DDoS Protection, Bastion or Key Vault. It explains the layer each one works at.
Domains 1 and 2 are on the same page, so you can review as you go.
Free, no sign-up, works on your phone.
Comment your score out of 12 — and tell me which pair of product names caught you. In this domain it's almost never the concept; it's the naming.
What's next
Part 4 covers Microsoft compliance solutions with Purview — 15–20% of the exam and, honestly, the easiest points available. Labels, DLP, retention, insider risk and eDiscovery, in one diagram plus a lab where you build a DLP rule that blocks a credit card number.
Top comments (0)