Microsoft Security, Compliance, and Identity Fundamentals SC-900 Practice Question

Threat and vulnerability management (TVM) in Microsoft Defender for Endpoint continually scans supported Windows client and Windows Server devices for missing patches, insecure configurations, and vulnerable software. It assigns exposure and security scores, ranks weaknesses by exploit likelihood, and provides recommended remediation actions that can be launched through tools such as Microsoft Intune or Microsoft Endpoint Configuration Manager.

Attack surface reduction rules enforce preventive policies like blocking suspicious scripts but do not inventory vulnerabilities. Endpoint detection and response (EDR) focuses on detecting and investigating active threats rather than pre-existing weaknesses. Live response offers a remote shell for manual investigation and remediation and does not calculate exposure scores. Therefore, TVM is the appropriate capability.