Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that…

The proposed solution is incorrect. Exploit protection is a component of Microsoft Defender Exploit Guard designed to apply mitigation techniques against memory-based attacks and software vulnerabilities. It does not manage application access to specific file system locations.

The correct feature to ensure only specific applications can modify data in protected folders is Controlled folder access. This feature is specifically designed to protect files and folders from unauthorized changes by untrusted applications, which is a common behavior of ransomware. Administrators can define which folders are protected and which applications are allowed to access them.

A. Yes: This is incorrect because Exploit Protection focuses on mitigating software vulnerabilities and preventing malware execution techniques, not on controlling which applications can write to specific folders.

1. Microsoft Learn. (2023). Protect important folders with controlled folder access.

Section: "What is controlled folder access?"

Content: "Controlled folder access helps protect your valuable data from malicious apps and threats

such as ransomware. It protects your data by checking apps against a list of known

trusted apps... You can add applications to the trusted list so they can access the protected folders." This document explicitly defines Controlled folder access as the tool for the stated goal.

2. Microsoft Learn. (2023). Enable exploit protection.

Section: "What is exploit protection?"

Content: "Exploit protection helps protect against malware that uses exploits to infect devices and spread. Exploit protection consists of a number of mitigations that can be applied to either the operating system or to an individual app." This source confirms that Exploit Protection's purpose is to mitigate exploits

not to control folder access.

3. Microsoft Learn. (2023). Overview of Microsoft Defender for Endpoint Plan 1.

Section: "Attack surface reduction"

Content: This document lists the components of attack surface reduction

which includes "Controlled folder access" and "Exploit protection" as separate and distinct capabilities. This distinction clarifies that one cannot be used to achieve the goal of the other.