An analyst wants to understand how Microsoft Defender XDR uses threat intelligence when it evaluates a suspicious sign-in and file execution. Which statement best describes the role of threat intelligence here?
- AIt replaces the need for user authentication by validating device identity before any sign-in occurs.
- BIt encrypts the tenant's data at rest so that stolen files cannot be read by an attacker.
- CIt assigns least privilege permissions to users so that a compromised account can reach fewer resources.
- DIt supplies up-to-date information on known malicious indicators and attacker behaviour that enriches detections and speeds investigation. Correct
Why A is wrong: Threat intelligence informs detection, but it does not authenticate users or devices, so this confuses it with the identity verification step.
Why B is wrong: Encryption at rest is a data protection control, not a function of threat intelligence, so this describes an unrelated capability.
Why C is wrong: Least privilege is an access governance principle applied through role assignment, not something threat intelligence performs, so this misattributes the role.
Why D is correct: Threat intelligence feeds Defender XDR with current indicators of compromise and adversary techniques, which improves detection accuracy and gives analysts context during investigation.