MD-101 Endpoint Security and Microsoft Defender for Endpoint

Question 1

Which Intune integration enables security administrators to manage Microsoft Defender for Endpoint settings directly from the Intune admin center?

Accepted Answer

Microsoft Defender for Endpoint — Intune connector via security settings management

Answer

The Microsoft Defender for Endpoint connector in Intune enables MDE security settings management, allowing Intune to push Defender configurations to onboarded devices.

Question 2

What is the purpose of Microsoft Defender for Endpoint's 'Attack Surface Reduction (ASR)' rules?

Accepted Answer

To prevent specific behaviors commonly exploited by malware, such as Office macro spawning processes

Answer

ASR rules block specific attack vectors used by malware, such as Office applications spawning child processes, executing content from email, and credential theft from LSASS.

Question 3

Which Intune endpoint security policy type configures Microsoft Defender Antivirus scan settings and exclusions?

Accepted Answer

Antivirus policy under Endpoint security

Answer

Endpoint security Antivirus policies in Intune configure Microsoft Defender Antivirus settings including scan type, schedule, exclusions, and cloud protection level.

Question 4

What does Microsoft Defender for Endpoint's 'Endpoint Detection and Response (EDR)' capability primarily provide?

Accepted Answer

Post-breach detection, investigation, and response capabilities for advanced threats

Answer

EDR provides advanced post-breach detection by continuously monitoring device behavior, enabling security teams to investigate and respond to threats that bypassed prevention.

Question 5

An administrator configures an ASR rule in 'Audit mode'. What is the effect on devices?

Accepted Answer

The rule logs what would have been blocked without actually preventing the action

Answer

Audit mode logs ASR rule trigger events to Windows Event Log and Microsoft Defender for Endpoint without blocking the action, allowing testing before enforcement.

MD-101 - Managing Modern Desktops Practice Test

MD-101 - Managing Modern Desktops Practice Test

MD-101 Endpoint Security and Microsoft Defender for Endpoint