MS-102 - Microsoft 365 Administrator Expert Managing Defender for Endpoint Questions and Answers

Question 1

An administrator needs to onboard a large number of existing Windows 10 devices, which are all managed by Microsoft Configuration Manager, to Microsoft Defender for Endpoint.
What is the most appropriate and efficient method to accomplish this?

Accepted Answer

Create a device collection in Configuration Manager and deploy the Defender for Endpoint onboarding configuration package to it.

Answer

Use Group Policy to deploy the onboarding script to all devices.

Answer

Manually run the local onboarding script on each device.

Answer

Enroll each device into Microsoft Intune and then deploy an onboarding policy.

Question 2

A security team is concerned that a sophisticated attacker, upon gaining local administrator rights, could disable or alter Microsoft Defender Antivirus settings to evade detection. Which Microsoft Defender for Endpoint feature should be enabled to specifically prevent these unauthorized changes to security settings?

Accepted Answer

Tamper Protection

Answer

Attack Surface Reduction (ASR)

Answer

Network Protection

Answer

Controlled Folder Access

Question 3

A security operations center (SOC) is experiencing a high volume of security alerts. To improve efficiency, they want to leverage a Defender for Endpoint capability that uses AI to automatically investigate alerts, correlate evidence, and apply remediation actions for confirmed threats without manual intervention. Which feature should they configure and use?

Accepted Answer

Automated investigation and response (AIR)

Answer

Advanced Hunting

Answer

Threat and Vulnerability Management

Answer

Live Response

Question 4

While reviewing the Threat and Vulnerability Management dashboard, a security administrator identifies a critical vulnerability on several devices related to outdated application software. What is the most direct, integrated action the administrator can take from the security recommendation within the Microsoft 365 Defender portal to initiate remediation?

Accepted Answer

Create a remediation task that can be tracked and sent to the IT administration team via Microsoft Intune.

Answer

Use Live Response to connect to each device and manually uninstall the software.

Answer

Isolate all affected devices from the network until they are patched.

Answer

Deploy a new Attack Surface Reduction rule to block the vulnerable application.

Question 5

Which of the following BEST describes the primary purpose of implementing Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint?

Accepted Answer

To prevent common malware infection techniques by blocking specific software behaviors and actions, such as Office apps creating executable content.

Answer

To scan for and report on software vulnerabilities and device misconfigurations.

Answer

To provide a remote shell for in-depth, real-time investigation on a compromised device.

Answer

To automatically quarantine malicious files based on cloud-delivered protection intelligence.

Question 6

A security analyst needs to perform a deep, interactive investigation on a specific device that has triggered a high-severity alert. The analyst requires the ability to run advanced commands, collect forensic artifacts like the MFT and registry hives, and run custom scripts in real-time. Which Defender for Endpoint feature provides this remote shell capability?

Accepted Answer

Live Response

Answer

Automated Investigation

Answer

Threat Analytics

Answer

Advanced Hunting