MS-102 - Microsoft 365 Administrator Expert Managing Defender for Endpoint Questions and Answers

Question 1

An administrator needs to onboard a large number of existing Windows 10 devices, which are all managed by Microsoft Configuration Manager, to Microsoft Defender for Endpoint. What is the most appropriate and efficient method to accomplish this?

Accepted Answer

Create a device collection in Configuration Manager and deploy the Defender for Endpoint onboarding configuration package to it.

Answer

For environments where devices are already managed by Configuration Manager, the most integrated and efficient method is to leverage the existing infrastructure. This involves creating a specific device collection for the target machines and then deploying the onboarding package directly to that collection.

Question 2

A security team is concerned that a sophisticated attacker, upon gaining local administrator rights, could disable or alter Microsoft Defender Antivirus settings to evade detection. Which Microsoft Defender for Endpoint feature should be enabled to specifically prevent these unauthorized changes to security settings?

Accepted Answer

Tamper Protection

Answer

Tamper Protection is designed to prevent malicious apps and unauthorized users (including local administrators) from changing critical Microsoft Defender Antivirus settings. When enabled, it locks down configurations like real-time protection and cloud-delivered protection, preventing them from being disabled.

Question 3

A security operations center (SOC) is experiencing a high volume of security alerts. To improve efficiency, they want to leverage a Defender for Endpoint capability that uses AI to automatically investigate alerts, correlate evidence, and apply remediation actions for confirmed threats without manual intervention. Which feature should they configure and use?

Accepted Answer

Automated investigation and response (AIR)

Answer

Automated investigation and response (AIR) is the feature specifically designed to address this need. It automatically examines alerts, collects and analyzes data, and can either recommend or automatically take remediation actions, significantly reducing alert fatigue and allowing analysts to focus on more complex threats.

Question 4

While reviewing the Threat and Vulnerability Management dashboard, a security administrator identifies a critical vulnerability on several devices related to outdated application software. What is the most direct, integrated action the administrator can take from the security recommendation within the Microsoft 365 Defender portal to initiate remediation?

Accepted Answer

Create a remediation task that can be tracked and sent to the IT administration team via Microsoft Intune.

Answer

The Threat and Vulnerability Management module is integrated with Microsoft Intune to streamline the remediation workflow. From a specific security recommendation, an administrator can create a remediation request, which generates a security task in Intune for the IT team to act upon. This bridges the gap between security discovery and IT operations.

Question 5

Which of the following BEST describes the primary purpose of implementing Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint?

Accepted Answer

To prevent common malware infection techniques by blocking specific software behaviors and actions, such as Office apps creating executable content.

Answer

Attack Surface Reduction (ASR) rules are a set of controls that prevent software behaviors often leveraged by malware to infect machines. They target specific actions, like scripts launching downloaded content or credential theft from LSASS, rather than relying on traditional file-based signatures. This reduces the number of ways an attacker can exploit a device.

(MS-102) Microsoft 365 Administrator Expert Practice Test

(MS-102) Microsoft 365 Administrator Expert Practice Test

MS-102 - Microsoft 365 Administrator Expert Managing Defender for Endpoint Questions and Answers