Microsoft 365 Administrator Expert Managing Defender for Endpoint Flashcards
7 cards from real MS-102 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Microsoft 365 Administrator Expert Managing Defender for Endpoint flashcards as text
An administrator needs to isolate a compromised device from the network while keeping it connected to the Defender for Endpoint service for investigation. Which action should they take in the Microsoft 365 Defender portal?
Answer: Contain device
The 'Contain device' action isolates the device from the network while maintaining the Defender for Endpoint management channel for investigation.
Which Defender for Endpoint feature uses behavioral sensors embedded in Windows to collect and process signals from the operating system?
Answer: Endpoint Detection and Response (EDR)
EDR uses behavioral sensors embedded in the OS to continuously collect telemetry signals that are processed in the Microsoft cloud.
A security analyst wants to hunt for threats across devices using custom queries. Which tool in Microsoft 365 Defender should they use?
Answer: Advanced hunting
Advanced hunting allows analysts to write Kusto Query Language (KQL) queries to proactively search for threats across devices and other data sources.
What is the default data retention period for Defender for Endpoint raw data in the Microsoft 365 Defender portal?
Answer: 180 days
Defender for Endpoint retains raw telemetry data for 180 days by default, giving analysts a six-month window for threat hunting and investigation.
An organization wants to prevent users from accessing known malicious IP addresses at the network level on Windows 10 devices. Which Defender for Endpoint feature should be enabled?
Answer: Network protection
Network protection extends SmartScreen to block outbound connections to malicious IP addresses and domains at the kernel level.
Which Microsoft Defender for Endpoint plan is required to access the Threat and Vulnerability Management (TVM) feature?
Answer: Defender for Endpoint Plan 2
Threat and Vulnerability Management is a Plan 2 feature that provides real-time device discovery and risk-based vulnerability prioritization.
A Defender for Endpoint alert is classified as 'Informational' severity. What does this indicate?
Answer: The activity is suspicious but has low impact on the organization
Informational alerts indicate activity that may not be harmful in isolation but could be part of a larger attack pattern worth monitoring.