Microsoft 365 Administrator Expert Managing Defender for Endpoint Flashcards
7 cards from real MS-102 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Microsoft 365 Administrator Expert Managing Defender for Endpoint flashcards as text
An administrator needs to deploy Defender for Endpoint to Linux servers. Which onboarding method is supported for Linux?
Answer: Local script or Ansible/Puppet/Chef
Linux devices can be onboarded using a local shell script or configuration management tools like Ansible, Puppet, or Chef.
What is the purpose of the 'Live Response' feature in Microsoft Defender for Endpoint?
Answer: Provide a remote shell session to investigate and remediate a device in real time
Live Response gives security analysts a remote shell connection to a device, allowing them to run commands, collect files, and remediate threats interactively.
Which role-based access control (RBAC) permission is required in Microsoft 365 Defender to approve or reject pending remediation actions in the Action center?
Answer: Active remediation actions permission
The 'Active remediation actions' permission within Defender for Endpoint RBAC allows users to approve or reject pending automated investigation actions.
An organization enables automated investigation and remediation (AIR) at the full automation level. What happens when malware is detected on a device?
Answer: Defender automatically investigates and remediates threats without human approval
Full automation allows AIR to automatically investigate and remediate threats without requiring manual approval from security analysts.
A company wants to block specific file hashes known to be malicious across all onboarded devices. Which Defender for Endpoint capability should they use?
Answer: Indicators of Compromise (IoC) — file hash block
Custom file hash IoCs can be configured to alert, allow, or block specific files identified by their SHA-1, SHA-256, or MD5 hash across onboarded devices.
What is the significance of the 'Risk score' assigned to a device in Defender for Endpoint?
Answer: It reflects the level of active threats and vulnerabilities on the device
The device risk score is calculated based on active alerts, vulnerability exposure, and threat intelligence signals to help prioritize investigation efforts.
Which Windows event logs are collected by the Defender for Endpoint sensor for endpoint detection and response?
Answer: Security, System, Application, and Sysmon logs among others
The Defender for Endpoint sensor collects a broad range of Windows event logs including Security, System, Application, and Sysmon events for comprehensive EDR coverage.