Microsoft 365 Administrator Expert Managing Defender for Endpoint Flashcards
7 cards from real MS-102 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Microsoft 365 Administrator Expert Managing Defender for Endpoint flashcards as text
An administrator wants to configure Defender for Endpoint to send alerts to a SIEM solution. Which integration method is recommended for Microsoft Sentinel?
Answer: Use the Microsoft 365 Defender connector in Microsoft Sentinel
The Microsoft 365 Defender data connector in Microsoft Sentinel natively ingests incidents and alerts from Defender for Endpoint without requiring custom scripting.
Which Defender for Endpoint feature provides a risk-based prioritization of vulnerabilities by correlating asset exposure with threat intelligence?
Answer: Threat and Vulnerability Management (TVM)
TVM continuously assesses device vulnerabilities and correlates them with active exploit activity and threat intelligence to prioritize remediation.
A security team wants to create a custom alert when a specific process is executed on any onboarded device. Which Defender for Endpoint capability supports this?
Answer: Custom detection rules
Custom detection rules run scheduled KQL queries against advanced hunting data and generate alerts or take actions when the query returns results.
What happens to a device's status in the Defender for Endpoint portal if it has not communicated with the service for more than 7 days?
Answer: Its status changes to 'Inactive'
Devices that do not report to the Defender for Endpoint service for more than 7 days are marked as 'Inactive' but remain in the device inventory.
Which onboarding package type should be used when deploying Defender for Endpoint to Windows 10 devices using Microsoft Intune?
Answer: Mobile Device Management (MDM)
When using Intune, the MDM onboarding package is selected in the Defender for Endpoint portal and deployed as an Intune device configuration policy.
An organization needs to allow a security operations team to view alerts and device details but not take any remediation actions. Which built-in Defender for Endpoint role should be assigned?
Answer: Security Reader
The Security Reader role provides read-only access to alerts, devices, and reports in Defender for Endpoint without the ability to take response actions.
Which Microsoft Defender for Endpoint capability specifically helps identify unmanaged devices on the network that have not been onboarded?
Answer: Device discovery
Device discovery uses onboarded devices as probes to passively or actively identify unmanaged endpoints and network devices on the corporate network.