Microsoft 365 Administrator Expert Managing Defender for Endpoint Flashcards
7 cards from real MS-102 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Microsoft 365 Administrator Expert Managing Defender for Endpoint flashcards as text
An administrator needs to ensure that endpoint detection data from Defender for Endpoint is stored within the European Union. Where is this configured?
Answer: During initial Defender for Endpoint setup when selecting the data storage location
The data storage location (US, EU, or UK) for Defender for Endpoint is selected during the initial service setup and cannot be changed without offboarding.
What is the function of 'Alert suppression rules' in Microsoft Defender for Endpoint?
Answer: Automatically hide recurring known-benign alerts to reduce alert fatigue
Suppression rules allow administrators to define conditions under which specific alerts are automatically suppressed, reducing noise from known legitimate activity.
A Defender for Endpoint investigation reveals a suspicious PowerShell script. An analyst uses Live Response to collect the script file for offline analysis. Which command should they use?
Answer: get-file
The 'get-file' command in Live Response downloads a file from the device to the portal for offline forensic analysis.
Which attack surface reduction rule helps prevent credential theft by blocking attempts to dump credentials from the Windows LSASS process?
Answer: Block credential stealing from the Windows local security authority subsystem
The ASR rule 'Block credential stealing from the Windows local security authority subsystem' prevents tools like Mimikatz from dumping LSASS memory.
What does the 'Exposure score' in Defender for Endpoint's Threat and Vulnerability Management represent?
Answer: The aggregate vulnerability exposure level of the entire organization's device fleet
The exposure score aggregates vulnerability data across all devices to represent the organization's overall susceptibility to exploitation.
An administrator wants to ensure Microsoft Defender Antivirus does not interfere with a third-party security product already installed. What mode should Defender Antivirus be configured to?
Answer: Passive mode
Passive mode allows Defender Antivirus to coexist with a primary third-party AV product, providing EDR data without actively scanning or remediating threats.
Which Microsoft 365 Defender feature provides a unified view correlating alerts from Defender for Endpoint, Defender for Identity, and Defender for Office 365 into a single incident?
Answer: Incidents queue
The incidents queue in Microsoft 365 Defender automatically correlates related alerts from multiple Defender products into a single incident for unified investigation.