MS-102 Microsoft 365 Administrator Expert Managing Defender for Endpoint 2

Question 1

An administrator needs to isolate a compromised device from the network while keeping it connected to the Defender for Endpoint service for investigation. Which action should they take in the Microsoft 365 Defender portal?

Accepted Answer

Contain device

Answer

The 'Contain device' action isolates the device from the network while maintaining the Defender for Endpoint management channel for investigation.

Question 2

Which Defender for Endpoint feature uses behavioral sensors embedded in Windows to collect and process signals from the operating system?

Accepted Answer

Endpoint Detection and Response (EDR)

Answer

EDR uses behavioral sensors embedded in the OS to continuously collect telemetry signals that are processed in the Microsoft cloud.

Question 3

A security analyst wants to hunt for threats across devices using custom queries. Which tool in Microsoft 365 Defender should they use?

Accepted Answer

Advanced hunting

Answer

Advanced hunting allows analysts to write Kusto Query Language (KQL) queries to proactively search for threats across devices and other data sources.

Question 4

What is the default data retention period for Defender for Endpoint raw data in the Microsoft 365 Defender portal?

Accepted Answer

180 days

Answer

Defender for Endpoint retains raw telemetry data for 180 days by default, giving analysts a six-month window for threat hunting and investigation.

Question 5

An organization wants to prevent users from accessing known malicious IP addresses at the network level on Windows 10 devices. Which Defender for Endpoint feature should be enabled?

Accepted Answer

Network protection

Answer

Network protection extends SmartScreen to block outbound connections to malicious IP addresses and domains at the kernel level.

(MS-102) Microsoft 365 Administrator Expert Practice Test

(MS-102) Microsoft 365 Administrator Expert Practice Test

MS-102 Microsoft 365 Administrator Expert Managing Defender for Endpoint 2