MS-102 Microsoft 365 Administrator Expert Managing Defender for Endpoint 3

Question 1

An administrator needs to deploy Defender for Endpoint to Linux servers. Which onboarding method is supported for Linux?

Accepted Answer

Local script or Ansible/Puppet/Chef

Answer

Linux devices can be onboarded using a local shell script or configuration management tools like Ansible, Puppet, or Chef.

Question 2

What is the purpose of the 'Live Response' feature in Microsoft Defender for Endpoint?

Accepted Answer

Provide a remote shell session to investigate and remediate a device in real time

Answer

Live Response gives security analysts a remote shell connection to a device, allowing them to run commands, collect files, and remediate threats interactively.

Question 3

Which role-based access control (RBAC) permission is required in Microsoft 365 Defender to approve or reject pending remediation actions in the Action center?

Accepted Answer

Active remediation actions permission

Answer

The 'Active remediation actions' permission within Defender for Endpoint RBAC allows users to approve or reject pending automated investigation actions.

Question 4

An organization enables automated investigation and remediation (AIR) at the full automation level. What happens when malware is detected on a device?

Accepted Answer

Defender automatically investigates and remediates threats without human approval

Answer

Full automation allows AIR to automatically investigate and remediate threats without requiring manual approval from security analysts.

Question 5

A company wants to block specific file hashes known to be malicious across all onboarded devices. Which Defender for Endpoint capability should they use?

Accepted Answer

Indicators of Compromise (IoC) — file hash block

Answer

Custom file hash IoCs can be configured to alert, allow, or block specific files identified by their SHA-1, SHA-256, or MD5 hash across onboarded devices.

(MS-102) Microsoft 365 Administrator Expert Practice Test

(MS-102) Microsoft 365 Administrator Expert Practice Test

MS-102 Microsoft 365 Administrator Expert Managing Defender for Endpoint 3