MS-102 Microsoft 365 Administrator Expert Managing Defender for Endpoint 4

Question 1

An administrator wants to configure Defender for Endpoint to send alerts to a SIEM solution. Which integration method is recommended for Microsoft Sentinel?

Accepted Answer

Use the Microsoft 365 Defender connector in Microsoft Sentinel

Answer

The Microsoft 365 Defender data connector in Microsoft Sentinel natively ingests incidents and alerts from Defender for Endpoint without requiring custom scripting.

Question 2

Which Defender for Endpoint feature provides a risk-based prioritization of vulnerabilities by correlating asset exposure with threat intelligence?

Accepted Answer

Threat and Vulnerability Management (TVM)

Answer

TVM continuously assesses device vulnerabilities and correlates them with active exploit activity and threat intelligence to prioritize remediation.

Question 3

A security team wants to create a custom alert when a specific process is executed on any onboarded device. Which Defender for Endpoint capability supports this?

Accepted Answer

Custom detection rules

Answer

Custom detection rules run scheduled KQL queries against advanced hunting data and generate alerts or take actions when the query returns results.

Question 4

What happens to a device's status in the Defender for Endpoint portal if it has not communicated with the service for more than 7 days?

Accepted Answer

Its status changes to 'Inactive'

Answer

Devices that do not report to the Defender for Endpoint service for more than 7 days are marked as 'Inactive' but remain in the device inventory.

Question 5

Which onboarding package type should be used when deploying Defender for Endpoint to Windows 10 devices using Microsoft Intune?

Accepted Answer

Mobile Device Management (MDM)

Answer

When using Intune, the MDM onboarding package is selected in the Defender for Endpoint portal and deployed as an Intune device configuration policy.

(MS-102) Microsoft 365 Administrator Expert Practice Test

(MS-102) Microsoft 365 Administrator Expert Practice Test

MS-102 Microsoft 365 Administrator Expert Managing Defender for Endpoint 4