MS-102 Microsoft 365 Administrator Expert Managing Defender for Endpoint 5

Question 1

An administrator needs to ensure that endpoint detection data from Defender for Endpoint is stored within the European Union. Where is this configured?

Accepted Answer

During initial Defender for Endpoint setup when selecting the data storage location

Answer

The data storage location (US, EU, or UK) for Defender for Endpoint is selected during the initial service setup and cannot be changed without offboarding.

Question 2

What is the function of 'Alert suppression rules' in Microsoft Defender for Endpoint?

Accepted Answer

Automatically hide recurring known-benign alerts to reduce alert fatigue

Answer

Suppression rules allow administrators to define conditions under which specific alerts are automatically suppressed, reducing noise from known legitimate activity.

Question 3

A Defender for Endpoint investigation reveals a suspicious PowerShell script. An analyst uses Live Response to collect the script file for offline analysis. Which command should they use?

Accepted Answer

get-file <path>

Answer

The 'get-file' command in Live Response downloads a file from the device to the portal for offline forensic analysis.

Question 4

Which attack surface reduction rule helps prevent credential theft by blocking attempts to dump credentials from the Windows LSASS process?

Accepted Answer

Block credential stealing from the Windows local security authority subsystem

Answer

The ASR rule 'Block credential stealing from the Windows local security authority subsystem' prevents tools like Mimikatz from dumping LSASS memory.

Question 5

What does the 'Exposure score' in Defender for Endpoint's Threat and Vulnerability Management represent?

Accepted Answer

The aggregate vulnerability exposure level of the entire organization's device fleet

Answer

The exposure score aggregates vulnerability data across all devices to represent the organization's overall susceptibility to exploitation.

(MS-102) Microsoft 365 Administrator Expert Practice Test

(MS-102) Microsoft 365 Administrator Expert Practice Test

MS-102 Microsoft 365 Administrator Expert Managing Defender for Endpoint 5