A security team wants to ensure that when a device is compromised, the incident is automatically investigated and the response is coordinated. They have already onboarded devices to Defender for Endpoint. What should they configure to enable automated investigation and response?

Enable the 'Live Response' feature in the Microsoft 365 Defender portal.

Enable the 'Threat intelligence' feature in the Microsoft 365 Defender portal.

Enable the 'Automated Investigation and Response' settings in the Microsoft 365 Defender portal.

Enable the 'EDR policy' in Intune and set the 'Sample collection' to 'All samples'.

Where can you view the encryption compliance status of devices managed by Microsoft Intune?

Microsoft Intune admin center > Devices > All devices

Microsoft 365 Defender portal > Incidents

Microsoft Purview compliance portal > Data classification

Microsoft Entra admin center > Users

What is the purpose of App Control for Business policies in Microsoft Intune?

To control which applications are allowed to run on devices

Which portal do users access to retrieve their own BitLocker recovery key when self-service recovery is enabled?

Microsoft Entra account portal (myaccount.microsoft.com)

A company uses Intune and Microsoft Defender for Endpoint. The security team wants to block malicious Office child processes and prevent credential theft from LSASS. They plan to use attack surface reduction (ASR) rules. Which two ASR rules should they enable?

Enable network protection and cloud-delivered protection in the antivirus policy.

Block executable files from running unless they meet a prevalence, age, or trusted list criterion and Block abuse of exploited vulnerable signed drivers.

Block process creations originating from PSExec and WMI commands and Block untrusted and unsigned processes that run from USB.

Block Office communication application from creating child processes and Block credential stealing from the Windows local security authority subsystem (lsass.exe).

Microsoft 365 Certified:Endpoint Administrator Associate

Domain 3Objective 1

Configure Endpoint Security MD-102 Practice Questions (Page 2)

Part of the Protect devices domain, which accounts for 15–20% of the MD-102 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

14concepts

15–20%of the exam

Questions 6–10

6application · medium
A security team wants to ensure that when a device is compromised, the incident is automatically investigated and the response is coordinated. They have already onboarded devices to Defender for Endpoint. What should they configure to enable automated investigation and response?
Select an answer first
7foundation · easy
Where can you view the encryption compliance status of devices managed by Microsoft Intune?
Select an answer first
8foundation · easy
What is the purpose of App Control for Business policies in Microsoft Intune?
Select an answer first
9foundation · easy
Which portal do users access to retrieve their own BitLocker recovery key when self-service recovery is enabled?
Select an answer first
10application · medium
A company uses Intune and Microsoft Defender for Endpoint. The security team wants to block malicious Office child processes and prevent credential theft from LSASS. They plan to use attack surface reduction (ASR) rules. Which two ASR rules should they enable?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to MD-102

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “MD-102” is a trademark of its owner, used for identification only.