When triaging an incident in Microsoft Defender for Endpoint, which factor is most important for prioritizing response actions?

The number of devices in the organization

The severity and impact of the incident

An organization has enabled BitLocker on all Windows devices. The helpdesk is overwhelmed with password reset requests from users who forget their BitLocker PIN. The security team wants to reduce the helpdesk workload while maintaining security. What should you configure?

Configure the BitLocker policy to store recovery keys in on-premises Active Directory.

Disable the BitLocker PIN requirement and use automatic unlock for all drives.

Enable the self-service recovery portal in Azure AD and communicate the URL to users.

Provide the helpdesk with a script to reset BitLocker PINs remotely.

Which connector must be enabled in Microsoft Intune to integrate with Microsoft Defender for Endpoint?

Microsoft Defender for Endpoint connector

In a Zero Trust model, what is the role of Microsoft Intune compliance policies?

To replace the need for antivirus software

To define the minimum security requirements a device must meet to access resources

To provide a virtual private network for remote access

To automatically remediate all security issues on devices

A global law firm is adopting Zero Trust. They have a mix of Windows 10 and Windows 11 devices, some unmanaged (BYOD). The security team wants to enforce conditional access that requires healthy, compliant devices to access Microsoft 365 apps. They also want to onboard unmanaged devices to Defender for Endpoint. Which two actions should they take?

Enroll all devices in Intune and deploy a compliance policy that requires Defender for Endpoint health; then create a Conditional Access policy that requires 'Device to be marked as compliant'.

Use App Control for Business to block all non-approved apps on unmanaged devices, and require users to sign in with a PIN.

Onboard unmanaged devices to Defender for Endpoint using a script, and then create a firewall policy that blocks all inbound traffic.

Create a Conditional Access policy that requires MFA for all users, and deploy a security baseline to all devices.

Microsoft 365 Certified:Endpoint Administrator Associate

Domain 3Objective 1

Configure Endpoint Security MD-102 Practice Questions (Page 4)

Part of the Protect devices domain, which accounts for 15–20% of the MD-102 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

14concepts

15–20%of the exam

Questions 16–20

16foundation · easy
When triaging an incident in Microsoft Defender for Endpoint, which factor is most important for prioritizing response actions?
Select an answer first
17application · medium
An organization has enabled BitLocker on all Windows devices. The helpdesk is overwhelmed with password reset requests from users who forget their BitLocker PIN. The security team wants to reduce the helpdesk workload while maintaining security. What should you configure?
Select an answer first
18foundation · easy
Which connector must be enabled in Microsoft Intune to integrate with Microsoft Defender for Endpoint?
Select an answer first
19foundation · easy
In a Zero Trust model, what is the role of Microsoft Intune compliance policies?
Select an answer first
20expert · hard
A global law firm is adopting Zero Trust. They have a mix of Windows 10 and Windows 11 devices, some unmanaged (BYOD). The security team wants to enforce conditional access that requires healthy, compliant devices to access Microsoft 365 apps. They also want to onboard unmanaged devices to Defender for Endpoint. Which two actions should they take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to MD-102

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “MD-102” is a trademark of its owner, used for identification only.