During an incident, a Defender for Endpoint alert shows that a device executed a malicious script that then attempted to access multiple internal servers. The analyst needs to determine the full scope of the attack and prioritize response. Which approach is most effective?

Run a full antivirus scan on all devices in the same organizational unit.

Check the Windows Event Log on the affected device for logon events.

Isolate the affected device immediately and then reimage it.

Use advanced hunting to query for the script's hash and command-line across all devices, then review the incident graph to see related alerts.

A hospital uses Intune to manage Windows 10 devices. The security team wants to block inbound SMB traffic on all devices, but the radiology department runs a legacy imaging application that requires inbound SMB from a specific on-premises server. You are configuring a firewall policy in Intune. What is the best approach to meet both requirements?

Create a single firewall policy that blocks inbound SMB for all devices, and exclude the radiology devices from the assignment.

Use a security baseline that disables SMB entirely on all devices, and have the radiology department use a VPN for the legacy application.

Create a firewall rule that blocks inbound SMB for all devices, then create a second rule that allows inbound SMB only from the radiology server's IP address and assign it to the radiology devices.

Configure Windows Defender Firewall with Advanced Security on each device manually and skip Intune firewall policies.

A security analyst is investigating a potential malware outbreak. The Microsoft 365 Defender portal shows multiple devices with the same file hash flagged as malicious. The analyst needs to determine the scope of the infection and identify the initial entry point. What should the analyst do?

Use the 'Live Response' feature to manually inspect each device.

Use the 'Incident queue' to see which incidents are related to the file.

Use the 'Device inventory' to check which devices have the file.

Use the 'Advanced hunting' feature to query for the file hash across all devices and timeline events.

A company wants to onboard their Windows 10 devices to Microsoft Defender for Endpoint. They are using Intune to manage the devices. What is the recommended way to onboard the devices?

Use a Group Policy to deploy the onboarding package.

Create a device configuration profile that deploys the Defender for Endpoint onboarding package.

Manually run the onboarding script on each device.

Create a compliance policy that requires Defender for Endpoint to be onboarded.

Microsoft 365 Certified:Endpoint Administrator Associate

Domain 3Objective 1

Configure Endpoint Security MD-102 Practice Questions (Page 6)

Part of the Protect devices domain, which accounts for 15–20% of the MD-102 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

14concepts

15–20%of the exam

Questions 26–30

26expert · hard
During an incident, a Defender for Endpoint alert shows that a device executed a malicious script that then attempted to access multiple internal servers. The analyst needs to determine the full scope of the attack and prioritize response. Which approach is most effective?
Select an answer first
27expert · hard
A hospital uses Intune to manage Windows 10 devices. The security team wants to block inbound SMB traffic on all devices, but the radiology department runs a legacy imaging application that requires inbound SMB from a specific on-premises server. You are configuring a firewall policy in Intune. What is the best approach to meet both requirements?
Select an answer first
28expert · hard
A security analyst is investigating a potential malware outbreak. The Microsoft 365 Defender portal shows multiple devices with the same file hash flagged as malicious. The analyst needs to determine the scope of the infection and identify the initial entry point. What should the analyst do?
Select an answer first
29foundation · easy
You need to create a firewall policy in Microsoft Intune for Windows devices. Which policy type should you select from the Endpoint security blade?
Select an answer first
30application · medium
A company wants to onboard their Windows 10 devices to Microsoft Defender for Endpoint. They are using Intune to manage the devices. What is the recommended way to onboard the devices?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to MD-102

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “MD-102” is a trademark of its owner, used for identification only.

Configure Endpoint Security MD-102 Practice Questions (Page 6)

Questions 26–30

During an incident, a Defender for Endpoint alert shows that a device executed a malicious script that then attempted to access multiple internal servers. The analyst needs to determine the full scope of the attack and prioritize response. Which approach is most effective?

A security analyst is investigating a potential malware outbreak. The Microsoft 365 Defender portal shows multiple devices with the same file hash flagged as malicious. The analyst needs to determine the scope of the infection and identify the initial entry point. What should the analyst do?

You need to create a firewall policy in Microsoft Intune for Windows devices. Which policy type should you select from the Endpoint security blade?

A company wants to onboard their Windows 10 devices to Microsoft Defender for Endpoint. They are using Intune to manage the devices. What is the recommended way to onboard the devices?

Keep studying — Protect devices