A security analyst receives an alert in Microsoft Defender for Endpoint about a suspicious PowerShell command on a device. The analyst wants to investigate the process tree and determine if the command is part of a known attack. Which two actions should the analyst take?

Open the device timeline and review the process tree, then use the 'Go hunt' option to run a Kusto query for related events.

Immediately isolate the device and then run a full antivirus scan.

Submit the file to Microsoft for analysis and wait for the result.

Delete the alert and block the PowerShell executable using App Control for Business.

A company has a mix of Windows 10 and Windows 11 devices. They want to implement a layered security approach that includes antivirus, attack surface reduction, and Zero Trust principles. The security team is concerned about performance impact on older devices. What should you do?

Do not deploy any security policies to older devices to avoid performance issues.

Deploy the antivirus policy to all devices, but only deploy ASR rules to devices that meet the performance criteria.

Deploy the ASR rules to all devices, but only deploy the antivirus policy to devices that meet the performance criteria.

Deploy all security policies to all devices, and monitor performance using the Intune reports.

A company wants to apply a consistent security configuration to all Windows 10 devices using Intune. They want to include antivirus, firewall, and BitLocker settings. What should they use?

A security baseline that includes all the required settings.

A single antivirus policy that also configures firewall and BitLocker.

A PowerShell script that configures all settings.

A device compliance policy that requires the settings.

Which policy type in Microsoft Intune is used to configure Endpoint Detection and Response (EDR) settings for devices?

Endpoint detection and response

Microsoft 365 Certified:Endpoint Administrator Associate

Domain 3Objective 1

Configure Endpoint Security MD-102 Practice Questions (Page 8)

Part of the Protect devices domain, which accounts for 15–20% of the MD-102 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

14concepts

15–20%of the exam

Questions 36–40

36application · medium
A security analyst receives an alert in Microsoft Defender for Endpoint about a suspicious PowerShell command on a device. The analyst wants to investigate the process tree and determine if the command is part of a known attack. Which two actions should the analyst take?
Select an answer first
37expert · hard
A company has a mix of Windows 10 and Windows 11 devices. They want to implement a layered security approach that includes antivirus, attack surface reduction, and Zero Trust principles. The security team is concerned about performance impact on older devices. What should you do?
Select an answer first
38application · medium
A company wants to apply a consistent security configuration to all Windows 10 devices using Intune. They want to include antivirus, firewall, and BitLocker settings. What should they use?
Select an answer first
39foundation · easy
Which policy type in Microsoft Intune is used to configure Endpoint Detection and Response (EDR) settings for devices?
Select an answer first
40foundation · easy
Which report in Microsoft Intune provides a summary of encryption status across devices?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to MD-102

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “MD-102” is a trademark of its owner, used for identification only.