Pass Your Microsoft MD-102 Exam Easy!

Threat action records distinguish detection from successful cleanup. It solves confirmed malware handling; the actual goal is persistent managed malware protection.

Intune policy targeting defines the actual platform and device population. Its role is attributable antivirus assignment scope; this case requires persistent managed malware protection.

Malware definition updates rely on reachable approved update infrastructure. The choice addresses restored antivirus signature updates rather than persistent managed malware protection.

Security incident operations can be delegated without broad tenant administrator rights. Its role is bounded EDR investigation authority; this case requires observation-only security review.

Granular management RBAC minimizes unrelated destructive power. This is appropriate for key rotation without wipe rights, not the specified observation-only security review.

Removing broad policy privileges aligns access with assigned duty. That suits least-privilege security contractor, whereas this device needs observation-only security review.

Sensor telemetry requires reachability to configured security cloud services. That suits branch EDR connectivity restoration, whereas this device needs active Defender device inventory.

Threat detection does not automatically encrypt local disks. The choice addresses separate device data-at-rest protection rather than active Defender device inventory.

Risk may reflect behavior and incident evidence beyond malware definitions. It solves resolved endpoint risk evidence; the actual goal is active Defender device inventory.

Filtered-traffic logs make deny enforcement observable. This is appropriate for auditable outbound policy effect, not the specified enforced enterprise RDP restriction.

Address and port constraints permit narrowly authorized service traffic. It solves subnet-limited service connectivity; the actual goal is enforced enterprise RDP restriction.

Network profiles change the effective firewall rules based on network trust. Its role is reduced public-network exposure; this case requires enforced enterprise RDP restriction.

Quarantine restoration requires security validation to avoid reactivating malware. That suits defensible false-positive recovery, whereas this device needs urgent endpoint network containment.

Preventive behavior controls address repeated exploit techniques. The choice addresses fleet-scale Office exploit mitigation rather than urgent endpoint network containment.

Recovery-key rotation invalidates credentials that were exposed. This is appropriate for replacement of used recovery key, not the specified urgent endpoint network containment.

EDR investigation captures behavioral alerts beyond simple antivirus configuration. Its role is investigated suspected endpoint compromise; this case requires minimal authorized scan exclusion.

Antivirus profiles configure endpoint malware prevention controls. That suits centrally enforced real-time scanning, whereas this device needs minimal authorized scan exclusion.

Updated signatures give the antivirus engine current detection information. It solves current antivirus intelligence; the actual goal is minimal authorized scan exclusion.

Rotation replaces an exposed recovery protector without disabling encryption. This is appropriate for invalidation of exposed recovery secret, not the specified recoverable encryption credentials.

Encryption reporting measures device protection and deployment failures. That suits verified fleet encryption state, whereas this device needs recoverable encryption credentials.

Disk-encryption settings configure BitLocker protection on supported devices. It solves encrypted corporate system drives; the actual goal is recoverable encryption credentials.

Effective firewall rules and events identify blocked traffic and conflicting settings. The choice addresses explained application connection block rather than controlled remote management port.

Profile-aware rules adapt endpoint network filtering to the detected network category. It solves risk-aware per-network firewall behavior; the actual goal is controlled remote management port.

Stateful firewall policy can default-deny unapproved inbound traffic. This is appropriate for restricted inbound network exposure, not the specified controlled remote management port.

ASR rules constrain common exploit behaviors at process boundaries. The choice addresses reduced Office malware execution rather than measured ASR rule impact.

Controlled exclusions preserve protection while accommodating verified exceptions. Its role is defensible ASR exception; this case requires measured ASR rule impact.

ASR telemetry associates enforcement with the exact configured mitigation. This is appropriate for attributable attack-surface enforcement, not the specified measured ASR rule impact.

Item-level status pinpoints individual hardening settings that did not apply. The choice addresses diagnosed baseline compliance gap rather than resolved baseline setting conflict.

Baselines deliver a curated starting set of security configurations. Its role is standardized secure endpoint configuration; this case requires resolved baseline setting conflict.

Baseline revisions can alter effective hardening behavior. That suits controlled baseline version adoption, whereas this device needs resolved baseline setting conflict.

EDR incident detail correlates process, alert and behavioral evidence. It solves full suspicious-device investigation; the actual goal is EDR risk-based device access.

Successful policy assignment does not prove active EDR sensor communication. Its role is working Defender endpoint sensor; this case requires EDR risk-based device access.

EDR onboarding establishes device reporting to Microsoft Defender security services. That suits onboarded endpoint detection telemetry, whereas this device needs EDR risk-based device access.