MD-102 Protect devices Practice Question
Exhibit
Refer to the exhibit.
```kusto
DeviceEvents
| where Timestamp > ago(7d)
| where DeviceName in ('PC001', 'PC002')
| where ActionType == 'AntivirusDetection'
| summarize DetectionCount = count() by DeviceName
| where DetectionCount > 0
```Refer to the exhibit. A KQL query in Microsoft Defender XDR returns no results for PC001 and PC002 even though you know there have been antivirus detections on those devices. What is the most likely reason?
⚠ Common exam trap
Many candidates assume any generic detection filter (like 'Detection' or 'Malware') will work, but Microsoft Defender XDR requires the precise ActionType value for antivirus events, and the question deliberately uses a filter that excludes those specific records.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ActionType filter is incorrect for antivirus detections
Antivirus detections in Microsoft Defender XDR are logged under specific ActionType values such as 'AntivirusDetection' or 'AntivirusDetectionCleaned', not generic detection names. If the KQL query uses an incorrect ActionType filter (e.g., filtering for 'MalwareDetection' or a misspelled value), it will return no results for PC001 and PC002 even though detections exist. The query must reference the exact ActionType string used by Microsoft Defender for Endpoint's antivirus events.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The timestamp range is too narrow
Why it's wrong here
7 days should capture recent detections.
- ✗
The device names are case-sensitive and are entered incorrectly
Why it's wrong here
Defender XDR is case-insensitive for device names.
- ✗
You do not have permissions to view events on those devices
Why it's wrong here
Permissions would cause an error, not empty results.
- ✓
The ActionType filter is incorrect for antivirus detections
Why this is correct
Antivirus detection action types may be 'AntivirusDetectedMalware' or others.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise-grade security platform that protects devices, servers, and networks from advanced cyber threats by combining antivirus, endpoint detection and response, and automated investigation and remediation.
Key term
Microsoft Defender XDR
Microsoft Defender XDR is a unified security platform that automatically correlates alerts from across an organization's endpoints, email, identities, and cloud apps to stop complex attacks.
About these practice questions
This MD-102 question is part of Courseiva's 942-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.