MD-102 Manage and maintain devices Practice Question
Exhibit
{
"@odata.type": "#microsoft.graph.windows10GeneralConfiguration",
"defenderDetectedMalwareActions": {
"lowSeverity": "clean",
"moderateSeverity": "clean",
"highSeverity": "block",
"severeSeverity": "block"
},
"defenderCloudBlockLevel": "high",
"defenderPromptForSampleSubmission": "alwaysPrompt",
"defenderPUAProtection": "enabled"
}Refer to the exhibit. You apply this device configuration profile to a Windows 10 device. A user downloads a file that is classified as potentially unwanted application (PUA). What action will Defender take?
⚠ Common exam trap
Candidates often confuse the 'Block' action of PUA protection with the 'Allow' or 'Audit' options, or mistakenly think that cloud analysis or automatic remediation occurs at the point of download, when in fact the block is enforced immediately by the local policy setting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block the file from being downloaded.
The device configuration profile shown in the exhibit sets the 'PUAProtection' policy to 'Enabled' with the 'Block' option selected. When a user attempts to download a file classified as a potentially unwanted application (PUA), Microsoft Defender for Endpoint enforces this policy by blocking the download entirely, preventing the file from being written to disk. Option D is correct because the explicit 'Block' setting overrides any other behavior, ensuring the PUA is not allowed to execute or persist on the device.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Audit the detection and allow the download.
Why it's wrong here
Audit mode is not enabled; PUA protection is enabled.
- ✗
Send the file to the cloud for analysis.
Why it's wrong here
This is controlled by cloud block level, not the action on detection.
- ✗
Automatically clean the file.
Why it's wrong here
Cleaning is not an action for PUA; the default is block.
- ✓
Block the file from being downloaded.
Why this is correct
PUA protection enabled blocks the file.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise-grade security platform that protects devices, servers, and networks from advanced cyber threats by combining antivirus, endpoint detection and response, and automated investigation and remediation.
About these practice questions
One of 942 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.