Courseiva
Protect deviceshardMultiple ChoiceObjective-mapped

MD-102 Protect devices Practice Question

Exhibit

Refer to the exhibit.

```json
{
  "@odata.type": "#microsoft.graph.windows10EndpointProtectionConfiguration",
  "firewallRules": [
    {
      "@odata.type": "#microsoft.graph.windowsFirewallRule",
      "displayName": "Allow RDP",
      "direction": "inbound",
      "protocol": "tcp",
      "localPortRanges": ["3389"],
      "action": "block"
    }
  ],
  "defenderDetectedMalwareActions": {
    "highSeverity": "block",
    "moderateSeverity": "clean",
    "lowSeverity": "allow"
  }
}
```

Refer to the exhibit. You deploy this endpoint protection configuration to a Windows 10 device. A user reports that they cannot connect to the device via RDP. What is the most likely cause?

⚠ Common exam trap

Candidates often assume a rule named 'Allow RDP' must permit traffic, overlooking the 'Action: Block' setting, which is the critical detail that reverses the rule's effect.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

The firewall rule 'Allow RDP' is configured to block traffic.

The exhibit shows that the 'Allow RDP' firewall rule has its 'Action' set to 'Block', which overrides any other configuration. Windows Defender Firewall processes rules in order of priority, and a block action explicitly denies inbound RDP traffic (TCP port 3389), preventing any RDP connection to the device. This is the most direct cause of the user's inability to connect via RDP.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • The firewall rule 'Allow RDP' is configured to block traffic.

    Why this is correct

    The action is 'block', preventing RDP connections.

  • The firewall rule is for outbound traffic, not inbound.

    Why it's wrong here

    Direction is inbound.

  • The malware actions are blocking RDP traffic.

    Why it's wrong here

    Malware actions do not affect firewall.

  • The firewall rule 'Allow RDP' is configured to allow traffic.

    Why it's wrong here

    It is set to block.

Visual reference

Client Server SYN (seq=100) SYN-ACK (seq=200, ack=101) ACK (ack=201) Connection established — data transfer begins

Go deeper

Related to this question

About these practice questions

This MD-102 question is part of Courseiva's 942-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.