MD-102 Prepare infrastructure for devices Practice Question
You are configuring Microsoft Defender for Endpoint in Microsoft Intune for Windows 10 devices. You need to ensure that when a threat is detected, the device automatically receives a remediation action. Which configuration should you use?
⚠ Common exam trap
Test-takers frequently confuse alerting or compliance policies with actual remediation actions, mistakenly thinking that marking a device non-compliant or creating an alert will automatically remediate the threat, when in fact only the antivirus policy's automatic remediation setting directly triggers the remediation action on the device.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable 'Automatic remediation' in the Microsoft Defender Antivirus policy.
Enabling 'Automatic remediation' in the Microsoft Defender Antivirus policy within Intune's endpoint security node ensures that when a threat is detected, the device automatically applies the configured remediation action (e.g., quarantine, remove, or block) without requiring manual intervention. This setting directly controls the behavior of Microsoft Defender Antivirus to act on detected threats, aligning with the requirement for automatic remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a device compliance policy to mark the device as non-compliant.
Why it's wrong here
Compliance policies do not automatically remediate threats.
- ✗
Enable 'Manual investigation' in the endpoint security policy.
Why it's wrong here
Manual investigation requires human intervention.
- ✗
Create an alert rule in Microsoft Defender XDR to notify administrators.
Why it's wrong here
Alerting does not automatically remediate.
- ✓
Enable 'Automatic remediation' in the Microsoft Defender Antivirus policy.
Why this is correct
Automatic remediation allows Defender to take action on detected threats.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Windows 10
Windows 10 is a personal computer operating system developed by Microsoft that combines the familiarity of Windows 7 with the modern features of Windows 8, designed to run on a wide range of devices from desktops to tablets.
About these practice questions
Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.