MD-102 Protect devices Practice Question
You are implementing Microsoft Defender for Endpoint on Windows Server devices managed by Microsoft Intune. After onboarding, the devices show as 'Inactive' in the Microsoft Defender XDR portal. Which action should you take?
⚠ Common exam trap
Watch out — candidates often assume an 'Inactive' status always means onboarding failed, leading them to re-run the onboarding script or reinstall the agent, when in fact the most common cause is a stopped sensor service that simply needs a restart.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restart the Microsoft Defender for Endpoint service on the devices.
When devices show as 'Inactive' in the Microsoft Defender XDR portal after onboarding, it typically indicates that the Microsoft Defender for Endpoint service (Sense) is not running or has stalled. Restarting the service forces the sensor to reinitialize and re-establish communication with the cloud backend, resolving the inactive state without requiring a full re-onboarding.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the Windows Security app configuration policy to enable real-time protection.
Why it's wrong here
Real-time protection is separate from sensor communication.
- ✓
Restart the Microsoft Defender for Endpoint service on the devices.
Why this is correct
Restarting the service can re-establish communication.
- ✗
Re-run the onboarding script on the devices.
Why it's wrong here
The script was already run; the issue is likely service-related.
- ✗
Uninstall and reinstall the Microsoft Defender for Endpoint agent.
Why it's wrong here
This is disruptive and may not be necessary.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Microsoft Intune
Microsoft Intune is a cloud-based service that helps organizations manage employee devices, apps, and security policies without needing to own or control the physical hardware.
Key term
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise-grade security platform that protects devices, servers, and networks from advanced cyber threats by combining antivirus, endpoint detection and response, and automated investigation and remediation.
About these practice questions
Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.