MD-102 Protect devices Practice Question
You are investigating a malware incident on a Windows 10 device managed by Microsoft Intune and protected by Microsoft Defender for Endpoint. Which log should you analyze to determine the initial infection vector?
⚠ Common exam trap
Many candidates choose Windows Event Viewer (Option C) because they associate it with security auditing, but they fail to realize that the Defender XDR incident timeline is the centralized, cloud-native tool designed specifically for cross-device attack chain analysis in a managed environment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender XDR incident investigation timeline.
The Microsoft Defender XDR incident investigation timeline aggregates alerts, events, and forensic data from all Defender for Endpoint sensors across devices, providing a unified view of the attack chain. This timeline specifically surfaces the initial infection vector (e.g., malicious file, phishing link, or exploit) by correlating process creation, network connections, and file events at the moment of compromise, which is exactly what you need for malware incident analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Sysinternals Process Monitor logs.
Why it's wrong here
Process Monitor captures real-time file, registry and process activity, but only while running; it holds no historical record of the initial infection vector after the fact. It is tempting because it is a powerful live troubleshooting tool, and would be correct for diagnosing a reproducible application or driver fault as it happens.
- ✗
Microsoft Intune compliance reports.
Why it's wrong here
Intune compliance reports only show whether a device meets policy conditions such as encryption or OS version; they contain no process, file or network telemetry showing how malware arrived. They are tempting because Intune manages the device, and would be correct for confirming policy compliance or triggering conditional access.
- ✗
Windows Event Viewer logs on the device.
Why it's wrong here
Windows Event Viewer holds local OS, application and security events, not Defender for Endpoint's aggregated alert and investigation data that traces an infection's origin. It is tempting because it is the default place to inspect device-level errors, and it would be the right choice for troubleshooting a local service crash or logon failure.
- ✓
Microsoft Defender XDR incident investigation timeline.
Why this is correct
Microsoft Defender XDR's incident investigation timeline correlates alerts, process trees and file events across endpoints, exposing the parent process and originating artefact that triggered the malware. This directly satisfies the stem's requirement to determine the initial infection vector, which raw Defender for Endpoint device timelines alone present without cross-signal correlation.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise-grade security platform that protects devices, servers, and networks from advanced cyber threats by combining antivirus, endpoint detection and response, and automated investigation and remediation.
About these practice questions
Courseiva writes every MD-102 question from scratch — 556 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.