MD-102 Protect devices Practice Question
You are investigating a malware incident on a Windows 10 device managed by Microsoft Intune and protected by Microsoft Defender for Endpoint. Which log should you analyze to determine the initial infection vector?
⚠ Common exam trap
Many candidates choose Windows Event Viewer (Option C) because they associate it with security auditing, but they fail to realize that the Defender XDR incident timeline is the centralized, cloud-native tool designed specifically for cross-device attack chain analysis in a managed environment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender XDR incident investigation timeline.
The Microsoft Defender XDR incident investigation timeline aggregates alerts, events, and forensic data from all Defender for Endpoint sensors across devices, providing a unified view of the attack chain. This timeline specifically surfaces the initial infection vector (e.g., malicious file, phishing link, or exploit) by correlating process creation, network connections, and file events at the moment of compromise, which is exactly what you need for malware incident analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Sysinternals Process Monitor logs.
Why it's wrong here
Process Monitor is a manual tool, not integrated with Defender.
- ✗
Microsoft Intune compliance reports.
Why it's wrong here
Compliance reports do not include malware infection details.
- ✗
Windows Event Viewer logs on the device.
Why it's wrong here
Event Viewer logs are useful but not the primary source for Defender detections.
- ✓
Microsoft Defender XDR incident investigation timeline.
Why this is correct
The timeline shows the initial infection vector and related events.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise-grade security platform that protects devices, servers, and networks from advanced cyber threats by combining antivirus, endpoint detection and response, and automated investigation and remediation.
About these practice questions
Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.