Manage and maintain devices →mediumMultiple ChoiceObjective-mapped

MD-102 Manage and maintain devices Practice Question

Exhibit

Refer to the exhibit.

```json
{
  "@odata.type": "#microsoft.graph.windows10EndpointProtectionConfiguration",
  "defenderBlockOnAccessProtection": true,
  "defenderScheduleScanDay": "everyday",
  "defenderScanType": "quick",
  "defenderCloudBlockLevel": "high",
  "defenderPUAProtection": "enabled",
  "defenderRealTimeScanDirection": "monitorAllFiles"
}
```

You deployed this endpoint protection policy to a Windows 10 device. A user reports that a known malicious file was downloaded but not blocked. What is the most likely reason?

⚠ Common exam trap

It's easy for candidates to assume a protection policy is automatically active once created, but Microsoft Intune policies require device check-in and successful application before they take effect, and the cloud block level setting is often misunderstood as affecting known malware detection.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy has not been applied to the device yet.

If the endpoint protection policy has not been applied to the device, the Microsoft Defender for Endpoint settings (including real-time scanning and cloud-delivered protection) are not active. The policy must be successfully delivered via Microsoft Intune or Configuration Manager before any protection rules take effect. Without policy application, the device runs with default or no protection, allowing known malicious files to be downloaded without being blocked.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Real-time scanning is set to monitorAllFiles, but the file was an archive.
Why it's wrong here
Real-time scanning should still scan archives.
✗
The scan type is set to quick, which does not scan downloaded files.
Why it's wrong here
Quick scan still scans common locations including downloads.
✗
The cloud block level is set to high, which may block unknown files, but known files might be missed.
Why it's wrong here
Cloud block level high should block unknown, not known.
✓
The policy has not been applied to the device yet.
Why this is correct
If the policy hasn't applied, settings are not active.

Go deeper

MD-102 Manage and maintain devices Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question