MD-102 Protect devices Practice Question
You have enabled Microsoft Defender for Endpoint on macOS devices. Some macOS devices show a status of 'Sensor disconnected' in the Microsoft Defender XDR portal. The devices are online and can communicate with the internet. Which troubleshooting step should you take first?
⚠ Common exam trap
A common mix-up: candidates assume a connectivity issue requires re-enrollment or reinstallation, but Microsoft's official troubleshooting guidance prioritizes a full scan first because it restarts the sensor process without disrupting the device's security posture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run a full scan using Microsoft Defender for Endpoint on the affected devices.
Running a full scan is the first recommended troubleshooting step when macOS devices show a 'Sensor disconnected' status in Microsoft Defender XDR. This status often indicates that the sensor process (e.g., mdatp) is not running or has crashed, and a full scan can trigger the sensor to restart and re-establish communication with the cloud backend. It is a non-disruptive, quick check that validates the agent's core functionality before escalating to more invasive steps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check the Windows Security app for any alerts.
Why it's wrong here
macOS does not have a Windows Security app.
- ✓
Run a full scan using Microsoft Defender for Endpoint on the affected devices.
Why this is correct
Malware can cause sensor disconnection; scanning may resolve it.
- ✗
Re-enroll the devices in Microsoft Intune.
Why it's wrong here
Re-enrollment does not address sensor disconnection.
- ✗
Uninstall and reinstall the Microsoft Defender for Endpoint agent.
Why it's wrong here
This is a last resort, not first step.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Microsoft Defender XDR
Microsoft Defender XDR is a unified security platform that automatically correlates alerts from across an organization's endpoints, email, identities, and cloud apps to stop complex attacks.
Key term
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise-grade security platform that protects devices, servers, and networks from advanced cyber threats by combining antivirus, endpoint detection and response, and automated investigation and remediation.
About these practice questions
Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.