MD-102 Protect devices Practice Question
You manage 500 Windows 11 devices with Microsoft Intune. A security policy requires that all devices run Microsoft Defender Antivirus with real-time protection enabled. You configure a Windows 10 and later antivirus policy in Intune and assign it to all devices. Several devices report that real-time protection is disabled. You need to ensure that real-time protection cannot be disabled by local administrators. What should you do?
⚠ Common exam trap
The trap here is assuming that setting 'Allow real-time protection' to Enabled will prevent users from turning it off, when it only makes the feature available.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable tamper protection in the Microsoft Defender for Endpoint security baseline or via a configuration profile.
Tamper protection is the only feature that prevents local administrators from disabling real-time protection and other Defender Antivirus settings. While other methods can enable the setting, they cannot lock it. Enabling tamper protection via the Defender for Endpoint baseline or a configuration profile ensures the setting remains enforced and cannot be overridden on the device.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable tamper protection in the Microsoft Defender for Endpoint security baseline or via a configuration profile.
Why this is correct
Tamper protection prevents users, including local administrators, from disabling real-time protection and other Defender Antivirus features. In Intune, you can enable tamper protection through the Defender for Endpoint security baseline or a custom configuration profile. Once enabled, the setting cannot be turned off locally, ensuring real-time protection remains active.
- ✗
Deploy a PowerShell script that runs at startup to enable real-time protection.
Why it's wrong here
A PowerShell script can enable real-time protection, but it does not prevent a local administrator from disabling it again. Scripts run once or on a schedule, so they cannot provide continuous enforcement. They also lack the tamper-proof mechanism that blocks changes even by administrators, making them insufficient for this requirement.
- ✗
Create a compliance policy that requires real-time protection to be enabled.
Why it's wrong here
A compliance policy only reports whether a device meets the condition; it does not enforce the setting. If real-time protection is disabled, the device becomes noncompliant, but the setting remains off. Compliance policies are used for conditional access, not for actively configuring or locking security settings.
- ✗
Configure the 'Allow real-time protection' setting to 'Enabled' in the antivirus policy.
Why it's wrong here
Setting 'Allow real-time protection' to Enabled permits real-time protection to be turned on, but it does not prevent a local administrator from disabling it. This setting only controls whether the feature is available, not whether it can be turned off. To enforce that it cannot be disabled, you need tamper protection, which locks the setting.
Go deeper
Related to this question
Learn chapter
Enrolling Devices with Microsoft Intune
Key term
Windows 11
Windows 11 is Microsoft's latest desktop operating system, offering a redesigned interface, enhanced security features, and improved support for modern hardware.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 556 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.