MD-102 Protect devices Practice Question
You need to configure Microsoft Defender for Endpoint on macOS devices. Which THREE components must be installed?
⚠ Common exam trap
Watch out — candidates often confuse the macOS Defender components with Windows Defender components, mistakenly including Intune or ConfigMgr agents that are irrelevant to macOS deployments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Endpoint daemon
Microsoft Defender for Endpoint on macOS requires three core components: the Microsoft Defender for Endpoint daemon (wdavdaemon) (option A), which runs as a background service handling real-time protection, scanning, and communication with the cloud service; the Microsoft Defender for Endpoint kernel extension or system extension (option D), which provides the low-level hooks needed for file system monitoring and network protection on macOS; and the Microsoft Defender for Endpoint user interface agent (option E), which presents the menu bar app and notifications to the user. The Intune management extension (option B) is a Windows component used for PowerShell scripts and Win32 apps, not a Defender for Endpoint macOS requirement, and the Configuration Manager client (option C) is a Windows management agent that is not installed on macOS for this purpose.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Endpoint daemon
Why this is correct
The Microsoft Defender for Endpoint daemon provides the background scanning and protection service that macOS requires, satisfying the stem's demand for a mandatory component. Without this persistent service, real-time threat detection cannot run on the device, so it must be installed alongside the network extension and the application itself.
- ✗
Microsoft Intune management extension
Why it's wrong here
The Intune management extension delivers scripts and Win32 apps on Windows; macOS onboarding relies on the Defender agent and a management channel such as Intune MDM or Jamf. It is tempting because Intune manages macOS, and would be correct if the platform were Windows.
- ✗
Configuration Manager client
Why it's wrong here
The Configuration Manager client is Windows-focused and not a required macOS Defender component; onboarding uses the Defender portal plus Intune or Jamf. It is tempting because ConfigMgr co-management is common on Windows, and would be correct if the devices were Windows rather than macOS.
- ✓
Microsoft Defender for Endpoint kernel extension (or system extension)
Why this is correct
On macOS, real-time protection requires either the kernel extension or the newer system extension, which intercepts file and process events at the OS level. Without it, Defender cannot enforce antivirus scanning or block malicious execution, so it is one of the three mandatory components alongside the main app and network extension.
- ✓
Microsoft Defender for Endpoint user interface agent
Why this is correct
The user interface agent provides the local management console on macOS, letting users run scans and view threat status. It is one of the three required components, alongside the main Defender for Endpoint application and the network protection extension, satisfying the stem's demand for the complete macOS installation set.
Go deeper
Related to this question
Learn chapter
Implementing Windows Autopilot
Key term
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise-grade security platform that protects devices, servers, and networks from advanced cyber threats by combining antivirus, endpoint detection and response, and automated investigation and remediation.
Key term
Configuration Manager
Configuration Manager is a systems management tool by Microsoft that helps IT administrators deploy software, enforce security policies, and manage devices across an organization.
About these practice questions
Courseiva writes every MD-102 question from scratch — 556 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.