MD-102 Manage and maintain devices Practice Question
Your organization requires that all managed Windows devices have Microsoft Defender Antivirus enabled and running. Which TWO methods can you use to verify this compliance?
⚠ Common exam trap
Watch out — candidates often confuse Microsoft Entra ID device settings (which manage device identity and registration) with device compliance monitoring, leading them to incorrectly select Option B as a verification method.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an Intune compliance policy for Windows Defender.
Intune compliance policies include a 'Microsoft Defender for Endpoint' category that allows you to require Defender Antivirus to be enabled and running. When a device reports its Defender status via the Intune Management Extension, the compliance policy evaluates the real-time protection state and marks the device as noncompliant if Defender is off or disabled. Option C is correct because Microsoft Defender XDR (formerly Microsoft 365 Defender) provides device health reports that aggregate antivirus status across all enrolled devices, including whether Defender is active and up to date.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an Intune compliance policy for Windows Defender.
Why this is correct
Correct. Compliance policies can check Defender state.
- ✗
Check Microsoft Entra ID device settings.
Why it's wrong here
Incorrect. Entra ID does not track Defender state.
- ✓
Use Microsoft Defender XDR device health reports.
Why this is correct
Correct. Defender XDR provides health status.
- ✗
Review the Local Group Policy Editor on each device.
Why it's wrong here
Incorrect. Local policy does not provide centralized reporting.
- ✗
Run a Configuration Manager hardware inventory.
Why it's wrong here
Incorrect. This is not a direct Microsoft 365 method.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise-grade security platform that protects devices, servers, and networks from advanced cyber threats by combining antivirus, endpoint detection and response, and automated investigation and remediation.
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
About these practice questions
This MD-102 question is part of Courseiva's 942-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.