MD-102 Protect devices Practice Question
Your organization uses Microsoft Defender for Endpoint (now part of Microsoft Defender XDR). You need to ensure that when a device is offboarding, all collected forensic data is deleted from Microsoft 365. What should you do?
⚠ Common exam trap
Many candidates confuse local sensor removal (Option D) with cloud-side data deletion, not realizing that uninstalling the sensor only stops future data collection while leaving historical forensic data intact in Microsoft 365.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the 'Remove device from organization' action in Microsoft Defender XDR console.
The 'Remove device from organization' action in the Microsoft Defender XDR console triggers a full offboarding workflow that deletes all collected forensic data (including machine-level telemetry, alerts, and investigation packages) from the Microsoft 365 backend. This action also revokes the device's access to the Defender for Endpoint service and removes its sensor registration, ensuring compliance with data retention policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable the device's onboarding policy in Intune.
Why it's wrong here
This stops onboarding but does not delete historical data.
- ✓
Use the 'Remove device from organization' action in Microsoft Defender XDR console.
Why this is correct
This action offboards the device and deletes its data from the service.
- ✗
Run a PowerShell script to execute 'Remove-MpPreference -DisableRealtimeMonitoring $true'.
Why it's wrong here
This only disables real-time monitoring; it does not offboard or delete data.
- ✗
Uninstall the Microsoft Defender for Endpoint sensor from the device.
Why it's wrong here
Uninstalling the sensor stops data flow but does not delete data already stored.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Microsoft Defender XDR
Microsoft Defender XDR is a unified security platform that automatically correlates alerts from across an organization's endpoints, email, identities, and cloud apps to stop complex attacks.
Key term
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise-grade security platform that protects devices, servers, and networks from advanced cyber threats by combining antivirus, endpoint detection and response, and automated investigation and remediation.
About these practice questions
This MD-102 question is part of Courseiva's 942-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.