MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
You manage Microsoft Defender for Endpoint. A device is showing as 'Inactive' in the device inventory. The device is turned on and connected to the network. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Microsoft Defender for Endpoint sensor is not reporting
An 'Inactive' status in Microsoft Defender for Endpoint means the sensor has not communicated with the cloud service for a defined period (typically 7 days). Since the device is on and connected, the most likely cause is that the Microsoft Defender for Endpoint sensor is not reporting. Option A is incorrect because the device is explicitly stated as turned on. Option B, while a firewall could potentially block communication, is less likely than sensor failure, and Defender for Endpoint uses HTTPS which is typically allowed. Option D is incorrect because a failed onboarding script would prevent the device from appearing or show it as 'Not onboarded', not 'Inactive'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The device is turned off
Why it's wrong here
The device is turned on as per the scenario.
- ✗
A firewall is blocking communication with the Microsoft Defender for Endpoint cloud service
Why it's wrong here
While possible, the most likely cause is the sensor not reporting.
- ✓
The Microsoft Defender for Endpoint sensor is not reporting
Why this is correct
If the sensor stops reporting, the device shows as inactive.
- ✗
The onboarding script was not run successfully
Why it's wrong here
If it were not run, the device would not appear at all.
Go deeper
Related to this question
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.