MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
Your company uses Microsoft Defender for Endpoint and wants to perform a live response on a device. Which THREE prerequisites must be met?
⚠ Common exam trap
It's easy for candidates to assume Intune management is required for live response, but Microsoft only requires the device to be onboarded to Defender for Endpoint and running a supported OS, with the user having the correct RBAC permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user must be assigned a role that includes live response permissions
Live response in Microsoft Defender for Endpoint requires the user to be assigned a role that includes specific live response permissions, such as 'Live response' or 'Live response advanced' under the Microsoft 365 Defender role-based access control (RBAC). Without these permissions, the user cannot initiate a live response session, regardless of other configurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The user must be assigned a role that includes live response permissions
Why this is correct
Initiating a live response session is gated by role-based access control (RBAC). The user must be assigned an Microsoft Entra ID role such as Security Operator, or a custom Defender for Endpoint role with the 'Live response' permission, and must have the device in their assigned scope; without this, the Start session button is unavailable even for an onboarded, supported device.
- ✓
The device must be running a supported operating system (e.g., Windows 10 or newer)
Why this is correct
Live response depends on the target endpoint running a platform that Microsoft Defender for Endpoint supports for this feature—for example, Windows 10, Windows 11, or Windows Server 2019/2022, and on macOS in later service releases. On older or unsupported operating systems, the sensor may be present but does not implement the low-level commands needed for live response, so no session can be created.
- ✗
The device must be managed by Microsoft Intune
Why it's wrong here
Intune enrollment is only one of several onboarding paths used to install the Defender for Endpoint sensor; devices can be onboarded via Configuration Manager, Group Policy, or a local script and still be fully eligible for live response. Intune's device management relationship, or lack of one, does not affect the sensor's ability to accept a live response session.
- ✗
The device must have Microsoft Defender Antivirus as the primary antivirus solution
Why it's wrong here
The live response engine communicates directly with the Defender for Endpoint sensor on the endpoint; it does not rely on Microsoft Defender Antivirus running or being set as the primary antimalware product. If another antivirus provider is the active solution, Defender Antivirus can run in passive mode or be disabled without preventing live response from executing commands.
- ✓
The device must be onboarded to Microsoft Defender for Endpoint
Why this is correct
For a device to appear as a selectable target, its Microsoft Defender for Endpoint sensor must be installed and reporting to the tenant—a state known as onboarding. Only devices that have completed onboarding and are showing an active status in the device inventory can be connected to via live response; an unonboarded endpoint is invisible to the service and cannot host a session.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Attack Simulation Training in Defender
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.