MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
Your organization uses Microsoft Defender for Endpoint. You need to ensure that when a device is onboarded, it automatically receives all current threat intelligence signatures. What should you verify is configured?
⚠ Common exam trap
It's easy for candidates to confuse cloud-delivered protection (which provides real-time signature updates) with other security features like network protection or sample submission, or assume that standard Microsoft Update handles Defender signatures.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud-delivered protection is enabled in the Microsoft 365 Defender portal.
Cloud-delivered protection in the Microsoft 365 Defender portal ensures that devices receive the latest threat intelligence signatures in near real-time. When enabled, Defender for Endpoint uses the Microsoft Intelligent Security Graph to push updated signatures and machine learning models to onboarded devices automatically, without relying on manual update cycles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The device is configured to receive updates from Microsoft Update.
Why it's wrong here
Microsoft Update is a distribution channel for standard antivirus definition updates, which are typically delivered on a regular schedule rather than in real time. It does not provide the cloud-based threat intelligence signatures that Microsoft Defender for Endpoint relies on for emergent threats. Depending solely on Microsoft Update leaves endpoints with static signature snapshots, so this configuration does not satisfy the requirement for immediate, dynamic signature delivery.
- ✗
Network protection is enabled in the attack surface reduction rules.
Why it's wrong here
Network protection, a feature within attack surface reduction rules, is a preventive control that audits or blocks outbound connections to untrusted IP addresses and domains using threat intelligence that already exists on the endpoint. It enforces rules against the current signature set but does not download or distribute new threat intelligence signatures. Therefore, enabling this feature does not provide real-time signature updates to the device.
- ✗
Sample submission is enabled in the advanced features.
Why it's wrong here
Sample submission is an advanced feature that automatically forwards suspicious files from the endpoint to Microsoft's cloud for deep analysis, helping to build new detections. This is a one-way upload mechanism and does not push signatures back to the device in real time; it is a telemetry and analysis aid, not a signature delivery channel. Consequently, it complements cloud protection but cannot supply the real-time threat intelligence updates required.
- ✓
Cloud-delivered protection is enabled in the Microsoft 365 Defender portal.
Why this is correct
Cloud-delivered protection is the core mechanism connecting Microsoft Defender for Endpoint to Microsoft's cloud security intelligence. When enabled, the endpoint sends telemetry to the cloud and receives near-real-time responses, including newly generated signatures, 'block at first sight' decisions, and behavioral detections. This low-latency, dynamic channel is exactly what ensures the device gets real-time signature updates, beyond the static definitions delivered by Microsoft Update.
Go deeper
Related to this question
Learn chapter
Intune Device Management
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
About these practice questions
One of 712 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.