MS-102 Practice Test 14 — 15 Questions

Question 1

A compliance officer needs to block users from sharing emails that contain credit card numbers with external recipients. When a user attempts to send such an email, it should be blocked immediately, and a policy tip should notify the user. Which Microsoft Purview solution should the officer configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data Loss Prevention (DLP) policy.. A Data Loss Prevention (DLP) policy is the correct solution because it is specifically designed to detect sensitive information types (e.g., credit card numbers via predefined rule patterns matching the Luhn algorithm) in transit and enforce actions such as blocking the email and displaying a policy tip to the sender. This meets the compliance officer's requirement to block external sharing of credit card data immediately with user notification.

Answer

Sensitivity label with encryption.

Answer

Microsoft Defender for Office 365 Safe Attachments policy.

Answer

Communication compliance policy.

Question 2

You are the security administrator for a multinational organization using Microsoft 365 E5. The organization has 10,000 users across three regions: North America, Europe, and Asia. You have deployed Microsoft Defender for Endpoint on all Windows devices and enabled Microsoft Defender for Office 365. Recently, a sophisticated phishing campaign targeted executives in Europe, using a custom domain that closely resembles your legitimate domain (e.g., contoso.com vs. contos0.com). The emails bypassed anti-spam and anti-phishing policies. You need to configure protection to block these impersonation attempts without affecting legitimate emails from the actual domain. You must also ensure that any similar future attempts using different variations are automatically detected. What should you do?

Accepted Answer

Configure an anti-phishing policy to protect against impersonation of your domain, enabling the 'Protect against impersonation of domains I own' setting and adding your legitimate domain to the list of domains to protect.. Anti-phishing policies in Microsoft Defender for Office 365 include a dedicated domain impersonation setting called 'Protect against impersonation of domains I own.' By enabling this and adding contoso.com to the protected domains list, Defender uses its impersonation detection engine to catch lookalike domains (contos0.com, contoso.co, etc.) using homoglyph, typo, and character-substitution analysis — not just exact string matches. This automatically generalizes to future variations without needing to enumerate each spoofed domain manually.

Answer

Create a Safe Links policy with a block action for URLs containing 'contos0.com'.

Answer

Enable mailbox intelligence in anti-phishing policies to detect unusual sender behavior.

Answer

Add the spoofed domain 'contos0.com' to the Tenant Allow/Block List in the Defender for Office 365 portal.

Question 3

Refer to the exhibit. You run the KQL query and see that a device named 'WORKSTATION42' has made 1500 connections to a public IP address 203.0.113.55 in the last day. You suspect the device may be compromised. What should you do next to gain the most context?

Accepted Answer

Expand the query to join with DeviceProcessEvents to see which process initiated the connections. Expanding the query to join with DeviceProcessEvents will provide context on which process initiated the connections, helping determine if the activity is malicious or benign. This is the next logical step in an investigation before taking containment actions.

Answer

Isolate the device immediately using Microsoft Defender for Endpoint

Answer

Add the IP address to the Tenant Allow/Block List to block it

Answer

Create a Safe Links policy to block the IP address

Question 4

A development team builds a background service that needs to read all users' calendars via Microsoft Graph without a signed-in user. The service will run on a server with a client secret. Which OAuth 2.0 grant flow should the application use?

Accepted Answer

Client credentials grant. The client credentials grant is designed for server-to-server, non-interactive scenarios where an application authenticates as itself (not on behalf of a user) to access resources. Since the background service runs with a client secret and needs to read all users' calendars without a signed-in user, this flow is the correct choice because it uses the application's own identity to obtain an access token from Microsoft Entra ID.

Answer

Authorization code grant

Answer

Device authorization grant

Answer

Implicit grant

Question 5

A company uses Microsoft Entra ID P2 licenses. They want to create a Conditional Access policy that requires MFA for all users, but the policy should only be enforced when the sign-in risk is medium or higher. Additionally, they need to exclude a group named 'Emergency Access' from this policy. Which configuration is correct?

Accepted Answer

Assign policy to 'All users', exclude 'Emergency Access' group, set 'Sign-in risk' condition to 'High and Medium'. It assigns the Conditional Access policy to 'All users' (ensuring universal coverage), excludes the 'Emergency Access' group (to prevent lockout of break-glass accounts), and sets the 'Sign-in risk' condition to 'High and Medium' — which matches the requirement to enforce MFA only when sign-in risk is medium or higher. Sign-in risk is the correct condition for real-time risk during authentication, while user risk tracks historical compromise likelihood.

Answer

Assign policy to 'All users', exclude 'Emergency Access' group, set 'User risk' condition to 'High and Medium'

Answer

Assign policy to 'Emergency Access' group, set 'Device state' condition to 'All device states'

Answer

Assign policy to 'All users', exclude 'Emergency Access' group, set 'Locations' condition to 'All trusted locations'

Question 6

You are a security administrator for a company that uses Microsoft Defender XDR. You need to configure alert policies to notify the security team when specific activities occur. You want to receive notifications for alerts related to malicious file detection and suspicious sign-in attempts. Which two actions should you perform? (Choose two.)

Accepted Answer

Configure email notifications for the alert policy.. To receive notifications for specific alerts in Microsoft Defender XDR, you must create an alert policy that includes the relevant detection sources and then configure email notifications for that policy. These two actions together ensure the security team is alerted about malicious files and suspicious sign-ins.

Answer

Set up a Microsoft Sentinel playbook.

Answer

Create a data loss prevention (DLP) policy.

Answer

Enable audit logging in Microsoft Purview compliance portal.

Question 7

Your organization uses Microsoft Defender for Cloud Apps. You discover that a user is downloading large amounts of data from SharePoint Online to an unmanaged device. You need to automatically block the download and alert the security team. What should you configure?

Accepted Answer

Session policy. A session policy in Defender for Cloud Apps applies real-time controls during a user session, including the ability to block downloads to unmanaged devices and trigger alerts. This is the correct control for stopping an active data exfiltration attempt from SharePoint Online.

Answer

Access policy

Answer

File policy

Answer

Anomaly detection policy

Question 8

Your organization uses Microsoft 365 Defender. You need to configure automated investigation and response (AIR) to automatically remediate high-confidence phishing emails. What should you configure?

Accepted Answer

Automated investigation and response for email. Automated investigation and response (AIR) for email in Microsoft 365 Defender automatically investigates and remediates phishing emails, including high-confidence detections. Configuring AIR for email enables the system to take remediation actions like soft-deleting messages, blocking senders, and removing malicious content without manual intervention.

Answer

Automated investigation and response for collaboration content

Answer

Automated investigation and response for identities

Answer

Automated investigation and response for devices

Question 9

A company uses Microsoft Defender for Office 365. They want to ensure that users cannot ignore warning messages when clicking on a malicious link in an email. What should they configure?

Accepted Answer

Configure a Safe Links policy with 'Do not allow users to click through to original URL' selected.. Safe Links policies include a setting 'Do not allow users to click through to the original URL' (or 'Block the following URLs' / 'Let users click through to the original URL' toggles). Selecting the option to prevent click-through ensures users cannot bypass the warning page and reach a malicious link. This is the direct control for the requirement.

Answer

Configure the anti-phishing policy with 'Impersonation protection' enabled.

Answer

Enable the 'Anti-malware' policy with 'Common attachments filter'.

Answer

Configure a Safe Attachments policy with 'Block' action.

Question 10

Which THREE steps are required to enable group-based licensing?

Accepted Answer

Add members to the group. Group-based licensing in Microsoft Entra ID requires that you add members to the security group that will have the license assigned. Without members, the license assignment has no effect, as the license is applied to all users in the group. This step ensures that the intended users receive the license automatically based on group membership.

Answer

Configure Azure AD Connect

Answer

Ensure group is mail-enabled

Question 11

A security analyst wants to create a custom detection rule that triggers when a device communicates with a new, unclassified IP address that has been flagged by Microsoft threat intelligence as potentially malicious. The rule should run every hour and create an incident if more than 5 such communications from the same device occur within a 24-hour window. Which advanced hunting tables should be joined in the KQL query for this rule?

Accepted Answer

DeviceNetworkEvents and IPReputation. The rule requires detecting network communications to potentially malicious IP addresses, which involves joining `DeviceNetworkEvents` (which logs network connections from devices) with `IPReputation` (which contains Microsoft's threat intelligence classifications for IP addresses). This join allows the query to filter for communications where the destination IP is flagged as malicious and then aggregate by device to trigger an incident when the count exceeds 5 within a 24-hour window.

Answer

DeviceProcessEvents and AlertInfo

Answer

DeviceFileEvents and DeviceIPInfo

Answer

EmailEvents and DeviceNetworkEvents

Question 12

A company has 500 users across Sales, Marketing, and IT departments. User objects are synced from on-premises Active Directory to Microsoft Entra ID using Azure AD Connect. Each department requires different Microsoft 365 license plans (e.g., Sales needs E3, Marketing needs Business Premium, IT needs E5). The administrator wants to automatically assign the appropriate license based on the department attribute without manual intervention. Which approach should the administrator use?

Accepted Answer

Configure group-based licensing using Microsoft Entra dynamic groups with rules based on the department attribute.. Microsoft Entra ID supports group-based licensing, which allows automatic license assignment to users based on their membership in dynamic groups. By creating dynamic groups with rules that filter on the department attribute (e.g., 'user.department -eq "Sales"'), the administrator can assign the appropriate license plan (E3, Business Premium, E5) to each group, and licenses are automatically applied or removed as users are added or removed from the group, without any manual or scripted intervention.

Answer

Create a script that runs daily to sync department values and assign licenses using PowerShell.

Answer

Use Azure AD Connect to filter objects and assign licenses during sync.

Answer

Manually assign licenses to each user in the Microsoft 365 admin center.

Question 13

A security analyst has identified a new malware sample with a specific SHA256 hash. The analyst needs to immediately block this file from executing on any managed endpoint across the organization, including prevention of future execution. Which Microsoft Defender for Endpoint capability should the analyst use?

Accepted Answer

Indicators (IoCs) for file hashes. Indicators of Compromise (IoCs) for file hashes in Microsoft Defender for Endpoint allow an analyst to create a block indicator for a specific SHA256 hash. This action immediately prevents the file from executing on any managed endpoint and persists across reboots, effectively blocking future execution attempts. Unlike other capabilities, IoCs provide a direct, hash-based block that is enforced by the Microsoft Defender Antivirus engine at the point of execution.

Answer

Attack surface reduction (ASR) rules

Answer

Custom detection rules via advanced hunting

Answer

Microsoft Defender Vulnerability Management

Question 14

A legal hold is required for all emails in a user's mailbox related to a litigation case. The administrator needs to ensure that the mailbox content is preserved even if the user tries to delete emails. Which Microsoft Purview feature should be used?

Accepted Answer

Litigation Hold. Litigation Hold is the correct choice because it is a Microsoft Purview feature specifically designed to preserve all mailbox content, including deleted items and original versions of modified items, for legal or compliance purposes. When enabled, it places the user's entire mailbox on hold, preventing permanent deletion by the user or automated processes, and ensures that all data related to a litigation case is retained indefinitely until the hold is removed.

Answer

eDiscovery (Standard) case hold

Answer

Retention policy

Answer

In-Place Hold

Question 15

A security analyst wants to automatically create a Microsoft Teams message in a dedicated security channel whenever a Microsoft 365 Defender incident with severity 'High' is created. Which automation approach should the analyst use?

Accepted Answer

Power Automate. Power Automate is the correct choice because it provides a no-code/low-code workflow that can be triggered by Microsoft 365 Defender's 'When an incident is created or updated' connector, filter for severity 'High', and then post a message to a dedicated Teams channel via the 'Post a message in a chat or channel' action. This directly meets the requirement for automatic, event-driven notification without custom code.

Answer

Automation rules in Defender

Answer

Microsoft Graph API

Answer

Action Center