MS-102 Practice Test 27 — 15 Questions

Question 1

Refer to the exhibit. You are analyzing a KQL query in Microsoft Defender XDR Advanced Hunting. The query returns a list of devices where PowerShell or cmd.exe with encoded commands executed more than 5 times in the last 7 days. The security team suspects that one of the devices is compromised due to excessive use of encoded commands. However, a legitimate administrative script uses encoded commands regularly. How can you refine the query to reduce false positives while still detecting potentially malicious activity?

Accepted Answer

Add a filter to exclude processes signed by a trusted certificate or running under specific service accounts.. Option A is correct because adding a filter to exclude known administrative accounts or processes that are approved would reduce false positives. Option B is wrong because changing the time range to 1 day might miss legitimate administrative activity but does not target the false positive source. Option C is wrong because looking for only powershell.exe would miss cmd.exe encoded commands. Option D is wrong because increasing the count threshold to 10 might still include the legitimate script if it runs frequently.

Answer

Increase the Count threshold to 10.

Answer

Remove cmd.exe from the FileName filter.

Answer

Change the time range to 1 day instead of 7 days.

Question 2

A company is using Microsoft Defender for Identity (MDI) and wants to receive alerts when a user account is involved in a suspicious network connection. The security team has enabled MDI alerts but is not receiving any alerts for a specific account that is showing anomalous behavior. What should the team check first?

Accepted Answer

Ensure the user's email address is configured in the MDI alert settings.. Option C is correct because MDI needs to be configured with the user's email address for alerts to be sent. If the email is missing or incorrect, alerts will not be delivered. Option A is wrong because the sensor status would affect all accounts, not just one. Option B is wrong because licensing is per user. Option D is wrong because directory data is not required for alerts.

Answer

Verify that the MDI sensor is running correctly on the domain controller.

Answer

Check that the user has an appropriate Microsoft 365 license.

Answer

Confirm that the user's Active Directory attributes are synced to Azure AD.

Question 3

Which TWO features in Microsoft Defender for Office 365 help protect against zero-day malware in email attachments?

Accepted Answer

Safe Attachments. Options B and D are correct because Safe Attachments detonates files in a sandbox, and ZAP retroactively removes malicious messages. Option A is a security policy but does not specifically target zero-day. Option C is a macro security feature. Option E is not a feature of Office 365.

Answer

Mail flow rules

Answer

Anti-spam policies

Answer

Anti-phishing policies

Question 4

Your organization uses Microsoft Defender for Endpoint. You need to collect investigation packages from multiple devices for forensic analysis. What is the most efficient method?

Accepted Answer

Use the central investigations feature to collect packages from multiple devices.. Option B is correct because the central investigations feature allows you to collect packages from multiple devices in one action. Option A is wrong because the device page only handles one device. Option C is wrong because a Live Response session is manual and one device at a time. Option D is wrong because the Microsoft 365 Defender portal does not have a dedicated forensic collection tool.

Answer

Use the Microsoft 365 Defender portal's forensic collection tool.

Answer

Initiate a Live Response session on each device.

Answer

Run a manual collection from each device's page.

Question 5

Your organization uses Microsoft Defender for Endpoint. You need to configure a rule that automatically isolates a device from the network when a specific threat is detected, but only if the device is in a specific device group. Which approach should you use?

Accepted Answer

Automation rule. Option B is correct because automation rules allow you to specify conditions, including device group, and actions like isolation. Option A is wrong because a custom detection rule creates custom alerts but does not automate isolation. Option C is wrong because an indicator of compromise (IoC) blocks files/processes, not isolates devices. Option D is wrong because group policy is not part of Defender for Endpoint automation.

Answer

Indicator of compromise (IoC)

Answer

Custom detection rule

Answer

Group policy in Intune

Question 6

You are investigating a phishing campaign targeting your organization. In Microsoft Defender XDR, you run a KQL query in Advanced Hunting to find all email messages that contain a specific phishing URL. Which table should you query?

Accepted Answer

EmailUrlInfo. Option C is correct because the EmailUrlInfo table contains URL information from email messages, including URLs that can be used to identify phishing links. Option A (EmailEvents) contains email delivery events but not URL details. Option B (EmailAttachmentInfo) contains attachment info. Option D (UrlClickEvents) contains click events, not email-level URL info.

Answer

EmailAttachmentInfo

Answer

UrlClickEvents

Answer

EmailEvents

Question 7

Your organization uses Microsoft Defender for Cloud Apps. You need to generate a report of all external users who have shared sensitive files from SharePoint Online. Which feature should you use?

Accepted Answer

Activity log. Option A is correct because Cloud Discovery is used for shadow IT, not user activity. Option B is correct because Activity log can filter by external users and file actions. Option C is wrong because App permissions report shows consent grants to apps, not user file sharing. Option D is wrong because OAuth app policies govern app permissions, not user activity.

Answer

OAuth app policies

Answer

App permissions report

Answer

Cloud Discovery

Question 8

Your organization uses Microsoft Defender for Identity. You need to configure a honeytoken account to detect attackers trying to use the account. In which location should you place the honeytoken account?

Accepted Answer

A domain user account with no privileges. Option B is correct because honeytoken accounts should be real user accounts with no privileges and no recent activity to attract attackers. Option A is wrong because service accounts may have elevated privileges and trigger false positives. Option C is wrong because they are often used and may cause false alerts. Option D is wrong because the account must exist in Active Directory to be monitored.

Answer

A service account with high privileges

Answer

A non-existent account alias in AD

Answer

A guest account

Question 9

Your organization uses Microsoft Defender for Endpoint. You need to configure advanced hunting to query device information. Which TWO tables contain device-related data?

Accepted Answer

DeviceInfo. Options B and D are correct because DeviceInfo and DeviceTvmInfoGathering are tables in advanced hunting that contain device information. Option A is wrong because AlertInfo contains alert metadata, not device info. Option C is wrong because EmailEvents contains email data. Option E is wrong because IdentityLogonEvents contains authentication events.

Answer

AlertInfo

Answer

EmailEvents

Answer

IdentityLogonEvents

Question 10

Your organization uses Microsoft Defender for Endpoint. A user reports that their device is not receiving security updates. You need to ensure that the device is properly onboarded to Defender for Endpoint. Which log should you check first?

Accepted Answer

Microsoft Defender for Endpoint client logs. Option D is correct because the Microsoft Defender for Endpoint client logs (e.g., C:\ProgramData\Microsoft\Windows Defender\Platform\*\MpCmdRun.log) provide detailed information about onboarding and update issues. Option A (Event Viewer Application logs) may show some errors but not as detailed. Option B (Windows Update logs) are for Windows Update, not Defender updates. Option C (System logs) are for system events.

Answer

Event Viewer Application logs

Answer

System logs

Answer

Windows Update logs

Question 11

Your organization uses Microsoft Defender for Office 365. You need to configure a policy that automatically moves emails containing malicious attachments to quarantine and notifies the security team. Additionally, you want to allow users to release their own quarantined messages if they are false positives. What should you do?

Accepted Answer

Create a new anti-malware policy and configure the quarantine policy to use 'LimitedAccess' or 'FullAccess'.. Option B is correct because the 'AdminOnlyAccessPolicy' for the quarantine policy allows only admins to release messages. To allow users to release their own quarantined messages, you must change the policy to 'LimitedAccess' or 'FullAccess'. Option A (use default policy) would not allow user release. Option C (modify anti-malware policy) does not control quarantine release permissions. Option D (set user release to false) prevents user release.

Answer

Create a new anti-malware policy and use the default quarantine policy.

Answer

Create a new anti-malware policy and set 'User release' to 'False' in the quarantine policy.

Answer

Modify the anti-malware policy to set 'Quarantine' as the action and assign a custom quarantine policy with user release enabled.

Question 12

Which TWO Microsoft Defender XDR components provide protection for email and collaboration tools? (Choose two.)

Accepted Answer

Microsoft Defender for Office 365. Options B and D are correct. Microsoft Defender for Office 365 protects email and collaboration tools like SharePoint, OneDrive, and Teams. Microsoft Defender for Cloud Apps provides visibility and control over cloud apps including email and collaboration platforms. Option A (Defender for Endpoint) protects endpoints. Option C (Defender for Identity) protects on-premises Active Directory. Option E (Defender for Cloud) protects cloud workloads.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Endpoint

Question 13

Your organization uses Microsoft Defender for Endpoint (MDE). A security analyst needs to investigate a file that was detected as malicious on several devices. The analyst wants to see the file's prevalence across the organization and other related events. Which feature in MDE should the analyst use?

Accepted Answer

File page. Option B is correct because the File page in MDE provides details about the file, including prevalence, device list, and related events. Option A is wrong because the Device page focuses on a specific device. Option C is wrong because the Alert page focuses on alerts. Option D is wrong because the Investigation page is for automated investigations.

Answer

Alert page

Answer

Device page

Answer

Investigation page

Question 14

Your organization has deployed Microsoft Defender for Cloud Apps. You need to ensure that all external file sharing to untrusted domains is automatically blocked. The solution must not affect internal sharing. What should you configure?

Accepted Answer

Create a file policy in Microsoft Defender for Cloud Apps with a governance action to remove external users.. Option A is correct because file policies in Defender for Cloud Apps can detect and automatically block sharing to untrusted domains. Option B is wrong because session policies control real-time access but do not automatically block file sharing. Option C is wrong because access policies control access conditions but not file sharing actions. Option D is wrong because app connectors provide visibility but do not enforce automatic blocking of file sharing.

Answer

Create an access policy in Microsoft Defender for Cloud Apps to block access from untrusted domains.

Answer

Configure an app connector for the cloud app to enforce DLP policies.

Answer

Create a session policy in Microsoft Defender for Cloud Apps to monitor external sharing.

Question 15

You are a security administrator. You need to configure Microsoft Defender for Cloud Apps to detect anomalous user activities such as impossible travel. Which feature should you enable?

Accepted Answer

Anomaly Detection policies. Option D is correct because Anomaly Detection policies in Microsoft Defender for Cloud Apps detect unusual behavior like impossible travel, mass download, etc. Option A (App Discovery) finds shadow IT apps. Option B (Conditional Access App Control) provides real-time session controls. Option C (Cloud Discovery) identifies cloud app usage.

Answer

App Discovery

Answer

Cloud Discovery

Answer

Conditional Access App Control

MS-102 Practice Test 27 — 15 Questions

Exhibit

MS-102 Practice Test 27 — 15 Questions

Exhibit