MS-102 Practice Test 28 — 15 Questions

Question 1

You run the above PowerShell command on a Windows 10 device that is onboarded to Microsoft Defender for Endpoint. The device is reporting as healthy in the portal, but you suspect that some behavioral detection capabilities are turned off. Based on the output, which setting should you modify?

Accepted Answer

Set DisableBehaviorMonitoring to False to enable behavior monitoring.. Option C is correct because DisableBehaviorMonitoring is set to True, which disables behavior monitoring. You should set it to False to enable behavior monitoring. Option A (real-time monitoring) is already enabled. Option B (Block at First Sight) is already enabled. Option D (cloud-delivered protection) is not shown but is separate.

Answer

Enable cloud-delivered protection by setting MAPSReporting to Advanced.

Answer

Set DisableBlockAtFirstSeen to True to enable Block at First Sight.

Answer

Set DisableRealtimeMonitoring to True to enable real-time monitoring.

Question 2

A security administrator is configuring Microsoft Defender for Office 365 to protect against zero-day malware in attachments. The administrator wants to use dynamic delivery so that users can view the email body while the attachment is being analyzed. However, the administrator is concerned about false positives and wants to ensure that if a benign attachment is later found to be malicious, it is removed from the user's inbox. What should the administrator configure?

Accepted Answer

Configure a Safe Attachments policy with dynamic delivery and enable ZAP.. Option D is correct because Safe Attachments policies with dynamic delivery can be set to allow email body delivery while the attachment is scanned, and if later found malicious, the attachment can be removed using the 'Zero-hour auto purge' (ZAP) feature. Option A is wrong because Anti-phishing policies do not handle attachments. Option B is wrong because Safe Links policies handle URLs, not attachments. Option C is wrong because Anti-malware policies do not provide dynamic delivery.

Answer

Configure a Safe Links policy with URL detonation.

Answer

Configure an anti-phishing policy with mailbox intelligence.

Answer

Configure an anti-malware policy with common attachments filter.

Question 3

Your organization uses Microsoft Defender for Endpoint. You need to ensure that when a device is onboarded, it automatically receives all current threat intelligence signatures. What should you verify is configured?

Accepted Answer

Cloud-delivered protection is enabled in the Microsoft 365 Defender portal.. Option B is correct because cloud-delivered protection ensures devices receive the latest signatures from Microsoft. Option A is wrong because sample submission is for advanced analysis, not signature updates. Option C is wrong because it's part of the detection engine but not specifically for signature updates. Option D is wrong because network protection is a feature, not signature delivery.

Answer

The device is configured to receive updates from Microsoft Update.

Answer

Network protection is enabled in the attack surface reduction rules.

Answer

Sample submission is enabled in the advanced features.

Question 4

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that automatically alerts when a user downloads more than 100 files from SharePoint Online in 10 minutes. What type of policy should you create?

Accepted Answer

Anomaly detection policy. Option A is correct because an anomaly detection policy detects unusual download activity. Option B is wrong because an app discovery policy identifies shadow IT. Option C is wrong because an OAuth app policy governs third-party app permissions. Option D is wrong because a session policy controls real-time access, not download thresholds.

Answer

Session policy

Answer

App discovery policy

Answer

OAuth app policy

Question 5

Your organization has Microsoft 365 E5 licenses and uses Microsoft Defender for Office 365. You need to ensure that users are warned before clicking on malicious URLs in email messages, even if the URL is clicked after the email is delivered. Which policy should you configure?

Accepted Answer

Safe Links policy. Option B is correct because Safe Links protection for email messages provides time-of-click protection, warning users when they click on malicious URLs after delivery. Option A (anti-phishing) does not provide URL click protection. Option C (anti-malware) deals with attachments. Option D (Safe Attachments) deals with attachments, not URLs.

Answer

Anti-malware policy

Answer

Safe Attachments policy

Answer

Anti-phishing policy

Question 6

Your company uses Microsoft Defender XDR. You need to review the list of incidents that were investigated automatically by the system. Where should you navigate in the Microsoft Defender portal?

Accepted Answer

Incidents & alerts > Incidents. Option A is correct because the Incidents & alerts section in the Microsoft Defender portal lists all incidents, including those investigated automatically. Option B is wrong because Action center shows pending and completed remediation actions, not incidents. Option C is wrong because Hunting is for proactive threat hunting using KQL. Option D is wrong because Reports provides summary reports, not incident details.

Answer

Hunting

Answer

Action center

Answer

Reports

Question 7

Your organization uses Microsoft Defender for Identity. You need to investigate an alert indicating a suspected lateral movement using pass-the-hash from a compromised workstation. Which entity should you prioritize examining in the investigation timeline?

Accepted Answer

The compromised account. Option A is correct because pass-the-hash attacks involve the compromise of NTLM hash, and examining the compromised account's activities is key to understanding the movement. Option B is wrong because the source workstation is where the attack originated but the hash is used from there. Option C is wrong because the destination server is the target, but the attacker's identity is more important. Option D is wrong because the network segment is not the primary entity.

Answer

The source workstation

Answer

The destination server

Answer

The network segment

Question 8

You need to integrate Microsoft Defender XDR with Microsoft Sentinel for centralized monitoring. Which data connector should you use?

Accepted Answer

Microsoft Defender XDR connector. Option A is correct because the Microsoft Defender XDR connector in Sentinel ingests incidents and alerts from all Defender products. Option B (Microsoft 365 Defender connector) is the same as A but named differently; the official name is Microsoft Defender XDR. Option C (Azure Security Center) is for Azure resources. Option D (Microsoft Defender for Cloud) is for cloud security posture.

Answer

Microsoft Defender for Cloud connector

Answer

Azure Security Center connector

Answer

Microsoft 365 Defender connector

Question 9

You are a security analyst. You need to create a custom detection rule in Microsoft Defender XDR that triggers an alert when a user account is created and then added to a privileged role within 24 hours. Which advanced hunting table should you primarily use?

Accepted Answer

IdentityLogonEvents. Option B is correct because the IdentityLogonEvents table captures identity events including user account creation and role changes. Option A is wrong because DeviceEvents focuses on device-level events. Option C is wrong because EmailEvents is for email events. Option D is wrong because CloudAppEvents is for cloud app events, not identity events in Defender for Identity.

Answer

EmailEvents

Answer

DeviceEvents

Answer

CloudAppEvents

Question 10

You are configuring policies in Microsoft Defender for Office 365. You need to ensure that users cannot click through to a malicious website that is hosted on a newly registered domain. Which policy setting should you enable?

Accepted Answer

Safe Links. Option A is correct because Safe Links checks URLs at time of click and can block newly registered domains if configured. Option B is wrong because Safe Attachments deals with attachments. Option C is wrong because anti-phishing policies protect against phishing but not specifically against malicious URLs in emails. Option D is wrong because anti-spam policies filter spam, not malicious URLs.

Answer

Anti-phishing

Answer

Anti-spam

Answer

Safe Attachments

Question 11

You are configuring Microsoft Defender for Office 365 to protect against business email compromise (BEC) attacks. Which policy setting should you enable to analyze email sender behavior and detect impersonation attempts?

Accepted Answer

Anti-phishing policy - Impersonation protection. Option C is correct because Anti-phishing policies in Defender for Office 365 include impersonation protection that analyzes sender behavior to detect impersonation attempts. Option A (Anti-malware) deals with malware. Option B (Safe Attachments) deals with attachments. Option D (Safe Links) deals with URLs.

Answer

Safe Attachments policy - Dynamic Delivery

Answer

Safe Links policy - URL scan

Answer

Anti-malware policy - Malware filter

Question 12

Your organization uses Microsoft Defender for Cloud Apps. You need to generate alerts when a user downloads a large number of files from Microsoft SharePoint Online in a short period. What should you create?

Accepted Answer

Activity policy. Option B is correct because Activity policies in Defender for Cloud Apps allow you to create custom rules to detect specific activities like mass download. Option A (Anomaly Detection) is for pre-built anomalies. Option C (Cloud Discovery) is for shadow IT. Option D (App Discovery) is for identifying apps.

Answer

App Discovery policy

Answer

Anomaly Detection policy

Answer

Cloud Discovery policy

Question 13

A security administrator needs to configure a policy that automatically blocks high-confidence phishing emails in Microsoft Defender for Office 365. The policy should be applied to all users in the finance department. The administrator wants to ensure that if an email is determined to be high-confidence phishing, it is quarantined and the user is not notified. Which type of policy should the administrator configure?

Accepted Answer

Anti-phishing policy. Option A is correct because Anti-phishing policies in Defender for Office 365 can be configured to take action on high-confidence phishing emails, such as quarantining them. Option B is wrong because Safe Links policies protect against malicious URLs, not the overall email classification. Option C is wrong because Safe Attachments policies handle malicious attachments. Option D is wrong because Anti-spam policies handle spam, not high-confidence phishing.

Answer

Safe Attachments policy

Answer

Anti-spam policy

Answer

Safe Links policy

Question 14

Which TWO actions can you perform using Microsoft Defender XDR's Advanced Hunting? (Choose two.)

Accepted Answer

Create custom detection rules based on query results.. Options A and C are correct. Advanced Hunting allows you to run KQL queries across data from various Defender products (A) and create custom detection rules based on query results (C). Option B (manage incident status) is done in the Incidents queue, not Advanced Hunting. Option D (configure data retention) is a tenant setting. Option E (deploy EDR sensors) is done via GPO or Intune.

Answer

Deploy EDR sensors to endpoints.

Answer

Configure data retention policies for logs.

Answer

Manage the status of incidents.

Question 15

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that alerts when a user downloads more than 10 files from SharePoint Online within 10 minutes. This activity should be considered anomalous. Which type of policy should you create?

Accepted Answer

Activity policy. Option B is correct because Activity policies in Defender for Cloud Apps can detect anomalous activities based on thresholds, such as multiple file downloads. Option A is wrong because App discovery policies are used to discover shadow IT. Option C is wrong because Cloud Discovery policies are for discovering cloud app usage. Option D is wrong because Session policies control sessions in real-time, not alert on historical activity.

Answer

Cloud Discovery policy

Answer

Session policy

Answer

App discovery policy

MS-102 Practice Test 28 — 15 Questions

Exhibit

MS-102 Practice Test 28 — 15 Questions

Exhibit