MS-102 Practice Test 30 — 15 Questions

Question 1

Your organization has Microsoft Defender for Office 365. Users report that legitimate emails from a partner domain are being quarantined. You need to ensure these emails are delivered while maintaining security. What should you do?

Accepted Answer

Add the partner domain to the Allow list in the Tenant Allow/Block List.. Option B is correct because adding the partner domain to the Allow list in the Tenant Allow/Block List allows the emails but may be used temporarily; long-term best practice is to fix authentication. Option A is wrong because disabling filtering is not recommended. Option C is wrong because it affects all external emails. Option D is wrong because creating a transport rule bypasses security checks and is not best practice.

Answer

Disable spam filtering for the partner domain.

Answer

Lower the spam confidence level (SCL) threshold for the organization.

Answer

Create a mail flow rule to bypass spam filtering for the partner domain.

Question 2

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious LDAP query from a domain controller. After investigating, you determine the query is legitimate. How should you prevent future alerts for this activity?

Accepted Answer

Create a suppression rule for that alert type and entity.. Option C is correct because creating a suppression rule for the specific alert type and entity prevents future false positives. Option A is wrong because disabling the sensor would stop all monitoring. Option B is wrong because modifying the alert severity does not suppress the alert. Option D is wrong because creating a detection rule is for custom detections, not suppression.

Answer

Create a custom detection rule to allow the LDAP query.

Answer

Disable the Defender for Identity sensor on the domain controller.

Answer

Change the alert severity to Low.

Question 3

Contoso uses Microsoft Defender XDR and has a Microsoft 365 E5 license. The security team wants to automate incident response when a user is compromised. They create a custom automation rule in the Microsoft 365 Defender portal. The rule should automatically isolate the user's device, disable the user account, and reset the user's password. Which action type should they configure in the rule?

Accepted Answer

Create a playbook that performs all three actions and run it as the automation rule action.. In Microsoft Defender XDR automation rules, you can define actions that trigger playbooks. To perform multiple actions like isolate device, disable account, and reset password, you need to use Microsoft Sentinel playbooks (or Logic Apps) because Defender XDR automation rules only support a single action per trigger. However, with a custom playbook, you can combine multiple steps. Option B is correct because a playbook can include multiple actions. Option A is wrong because an automation rule only supports one action. Option C is wrong because incident actions are limited. Option D is wrong because a webhook would require external orchestration.

Answer

Select 'Isolate device' as the incident action.

Answer

Configure a webhook to call an external API that performs the actions.

Answer

Use the 'Run script' action and provide a PowerShell script.

Question 4

A company is deploying Microsoft Defender for Office 365 to protect against advanced threats. Which two features are available only in Defender for Office 365 Plan 2 and not in Plan 1? (Choose two.)

Accepted Answer

Automated Investigation & Response. Options C and D are correct. Threat Explorer and Automated Investigation & Response (AIR) are only available in Plan 2. Option A is wrong because Safe Attachments is available in both plans. Option B is wrong because Anti-phishing is available in both plans. Option E is wrong because Safe Links is available in both plans.

Answer

Anti-phishing

Answer

Safe Attachments

Answer

Safe Links

Question 5

Your organization uses Microsoft Defender for Endpoint. You need to ensure that when a user clicks a malicious link in an email, the endpoint is automatically isolated. What should you configure?

Accepted Answer

Configure an automated investigation and response (AIR) playbook for device isolation.. Option C is correct because automated investigation and response (AIR) can be configured to isolate a device when a malicious link is clicked. Option A is wrong because attack surface reduction rules reduce vulnerability but do not automatically isolate. Option B is wrong because network protection blocks connections but does not isolate. Option D is wrong because custom detection rules can trigger isolation but require additional configuration; AIR is the built-in automation.

Answer

Enable network protection in block mode.

Answer

Configure attack surface reduction rules to block the link.

Answer

Create a custom detection rule to trigger isolation.

Question 6

Your organization uses Microsoft Defender for Endpoint. You need to ensure that when a device with a high-risk vulnerability is detected, it is automatically isolated from the network. What should you configure?

Accepted Answer

Create an automation rule in Microsoft Defender XDR.. Option D is correct because an automation rule in Microsoft Defender XDR can automatically isolate a device when a vulnerability is detected. Option A is wrong because device groups control policy assignment, not automation. Option B is wrong because vulnerability management shows findings but does not automate isolation. Option C is wrong because the advanced hunting query only identifies devices, it does not trigger actions.

Answer

Run an advanced hunting query to identify high-risk devices.

Answer

Create a device group and assign a device configuration policy.

Answer

Enable vulnerability management in Microsoft Defender for Endpoint.

Question 7

Which TWO actions can be performed by Microsoft Defender for Identity? (Select TWO.)

Accepted Answer

Monitor domain controller activities and behavior.. Defender for Identity identifies compromised accounts and lateral movement paths. Option A (identify lateral movement) and Option D (monitor domain controller activities) are correct. Option B is wrong because Defender for Identity does not block sign-ins; that is done by Conditional Access. Option C is wrong because it does not scan files. Option E is wrong because it does not manage endpoints.

Answer

Manage firewall rules on endpoints.

Answer

Scan files for malware in real time.

Answer

Block sign-in attempts from malicious IP addresses.

Question 8

Your organization uses Microsoft Defender for Cloud Apps. You need to be alerted when a user accesses a cloud app from an anonymous IP address. Which type of policy should you create?

Accepted Answer

Activity policy. Option B is correct because an activity policy can detect access from anonymous IP addresses. Option A is wrong because an app discovery policy is for discovering shadow IT. Option C is wrong because a session policy controls sessions. Option D is wrong because a file policy monitors file sharing.

Answer

Session policy

Answer

File policy

Answer

App discovery policy

Question 9

You are investigating a security incident in Microsoft 365 Defender. The incident involves a user who received a phishing email that contained a link to a malicious website. The user clicked the link and entered credentials. Which THREE components of Microsoft Defender XDR would generate alerts that contribute to this incident?

Accepted Answer

Microsoft Defender for Office 365. Options A, B, and C are correct because all three detect different aspects of the attack: endpoint (malicious website access), Office 365 (phishing email), and identity (credential compromise). Option D is not directly relevant to this incident. Option E is not part of Microsoft Defender XDR; it's a SIEM.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 10

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Entra ID. You need to block access to a third-party cloud app that is not sanctioned. The app uses OAuth and users have already granted consent. What should you configure?

Accepted Answer

Create an OAuth app policy in Microsoft Defender for Cloud Apps to revoke the app.. Option A is correct because an OAuth app policy in Defender for Cloud Apps can revoke permissions and block access. Option B is wrong because a Conditional Access policy can block access but does not revoke OAuth permissions. Option C is wrong because an app discovery policy only identifies apps. Option D is wrong because a session policy controls usage but does not block access after consent.

Answer

Create a Conditional Access policy in Microsoft Entra ID to block the app.

Answer

Create a session policy in Microsoft Defender for Cloud Apps.

Answer

Create an app discovery policy in Microsoft Defender for Cloud Apps.

Question 11

A company experiences a ransomware attack that encrypts files on several endpoints. The security team wants to use automated investigation and response (AIR) capabilities in Microsoft Defender XDR to contain the threat. Which TWO actions can be taken automatically by AIR? (Select TWO.)

Accepted Answer

Remove malicious files detected by Defender for Endpoint.. AIR in Defender XDR can automatically isolate devices and remove malicious files. Option A and Option D are correct. Option B is wrong because disabling user accounts is not automatic; it requires a playbook. Option C is wrong because password reset is not automatic. Option E is wrong because blocking email domains is not automatic.

Answer

Block the sender's email domain in Defender for Office 365.

Answer

Disable user accounts associated with the attack.

Answer

Reset user passwords for affected accounts.

Question 12

You are a security administrator for a Microsoft 365 E5 organization. You need to configure a policy that automatically blocks execution of files that have a low reputation score in Microsoft Defender for Endpoint. Which policy type should you configure?

Accepted Answer

Attack surface reduction rule in Microsoft Defender for Endpoint. Option D is correct because Attack Surface Reduction rules can block execution of files with low reputation. Option A is wrong because it's for email. Option B is wrong because it's for device control. Option C is wrong because it's for cloud apps.

Answer

Device control policy in Microsoft Intune

Answer

Anti-malware policy in Exchange Online Protection

Answer

Cloud App Security policy in Microsoft Defender for Cloud Apps

Question 13

You are investigating an incident in Microsoft 365 Defender. The incident involves a user who received a malware attachment. Which THREE actions can you take from the incident page?

Accepted Answer

Start an automated investigation. Options A, B, and E are correct because you can isolate device, delete email, and investigate. Option C is wrong because resetting password is not in incident page. Option D is wrong because blocking URL is not directly in incident page.

Answer

Reset the user's password

Answer

Block the malicious URL globally

Question 14

You need to configure Microsoft Defender for Identity to alert when a user account is assigned a high number of group memberships in Active Directory. Which attack type does this correspond to?

Accepted Answer

Golden Ticket attack. Option D is correct because Golden Ticket attacks often involve modifying group memberships to gain elevated privileges. Option A is wrong because DCSync attacks replicate domain credentials. Option B is wrong because Overpass-the-Hash uses Kerberos tickets. Option C is wrong because Skeleton Key attacks inject a backdoor.

Answer

Overpass-the-Hash attack

Answer

DCSync attack

Answer

Skeleton Key attack

Question 15

Your organization deploys Microsoft Defender XDR and wants to use advanced hunting to detect lateral movement by an attacker who uses RDP from a compromised workstation to a domain controller. Which KQL query should you use in advanced hunting?

Accepted Answer

DeviceNetworkEvents | where RemotePort == 3389 and RemoteIP == '10.0.0.10' and InitiatingProcessAccountName == 'compromised_user'. Option B is correct because DeviceNetworkEvents captures network connections, and filtering for RDP (port 3389) from a compromised device to a domain controller identifies lateral movement. Option A is wrong because DeviceLogonEvents shows logons but not the network direction. Option C is wrong because DeviceProcessEvents shows processes, not network connections. Option D is wrong because IdentityLogonEvents is for cloud identities, not endpoint network events.

Answer

DeviceLogonEvents | where RemoteIP == '10.0.0.10' and LogonType == '10'

Answer

IdentityLogonEvents | where AccountUpn == 'compromised_user@contoso.com' and Application == 'Microsoft Remote Desktop'

Answer

DeviceProcessEvents | where ProcessCommandLine contains 'mstsc.exe' and AccountName == 'compromised_user'