MS-102 Practice Test 33 — 15 Questions

Question 1

You run the KQL query in Microsoft Defender XDR. The query returns a list of users who logged into Exchange Online more than 10 times in the last day from a single IP address. However, you notice that some IP addresses are internal corporate IPs. What should you add to the query to focus on suspicious logons from external IPs?

Accepted Answer

Add a line: | where IPAddress !startswith "10.". Option C is correct because the query should filter by an IP range that excludes internal corporate IPs. Option A is wrong because filtering by Application would not exclude internal IPs. Option B is wrong because summarizing by Application is unnecessary. Option D is wrong because filtering by TotalLogons > 10 already exists. Option E is wrong because sorting does not exclude internal IPs.

Answer

Add a line: | where Application == "Outlook Web App"

Answer

Add a line: | summarize by Application

Answer

Add a line: | where TotalLogons > 50

Answer

Add a line: | sort by TotalLogons desc

Question 2

A company wants to use Microsoft Defender XDR to automatically investigate and remediate threats across email, endpoints, and identities. Which role is required to configure automation settings in the Microsoft 365 Defender portal?

Accepted Answer

Security Administrator. The Security Administrator role can manage automation settings. Option A is correct. Option B is wrong because Global Reader is read-only. Option C is wrong because Security Reader is read-only. Option D is wrong because Compliance Administrator is for compliance.

Answer

Global Reader

Answer

Compliance Administrator

Answer

Security Reader

Question 3

Your organization uses Microsoft 365 Defender. You need to configure automated investigation and response (AIR) to automatically remediate high-confidence phishing emails. What should you configure?

Accepted Answer

Automated investigation and response for email. Option C is correct because AIR policies for email handle automated remediation of phishing. Option A is wrong because it's for device. Option B is wrong because it's for user accounts. Option D is wrong because it's for collaboration.

Answer

Automated investigation and response for collaboration content

Answer

Automated investigation and response for identities

Answer

Automated investigation and response for devices

Question 4

Your organization uses Microsoft Defender for Office 365. You receive a report that users are receiving spoofed email messages that appear to come from your own domain. The spoofed messages are not being filtered. You need to ensure that spoofed messages from your domain are blocked. What should you do?

Accepted Answer

Configure spoof intelligence settings to block the spoofed domain. Option B is correct because spoof intelligence in Microsoft Defender for Office 365 allows you to block spoofed messages from your own domain. Option A is wrong because DKIM signing is important but does not block spoofed messages by itself. Option C is wrong because DMARC policy can help but spoof intelligence is more direct. Option D is wrong because adding domain to allowed list would actually allow spoofing.

Answer

Add your domain to the allowed domains list in the anti-spam policy

Answer

Configure DKIM signing for your domain

Answer

Configure DMARC policy to reject messages that fail SPF or DKIM

Question 5

Your organization uses Microsoft Defender XDR. You need to configure automated actions for high-confidence phishing emails. Which TWO actions can be automatically taken by Microsoft Defender for Office 365?

Accepted Answer

Soft delete the email from the user's mailbox. Option A (Move to quarantine) and Option C (Soft delete) are automated actions that can be configured for phishing emails. Option B (Delete from the user's mailbox permanently) is not a direct automated action; soft delete is used. Option D (Forward to the security team) is not an automated action. Option E (Add a header to the email) is not a typical automated action for phishing.

Answer

Add a header to the email indicating it is phishing

Answer

Permanently delete the email from the user's mailbox

Answer

Forward the email to the security team

Question 6

A company uses Microsoft Defender for Office 365. They want to ensure that users cannot ignore warning messages when clicking on a malicious link in an email. What should they configure?

Accepted Answer

Configure a Safe Links policy with 'Do not allow users to click through to original URL' selected.. Safe Links policies allow you to prevent users from clicking through to the original URL. Option C is correct. Option A is wrong because Safe Attachments is for attachments. Option B is wrong because anti-phishing policies do not control link click behavior. Option D is wrong because ATP anti-malware is for malware.

Answer

Configure the anti-phishing policy with 'Impersonation protection' enabled.

Answer

Enable the 'Anti-malware' policy with 'Common attachments filter'.

Answer

Configure a Safe Attachments policy with 'Block' action.

Question 7

Contoso has a hybrid identity environment with Microsoft Defender for Identity deployed. They suspect a compromised account is being used to perform reconnaissance against domain controllers. Which Defender for Identity alert type would most likely trigger?

Accepted Answer

Suspicious service creation. Reconnaissance attacks are often detected by 'Suspicious service creation' or 'Directory services enumeration'. Option A is correct. Option B is wrong because Golden Ticket is for persistence. Option C is wrong because DCSync is for credential dumping. Option D is wrong because Brute Force is for password attacks.

Answer

Brute Force attack

Answer

DCSync attack

Answer

Golden Ticket activity

Question 8

You need to configure Microsoft Defender for Office 365 to protect users from malicious links in email. Which TWO actions should you configure?

Accepted Answer

Enable URL detonation. Options B and D are correct because Safe Links scanning and URL detonation are key protections. Option A is wrong because it's for attachments. Option C is wrong because it's for anti-spam. Option E is wrong because it's for anti-malware.

Answer

Enable anti-malware engine

Answer

Enable anti-spam filtering

Answer

Enable Safe Attachments

Question 9

Your organization uses Microsoft Defender for Cloud Apps. You discover that a user is accessing sensitive data from an unmanaged device. You need to automatically restrict the user's access to sensitive data until the device is compliant. What should you configure?

Accepted Answer

Create a session policy that monitors and controls access to sensitive data. Option D is correct because session control can block access based on device compliance. Option A is wrong because it doesn't restrict access. Option B is wrong because it's for conditional access to apps. Option C is wrong because it's for discovery.

Answer

Create a Conditional Access App Control policy for all apps

Answer

Create an anomaly detection policy

Answer

Create an app discovery policy

Question 10

You are a security administrator. You need to configure a Microsoft Defender for Endpoint policy that prevents users from running executables from the Temp folder. Which Attack Surface Reduction (ASR) rule should you enable?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion. Option A is correct because the ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' covers Temp folder executables. Option B is wrong because it blocks credential theft. Option C is wrong because it blocks macros. Option D is wrong because it blocks process injection.

Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Answer

Block Office communication application from creating child processes

Answer

Block process injections originating from Windows executable files

Question 11

Your company has deployed Microsoft Defender for Endpoint on all Windows devices. You are investigating an alert for a suspicious PowerShell command that was blocked by Attack Surface Reduction (ASR) rules. The alert shows the command was executed from a script embedded in a Word document. You need to identify the ASR rule that blocked this activity. Which rule is most likely responsible?

Accepted Answer

Block Office applications from creating child processes. Option B is correct because the ASR rule 'Block Office applications from creating child processes' specifically prevents Office apps like Word from launching child processes such as PowerShell. Option A is wrong because that rule blocks macros from making Win32 API calls, not launching processes. Option C is wrong because that rule blocks Office apps from injecting code into other processes. Option D is wrong because that rule blocks Office apps from executable content creation.

Answer

Block Office applications from making Win32 API calls

Answer

Block Office applications from injecting code into other processes

Answer

Block Office applications from creating executable content

Question 12

Your organization uses Microsoft Defender XDR. You need to configure automated investigation and response (AIR) for email and collaboration content. Which policy type should you configure in the Microsoft 365 Defender portal?

Accepted Answer

Automated investigation and response. Option A is correct because AIR for email is configured via the 'Automated investigation and response' policy within Email & collaboration policies. Option B is wrong because attack simulation training is for phishing simulations. Option C is wrong because quarantine policies manage quarantined messages. Option D is wrong because safe attachments policies are part of anti-malware settings.

Answer

Attack simulation training

Answer

Safe attachments policies

Answer

Quarantine policies

Question 13

Your organization uses Microsoft Defender for Endpoint and Microsoft Defender for Identity. A user reports that their account was used to send a large volume of email messages to internal recipients, which appears to be a potential account compromise. You need to determine if the account is compromised and if any lateral movement occurred. Which data sources should you analyze in Microsoft Defender XDR?

Accepted Answer

IdentityLogonEvents, EmailEvents, and DeviceProcessEvents. Option C is correct because analyzing IdentityLogonEvents (from MDI) and EmailEvents (from MDO) together can correlate the logon activity with email sending, while DeviceProcessEvents can detect lateral movement. Option A is wrong because DeviceEvents are not as useful for email context. Option B is wrong because EmailEvents alone cannot detect lateral movement. Option D is wrong because DeviceNetworkEvents alone may miss identity context.

Answer

EmailEvents and EmailAttachmentInfo

Answer

DeviceNetworkEvents and DeviceProcessEvents

Answer

DeviceEvents and DeviceNetworkEvents

Question 14

Your organization uses Microsoft Defender XDR. You need to configure a policy that automatically blocks high-risk user activities in Microsoft Defender for Cloud Apps. Which feature should you configure?

Accepted Answer

Session policy. Option A is correct because session policies in Defender for Cloud Apps allow real-time control over user sessions, enabling blocking of risky activities. Option B is wrong because access policies control access based on conditions, but not real-time activity blocking. Option C is wrong because app governance policies focus on app permissions. Option D is wrong because anomaly detection policies generate alerts but do not automatically block.

Answer

App governance policy

Answer

Access policy

Answer

Anomaly detection policy

Question 15

Your organization has Microsoft Defender for Endpoint deployed on all devices. You are investigating an incident where a user received a phishing email containing a link that led to a drive-by download. The download executed a script that attempted to modify registry run keys for persistence. Which THREE advanced hunting tables should you use to investigate this attack chain?

Accepted Answer

EmailEvents. Option A (EmailEvents) captures the phishing email. Option C (DeviceProcessEvents) captures the script execution. Option E (DeviceRegistryEvents) captures the registry modification. Option B is wrong because DeviceNetworkEvents might be used but not as directly relevant for the described chain. Option D is wrong because DeviceFileEvents could capture the download, but the chain is better captured by email, process, and registry.

Answer

DeviceFileEvents

Answer

DeviceNetworkEvents

MS-102 Practice Test 33 — 15 Questions

Exhibit

MS-102 Practice Test 33 — 15 Questions

Exhibit