MS-102 Practice Test 35 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Identity (MDI) and Microsoft Defender for Cloud Apps. You receive an alert about a user who is performing an unusual number of failed logon attempts from a non-corporate IP address. The user is a member of the Finance group. What is the recommended first step?

Accepted Answer

Contact the user to verify if the activity is legitimate.. Option D is correct because the first step is to verify with the user whether the activity is legitimate before taking any action. Option A is wrong because immediately disabling the account may cause unnecessary disruption. Option B is wrong because resetting password without verification may not be necessary. Option C is wrong because blocking the IP may be premature. Option E is wrong because closing the alert without investigation is not appropriate.

Answer

Reset the user's password and require MFA.

Answer

Disable the user account immediately.

Answer

Block the IP address in the firewall.

Answer

Close the alert as a false positive.

Question 2

You are configuring a network security policy in Microsoft Defender for Cloud Apps. The exhibit shows a policy to block traffic from known Tor exit nodes. However, the policy is not blocking traffic from IP 185.220.101.5. What is the most likely reason?

Accepted Answer

Another policy with a higher priority is allowing the traffic.. Option D is correct because the policy order must be set to a higher priority (lower number) to be evaluated first. Option A is wrong because the IP is within the range. Option B is wrong because the action is AlertAndBlock. Option C is wrong because the protocol is Any. Option E is wrong because the source address condition is correct.

Answer

The action is set to Alert only, not block.

Answer

The IP address is not in the specified subnet.

Answer

The protocol condition is too restrictive.

Answer

The source address condition is missing a wildcard.

Question 3

Your organization uses Microsoft Defender for Office 365. Users report that some phishing emails are still reaching inboxes despite the anti-phish policy being enabled. You need to reduce the number of phishing emails that bypass the filter. What should you configure?

Accepted Answer

Configure spoof intelligence in the anti-phish policy. Option B is correct because spoof intelligence allows you to analyze and block spoofed senders. Option A is wrong because Safe Attachments scans attachments, not the email body. Option C is wrong because Tenant Allow/Block List is for manual overrides. Option D is wrong because DKIM is an authentication method, not a filtering setting.

Answer

Add the phishing domains to the Tenant Allow/Block List

Answer

Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams

Answer

Enable DKIM signing for your custom domains

Question 4

You are configuring Microsoft Defender for Office 365 anti-phish policy. You want to protect against user impersonation attacks. The CEO and CFO are frequent targets. What should you configure in the anti-phish policy?

Accepted Answer

Enable user impersonation protection and add the CEO and CFO as protected users. Option B is correct because user impersonation protection allows you to define specific users to protect. Option A is wrong because domain impersonation protects against domain spoofing. Option C is wrong because mailbox intelligence is for general impersonation detection. Option D is wrong because spoof intelligence is for domain spoofing.

Answer

Configure spoof intelligence

Answer

Add the CEO and CFO's domains to domain impersonation

Answer

Enable mailbox intelligence

Question 5

Which THREE settings can you configure in a Microsoft Defender for Office 365 anti-phish policy?

Accepted Answer

Mailbox intelligence. Options B, C, and D are correct. Anti-phish policies include spoof intelligence, mailbox intelligence, and user impersonation protection. Option A is wrong because DKIM is configured in the domain's DNS. Option E is wrong because Safe Attachments is a separate policy.

Answer

Safe Attachments

Answer

DKIM signing

Question 6

Contoso uses Microsoft 365 E5 and has enabled Microsoft Defender for Office 365. Users report that legitimate external emails are being quarantined. You need to reduce false positives without reducing protection. What should you do?

Accepted Answer

Configure Advanced Delivery for trusted senders from the external domain.. Option D is correct because configuring User Mailbox Advanced Delivery allows trusted senders to bypass filtering only for specific domains, reducing false positives while maintaining general protection. Option A is wrong because allowing all senders from the same domain weakens security. Option B is wrong because reducing the spam confidence level threshold increases false negatives. Option C is wrong because disabling third-party email filtering removes necessary protection.

Answer

Disable third-party email filtering integration.

Answer

Reduce the Spam Confidence Level (SCL) threshold in anti-spam policies.

Answer

Allow all emails from the sender's domain in the Tenant Allow/Block List.

Question 7

You are investigating an incident in Microsoft Defender XDR where a user received a phishing email that contained a link to a malicious site. The user clicked the link but did not enter credentials. Which actions would be most effective to remediate the incident?

Accepted Answer

Use Threat Explorer to delete the phishing email from all mailboxes.. Option B is correct because soft-deleting the email from all mailboxes removes the threat. Option D is correct because investigating the user's device for any post-click activity is crucial. Option A is wrong because blocking the user's sign-in is not necessary since credentials were not compromised. Option C is wrong because resetting password is not needed. Option E is wrong because blocking the URL is good but not sufficient as the email remains in other users' inboxes.

Answer

Block the user's account from signing in.

Answer

Block the URL in the Tenant Allow/Block List.

Answer

Reset the user's password immediately.

Question 8

Your organization has Microsoft Defender for Office 365 Plan 2. You want to set up a policy that automatically moves messages containing malware to quarantine and notifies the security team. Which policy should you configure?

Accepted Answer

Safe Attachments policy. Option A is correct because Safe Attachments policy is specifically designed to handle email attachments with malware. Option B is wrong because Anti-Phishing policy deals with phishing attempts. Option C is wrong because Anti-Spam policy handles spam and bulk mail. Option D is wrong because DMARC policy handles email authentication. Option E is wrong because DKIM policy is for signing emails.

Answer

DKIM policy

Answer

DMARC policy

Answer

Anti-Spam policy

Answer

Anti-Phishing policy

Question 9

Your organization uses Microsoft Defender for Office 365 and Microsoft Defender for Endpoint. A user receives an email with a link that leads to a malicious website. The user clicks the link, but the browser is protected by Microsoft Defender SmartScreen. However, the user is still able to download a file from the site. What should you configure to prevent this?

Accepted Answer

Enable Safe Links in Microsoft Defender for Office 365.. Option A is correct because Safe Links protects users by scanning URLs in emails and blocking malicious links at time of click. Option B is wrong because Safe Attachments is for email attachments, not links. Option C is wrong because Anti-Phishing policies deal with impersonation. Option D is wrong because Attack Surface Reduction rules apply to processes, not web downloads. Option E is wrong because network protection blocks connections to malicious IPs, but the download may occur if the site is allowed.

Answer

Enable Attack Surface Reduction rules.

Answer

Enable network protection in Microsoft Defender for Endpoint.

Answer

Enable Safe Attachments in Microsoft Defender for Office 365.

Answer

Configure an Anti-Phishing policy.

Question 10

You manage a Microsoft Defender for Endpoint environment. A device onboarded to Defender for Endpoint is not reporting alerts. You run the Microsoft Defender for Endpoint client analyzer and see that the service is running. Which log should you review to troubleshoot the issue?

Accepted Answer

Microsoft Defender for Endpoint sensor logs located in %ProgramData%\Microsoft\Windows Defender Advanced Threat Protection\Datamart. Option C is correct because the Microsoft Defender for Endpoint sensor logs contain detailed information about the sensor's communication with the cloud. Option A is wrong because Windows Event Logs may not contain sensor-specific errors. Option B is wrong because Microsoft 365 Defender portal logs are cloud-side. Option D is wrong because Network Protection logs are for network filtering.

Answer

Network Protection logs in %ProgramData%\Microsoft\Windows Defender\NIS

Answer

Microsoft 365 Defender portal audit log

Answer

Windows Event Log (Applications and Services Logs/Microsoft/Windows/Defender)

Question 11

Your organization uses Microsoft Defender for Cloud Apps. You discover that a user is accessing a sanctioned cloud app from an unknown IP address. You want to require multi-factor authentication (MFA) for this access. What should you configure?

Accepted Answer

Create an access policy. Option A is correct because an access policy can require MFA based on conditions like IP address. Option B is wrong because session policies control real-time access but are for monitoring. Option C is wrong because app discovery policies identify apps. Option D is wrong because file policies control file sharing.

Answer

Create a file policy

Answer

Create a session policy

Answer

Create an app discovery policy

Question 12

Which TWO components are part of Microsoft Defender XDR?

Accepted Answer

Microsoft Defender for Office 365. Options A and D are correct. Microsoft Defender XDR includes Microsoft Defender for Endpoint and Microsoft Defender for Office 365. Option B is wrong because Microsoft Sentinel is a separate SIEM. Option C is wrong because Microsoft Purview is for compliance. Option E is wrong because Microsoft Intune is for device management.

Answer

Microsoft Purview

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Question 13

Your organization uses Microsoft Defender for Endpoint. A security analyst reports that a critical file was quarantined on several devices, but the file is a trusted application. You need to restore the file and prevent future false positives. What should you do?

Accepted Answer

Create a custom indicator for the file hash with the action 'Allow and alert'.. Option C is correct because adding an indicator for the file hash allows and alerts on the file, preventing future quarantines. Option A is wrong because adding the file to the trusted list in Windows Defender Firewall does not affect Defender for Endpoint. Option B is wrong because allowing the file in Microsoft Defender Antivirus does not prevent it from being blocked by cloud protection. Option D is wrong because excluding the file from real-time protection is a temporary workaround that can be bypassed.

Answer

Add the file to the allowed list in Microsoft Defender Antivirus exclusions.

Answer

Disable real-time protection on affected devices.

Answer

Add the file to the trusted list in Windows Defender Firewall.

Question 14

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Defender for Cloud Apps. You need to configure a policy that automatically blocks downloads of sensitive files from a specific cloud app if the user's risk score is high. Which integration and policy type should you use?

Accepted Answer

Create a session policy in Microsoft Defender for Cloud Apps using Conditional Access App Control.. Option D is correct because the session policy in Microsoft Defender for Cloud Apps can use Microsoft Entra ID Conditional Access app control to monitor and block downloads in real-time based on risk. Option A is wrong because MDE device policies do not control cloud app downloads. Option B is wrong because Cloud Discovery is for identifying shadow IT. Option C is wrong because MDE policy does not integrate with cloud app download blocking. Option E is wrong because Conditional Access policies do not have per-file download controls.

Answer

Use the Cloud Discovery dashboard to block the app.

Answer

Create an attack surface reduction rule in MDE.

Answer

Create a Conditional Access policy in Microsoft Entra ID to block access to the app.

Answer

Create a device compliance policy in Microsoft Intune.

Question 15

You are configuring Microsoft Defender for Cloud Apps to detect anomalous behavior. You need to set up a policy that triggers an alert when a user downloads more than 100 files from SharePoint Online in 10 minutes. Which policy template should you use?

Accepted Answer

Activity from anonymous IP addresses. Option B is correct because the 'Activity from anonymous IP addresses' template is used to detect unusual download volumes. Option A is wrong because 'Impossible travel' is for geographic anomalies. Option C is wrong because 'Unusual file sharing' is for sharing to external users. Option D is wrong because 'Malware detection' is for malware. Option E is wrong because 'Ransomware detection' is for ransomware.

Answer

Impossible travel

Answer

Malware detection

Answer

Ransomware detection

Answer

Unusual file sharing by user