MS-102 Practice Test 36 — 15 Questions

Question 1

Your company uses Microsoft Defender XDR and Microsoft Defender for Cloud Apps. You have discovered that a user's credentials were compromised and used to access a SaaS application from an unusual location. You need to automatically suspend the user's access to all cloud apps and require a password reset. The suspension should be immediate upon detection. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In Microsoft Defender for Cloud Apps, create a session policy that uses the 'Suspend user' governance action and configure it to require password reset.. Microsoft Defender for Cloud Apps allows you to create a session policy with the 'Suspend user' governance action, which can automatically suspend the user's access to all cloud apps upon detection of anomalous activity. Additionally, you can configure the policy to require a password reset, ensuring immediate remediation. Option B is wrong because a Microsoft Sentinel playbook can disable the user account but does not inherently force a password reset, and the response may not be immediate due to playbook execution delays. Option C is wrong because a conditional access policy in Microsoft Entra ID can block access from unusual locations but does not suspend the user or require a password reset. Option D is wrong because Microsoft Defender XDR automated investigation rules cannot reset passwords; that action is not available in Defender XDR.

Answer

Create a playbook in Microsoft Sentinel that disables the user account in Microsoft Entra ID.

Answer

Set up a conditional access policy in Microsoft Entra ID to block all access from unusual locations.

Answer

Configure an automated investigation rule in Microsoft Defender XDR to reset the user's password.

Question 2

A compliance officer needs to prevent users from sharing documents that have been labeled 'Highly Confidential' with external users. When a user attempts to share such a document externally, the action should be blocked and the user should see a policy tip. Which Microsoft Purview solution should the officer configure?

Accepted Answer

Data Loss Prevention (DLP) policy. A Data Loss Prevention (DLP) policy is the correct solution because it can inspect content and context (including sensitivity labels) to enforce rules that block external sharing of documents labeled 'Highly Confidential' and display a policy tip to the user. DLP policies in Microsoft Purview are specifically designed to prevent accidental or intentional data leakage by monitoring and controlling sharing actions in real time.

Answer

Sensitivity label encryption

Answer

Retention policy

Answer

Records management

Question 3

Which TWO actions can you perform using Microsoft Defender XDR's Advanced Hunting? (Choose two.)

Accepted Answer

Create custom detection rules based on query results.. Advanced Hunting in Microsoft Defender XDR allows you to run KQL queries across data from various Defender services, so option E is correct. You can also create custom detection rules based on query results, making option C correct. Option A (deploy EDR sensors) is done via group policy or Intune, not in Advanced Hunting. Option B (configure data retention) is a tenant-level setting. Option D (manage incident status) is performed in the Incidents queue, not in Advanced Hunting.

Answer

Deploy EDR sensors to endpoints.

Answer

Configure data retention policies for logs.

Answer

Manage the status of incidents.

Question 4

Your organization uses Microsoft Defender for Office 365. You need to ensure that malicious links in email messages are blocked at the time of click by checking the link reputation in real time. What should you enable?

Accepted Answer

Safe Links policy.. Safe Links policy in Defender for Office 365 provides real-time link reputation checking at the time of click. It rewrites URLs and checks them against a dynamic list of known malicious links when users click them. Option A is incorrect because anti-spam policies filter spam emails, not malicious links. Option B is incorrect because Safe Attachments scans email attachments for malware, not links. Option D is incorrect because anti-phishing policies protect against phishing attempts but do not perform real-time link checking.

Answer

Anti-spam policy.

Answer

Safe Attachments policy.

Answer

Anti-phishing policy.

Question 5

You are a Microsoft 365 administrator for Contoso Pharmaceuticals, which uses Microsoft Entra ID P2. The company has a partnership with a research firm that needs access to a specific set of SharePoint Online sites and a custom line-of-business application. The partners must authenticate by using their own Microsoft Entra ID credentials. You need to provide access while ensuring that the partners' access is reviewed every quarter and that they can request access through a self-service portal. What should you do?

Accepted Answer

Configure Microsoft Entra B2B collaboration and create an entitlement management access package that includes the SharePoint sites and the application, with a quarterly access review and an external catalog for partner self-service requests.. The requirements are for partners to use their own credentials, to access specific resources, to have quarterly access reviews, and to request access via self-service. Entitlement management access packages with B2B collaboration meet all these needs: access packages bundle resources, support external catalogs for self-service, and allow scheduled access reviews. This is the correct solution.

Answer

Configure cross-tenant synchronization to synchronize partner users into the tenant and assign them to the resources.

Answer

Configure a Conditional Access policy that requires MFA for guest users and grants access to the SharePoint sites and application.

Answer

Configure Microsoft Entra B2B collaboration and create a guest user for each partner, then assign them directly to the SharePoint sites and application.

Question 6

You create a custom detection rule in Microsoft Defender XDR using the KQL query shown in the exhibit. The rule is intended to detect lateral movement via SMB. After deploying the rule, you notice that it generates many false positives from legitimate administrative activity. What is the most effective way to reduce false positives?

Accepted Answer

Add a filter to exclude specific administrative accounts or IP ranges. Adding a filter to exclude specific administrative accounts or IP ranges is the most effective way to reduce false positives from legitimate administrative activity. Since the rule detects lateral movement via SMB, legitimate admins may perform similar actions. By excluding known admin accounts or trusted IP ranges, you can suppress alerts for benign activity while still detecting malicious lateral movement.

Answer

Filter for only inbound SMB connections

Answer

Remove the join with DeviceProcessEvents

Answer

Increase the time window of the query

Question 7

A security team wants to automatically investigate and respond to security incidents across endpoints, email, and identities without manual intervention. Which Microsoft Defender XDR capability provides this automation?

Accepted Answer

Automated investigation and response (AIR). Automated investigation and response (AIR) is the Microsoft Defender XDR capability that automatically investigates alerts and takes remediation actions across endpoints, email, and identities without manual intervention. It uses playbooks and machine learning to triage incidents, determine scope, and apply actions like isolating devices or deleting malicious emails.

Answer

Advanced hunting

Answer

Threat analytics

Answer

Attack surface reduction rules

Question 8

A compliance administrator needs to automatically apply a retention label to all documents in a SharePoint Online site that contain Social Security numbers. The label should retain the documents for 5 years and then automatically delete them. Which feature should they configure?

Accepted Answer

retention label with auto-labeling. Retention labels with auto-labeling are designed to automatically apply retention settings based on sensitive information types, such as Social Security numbers, and can enforce a retention period (5 years) followed by automatic deletion. This feature is part of Microsoft Purview's records management and uses trainable classifiers or sensitive info types to trigger the label assignment on SharePoint Online documents.

Answer

Data Loss Prevention (DLP) policy

Answer

sensitivity label with auto-labeling

Answer

An information barrier policy

Question 9

A company has a Microsoft 365 E5 subscription. The security team requires that all guest users must have terms of use acceptance before accessing resources. Which Azure AD feature should be configured?

Accepted Answer

Azure AD Terms of Use. Microsoft Entra ID Terms of Use (ToU) is the correct feature because it allows administrators to present a document to guest users that they must accept before accessing resources. This directly meets the security team's requirement for mandatory terms of use acceptance. Conditional Access policies can enforce ToU acceptance, but the ToU document itself is created and managed under the Microsoft Entra ID Terms of Use blade.

Answer

Conditional Access policy

Answer

Azure AD Identity Protection

Answer

Self-service password reset

Question 10

A company needs to migrate several shared mailboxes from on-premises Exchange 2016 to Exchange Online. The company plans to keep some user mailboxes on-premises for now. Which migration strategy should they use for the shared mailboxes?

Accepted Answer

Hybrid migration. A hybrid migration is the correct choice because it allows the coexistence of on-premises Exchange 2016 and Exchange Online mailboxes, enabling the selective migration of shared mailboxes while keeping some user mailboxes on-premises. This approach uses the Hybrid Configuration Wizard to establish a secure connection and synchronize directory objects via Microsoft Entra Connect, supporting mailbox moves with the New-MoveRequest cmdlet.

Answer

Cutover migration

Answer

Staged migration

Answer

IMAP migration

Question 11

A company plans to migrate their email from an on-premises Exchange server to Exchange Online. They want to ensure that during the migration, mail sent to users who have already been migrated is delivered to Exchange Online, while mail for non-migrated users is delivered to on-premises. Which type of domain configuration should they use?

Accepted Answer

Split domain. A split domain configuration is required when some mailboxes reside on-premises and others in Exchange Online during a migration. It uses MX records pointing to Exchange Online Protection (EOP) and internal mail flow connectors to route messages for migrated users to Exchange Online and non-migrated users to on-premises, ensuring each mailbox receives mail at its current location.

Answer

Coexistence domain

Answer

Shared domain

Answer

Forwarding domain

Question 12

You need to implement a solution that allows users to classify documents containing personal data as 'Highly Confidential' and automatically encrypt them when shared via email. What should you configure?

Accepted Answer

A sensitivity label with auto-labeling and encryption.. A sensitivity label with auto-labeling and encryption is correct because sensitivity labels in Microsoft Purview Information Protection can be configured to automatically classify documents based on sensitive data types (e.g., personal data) and apply encryption to protect the content when shared via email. The auto-labeling feature uses conditions like pattern matching for personally identifiable information (PII) to assign the 'Highly Confidential' label, and the encryption action ensures the document is protected with Rights Management Services (RMS) policies, preventing unauthorized access even if the email is forwarded.

Answer

A retention label with a disposition action.

Answer

An information barrier policy.

Answer

A DLP policy with an action to block sharing.

Question 13

Your organization uses Microsoft Entra ID. You need to enable users to reset their own passwords without administrator intervention. Which TWO components must be configured?

Accepted Answer

Microsoft Entra self-service password reset (SSPR). Microsoft Entra self-service password reset (SSPR) is the core feature that allows users to reset their own passwords without administrator intervention. It must be enabled and configured at the tenant level, and it relies on users having registered authentication methods to verify their identity during the reset process.

Answer

Microsoft Entra Identity Protection

Answer

Conditional Access policies

Answer

Microsoft Entra Privileged Identity Management

Question 14

A compliance officer needs to ensure that any email sent from the organization that contains personally identifiable information (PII) such as social security numbers is automatically encrypted when the recipient is outside the organization. Which Microsoft Purview solution should the officer configure?

Accepted Answer

Data Loss Prevention (DLP) policy with encryption action. A Data Loss Prevention (DLP) policy in Microsoft Purview can be configured with an 'Encrypt email messages' action that automatically applies Office 365 Message Encryption (OME) to emails containing sensitive information types (e.g., Social Security Number) when sent to external recipients. This meets the compliance requirement for automatic encryption based on content detection, without requiring user intervention or manual label application.

Answer

Sensitivity labels with auto-labeling

Answer

Office 365 Message Encryption (OME) configuration

Answer

Retention policy and labels

Question 15

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a user receives a phishing email containing a malicious URL and then clicks that URL within 10 minutes. Which two Advanced Hunting tables must be joined in the KQL query?

Accepted Answer

EmailEvents and UrlClickEvents. The rule requires detecting when a user receives a phishing email with a malicious URL and then clicks that URL within 10 minutes. Two separate joins can accomplish this:

- **EmailEvents and UrlClickEvents**: EmailEvents contains metadata about email delivery (including NetworkMessageId), and UrlClickEvents records user clicks on URLs in Microsoft Defender for Office 365 Safe Links. Joining these tables on NetworkMessageId (and optionally URL hash) allows correlating the email receipt with the click event, enabling the time-based trigger.

- **EmailUrlInfo and UrlClickEvents**: EmailUrlInfo provides details on URLs found within emails (including the URL and its verdict), and UrlClickEvents logs clicks. Joining on the URL hash (SHA256) directly correlates the email-delivered URL with the user's click, also enabling the time-based trigger.

Both pairs are valid and commonly used depending on the specific data needed. Option B (DeviceProcessEvents) is irrelevant as it deals with process execution, not email or URL clicks. Option D (EmailAttachmentInfo) pertains to attachments, not URLs.

Answer

EmailEvents and DeviceProcessEvents

Answer

EmailAttachmentInfo and UrlClickEvents