MS-102 Practice Test 38 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps. A security incident involves a user who accessed a malicious link from an email and then uploaded sensitive data to an external cloud app. Which THREE Microsoft Defender XDR components would provide relevant alerts and insights for this incident?

Accepted Answer

Microsoft Defender for Office 365. Correct: A, B, and D. Defender for Office 365 alerts on malicious links in email; Defender for Cloud Apps alerts on data upload to external apps; Microsoft Defender XDR correlates them into a single incident. Option C is wrong because Defender for Identity focuses on identity-related threats, not email or cloud app data upload. Option E is wrong because Microsoft Sentinel is a SIEM, not a component of Defender XDR.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Identity

Question 2

Your organization uses Microsoft Defender for Office 365. You need to ensure that emails containing malicious attachments are automatically removed from users' inboxes after detection. What should you configure?

Accepted Answer

Configure a Safe Attachments policy. Option B is correct because Safe Attachments policies can automatically remove detected malicious attachments. Option A is wrong because anti-spam policies handle spam, not malware. Option C is wrong because Safe Links policies handle URLs. Option D is wrong because phishing simulation is for training.

Answer

Configure a Safe Links policy

Answer

Configure an anti-spam policy to delete the email

Answer

Use the attack simulation training to report the email

Question 3

You are configuring Microsoft Defender for Office 365 to protect against sophisticated phishing attacks. You need to ensure that users are warned about potentially malicious messages that bypass other filters. Which two policies should you configure?

Accepted Answer

Anti-spam policy: Spoof intelligence. To warn users about potentially malicious messages, you should configure anti-phishing policy's impersonation protection and spoof intelligence. Spam filter policies do not provide user warnings. Safe Attachments and Safe Links policies block or detonate attachments/links but do not warn users.

Answer

Safe Attachments policy

Answer

Safe Links policy

Answer

Anti-malware policy

Question 4

Refer to the exhibit. You run the KQL query and see that a device named 'WORKSTATION42' has made 1500 connections to a public IP address 203.0.113.55 in the last day. You suspect the device may be compromised. What should you do next to gain the most context?

Accepted Answer

Expand the query to join with DeviceProcessEvents to see which process initiated the connections. Option B is correct because expanding the query to include process information can reveal which process is making the connections, helping identify malware. Option A is wrong because simply isolating the device loses forensic data. Option C is wrong because Safe Links is for email, not device network. Option D is wrong because blocking the IP is reactive and may disrupt legitimate traffic.

Answer

Isolate the device immediately using Microsoft Defender for Endpoint

Answer

Add the IP address to the Tenant Allow/Block List to block it

Answer

Create a Safe Links policy to block the IP address

Question 5

You are investigating an alert in Microsoft Defender XDR that indicates a user clicked a malicious link in an email. You need to gather additional information to determine the scope of the attack. Which three sources should you examine?

Accepted Answer

Email entity page. To fully investigate a phishing incident, you should examine the alert timeline for related events, the email entity page for email details, and the user entity page for user actions. Device timeline may not be relevant if the user only clicked a link without further action. The incidents page provides a summary but not detailed scope.

Answer

Incidents page

Answer

Device timeline

Question 6

You are a security administrator for a company that uses Microsoft Defender XDR. You need to configure automated investigation and response (AIR) to automatically remediate threats. Which two actions should you take?

Accepted Answer

Configure action center settings to allow automatic remediation.. To enable automated investigation and response (AIR) in Microsoft Defender XDR, you must first enable the feature in the Microsoft Defender portal, and then configure action settings to allow automatic remediation. Option D is incorrect because automation levels are set per policy, not globally. Option E is incorrect because creating a device group is not required; AIR can be enabled for all devices.

Answer

Create a device group for automatic remediation.

Answer

Assign the Security Administrator role to all users.

Answer

Set the automation level to 'Full - remediate threats automatically' globally.

Question 7

You are a security administrator for an organization that uses Microsoft Defender XDR. You want to provide your security operations team with a unified view of all incidents across endpoints, email, and identities. You also want to automate the creation of incidents when correlated alerts are detected. What should you do?

Accepted Answer

Navigate to the Microsoft Defender XDR portal (security.microsoft.com) and use the Incidents view.. Option B is correct because the Microsoft 365 Defender portal (now Microsoft Defender XDR) provides a unified incident view and automatically correlates alerts into incidents. Option A is wrong because that portal focuses on endpoints only. Option C is wrong because Microsoft Sentinel requires additional configuration and cost. Option D is wrong because custom KQL queries do not provide automatic incident creation.

Answer

Open the Microsoft Defender for Endpoint portal and create a dashboard for all alerts.

Answer

Install Microsoft Sentinel and configure data connectors for all workloads.

Answer

Create a custom KQL query that correlates alerts from different sources and create a workbook.

Question 8

You are a security administrator for a company that uses Microsoft Defender XDR. You need to generate a report that shows the number of incidents closed as true positive, false positive, and benign in the last 30 days. You want to use built-in features without writing custom queries. What should you do?

Accepted Answer

In the Microsoft Defender XDR portal, go to Reports > General > Incident summary.. Option A is correct because the Microsoft Defender XDR portal has built-in reports for incidents classification. Option B is wrong because that is for endpoints, not all incidents. Option C is wrong because that's for threat analytics. Option D is wrong because that's for attack surface reduction.

Answer

Use the Microsoft Defender for Endpoint reports section.

Answer

Use the Device health report in Microsoft Defender XDR.

Answer

Navigate to Threat analytics in the Defender XDR portal.

Question 9

You are a security administrator for a company that uses Microsoft Defender XDR. You need to investigate a suspicious email that was reported by a user. You want to see the full email details, including headers, attachments, and URLs. Where should you look?

Accepted Answer

In the Microsoft Defender XDR portal, search for the email message ID or subject to open the email entity page.. Option A is correct because the email entity page in Microsoft Defender XDR provides detailed information about a specific email. Option B is wrong because that page shows alerts, not email details. Option C is wrong because it shows attack patterns. Option D is wrong because it shows user activity, not email details.

Answer

Use the Threat analytics dashboard to find the email.

Answer

Go to the user entity page and view their email activity.

Answer

Open the incident related to the email and view the alert details.

Question 10

Which TWO Microsoft Purview solutions are primarily used for data classification?

Accepted Answer

Auto-labeling. Auto-labeling applies labels based on sensitive info types. Sensitivity labels are the classification labels themselves. DLP is for protection. Data Lifecycle Management is for retention. Communication Compliance is for monitoring.

Answer

Data Loss Prevention

Answer

Communication Compliance

Answer

Data Lifecycle Management

Question 11

Your company is migrating from an on-premises file server to SharePoint Online. You need to ensure that files containing personally identifiable information (PII) are automatically detected and classified with a sensitivity label. What should you use?

Accepted Answer

Auto-labeling for sensitivity labels in Microsoft 365.. Auto-labeling for sensitivity labels can scan files at rest in SharePoint and apply labels based on sensitive info types. Option C is correct. Option A is wrong because Microsoft Information Protection scanner is for on-premises file servers, not SharePoint. Option B is wrong because DLP policies do not apply labels. Option D is wrong because retention labels are for lifecycle, not classification.

Answer

A retention label auto-applied by a trainable classifier.

Answer

Microsoft Information Protection scanner.

Answer

A DLP policy to block sharing of PII.

Question 12

Contoso Ltd. uses Microsoft Purview to manage compliance for sensitive data across Microsoft 365 and Azure. They need to ensure that all documents containing personally identifiable information (PII) are automatically labeled with a 'Highly Confidential' sensitivity label. The solution must also require users to justify access to these labeled documents. Which two actions should you configure?

Accepted Answer

Create a Microsoft Purview auto-labeling policy for sensitivity labels.. Option A is correct because auto-labeling policies can apply sensitivity labels automatically. Option D is correct because Microsoft Purview Information Protection supports rights management protection that can enforce justification on access. Option B is wrong because DLP policies block actions, not enforce justification. Option C is wrong because retention labels are for retention, not access justification. Option E is wrong because audit logs track events but don't enforce justification.

Answer

Configure a retention label to mark documents as 'Highly Confidential'.

Answer

Create a DLP policy that blocks sharing of unlabeled documents.

Answer

Enable Microsoft Purview Audit (Standard) to log access to sensitive documents.

Question 13

Your organization receives a data subject request (DSR) to export personal data of a user. Which Microsoft Purview solution should you use to search for and export the data?

Accepted Answer

Microsoft Purview eDiscovery. Option A is correct because Microsoft Purview eDiscovery can search for content across Microsoft 365 and export it. Option B is wrong because audit logs only track activities, not content search. Option C is wrong because DLP is for preventing data loss, not exporting. Option D is wrong because retention policies do not export data.

Answer

Microsoft Purview retention policies

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Data Loss Prevention

Question 14

Your company is implementing Microsoft Purview Data Loss Prevention (DLP) to protect credit card numbers in emails. Which THREE actions can a DLP policy take when a match is found?

Accepted Answer

Allow the user to override the block with a business justification.. Options A, B, and C are correct because DLP can block sending, send notification, and allow override. Option D is wrong because encrypting email with rights management is an action, but not listed as a standard DLP action (it is an exception). Option E is wrong because DLP does not delete emails automatically.

Answer

Delete the email from the recipient's inbox.

Answer

Encrypt the email automatically.

Question 15

Your organization is implementing Microsoft Purview Communication Compliance to detect potential insider trading. You need to scan internal emails for specific patterns and assign reviewers from the legal team. What is the minimum number of policies required?

Accepted Answer

One policy with multiple conditions.. Option B is correct because a single Communication Compliance policy can contain multiple conditions (e.g., multiple keywords) and assign reviewers. Option A is wrong because one policy can handle multiple patterns. Option C is wrong because multiple policies are not needed. Option D is wrong because one policy is sufficient.

Answer

Three policies: one for patterns, one for reviewers, and one for storage.

Answer

Zero, as Communication Compliance does not support custom policies.

Answer

Two policies: one for each pattern.