MS-102 Practice Test 41 — 15 Questions

Question 1

Which TWO components are part of Microsoft Defender XDR?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender XDR is a unified extended detection and response suite that natively correlates signals across Microsoft's first-party security workloads, and Microsoft Defender for Office 365 (option A) is one of its core pillars, delivering protection against phishing, malware, and business email compromise across Exchange Online, Teams, and SharePoint/OneDrive. Microsoft Defender for Endpoint (option C) is likewise a native Defender XDR component, providing endpoint detection and response, attack surface reduction, and automated investigation and remediation that feed into the unified incident queue. By contrast, Microsoft Purview (option B) is a separate compliance and data-governance solution family (information protection, DLP, eDiscovery), Microsoft Intune (option D) is the cloud-based endpoint management/MDM service in the Microsoft Intune family, and Microsoft Sentinel (option E) is a standalone cloud-native SIEM/SOAR product that integrates with Defender XDR but is not itself one of its constituent workloads.

Answer

Microsoft Purview

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Question 2

A user reports that they cannot access their Microsoft 365 mailbox from the Outlook desktop client, but they can access it via Outlook on the web. Other users in the same tenant are not experiencing issues. What is the most likely cause?

Accepted Answer

The user's Outlook profile is corrupted or needs to be re-created.. If a user can access their mailbox via Outlook on the web but not the desktop client, while other users are unaffected, the issue is isolated to the local Outlook profile or client configuration. A corrupted Outlook profile is the most common cause and is resolved by creating a new profile. This scenario rules out tenant-wide service incidents, account disablement, or license expiry because those would also block OWA access.

Answer

There is a service incident affecting only the Outlook desktop client.

Answer

The user's account has been disabled.

Answer

The user's Microsoft 365 license has expired.

Question 3

Your organization uses Microsoft Defender for Office 365. You need to ensure that all email messages containing encrypted attachments are automatically scanned for malware before delivery. What should you configure?

Accepted Answer

Safe Attachments policy. Safe Attachments policy can be configured to scan encrypted attachments. Option B is wrong because it is for scanning URLs in emails. Option C is wrong because the anti-malware policy handles malware detection but does not specifically address encrypted attachments. Option D is wrong because the anti-spam policy is designed to filter spam, not to scan attachments for malware.

Answer

Safe Links policy with URL scanning

Answer

Anti-malware policy

Answer

Anti-spam policy

Question 4

Your organization uses Microsoft Entra ID P2 licenses. You need to configure a Conditional Access policy that requires phishing-resistant authentication for all users when accessing the Azure Management application. Which TWO authentication methods satisfy the requirement?

Accepted Answer

Windows Hello for Business. Windows Hello for Business is a phishing-resistant authentication method because it uses a key pair bound to the device, requiring a biometric or PIN gesture that cannot be intercepted or replayed. It satisfies the Conditional Access requirement for phishing-resistant authentication when accessing the Azure Management application.

Answer

SMS one-time passcode

Answer

Microsoft Authenticator with number matching

Answer

Voice call verification code

Question 5

Which THREE actions can be taken by a Microsoft Purview Data Loss Prevention (DLP) policy in Exchange Online?

Accepted Answer

Block the email from being sent. DLP policies in Exchange Online can block sending, encrypt the message, and notify the sender with a policy tip. Justifying override is not an action; it's a user response. Blocking all emails is not granular; DLP actions are rule-based.

Answer

Allow the sender to override the block

Answer

Block all emails from the sender

Question 6

A security administrator wants to automatically block malicious IP addresses from sending email to Exchange Online mailboxes. Which Microsoft Defender component should be configured?

Accepted Answer

Exchange Online Protection (EOP). Exchange Online Protection (EOP) is the cloud-based email filtering service that protects Exchange Online mailboxes from spam, malware, and malicious IP addresses. It includes connection filtering, which can automatically block messages from specified IP addresses by using the default connection filter policy or custom IP Allow/Block lists. This makes EOP the correct component for blocking malicious IPs from sending email to Exchange Online.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Question 7

Your organization, Contoso Ltd., has a Microsoft 365 E5 tenant with Microsoft Entra ID P2. You are the Global Administrator. The security team reports that several users have been compromised due to weak passwords. You need to implement a solution that enforces strong password policies and blocks common passwords. The solution must also provide users with the ability to reset their own passwords securely if they forget them, without requiring help desk intervention. Additionally, you need to configure risk-based Conditional Access policies to block sign-ins from anonymous IP addresses and require MFA for high-risk sign-ins. You have the following options: A. Configure password protection in Microsoft Entra ID to enforce a custom banned password list and enable self-service password reset (SSPR) with MFA. Then create Conditional Access policies for sign-in risk and anonymous IP. B. Enable password hash sync and configure pass-through authentication. Create a Conditional Access policy to require MFA for all users. C. Implement Microsoft Entra ID Protection and enable MFA registration policy. Configure password expiration to 90 days. D. Use security defaults in Microsoft Entra ID and enable automatic password rollback. Which option should you choose?

Accepted Answer

Configure password protection with custom banned list, SSPR with MFA, and risk-based Conditional Access policies. Option A directly addresses every stated requirement: Microsoft Entra Password Protection with a custom banned password list enforces strong passwords and blocks common ones, SSPR with MFA lets users reset passwords without help desk involvement, and risk-based Conditional Access policies (sign-in risk and anonymous IP) block risky sign-ins and require MFA for high-risk events. This combination uses the Entra ID P2 features already licensed in the E5 tenant.

Answer

Enable password hash sync, pass-through authentication, and require MFA for all

Answer

Implement Identity Protection, enable MFA registration policy, set password expiration to 90 days

Answer

Use security defaults and enable automatic password rollback

Question 8

Your organization uses Microsoft Defender XDR. You need to configure automated investigation and response (AIR) for email and collaboration content. Which policy type should you configure in the Microsoft 365 Defender portal?

Accepted Answer

Automated investigation and response. Automated investigation and response (AIR) for email and collaboration content is configured via the 'Automated investigation and response' policy within the Email & collaboration section of the Microsoft 365 Defender portal. This policy allows you to set up automatic remediation actions for threats in email and collaboration tools. Option A is incorrect because Attack simulation training is used for conducting phishing simulations, not for AIR. Option B is incorrect because Safe attachments policies protect against malicious attachments in email and are part of anti-malware settings. Option C is incorrect because Quarantine policies manage how quarantined messages are handled, not automated investigation and response.

Answer

Attack simulation training

Answer

Safe attachments policies

Answer

Quarantine policies

Question 9

Which THREE settings can you configure in a Microsoft Defender for Office 365 anti-phish policy?

Accepted Answer

Mailbox intelligence. Mailbox intelligence (A) is a configurable setting in an anti-phish policy that uses a user's past communication patterns to detect impersonation attempts. User impersonation protection (D) is also configured in anti-phish policies, allowing you to protect specific internal or external senders from impersonation. Spoof intelligence (E) is a configurable setting in anti-phish policies that controls how the service handles senders who spoof domains you don't own. Safe Attachments (B) is a separate Defender for Office 365 policy (Safe Attachments policy), not a setting within an anti-phish policy. DKIM signing (C) is configured via DNS and Exchange Online mail flow settings, not within an anti-phish policy.

Answer

Safe Attachments

Answer

DKIM signing

Question 10

Your organization uses Microsoft 365 Defender for Office 365. You need to ensure that phishing emails reported by users are automatically submitted for analysis in Microsoft Defender XDR. What should you configure?

Accepted Answer

Configure the User-reported messages settings in the Microsoft 365 Defender portal.. The User-reported messages settings in the Microsoft 365 Defender portal allow you to configure how user-reported phishing emails are handled. By enabling automatic submission to Microsoft for analysis, you ensure that reported messages are sent directly to the Microsoft security team for threat intelligence and policy tuning. This is the correct setting because it specifically controls the submission behavior for user-reported messages in Defender for Office 365.

Answer

Modify the anti-phishing policy to include user-reported submissions.

Answer

Use the Attack simulation training to collect user reports.

Answer

Enable Safe Attachments policy to automatically submit reported messages.

Question 11

A security administrator wants to review email messages that were blocked due to a malware detection in Microsoft Defender for Office 365. Which report should they use?

Accepted Answer

Threat Protection Status report. The Threat Protection Status report in Microsoft Defender for Office 365 provides details on email messages blocked due to malware, phishing, or other threats. It includes data on detections by type and allows administrators to review blocked messages. The Submissions report is for user/admin submissions of suspicious email, the Spoof intelligence report covers spoofing, and the Mailflow map report visualizes mail flow, not blocked malware messages.

Answer

Submissions report

Answer

Spoof intelligence report

Answer

Mailflow map report

Question 12

A user receives an email from an unknown sender with a .zip attachment. The attachment contains a potentially malicious executable file. Microsoft Defender for Office 365 is enabled. Which feature dynamically detonates the attachment in a sandbox environment and blocks it if malicious behavior is detected?

Accepted Answer

Safe Attachments. Safe Attachments is the correct feature because it specifically detonates email attachments in a dynamic sandbox environment, analyzing behavior in real time. If the .zip file contains a malicious executable, Safe Attachments will block the email before delivery, preventing the user from accessing the threat. This is distinct from other Defender for Office 365 features that focus on URLs, phishing content, or spam filtering.

Answer

Safe Links

Answer

Anti-phishing

Answer

Anti-spam

Question 13

Your organization is deploying Microsoft 365 for a multinational company. You need to ensure users in different regions authenticate against the nearest Microsoft Entra ID endpoint for performance. What should you configure?

Accepted Answer

No additional configuration is required; Microsoft Entra ID automatically routes to the nearest endpoint.. Microsoft Entra ID (formerly Azure AD) uses a global anycast network to automatically route authentication requests to the nearest available endpoint based on DNS resolution and network latency. No additional configuration is required because Entra ID's infrastructure is designed to provide optimal performance globally without manual traffic management.

Answer

Add the appropriate regional subdomain (e.g., us.contoso.com) as a custom domain.

Answer

Create a conditional access policy to route authentication to the nearest region.

Answer

Configure a traffic manager profile in Azure to route authentication requests.

Question 14

An administrator wants to restrict which users in the organization can create Microsoft 365 groups. The requirement is that only members of the IT department (identified by the department attribute in Azure AD) should be able to create groups. Which configuration should the administrator use?

Accepted Answer

Azure AD > Groups > Group settings > Group creation settings.. The Microsoft Entra ID 'Group settings' blade includes a 'Group creation settings' option that allows administrators to restrict group creation to specific security groups. By configuring this setting, the administrator can limit group creation to only members of the IT department, identified by the department attribute in Microsoft Entra ID, by placing those users into a designated security group.

Answer

Azure AD Identity Governance > Access reviews.

Answer

Azure AD > Groups > Naming policy.

Answer

Microsoft 365 admin center > Groups > Add group.

Question 15

A security administrator is configuring Microsoft Defender for Cloud Apps to protect against data exfiltration from SaaS apps. The administrator wants to create a policy that alerts when a user attempts to download more than 50 files from SharePoint Online within 5 minutes. Which two components must be configured to achieve this? (Choose two.)

Accepted Answer

Activity policy. The correct answers are C (Activity policy) and E (App connector for SharePoint Online). An activity policy is needed to define the threshold (50 files in 5 minutes) and trigger an alert when exceeded. The app connector for SharePoint Online must be enabled to allow Defender for Cloud Apps to monitor SharePoint activity. Option A (File policy) is incorrect because file policies govern file sharing and collaboration, not download counts. Option B (Session policy) is used for real-time session control, not alerting on activity counts. Option D (Conditional Access App Control) is used to enforce access policies, not for monitoring specific activities.

Answer

File policy

Answer

Session policy

Answer

Conditional Access App Control