MS-102 Practice Test 46 — 15 Questions

Question 1

You are investigating a potential security incident in Microsoft Defender XDR. The incident involves a user who received a phishing email and clicked a link that executed a PowerShell script. You need to perform a detailed investigation of the PowerShell script's behavior across all affected devices. Which feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Advanced hunting in Microsoft Defender XDR.. Advanced hunting in Microsoft Defender XDR allows you to run KQL queries across all affected devices, enabling detailed investigation of the PowerShell script's behavior. It provides access to raw event data from multiple sources, including device process events, network connections, and file operations, which are essential for understanding script execution and impact.

Answer

The Action Center in Microsoft Defender XDR.

Answer

Live Response from Microsoft Defender for Endpoint.

Answer

The device timeline in the Microsoft 365 Defender portal.

Question 2

An administrator recently added a custom domain 'tailspintoys.com' to their Microsoft 365 tenant and verified it. They now need to configure the domain so that all recipient email addresses for 'info@tailspintoys.com' are delivered to a shared mailbox in Exchange Online. The domain is currently set as internal relay. What should the administrator do first to route email for this domain to Exchange Online?

Accepted Answer

Change the domain type from 'Internal relay' to 'Authoritative' in Exchange admin center. When a domain is set to 'Internal relay' in Exchange Online, the service expects to relay messages to an on-premises server for that domain. To have Exchange Online accept and deliver messages directly to a shared mailbox (or any hosted recipient), the domain must be changed to 'Authoritative'. This tells Exchange Online that it is the final destination for all recipients in that domain, enabling local delivery.

Answer

Update the MX record at the DNS registrar to point to Exchange Online

Answer

Create the shared mailbox 'info@tailspintoys.com' in Exchange Online

Answer

Disable the internal relay option for the domain in the Microsoft 365 admin center

Question 3

A security administrator wants to block executable files from running from writable system directories such as %TEMP% and %APPDATA% on Windows devices. Which attack surface reduction (ASR) rule should be enabled?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion.. The ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) is designed specifically to block executables (e.g., .exe, .dll, .scr) from running from writable locations like %TEMP% and %APPDATA% unless they have sufficient global prevalence, are older than a certain age, or are on a trusted list. This directly addresses the administrator's requirement to prevent untrusted executables from executing from these directories.

Answer

Block Office communication application from creating child processes.

Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe).

Answer

Block executable content from email client and webmail.

Question 4

You are the compliance administrator for Contoso Ltd., a multinational corporation with 10,000 users. The company uses Microsoft 365 E5 licenses and has deployed Microsoft Purview. The legal department requires that all email communications related to ongoing litigation be preserved for the duration of the case. You have identified the custodians and relevant keywords. You need to ensure that all relevant emails are preserved, regardless of whether users delete them. Additionally, you need to allow authorized reviewers to search and export the preserved emails without affecting the original data. Finally, you must ensure that the preservation is lifted automatically when the case is closed. What should you do?

Accepted Answer

Create an eDiscovery (Premium) case, add custodians, place them on hold, and use the case to search and export. Close the case to release the hold.. eDiscovery (Premium) cases in Microsoft Purview are purpose-built for litigation workflows: they let you add custodians, place them on legal hold, run targeted searches, and export results without altering the source data. Closing the case automatically releases the custodian holds, which satisfies the requirement that preservation be lifted when the case ends. This is the only option that combines custodian-scoped preservation, reviewer search/export, and automatic hold release in one workflow.

Answer

Configure a DLP policy to protect sensitive data and preserve the emails.

Answer

Create a retention label with a preservation action and publish it to the entire organization.

Answer

Place an in-place hold on all mailboxes using the Exchange admin center.

Question 5

Your organization is a small business with 200 users. You use Microsoft 365 Business Premium, which includes Microsoft Defender for Business (the small business version of Defender for Endpoint) and Microsoft Defender for Office 365 Plan 1. You want to protect against ransomware by blocking malicious processes and behaviors on endpoints. You also need to enable automated investigation and response for common threats. However, your IT team has limited security expertise and wants a simple configuration that provides out-of-the-box protection without custom policies. What should you do?

Accepted Answer

Enable the default security baseline in Microsoft Defender for Business, which includes attack surface reduction rules and automated investigation.. Microsoft Defender for Business includes a default security baseline that turns on recommended attack surface reduction (ASR) rules, next-generation antivirus, and automated investigation and response (AIR) out of the box. For a 200-user shop with limited security expertise, enabling this baseline delivers ransomware-blocking behavior rules and automated remediation without requiring custom policy authoring. This matches the requirement for simple, out-of-the-box protection.

Answer

Configure Safe Attachments policies in Microsoft Defender for Office 365 to block ransomware attachments.

Answer

Create custom attack surface reduction rules in Microsoft Defender for Business to block ransomware behaviors.

Answer

Deploy a third-party endpoint detection and response (EDR) solution alongside Microsoft Defender for Business.

Question 6

A company uses Microsoft Entra ID Governance to automate the lifecycle of user access. They want to automatically remove a user's group membership for a critical application 30 days after the user's employment end date is captured from the HR system. Which feature should be configured to meet this requirement?

Accepted Answer

Lifecycle Workflows. Lifecycle Workflows (LCW) in Microsoft Entra ID Governance are specifically designed to automate joiner, mover, and leaver processes triggered by HR data. A 'leaver' workflow can be configured to remove group memberships a defined number of days after the employee's employment end date is captured from the HR system, meeting the 30-day requirement precisely.

Answer

Access Reviews

Answer

Entitlement management

Answer

Privileged Identity Management

Question 7

A user with an E5 license is unable to use Azure Information Protection (AIP). The admin confirms the license is assigned. What is the most likely cause?

Accepted Answer

AIP service plan is disabled in the license. Even with an E5 license assigned, the Azure Information Protection (AIP) service plan must be explicitly enabled for the user. By default, some service plans within an E5 license may be disabled, and the AIP service plan (commonly labeled as 'Azure Information Protection' or 'Information Protection for Office 365') must be toggled on in the user's license settings in the Microsoft 365 admin center. Without this, the user cannot activate AIP features regardless of license assignment.

Answer

AIP requires an additional subscription

Answer

AIP client is not installed

Answer

User account is blocked

Question 8

A Microsoft Purview auto-labeling policy for sensitivity labels is matching too many SharePoint documents after simulation. Which two changes would most directly reduce false positives before enabling automatic labeling? (Choose two.)

Accepted Answer

Increase the confidence level or instance-count requirement for the sensitive information type. Increasing the confidence level or instance-count requirement for the sensitive information type (SIT) directly reduces false positives by raising the threshold for what qualifies as a match. A higher confidence level means the classification engine requires stronger evidence (e.g., more keywords or a closer proximity to a pattern), while a higher instance count requires the sensitive data to appear multiple times in the document. Both adjustments make the auto-labeling rule more selective, ensuring only documents with a high likelihood of containing the specified sensitive content are labeled.

Answer

Turn on automatic labeling immediately and wait for users to report problems

Answer

Replace the sensitivity label with a retention label

Question 9

Your organization is migrating from on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can use their existing on-premises passwords to log in to cloud services, while maintaining password policy enforcement on-premises. Which feature should you implement?

Accepted Answer

Pass-through Authentication with Seamless SSO. Pass-through Authentication (PTA) validates passwords directly against on-premises Active Directory, ensuring that on-premises password policies (complexity, expiration, lockout) are enforced for cloud sign-ins. PHS merely synchronizes password hashes to Entra ID and cannot enforce on-premises lockout or account state at authentication time.

Answer

Password Hash Synchronization (PHS)

Answer

Active Directory Federation Services (AD FS)

Answer

Install Azure AD Connect with default settings

Question 10

Your company uses Microsoft Purview Data Lifecycle Management. You have a policy that retains items for 3 years and then deletes them. A user places an eDiscovery hold on a folder that contains items subject to this policy. What happens to those items after 3 years?

Accepted Answer

They are preserved until the hold is removed.. eDiscovery hold takes precedence over the deletion policy. Items under a hold are preserved indefinitely until the hold is removed, regardless of any retention and deletion policies. Option C correctly states they are preserved until the hold is removed. Option A is incorrect because hold overrides the policy, not extending it. Option B is incorrect because items are not deleted while under hold. Option D is incorrect because items are not moved to a separate location.

Answer

They are retained for an additional 3 years.

Answer

They are deleted after 3 years.

Answer

They are moved to a separate location.

Question 11

An administrator deployed the above Intune device configuration policy for Microsoft Defender for Endpoint on Windows 10 devices. Users report that some potentially unwanted applications (PUA) are still being installed. What is the most likely cause?

Accepted Answer

The PUAProtection setting is in AuditMode and not blocking PUAs.. The PUAProtection setting in the Defender for Endpoint Intune policy has three modes: Off, AuditMode, and Enabled (Block). AuditMode only logs detections without blocking, so PUAs continue to install. To actually block PUAs, the setting must be set to 'Enabled' (Block), not AuditMode.

Answer

The cloud timeout value is too low, causing PUA detection to fail.

Answer

Cloud-delivered protection is set to High level, which does not affect PUAs.

Answer

Real-time monitoring is disabled.

Question 12

Refer to the exhibit. You have a DLP policy in test mode as shown. A user reports that they received a notification that sharing credit card numbers is blocked, but they were still able to share them. What is the most likely reason?

Accepted Answer

The policy is in test mode, which does not enforce actions.. A DLP policy in test mode (also called simulation mode) evaluates rules and generates alerts, notifications, and activity reports, but it does not enforce the configured actions such as BlockAccess or Block. Therefore the user sees the policy tip/notification indicating the content is sensitive, yet the sharing is still allowed because the block action is not applied. This is the intended behavior for validating a policy before turning it on.

Answer

The rule action 'BlockAccess' is not included in the policy.

Answer

The condition 'SensitiveInformation' is not configured correctly.

Answer

The notification is not enabled in the policy.

Question 13

Refer to the exhibit. The conditional access policy JSON shown above is applied to all users. A user authenticates from a trusted location and wants to access a cloud app. Which combination of controls will be enforced?

Accepted Answer

MFA, terms of use acceptance, sign-in frequency of 1 hour, and persistent browser never. The conditional access policy JSON explicitly defines three grant controls: 'mfa' (require multi-factor authentication), 'termsOfUse' (require terms of use acceptance), and 'signInFrequency' (value 3600 seconds = 1 hour) combined with 'persistentBrowser' set to 'never'. Since the policy is applied to all users and the user authenticates from a trusted location, all specified controls are enforced simultaneously, as conditional access policies apply all grant controls in the 'grantControls' block unless overridden by session controls.

Answer

Terms of use acceptance and persistent browser never only

Answer

MFA and terms of use acceptance only

Answer

MFA and sign-in frequency of 1 hour only

Question 14

You are hunting for malicious activity in Microsoft 365 Defender. The exhibit shows a KQL query. What is the query searching for?

Accepted Answer

PowerShell processes with encoded command line arguments. The KQL query filters PowerShell process creation events where the command line contains encoded command indicators such as '-enc', '-EncodedCommand', or Base64-looking strings. This pattern is a classic detection for obfuscated PowerShell used by attackers to hide malicious scripts from casual inspection and simple string-based defenses.

Answer

PowerShell processes with standard command line arguments

Answer

Processes that created PowerShell processes

Answer

PowerShell processes that were downloaded from the internet

Question 15

Your organization uses Microsoft Defender for Cloud Apps. You want to detect when a user accesses a sanctioned cloud app from an anonymous IP address. What should you configure?

Accepted Answer

Create an activity policy in Defender for Cloud Apps. An activity policy in Microsoft Defender for Cloud Apps is designed to monitor user activities and generate alerts based on conditions such as anonymous IP address usage. Since the requirement is to detect (not block) access from anonymous IPs, an activity policy with the 'Anonymous IP address' filter is the correct configuration. It leverages the built-in anonymous IP detection in Defender for Cloud Apps.

Answer

Configure an app discovery policy

Answer

Set up a session policy to block access from anonymous IPs

Answer

Enable the cloud discovery shadow IT report