MS-102 Practice Test 48 — 15 Questions

Question 1

Your organization has deployed Microsoft Defender for Cloud Apps. You want to detect anomalous behavior such as impossible travel for users accessing cloud apps. You need to configure the appropriate policy. Which policy type should you create?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Activity policy. Activity policies in Microsoft Defender for Cloud Apps are designed to monitor user activity across cloud apps and trigger alerts or governance actions on anomalous behavior, including impossible travel, suspicious IP addresses, and unusual file downloads. Creating an activity policy with the 'Impossible travel' template directly detects the scenario described. This is the correct policy type for behavioral anomaly detection.

Answer

App discovery policy

Answer

Session policy

Answer

File policy

Question 2

A compliance officer needs to retain all email messages in a user's Exchange Online mailbox for 7 years after the message is sent or received, and then automatically delete them. The retention must be enforced regardless of user actions. Which Microsoft Purview solution should be used?

Accepted Answer

Retention policy with Exchange location. A retention policy with the Exchange location in Microsoft Purview allows you to define a retention period (e.g., 7 years) and then automatically delete messages after that period. It enforces the retention regardless of user actions because it operates at the service level, not relying on user cooperation. This meets the compliance officer's requirement for mandatory, time-based retention and deletion.

Answer

Litigation hold

Answer

Classification policy

Answer

In-place eDiscovery hold

Question 3

A security administrator needs a single console to investigate and respond to a complex incident involving alerts from endpoints, email, and identities. Which Microsoft portal should they use?

Accepted Answer

Microsoft 365 Defender portal. The Microsoft 365 Defender portal (security.microsoft.com) is the correct choice because it provides a unified incident management console that correlates alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. This allows the security administrator to investigate and respond to a complex incident spanning endpoints, email, and identities from a single pane of glass, leveraging automated investigation and response (AIR) capabilities.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Answer

Microsoft 365 compliance center

Question 4

Your organization needs to automatically detect and classify documents containing passport numbers in SharePoint Online. Which Microsoft Purview feature should you use?

Accepted Answer

Auto-labeling with sensitivity labels.. Auto-labeling with sensitivity labels in Microsoft Purview can automatically detect sensitive content such as passport numbers using built-in or custom sensitive information types (SITs) and then apply a sensitivity label to the document. This is the only feature among the options designed to both detect and classify (label) content at scale in SharePoint Online. The label can then drive encryption, retention, and other protections.

Answer

eDiscovery (Premium).

Answer

Data Lifecycle Management (DLM) policy.

Answer

Data Loss Prevention (DLP) policy.

Question 5

You are a security analyst. You need to investigate a potential malware outbreak on a device using Microsoft Defender XDR. Which three data sources can you include in an advanced hunting query to gather relevant information? (Choose three.)

Accepted Answer

DeviceFileEvents. DeviceFileEvents (B) is correct because it records file creation, modification, and other file-system activity on the endpoint, which is essential for tracing malware dropped or modified files during an outbreak. DeviceNetworkEvents (D) is correct because it captures network connections and related telemetry, allowing you to identify command-and-control traffic, lateral movement, or data exfiltration tied to the malware. DeviceProcessEvents (E) is correct because it logs process creation and execution details, letting you trace malicious process trees, parent-child relationships, and command lines used by the malware. CloudAppEvents (A) is not among the marked answers because it covers cloud app and SaaS activity rather than endpoint malware artifacts, and EmailAttachmentInfo (C) is not marked because it concerns email attachment metadata, which is relevant to phishing delivery but not to the endpoint-focused advanced hunting sources selected here.

Answer

CloudAppEvents

Answer

EmailAttachmentInfo

Question 6

Your company is implementing Microsoft Purview Data Loss Prevention (DLP) to protect credit card numbers in emails. Which THREE actions can a DLP policy take when a match is found?

Accepted Answer

Allow the user to override the block with a business justification.. Option C is correct because Microsoft Purview DLP policies can be configured with user override capabilities, allowing users to provide a business justification to bypass a block action when a sensitive information match is detected. Option D is correct because DLP policies can display policy tips to users in supported workloads like Outlook, notifying them that their email contains sensitive content and explaining the policy that triggered the match. Option E is correct because blocking the email from being sent is a core DLP enforcement action that prevents the message containing credit card numbers from leaving the organization. Option A is incorrect because DLP policies do not retroactively delete emails from a recipient's inbox; they act at send time or at rest through retention/retention labels, not as a DLP match action. Option B is incorrect because DLP policies do not automatically encrypt emails as a match action; encryption is handled through sensitivity labels, Azure Information Protection, or Exchange mail flow rules, not DLP policy actions.

Answer

Delete the email from the recipient's inbox.

Answer

Encrypt the email automatically.

Question 7

Which TWO Microsoft Purview solutions are primarily used for data classification?

Accepted Answer

Auto-labeling. Auto-labeling (B) is correct because it is a Microsoft Purview Information Protection capability that automatically applies sensitivity labels to content by scanning it for sensitive information types, trainable classifiers, or exact data match, which is a core data-classification function. Sensitivity labels (E) are also correct because they are the primary mechanism in Microsoft Purview for manually classifying and protecting content by tagging it with a classification (for example, Confidential or Highly Confidential) that can enforce encryption and other protections. Together, sensitivity labels and auto-labeling form the classification backbone of Microsoft Purview Information Protection. Data Loss Prevention (A) is not primarily a classification tool; it uses classification results to detect and block risky sharing of sensitive data. Communication Compliance (C) focuses on detecting policy violations in communications such as harassment or inappropriate content, not on classifying data. Data Lifecycle Management (D) governs retention and deletion of content rather than classifying it.

Answer

Data Loss Prevention

Answer

Communication Compliance

Answer

Data Lifecycle Management

Question 8

A company experiences a ransomware attack that encrypts files on several endpoints. The security team wants to use automated investigation and response (AIR) capabilities in Microsoft Defender XDR to contain the threat. Which TWO actions can be taken automatically by AIR? (Select TWO.)

Accepted Answer

Remove malicious files detected by Defender for Endpoint.. Option B is correct because Microsoft Defender XDR's automated investigation and response (AIR) can automatically remediate endpoint threats by quarantining or removing malicious files that Defender for Endpoint detects during an investigation. Option C is correct because AIR can automatically isolate an affected device from the network to prevent lateral movement and further compromise while the investigation proceeds. Option A is not an AIR action in this context; blocking a sender's email domain is a manual or policy-driven action in Defender for Office 365, not an automatic endpoint containment response. Option D is incorrect because disabling user accounts is an identity protection action typically performed manually or via Microsoft Entra ID Protection, not an automatic AIR containment step. Option E is also incorrect because password resets are identity remediation actions handled through Microsoft Entra ID, not automated endpoint containment by AIR.

Answer

Block the sender's email domain in Defender for Office 365.

Answer

Disable user accounts associated with the attack.

Answer

Reset user passwords for affected accounts.

Question 9

Which THREE features are included in Microsoft Defender for Office 365 Plan 2 but NOT in Plan 1? (Choose three.)

Accepted Answer

Automated Investigation and Response (AIR). Automated Investigation and Response (AIR) (C) is exclusive to Defender for Office 365 Plan 2, as it uses automated playbooks to investigate and remediate threats, which Plan 1 does not include. Threat Explorer (D) is also a Plan 2-only feature, providing real-time and historical threat hunting and reporting capabilities that are absent from Plan 1. Attack Simulation Training (E) is likewise included only in Plan 2, enabling organizations to run simulated phishing and social engineering attacks to train users. Anti-phishing policies (A) and Safe Links (B) are available in both Plan 1 and Plan 2, so they are not correct answers for features unique to Plan 2.

Answer

Anti-phishing policies

Answer

Safe Links

Question 10

You are configuring Microsoft Defender for Office 365. Which TWO actions should you take to protect users from phishing attacks that use impersonation?

Accepted Answer

Configure anti-phishing policies to protect users from impersonation of custom domains.. Anti-phishing policies in Microsoft Defender for Office 365 include impersonation settings that specifically protect against spoofing of custom domains the organization owns, using domain impersonation protection with actions like quarantining or moving messages to the Junk folder. Option D is also correct because the same anti-phishing policy provides user impersonation protection, which detects messages where the display name matches an internal user (such as executives or key staff) and applies the configured action. These two settings directly address phishing attacks that rely on impersonating trusted domains and internal users. Option A is not correct because DLP policies govern sensitive information sharing, not impersonation-based phishing. Option B is not correct because raising the spam confidence level (SCL) affects bulk/spam filtering, not impersonation detection. Option E is not correct because Safe Attachments for SharePoint, OneDrive, and Teams protects against malicious files in those workloads, not impersonation phishing.

Answer

Create a data loss prevention (DLP) policy to prevent sharing of credentials.

Answer

Configure anti-spam policies to increase the spam confidence level.

Answer

Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams.

Question 11

Which TWO actions can you perform using Microsoft Purview eDiscovery (Premium)? (Choose two.)

Accepted Answer

Place a legal hold on custodians' mailboxes and sites.. Option A is correct because eDiscovery (Premium) supports placing legal holds on custodians, which preserves mailbox and site content (including Exchange mailboxes, SharePoint sites, and OneDrive accounts) to prevent spoliation during an investigation. Option B is correct because eDiscovery (Premium) allows you to export search results and review sets to a local computer for offline review, typically via the Export tool in the case. Option C is incorrect because retention labels are created and published through Microsoft Purview Records Management or Data Lifecycle Management, not through eDiscovery (Premium). Option D is incorrect because automatic deletion of emails by age is handled by retention policies in Data Lifecycle Management, not eDiscovery (Premium). Option E is incorrect because sensitivity labels and encryption are configured through Microsoft Purview Information Protection, not eDiscovery (Premium).

Answer

Create and apply retention labels to documents.

Answer

Automatically delete emails older than a specified date.

Answer

Configure sensitivity labels to encrypt documents.

Question 12

You need to configure Microsoft Defender for Cloud Apps to detect anomalous user behavior such as impossible travel. Which type of policy should you create?

Accepted Answer

Anomaly detection policy. Anomaly detection policy. In Microsoft Defender for Cloud Apps, anomaly detection policies are specifically designed to identify unusual user behaviors, such as impossible travel (login from geographically distant locations within a short time), unusual activity patterns, and other security anomalies. Option A (Access policy) is incorrect because it enforces access controls based on conditions like location or device, rather than detecting anomalies. Option B (Session policy) is incorrect as it monitors and controls real-time application sessions, not anomaly detection. Option D (File policy) is incorrect because it focuses on data protection by applying rules to files stored in cloud apps.

Answer

Access policy

Answer

Session policy

Answer

File policy

Question 13

Your organization uses Microsoft Purview Information Protection. You need to ensure that when users manually apply a 'Confidential' label to a document in Word, the document is automatically marked with a footer 'CONFIDENTIAL' and encrypted. What must you configure?

Accepted Answer

Configure the sensitivity label's settings to include the footer and encryption.. Sensitivity labels in Microsoft Purview Information Protection can be configured with content marking (headers, footers, watermarks) and encryption settings directly in the label definition. When a user manually applies the 'Confidential' label in Word, the label's configured footer and encryption are applied automatically to the document. This is the core behavior of sensitivity labels — the label itself carries the protection settings.

Answer

Modify the sensitivity label policy to include the footer.

Answer

Create a DLP rule that applies the footer and encryption.

Answer

Set up auto-labeling to apply the footer and encryption.

Question 14

Your organization uses Microsoft Purview to enforce data loss prevention (DLP) policies. Users report that a DLP policy blocks legitimate sharing of a document containing sensitive financial data. You need to allow the sharing while still protecting the data. What should you do?

Accepted Answer

Configure a policy tip to allow override with a business justification.. Configuring a policy tip to allow override with a business justification enables users to legitimately share the document while still being audited. Policy tips notify users when their action violates a DLP policy and allow them to override with a justification, which is logged for review. Option A is wrong because disabling the policy removes protection entirely. Option B is wrong because adding a user to a super user group bypasses all DLP checks, which is not appropriate. Option C is wrong because excluding the document type could weaken protection for all similar documents.

Answer

Disable the DLP policy and create a new one with broader conditions.

Answer

Add the user to the DLP policy's super user group.

Answer

Modify the DLP policy to exclude the specific document type.

Question 15

Your organization, Contoso Ltd., has a Microsoft 365 E5 tenant with Microsoft Entra ID P2. You have 10,000 users and 500 applications. You are planning to implement a comprehensive identity security strategy. Your requirements are:
1. All users must use phishing-resistant MFA for accessing business-critical applications.
2. Users accessing sensitive HR data must be required to use a compliant device.
3. Any authentication attempt from an anonymous IP address or from a country where Contoso has no business operations must be blocked.
4. All external collaboration must be governed by access reviews that require sponsor approval.
5. You need to monitor and respond to identity risks in real time.

You need to design a solution using Microsoft Entra ID features. Which combination of features should you implement?

Accepted Answer

Deploy Microsoft Entra ID authentication strengths for phishing-resistant MFA. Create Conditional Access policies requiring compliant device for HR apps and blocking anonymous IPs and non-business countries. Use Microsoft Entra Identity Protection for risk detection and automated response. Implement entitlement management with connected organizations and access reviews requiring sponsor approval.. Option A correctly maps all requirements to Microsoft Entra ID features: authentication strengths for phishing-resistant MFA, Conditional Access for device compliance and location-based blocks, Identity Protection for risk monitoring and automated response, and entitlement management with access reviews for external collaboration governance. This combination leverages the full capabilities of Microsoft Entra ID P2 and E5 licenses.

Answer

Configure Conditional Access policies with MFA and trusted locations. Use Identity Protection for risk monitoring. Set up access reviews with group owner approval.

Answer

Enable security defaults for all users. Use Microsoft Defender for Cloud Apps to block anonymous IPs. Configure Azure AD access reviews for external users.

Answer

Use certificate-based authentication for all users. Create Conditional Access policies for device compliance. Set up identity protection. Use self-service access reviews for external users.