MS-102 Practice Exam 51 — 20 Questions

Question 1

A compliance officer needs to prevent users from sending emails that contain sensitive information, such as social security numbers, to external recipients. If a user attempts to send such an email, the action should be blocked and a policy tip should be displayed to the user. Which Microsoft Purview solution should the officer configure?

Accepted Answer

Data Loss Prevention (DLP) policy. A Data Loss Prevention (DLP) policy in Microsoft Purview is designed to inspect email content for sensitive information (e.g., social security numbers) and can block the message while displaying a policy tip to the user. This matches the requirement exactly, as DLP policies enforce actions on data in transit (email) with user notifications.

Answer

sensitivity label with encryption

Answer

Information Rights Management (IRM)

Answer

retention label with deletion

Question 2

Match each Microsoft 365 migration tool to its use case.

Question 3

A compliance administrator needs to preserve all communications in a user's mailbox and OneDrive for an ongoing litigation. The user must continue working normally, but their data should not be altered or deleted. Which Microsoft Purview feature should be applied?

Accepted Answer

Litigation Hold. Litigation Hold is the correct feature because it preserves all mailbox and OneDrive content in its original state, including deleted and modified items, while allowing the user to continue working normally. Unlike eDiscovery Hold, which is applied to specific search results, Litigation Hold is placed directly on the user's mailbox and OneDrive to prevent any data from being altered or deleted during ongoing litigation.

Answer

eDiscovery Hold

Answer

Retention policy

Answer

Data Loss Prevention (DLP) policy

Question 4

A compliance officer needs to prevent external users from printing or copying content from documents stored in a SharePoint Online site. Which Microsoft Purview feature should be configured to enforce this restriction?

Accepted Answer

Sensitivity labels with encryption and usage rights. Sensitivity labels with encryption and usage rights allow administrators to apply Azure Rights Management (Azure RMS) protection to documents, which can restrict actions such as printing and copying. By configuring a sensitivity label with specific usage rights (e.g., 'View Only' or disabling 'Extract' and 'Print'), external users are prevented from printing or copying content even after the document is downloaded or accessed in SharePoint Online. This is the only Purview feature that directly enforces persistent content-level restrictions on external users.

Answer

Data Loss Prevention (DLP) policy

Answer

Information Barriers

Answer

Microsoft Purview Information Protection without encryption

Question 5

A compliance officer needs to preserve all mailbox data for a user who is under a legal investigation. The data must be preserved indefinitely, and no deletion (by the user or system) should be possible. Which Microsoft Purview feature should the officer use?

Accepted Answer

Litigation Hold. Litigation Hold is the correct feature because it preserves all mailbox content indefinitely, preventing any deletion by the user or automated processes like the Managed Folder Assistant. It ensures that data is immutable for eDiscovery purposes, meeting the compliance officer's requirement for indefinite preservation under legal investigation.

Answer

Retention Policy

Answer

Data Loss Prevention (DLP)

Answer

Sensitivity labels

Question 6

A compliance officer needs to prevent users from sharing confidential documents with external users outside the organization. The policy should block sharing via email attachments or sharing links from SharePoint Online. Which Microsoft Purview solution should be configured?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) in Microsoft Purview is designed to identify, monitor, and automatically protect sensitive information across Exchange Online, SharePoint Online, and OneDrive for Business. By creating a DLP policy with a rule that blocks sharing of confidential documents via email attachments or sharing links to external users, the compliance officer can enforce the required restriction. DLP policies can inspect content for sensitive data types (e.g., credit card numbers, custom confidential labels) and apply actions such as blocking the sharing action or sending a notification.

Answer

Sensitivity labels

Answer

Retention policies

Answer

Information barriers

Question 7

A compliance officer needs to automatically apply a 'Highly Confidential' sensitivity label to any email in Exchange Online that contains social security numbers. The labeling must happen automatically without user interaction. Which two Microsoft Purview components must be configured? (Select the option that correctly identifies both required components.)

Accepted Answer

sensitivity label with auto-labeling rule and a Data Loss Prevention policy. Option C is correct because automatically applying a sensitivity label to emails containing social security numbers requires both a sensitivity label configured with an auto-labeling rule (to define the label and conditions) and an auto-labeling policy (to scope the rule to Exchange Online and enable automatic enforcement without user interaction). The auto-labeling policy triggers the label based on sensitive info types, meeting the compliance officer's requirement for fully automated labeling.

Answer

retention label and a Communication Compliance policy

Answer

unified labeling client and a custom sensitive info type

Question 8

A compliance officer needs to implement a policy that automatically marks emails containing a specific custom sensitive information type as a regulatory record upon sending. The regulatory record must be retained for 10 years and cannot be deleted by users. Which two components must be configured to achieve this?

Accepted Answer

Create a custom sensitive information type and configure an auto-apply retention label policy that applies a regulatory record label. To automatically mark emails containing a specific custom sensitive information type as a regulatory record upon sending, you need both a custom sensitive information type (to define the data pattern) and an auto-apply retention label policy (to automatically apply a regulatory record label based on that pattern). The regulatory record label enforces the 10-year retention and prohibits user deletion, meeting the compliance officer's requirements without manual user action.

Answer

Create a retention label with record marking and publish it to all users, then train users to apply it manually

Answer

Create a Data Loss Prevention (DLP) policy that detects the custom pattern and blocks the email until it is labeled

Question 9

A compliance officer needs to automatically detect and apply a sensitivity label to documents in SharePoint Online that contain personally identifiable information (PII) such as social security numbers. The label should be applied automatically, and users must be able to override the label with a justification. Which two Microsoft Purview components must be configured to achieve this?

Accepted Answer

sensitive info type (SIT) and an auto-labeling policy. Option A is correct because auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels to documents in SharePoint Online based on sensitive info types (SITs), such as social security numbers. The auto-labeling policy supports user override with justification when configured with the 'Mandatory labeling with justification' setting, meeting the compliance officer's requirements.

Answer

data loss prevention (DLP) policy and a retention label

Answer

default sensitivity label and a compliance tag

Question 10

A security administrator wants to simulate a realistic phishing attack to train users and measure their susceptibility. The simulation should be run from within Microsoft Defender XDR and provide detailed reporting. Which feature should the administrator use?

Accepted Answer

Attack Simulation Training. Attack Simulation Training in Microsoft Defender XDR allows security administrators to create and launch realistic phishing campaigns directly from the Microsoft 365 Defender portal. It provides detailed reporting on user interactions, such as who clicked the link or entered credentials, enabling measurement of user susceptibility and targeted training follow-ups.

Answer

Advanced Hunting

Answer

Automated Investigation and Response

Answer

Threat Analytics

Question 11

A security analyst identifies a malicious file hash on one endpoint. They need to ensure that file is blocked from executing on all other endpoints in the organization immediately. Which Microsoft Defender for Endpoint feature should be used?

Accepted Answer

Indicators of compromise (IOCs). Indicators of compromise (IOCs) in Microsoft Defender for Endpoint allow security analysts to create custom indicators (e.g., file hashes, IPs, URLs) that are enforced across all endpoints in near real-time. By adding the malicious file hash as an IOC with an 'Alert and Block' action, the file is immediately prevented from executing on any managed device, providing a rapid, organization-wide block without waiting for signature updates.

Answer

Attack surface reduction rules

Answer

Automated investigation and response

Answer

Custom detection rules

Question 12

A security administrator wants to prevent malware from using Office macros to spawn malicious processes. Specifically, they want to block Excel, Word, and PowerPoint from creating child processes. Which Microsoft Defender for Endpoint capability should be configured?

Accepted Answer

Attack Surface Reduction (ASR) rules. Attack Surface Reduction (ASR) rules are a Microsoft Defender for Endpoint capability specifically designed to block common malware behaviors, such as Office applications (Excel, Word, PowerPoint) from creating child processes. This rule (GUID: 26190899-1602-49e8-8b27-eb1d0a1ce869) prevents macros from spawning cmd.exe, powershell.exe, or other executables, directly addressing the administrator's requirement.

Answer

Threat & Vulnerability Management

Answer

Web Protection

Answer

Network Protection

Question 13

A security administrator needs a single console to investigate and respond to a complex incident involving alerts from endpoints, email, and identities. Which Microsoft portal should they use?

Accepted Answer

Microsoft 365 Defender portal. The Microsoft 365 Defender portal (security.microsoft.com) is the correct choice because it provides a unified incident management console that correlates alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. This allows the security administrator to investigate and respond to a complex incident spanning endpoints, email, and identities from a single pane of glass, leveraging automated investigation and response (AIR) capabilities.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Answer

Microsoft 365 compliance center

Question 14

A security administrator needs to block outbound network connections from a compromised Windows device to a known malicious IP address. The solution should be configured in Microsoft Defender for Endpoint and must work at the network layer, not relying on a user-installed client. Which feature should the administrator enable?

Accepted Answer

Network protection. Option C, Network protection, is correct because it is a Microsoft Defender for Endpoint feature that blocks outbound connections to malicious IP addresses and domains at the network layer, using the Windows Filtering Platform (WFP) to enforce policies without requiring a user-installed client. This ensures the block applies system-wide, even if the device is compromised, as it operates before the TCP/IP stack processes the connection.

Answer

Attack surface reduction (ASR) rules

Answer

Custom detection rules (advanced hunting)

Answer

Web protection (web threat protection)

Question 15

A security operations team uses Microsoft Defender XDR. They want to create a custom detection rule that alerts when a specific process (e.g., wscript.exe) launches from a user's temp directory and then performs a network connection to an external IP. Which advanced hunting query language should they use?

Accepted Answer

Kusto Query Language (KQL). Microsoft Defender XDR uses Kusto Query Language (KQL) for advanced hunting queries, including custom detection rules. KQL allows querying the DeviceProcessEvents and DeviceNetworkEvents tables to correlate process launches with network connections, making it the correct choice for this scenario.

Answer

PowerShell

Answer

Splunk SPL

Answer

SQL

Question 16

An organization uses Microsoft Defender for Cloud Apps to monitor shadow IT. They want to enforce policies that block downloads from risky cloud apps. Which Microsoft Defender XDR component provides this capability?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps is the correct component because it is specifically designed to provide visibility into shadow IT and enforce policies on cloud applications. Its 'Governance' actions include blocking downloads from risky apps by integrating with the cloud app's API to prevent data exfiltration, which directly addresses the requirement.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Office 365

Question 17

An organization wants to prevent users from running executable files from the Windows Temp folder. Which Microsoft Defender for Endpoint capability should be configured?

Accepted Answer

Attack surface reduction rules. Attack surface reduction (ASR) rules are a Microsoft Defender for Endpoint capability that can block executable files from running from specific locations, such as the Windows Temp folder. Rule GUID 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 specifically targets this behavior by preventing executables and scripts from launching from temporary folders. This is the correct capability because ASR rules are designed to reduce the attack surface by controlling common malware entry points and persistence mechanisms.

Answer

Network protection

Answer

Exploit protection

Answer

Controlled folder access

Question 18

An organization wants to allow only specific company-approved USB devices (e.g., those with a specific hardware ID) on managed Windows devices. All other USB devices must be blocked. Which Microsoft 365 Defender feature should be configured?

Accepted Answer

Microsoft Defender for Endpoint device control. Microsoft Defender for Endpoint device control is the correct feature because it provides granular control over peripheral devices, including USB devices, based on hardware IDs. It allows administrators to create allow/block policies that enforce restrictions on managed Windows devices, ensuring only company-approved USB devices can be used.

Answer

Attack surface reduction rules

Answer

Microsoft Defender for Cloud Apps session policy

Answer

Conditional Access device compliance

Question 19

A security analyst is using Microsoft 365 Defender Advanced Hunting to investigate a potential malware outbreak. The analyst needs to find all devices where a specific signed executable (known to be malicious) was created in the past 24 hours. Which Advanced Hunting table should be queried to detect the creation of the executable file?

Accepted Answer

DeviceFileEvents. The DeviceFileEvents table in Microsoft 365 Defender Advanced Hunting captures file creation, modification, and deletion events. Since the question specifically asks for detecting the creation of a signed executable file, this table provides the necessary data, including file name, path, and timestamp, to identify when and where the malicious executable was created.

Answer

DeviceProcessEvents

Answer

DeviceNetworkEvents

Answer

DeviceRegistryEvents

Question 20

A security analyst needs to create a custom detection rule in Microsoft Defender XDR that triggers when a user's device establishes a network connection to a known malicious IP address on a port commonly used by a specific malware. The rule must also include process information such as the filename of the process that initiated the connection. Which advanced hunting table should be the primary data source for this rule?

Accepted Answer

DeviceNetworkEvents. The DeviceNetworkEvents table in Microsoft Defender XDR captures network connection events, including source and destination IP addresses, ports, and the initiating process's filename and ID. This makes it the ideal primary data source for a custom detection rule that must trigger on a specific malicious IP and port combination while also providing process information.

Answer

DeviceProcessEvents

Answer

DeviceFileEvents

Answer

IdentityLogonEvents