MS-102 Practice Exam 52 — 20 Questions

Question 1

A security analyst wants to create a custom detection rule in Microsoft Defender XDR that triggers when a user receives a phishing email and clicks a link to a known malicious domain. Which advanced hunting table should the analyst query to track the clicked URL?

Accepted Answer

EmailUrlInfo. The EmailUrlInfo table in Advanced Hunting for Microsoft Defender XDR contains records of URLs that were present in emails, including the URL domain and whether the link was clicked. By joining EmailEvents with EmailUrlInfo on the NetworkMessageId, the analyst can identify when a user clicked a URL that leads to a known malicious domain, making it the correct table for tracking clicked URLs.

Answer

EmailEvents

Answer

EmailAttachmentInfo

Answer

DeviceEvents

Question 2

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a user opens a malicious Office document, which launches a process named cmd.exe from Microsoft Word, and then that cmd.exe process makes an outbound connection to a known malicious IP address. Which two Advanced Hunting tables must be joined in the KQL query?

Accepted Answer

DeviceProcessEvents and DeviceNetworkEvents. Option B is correct because the detection rule requires tracking the process creation (cmd.exe launched from Microsoft Word) and the subsequent network connection from that process to a malicious IP. DeviceProcessEvents captures process creation events, including parent-child relationships, while DeviceNetworkEvents captures outbound network connections initiated by processes. Joining these tables on DeviceId and ProcessId allows correlating the specific cmd.exe instance with its network activity.

Answer

EmailEvents and EmailUrlInfo

Answer

DeviceEvents and DeviceLogonEvents

Question 3

A security analyst wants to create a custom detection rule in Microsoft Defender XDR that triggers when a user receives a phishing email (delivered to inbox) and later clicks a link from that email that leads to a known malicious domain. The rule will be based on an advanced hunting query. Which two tables should the analyst join in the query to capture both the email delivery event and the link click event? (Choose two.)

Accepted Answer

EmailEvents. EmailEvents contains records of email delivery events, including phishing emails that were delivered to the inbox. UrlClickEvents captures user clicks on URLs in emails, including the target domain. Joining these two tables on the email's network message ID allows the analyst to correlate the specific phishing email delivery with the subsequent link click to a known malicious domain, which is the exact scenario described.

Answer

DeviceEvents

Answer

IdentityLogonEvents

Question 4

A company is experiencing a significant number of phishing attempts that target high-level executives by impersonating their email addresses. The security team wants to configure protection against user impersonation in Microsoft Defender for Office 365. Which setting must be enabled in the anti-phishing policy to protect these specific users?

Accepted Answer

Enable users to protect against impersonation. Option A is correct because the 'Enable users to protect against impersonation' setting in an anti-phishing policy allows you to specify a list of users (such as high-level executives) whose email identities will be monitored for impersonation attempts. When enabled, Defender for Office 365 analyzes inbound messages for display name and email address matches against the protected users, and if a match is found with a suspicious sender, the message is flagged or quarantined. This directly addresses the scenario of attackers spoofing executive email addresses.

Answer

Enable domains to protect against impersonation

Answer

Mailbox intelligence

Answer

Spoofed sender posture

Question 5

A security analyst wants to create a custom detection rule in Microsoft 365 Defender that triggers when a PowerShell process with suspicious command-line arguments is detected on a device, and within 5 minutes, an outbound network connection to a known malicious IP occurs. Which two advanced hunting tables must be joined in the KQL query?

Accepted Answer

DeviceProcessEvents and DeviceNetworkEvents. Option A is correct because the detection rule requires correlating a PowerShell process event (stored in DeviceProcessEvents) with a subsequent outbound network connection to a known malicious IP (stored in DeviceNetworkEvents). Joining these two tables on the device ID and timestamp within a 5-minute window allows the KQL query to identify the specific sequence of process execution followed by network activity, which is the core behavior being monitored.

Answer

EmailEvents and DeviceNetworkEvents

Answer

IdentityLogonEvents and DeviceNetworkEvents

Question 6

A security administrator wants to create a custom detection rule in Microsoft Defender XDR that alerts when a device initiates an outbound TCP connection to a known malicious IP address on a non-standard port (e.g., port 4444). Which advanced hunting table should be queried to find these network connections?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the correct table because it specifically captures network connection events, including outbound TCP connections to IP addresses and ports. This table contains fields like RemoteIP, RemotePort, and Protocol, making it ideal for detecting connections to known malicious IPs on non-standard ports such as 4444.

Answer

DeviceProcessEvents

Answer

EmailEvents

Answer

IdentityLogonEvents

Question 7

A security administrator needs to block executable files from running from the %TEMP% folder on Windows devices to prevent common malware execution. Which attack surface reduction (ASR) rule should be enabled?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criteria. Option A is correct because the ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criteria' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) specifically targets executables launched from locations commonly used by malware, such as the %TEMP% folder. This rule uses cloud-delivered reputation data to allow only executables that are prevalent, have sufficient age, or are on a trusted list, effectively blocking unknown or suspicious binaries from running in temporary directories.

Answer

Block credential stealing from the Windows local security authority subsystem

Answer

Block all Office applications from creating child processes

Answer

Block JavaScript or VBScript from launching downloaded executable content

Question 8

A security operations team wants to receive real-time alerts when a user is at high risk of having their account compromised based on unusual sign-in patterns. Which Microsoft Defender XDR component should they configure?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is the correct component because it is specifically designed to detect and alert on identity-based threats, including unusual sign-in patterns that indicate a high risk of account compromise. MDI uses behavioral analytics and machine learning to monitor on-premises Active Directory and Azure AD sign-in logs for anomalies such as impossible travel, unusual login times, or suspicious credential usage, triggering real-time alerts. This directly matches the requirement for real-time alerts on user risk from unusual sign-in patterns.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Question 9

A security administrator wants to automatically isolate a device in Microsoft Defender for Endpoint whenever a high-severity alert is triggered. The isolation should occur without manual intervention. Which Microsoft Defender XDR feature should be configured?

Accepted Answer

Automated investigation and response. Automated Investigation and Response (AIR) in Microsoft Defender XDR is designed to automatically respond to threats by running playbooks that can take remediation actions, such as isolating a device, without manual intervention. When a high-severity alert triggers, AIR evaluates the alert and, if configured, executes the isolation action as part of its automated response, meeting the requirement for zero-touch isolation.

Answer

Attack surface reduction rules

Answer

Threat analytics

Answer

Vulnerability management

Question 10

A security analyst needs to search for devices that have been communicating with a known malicious command-and-control server over the past 7 days. The analyst wants to identify the process that initiated the connection. Which advanced hunting query would be most efficient?

Accepted Answer

DeviceNetworkEvents | where RemoteIP == 'malicious IP' and Timestamp > ago(7d) | project DeviceName, InitiatingProcessFileName, Timestamp. Option A is correct because DeviceNetworkEvents contains network connection data including the remote IP and the initiating process details. Filtering by RemoteIP and Timestamp directly retrieves the required information without unnecessary joins or subqueries, making it the most efficient query for identifying the process that initiated the connection to a known malicious C2 server.

Answer

DeviceProcessEvents | where ProcessId in (select ProcessId from DeviceNetworkEvents where RemoteIP == 'malicious IP' and Timestamp > ago(7d)) | project DeviceName, ProcessFileName, Timestamp

Answer

DeviceNetworkEvents | where Timestamp > ago(7d) | join DeviceProcessEvents on ProcessId | where RemoteIP == 'malicious IP' | project DeviceName, ProcessFileName, Timestamp

Answer

IdentityLogonEvents | where IPAddress == 'malicious IP' | project DeviceName, Timestamp

Question 11

A security administrator needs to block executable files (e.g., .exe, .ps1) from running from the %TEMP% folder on Windows devices to prevent common malware execution. Which attack surface reduction (ASR) rule should be enabled?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion. ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) is designed specifically to block executables (including .exe, .ps1, .scr, .dll) from launching from locations like %TEMP%, %APPDATA%, and the Windows folder, which are common malware staging areas. This rule uses cloud-delivered reputation (prevalence and age) and a Microsoft-managed trusted list to allow legitimate files while blocking unknown or suspicious ones, directly addressing the requirement to prevent malware execution from %TEMP%.

Answer

Block executable content from email client and webmail

Answer

Block Office applications from creating child processes

Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Question 12

A security team wants to automatically investigate and remediate alerts generated from Microsoft Defender for Endpoint, Office 365, and Microsoft Entra ID. Which Microsoft Defender XDR capability should be configured?

Accepted Answer

Automated Investigation and Response. Automated Investigation and Response (AIR) in Microsoft Defender XDR is the correct capability because it automatically triggers playbooks to investigate and remediate alerts across Microsoft Defender for Endpoint, Office 365, and Microsoft Entra ID. AIR uses predefined or custom automation rules to correlate signals from these sources, run investigations, and apply remediation actions like isolating devices or blocking accounts without manual intervention.

Answer

Threat Analytics

Answer

Advanced Hunting

Answer

Secure Score

Question 13

A security administrator wants to configure Microsoft Defender for Cloud Apps so that when a user accesses a sensitive file in a sanctioned cloud app from an unmanaged device, the user is blocked from downloading the file and a block action is logged in real time. Which type of policy should the administrator configure?

Accepted Answer

Create a session policy with the action 'Block' on the download action for files with a specific sensitivity label. A session policy in Microsoft Defender for Cloud Apps allows real-time control over user activities within a sanctioned cloud app. By configuring the action 'Block' on the download action for files with a specific sensitivity label, the administrator can block the download when the session is initiated from an unmanaged device, and the block action is logged in real time. This meets the requirement of blocking the download and logging the action simultaneously.

Answer

Create a file policy that monitors for sensitive files being accessed from unmanaged devices and generates an alert

Answer

Configure an access policy that blocks access to the cloud app from unmanaged devices

Answer

Configure an activity policy that monitors download activities from unmanaged devices and triggers automatic remediation

Question 14

A security team wants to automatically investigate and respond to security incidents across endpoints, email, and identities without manual intervention. Which Microsoft Defender XDR capability provides this automation?

Accepted Answer

Automated investigation and response (AIR). Automated investigation and response (AIR) is the Microsoft Defender XDR capability that automatically investigates alerts and takes remediation actions across endpoints, email, and identities without manual intervention. It uses playbooks and machine learning to triage incidents, determine scope, and apply actions like isolating devices or deleting malicious emails.

Answer

Advanced hunting

Answer

Threat analytics

Answer

Attack surface reduction rules

Question 15

A security administrator wants to prevent users from uploading files to unsanctioned cloud storage apps (e.g., personal Dropbox or Google Drive) from managed Windows devices. The solution must use a reverse proxy to control file uploads in real time. Which Microsoft Defender for Cloud Apps feature should the administrator configure?

Accepted Answer

Session policy. Session policy in Microsoft Defender for Cloud Apps uses reverse proxy capabilities to monitor and control user activities in real time. When configured with the 'Control file upload' action, it can block or restrict uploads to unsanctioned cloud storage apps like personal Dropbox or Google Drive from managed Windows devices, meeting the requirement exactly.

Answer

App discovery policy

Answer

Access policy

Answer

Activity policy

Question 16

A security analyst needs to create a custom detection rule in Microsoft 365 Defender that triggers when a suspicious PowerShell process (e.g., using -EncodedCommand) is detected on a device, and within 5 minutes, an outbound network connection to a known malicious IP address occurs. Which two advanced hunting tables must be joined?

Accepted Answer

DeviceProcessEvents and DeviceNetworkEvents. The custom detection rule requires correlating a suspicious PowerShell process event with a subsequent outbound network connection to a malicious IP within a 5-minute window. DeviceProcessEvents contains process creation data (e.g., command line, process name) for detecting encoded PowerShell commands, while DeviceNetworkEvents logs network connections (destination IP, port, protocol). Joining these two tables on DeviceId and a time range allows the rule to identify the sequence of a process event followed by a network event from the same device.

Answer

DeviceEvents and DeviceFileCertificateInfo

Answer

IdentityLogonEvents and CloudAppEvents

Answer

EmailEvents and EmailAttachmentInfo

Question 17

A security analyst needs to create a custom detection rule in Microsoft Defender XDR that triggers when a device communicates with a new, unclassified IP address flagged by Microsoft threat intelligence as potentially malicious. The rule must run every hour and create an incident if the count of such communications exceeds 10 in a 24-hour window. Which type of rule should the analyst create?

Accepted Answer

custom detection rule using advanced hunting. A custom detection rule using advanced hunting is the correct choice because Microsoft Defender XDR allows you to create custom detection rules based on Kusto Query Language (KQL) queries that run on a scheduled interval (e.g., every hour). This rule can query the `DeviceNetworkEvents` table to identify communications with IP addresses flagged as malicious by Microsoft threat intelligence, aggregate the count over a 24-hour sliding window, and trigger an incident when the threshold of 10 is exceeded. This directly meets the requirement for a scheduled, threshold-based detection within Defender XDR.

Answer

scheduled alert rule in Microsoft Sentinel

Answer

An incident creation rule in Microsoft Defender for Cloud Apps

Answer

custom remediation action rule

Question 18

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a user receives a phishing email containing a malicious URL and then clicks that URL within 10 minutes. Which two Advanced Hunting tables must be joined in the KQL query?

Accepted Answer

EmailEvents and UrlClickEvents. The rule requires detecting when a user receives a phishing email with a malicious URL and then clicks that URL within 10 minutes. The EmailUrlInfo table contains the URL extracted from the email (including the verdict), and the UrlClickEvents table records user clicks on URLs in Microsoft Defender for Office 365 Safe Links. Joining these two tables on the URL hash (SHA256) allows correlation of the email-delivered URL with the user's click event, enabling the time-based trigger.

Answer

EmailEvents and DeviceProcessEvents

Answer

EmailAttachmentInfo and UrlClickEvents

Question 19

A security analyst wants to create a custom detection rule that triggers when a device communicates with a new, unclassified IP address that has been flagged by Microsoft threat intelligence as potentially malicious. The rule should run every hour and create an incident if more than 5 such communications from the same device occur within a 24-hour window. Which advanced hunting tables should be joined in the KQL query for this rule?

Accepted Answer

DeviceNetworkEvents and IPReputation. Option A is correct because the rule requires detecting network communications to potentially malicious IP addresses, which involves joining `DeviceNetworkEvents` (which logs network connections from devices) with `IPReputation` (which contains Microsoft's threat intelligence classifications for IP addresses). This join allows the query to filter for communications where the destination IP is flagged as malicious and then aggregate by device to trigger an incident when the count exceeds 5 within a 24-hour window.

Answer

DeviceProcessEvents and AlertInfo

Answer

DeviceFileEvents and DeviceIPInfo

Answer

EmailEvents and DeviceNetworkEvents

Question 20

You are a Microsoft 365 administrator responsible for managing security and threats by using Microsoft Defender XDR. Which four of the following are core components or capabilities of Microsoft Defender XDR? (Choose all that apply. There are four correct answers.)

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender XDR is a unified pre- and post-breach enterprise defense suite that natively integrates signals from four core Microsoft Defender components: Defender for Endpoint (endpoint detection and response), Defender for Office 365 (email and collaboration security), Defender for Identity (on-premises Active Directory identity threat detection), and Defender for Cloud Apps (SaaS application access and shadow IT control). These four are the foundational pillars that feed into the Microsoft 365 Defender portal, enabling cross-domain correlation and automated incident response.

Answer

Microsoft Intune

Answer

Microsoft 365 Defender portal Threat Analytics