MS-102 Practice Exam 53 — 20 Questions

Question 1

A ransomware alert is confirmed in Microsoft Defender XDR on a user device that is still communicating with other endpoints. What should the administrator do first to reduce spread while preserving the ability to investigate?

Accepted Answer

Isolate the affected device from the network. Option A is correct because immediately isolating the affected device from the network stops the ransomware from spreading laterally to other endpoints via SMB, RDP, or other protocols, while preserving the device's state for forensic analysis. Microsoft Defender XDR's device isolation feature blocks all inbound and outbound communication except with the Defender for Endpoint cloud service, allowing investigation to continue without the risk of further infection.

Answer

Collect a forensic package before taking containment action

Answer

Run a full antivirus scan before isolating the device

Answer

Wait for automated investigation to complete before responding

Question 2

A security analyst wants to create a custom detection rule in Microsoft Defender XDR that triggers when a user receives a phishing email (delivered to inbox) and then, from their Windows device, establishes a network connection to a known malicious IP address. The rule will be based on an advanced hunting query. Which two tables should the analyst join in the KQL query to capture both the email delivery event and the network connection event?

Accepted Answer

EmailEvents and DeviceNetworkEvents. Option A is correct because the rule requires capturing both the phishing email delivery event and the subsequent network connection to a malicious IP. The EmailEvents table records email delivery status (including 'Delivered' to inbox), and the DeviceNetworkEvents table records outbound network connections from Windows devices, including destination IP addresses. Joining these two tables on a common identifier (such as RecipientObjectId and DeviceId) allows the analyst to correlate the email receipt with the network connection event.

Answer

EmailEvents and DeviceProcessEvents

Answer

EmailAttachmentInfo and DeviceRegistryEvents

Question 3

A security analyst wants to create a custom detection rule in Microsoft 365 Defender Advanced Hunting that alerts when a user receives a phishing email and clicks a malicious link within 10 minutes. Which two tables must be joined in the KQL query?

Accepted Answer

EmailEvents and UrlClickEvents. To detect a user receiving a phishing email and clicking a malicious link within 10 minutes, you need to correlate the email delivery event with the click action. The EmailEvents table contains records of email delivery (including sender, recipient, and subject), while the UrlClickEvents table logs when a user clicks a link in an email, including the URL and timestamp. Joining these two tables on a common identifier (such as NetworkMessageId) allows you to filter for clicks that occur within 10 minutes of email delivery, satisfying the detection requirement.

Answer

EmailAttachmentInfo and UrlClickEvents

Answer

EmailPostDeliveryEvents and DeviceNetworkEvents

Question 4

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should detect when a user opens a malicious email attachment, which launches a PowerShell process, and then that PowerShell process makes an outbound connection to a known malicious IP address. Which three Advanced Hunting tables must be joined in the KQL query?

Accepted Answer

EmailEvents, DeviceProcessEvents, DeviceNetworkEvents. Option B is correct because the detection requires tracking the attachment that initiated the process (EmailAttachmentInfo), the PowerShell process execution (DeviceProcessEvents), and the outbound network connection to a malicious IP (DeviceNetworkEvents). EmailAttachmentInfo provides the link between the email and the file, while EmailEvents lacks file-level details needed for this chain.

Answer

EmailAttachmentInfo, DeviceProcessEvents, DeviceLogonEvents

Question 5

A security analyst wants to search for instances where a user received a phishing email that was delivered to their inbox, and then later clicked a link within that email that led to a known malicious domain. Which two advanced hunting tables should be joined to identify both the email delivery and the link click events? (Choose the option that correctly identifies the primary table pair.)

Accepted Answer

EmailEvents and DeviceEvents. To correlate a phishing email that was delivered to a user's inbox with a subsequent link click to a known malicious domain, you need to join the EmailEvents table (which records email delivery events, including the delivery action and the unique NetworkMessageId) with the DeviceEvents table (which captures user actions such as clicking a URL, including the ActionType 'PhishClick' or 'UrlClick'). This join allows you to match the email's NetworkMessageId with the click event's NetworkMessageId, linking the delivered email to the specific link click.

Answer

EmailUrlInfo and DeviceProcessEvents

Answer

EmailEvents and DeviceLogonEvents

Question 6

A security analyst is investigating a potential lateral movement attack. They need to identify which processes were created on a compromised device and then which network connections were made by those processes. Which two advanced hunting tables should the analyst join in a KQL query?

Accepted Answer

A: DeviceProcessEvents and DeviceNetworkEvents. Option A is correct because the analyst needs to correlate process creation events (DeviceProcessEvents) with network connections initiated by those processes (DeviceNetworkEvents). Joining these two tables on a common field like DeviceId and ProcessId allows the analyst to trace which specific processes on the compromised device made outbound connections, directly mapping lateral movement indicators such as SMB, RDP, or WinRM traffic.

Answer

B: DeviceEvents and DeviceFileEvents

Answer

D: EmailEvents and DeviceNetworkEvents

Question 7

A security analyst wants to create a custom detection rule that triggers when a user receives a phishing email that bypassed Exchange Online Protection, and then clicks a link that leads to a known malicious domain. Which two advanced hunting tables should the analyst combine to detect this chain of events?

Accepted Answer

EmailEvents and UrlClickEvents. Option B is correct because the detection requires correlating the email receipt (EmailEvents) with the user's click on a malicious link (UrlClickEvents). EmailEvents captures email delivery details, while UrlClickEvents records user clicks on URLs in email messages, including those that bypassed Exchange Online Protection. Combining these two tables allows the analyst to identify the specific chain: a user received a phishing email and then clicked a link to a known malicious domain.

Answer

EmailEvents and DeviceNetworkEvents

Answer

EmailEvents and IdentityLogonEvents

Question 8

A security analyst is building a custom detection rule in Microsoft 365 Defender to identify when a user clicks a malicious URL in a phishing email and subsequently visits the malicious site from their corporate device. The analyst plans to use advanced hunting with Kusto Query Language (KQL). Which two tables must be joined to capture both the URL click event and the network connection to the malicious site?

Accepted Answer

EmailEvents and DeviceNetworkEvents. Option B is correct because EmailUrlInfo contains the URL click events from phishing emails, and DeviceNetworkEvents logs network connections from corporate devices. Joining these two tables on the URL value captures the full chain: the user clicking the malicious link and the device subsequently connecting to that site.

Answer

EmailAttachmentInfo and DeviceProcessEvents

Answer

EmailEvents and DeviceFileEvents

Question 9

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a process named 'powershell.exe' is launched with command-line arguments containing '-EncodedCommand', and within 5 minutes a service is created on the same device. Which two Advanced Hunting tables must be joined in the KQL query to create this detection?

Accepted Answer

DeviceProcessEvents and DeviceEvents. The correct answer is A because the detection rule requires monitoring process creation events (DeviceProcessEvents) to detect powershell.exe with '-EncodedCommand', and then service creation events (DeviceEvents) within 5 minutes on the same device. DeviceEvents captures service-related actions like 'ServiceInstalled' or 'ServiceCreated', which are essential for the second condition. Joining these two tables on DeviceId and a time window allows the KQL query to correlate the two events.

Answer

DeviceProcessEvents and DeviceNetworkEvents

Answer

DeviceEvents and DeviceLogonEvents

Question 10

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should detect when a user receives a malicious email attachment and then opens the attachment, resulting in a process being created (e.g., .exe file). Which two Advanced Hunting tables must be joined to correlate the email attachment with the resulting process?

Accepted Answer

EmailEvents and DeviceProcessEvents. Option B is correct because correlating email attachment information with process creation requires joining the EmailAttachmentInfo table (which contains details about attachments like file name and SHA256 hash) with the DeviceProcessEvents table (which logs process creation events). This join allows the analyst to match the attachment's hash or file name to the process that was created when the user opened the attachment, directly linking the malicious email to the resulting executable.

Answer

EmailAttachmentInfo and DeviceFileEvents

Answer

DeviceProcessEvents and IdentityLogonEvents

Question 11

A compliance officer needs to identify documents in SharePoint Online that contain credit card numbers. The officer wants a solution that can automatically detect and mark these documents for further review without applying any protection actions. Which Microsoft Purview solution should the officer use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) policy. Microsoft Purview Data Loss Prevention (DLP) policies can be configured to detect sensitive information types, such as credit card numbers, in SharePoint Online documents. When a match is found, the policy can be set to send an alert or trigger a review action without automatically applying protection (e.g., blocking access or encrypting). This meets the compliance officer's requirement for automatic detection and marking for further review.

Answer

Microsoft Purview Information Protection sensitivity label auto-labeling

Answer

Microsoft Purview eDiscovery content search

Answer

Microsoft Purview Records Management retention label

Question 12

A compliance officer needs to prevent users from sending emails that contain social security numbers to external recipients. When a user attempts to send such an email from Outlook, the email should be blocked and a policy tip should be displayed explaining why the email was blocked. Which Microsoft Purview solution should the officer configure?

Accepted Answer

Data Loss Prevention (DLP) policy. A Data Loss Prevention (DLP) policy in Microsoft Purview is designed to detect sensitive information, such as social security numbers, in emails and enforce actions like blocking the message and displaying a policy tip. This meets the compliance officer's requirement to prevent external sending of sensitive data while providing user notification.

Answer

Sensitivity labels

Answer

Communication compliance

Answer

eDiscovery

Question 13

A compliance officer needs to prevent users from sharing emails that contain credit card numbers with external recipients. When a user attempts to send such an email, it should be blocked immediately, and a policy tip should notify the user. Which Microsoft Purview solution should the officer configure?

Accepted Answer

Data Loss Prevention (DLP) policy. A Data Loss Prevention (DLP) policy is the correct solution because it is specifically designed to detect sensitive information, such as credit card numbers, in transit (e.g., email) and enforce actions like blocking the message and displaying a policy tip to the user. DLP policies use sensitive information types (e.g., Credit Card Number) and rules to inspect content in Exchange Online, SharePoint, OneDrive, and Teams, allowing real-time blocking with user notification. This directly meets the compliance officer's requirement to prevent external sharing and provide immediate feedback.

Answer

sensitivity label

Answer

retention label

Answer

An information barrier policy

Question 14

Refer to the exhibit. You are reviewing a Conditional Access policy JSON. The policy is intended to block legacy authentication. However, users are still able to connect using Exchange ActiveSync. What is the most likely reason?

Accepted Answer

The policy is missing the 'browser' and 'mobileAppsAndDesktopClient' client app types. The policy is missing the 'browser' and 'mobileAppsAndDesktopClient' client app types. Conditional Access policies that block legacy authentication must explicitly include these client app types because Exchange ActiveSync (EAS) uses the 'mobileAppsAndDesktopClient' type for modern authentication clients and falls back to legacy protocols if not properly targeted. Without these types, the policy does not apply to EAS traffic, allowing legacy connections to succeed.

Answer

The grant control operator 'OR' should be 'AND'

Answer

The policy is configured in 'report-only' mode instead of 'enforce'

Answer

The policy is missing a condition for 'device platforms' to target iOS and Android

Question 15

An organization wants to authenticate users using their on-premises Active Directory without synchronizing passwords to Microsoft Entra ID. Which identity model should they choose?

Accepted Answer

Federated identity. Federated identity allows users to authenticate against on-premises Active Directory using protocols such as WS-Federation, SAML 2.0, or AD FS, without synchronizing password hashes to Microsoft Entra ID. This model relies on a trust relationship between the on-premises identity provider and Entra ID, ensuring passwords never leave the local environment.

Answer

Synchronized identity

Answer

Cloud-only identity

Answer

Microsoft-managed identity

Question 16

A compliance officer needs to discover and review documents in SharePoint Online that contain driver's license numbers, but the officer does not want to apply any protection actions automatically. Which Microsoft Purview solution should be used?

Accepted Answer

Data Classification. Data Classification in Microsoft Purview allows you to identify and label sensitive content, such as driver's license numbers, across SharePoint Online without automatically applying protection actions like encryption or access restrictions. This solution is ideal for discovery and review scenarios where the compliance officer needs to locate sensitive data but does not want to enforce automated policies.

Answer

Data Lifecycle Management

Answer

Records Management

Answer

Information Protection

Question 17

A compliance officer needs to prevent users from sharing documents labeled 'Confidential' via email with external recipients. If a user attempts to send such an email, the action should be blocked and a policy tip displayed. Which Microsoft Purview feature should be configured?

Accepted Answer

Data Loss Prevention (DLP) policy. A Data Loss Prevention (DLP) policy is the correct Microsoft Purview feature because it is specifically designed to inspect email content and attachments for sensitive information, such as documents labeled 'Confidential', and enforce actions like blocking the email and displaying a policy tip to the user. DLP policies can be configured with conditions that detect sensitivity labels and apply protective actions, including blocking external sharing and notifying users via policy tips.

Answer

Retention labels

Answer

Sensitivity labels

Answer

Information barriers

Question 18

A compliance officer needs to ensure that all documents in a SharePoint Online library are automatically labeled with a 'Confidential' sensitivity label if they contain at least one of a predefined list of sensitive information types such as credit card numbers or social security numbers. Users should be able to override the label with a business justification. Which Microsoft Purview feature should the officer configure?

Accepted Answer

Auto-labeling policy for SharePoint Online. Auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels to documents in SharePoint Online based on the detection of sensitive information types (e.g., credit card numbers, SSNs). This policy supports user override with a business justification, meeting the compliance officer's requirement exactly. Manual classification (Option D) would not automate the labeling, and DLP policies (Option B) focus on preventing data loss, not applying sensitivity labels.

Answer

Data Loss Prevention (DLP) policy

Answer

Retention label policy

Answer

Sensitivity label with manual classification

Question 19

You are the Microsoft 365 Administrator for a multinational organization that must comply with various regulatory requirements, including GDPR, SOX, and internal data retention policies. You are deploying Microsoft Purview compliance solutions. Which four of the following actions are valid steps when managing compliance using Microsoft Purview? (Choose all that apply. There are four correct answers.)

Accepted Answer

Create a DLP policy that prevents users from sharing credit card numbers via email with external recipients.. Creating a DLP policy that prevents sharing credit card numbers via email with external recipients is a valid step because Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive information types (e.g., credit card numbers) and enforce actions such as blocking external sharing. This directly supports compliance with regulations like GDPR and SOX by preventing unauthorized data exfiltration.

Answer

Apply a sensitivity label to a SharePoint site that blocks all external sharing of documents stored in that site.

Answer

Assign a retention policy to a user's mailbox that deletes all emails immediately after they are sent.

Question 20

An organization is involved in a legal case and needs to preserve all emails in a user's mailbox, including future emails, without deleting or modifying them. The user must continue to work normally. Which Microsoft Purview feature should be applied to the user's mailbox?

Accepted Answer

Litigation Hold. Litigation Hold (option A) is the correct feature because it preserves all mailbox content, including future emails, in its original state without allowing deletion or modification by users or automated processes. Unlike a retention policy, Litigation Hold places the entire mailbox on indefinite hold, ensuring that any item changed or deleted by the user is retained in the Recoverable Items folder, while the user continues to work normally. This meets the legal preservation requirement without disrupting daily operations.

Answer

Retention policy

Answer

Sensitivity label

Answer

Data Loss Prevention (DLP)