MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 10 — 15 Questions

Question 1

A security analyst needs to identify the specific process (filename) that initiated a network connection from a device to a known malicious IP address over the last 24 hours. Which advanced hunting table in Microsoft Defender XDR provides the necessary data including the initiating process filename and the remote IP address?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the correct table because it specifically captures network connection events, including the initiating process filename (InitiatingProcessFileName) and the remote IP address (RemoteIP). This table is designed for hunting network-related activities, such as connections to known malicious IPs, within Microsoft Defender XDR's advanced hunting schema.

Answer

DeviceProcessEvents

Answer

DeviceEvents

Answer

DeviceRegistryEvents

Question 2

A security administrator wants to simulate a realistic phishing attack to train users and measure their susceptibility. The simulation should be run from within Microsoft Defender XDR and provide detailed reporting. Which feature should the administrator use?

Accepted Answer

Attack Simulation Training. Attack Simulation Training in Microsoft Defender XDR allows security administrators to create and launch realistic phishing campaigns directly from the Microsoft 365 Defender portal. It provides detailed reporting on user interactions, such as who clicked the link or entered credentials, enabling measurement of user susceptibility and targeted training follow-ups.

Answer

Advanced Hunting

Answer

Automated Investigation and Response

Answer

Threat Analytics

Question 3

A security administrator wants to prevent malware from using Office macros to spawn malicious processes. Specifically, they want to block Excel, Word, and PowerPoint from creating child processes. Which Microsoft Defender for Endpoint capability should be configured?

Accepted Answer

Attack Surface Reduction (ASR) rules. Attack Surface Reduction (ASR) rules are a Microsoft Defender for Endpoint capability specifically designed to block common malware behaviors, such as Office applications (Excel, Word, PowerPoint) from creating child processes. This rule (GUID: 26190899-1602-49e8-8b27-eb1d0a1ce869) prevents macros from spawning cmd.exe, powershell.exe, or other executables, directly addressing the administrator's requirement.

Answer

Threat & Vulnerability Management

Answer

Web Protection

Answer

Network Protection

Question 4

A security administrator wants to automatically isolate a device in Microsoft Defender for Endpoint whenever a high-severity alert is triggered. The isolation should occur without manual intervention. Which Microsoft Defender XDR feature should be configured?

Accepted Answer

Automated investigation and response. Automated Investigation and Response (AIR) in Microsoft Defender XDR is designed to automatically respond to threats by running playbooks that can take remediation actions, such as isolating a device, without manual intervention. When a high-severity alert triggers, AIR evaluates the alert and, if configured, executes the isolation action as part of its automated response, meeting the requirement for zero-touch isolation.

Answer

Attack surface reduction rules

Answer

Threat analytics

Answer

Vulnerability management

Question 5

A security analyst has identified a new malware sample with SHA256 hash 'abc123...'. They need to immediately block this file from executing on any managed endpoint across the organization. Which Microsoft Defender for Endpoint capability should they use?

Accepted Answer

Indicators (IoC). Indicators of Compromise (IoC) in Microsoft Defender for Endpoint allow security analysts to create custom indicators (such as file hashes, IPs, or URLs) that are immediately enforced across all managed endpoints. This capability enables blocking execution of a specific SHA256 hash at the kernel level via the Microsoft Defender Antivirus driver, providing near-instant protection without requiring a signature update or policy change.

Answer

Attack surface reduction rules

Answer

Automated investigation and response

Answer

Threat analytics

Question 6

A security analyst needs to create a custom detection rule in Microsoft Defender XDR that triggers when a device communicates with a new, unclassified IP address flagged by Microsoft threat intelligence as potentially malicious. The rule must run every hour and create an incident if the count of such communications exceeds 10 in a 24-hour window. Which type of rule should the analyst create?

Accepted Answer

custom detection rule using advanced hunting. A custom detection rule using advanced hunting is the correct choice because Microsoft Defender XDR allows you to create custom detection rules based on Kusto Query Language (KQL) queries that run on a scheduled interval (e.g., every hour). This rule can query the `DeviceNetworkEvents` table to identify communications with IP addresses flagged as malicious by Microsoft threat intelligence, aggregate the count over a 24-hour sliding window, and trigger an incident when the threshold of 10 is exceeded. This directly meets the requirement for a scheduled, threshold-based detection within Defender XDR.

Answer

scheduled alert rule in Microsoft Sentinel

Answer

An incident creation rule in Microsoft Defender for Cloud Apps

Answer

custom remediation action rule

Question 7

A security administrator needs to view a unified incident queue that correlates alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. Which console should the administrator open?

Accepted Answer

Microsoft 365 Defender portal (security.microsoft.com). The Microsoft 365 Defender portal (security.microsoft.com) provides a unified incident queue that aggregates and correlates alerts from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This single-pane-of-glass view enables security administrators to investigate and respond to cross-domain threats without switching between separate consoles.

Answer

Azure Security Center

Answer

Microsoft Endpoint Manager admin center

Answer

Microsoft Purview compliance portal

Question 8

A security analyst wants to create a custom detection rule in Microsoft Defender XDR that triggers when a user receives a phishing email (delivered to inbox) and later clicks a link from that email that leads to a known malicious domain. The rule will be based on an advanced hunting query. Which two tables should the analyst join in the query to capture both the email delivery event and the link click event? (Choose two.)

Accepted Answer

EmailEvents. EmailEvents contains records of email delivery events, including phishing emails that were delivered to the inbox. UrlClickEvents captures user clicks on URLs in emails, including the target domain. Joining these two tables on the email's network message ID allows the analyst to correlate the specific phishing email delivery with the subsequent link click to a known malicious domain, which is the exact scenario described.

Answer

DeviceEvents

Answer

IdentityLogonEvents

Question 9

A security analyst has identified a new malware sample with a specific SHA256 hash. The analyst needs to immediately block this file from executing on any managed endpoint across the organization, including prevention of future execution. Which Microsoft Defender for Endpoint capability should the analyst use?

Accepted Answer

Indicators (IoCs) for file hashes. Indicators of Compromise (IoCs) for file hashes in Microsoft Defender for Endpoint allow an analyst to create a block indicator for a specific SHA256 hash. This action immediately prevents the file from executing on any managed endpoint and persists across reboots, effectively blocking future execution attempts. Unlike other capabilities, IoCs provide a direct, hash-based block that is enforced by the Microsoft Defender Antivirus engine at the point of execution.

Answer

Attack surface reduction (ASR) rules

Answer

Custom detection rules via advanced hunting

Answer

Microsoft Defender Vulnerability Management

Question 10

A security analyst wants to create a custom detection rule that triggers when a device communicates with a new, unclassified IP address that has been flagged by Microsoft threat intelligence as potentially malicious. The rule should run every hour and create an incident if more than 5 such communications from the same device occur within a 24-hour window. Which advanced hunting tables should be joined in the KQL query for this rule?

Accepted Answer

DeviceNetworkEvents and IPReputation. The rule requires detecting network communications to potentially malicious IP addresses, which involves joining `DeviceNetworkEvents` (which logs network connections from devices) with `IPReputation` (which contains Microsoft's threat intelligence classifications for IP addresses). This join allows the query to filter for communications where the destination IP is flagged as malicious and then aggregate by device to trigger an incident when the count exceeds 5 within a 24-hour window.

Answer

DeviceProcessEvents and AlertInfo

Answer

DeviceFileEvents and DeviceIPInfo

Answer

EmailEvents and DeviceNetworkEvents

Question 11

A security administrator needs to create an automated investigation and response (AIR) playbook that automatically isolates a device whenever a high-severity alert from Microsoft Defender for Endpoint is generated. The playbook should run without requiring manual approval. Which capability in Microsoft 365 Defender should the administrator configure?

Accepted Answer

Automated investigation and response (AIR) action policy. Automated Investigation and Response (AIR) action policies in Microsoft 365 Defender allow administrators to define automated remediation actions—such as device isolation—that execute automatically when specific alert conditions are met, without requiring manual approval. The policy can be configured to trigger on high-severity alerts from Microsoft Defender for Endpoint, enabling fully automated containment of compromised devices.

Answer

Custom detection rule

Answer

Threat analytics

Answer

Attack simulation training

Question 12

A security administrator wants to configure Automated Investigation and Response (AIR) in Microsoft 365 Defender to automatically isolate a device when a high-severity alert for malware is detected. Which step is required?

Accepted Answer

C: Configure the device to be part of a device group and enable automation level.. To enable Automated Investigation and Response (AIR) in Microsoft Defender for Endpoint, the device must be added to a device group, and the automation level for that group must be set to 'Full – remediate threats automatically' or a similar level. This configuration allows Defender to automatically isolate a device when a high-severity malware alert is triggered, as part of the built-in AIR playbooks.

Answer

A: Create an automation rule in Microsoft Sentinel.

Answer

B: Create a custom detection rule in advanced hunting.

Answer

D: Enable auto-removal of malware from devices.

Question 13

A security analyst wants to create a custom detection rule in Microsoft Defender XDR that triggers when a device establishes a network connection to an IP address that has been recently observed in threat intelligence feeds as a new, malicious command-and-control server. The rule should analyze network communication events. Which advanced hunting table should be the primary data source for the Kusto Query Language (KQL) query?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the correct primary data source because it captures network connection events, including source and destination IP addresses, ports, and protocols. To detect a device connecting to a newly observed malicious command-and-control server, the KQL query must analyze network communication events, which are stored exclusively in this table.

Answer

DeviceProcessEvents

Answer

EmailEvents

Answer

AlertEvidence

Question 14

A user receives an email from an unknown sender with a .zip attachment. The attachment contains a potentially malicious executable file. Microsoft Defender for Office 365 is enabled. Which feature dynamically detonates the attachment in a sandbox environment and blocks it if malicious behavior is detected?

Accepted Answer

Safe Attachments. Safe Attachments is the correct feature because it specifically detonates email attachments in a dynamic sandbox environment, analyzing behavior in real time. If the .zip file contains a malicious executable, Safe Attachments will block the email before delivery, preventing the user from accessing the threat. This is distinct from other Defender for Office 365 features that focus on URLs, phishing content, or spam filtering.

Answer

Safe Links

Answer

Anti-phishing

Answer

Anti-spam

Question 15

A security administrator wants to detect unusual user activity, such as a user downloading an abnormally large number of files from SharePoint Online in a short period. Which Microsoft Defender for Cloud Apps feature should be used to create a policy for this behavior?

Accepted Answer

Anomaly detection policy. Microsoft Defender for Cloud Apps uses anomaly detection policies to identify unusual user behavior, such as a user downloading an abnormally large number of files from SharePoint Online in a short period. These policies leverage machine learning to establish a baseline of normal activity and then trigger alerts when deviations occur, like a spike in download volume or rate.

Answer

Cloud Discovery

Answer

Conditional Access App Control

Answer

App permissions