MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 10 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Endpoint and Microsoft Defender for Identity. A user reports that their account was used to send a large volume of email messages to internal recipients, which appears to be a potential account compromise. You need to determine if the account is compromised and if any lateral movement occurred. Which data sources should you analyze in Microsoft Defender XDR?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IdentityLogonEvents, EmailEvents, and DeviceProcessEvents. IdentityLogonEvents (from Microsoft Defender for Identity) provide logon activities, EmailEvents (from Microsoft Defender for Office 365) show email sending patterns, and DeviceProcessEvents (from Microsoft Defender for Endpoint) reveal process creations that may indicate lateral movement (e.g., PsExec, WMI). Together, these three data sources allow correlation of identity, email, and device events to confirm a compromise and detect lateral movement. Option A is incorrect because EmailEvents and EmailAttachmentInfo cover only email context, lacking identity and lateral movement data. Option B is incorrect because DeviceNetworkEvents and DeviceProcessEvents lack identity and email context. Option C is incorrect because DeviceEvents and DeviceNetworkEvents also miss identity and email context.

Answer

EmailEvents and EmailAttachmentInfo

Answer

DeviceNetworkEvents and DeviceProcessEvents

Answer

DeviceEvents and DeviceNetworkEvents

Question 2

Your organization uses Microsoft Defender XDR. You need to configure automatic attack disruption for SaaS applications. Which Microsoft 365 security solution provides this capability?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (Option B) provides automatic attack disruption for SaaS applications by using risk indicators and automation to stop attacks in real time. Option A (Microsoft Defender for Identity) focuses on on-premises Active Directory and identity threats, not SaaS apps. Option C (Microsoft Defender for Office 365) protects email and collaboration tools. Option D (Microsoft Defender for Endpoint) secures endpoints like desktops and servers. Therefore, only option B delivers the required capability.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Endpoint

Question 3

Your organization uses Microsoft Defender XDR. You are configuring a custom detection rule to detect a specific behavior: a user runs a PowerShell script that connects to a known malicious IP address. Which TWO advanced hunting tables should you use in your KQL query to detect this behavior?

Accepted Answer

DeviceProcessEvents. To detect a user running a PowerShell script that connects to a known malicious IP address, you need to correlate process creation events (to capture the PowerShell script execution) with network connection events (to capture the outbound connection to the IP address). DeviceProcessEvents tracks process creation, including PowerShell.exe. DeviceNetworkEvents tracks network connections to remote IP addresses. Therefore, the correct tables are DeviceProcessEvents (A) and DeviceNetworkEvents (E).

Answer

DeviceRegistryEvents

Answer

DeviceLogonEvents

Answer

DeviceFileEvents

Question 4

Your organization has Microsoft Defender for Endpoint deployed on all devices. You are investigating an incident where a user received a phishing email containing a link that led to a drive-by download. The download executed a script that attempted to modify registry run keys for persistence. Which THREE advanced hunting tables should you use to investigate this attack chain?

Accepted Answer

EmailEvents. The correct three tables are EmailEvents (option B) for the phishing email, DeviceProcessEvents (option C) for the script execution, and DeviceRegistryEvents (option D) for the registry persistence. Option A (DeviceFileEvents) could also be used for the file download but is not required, and Option E (DeviceNetworkEvents) is less directly relevant.

Answer

DeviceFileEvents

Answer

DeviceNetworkEvents

Question 5

Your organization uses Microsoft Defender XDR. You need to configure automated actions for high-confidence phishing emails. Which TWO actions can be automatically taken by Microsoft Defender for Office 365?

Accepted Answer

Soft delete the email from the user's mailbox. Options C (Soft delete) and D (Move to quarantine) are automated actions that can be configured for high-confidence phishing emails in Microsoft Defender for Office 365. Option A (Add a header) is not an automated action; it's a mail flow rule. Option B (Permanently delete) is not a direct automated action; soft delete is used instead. Option E (Forward to security team) is not an automated action; it would require a custom rule.

Answer

Add a header to the email indicating it is phishing

Answer

Permanently delete the email from the user's mailbox

Answer

Forward the email to the security team

Question 6

You are reviewing a conditional access policy in Microsoft Entra ID as shown in the exhibit. The policy is intended to block sign-ins that are considered risky. However, some high-risk users are still able to sign in. What is the most likely reason?

Accepted Answer

The policy requires both user risk and sign-in risk to be at specified levels simultaneously. The conditional access policy only blocks sign-ins when both user risk is high AND sign-in risk is medium or high. If a user has high user risk but low sign-in risk, the policy does not apply, allowing them to sign in. Options A, B, and C are incorrect: A states both must be high, but the policy may require medium or high for sign-in risk; B is not about MFA; C is wrong because sign-in risk levels are included.

Answer

The policy requires user risk and sign-in risk to both be high

Answer

The policy requires multi-factor authentication instead of blocking

Answer

The policy does not include sign-in risk levels

Question 7

You create a custom detection rule in Microsoft Defender XDR using the KQL query shown in the exhibit. The rule is intended to detect lateral movement via SMB. After deploying the rule, you notice that it generates many false positives from legitimate administrative activity. What is the most effective way to reduce false positives?

Accepted Answer

Add a filter to exclude specific administrative accounts or IP ranges. Adding a filter to exclude specific administrative accounts or IP ranges directly addresses the false positives caused by legitimate administrative activity. Option A is wrong because focusing only on inbound SMB connections may still include administrative traffic and could miss lateral movement patterns. Option B is wrong because removing the join with DeviceProcessEvents would eliminate the correlation between SMB connections and process events, which is essential for detecting lateral movement via SMB. Option D is wrong because increasing the time window would include more events, potentially increasing false positives rather than reducing them.

Answer

Filter for only inbound SMB connections

Answer

Remove the join with DeviceProcessEvents

Answer

Increase the time window of the query

Question 8

You are a security administrator for a company that uses Microsoft Defender XDR. You need to configure a policy to automatically remediate high-severity incidents involving ransomware on Windows 10 devices. The solution must minimize manual intervention. Which automation level should you configure in the automated investigation and response (AIR) capabilities?

Accepted Answer

Automatically remediate threats. 'Automatically remediate threats,' is the correct automation level for minimizing manual intervention when handling high-severity ransomware incidents on Windows 10 devices in Microsoft Defender XDR. This setting allows the automated investigation and response (AIR) engine to take remediation actions—such as isolating devices or blocking files—without requiring an administrator's approval, which is essential for rapid containment of ransomware. The 'Full - automatically remediate threats' option is not a valid selection in the AIR automation levels; the correct terminology is simply 'Automatically remediate threats.'

Answer

Full - automatically remediate threats

Answer

Semi - require approval for any remediation

Answer

No automated response

Question 9

Your organization uses Microsoft Defender for Endpoint and Microsoft Defender for Identity. A user reports that their account was used to send a large volume of email messages to internal recipients, which appears to be a potential account compromise. You need to determine if the account is compromised and if any lateral movement occurred. Which data sources should you analyze in Microsoft Defender XDR?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A session policy in Defender for Cloud Apps. To automatically suspend a compromised user and prevent access to cloud apps, you should configure a policy in Microsoft Defender for Cloud Apps such as an activity policy or anomaly detection policy that triggers on conditions like unusual location or impossible travel. These policy types allow you to set a governance action to 'Suspend user', which disables the user account. A session policy in Defender for Cloud Apps provides real-time session control (e.g., block or limit actions) but does not suspend the user account. Since options A, B, and C are email security policies unrelated to this scenario, the closest answer is D despite the inaccuracy in describing it as a session policy.

Answer

An anti-phishing policy in Defender for Office 365

Answer

A Safe Attachments policy in Defender for Office 365

Answer

A Safe Links policy in Defender for Office 365

Question 10

Your company uses Microsoft Defender XDR. You need to review the list of incidents that were investigated automatically by the system. Where should you navigate in the Microsoft Defender portal?

Accepted Answer

Incidents & alerts > Incidents. The 'Incidents & alerts > Incidents' section in the Microsoft Defender portal is the dedicated location where all incidents, including those automatically investigated by Microsoft Defender XDR's automated investigation and response (AIR) capabilities, are listed and managed. This view shows the incident queue, including the 'Investigation state' column that indicates whether an investigation was initiated automatically or manually, allowing you to filter and review system-initiated investigations.

Answer

Hunting

Answer

Action center

Answer

Reports

Question 11

You are a security analyst. You need to create a custom detection rule in Microsoft Defender XDR that triggers an alert when a user account is created and then added to a privileged role within 24 hours. Which advanced hunting table should you primarily use?

Accepted Answer

IdentityLogonEvents. The correct table for detecting user account creation and role changes is IdentityDirectoryEvents, not IdentityLogonEvents. None of the given options (A: EmailEvents, B: IdentityLogonEvents, C: DeviceEvents, D: CloudAppEvents) are correct for this scenario.

Answer

EmailEvents

Answer

DeviceEvents

Answer

CloudAppEvents

Question 12

Your organization has Microsoft Defender for Cloud Apps deployed. You need to be alerted when a user performs more than 50 failed login attempts in an hour from a non-corporate IP address. Which type of policy should you create?

Accepted Answer

Anomaly detection policy. An anomaly detection policy in Defender for Cloud Apps can detect unusual patterns like multiple failed login attempts from non-corporate IPs. Option A is wrong because a session policy controls real-time access but doesn't detect anomalies. Option C is wrong because a file policy monitors file activities, not login attempts. Option D is wrong because an access policy enforces conditional access based on compliance, not anomaly detection.

Answer

Session policy

Answer

File policy

Answer

Access policy

Question 13

You are a security administrator. You need to ensure that email messages containing malicious attachments are automatically removed from all mailboxes in your organization after delivery. Which Microsoft Defender for Office 365 feature should you configure?

Accepted Answer

Zero-hour auto purge (ZAP). Zero-hour auto purge (ZAP) is the feature in Microsoft Defender for Office 365 that automatically removes malicious messages (including those with malicious attachments) that have already been delivered to a mailbox. Option A is wrong because Safe Links protects users from malicious URLs in messages. Option C is wrong because Anti-phishing policies protect against phishing attacks but do not automatically remove messages after delivery. Option D is wrong because Safe Attachments scans and blocks attachments at the time of delivery but does not remove messages that were already delivered.

Answer

Safe Links

Answer

Anti-phishing

Answer

Safe Attachments

Question 14

Your organization uses Microsoft Defender for Cloud Apps. You discover that a user is downloading large amounts of data from SharePoint Online to an unmanaged device. You need to automatically block the download and alert the security team. What should you configure?

Accepted Answer

Session policy. A session policy in Microsoft Defender for Cloud Apps allows real-time control of user sessions, enabling you to block downloads and send alerts to the security team. Option B is incorrect because an access policy can block access entirely but cannot specifically block downloads while allowing other activities. Option C is incorrect because a file policy monitors file activities and can trigger alerts, but it does not block downloads in real time. Option D is incorrect because an anomaly detection policy detects unusual activity but does not automatically block downloads.

Answer

Access policy

Answer

File policy

Answer

Anomaly detection policy

Question 15

Your organization uses Microsoft Defender for Identity. You need to investigate an alert indicating a suspected lateral movement using pass-the-hash from a compromised workstation. Which entity should you prioritize examining in the investigation timeline?

Accepted Answer

The compromised account. In a pass-the-hash (PtH) attack, the attacker uses the NTLM hash of a compromised account to authenticate to other systems. Microsoft Defender for Identity correlates the account's authentication events across multiple machines, so examining the compromised account in the investigation timeline reveals the full scope of lateral movement, including which workstations and servers were accessed using the stolen hash.

Answer

The source workstation

Answer

The destination server

Answer

The network segment