MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 10 — 15 Questions

Question 1

You are investigating a security incident in Microsoft 365 Defender. The incident involves a user who received a phishing email that contained a link to a malicious website. The user clicked the link and entered credentials. Which THREE components of Microsoft Defender XDR would generate alerts that contribute to this incident?

Accepted Answer

Microsoft Defender for Office 365. Options A, B, and C are correct because all three detect different aspects of the attack: endpoint (malicious website access), Office 365 (phishing email), and identity (credential compromise). Option D is not directly relevant to this incident. Option E is not part of Microsoft Defender XDR; it's a SIEM.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 2

Which TWO features in Microsoft Defender for Office 365 help protect against zero-day malware in email attachments?

Accepted Answer

Safe Attachments. Options B and D are correct because Safe Attachments detonates files in a sandbox, and ZAP retroactively removes malicious messages. Option A is a security policy but does not specifically target zero-day. Option C is a macro security feature. Option E is not a feature of Office 365.

Answer

Mail flow rules

Answer

Anti-spam policies

Answer

Anti-phishing policies

Question 3

Your organization uses Microsoft Defender for Cloud Apps. You need to be alerted when a user accesses a cloud app from a risky IP address. What should you configure?

Accepted Answer

Create an anomaly detection policy with the 'Activity from risky IP address' template.. Option A is correct because an anomaly detection policy can alert on activities from risky IP addresses. Option B is wrong because session policies control real-time access. Option C is wrong because file policies monitor data. Option D is wrong because access policies control access based on conditions.

Answer

Create a session policy to monitor risky IP addresses.

Answer

Create a file policy to detect access from risky IPs.

Answer

Create an access policy to block risky IPs.

Question 4

Your organization uses Microsoft Defender for Office 365 and Microsoft Defender for Endpoint. You need to configure automatic investigation and response (AIR) to handle a phishing email that was delivered to a user's inbox and the user clicked a link that downloaded a malicious file. What should you configure?

Accepted Answer

Configure the unified automated investigation and response playbook in Microsoft Defender XDR.. Option C is correct because the unified AIR playbook in Microsoft Defender XDR coordinates automated actions across Defender for Office 365 and Defender for Endpoint, handling the email and the file in one playbook. Option A is wrong because separate playbooks do not coordinate. Option B is wrong because manual triggers are not automated. Option D is wrong because automation levels apply to individual playbooks.

Answer

Configure separate automated investigation playbooks in each workload.

Answer

Set the automation level for each playbook to 'Full – remediate automatically'.

Answer

Enable manual investigation triggers in Microsoft Defender XDR.

Question 5

Your organization deploys Microsoft Defender XDR and wants to use advanced hunting to detect lateral movement by an attacker who uses RDP from a compromised workstation to a domain controller. Which KQL query should you use in advanced hunting?

Accepted Answer

DeviceNetworkEvents | where RemotePort == 3389 and RemoteIP == '10.0.0.10' and InitiatingProcessAccountName == 'compromised_user'. Option B is correct because DeviceNetworkEvents captures network connections, and filtering for RDP (port 3389) from a compromised device to a domain controller identifies lateral movement. Option A is wrong because DeviceLogonEvents shows logons but not the network direction. Option C is wrong because DeviceProcessEvents shows processes, not network connections. Option D is wrong because IdentityLogonEvents is for cloud identities, not endpoint network events.

Answer

DeviceLogonEvents | where RemoteIP == '10.0.0.10' and LogonType == '10'

Answer

IdentityLogonEvents | where AccountUpn == 'compromised_user@contoso.com' and Application == 'Microsoft Remote Desktop'

Answer

DeviceProcessEvents | where ProcessCommandLine contains 'mstsc.exe' and AccountName == 'compromised_user'

Question 6

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that automatically alerts when a user downloads more than 100 files from SharePoint Online in 10 minutes. What type of policy should you create?

Accepted Answer

Anomaly detection policy. Option A is correct because an anomaly detection policy detects unusual download activity. Option B is wrong because an app discovery policy identifies shadow IT. Option C is wrong because an OAuth app policy governs third-party app permissions. Option D is wrong because a session policy controls real-time access, not download thresholds.

Answer

Session policy

Answer

App discovery policy

Answer

OAuth app policy

Question 7

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious LDAP query from a domain controller. After investigating, you determine the query is legitimate. How should you prevent future alerts for this activity?

Accepted Answer

Create a suppression rule for that alert type and entity.. Option C is correct because creating a suppression rule for the specific alert type and entity prevents future false positives. Option A is wrong because disabling the sensor would stop all monitoring. Option B is wrong because modifying the alert severity does not suppress the alert. Option D is wrong because creating a detection rule is for custom detections, not suppression.

Answer

Create a custom detection rule to allow the LDAP query.

Answer

Disable the Defender for Identity sensor on the domain controller.

Answer

Change the alert severity to Low.

Question 8

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to stream advanced hunting data from Defender XDR to Sentinel to run analytics rules. What should you configure?

Accepted Answer

Install the Microsoft Defender XDR data connector in Microsoft Sentinel.. Option B is correct because the Microsoft Defender XDR data connector in Sentinel streams advanced hunting data. Option A is wrong because the Diagnostic settings in Defender XDR export to Log Analytics, but the direct connector is simpler. Option C is wrong because the Microsoft 365 Defender connector is for Office 365 data. Option D is wrong because the Threat Intelligence connector ingests threat intel, not telemetry.

Answer

Configure Diagnostic settings in Microsoft Defender XDR to send logs to Log Analytics.

Answer

Use the Microsoft 365 Defender connector in Sentinel.

Answer

Configure the Threat Intelligence – TAXII connector in Sentinel.

Question 9

Your organization uses Microsoft Defender for Endpoint. You need to ensure that when a device with a high-risk vulnerability is detected, it is automatically isolated from the network. What should you configure?

Accepted Answer

Create an automation rule in Microsoft Defender XDR.. Option D is correct because an automation rule in Microsoft Defender XDR can automatically isolate a device when a vulnerability is detected. Option A is wrong because device groups control policy assignment, not automation. Option B is wrong because vulnerability management shows findings but does not automate isolation. Option C is wrong because the advanced hunting query only identifies devices, it does not trigger actions.

Answer

Run an advanced hunting query to identify high-risk devices.

Answer

Create a device group and assign a device configuration policy.

Answer

Enable vulnerability management in Microsoft Defender for Endpoint.

Question 10

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the built-in anti-phishing policy. You need to analyze the email headers to determine why it was not detected. What should you use?

Accepted Answer

Threat Explorer in Microsoft Defender for Office 365. Option B is correct because Threat Explorer allows you to search for emails and view detailed headers and detection details. Option A is wrong because the email trace tool is for transport flow, not security analysis. Option C is wrong because the Quarantine page shows quarantined items, not delivered emails. Option D is wrong because the Attack Simulator is for training, not analysis.

Answer

Attack Simulator in Microsoft Defender for Office 365

Answer

Message trace in Exchange admin center

Answer

Quarantine page in Microsoft Defender for Office 365

Question 11

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Entra ID. You need to block access to a third-party cloud app that is not sanctioned. The app uses OAuth and users have already granted consent. What should you configure?

Accepted Answer

Create an OAuth app policy in Microsoft Defender for Cloud Apps to revoke the app.. Option A is correct because an OAuth app policy in Defender for Cloud Apps can revoke permissions and block access. Option B is wrong because a Conditional Access policy can block access but does not revoke OAuth permissions. Option C is wrong because an app discovery policy only identifies apps. Option D is wrong because a session policy controls usage but does not block access after consent.

Answer

Create a Conditional Access policy in Microsoft Entra ID to block the app.

Answer

Create a session policy in Microsoft Defender for Cloud Apps.

Answer

Create an app discovery policy in Microsoft Defender for Cloud Apps.

Question 12

Your organization uses Microsoft Defender for Endpoint. You need to collect investigation packages from multiple devices for forensic analysis. What is the most efficient method?

Accepted Answer

Use the central investigations feature to collect packages from multiple devices.. Option B is correct because the central investigations feature allows you to collect packages from multiple devices in one action. Option A is wrong because the device page only handles one device. Option C is wrong because a Live Response session is manual and one device at a time. Option D is wrong because the Microsoft 365 Defender portal does not have a dedicated forensic collection tool.

Answer

Use the Microsoft 365 Defender portal's forensic collection tool.

Answer

Initiate a Live Response session on each device.

Answer

Run a manual collection from each device's page.

Question 13

Your organization uses Microsoft Defender XDR. You need to ensure that when an incident is created, it is automatically assigned to the appropriate analyst team based on the incident category. Which TWO actions should you configure? (Choose two.)

Accepted Answer

Create automation rules in Microsoft Defender XDR to assign incidents based on criteria.. A and D are correct. Automation rules can be used to assign incidents based on conditions. Custom incident fields can categorize incidents. B is wrong because not all incidents are assigned automatically. C is wrong because tags help with classification but not assignment. E is wrong because the main incident page does not automate assignment.

Answer

Use the incident page's 'Assign to' option.

Answer

Configure the default assignment rule to assign all incidents to a specific team.

Answer

Use tags to categorize incidents and then manually assign.

Question 14

Your organization uses Microsoft Defender for Cloud Apps. You need to detect and block the use of a newly discovered cloud app that is classified as 'high risk' by the Cloud App Catalog. Which THREE actions should you take? (Choose three.)

Accepted Answer

Create a session policy to block downloads or uploads for the app.. A, B, and D are correct. Sanctioning the app is required to apply policies. A session policy can block uploads/downloads. An access policy can block access. C is wrong because unsanctioning the app alone does not block it; policies must be enforced. E is wrong because the app discovery policy only identifies apps, not blocks them.

Answer

Create an app discovery policy for the app.

Answer

Unsanction the app in the Cloud App Catalog.

Question 15

Your organization uses Microsoft Defender for Office 365. You need to create a Safe Attachments policy that will block all attachments with a specific file type. Which TWO elements must you configure? (Choose two.)

Accepted Answer

Set the action to 'Block' for the file type.. A and C are correct. The 'Block' action is necessary to block the attachment. Setting the file type in the policy configuration targets the specific type. B is wrong because the redirect option is for delivering to a different location, not blocking. D is wrong because the policy applies to mailboxes, not individual users. E is wrong because the policy applies to a domain, not recipients.

Answer

Enable the redirect option to send the attachment to a security mailbox.

Answer

Specify the recipient domain in the policy condition.

Answer

Select the user or group to apply the policy to.