MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 11 — 15 Questions

Question 1

You are configuring policies in Microsoft Defender for Office 365. You need to ensure that users cannot click through to a malicious website that is hosted on a newly registered domain. Which policy setting should you enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Safe Links. Safe Links (Option B) is the correct choice. Safe Links provides time-of-click protection by scanning URLs in email messages and Office documents. It can be configured to block newly registered domains, which are often used for malicious websites. Anti-phishing policies (Option A) primarily protect against phishing attempts but do not specifically block URLs from newly registered domains. Anti-spam policies (Option C) filter out spam emails, not malicious URLs. Safe Attachments (Option D) scans attachments for malware, not URLs.

Answer

Anti-phishing

Answer

Anti-spam

Answer

Safe Attachments

Question 2

You are a security administrator for a company that uses Microsoft Defender XDR. You need to configure an automated investigation and response (AIR) policy to automatically remediate threats on devices. Which two actions can be taken automatically without requiring administrator approval? (Choose two.)

Accepted Answer

Quarantine file. Options A and D are correct because 'Quarantine file' and 'Isolate device' are remediation actions that can be set to run automatically depending on the automation level. Option B 'Block URL' is a remediation action but typically requires administrator approval. Option C 'Run antivirus scan' is an investigation action, not a remediation action. Option E 'Collect investigation package' is also an investigation action.

Answer

Block URL

Answer

Run antivirus scan

Answer

Collect investigation package

Question 3

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that detects when a user shares a file containing sensitive data with an external domain. Which three components must you configure in the policy? (Choose three.)

Accepted Answer

A content inspection method (e.g., DLP). The correct components for a file policy in Microsoft Defender for Cloud Apps are: a filter to specify the scope (e.g., sharing with external users), a content inspection method (e.g., DLP) to detect sensitive data, and a governance action (e.g., alert or block). Option D is incorrect because session control actions are used in session policies, not file policies. Option E is incorrect because access token conditions are not a component of file policies.

Answer

A session control action

Answer

An access token condition

Question 4

You are a security analyst. You need to investigate a potential malware outbreak on a device using Microsoft Defender XDR. Which three data sources can you include in an advanced hunting query to gather relevant information? (Choose three.)

Accepted Answer

DeviceFileEvents. The correct answers are DeviceFileEvents, DeviceNetworkEvents, and DeviceProcessEvents. These tables are part of Microsoft Defender XDR advanced hunting and provide file, network, and process activity data essential for investigating malware. CloudAppEvents is for cloud app activities, not device-level events, and EmailAttachmentInfo is for email attachments, not direct device events. Therefore, options B, D, and E are correct.

Answer

CloudAppEvents

Answer

EmailAttachmentInfo

Question 5

Your organization uses Microsoft Defender for Office 365. Users report that legitimate emails from a specific partner domain are being moved to Junk Email folder. You verify that the partner's SPF, DKIM, and DMARC records are correctly configured. Which two actions should you take to resolve this issue?

Accepted Answer

Review the Anti-Phishing policy's spoof intelligence settings.. Legitimate emails from a partner domain are being moved to Junk Email folder despite correct SPF, DKIM, and DMARC records. This typically indicates that the emails are being misclassified as spoofed or phishing. Reviewing the Anti-Phishing policy's spoof intelligence settings (Option B) allows you to check if the partner domain is being incorrectly treated as a spoof sender and adjust the settings accordingly. Additionally, adding the partner domain to the Tenant Allow/Block List as an allowed domain (Option E) explicitly permits emails from that domain, overriding any false positive filtering. Option A (increasing spam threshold) may reduce spam filtering effectiveness and does not address the root cause. Option C (Outbound spam filter policy) affects outgoing emails, not inbound. Option D (disabling spam filter) is too aggressive and removes protection for the affected users. Therefore, the correct actions are B and E.

Answer

Modify the Anti-Spam policy to increase the spam threshold.

Answer

Configure the Outbound spam filter policy.

Answer

Disable the Spam filter for the affected users.

Question 6

You are investigating an incident in Microsoft Defender XDR where a user received a phishing email that contained a link to a malicious site. The user clicked the link but did not enter credentials. Which actions would be most effective to remediate the incident?

Accepted Answer

Use Threat Explorer to delete the phishing email from all mailboxes.. Using Threat Explorer to delete the phishing email from all mailboxes removes the threat from all recipients, preventing further exposure. Option C is correct because initiating an automated investigation on the user's device checks for post-click activity, such as malware installation or unauthorized access, which is crucial even without credential entry. Option A is incorrect because blocking the user's account from signing in is unnecessary since credentials were not compromised. Option D is incorrect because blocking the URL in the Tenant Allow/Block List only prevents future access to the malicious site but does not remove the existing email from mailboxes. Option E is incorrect because resetting the user's password is not warranted when no credentials were entered.

Answer

Block the user's account from signing in.

Answer

Block the URL in the Tenant Allow/Block List.

Answer

Reset the user's password immediately.

Question 7

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Defender for Cloud Apps. You need to configure a policy that automatically blocks downloads of sensitive files from a specific cloud app if the user's risk score is high. Which integration and policy type should you use?

Accepted Answer

Create a session policy in Microsoft Defender for Cloud Apps using Conditional Access App Control.. A session policy in Microsoft Defender for Cloud Apps with Conditional Access App Control can monitor and block downloads of sensitive files in real time based on user risk score. Option B is incorrect because Cloud Discovery is used to identify shadow IT, not to block downloads. Option C is incorrect because attack surface reduction rules in MDE focus on device-level behaviors, not cloud app downloads. Option D is incorrect because a Conditional Access policy in Microsoft Entra ID controls access at the app or session level but does not block specific file downloads. Option E is incorrect because device compliance policies in Intune manage device settings, not cloud app download behavior.

Answer

Use the Cloud Discovery dashboard to block the app.

Answer

Create an attack surface reduction rule in MDE.

Answer

Create a Conditional Access policy in Microsoft Entra ID to block access to the app.

Answer

Create a device compliance policy in Microsoft Intune.

Question 8

A user reports that they are unable to access a file in SharePoint Online. You check the audit log and see that the file was quarantined by Microsoft Defender for Office 365. What is the most likely reason?

Accepted Answer

The file was detected as malware by Safe Attachments.. Microsoft Defender for Office 365 uses Safe Attachments to detect and quarantine malicious files in SharePoint Online. Option A is wrong because overwriting by a previous version does not trigger quarantine. Option C is wrong because retention policies move files to Preservation Hold library, not quarantine. Option D is wrong because sensitivity labels classify files but do not quarantine them. Option E is wrong because DLP policies block sharing or apply protections, but do not quarantine files.

Answer

The file was overwritten by a previous version.

Answer

The file has a retention policy that moved it to the Preservation Hold library.

Answer

The file was labeled as highly confidential by Microsoft Purview Information Protection.

Answer

The file contains sensitive information and triggered a Data Loss Prevention (DLP) policy.

Question 9

You are a security administrator. You need to investigate a suspicious logon from an anonymous IP address. Which Microsoft Defender XDR data source should you query first?

Accepted Answer

Identity and authentication events. Identity and authentication events are the primary data source in Microsoft Defender XDR for investigating suspicious logons. These events include details such as source IP addresses, logon types, success/failure status, and user accounts involved. Option B (Cloud app events) focuses on activities in cloud applications, not authentication logs. Option C (Endpoint device events) deals with device-level behaviors like process creation, not logons. Option D (Vulnerability and compliance events) tracks software vulnerabilities and compliance posture, unrelated to authentication. Option E (Email & collaboration events) is designed for phishing and malware in email, not logon investigation.

Answer

Cloud app events

Answer

Endpoint device events

Answer

Vulnerability and compliance events

Answer

Email & collaboration events

Question 10

Your organization uses Microsoft Defender for Identity (MDI) and Microsoft Defender for Cloud Apps. You receive an alert about a user who is performing an unusual number of failed logon attempts from a non-corporate IP address. The user is a member of the Finance group. What is the recommended first step?

Accepted Answer

Contact the user to verify if the activity is legitimate.. When an alert indicates unusual failed logon attempts from a non-corporate IP address, the recommended first step is to contact the user to verify if the activity is legitimate. This follows the principle of verification before action, as the activity could be due to a forgotten password or a misconfigured application. Option B is correct. Option A (resetting password and requiring MFA) is premature without verification, as it may disrupt legitimate access. Option C (disabling the account) could be too disruptive and should only be done after confirming malicious intent. Option D (blocking the IP) might block legitimate users or shared IPs. Option E (closing as false positive) skips investigation and could miss a real threat.

Answer

Reset the user's password and require MFA.

Answer

Disable the user account immediately.

Answer

Block the IP address in the firewall.

Answer

Close the alert as a false positive.

Question 11

Your organization has Microsoft Defender for Office 365 Plan 2. You want to set up a policy that automatically moves messages containing malware to quarantine and notifies the security team. Which policy should you configure?

Accepted Answer

Safe Attachments policy. Safe Attachments policy is specifically designed to handle email attachments with malware and can automatically quarantine messages and notify the security team. Option A (DKIM) is wrong because DKIM is an email authentication method, not a malware quarantine policy. Option B (DMARC) is wrong because DMARC is also an email authentication policy. Option C (Anti-Spam) is wrong because it handles spam and bulk mail, not malware. Option D (Anti-Phishing) is wrong because it deals with phishing attempts, not malware in attachments.

Answer

DKIM policy

Answer

DMARC policy

Answer

Anti-Spam policy

Answer

Anti-Phishing policy

Question 12

You are configuring Microsoft Defender for Cloud Apps to detect anomalous behavior. You need to set up a policy that triggers an alert when a user downloads more than 100 files from SharePoint Online in 10 minutes. Which policy template should you use?

Accepted Answer

Activity from anonymous IP addresses. The 'Activity from anonymous IP addresses' template alerts when a user performs actions from an anonymous IP address, which can indicate a compromised account attempting to exfiltrate data by downloading many files. Option B (Impossible travel) detects logins from geographically improbable locations, not download volume. Option C (Malware detection) is for identifying malicious files. Option D (Ransomware detection) is for ransomware behaviors. Option E (Unusual file sharing by user) focuses on external sharing, not downloads.

Answer

Impossible travel

Answer

Malware detection

Answer

Ransomware detection

Answer

Unusual file sharing by user

Question 13

You run the KQL query in Microsoft Defender XDR. The query returns a list of users who logged into Exchange Online more than 10 times in the last day from a single IP address. However, you notice that some IP addresses are internal corporate IPs. What should you add to the query to focus on suspicious logons from external IPs?

Accepted Answer

Add a line: | where IPAddress !startswith "10.". To focus on external IPs, the query should exclude all RFC 1918 private IPv4 addresses. In KQL, this is better done with `| where not(ipv4_is_private(IPAddress))`. The provided option A only removes 10.x addresses and would still include internal IPs from other private ranges, so it does not fully meet the requirement. The other options (B, C, D, E) do not filter internal IPs at all. Therefore, none of the options is a fully correct answer.

Answer

Add a line: | where Application == "Outlook Web App"

Answer

Add a line: | summarize by Application

Answer

Add a line: | where TotalLogons > 50

Answer

Add a line: | sort by TotalLogons desc

Question 14

You are reviewing a Conditional Access policy in Microsoft Entra ID. The policy is intended to block access to Exchange Online for users with high risk level. However, users with high risk are still able to access Exchange Online. What is the most likely cause?

Accepted Answer

The policy is set to report-only mode.. Report-only mode evaluates the policy but does not enforce it, so high-risk users are not blocked. Option D is correct because the policy is likely set to report-only mode. Option A is wrong because the policy includes Exchange Online. Option B is wrong because the policy does not exclude the affected users. Option C is wrong because the policy targets high risk, not low risk. Option E is wrong because the grant control is block, not require MFA.

Answer

The policy does not include Exchange Online.

Answer

The policy excludes the affected users.

Answer

The policy is targeting low risk instead of high risk.

Answer

The grant control is set to require multi-factor authentication.

Question 15

You are configuring a network security policy in Microsoft Defender for Cloud Apps. The exhibit shows a policy to block traffic from known Tor exit nodes. However, the policy is not blocking traffic from IP 185.220.101.5. What is the most likely reason?

Accepted Answer

Another policy with a higher priority is allowing the traffic.. Microsoft Defender for Cloud Apps evaluates policies in priority order. If another policy with a higher priority (lower number) is configured to allow traffic from this IP or subnet, it will override the block policy. This is the most likely reason why traffic from IP 185.220.101.5 is not being blocked despite a policy targeting Tor exit nodes. Option A is wrong because the action is set to 'Block', not 'Alert only'. Option B is wrong because the IP address falls within the specified Tor exit node subnet. Option C is wrong because the protocol condition is set to 'Any', so it is not restrictive. Option D is wrong because the source address condition does not require a wildcard; it matches the specific subnet.

Answer

The action is set to Alert only, not block.

Answer

The IP address is not in the specified subnet.

Answer

The protocol condition is too restrictive.

Answer

The source address condition is missing a wildcard.