MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 11 — 15 Questions

Question 1

A company uses Microsoft Defender for Office 365. Users report that phishing emails with malicious links are occasionally delivered to their inboxes. The security team wants to ensure that suspicious URLs are detonated in a sandbox before delivery for all recipients. What should the security team configure?

Accepted Answer

Configure a Safe Links policy with 'Use Safe Attachments to scan content' enabled.. Safe Links for email messages scans URLs at time of click, but to detonate before delivery, you need to enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams, or use a policy that triggers sandbox analysis. However, to detonate URLs before delivery, you need to configure a Safe Links policy with 'Do not track user clicks' and 'Do not allow users to click through to original URL' and ensure 'Scan URLs in email messages' is enabled and 'Use Safe Attachments to scan content' is selected. Actually, the correct answer is to enable 'Use Safe Attachments to scan content' in a Safe Links policy, which triggers sandbox detonation of URLs in email. Option C is correct because Safe Links with sandbox detonation (Safe Attachments scanning) is the recommended approach. Option A is wrong because Safe Attachments for email scans attachments, not URLs. Option B is wrong because that policy does not detonate URLs. Option D is wrong because it only scans at click time.

Answer

Enable the 'Block URLs' option in the anti-phishing policy.

Answer

Configure a Safe Attachments policy for email messages.

Answer

Enable 'Safe Links for Microsoft Teams' in the global settings.

Question 2

Contoso uses Microsoft Defender XDR and has a Microsoft 365 E5 license. The security team wants to automate incident response when a user is compromised. They create a custom automation rule in the Microsoft 365 Defender portal. The rule should automatically isolate the user's device, disable the user account, and reset the user's password. Which action type should they configure in the rule?

Accepted Answer

Create a playbook that performs all three actions and run it as the automation rule action.. In Microsoft Defender XDR automation rules, you can define actions that trigger playbooks. To perform multiple actions like isolate device, disable account, and reset password, you need to use Microsoft Sentinel playbooks (or Logic Apps) because Defender XDR automation rules only support a single action per trigger. However, with a custom playbook, you can combine multiple steps. Option B is correct because a playbook can include multiple actions. Option A is wrong because an automation rule only supports one action. Option C is wrong because incident actions are limited. Option D is wrong because a webhook would require external orchestration.

Answer

Select 'Isolate device' as the incident action.

Answer

Configure a webhook to call an external API that performs the actions.

Answer

Use the 'Run script' action and provide a PowerShell script.

Question 3

A company wants to receive alerts when a user account is used from an unauthorized location. They have Microsoft Defender for Cloud Apps (MDA). Which policy type should they create?

Accepted Answer

Create an anomaly detection policy.. Anomaly detection policies in MDA detect user behavior anomalies such as impossible travel. Option A is correct. Option B is wrong because session policies control real-time access. Option C is wrong because file policies monitor file sharing. Option D is wrong because app permissions policies manage OAuth apps.

Answer

Create a session policy.

Answer

Create an app permissions policy.

Answer

Create a file policy.

Question 4

Which TWO actions can be performed by Microsoft Defender for Identity? (Select TWO.)

Accepted Answer

Monitor domain controller activities and behavior.. Defender for Identity identifies compromised accounts and lateral movement paths. Option A (identify lateral movement) and Option D (monitor domain controller activities) are correct. Option B is wrong because Defender for Identity does not block sign-ins; that is done by Conditional Access. Option C is wrong because it does not scan files. Option E is wrong because it does not manage endpoints.

Answer

Manage firewall rules on endpoints.

Answer

Scan files for malware in real time.

Answer

Block sign-in attempts from malicious IP addresses.

Question 5

Which THREE features are part of Microsoft Defender XDR? (Select THREE.)

Accepted Answer

Microsoft Defender for Endpoint. Defender XDR integrates signals from Microsoft 365 Defender, Defender for Endpoint, Defender for Identity, Defender for Cloud Apps, and Defender for Office 365. Options A, B, and C are correct. Option D is wrong because Microsoft Sentinel is a separate SIEM. Option E is wrong because Microsoft Purview is a separate compliance solution.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Question 6

A company experiences a ransomware attack that encrypts files on several endpoints. The security team wants to use automated investigation and response (AIR) capabilities in Microsoft Defender XDR to contain the threat. Which TWO actions can be taken automatically by AIR? (Select TWO.)

Accepted Answer

Remove malicious files detected by Defender for Endpoint.. AIR in Defender XDR can automatically isolate devices and remove malicious files. Option A and Option D are correct. Option B is wrong because disabling user accounts is not automatic; it requires a playbook. Option C is wrong because password reset is not automatic. Option E is wrong because blocking email domains is not automatic.

Answer

Block the sender's email domain in Defender for Office 365.

Answer

Disable user accounts associated with the attack.

Answer

Reset user passwords for affected accounts.

Question 7

An administrator deployed the above Intune device configuration policy for Microsoft Defender for Endpoint on Windows 10 devices. Users report that some potentially unwanted applications (PUA) are still being installed. What is the most likely cause?

Accepted Answer

The PUAProtection setting is in AuditMode and not blocking PUAs.. The PUAProtection is set to 'AuditMode', which only logs PUA events but does not block them. To block PUAs, the setting should be 'Enabled' or 'Block'. Option A is correct. Option B is wrong because cloud-delivered protection is enabled. Option C is wrong because real-time monitoring is enabled. Option D is wrong because cloud timeout is not related to PUA detection.

Answer

The cloud timeout value is too low, causing PUA detection to fail.

Answer

Cloud-delivered protection is set to High level, which does not affect PUAs.

Answer

Real-time monitoring is disabled.

Question 8

A security analyst runs the above KQL query in Microsoft 365 Defender. The query returns an empty result set. Which is the most likely reason?

Accepted Answer

No antivirus detection events for files with 'ransomware' or 'encrypt' in the filename occurred in the last 7 days.. The query uses 'has_any' to match filenames containing 'ransomware' or 'encrypt'. If no detections match those strings, the result is empty. Option B is correct. Option A is wrong because the query uses the correct table. Option C is wrong because the syntax is valid. Option D is wrong because the time range is 7 days, which is typical.

Answer

The time range is too wide and the query times out.

Answer

The 'has_any' operator is used incorrectly; it should be 'contains' for each condition.

Answer

The DeviceEvents table does not contain antivirus detection events.

Question 9

A tenant administrator runs the above PowerShell command to create a Conditional Access policy. Users on iOS and Android devices report that they are still prompted for MFA, but the policy is intended to exclude those platforms. What is the issue?

Accepted Answer

The ExcludePlatforms parameter is placed incorrectly in the JSON body; it should be under conditions.platforms.excludePlatforms.. The 'ExcludePlatforms' property is used to exclude platforms from the policy. However, in the New-MgIdentityConditionalAccessPolicy cmdlet, the parameter for excluding platforms is 'ExcludePlatforms' but the correct property name in the body should be 'conditions' > 'platforms' > 'excludePlatforms'. The exhibit's structure is incorrect; the 'ExcludePlatforms' at the top level is ignored. Therefore, the policy applies to all platforms, including iOS and Android. Option A is correct. Option B is wrong because the policy is successfully created. Option C is wrong because MFA is enforced as intended for other platforms. Option D is wrong because the policy does apply.

Answer

The policy does not apply to iOS and Android because they are not listed in IncludeApplications.

Answer

The policy creation failed due to invalid syntax.

Answer

The policy requires MFA for all apps, overriding the platform exclusion.

Question 10

A security administrator wants to review email messages that were blocked due to a malware detection in Microsoft Defender for Office 365. Which report should they use?

Accepted Answer

Threat Protection Status report. The Threat Protection Status report shows malware detections in email. Option A is correct. Option B is wrong because the Mailflow report shows message routing. Option C is wrong because the Submission report shows user-reported messages. Option D is wrong because the Spoof Intelligence report shows spoofed senders.

Answer

Submissions report

Answer

Spoof intelligence report

Answer

Mailflow map report

Question 11

A company uses Microsoft Defender for Cloud Apps to monitor cloud app usage. They want to receive alerts when a user downloads a large number of files from SharePoint Online in a short time, which could indicate data exfiltration. What should they configure?

Accepted Answer

Activity policy. An activity policy can detect anomalous activities like mass download. Option B is correct. Option A is wrong because anomaly detection is for user behavior like impossible travel. Option C is wrong because file policies monitor sharing. Option D is wrong because a session policy controls access.

Answer

Session policy

Answer

Anomaly detection policy

Answer

File policy

Question 12

An organization uses Microsoft Defender for Endpoint and wants to allow only certain applications to run on managed devices. They create a custom indicator (IoA) to allow a specific application by its certificate thumbprint. However, after deployment, the application is still blocked by default Windows Defender Application Control (WDAC) policy. What is the most likely reason?

Accepted Answer

The WDAC policy is in enforce mode and does not trust the indicator.. Custom indicators for allow are prioritized over WDAC only if the WDAC policy trusts the indicator. However, by default, WDAC does not automatically trust Defender for Endpoint indicators; you must configure WDAC to allow indicators or use a WDAC policy that is in audit mode. Option D is correct. Option A is wrong because indicators do work with WDAC. Option B is wrong because certificate thumbprint is a valid indicator. Option C is wrong because the indicator does not expire quickly.

Answer

The indicator is not yet active due to propagation delay.

Answer

The certificate thumbprint is incorrect.

Answer

Custom indicators cannot override WDAC policies.

Question 13

A company wants to use Microsoft Defender XDR to automatically investigate and remediate threats across email, endpoints, and identities. Which role is required to configure automation settings in the Microsoft 365 Defender portal?

Accepted Answer

Security Administrator. The Security Administrator role can manage automation settings. Option A is correct. Option B is wrong because Global Reader is read-only. Option C is wrong because Security Reader is read-only. Option D is wrong because Compliance Administrator is for compliance.

Answer

Global Reader

Answer

Compliance Administrator

Answer

Security Reader

Question 14

A company uses Microsoft Defender for Office 365. They want to ensure that users cannot ignore warning messages when clicking on a malicious link in an email. What should they configure?

Accepted Answer

Configure a Safe Links policy with 'Do not allow users to click through to original URL' selected.. Safe Links policies allow you to prevent users from clicking through to the original URL. Option C is correct. Option A is wrong because Safe Attachments is for attachments. Option B is wrong because anti-phishing policies do not control link click behavior. Option D is wrong because ATP anti-malware is for malware.

Answer

Configure the anti-phishing policy with 'Impersonation protection' enabled.

Answer

Enable the 'Anti-malware' policy with 'Common attachments filter'.

Answer

Configure a Safe Attachments policy with 'Block' action.

Question 15

Contoso has a hybrid identity environment with Microsoft Defender for Identity deployed. They suspect a compromised account is being used to perform reconnaissance against domain controllers. Which Defender for Identity alert type would most likely trigger?

Accepted Answer

Suspicious service creation. Reconnaissance attacks are often detected by 'Suspicious service creation' or 'Directory services enumeration'. Option A is correct. Option B is wrong because Golden Ticket is for persistence. Option C is wrong because DCSync is for credential dumping. Option D is wrong because Brute Force is for password attacks.

Answer

Brute Force attack

Answer

DCSync attack

Answer

Golden Ticket activity