MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 12 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Office 365 and Microsoft Defender for Endpoint. A user receives an email with a link that leads to a malicious website. The user clicks the link, but the browser is protected by Microsoft Defender SmartScreen. However, the user is still able to download a file from the site. What should you configure to prevent this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Safe Links in Microsoft Defender for Office 365.. Safe Links in Microsoft Defender for Office 365 protects users by scanning URLs in emails and blocking malicious links at the time of click, preventing access to malicious websites. Option A is incorrect because Attack Surface Reduction rules are designed to block specific behaviors and processes, not web downloads from a browser after clicking a link. Option B is incorrect because network protection in Microsoft Defender for Endpoint blocks connections to malicious IPs or domains at the network level, but if the website is considered safe, network protection may not block the download. Option C is incorrect because Safe Attachments is designed to scan email attachments, not URLs or links. Option D is incorrect because Anti-Phishing policies primarily protect against impersonation and phishing attempts, not direct downloads from a website.

Answer

Enable Attack Surface Reduction rules.

Answer

Enable network protection in Microsoft Defender for Endpoint.

Answer

Enable Safe Attachments in Microsoft Defender for Office 365.

Answer

Configure an Anti-Phishing policy.

Question 2

You are configuring Microsoft Defender for Identity (MDI) to monitor for lateral movement attacks. Which of the following activities would MDI alert on as a potential lateral movement?

Accepted Answer

A user logging into multiple servers using a compromised account.. Microsoft Defender for Identity (MDI) can detect lateral movement when a compromised account is used to log into multiple servers, which indicates an attacker moving laterally within the network. Option B is incorrect because DCSync is a domain replication attack that targets the domain controller to extract credentials, not lateral movement. Option C is incorrect because password spray is a type of brute force attack that tries common passwords against many accounts, not lateral movement. Option D is incorrect because executing a privilege escalation tool on a workstation is a local privilege escalation attempt, not lateral movement between systems. Option E is incorrect because brute force attacks on a domain controller are authentication attacks, not lateral movement.

Answer

A user performing a DCSync attack.

Answer

A user conducting a password spray attack.

Answer

A user executing a privilege escalation tool on their workstation.

Answer

A user performing a brute force attack on a domain controller.

Question 3

Your organization uses Microsoft Defender XDR. You want to create a custom detection rule that triggers an alert when a specific process is created on multiple endpoints. Which advanced hunting table should you use?

Accepted Answer

DeviceProcessEvents. DeviceProcessEvents. This table captures process creation events, which is the required data for a detection rule on a specific process being created.

Option A (DeviceNetworkEvents) is incorrect because it logs network connections, not process creation. 
Option B (DeviceFileEvents) is incorrect because it logs file operations. 
Option C (DeviceLogonEvents) is incorrect because it logs logon events. 
Option D (DeviceRegistryEvents) is incorrect because it logs registry changes.

Answer

DeviceNetworkEvents

Answer

DeviceFileEvents

Answer

DeviceLogonEvents

Answer

DeviceRegistryEvents

Question 4

Your organization is using Microsoft Defender for Cloud Apps. You want to generate an alert when a user shares a file containing sensitive information with an external domain. You have configured a file policy with the condition: 'Inspection method: Data Classification Service' and 'Inspection type: Sensitive information type'. However, no alerts are triggered. What is the most likely reason?

Accepted Answer

The sensitive information type is not correctly configured in the data classification service.. The Data Classification Service in Microsoft Defender for Cloud Apps relies on sensitive information types defined in Microsoft Purview Compliance Portal. If the sensitive information type specified in the file policy is not correctly configured, published, or scoped to the appropriate location, the service cannot match it against file content, so no alert is triggered. Option A is incorrect because internal-only sharing would not generate an alert only when external sharing is the trigger condition, but the question states no alerts fire at all. Option B is incorrect because the policy is applied to specific cloud apps; if misapplied, alerts would not fire, but the condition mentions 'Inspection method: Data Classification Service', which is correctly configured, so the issue likely lies in the type definition. Option C is incorrect because while files over 500 MB are skipped, file size is not mentioned in the scenario, and the described configuration (sensitive information type) is the more probable cause. Option E is incorrect because if the user lacked licensing, the alert would likely still appear in logs but not enforce actions, and the policy would still attempt inspection; misconfigured types are a more common root cause.

Answer

The file is shared with an internal user only.

Answer

The policy is not applied to the specific cloud app.

Answer

The file size is too large for inspection.

Answer

The user is not licensed for Microsoft Defender for Cloud Apps.

Question 5

Your organization uses Microsoft Defender for Office 365. Users report that some phishing emails are still reaching inboxes despite the anti-phish policy being enabled. You need to reduce the number of phishing emails that bypass the filter. What should you configure?

Accepted Answer

Configure spoof intelligence in the anti-phish policy. C is correct because spoof intelligence in the anti-phish policy allows you to analyze and block messages from spoofed senders, which is a common tactic in phishing emails. Option A is incorrect because the Tenant Allow/Block List is used for allowing or blocking known senders, but it is not a dynamic filtering mechanism to reduce phishing bypass. Option B is incorrect because Safe Attachments for SharePoint, OneDrive, and Teams is designed to protect files in these locations, not to filter incoming email. Option D is incorrect because DKIM signing is an email authentication method that helps verify sender legitimacy, but it does not directly filter phishing emails.

Answer

Add the phishing domains to the Tenant Allow/Block List

Answer

Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams

Answer

Enable DKIM signing for your custom domains

Question 6

You manage a Microsoft Defender for Endpoint environment. A device onboarded to Defender for Endpoint is not reporting alerts. You run the Microsoft Defender for Endpoint client analyzer and see that the service is running. Which log should you review to troubleshoot the issue?

Accepted Answer

Microsoft Defender for Endpoint sensor logs located in %ProgramData%\Microsoft\Windows Defender Advanced Threat Protection\Datamart. The Microsoft Defender for Endpoint sensor logs contain detailed information about the sensor's communication with the cloud. Option A is wrong because Network Protection logs are for network filtering, not sensor communication. Option B is wrong because Microsoft 365 Defender portal audit logs are cloud-side and do not help with local sensor issues. Option D is wrong because Windows Event Log may not contain sensor-specific errors.

Answer

Network Protection logs in %ProgramData%\Microsoft\Windows Defender\NIS

Answer

Microsoft 365 Defender portal audit log

Answer

Windows Event Log (Applications and Services Logs/Microsoft/Windows/Defender)

Question 7

Your organization has deployed Microsoft Defender for Cloud Apps. You want to detect anomalous behavior such as impossible travel for users accessing cloud apps. You need to configure the appropriate policy. Which policy type should you create?

Accepted Answer

Activity policy. (Activity policy) is correct because activity policies in Microsoft Defender for Cloud Apps can detect anomalous behaviors such as impossible travel by analyzing user activities across various cloud apps. Option A (App discovery policy) is incorrect as it is used to identify shadow IT and unsanctioned app usage, not anomaly detection. Option C (Session policy) is incorrect because session policies control real-time access and data protection during user sessions, not anomaly detection. Option D (File policy) is incorrect because file policies focus on scanning and controlling file sharing, not user behavior anomalies.

Answer

App discovery policy

Answer

Session policy

Answer

File policy

Question 8

A user reports that they cannot access a legitimate external website because Microsoft Defender for Endpoint is blocking it. The website is required for business. What should you do to allow access while maintaining security?

Accepted Answer

Add the URL to the custom indicators allow list. Adding the URL to the custom indicators allow list permits access to the specific legitimate website while maintaining all other security protections. Option A is incorrect because excluding the device from the policy would disable all protections for that device, weakening security. Option B is incorrect because disabling network protection removes all URL filtering, not just for the required site. Option D is incorrect because adding the user to a custom group with lower security is not granular and reduces security for other sites.

Answer

Exclude the device from the policy

Answer

Disable network protection for the device

Answer

Add the user to a custom group with lower security

Question 9

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos ticket request. You need to investigate the alert. Which log should you analyze in Microsoft Defender for Identity?

Accepted Answer

Network activities. Kerberos ticket requests, such as suspicious activity, are captured as network activities within Microsoft Defender for Identity. Option A is wrong because lateral movement paths show potential attack paths, not the raw ticket data. Option B is wrong because entity profiles show user or machine details, not network-level logs. Option D is wrong because security alerts are the alerts themselves, not the underlying log data.

Answer

Lateral movement paths

Answer

Entity profile

Answer

Security alerts

Question 10

You are configuring Microsoft Defender for Office 365 anti-phish policy. You want to protect against user impersonation attacks. The CEO and CFO are frequent targets. What should you configure in the anti-phish policy?

Accepted Answer

Enable user impersonation protection and add the CEO and CFO as protected users. User impersonation protection in anti-phish policies allows you to add specific users (e.g., CEO and CFO) as protected users. This protects against attacks where an attacker impersonates those users. Option A is incorrect because spoof intelligence protects against domain spoofing, not user impersonation. Option B is incorrect because domain impersonation protects against impersonation of entire domains, not individual users. Option D is incorrect because mailbox intelligence is a feature that learns user communication patterns to detect impersonation, but it is not the configuration to protect specific users.

Answer

Configure spoof intelligence

Answer

Add the CEO and CFO's domains to domain impersonation

Answer

Enable mailbox intelligence

Question 11

Your organization uses Microsoft Defender for Cloud Apps. You discover that a user is accessing a sanctioned cloud app from an unknown IP address. You want to require multi-factor authentication (MFA) for this access. What should you configure?

Accepted Answer

Create an access policy. An access policy in Microsoft Defender for Cloud Apps can enforce conditional access controls, such as requiring multi-factor authentication (MFA), based on conditions like IP address. Option A is incorrect because file policies govern file sharing and cannot enforce MFA. Option C is incorrect because session policies monitor and control user activity in real time but do not directly enforce MFA. Option D is incorrect because app discovery policies identify shadow IT and do not control access conditions.

Answer

Create a file policy

Answer

Create a session policy

Answer

Create an app discovery policy

Question 12

You are designing an incident response plan using Microsoft Defender XDR. You want to automate the containment of compromised devices when a high-severity incident is detected. What should you configure?

Accepted Answer

Enable automated investigation and response (AIR) in Microsoft Defender XDR. C is correct because automated investigation and response (AIR) in Microsoft Defender XDR can automatically contain devices when a high-severity incident is detected. A is incorrect because custom detection rules in Microsoft Defender for Endpoint only create alerts; they do not automatically contain devices. B is incorrect because device groups are used for management and policy assignment, not for automated containment. D is incorrect because playbooks in Microsoft Sentinel require manual triggering or other automation; they are not configured within Defender XDR.

Answer

Configure custom detection rules in Microsoft Defender for Endpoint

Answer

Configure device groups in Microsoft Defender for Endpoint

Answer

Create a playbook in Microsoft Sentinel

Question 13

Which TWO actions can you perform in the Microsoft Defender XDR portal to investigate a security incident?

Accepted Answer

View the incident timeline. In the Microsoft Defender XDR portal, you can view the incident timeline (Option A) to see the sequence of events leading up to and during the incident, and you can review impacted assets (Option E) to identify affected devices and users. Option B is incorrect because advanced hunting is a separate feature for querying data, not a direct action within an incident investigation. Option C is incorrect because creating mail flow rules is done in the Exchange admin center, not in Defender XDR. Option D is incorrect because resetting user passwords is a task for Azure AD or the Microsoft 365 admin center, not directly in Defender XDR.

Answer

Run advanced hunting queries

Answer

Create mail flow rules

Answer

Reset user passwords

Question 14

Which THREE settings can you configure in a Microsoft Defender for Office 365 anti-phish policy?

Accepted Answer

Mailbox intelligence. Options A, D, and E are correct. Anti-phish policies include mailbox intelligence, user impersonation protection, and spoof intelligence. Option B (Safe Attachments) is a separate policy in Defender for Office 365, not a setting within an anti-phish policy. Option C (DKIM signing) is configured at the domain level for email authentication, not within anti-phish policies.

Answer

Safe Attachments

Answer

DKIM signing

Question 15

Which TWO components are part of Microsoft Defender XDR?

Accepted Answer

Microsoft Defender for Office 365. Options A and C are correct. Microsoft Defender XDR (Extended Detection and Response) is a unified platform that integrates Microsoft Defender for Office 365 (for email and collaboration protection) and Microsoft Defender for Endpoint (for endpoint detection and response). Option B (Microsoft Purview) is incorrect as it is a compliance and data governance solution, not part of Defender XDR. Option D (Microsoft Intune) is incorrect because it is a mobile device management (MDM) and mobile application management (MAM) service, separate from Defender XDR. Option E (Microsoft Sentinel) is incorrect as it is a cloud-native SIEM (Security Information and Event Management) solution, not a component of Defender XDR.

Answer

Microsoft Purview

Answer

Microsoft Intune

Answer

Microsoft Sentinel