MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 12 — 15 Questions

Question 1

You are a security administrator for a Microsoft 365 E5 organization. You need to configure a policy that automatically blocks execution of files that have a low reputation score in Microsoft Defender for Endpoint. Which policy type should you configure?

Accepted Answer

Attack surface reduction rule in Microsoft Defender for Endpoint. Option D is correct because Attack Surface Reduction rules can block execution of files with low reputation. Option A is wrong because it's for email. Option B is wrong because it's for device control. Option C is wrong because it's for cloud apps.

Answer

Device control policy in Microsoft Intune

Answer

Anti-malware policy in Exchange Online Protection

Answer

Cloud App Security policy in Microsoft Defender for Cloud Apps

Question 2

Your organization uses Microsoft 365 Defender. You need to ensure that when a user reports a phishing email via the Report Message add-in, the email is automatically submitted to Microsoft for analysis and the user is notified of the analysis result. What should you configure?

Accepted Answer

Configure User Reported Settings in the Microsoft 365 Defender portal. Option B is correct because the User Reported Settings in the portal allow automatic submission and notification. Option A is wrong because it only affects admin submissions. Option C is wrong because ATP is deprecated. Option D is wrong because it only allows reporting, not auto-submission.

Answer

Configure a mail flow rule to forward reported messages to Microsoft

Answer

Create a submission policy in the Microsoft 365 Defender portal

Answer

Enable Advanced Threat Protection (ATP) for SharePoint, OneDrive, and Teams

Question 3

You are investigating an incident in Microsoft 365 Defender. The incident involves a user who received a malicious link in an email and clicked it. The link led to a credential phishing page. You need to identify which user accounts might have been compromised. Which Microsoft 365 Defender feature should you use?

Accepted Answer

Investigation package. Option C is correct because the investigation package contains evidence for compromised accounts. Option A is wrong because it's for automated actions. Option B is wrong because it's for device investigation. Option D is wrong because it's for file investigation.

Answer

Live Response

Answer

File investigation

Answer

Action center

Question 4

Your organization uses Microsoft Defender for Office 365. You need to ensure that all email messages containing encrypted attachments are automatically scanned for malware before delivery. What should you configure?

Accepted Answer

Safe Attachments policy with Dynamic Delivery enabled. Option A is correct because Safe Attachments policy can be configured to scan encrypted attachments. Option B is wrong because it's for links. Option C is wrong because it's for anti-spam. Option D is wrong because it's for anti-malware.

Answer

Safe Links policy with URL scanning

Answer

Anti-malware policy

Answer

Anti-spam policy

Question 5

You are a security administrator. You need to configure a policy that automatically blocks sign-ins from anonymous IP addresses for all users in your Microsoft 365 tenant. Which policy should you configure in Microsoft Entra ID?

Accepted Answer

Conditional Access policy with sign-in risk condition. Option C is correct because Conditional Access policies can block anonymous IP sign-ins. Option A is wrong because Identity Protection detects but doesn't block. Option B is wrong because password protection doesn't control sign-in. Option D is wrong because it's for user risk.

Answer

Password protection policy

Answer

Conditional Access policy with user risk condition

Answer

Identity Protection user risk policy

Question 6

Your organization uses Microsoft Defender for Cloud Apps. You discover that a user is accessing sensitive data from an unmanaged device. You need to automatically restrict the user's access to sensitive data until the device is compliant. What should you configure?

Accepted Answer

Create a session policy that monitors and controls access to sensitive data. Option D is correct because session control can block access based on device compliance. Option A is wrong because it doesn't restrict access. Option B is wrong because it's for conditional access to apps. Option C is wrong because it's for discovery.

Answer

Create a Conditional Access App Control policy for all apps

Answer

Create an anomaly detection policy

Answer

Create an app discovery policy

Question 7

You are configuring Microsoft Defender for Identity to monitor on-premises Active Directory. You need to ensure that honeytoken accounts are configured to detect attackers attempting to use them. What is a honeytoken account?

Accepted Answer

A fake user account created to attract attackers. Option B is correct because honeytoken accounts are fake accounts used to detect attackers. Option A is wrong because they are not real. Option C is wrong because they are not service accounts. Option D is wrong because they are not disabled.

Answer

A service account used for application authentication

Answer

A disabled user account that cannot be used for sign-in

Answer

A real user account with high privileges used for monitoring

Question 8

Your organization uses Microsoft 365 Defender. You need to configure automated investigation and response (AIR) to automatically remediate high-confidence phishing emails. What should you configure?

Accepted Answer

Automated investigation and response for email. Option C is correct because AIR policies for email handle automated remediation of phishing. Option A is wrong because it's for device. Option B is wrong because it's for user accounts. Option D is wrong because it's for collaboration.

Answer

Automated investigation and response for collaboration content

Answer

Automated investigation and response for identities

Answer

Automated investigation and response for devices

Question 9

You are a security administrator. You need to configure a Microsoft Defender for Endpoint policy that prevents users from running executables from the Temp folder. Which Attack Surface Reduction (ASR) rule should you enable?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion. Option A is correct because the ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' covers Temp folder executables. Option B is wrong because it blocks credential theft. Option C is wrong because it blocks macros. Option D is wrong because it blocks process injection.

Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Answer

Block Office communication application from creating child processes

Answer

Block process injections originating from Windows executable files

Question 10

You need to configure Microsoft Defender for Office 365 to protect users from malicious links in email. Which TWO actions should you configure?

Accepted Answer

Enable URL detonation. Options B and D are correct because Safe Links scanning and URL detonation are key protections. Option A is wrong because it's for attachments. Option C is wrong because it's for anti-spam. Option E is wrong because it's for anti-malware.

Answer

Enable anti-malware engine

Answer

Enable anti-spam filtering

Answer

Enable Safe Attachments

Question 11

You are investigating an incident in Microsoft 365 Defender. The incident involves a user who received a malware attachment. Which THREE actions can you take from the incident page?

Accepted Answer

Start an automated investigation. Options A, B, and E are correct because you can isolate device, delete email, and investigate. Option C is wrong because resetting password is not in incident page. Option D is wrong because blocking URL is not directly in incident page.

Answer

Reset the user's password

Answer

Block the malicious URL globally

Question 12

Your organization uses Microsoft Defender for Identity. You need to configure honeytoken accounts. Which THREE attributes should you ensure are NOT set for honeytoken accounts?

Accepted Answer

Last logon timestamp. Options A, C, and D are correct because honeytoken accounts should not have email, group memberships, or recent logins. Option B is wrong because they should be enabled. Option E is wrong because description can be anything.

Answer

Description field

Answer

Account enabled status

Question 13

You are reviewing a Microsoft Defender for Cloud Apps file policy. The exhibit shows a policy snippet. What is the effect of this policy?

Accepted Answer

It allows Office files between 10 MB and 100 MB from the internet. Option C is correct because the policy action is 'Allow' but the name is 'BlockLargeOfficeFiles', which is misleading. Option A is wrong because it allows files. Option B is wrong because it doesn't block. Option D is wrong because it allows docx files.

Answer

It blocks all Office files from the internet

Answer

It allows all Office files from the internet regardless of size

Answer

It blocks Office files larger than 10 MB from the internet

Question 14

You are hunting for malicious activity in Microsoft 365 Defender. The exhibit shows a KQL query. What is the query searching for?

Accepted Answer

PowerShell processes with encoded command line arguments. Option B is correct because it hunts for PowerShell with encoded commands. Option A is wrong because it's not about powershell.exe from internet. Option C is wrong because it's not about standard commands. Option D is wrong because it's not about processes creating powershell.exe.

Answer

PowerShell processes with standard command line arguments

Answer

Processes that created PowerShell processes

Answer

PowerShell processes that were downloaded from the internet

Question 15

You are configuring a mail flow rule in Exchange Online. The exhibit shows a snippet. What will this rule do?

Accepted Answer

Quarantine messages sent to example.com. Option B is correct because the rule quarantines messages to example.com. Option A is wrong because it's not rejected. Option C is wrong because it's not blocked. Option D is wrong because it's only for example.com.

Answer

Reject messages sent to example.com

Answer

Block messages from example.com

Answer

Allow messages to example.com