MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 12 — 15 Questions

Question 1

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a device makes an outbound connection to a known malicious IP address, and within 10 minutes, a process with suspicious command-line arguments is started on the same device. Which two Advanced Hunting tables must be joined using a KQL query to create this detection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DeviceNetworkEvents and DeviceProcessEvents.. The detection rule correlates an outbound network connection to a known malicious IP with a subsequent process creation on the same device within 10 minutes. This requires joining DeviceNetworkEvents (for network connections) with DeviceProcessEvents (for process creation and command-line arguments). DeviceFileEvents is not needed because the rule does not involve file events. Therefore, only Option A provides the necessary tables.

Answer

DeviceEvents and DeviceLogonEvents.

Answer

DeviceProcessEvents and DeviceFileEvents.

Answer

DeviceNetworkEvents and DeviceRegistryEvents.

Question 2

A security administrator needs to block users from running portable executable files (e.g., .exe, .scr) that were downloaded from the internet on Windows devices. Which Attack Surface Reduction (ASR) rule should the administrator enable to meet this requirement?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion. The ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) specifically targets executable files (e.g., .exe, .scr) that have been downloaded from the internet by checking their Mark-of-the-Web (MoTW) attribute. When enabled, this rule prevents execution of such files unless they meet criteria like high prevalence, sufficient age, or inclusion in a trusted list, directly addressing the requirement to block internet-downloaded portable executables.

Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Answer

Block Adobe Reader from creating child processes

Answer

Block persistence through WMI event subscription

Question 3

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a device makes an outbound connection to a known malicious IP address, and within 10 minutes, a process with suspicious command-line arguments is started on the same device. Which two Advanced Hunting tables must be joined using a KQL query to create this detection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

EmailEvents and UrlClickEvents. The rule requires detecting when a user receives a phishing email with a malicious URL and then clicks that URL within 10 minutes. Two separate joins can accomplish this:

- **EmailEvents and UrlClickEvents**: EmailEvents contains metadata about email delivery (including NetworkMessageId), and UrlClickEvents records user clicks on URLs in Microsoft Defender for Office 365 Safe Links. Joining these tables on NetworkMessageId (and optionally URL hash) allows correlating the email receipt with the click event, enabling the time-based trigger.

- **EmailUrlInfo and UrlClickEvents**: EmailUrlInfo provides details on URLs found within emails (including the URL and its verdict), and UrlClickEvents logs clicks. Joining on the URL hash (SHA256) directly correlates the email-delivered URL with the user's click, also enabling the time-based trigger.

Both pairs are valid and commonly used depending on the specific data needed. Option B (DeviceProcessEvents) is irrelevant as it deals with process execution, not email or URL clicks. Option D (EmailAttachmentInfo) pertains to attachments, not URLs.

Answer

EmailEvents and DeviceProcessEvents

Answer

EmailAttachmentInfo and UrlClickEvents

Question 4

A security administrator is configuring Microsoft Defender for Cloud Apps. The administrator needs to discover which cloud apps are being used in the organization and then block usage of unsanctioned apps in real time using a reverse proxy. Which two Defender for Cloud Apps features must be configured? (Select the two correct options.)

Accepted Answer

Cloud Discovery. Cloud Discovery is the correct feature because it identifies which cloud apps are in use by analyzing traffic logs from the organization's network. This provides the visibility needed to determine which apps are unsanctioned. Conditional Access App Control is the correct feature because it uses a reverse proxy to enforce real-time access controls, blocking unsanctioned apps at the session level.

Answer

App governance

Answer

OAuth app permissions

Question 5

A security analyst is investigating a suspected credential theft attack where an attacker attempts to dump credentials from LSASS. Which Attack Surface Reduction (ASR) rule should the administrator enable to block this activity from untrusted processes?

Accepted Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe). The ASR rule 'Block credential stealing from the Windows local security authority subsystem (lsass.exe)' (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2) is specifically designed to prevent untrusted processes from accessing LSASS memory and dumping credentials, such as with tools like Mimikatz. This directly addresses the described attack scenario of credential theft from LSASS, making it the correct choice.

Answer

Block Office applications from creating child processes

Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion

Answer

Block Adobe Reader from creating child processes

Question 6

A security administrator wants to reduce the risk of credential dumping from LSASS on managed Windows endpoints. Which Attack Surface Reduction rule should be enabled?

Accepted Answer

Block credential stealing from the Windows Local Security Authority Subsystem. The 'Block credential stealing from the Windows Local Security Authority Subsystem' ASR rule (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2) specifically prevents credential dumping from LSASS by blocking access to the process memory via common techniques like Mimikatz or direct API calls (e.g., OpenProcess, ReadProcessMemory). This directly reduces the risk of credential theft on managed Windows endpoints.

Answer

Block executable files from running unless they meet prevalence, age, or trusted list criteria

Answer

Block untrusted and unsigned processes that run from USB

Answer

Block JavaScript or VBScript from launching downloaded executable content

Question 7

A security administrator needs to discover which cloud apps are being used in the organization and then block usage of unsanctioned apps in real time using a reverse proxy. Which two Microsoft Defender for Cloud Apps features must be configured to meet these requirements? (Select all that apply.)

Accepted Answer

Cloud Discovery. Cloud Discovery (A) is correct because it analyzes traffic logs from your network to identify all cloud apps in use, providing visibility into sanctioned and unsanctioned apps. Conditional Access App Control (C) is correct because it enforces real-time access controls via a reverse proxy, allowing you to block unsanctioned apps as users attempt to access them.

Answer

App Connectors

Answer

API connectors

Question 8

A security administrator needs to block unsanctioned cloud apps in real time using a reverse proxy. Which two Microsoft Defender for Cloud Apps components must be configured?

Accepted Answer

Conditional Access App Control. Conditional Access App Control (B) is the reverse proxy component in Microsoft Defender for Cloud Apps that enforces real-time session-level monitoring and control of cloud app access. Session control policies (D) are the specific policy objects that define the actions (e.g., block download, block access) applied through that reverse proxy. Together, they enable blocking unsanctioned cloud apps in real time by intercepting user traffic via the reverse proxy architecture.

Answer

Cloud Discovery

Answer

App governance

Question 9

A security administrator wants to configure Microsoft Defender for Cloud Apps to block downloads of sensitive files from Salesforce to unmanaged devices in real time. Which Defender for Cloud Apps component must be configured?

Accepted Answer

Conditional Access App Control. Conditional Access App Control (CAAC) is the correct component because it enables real-time session-level monitoring and control of user activities in SaaS apps like Salesforce. By integrating with Microsoft Entra Conditional Access, CAAC can enforce policies to block downloads of sensitive files to unmanaged devices at the moment of access, using reverse proxy architecture to inspect and intervene in the traffic.

Answer

Cloud Discovery

Answer

App Connectors

Answer

Activity policies

Question 10

A security administrator wants to configure Microsoft Defender for Cloud Apps so that when a user accesses a sensitive file in a sanctioned cloud app from an unmanaged device, the user is blocked from downloading the file and a block action is logged in real time. Which type of policy should the administrator configure?

Accepted Answer

Create a session policy with the action 'Block' on the download action for files with a specific sensitivity label. A session policy in Microsoft Defender for Cloud Apps allows real-time control over user activities within a sanctioned cloud app. By configuring the action 'Block' on the download action for files with a specific sensitivity label, the administrator can block the download when the session is initiated from an unmanaged device, and the block action is logged in real time. This meets the requirement of blocking the download and logging the action simultaneously.

Answer

Create a file policy that monitors for sensitive files being accessed from unmanaged devices and generates an alert

Answer

Configure an access policy that blocks access to the cloud app from unmanaged devices

Answer

Configure an activity policy that monitors download activities from unmanaged devices and triggers automatic remediation

Question 11

A company is experiencing a significant number of phishing attempts that target high-level executives by impersonating their email addresses. The security team wants to configure protection against user impersonation in Microsoft Defender for Office 365. Which setting must be enabled in the anti-phishing policy to protect these specific users?

Accepted Answer

Enable users to protect against impersonation. The 'Enable users to protect against impersonation' setting in an anti-phishing policy allows you to specify a list of users (such as high-level executives) whose email identities will be monitored for impersonation attempts. When enabled, Defender for Office 365 analyzes inbound messages for display name and email address matches against the protected users, and if a match is found with a suspicious sender, the message is flagged or quarantined. This directly addresses the scenario of attackers spoofing executive email addresses.

Answer

Enable domains to protect against impersonation

Answer

Mailbox intelligence

Answer

Spoofed sender posture

Question 12

Drag and drop the steps to configure a Conditional Access policy in Microsoft Entra ID in the correct order.

Accepted Answer

1. Create a new Conditional Access policy, 2. Assign users and groups, 3. Configure conditions (cloud apps, locations, etc.), 4. Configure access controls (Grant/Block) and enable policy. Conditional Access policies are created in Entra ID, assigned to users, conditions defined, and access controls applied.

Answer

1. Configure access controls, 2. Assign users and groups, 3. Configure conditions, 4. Create a new Conditional Access policy

Answer

1. Create a new Conditional Access policy, 2. Configure conditions, 3. Assign users and groups, 4. Configure access controls and enable policy

Answer

1. Assign users and groups, 2. Create a new Conditional Access policy, 3. Configure access controls, 4. Enable policy

Question 13

Drag and drop the steps to configure a compliance retention policy in Microsoft Purview in the correct order.

Accepted Answer

Create a retention policy → Select locations → Configure retention settings → Publish the policy. Retention policies are created in Purview, locations selected, retention settings defined, and then published.

Answer

Select locations → Create a retention policy → Configure retention settings → Publish the policy

Answer

Configure retention settings → Create a retention policy → Select locations → Publish the policy

Answer

Create a retention policy → Publish the policy → Select locations → Configure retention settings

Question 14

Match each Microsoft 365 compliance feature to its purpose.

Accepted Answer

Data Loss Prevention (DLP): Prevents accidental sharing of sensitive information.. Correct matches: DLP prevents accidental sharing, eDiscovery searches for legal needs, and Sensitivity Labels classify/protect data. Common confusions include mixing DLP with retention policies and eDiscovery with automatic classification.

Answer

Data Loss Prevention (DLP): Manages data retention and deletion policies.

Answer

eDiscovery: Applies automatic classification based on content patterns.

Question 15

Match each Microsoft 365 threat scenario to the appropriate protection.

Accepted Answer

Phishing email with malicious link: Microsoft Defender for Office 365 Safe Links. Correct matches: Phishing links → Safe Links; Malware attachments → Safe Attachments; Data leaks → DLP; Ransomware → Anti-ransomware policies. Common mistakes include confusing Safe Links with Safe Attachments and DLP with Defender protections.

Answer

Phishing email with malicious link: Microsoft Defender for Office 365 Safe Attachments

Answer

Accidental data leak via email: Microsoft Defender for Office 365 Safe Links