MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 13 — 15 Questions

Question 1

Your organization uses Microsoft 365 E5 and has Microsoft Defender for Office 365 enabled. Users report that legitimate external emails are being quarantined as phishing attempts. You need to reduce false positives while maintaining security. What should you do?

Accepted Answer

Configure user-reported message settings in Microsoft Defender for Office 365. Option C is correct because configuring user-reported phishing settings allows users to report false positives, which feeds into Microsoft's machine learning and reduces future false positives. Option A is wrong because allowing all external emails bypasses security. Option B is wrong because disabling phishing detection removes protection. Option D is wrong because increasing spam confidence threshold may not address phishing false positives specifically.

Answer

Create a transport rule to allow all emails from external domains

Answer

Disable the anti-phishing policy

Answer

Increase the Spam Confidence Level (SCL) threshold for incoming mail

Question 2

Your company has deployed Microsoft Defender for Endpoint on all Windows devices. You are investigating an alert for a suspicious PowerShell command that was blocked by Attack Surface Reduction (ASR) rules. The alert shows the command was executed from a script embedded in a Word document. You need to identify the ASR rule that blocked this activity. Which rule is most likely responsible?

Accepted Answer

Block Office applications from creating child processes. Option B is correct because the ASR rule 'Block Office applications from creating child processes' specifically prevents Office apps like Word from launching child processes such as PowerShell. Option A is wrong because that rule blocks macros from making Win32 API calls, not launching processes. Option C is wrong because that rule blocks Office apps from injecting code into other processes. Option D is wrong because that rule blocks Office apps from executable content creation.

Answer

Block Office applications from making Win32 API calls

Answer

Block Office applications from injecting code into other processes

Answer

Block Office applications from creating executable content

Question 3

Your organization uses Microsoft Defender XDR. You need to configure automated investigation and response (AIR) for email and collaboration content. Which policy type should you configure in the Microsoft 365 Defender portal?

Accepted Answer

Automated investigation and response. Option A is correct because AIR for email is configured via the 'Automated investigation and response' policy within Email & collaboration policies. Option B is wrong because attack simulation training is for phishing simulations. Option C is wrong because quarantine policies manage quarantined messages. Option D is wrong because safe attachments policies are part of anti-malware settings.

Answer

Attack simulation training

Answer

Safe attachments policies

Answer

Quarantine policies

Question 4

Your organization uses Microsoft Defender for Identity (MDI) and Microsoft Defender for Cloud Apps. You receive an alert about a user account that is exhibiting suspicious behavior: unusual login times from an IP address that is not in the user's typical location. The alert recommends action. You need to determine if the account is compromised. What is the best next step?

Accepted Answer

Initiate an automated investigation in Microsoft Defender XDR. Option B is correct because initiating an automated investigation in Microsoft Defender XDR will correlate signals across MDI, Defender for Cloud Apps, and other Microsoft 365 services to determine if the account is compromised. Option A is wrong because disabling the account immediately might be premature and could disrupt legitimate access. Option C is wrong because resetting password alone without investigation may not detect other malicious activity. Option D is wrong because configuring an access policy in Microsoft Entra ID is a longer-term fix, not immediate investigation.

Answer

Configure a conditional access policy in Microsoft Entra ID to block the IP

Answer

Immediately disable the user account

Answer

Reset the user's password

Question 5

Your organization has Microsoft Defender for Endpoint deployed. You are investigating a potential ransomware incident. The device timeline shows a series of events: a user downloaded a malicious attachment from an email, which then executed a script that encrypted files and attempted to propagate to other devices via SMB. You need to configure a custom detection rule to alert on similar behavior in the future. Which KQL query should you use as a basis?

Accepted Answer

DeviceProcessEvents | join DeviceNetworkEvents on DeviceId. Option A is correct because DeviceProcessEvents can capture process creation events (script execution) and DeviceNetworkEvents can capture SMB outbound connections, allowing correlation of initial script execution with later network propagation. Option B is wrong because DeviceFileEvents captures file modifications but not process or network events. Option C is wrong because DeviceRegistryEvents captures registry changes. Option D is wrong because DeviceLogonEvents captures logon activity.

Answer

DeviceFileEvents | where FileName endswith '.encrypted'

Answer

DeviceLogonEvents | where LogonType == 3

Answer

DeviceRegistryEvents | where RegistryKey contains 'Run'

Question 6

Your organization uses Microsoft Defender XDR. You need to configure a policy that automatically blocks high-risk user activities in Microsoft Defender for Cloud Apps. Which feature should you configure?

Accepted Answer

Session policy. Option A is correct because session policies in Defender for Cloud Apps allow real-time control over user sessions, enabling blocking of risky activities. Option B is wrong because access policies control access based on conditions, but not real-time activity blocking. Option C is wrong because app governance policies focus on app permissions. Option D is wrong because anomaly detection policies generate alerts but do not automatically block.

Answer

App governance policy

Answer

Access policy

Answer

Anomaly detection policy

Question 7

Your organization uses Microsoft Defender for Office 365. You receive a report that users are receiving spoofed email messages that appear to come from your own domain. The spoofed messages are not being filtered. You need to ensure that spoofed messages from your domain are blocked. What should you do?

Accepted Answer

Configure spoof intelligence settings to block the spoofed domain. Option B is correct because spoof intelligence in Microsoft Defender for Office 365 allows you to block spoofed messages from your own domain. Option A is wrong because DKIM signing is important but does not block spoofed messages by itself. Option C is wrong because DMARC policy can help but spoof intelligence is more direct. Option D is wrong because adding domain to allowed list would actually allow spoofing.

Answer

Add your domain to the allowed domains list in the anti-spam policy

Answer

Configure DKIM signing for your domain

Answer

Configure DMARC policy to reject messages that fail SPF or DKIM

Question 8

Your organization uses Microsoft Defender for Endpoint and Microsoft Defender for Identity. A user reports that their account was used to send a large volume of email messages to internal recipients, which appears to be a potential account compromise. You need to determine if the account is compromised and if any lateral movement occurred. Which data sources should you analyze in Microsoft Defender XDR?

Accepted Answer

IdentityLogonEvents, EmailEvents, and DeviceProcessEvents. Option C is correct because analyzing IdentityLogonEvents (from MDI) and EmailEvents (from MDO) together can correlate the logon activity with email sending, while DeviceProcessEvents can detect lateral movement. Option A is wrong because DeviceEvents are not as useful for email context. Option B is wrong because EmailEvents alone cannot detect lateral movement. Option D is wrong because DeviceNetworkEvents alone may miss identity context.

Answer

EmailEvents and EmailAttachmentInfo

Answer

DeviceNetworkEvents and DeviceProcessEvents

Answer

DeviceEvents and DeviceNetworkEvents

Question 9

Your organization uses Microsoft Defender XDR. You need to configure automatic attack disruption for SaaS applications. Which Microsoft 365 security solution provides this capability?

Accepted Answer

Microsoft Defender for Cloud Apps. Option A is correct because automatic attack disruption is a feature of Microsoft Defender for Cloud Apps that can stop attacks in SaaS applications. Option B is wrong because Microsoft Defender for Endpoint focuses on endpoints. Option C is wrong because Microsoft Defender for Office 365 focuses on email and collaboration. Option D is wrong because Microsoft Defender for Identity focuses on on-premises Active Directory.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Endpoint

Question 10

Your organization uses Microsoft Defender XDR. You are configuring a custom detection rule to detect a specific behavior: a user runs a PowerShell script that connects to a known malicious IP address. Which TWO advanced hunting tables should you use in your KQL query to detect this behavior?

Accepted Answer

DeviceProcessEvents. Option A (DeviceProcessEvents) captures PowerShell process creation. Option D (DeviceNetworkEvents) captures network connections to IP addresses. Together they can correlate the script execution with the connection. Option B is wrong because DeviceFileEvents captures file events not processes. Option C is wrong because DeviceRegistryEvents captures registry changes. Option E is wrong because DeviceLogonEvents captures logon events.

Answer

DeviceRegistryEvents

Answer

DeviceLogonEvents

Answer

DeviceFileEvents

Question 11

Your organization has Microsoft Defender for Endpoint deployed on all devices. You are investigating an incident where a user received a phishing email containing a link that led to a drive-by download. The download executed a script that attempted to modify registry run keys for persistence. Which THREE advanced hunting tables should you use to investigate this attack chain?

Accepted Answer

EmailEvents. Option A (EmailEvents) captures the phishing email. Option C (DeviceProcessEvents) captures the script execution. Option E (DeviceRegistryEvents) captures the registry modification. Option B is wrong because DeviceNetworkEvents might be used but not as directly relevant for the described chain. Option D is wrong because DeviceFileEvents could capture the download, but the chain is better captured by email, process, and registry.

Answer

DeviceFileEvents

Answer

DeviceNetworkEvents

Question 12

Your organization uses Microsoft Defender XDR. You need to configure automated actions for high-confidence phishing emails. Which TWO actions can be automatically taken by Microsoft Defender for Office 365?

Accepted Answer

Soft delete the email from the user's mailbox. Option A (Move to quarantine) and Option C (Soft delete) are automated actions that can be configured for phishing emails. Option B (Delete from the user's mailbox permanently) is not a direct automated action; soft delete is used. Option D (Forward to the security team) is not an automated action. Option E (Add a header to the email) is not a typical automated action for phishing.

Answer

Add a header to the email indicating it is phishing

Answer

Permanently delete the email from the user's mailbox

Answer

Forward the email to the security team

Question 13

You run the KQL query shown in the exhibit in Microsoft Defender XDR advanced hunting. What is the primary purpose of this query?

Accepted Answer

Detect potentially malicious PowerShell commands that are obfuscated. Option B is correct because the query filters for powershell.exe processes with an encoded command, which is commonly used to obfuscate malicious commands. Option A is wrong because the query does not filter for specific users. Option C is wrong because the query does not filter by device. Option D is wrong because the query does not filter by time other than the last 7 days.

Answer

Identify all PowerShell activity from a specific user

Answer

Find PowerShell processes running on a specific device

Answer

List all PowerShell executions in the last 7 days

Question 14

You are reviewing a conditional access policy in Microsoft Entra ID as shown in the exhibit. The policy is intended to block sign-ins that are considered risky. However, some high-risk users are still able to sign in. What is the most likely reason?

Accepted Answer

The policy requires both user risk and sign-in risk to be at specified levels simultaneously. Option A is correct because the policy only blocks when both user risk is high AND sign-in risk is medium or high. If user risk is high but sign-in risk is low, the policy does not apply. Option B is wrong because the policy does not require both risk levels to be high; it requires user risk high and sign-in risk medium or high. Option C is wrong because the policy includes sign-in risk levels medium and high. Option D is wrong because the policy does not require multi-factor authentication.

Answer

The policy requires user risk and sign-in risk to both be high

Answer

The policy requires multi-factor authentication instead of blocking

Answer

The policy does not include sign-in risk levels

Question 15

You create a custom detection rule in Microsoft Defender XDR using the KQL query shown in the exhibit. The rule is intended to detect lateral movement via SMB. After deploying the rule, you notice that it generates many false positives from legitimate administrative activity. What is the most effective way to reduce false positives?

Accepted Answer

Add a filter to exclude specific administrative accounts or IP ranges. Option D is correct because adding a filter to exclude known administrative accounts or devices can reduce false positives. Option A is wrong because increasing the time window would include more events, potentially increasing false positives. Option B is wrong because removing the join would eliminate the correlation between SMB connections and PowerShell, which is key to detecting lateral movement. Option C is wrong because focusing only on inbound connections may miss the lateral movement scenario.

Answer

Filter for only inbound SMB connections

Answer

Remove the join with DeviceProcessEvents

Answer

Increase the time window of the query