MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 14 — 15 Questions

Question 1

You are a security administrator for a company that uses Microsoft Defender XDR. You need to configure a policy to automatically remediate high-severity incidents involving ransomware on Windows 10 devices. The solution must minimize manual intervention. Which automation level should you configure in the automated investigation and response (AIR) capabilities?

Accepted Answer

Automatically remediate threats. Option C is correct because 'Automatically remediate threats' is the highest automation level that allows Defender XDR to take automatic remediation actions without human approval, which matches the requirement to minimize manual intervention. Option A is wrong because 'Full - automatically remediate threats' is the same as option C; note that the correct term is 'Automatically remediate threats' or 'Full automation' depending on the UI. Option B is wrong because 'Semi - require approval for any remediation' requires manual approval, which does not minimize manual intervention. Option D is wrong because 'No automated response' disables automation entirely.

Answer

Full - automatically remediate threats

Answer

Semi - require approval for any remediation

Answer

No automated response

Question 2

Your organization uses Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps. You discover that a user's credentials were compromised and used to access sensitive data in SharePoint Online from an unusual location. You need to automatically suspend the user and prevent further access to cloud apps. What should you configure?

Accepted Answer

A session policy in Defender for Cloud Apps. Option D is correct because Microsoft Defender for Cloud Apps offers session policies that can be set to block access or suspend users based on risk. Specifically, you can create a policy to automatically suspend the user when anomalous activity is detected. Option A is wrong because Safe Attachments is for email attachments. Option B is wrong because anti-phishing policies are for email. Option C is wrong because Safe Links is for URL protection in email and Office documents.

Answer

An anti-phishing policy in Defender for Office 365

Answer

A Safe Attachments policy in Defender for Office 365

Answer

A Safe Links policy in Defender for Office 365

Question 3

Your company uses Microsoft Defender XDR. You need to review the list of incidents that were investigated automatically by the system. Where should you navigate in the Microsoft Defender portal?

Accepted Answer

Incidents & alerts > Incidents. Option A is correct because the Incidents & alerts section in the Microsoft Defender portal lists all incidents, including those investigated automatically. Option B is wrong because Action center shows pending and completed remediation actions, not incidents. Option C is wrong because Hunting is for proactive threat hunting using KQL. Option D is wrong because Reports provides summary reports, not incident details.

Answer

Hunting

Answer

Action center

Answer

Reports

Question 4

You are a security analyst. You need to create a custom detection rule in Microsoft Defender XDR that triggers an alert when a user account is created and then added to a privileged role within 24 hours. Which advanced hunting table should you primarily use?

Accepted Answer

IdentityLogonEvents. Option B is correct because the IdentityLogonEvents table captures identity events including user account creation and role changes. Option A is wrong because DeviceEvents focuses on device-level events. Option C is wrong because EmailEvents is for email events. Option D is wrong because CloudAppEvents is for cloud app events, not identity events in Defender for Identity.

Answer

EmailEvents

Answer

DeviceEvents

Answer

CloudAppEvents

Question 5

Your organization has Microsoft Defender for Cloud Apps deployed. You need to be alerted when a user performs more than 50 failed login attempts in an hour from a non-corporate IP address. Which type of policy should you create?

Accepted Answer

Anomaly detection policy. Option C is correct because an anomaly detection policy in Defender for Cloud Apps can detect unusual login patterns, such as multiple failed attempts. Option A is wrong because a session policy controls access in real-time, not detection. Option B is wrong because an access policy enforces conditional access. Option D is wrong because a file policy monitors file activities.

Answer

Session policy

Answer

File policy

Answer

Access policy

Question 6

You are a security administrator. You need to ensure that email messages containing malicious attachments are automatically removed from all mailboxes in your organization after delivery. Which Microsoft Defender for Office 365 feature should you configure?

Accepted Answer

Zero-hour auto purge (ZAP). Option D is correct because Zero-hour auto purge (ZAP) automatically removes malicious messages that have already been delivered to mailboxes. Option A is wrong because Safe Attachments scans attachments before delivery. Option B is wrong because Safe Links scans URLs. Option C is wrong because anti-phishing policies protect against phishing, not necessarily remove malicious attachments after delivery.

Answer

Safe Links

Answer

Anti-phishing

Answer

Safe Attachments

Question 7

Your organization uses Microsoft Defender for Cloud Apps. You discover that a user is downloading large amounts of data from SharePoint Online to an unmanaged device. You need to automatically block the download and alert the security team. What should you configure?

Accepted Answer

Session policy. Option B is correct because a session policy can control access and block downloads in real-time. Option A is wrong because an anomaly detection policy only alerts, it does not block. Option C is wrong because an access policy can block access entirely, but not specifically block downloads. Option D is wrong because a file policy monitors file activities but does not block downloads real-time.

Answer

Access policy

Answer

File policy

Answer

Anomaly detection policy

Question 8

Your organization uses Microsoft Defender for Identity. You need to investigate an alert indicating a suspected lateral movement using pass-the-hash from a compromised workstation. Which entity should you prioritize examining in the investigation timeline?

Accepted Answer

The compromised account. Option A is correct because pass-the-hash attacks involve the compromise of NTLM hash, and examining the compromised account's activities is key to understanding the movement. Option B is wrong because the source workstation is where the attack originated but the hash is used from there. Option C is wrong because the destination server is the target, but the attacker's identity is more important. Option D is wrong because the network segment is not the primary entity.

Answer

The source workstation

Answer

The destination server

Answer

The network segment

Question 9

You are configuring policies in Microsoft Defender for Office 365. You need to ensure that users cannot click through to a malicious website that is hosted on a newly registered domain. Which policy setting should you enable?

Accepted Answer

Safe Links. Option A is correct because Safe Links checks URLs at time of click and can block newly registered domains if configured. Option B is wrong because Safe Attachments deals with attachments. Option C is wrong because anti-phishing policies protect against phishing but not specifically against malicious URLs in emails. Option D is wrong because anti-spam policies filter spam, not malicious URLs.

Answer

Anti-phishing

Answer

Anti-spam

Answer

Safe Attachments

Question 10

You are a security administrator for a company that uses Microsoft Defender XDR. You need to configure an automated investigation and response (AIR) policy to automatically remediate threats on devices. Which two actions can be taken automatically without requiring administrator approval? (Choose two.)

Accepted Answer

Quarantine file. Options A and C are correct because 'Quarantine file' and 'Isolate device' are both remediation actions that can be set to run automatically depending on the automation level. Option B is wrong because 'Run antivirus scan' is typically an investigation action, not a remediation action. Option D is wrong because 'Collect investigation package' is an investigation action. Option E is wrong because 'Block URL' is a remediation action but often requires approval.

Answer

Block URL

Answer

Run antivirus scan

Answer

Collect investigation package

Question 11

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that detects when a user shares a file containing sensitive data with an external domain. Which three components must you configure in the policy? (Choose three.)

Accepted Answer

A content inspection method (e.g., DLP). Options A, B, and D are correct because a file policy requires a filter (e.g., sharing with external users), a content inspection method to detect sensitive data, and a governance action (e.g., alert or block). Option C is wrong because session policies are separate. Option E is wrong because access token is not a component of a file policy.

Answer

A session control action

Answer

An access token condition

Question 12

You are a security analyst. You need to investigate a potential malware outbreak on a device using Microsoft Defender XDR. Which three data sources can you include in an advanced hunting query to gather relevant information? (Choose three.)

Accepted Answer

DeviceFileEvents. Options A, B, and C are correct because DeviceProcessEvents, DeviceNetworkEvents, and DeviceFileEvents are all standard tables in advanced hunting for process, network, and file activities. Option D is wrong because EmailAttachmentInfo is for email, not device. Option E is wrong because CloudAppEvents is for cloud apps.

Answer

CloudAppEvents

Answer

EmailAttachmentInfo

Question 13

Your organization uses Microsoft Defender for Office 365. Users report that legitimate emails from a specific partner domain are being moved to Junk Email folder. You verify that the partner's SPF, DKIM, and DMARC records are correctly configured. Which two actions should you take to resolve this issue?

Accepted Answer

Review the Anti-Phishing policy's spoof intelligence settings.. Option A is correct because you can create an Allow entry in the Tenant Allow/Block List to explicitly allow emails from the partner domain. Option D is correct because reviewing the phishing simulation and spoof intelligence settings can help identify if the system is misclassifying the domain. Option B is wrong because the Anti-Spam policy is not the cause; the issue is likely in the anti-phishing or spoof settings. Option C is wrong because disabling spam filtering is too aggressive and not recommended. Option E is wrong because the issue is with inbound filtering, not outbound.

Answer

Modify the Anti-Spam policy to increase the spam threshold.

Answer

Configure the Outbound spam filter policy.

Answer

Disable the Spam filter for the affected users.

Question 14

You are investigating an incident in Microsoft Defender XDR where a user received a phishing email that contained a link to a malicious site. The user clicked the link but did not enter credentials. Which actions would be most effective to remediate the incident?

Accepted Answer

Use Threat Explorer to delete the phishing email from all mailboxes.. Option B is correct because soft-deleting the email from all mailboxes removes the threat. Option D is correct because investigating the user's device for any post-click activity is crucial. Option A is wrong because blocking the user's sign-in is not necessary since credentials were not compromised. Option C is wrong because resetting password is not needed. Option E is wrong because blocking the URL is good but not sufficient as the email remains in other users' inboxes.

Answer

Block the user's account from signing in.

Answer

Block the URL in the Tenant Allow/Block List.

Answer

Reset the user's password immediately.

Question 15

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Defender for Cloud Apps. You need to configure a policy that automatically blocks downloads of sensitive files from a specific cloud app if the user's risk score is high. Which integration and policy type should you use?

Accepted Answer

Create a session policy in Microsoft Defender for Cloud Apps using Conditional Access App Control.. Option D is correct because the session policy in Microsoft Defender for Cloud Apps can use Microsoft Entra ID Conditional Access app control to monitor and block downloads in real-time based on risk. Option A is wrong because MDE device policies do not control cloud app downloads. Option B is wrong because Cloud Discovery is for identifying shadow IT. Option C is wrong because MDE policy does not integrate with cloud app download blocking. Option E is wrong because Conditional Access policies do not have per-file download controls.

Answer

Use the Cloud Discovery dashboard to block the app.

Answer

Create an attack surface reduction rule in MDE.

Answer

Create a Conditional Access policy in Microsoft Entra ID to block access to the app.

Answer

Create a device compliance policy in Microsoft Intune.