MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 14 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Identity. You receive an alert about a potential DCSync attack. What should you do to investigate this alert in Microsoft Defender XDR?

Accepted Answer

Run a KQL query in Advanced Hunting against IdentityLogonEvents to identify suspicious replication attempts.. DCSync attacks are performed by requesting domain replication via the MS-DRSR protocol, which generates specific directory replication events. In Microsoft Defender XDR, these replication attempts are logged in the IdentityLogonEvents table when an account authenticates to a domain controller for replication purposes. Running a KQL query against this table allows you to identify the source account, target domain controller, and the specific replication activity that triggered the alert.

Answer

Review the IdentityDirectoryEvents table for replication-related events.

Answer

Use IdentityQueryEvents to find LDAP queries related to replication.

Answer

Check the IdentityAlertEvents table to see if the alert has additional context.

Question 2

Your organization has Microsoft 365 E5 licenses and uses Microsoft Defender for Office 365. You need to ensure that users are warned before clicking on malicious URLs in email messages, even if the URL is clicked after the email is delivered. Which policy should you configure?

Accepted Answer

Safe Links policy. Safe Links policy is correct because it provides time-of-click protection, which scans URLs in email messages at the moment the user clicks them, even after delivery. This ensures users are warned or blocked from accessing malicious URLs that may have been benign at the time of delivery but later weaponized. Anti-malware, Safe Attachments, and Anti-phishing policies do not offer this post-delivery click-time verification.

Answer

Anti-malware policy

Answer

Safe Attachments policy

Answer

Anti-phishing policy

Question 3

You need to integrate Microsoft Defender XDR with Microsoft Sentinel for centralized monitoring. Which data connector should you use?

Accepted Answer

Microsoft Defender XDR connector. The Microsoft Defender XDR connector (option D) is the correct choice because it ingests signals from all Microsoft 365 Defender components—including Defender for Endpoint, Office 365, Identity, and Cloud Apps—into Microsoft Sentinel. This connector uses the Microsoft 365 Defender API to stream unified alerts and incidents, enabling centralized monitoring and correlation across the entire XDR stack.

Answer

Microsoft Defender for Cloud connector

Answer

Azure Security Center connector

Answer

Microsoft 365 Defender connector

Question 4

Your organization uses Microsoft Defender for Identity. You receive an alert about a potential DCSync attack. What should you do to investigate this alert in Microsoft Defender XDR?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Endpoint client logs. The Microsoft Defender for Endpoint client logs (option C) are the primary source for troubleshooting onboarding issues because they contain detailed records of the client's registration, communication with the cloud service, and policy application. If a device is not receiving security updates, it often indicates a failure in the onboarding process or a connectivity problem, which these logs directly capture. Checking these logs first allows you to verify the device's enrollment status and identify any errors in the initial connection or certificate exchange.

Answer

Event Viewer Application logs

Answer

System logs

Answer

Windows Update logs

Question 5

You are configuring Microsoft Defender for Office 365 to protect against business email compromise (BEC) attacks. Which policy setting should you enable to analyze email sender behavior and detect impersonation attempts?

Accepted Answer

Anti-phishing policy - Impersonation protection. Anti-phishing policies in Microsoft Defender for Office 365 include impersonation protection settings that analyze sender behavior and detect attempts to impersonate users, domains, or trusted senders. Enabling impersonation protection specifically addresses BEC by using mailbox intelligence and spoof intelligence to identify anomalous sender patterns.

Answer

Safe Attachments policy - Dynamic Delivery

Answer

Safe Links policy - URL scan

Answer

Anti-malware policy - Malware filter

Question 6

Your organization uses Microsoft Defender for Identity. You receive an alert about a potential DCSync attack. What should you do to investigate this alert in Microsoft Defender XDR?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Activity policy. Activity policies in Defender for Cloud Apps allow you to create custom rules to detect specific activities like mass download. Option A (App Discovery policy) is used to discover apps in use in your organization. Option C (Anomaly Detection policy) is for pre-built anomalies. Option D (Cloud Discovery policy) is for shadow IT.

Answer

App Discovery policy

Answer

Anomaly Detection policy

Answer

Cloud Discovery policy

Question 7

Which TWO actions can you perform using Microsoft Defender XDR's Advanced Hunting? (Choose two.)

Accepted Answer

Create custom detection rules based on query results.. Advanced Hunting in Microsoft Defender XDR allows you to run KQL queries across data from various Defender services, so option E is correct. You can also create custom detection rules based on query results, making option C correct. Option A (deploy EDR sensors) is done via group policy or Intune, not in Advanced Hunting. Option B (configure data retention) is a tenant-level setting. Option D (manage incident status) is performed in the Incidents queue, not in Advanced Hunting.

Answer

Deploy EDR sensors to endpoints.

Answer

Configure data retention policies for logs.

Answer

Manage the status of incidents.

Question 8

Which THREE features are included in Microsoft Defender for Office 365 Plan 2 but NOT in Plan 1? (Choose three.)

Accepted Answer

Automated Investigation and Response (AIR). Automated Investigation and Response (AIR) (C) is exclusive to Defender for Office 365 Plan 2, as it uses automated playbooks to investigate and remediate threats, which Plan 1 does not include. Threat Explorer (D) is also a Plan 2-only feature, providing real-time and historical threat hunting and reporting capabilities that are absent from Plan 1. Attack Simulation Training (E) is likewise included only in Plan 2, enabling organizations to run simulated phishing and social engineering attacks to train users. Anti-phishing policies (A) and Safe Links (B) are available in both Plan 1 and Plan 2, so they are not correct answers for features unique to Plan 2.

Answer

Anti-phishing policies

Answer

Safe Links

Question 9

Which TWO Microsoft Defender XDR components provide protection for email and collaboration tools? (Choose two.)

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 is the correct choice because it is the dedicated component that protects email and collaboration tools (Exchange Online, SharePoint Online, OneDrive for Business, and Teams) against threats like phishing, malware, and spam. It uses advanced machine learning and detonation analysis in Safe Attachments and Safe Links to inspect attachments and URLs in real time.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Endpoint

Question 10

You run the above PowerShell command on a Windows 10 device that is onboarded to Microsoft Defender for Endpoint. The device is reporting as healthy in the portal, but you suspect that some behavioral detection capabilities are turned off. Based on the output, which setting should you modify?

Accepted Answer

Set DisableBehaviorMonitoring to False to enable behavior monitoring.. The PowerShell command output shows that DisableBehaviorMonitoring is set to True, which disables behavioral monitoring. Since the device is healthy but behavioral detection capabilities are suspected to be off, setting DisableBehaviorMonitoring to False re-enables behavior monitoring, allowing Defender for Endpoint to analyze runtime behavior for threats.

Answer

Enable cloud-delivered protection by setting MAPSReporting to Advanced.

Answer

Set DisableBlockAtFirstSeen to True to enable Block at First Sight.

Answer

Set DisableRealtimeMonitoring to True to enable real-time monitoring.

Question 11

You run the above KQL query in Microsoft Defender XDR Advanced Hunting. The query returns no results. What is the most likely reason?

Accepted Answer

The column name SenderDomain does not exist in EmailEvents.. The most likely reason is that the column name 'SenderDomain' does not exist in the EmailEvents table. In Microsoft Defender XDR Advanced Hunting, the EmailEvents table contains columns like 'SenderFromDomain' or 'SenderMailFromDomain', but not 'SenderDomain'. Therefore, the query would fail to return results because of an invalid column reference.

Answer

The EmailDirection filter should be 'Outbound'.

Answer

No inbound emails were blocked in the last 30 days.

Answer

The time range should be 7 days instead of 30 days.

Question 12

A company's security team needs to investigate a suspicious email that was reported by a user. The email was not blocked by Exchange Online Protection (EOP) and was delivered to the user's inbox. The security team wants to use Microsoft Defender XDR to analyze the email and its attachments. Which feature should they use to submit the email for automated investigation?

Accepted Answer

Submissions. Microsoft Defender XDR's Submissions feature (under Email & Collaboration > Submissions) allows security teams to submit suspicious emails, attachments, and URLs to Microsoft for automated analysis. When a user reports a phish that EOP missed, the admin can submit it via Submissions, which triggers automated investigation, detonation, and re-classification. This is the correct tool for analyzing a specific reported email and its attachments.

Answer

Advanced Hunting

Answer

Threat Explorer

Answer

Attack Simulator

Question 13

Your organization uses Microsoft Defender for Identity. You receive an alert about a potential DCSync attack. What should you do to investigate this alert in Microsoft Defender XDR?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Activity policy. An Activity policy in Defender for Cloud Apps triggers alerts based on user activities such as file downloads, and supports thresholds and time windows. To alert when a user downloads more than 10 files from SharePoint Online within 10 minutes, you configure an Activity policy with the 'Download file' activity, a threshold of 10, and a 10-minute window. This matches the requirement exactly.

Answer

Cloud Discovery policy

Answer

Session policy

Answer

App discovery policy

Question 14

Refer to the exhibit. You are analyzing a KQL query in Microsoft Defender XDR Advanced Hunting. The query returns a list of devices where PowerShell or cmd.exe with encoded commands executed more than 5 times in the last 7 days. The security team suspects that one of the devices is compromised due to excessive use of encoded commands. However, a legitimate administrative script uses encoded commands regularly. How can you refine the query to reduce false positives while still detecting potentially malicious activity?

Accepted Answer

Add a filter to exclude processes signed by a trusted certificate or running under specific service accounts.. Adding a filter to exclude processes signed by a trusted certificate or running under specific service accounts directly addresses the legitimate administrative script that uses encoded commands. This refinement reduces false positives by allowing trusted, signed executables or known service accounts to bypass detection, while still flagging unsigned or anomalous encoded command executions that are more likely malicious. In Microsoft Defender XDR Advanced Hunting, you can use the `SigningCertificate` or `InitiatingProcessAccountName` fields in the KQL query to implement this exclusion.

Answer

Increase the Count threshold to 10.

Answer

Remove cmd.exe from the FileName filter.

Answer

Change the time range to 1 day instead of 7 days.

Question 15

Your organization uses Microsoft Defender for Identity. You receive an alert about a potential DCSync attack. What should you do to investigate this alert in Microsoft Defender XDR?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

File page. The File page in Microsoft Defender for Endpoint provides a comprehensive view of a specific file, including its prevalence across the organization, a list of devices where it was observed, and related events such as alerts and detections. This allows the security analyst to investigate the file's spread and associated incidents in one centralized location.

Answer

Alert page

Answer

Device page

Answer

Investigation page