MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 14 — 15 Questions

Question 1

Your organization uses Microsoft 365 E5 and has deployed Microsoft Defender for Cloud Apps. You discover that a user in the finance department is using a personal cloud storage app to store sensitive financial data. The app is unsanctioned. You need to prevent any further uploads of sensitive data to this app. Additionally, you want to automatically alert when users attempt to access this app from unmanaged devices. You must not block access entirely, as some users need to read data already stored there. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a session policy in Defender for Cloud Apps that blocks uploads for the unsanctioned app and requires conditional access app control for unmanaged devices.. A session policy in Defender for Cloud Apps can block uploads for unsanctioned apps while allowing read access, and it can enforce conditional access app control to require managed devices for access, generating alerts. Option A is incorrect because app governance manages app permissions, not session-level controls for blocking uploads and conditional access. Option B is incorrect because an access policy blocks all access, which would prevent reading existing data. Option C is incorrect because a file policy applies DLP labels but does not control user sessions or enforce device restrictions.

Answer

Configure app governance in Defender for Cloud Apps to revoke the app's permissions.

Answer

Create an access policy in Defender for Cloud Apps that blocks all access to the app from unmanaged devices and blocks uploads from all devices.

Answer

Create a file policy in Defender for Cloud Apps that detects sensitive data and automatically applies a DLP label.

Question 2

Your organization uses Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps. You need to configure automated remediation for a confirmed phishing email that was delivered to a user's inbox. The remediation should also block the sender's domain across the tenant. Which action should you include in the automation playbook?

Accepted Answer

Create a playbook in Microsoft Defender XDR that triggers automated actions. The correct action is to create a playbook in Microsoft Defender XDR (option C) because playbooks can automate remediation actions such as soft-deleting a malicious email and blocking the sender's domain across the tenant. Option A is incorrect because attack simulation training is for educating users, not for remediation. Option B is incorrect because data loss prevention policies classify and protect data, not remediate already delivered emails. Option D is incorrect because Safe Links policies protect users from clicking malicious links but do not remediate emails already in the inbox.

Answer

Create an attack simulation training campaign for the affected user

Answer

Create a data loss prevention policy to classify the email as malicious

Answer

Configure a Safe Links policy to block the URL at click time

Question 3

Your organization uses Microsoft Defender for Endpoint (Plan 2) and Microsoft Defender for Identity. A user reports that their device is running slowly and exhibiting unusual network traffic. You investigate in Microsoft Defender XDR and see a high number of alerts for the device. You need to determine if the device is compromised and, if so, initiate an automated investigation. What should you do first?

Accepted Answer

Use the Microsoft Defender XDR portal to trigger an automated investigation on the device. Using the Microsoft Defender XDR portal to trigger an automated investigation leverages the full XDR capabilities to analyze the device and determine if it is compromised. Option A is incorrect because isolating the device is a containment action, not the first step to determine compromise. Option B is incorrect because Live Response is a manual forensic tool, not an automated investigation. Option D is incorrect because running a full antivirus scan is not an automated investigation and may not detect advanced threats.

Answer

Isolate the device from the network immediately

Answer

Initiate a Live Response session to gather forensic data

Answer

Run a full antivirus scan from Microsoft Defender Antivirus

Question 4

Your organization uses Microsoft Defender for Cloud Apps. You want to detect when a user accesses a sanctioned cloud app from an anonymous IP address. What should you configure?

Accepted Answer

Create an activity policy in Defender for Cloud Apps. An activity policy in Microsoft Defender for Cloud Apps can be configured to detect when a user accesses a sanctioned cloud app from an anonymous IP address. Activity policies monitor user activities and trigger alerts based on specific conditions, such as accessing apps from anonymous IPs. Option A is incorrect because app discovery policies are used to identify cloud apps in use, not to detect anomalous access. Option B is incorrect because session policies control access in real-time (e.g., blocking), but the requirement is to detect, not block. Option C is incorrect because the cloud discovery shadow IT report shows discovered apps and usage, not alerts for specific access patterns.

Answer

Configure an app discovery policy

Answer

Set up a session policy to block access from anonymous IPs

Answer

Enable the cloud discovery shadow IT report

Question 5

Your organization uses Microsoft Defender for Endpoint (Plan 2) and Microsoft Defender for Identity. A security analyst reports that several domain controllers are generating alerts for anomalous logon activity. You need to investigate the scope of the potential compromise across the entire environment, including endpoints, identities, and cloud apps. What is the most efficient approach?

Accepted Answer

Use the Microsoft Defender XDR portal to view the unified incident. Microsoft Defender XDR provides a unified incident view that correlates alerts from all workloads. Option A is wrong because checking only endpoints misses identity and cloud app alerts. Option B is wrong because checking only identities misses endpoints. Option C is wrong because using multiple portals is inefficient.

Answer

Check each workload portal individually and correlate manually

Answer

Review the alerts in Microsoft Defender for Identity only

Answer

Review the alerts in Microsoft Defender for Endpoint only

Question 6

Your organization uses Microsoft Defender for Cloud Apps. You need to generate alerts when a user downloads more than 100 files from SharePoint Online within 10 minutes. What should you configure?

Accepted Answer

Create an activity policy. An activity policy in Microsoft Defender for Cloud Apps can be configured to monitor user activities, such as downloading multiple files from SharePoint Online, and trigger alerts based on specified thresholds (e.g., more than 100 files within 10 minutes). Option B is incorrect because app discovery policies are used to identify and control the use of cloud apps, not to monitor user activities. Option C is incorrect because session policies control access and user sessions in real-time, but they do not generate alerts based on activity thresholds. Option D is incorrect because OAuth app policies manage permissions for third-party apps, not user activities.

Answer

Create an app discovery policy

Answer

Create a session policy

Answer

Create an OAuth app policy

Question 7

Your organization uses Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps. A user reports receiving a suspicious email with a link to a known phishing site. You need to prevent other users from clicking similar links in the future. What should you configure?

Accepted Answer

Add the URL to the Tenant Allow/Block List in Microsoft 365 Defender. The Tenant Allow/Block List in Microsoft 365 Defender allows you to block specific URLs across the organization, preventing users from accessing known phishing sites. Option A is incorrect because attack simulation training is for user education, not blocking links. Option B is incorrect because Safe Attachments policies only handle email attachments, not URLs. Option C is incorrect because spam filter policies manage spam classification, not specific URLs.

Answer

Use the attack simulation training to educate users

Answer

Create a Safe Attachments policy to block the attachment

Answer

Configure a spam filter policy to block the sender

Question 8

Your organization has Microsoft Defender for Endpoint (Plan 2) and Microsoft Defender for Identity. A critical server is showing signs of a ransomware attack. You need to contain the threat while preserving forensic evidence for analysis. What should you do first?

Accepted Answer

Initiate an automated investigation in Microsoft Defender XDR. Initiating an automated investigation in Microsoft Defender XDR automatically contains the threat (e.g., by isolating the device) while collecting and preserving forensic evidence for analysis. Option A is wrong because a Live Response session is a manual, interactive process that allows collection of forensic data but does not contain the threat, and it could disrupt evidence if not performed carefully. Option B is wrong because isolating the server immediately contains the threat but may disrupt forensic evidence collection, as isolation stops processes and network traffic that might be needed for analysis. Option C is wrong because a full antivirus scan is reactive, does not contain the threat, and may take too long, potentially allowing the ransomware to spread or encrypt more data.

Answer

Run a Live Response session to collect forensic data

Answer

Isolate the server from the network immediately

Answer

Run a full antivirus scan on the server

Question 9

Your organization uses Microsoft Defender for Office 365. You need to ensure that emails containing malicious attachments are automatically removed from users' inboxes after detection. What should you configure?

Accepted Answer

Configure a Safe Attachments policy. Configure a Safe Attachments policy. Safe Attachments policies in Defender for Office 365 automatically scan email attachments for malicious content and can remove or quarantine emails with detected malware. Option A (Safe Links) protects against malicious URLs, not attachments. Option B (anti-spam policy) handles spam, not malware in attachments. Option D (attack simulation training) is for phishing simulations, not automatic removal of malicious attachments.

Answer

Configure a Safe Links policy

Answer

Configure an anti-spam policy to delete the email

Answer

Use the attack simulation training to report the email

Question 10

Your organization uses Microsoft Defender XDR. You need to configure automatic response actions for a high-severity incident. Which TWO options are available in the Microsoft Defender XDR automated investigation and response capabilities?

Accepted Answer

Isolate a device from the network. Correct: B and C. Automated investigation and response (AIR) in Microsoft Defender XDR can automatically isolate a device from the network and collect an investigation package from a device. Option A is incorrect because creating a mailbox rule is not an automated response action. Option D is incorrect because delegating mailbox permissions is not an automated action. Option E is incorrect because resetting user passwords is not part of AIR.

Answer

Create a mailbox rule to delete suspicious emails

Answer

Delegate mailbox permissions

Answer

Reset user passwords

Question 11

Your organization uses Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps. A security incident involves a user who accessed a malicious link from an email and then uploaded sensitive data to an external cloud app. Which THREE Microsoft Defender XDR components would provide relevant alerts and insights for this incident?

Accepted Answer

Microsoft Defender for Office 365. Correct: A, B, and E. Defender for Office 365 alerts on malicious links in email; Defender for Cloud Apps alerts on data upload to external apps; Microsoft Defender XDR correlates them into a single incident. Option C is wrong because Microsoft Sentinel is a SIEM, not a component of Defender XDR. Option D is wrong because Defender for Identity focuses on identity-related threats, not email or cloud app data upload.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Identity

Question 12

Your organization uses Microsoft Defender for Endpoint (Plan 2). You need to configure a custom detection rule that alerts when a specific process attempts to access the internet. Which TWO components are required to create this custom detection?

Accepted Answer

Response action in the detection rule. Correct: B and E. Custom detection rules in Microsoft Defender for Endpoint require an Advanced Hunting query (KQL) to define the detection logic, and a response action to automate remediation when the alert is triggered. Option A is incorrect because attack surface reduction rules are predefined and not custom. Option C is incorrect because Microsoft Sentinel automation rules are separate from Defender for Endpoint custom detections. Option D is incorrect because indicators of compromise are used for threat intelligence, not for custom detection rules based on process internet access.

Answer

Attack surface reduction rule

Answer

Microsoft Sentinel automation rule

Answer

Indicator of compromise (IOC)

Question 13

Refer to the exhibit. You run the KQL query and see that a device named 'WORKSTATION42' has made 1500 connections to a public IP address 203.0.113.55 in the last day. You suspect the device may be compromised. What should you do next to gain the most context?

Accepted Answer

Expand the query to join with DeviceProcessEvents to see which process initiated the connections. Expanding the query to include process information can reveal which process is making the connections, helping identify malware. Option A is wrong because simply isolating the device loses forensic data. Option C is wrong because Safe Links is for email, not device network. Option D is wrong because blocking the IP is reactive and may disrupt legitimate traffic.

Answer

Isolate the device immediately using Microsoft Defender for Endpoint

Answer

Add the IP address to the Tenant Allow/Block List to block it

Answer

Create a Safe Links policy to block the IP address

Question 14

Your organization is a multinational company with 10,000 users. You use Microsoft Defender for Office 365 Plan 2, Microsoft Defender for Endpoint Plan 2, Microsoft Defender for Cloud Apps, and Microsoft Defender for Identity. Recently, a sophisticated phishing campaign targeted your executives. The campaign used personalized emails with malicious links that bypassed Safe Links protection. Several executives clicked the links and entered their credentials on a fake login page. The attackers then used those credentials to access the executives' mailboxes and exfiltrate sensitive data. You need to implement a solution that prevents similar attacks in the future by automatically blocking access to newly discovered phishing sites and providing real-time protection when users click unknown URLs. The solution should also allow you to simulate phishing campaigns to train users. What should you do?

Accepted Answer

Configure Attack Simulation Training in Microsoft 365 Defender, create a simulated phishing campaign targeting executives, and use the training to educate users on reporting phishing. Additionally, ensure Safe Links policy uses the 'Do not allow users to click through to the original URL' option and enable 'URL detonation' for unknown URLs.. Attack Simulation Training allows you to create and run phishing campaigns to educate users, and it integrates with Defender for Office 365 to improve detection. Additionally, configuring Safe Links with 'Do not allow users to click through to the original URL' and enabling 'URL detonation' provides real-time protection when users click unknown URLs. Option A is incorrect because blocking all URLs from unknown domains is too restrictive and would cause heavy false positives, impairing business operations. Option B is incorrect because Safe Attachments policies handle email attachments, not URLs; the threat in this scenario is malicious links. Option C is incorrect because adding the known phishing domain to the Tenant Allow/Block List is a reactive measure that only blocks that specific domain after it has been used; it does not provide proactive protection against new phishing sites.

Answer

Create a Safe Links policy that blocks all URLs from domains not in the allowed list.

Answer

Deploy Safe Attachments policies with dynamic delivery and enable 'Automatic forwarding of attachments' for unknown files.

Answer

Add the known phishing domain to the Tenant Allow/Block List and block it.

Question 15

Your organization is a financial services company with 5,000 users. You use Microsoft Defender XDR, including Defender for Endpoint Plan 2, Defender for Identity, Defender for Office 365 Plan 2, and Defender for Cloud Apps. You have recently deployed Microsoft Copilot for Security to assist your security operations center (SOC) analysts. A high-severity incident is generated: 'A user named jdoe accessed a malicious IP address from their device, and then logged into Azure Portal from an anonymous IP address. Defender for Identity detected a suspicious Kerberos ticket request from the same user's domain controller. The SOC analysts are overwhelmed with alerts and need to quickly understand the full scope of the incident, including related alerts, impacted assets, and recommended actions. They also want to use natural language to ask questions about the incident. What should you do to enable the analysts to efficiently investigate this incident?

Accepted Answer

Use Microsoft Copilot for Security integrated with Microsoft Defender XDR to get a natural language summary of the incident, ask follow-up questions, and receive recommended actions.. Microsoft Copilot for Security is designed to provide a natural language summary of incidents, answer follow-up questions, and suggest recommended actions. This directly addresses the SOC analysts' need to quickly understand the full scope of the incident without needing to write KQL queries. Option A is wrong because Advanced Hunting requires knowledge of KQL and is not a natural language interface, which would slow down overwhelmed analysts. Option B is wrong because creating custom detection rules generates more alerts for future incidents but does not help investigate the current incident. Option D is wrong because automated investigation and remediation can contain threats, but it does not provide a natural language summary or allow analysts to ask questions about the incident.

Answer

Train the analysts to use Advanced Hunting to query across all data sources and build custom KQL queries to correlate the alerts.

Answer

Create custom detection rules in Microsoft Defender XDR to generate more specific alerts for similar activity.

Answer

Configure automated investigation and remediation to automatically contain the threat and then review the results.