MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 15 — 15 Questions

Question 1

A company is planning to deploy Microsoft Defender for Endpoint to its Windows 10 devices. The devices are managed by Microsoft Intune. The security team wants to ensure that the MDE sensor is installed automatically on new devices that are enrolled in Intune. Which method should the team use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an Endpoint security policy in Intune to deploy MDE.. The correct method is to create an Endpoint security policy in Intune specifically for Microsoft Defender for Endpoint. This policy type allows you to configure the MDE onboarding blob and automatically deploy the MDE sensor to Windows 10 devices enrolled in Intune. It is the native, cloud-based approach that ensures new devices receive the sensor without manual intervention or on-premises infrastructure.

Answer

Manually install MDE on each device.

Answer

Use Group Policy to deploy the MDE installation package.

Answer

Deploy MDE using Microsoft Configuration Manager.

Question 2

A security administrator is configuring Microsoft Defender for Office 365 to protect against zero-day malware in attachments. The administrator wants to use dynamic delivery so that users can view the email body while the attachment is being analyzed. However, the administrator is concerned about false positives and wants to ensure that if a benign attachment is later found to be malicious, it is removed from the user's inbox. What should the administrator configure?

Accepted Answer

Configure a Safe Attachments policy with dynamic delivery and enable ZAP.. Safe Attachments policies with dynamic delivery allow users to view the email body while the attachment is being detonated in a sandbox. Zero-Hour Auto Purge (ZAP) then retroactively removes messages from the user’s inbox if a previously deemed benign attachment is later identified as malicious, addressing the false-positive concern.

Answer

Configure a Safe Links policy with URL detonation.

Answer

Configure an anti-phishing policy with mailbox intelligence.

Answer

Configure an anti-malware policy with common attachments filter.

Question 3

A security administrator is configuring Microsoft Defender for Cloud Apps to protect against data exfiltration from SaaS apps. The administrator wants to create a policy that alerts when a user attempts to download more than 50 files from SharePoint Online within 5 minutes. Which two components must be configured to achieve this? (Choose two.)

Accepted Answer

Activity policy. The correct answers are C (Activity policy) and E (App connector for SharePoint Online). An activity policy is needed to define the threshold (50 files in 5 minutes) and trigger an alert when exceeded. The app connector for SharePoint Online must be enabled to allow Defender for Cloud Apps to monitor SharePoint activity. Option A (File policy) is incorrect because file policies govern file sharing and collaboration, not download counts. Option B (Session policy) is used for real-time session control, not alerting on activity counts. Option D (Conditional Access App Control) is used to enforce access policies, not for monitoring specific activities.

Answer

File policy

Answer

Session policy

Answer

Conditional Access App Control

Question 4

A company is deploying Microsoft Defender for Office 365 to protect against advanced threats. Which two features are available only in Defender for Office 365 Plan 2 and not in Plan 1? (Choose two.)

Accepted Answer

Automated Investigation & Response. Options A and E are correct. Automated Investigation & Response (AIR) and Threat Explorer are only available in Defender for Office 365 Plan 2. Anti-phishing, Safe Attachments, and Safe Links are available in both Plan 1 and Plan 2.

Answer

Anti-phishing

Answer

Safe Attachments

Answer

Safe Links

Question 5

Your organization uses Microsoft Defender for Cloud Apps. You need to be alerted when a user accesses a cloud app from an anonymous IP address. Which type of policy should you create?

Accepted Answer

Activity policy. An activity policy in Microsoft Defender for Cloud Apps can detect access from anonymous IP addresses by monitoring user activities. Option A is incorrect because a session policy controls user sessions in real-time but does not specifically alert on anonymous IP access. Option B is incorrect because a file policy focuses on monitoring and protecting files, not on access from anonymous IPs. Option D is incorrect because an app discovery policy is used to discover shadow IT and unsanctioned apps, not to alert on anonymous IP access.

Answer

Session policy

Answer

File policy

Answer

App discovery policy

Question 6

Your organization has deployed Microsoft Defender for Cloud Apps. You need to ensure that all external file sharing to untrusted domains is automatically blocked. The solution must not affect internal sharing. What should you configure?

Accepted Answer

Create a file policy in Microsoft Defender for Cloud Apps with a governance action to remove external users.. A file policy in Microsoft Defender for Cloud Apps can be configured with a governance action to remove external users from shared files when sharing is detected with untrusted domains. This action automatically blocks external sharing without affecting internal sharing, as it targets only external collaborators from domains not on the trusted list.

Answer

Create an access policy in Microsoft Defender for Cloud Apps to block access from untrusted domains.

Answer

Configure an app connector for the cloud app to enforce DLP policies.

Answer

Create a session policy in Microsoft Defender for Cloud Apps to monitor external sharing.

Question 7

Your organization uses Microsoft Defender for Endpoint. You need to ensure that when a device is onboarded, it automatically receives all current threat intelligence signatures. What should you verify is configured?

Accepted Answer

Cloud-delivered protection is enabled in the Microsoft 365 Defender portal.. Cloud-delivered protection in the Microsoft 365 Defender portal ensures that devices receive the latest threat intelligence signatures in near real-time. When enabled, Defender for Endpoint uses the Microsoft Intelligent Security Graph to push updated signatures and machine learning models to onboarded devices automatically, without relying on manual update cycles.

Answer

The device is configured to receive updates from Microsoft Update.

Answer

Network protection is enabled in the attack surface reduction rules.

Answer

Sample submission is enabled in the advanced features.

Question 8

Your organization has Microsoft Defender for Office 365. Users report that legitimate emails from a partner domain are being quarantined. You need to ensure these emails are delivered while maintaining security. What should you do?

Accepted Answer

Add the partner domain to the Allow list in the Tenant Allow/Block List.. The Tenant Allow/Block List in Microsoft Defender for Office 365 is the supported, granular mechanism for allowing specific senders or domains that are being incorrectly quarantined. Adding the partner domain as an allow entry tells Exchange Online Protection (EOP) to skip filtering actions (quarantine, junk, etc.) for messages from that domain while still applying other protections like malware scanning and Safe Links. This preserves security posture because only the specific false-positive source is exempted, not the entire filtering pipeline.

Answer

Disable spam filtering for the partner domain.

Answer

Lower the spam confidence level (SCL) threshold for the organization.

Answer

Create a mail flow rule to bypass spam filtering for the partner domain.

Question 9

You need to configure Microsoft Defender for Cloud Apps to detect anomalous user behavior such as impossible travel. Which type of policy should you create?

Accepted Answer

Anomaly detection policy. Anomaly detection policy. In Microsoft Defender for Cloud Apps, anomaly detection policies are specifically designed to identify unusual user behaviors, such as impossible travel (login from geographically distant locations within a short time), unusual activity patterns, and other security anomalies. Option A (Access policy) is incorrect because it enforces access controls based on conditions like location or device, rather than detecting anomalies. Option B (Session policy) is incorrect as it monitors and controls real-time application sessions, not anomaly detection. Option D (File policy) is incorrect because it focuses on data protection by applying rules to files stored in cloud apps.

Answer

Access policy

Answer

Session policy

Answer

File policy

Question 10

Which TWO features in Microsoft Defender for Office 365 help protect against zero-day malware in email attachments?

Accepted Answer

Safe Attachments. Safe Attachments (Option A) is correct because it uses a detonation chamber environment to open email attachments in a virtualized sandbox, analyzing behavior for zero-day malware before delivery. This process catches unknown threats by executing the attachment and observing malicious actions, unlike signature-based detection.

Answer

Mail flow rules

Answer

Anti-spam policies

Answer

Anti-phishing policies

Question 11

Your organization uses Microsoft Defender for Cloud Apps. You need to be alerted when a user accesses a cloud app from a risky IP address. What should you configure?

Accepted Answer

Create an anomaly detection policy with the 'Activity from risky IP address' template.. An anomaly detection policy can alert on activities from risky IP addresses. Option B is wrong because session policies control real-time access. Option C is wrong because file policies monitor data. Option D is wrong because access policies control access based on conditions.

Answer

Create a session policy to monitor risky IP addresses.

Answer

Create a file policy to detect access from risky IPs.

Answer

Create an access policy to block risky IPs.

Question 12

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that automatically alerts when a user downloads more than 100 files from SharePoint Online in 10 minutes. What type of policy should you create?

Accepted Answer

Anomaly detection policy. An anomaly detection policy in Microsoft Defender for Cloud Apps is designed to identify unusual user behavior, such as a user downloading over 100 files from SharePoint Online within 10 minutes. This policy type uses machine learning and predefined thresholds to detect deviations from baseline activity, making it the correct choice for this scenario.

Answer

Session policy

Answer

App discovery policy

Answer

OAuth app policy

Question 13

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious LDAP query from a domain controller. After investigating, you determine the query is legitimate. How should you prevent future alerts for this activity?

Accepted Answer

Create a suppression rule for that alert type and entity.. Microsoft Defender for Identity suppression rules are the designed mechanism for silencing alerts that have been triaged as benign. A suppression rule scoped to the specific alert type (e.g., 'Suspicious LDAP query') and the specific entity (the domain controller or account) prevents future identical alerts from being raised without weakening detection for the rest of the environment. This preserves the integrity of the detection pipeline while eliminating noise from known-good activity.

Answer

Create a custom detection rule to allow the LDAP query.

Answer

Disable the Defender for Identity sensor on the domain controller.

Answer

Change the alert severity to Low.

Question 14

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the built-in anti-phishing policy. You need to analyze the email headers to determine why it was not detected. What should you use?

Accepted Answer

Threat Explorer in Microsoft Defender for Office 365. Threat Explorer (part of Microsoft 365 Defender's Email & Collaboration section) provides detailed email metadata, including full message headers, delivery action, and the specific policy or filter that processed the message. It lets administrators trace why a message was allowed, blocked, or delivered to junk, and it surfaces the anti-phishing verdict, spoof intelligence, and detection technology that evaluated the message. This is the correct tool for post-incident header analysis of a phishing message that bypassed filtering.

Answer

Attack Simulator in Microsoft Defender for Office 365

Answer

Message trace in Exchange admin center

Answer

Quarantine page in Microsoft Defender for Office 365

Question 15

A company wants to receive alerts when a user account is used from an unauthorized location. They have Microsoft Defender for Cloud Apps (MDA). Which policy type should they create?

Accepted Answer

Create an anomaly detection policy.. Anomaly detection policies in Microsoft Defender for Cloud Apps use machine learning and behavioral baselines to flag activities that deviate from a user's normal pattern — including logins from unfamiliar or unauthorized geographic locations. This is the correct policy type because the requirement is to detect unusual user behavior (impossible travel, atypical location) rather than to control sessions, permissions, or files. MDA's anomaly detection engine automatically surfaces alerts such as 'Activity from infrequent country' or 'Impossible travel' without needing a predefined rule.

Answer

Create a session policy.

Answer

Create an app permissions policy.

Answer

Create a file policy.