MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 15 — 15 Questions

Question 1

Your organization is a small business with 200 users. You use Microsoft 365 Business Premium, which includes Microsoft Defender for Business (the small business version of Defender for Endpoint) and Microsoft Defender for Office 365 Plan 1. You want to protect against ransomware by blocking malicious processes and behaviors on endpoints. You also need to enable automated investigation and response for common threats. However, your IT team has limited security expertise and wants a simple configuration that provides out-of-the-box protection without custom policies. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the default security baseline in Microsoft Defender for Business, which includes attack surface reduction rules and automated investigation.. Defender for Business provides default security baselines that include attack surface reduction rules and automated investigation, requiring minimal configuration. Option A is wrong because creating custom policies is complex and not necessary. Option C is wrong because third-party EDR adds complexity and cost. Option D is wrong because Safe Attachments is for email, not endpoint behavior.

Answer

Configure Safe Attachments policies in Microsoft Defender for Office 365 to block ransomware attachments.

Answer

Create custom attack surface reduction rules in Microsoft Defender for Business to block ransomware behaviors.

Answer

Deploy a third-party endpoint detection and response (EDR) solution alongside Microsoft Defender for Business.

Question 2

You are a security administrator for a company that uses Microsoft Defender XDR. You need to configure automated investigation and response (AIR) to automatically remediate threats. Which two actions should you take?

Accepted Answer

Configure action center settings to allow automatic remediation.. To enable automated investigation and response (AIR) in Microsoft Defender XDR, you must first enable the feature in the Microsoft Defender portal (option D), and then configure action center settings to allow automatic remediation (option C). Option A is incorrect because device groups are not required for AIR; they are used for device-specific policies. Option B is incorrect because the Security Administrator role should be assigned only to necessary users, not all users. Option E is incorrect because automation levels are set per policy, not globally.

Answer

Create a device group for automatic remediation.

Answer

Assign the Security Administrator role to all users.

Answer

Set the automation level to 'Full - remediate threats automatically' globally.

Question 3

You are configuring Microsoft Defender for Office 365 to protect against sophisticated phishing attacks. You need to ensure that users are warned about potentially malicious messages that bypass other filters. Which two policies should you configure?

Accepted Answer

Anti-phishing policy: Impersonation protection settings. To warn users about potentially malicious messages, you must configure anti-phishing policy settings for impersonation protection and spoof intelligence. Both are part of the anti-phishing policy. Since option D misnames the policy as anti-spam, it is not a correct choice. Only option E is correctly identified. The stem requests two policies, but as written, only one correct policy exists.

Answer

Safe Attachments policy

Answer

Safe Links policy

Answer

Anti-malware policy

Answer

Anti-spam policy: Spoof intelligence

Question 4

Your organization uses Microsoft Defender XDR and Microsoft Sentinel in a hybrid deployment. You are the security operations lead. A new regulation requires that all security alerts be automatically enriched with threat intelligence indicators from an external feed before being sent to Sentinel. You need to implement this enrichment with minimal latency and without writing custom code. What should you do?

Accepted Answer

Configure the Microsoft Defender XDR connector in Sentinel to receive alerts, and use the Threat Intelligence API to add indicators to Defender XDR.. Microsoft Defender XDR can ingest external threat intelligence via the API and then forward enriched alerts to Sentinel using the built-in connector. Option B is wrong because Logic Apps require custom code and may introduce latency. Option C is wrong because Azure Functions require custom code. Option D is wrong because the data connector does not support enrichment.

Answer

Create a Logic App that runs on a schedule to pull alerts from Defender XDR, enrich them using external TI, and push to Sentinel.

Answer

Create an Azure Function that uses the Microsoft Graph API to get alerts, enrich them, and send to Sentinel.

Answer

Use the Microsoft Sentinel data connector for Microsoft Defender XDR and configure automatic enrichment in the data connector settings.

Question 5

You are a security administrator for a multinational company that uses Microsoft Defender XDR. You have deployed Microsoft Defender for Endpoint on all devices. The company has a strict policy that any device with a high-severity alert must be isolated from the network immediately. You need to configure an automated response that isolates the device as soon as a high-severity alert is generated. What should you do?

Accepted Answer

In Microsoft Defender XDR, navigate to Settings > Endpoints > Automated investigation and response, and configure the automation level for high-severity alerts to 'Full - remediate threats automatically'.. In Microsoft Defender XDR, you can configure automated investigation and response settings to automatically remediate threats. By setting the automation level to 'Full - remediate threats automatically' for high-severity alerts, the system will automatically isolate devices as part of the remediation actions. Option A is incorrect because enabling automatic investigation does not automatically trigger isolation; it only starts an investigation. Option B is incorrect because the Action Center is for manual actions, not automated response. Option C is incorrect because device groups and conditional access policies are not the mechanism for automatic isolation in Defender for Endpoint; that is handled by the automated investigation and response settings.

Answer

Enable 'Automatically investigate alerts' in the Microsoft Defender portal.

Answer

Use the Action Center to manually isolate devices as alerts come in.

Answer

Create a device group for high-severity alerts and configure a conditional access policy to block network access.

Question 6

Your company uses Microsoft Defender XDR and Microsoft 365 E5 licenses. You are the security administrator. The company's incident response team receives hundreds of low-severity alerts daily, causing alert fatigue. You need to reduce noise by automatically closing low-severity alerts that are determined to be false positives by Microsoft's threat intelligence. You want to minimize manual effort and ensure that only alerts with high confidence of being false positives are closed. What should you do?

Accepted Answer

Enable the built-in 'Automatic false positive suppression' feature in the Microsoft Defender XDR settings.. Microsoft Defender XDR includes a built-in 'Automatic false positive suppression' feature that uses Microsoft's threat intelligence to automatically close low-severity alerts determined to be false positives with high confidence, reducing noise without manual effort. Option B is incorrect because automated investigation and response rules are designed for taking actions on alerts based on criteria, but they do not leverage Microsoft's threat intelligence to determine false positives; they might close alerts that are not truly false positives. Option C is incorrect because using the API and PowerShell to close alerts requires significant manual effort to maintain a false positive list and does not use Microsoft's threat intelligence, and it may not be as reliable. Option D is incorrect because custom detection rules are used to create new alerts, not to suppress false positives; suppression rules (like tuning rules) require manual creation and maintenance.

Answer

Configure an automated investigation and response rule for low-severity alerts to automatically close them.

Answer

Use the Microsoft Defender XDR API to export alerts daily and run a PowerShell script to close low-severity alerts that match a known false positive list.

Answer

Create a custom detection rule that excludes low-severity alerts from known false positive indicators.

Question 7

You are a security administrator for an organization that uses Microsoft Defender XDR. You want to provide your security operations team with a unified view of all incidents across endpoints, email, and identities. You also want to automate the creation of incidents when correlated alerts are detected. What should you do?

Accepted Answer

Navigate to the Microsoft Defender XDR portal (security.microsoft.com) and use the Incidents view.. The Microsoft Defender XDR portal (security.microsoft.com) provides a unified incident view and automatically correlates alerts from multiple workloads (endpoints, email, identities) into incidents. Option B is incorrect because Microsoft Defender for Endpoint portal focuses only on endpoint data, not the unified view across all services. Option C is incorrect because while Microsoft Sentinel can provide a unified view, it requires additional licensing, configuration, and does not automatically create incidents from correlated alerts without custom analytics rules. Option D is incorrect because custom KQL queries and workbooks provide visibility but do not automate incident creation; that requires built-in correlation from Microsoft Defender XDR.

Answer

Open the Microsoft Defender for Endpoint portal and create a dashboard for all alerts.

Answer

Install Microsoft Sentinel and configure data connectors for all workloads.

Answer

Create a custom KQL query that correlates alerts from different sources and create a workbook.

Question 8

Your organization uses Microsoft Defender XDR and Microsoft 365 E5 licenses. You need to ensure that when a user reports a phishing email using the Microsoft Report Message add-in, the email is automatically submitted to Microsoft for analysis and the user is notified of the analysis result. You want to minimize administrative effort. What should you do?

Accepted Answer

In Microsoft Defender XDR, go to Settings > Email & collaboration > User reported messages, and enable 'Send reported messages to Microsoft' and 'Notify users when analysis completes'.. The user-reported messages settings in Microsoft Defender XDR (Settings > Email & collaboration > User reported messages) allow you to automatically send reported messages to Microsoft for analysis and notify users when analysis completes, minimizing administrative effort. Option A is wrong because a mail flow rule would only forward messages to a security team mailbox, not to Microsoft, and would not provide automatic analysis or user notification. Option B is wrong because simply configuring the Report Message add-in for all users enables reporting but does not by itself automatically submit to Microsoft or notify users; the Defender XDR settings are required for those actions. Option C is wrong because manually submitting each reported email via the Microsoft 365 Defender portal defeats the goal of minimizing administrative effort and does not automatically notify the user of results.

Answer

Create a mail flow rule that forwards reported messages to a security team mailbox.

Answer

Configure the Microsoft Report Message add-in for all users.

Answer

Use the Microsoft 365 Defender portal to manually submit the email for analysis whenever a user reports it.

Question 9

Your company uses Microsoft Defender XDR and Microsoft Defender for Cloud Apps. You have discovered that a user's credentials were compromised and used to access a SaaS application from an unusual location. You need to automatically suspend the user's access to all cloud apps and require a password reset. The suspension should be immediate upon detection. What should you do?

Accepted Answer

In Microsoft Defender for Cloud Apps, create a session policy that uses the 'Suspend user' governance action and configure it to require password reset.. Microsoft Defender for Cloud Apps allows you to create a session policy with the 'Suspend user' governance action, which can automatically suspend the user's access to all cloud apps upon detection of anomalous activity. Additionally, you can configure the policy to require a password reset, ensuring immediate remediation. Option B is wrong because a Microsoft Sentinel playbook can disable the user account but does not inherently force a password reset, and the response may not be immediate due to playbook execution delays. Option C is wrong because a conditional access policy in Microsoft Entra ID can block access from unusual locations but does not suspend the user or require a password reset. Option D is wrong because Microsoft Defender XDR automated investigation rules cannot reset passwords; that action is not available in Defender XDR.

Answer

Create a playbook in Microsoft Sentinel that disables the user account in Microsoft Entra ID.

Answer

Set up a conditional access policy in Microsoft Entra ID to block all access from unusual locations.

Answer

Configure an automated investigation rule in Microsoft Defender XDR to reset the user's password.

Question 10

You are a security administrator for a company that uses Microsoft Defender XDR. You need to generate a report that shows the number of incidents closed as true positive, false positive, and benign in the last 30 days. You want to use built-in features without writing custom queries. What should you do?

Accepted Answer

In the Microsoft Defender XDR portal, go to Reports > General > Incident summary.. The Microsoft Defender XDR portal provides a built-in 'Incident summary' report under Reports > General. This report shows the number of incidents closed as true positive, false positive, and benign within a specified time range, such as the last 30 days. Options A, B, and C are incorrect: Option A refers to the Microsoft Defender for Endpoint reports section, which focuses on endpoint-specific data rather than overall incidents. Option B is the Device health report, which deals with device status, not incident classification. Option C is Threat analytics, which provides threat intelligence and vulnerability information, not incident closure summaries.

Answer

Use the Microsoft Defender for Endpoint reports section.

Answer

Use the Device health report in Microsoft Defender XDR.

Answer

Navigate to Threat analytics in the Defender XDR portal.

Question 11

Your organization uses Microsoft Defender XDR and Microsoft 365 E5 licenses. You are a security administrator. The security team wants to receive email notifications for high-severity incidents only. You need to configure the notification settings. What should you do?

Accepted Answer

In the Microsoft Defender XDR portal, go to Settings > Microsoft 365 Defender > Email notifications, and create a notification for high-severity incidents.. In the Microsoft Defender XDR portal, you can configure email notifications for incidents based on severity under Settings > Microsoft 365 Defender > Email notifications. Option B is incorrect because incident response rules are used for automated responses, not email notifications. Option C is incorrect because alert policies in the Microsoft Purview compliance portal are for data loss prevention and compliance alerts, not Defender incidents. Option D is incorrect because service health notifications in the Microsoft 365 admin center are for service availability, not security incidents.

Answer

Create an incident response rule that sends an email when a high-severity incident is created.

Answer

Use the Microsoft Purview compliance portal to create an alert policy.

Answer

Configure a service health notification in the Microsoft 365 admin center.

Question 12

Your company uses Microsoft Defender XDR and Microsoft Defender for Identity. You have detected that a domain controller is communicating with a known malicious IP address. You need to immediately contain the threat by isolating the domain controller from the network while preserving forensic data. However, you cannot afford downtime for authentication services. What should you do?

Accepted Answer

In Microsoft Defender for Identity, configure a network protection policy to block communication to the malicious IP.. Microsoft Defender for Identity's network protection policies can block communication to specific malicious IP addresses without isolating the entire domain controller, thereby containing the threat while preserving authentication services. Option A is incorrect because conditional access policies apply to users and devices, not domain controllers. Option B is incorrect because isolating the domain controller with Microsoft Defender for Endpoint would block all network traffic, causing authentication downtime. Option D is incorrect because blocking at the firewall may not be immediate and could inadvertently affect legitimate traffic.

Answer

Create a conditional access policy to block the domain controller.

Answer

Use Microsoft Defender for Endpoint to isolate the domain controller.

Answer

Block the IP address at the network firewall.

Question 13

Your organization uses Microsoft Defender XDR and Microsoft 365 E5 licenses. You need to ensure that when a user is determined to be compromised (e.g., due to a leaked credential), all active sessions are terminated and the user is required to re-authenticate with multi-factor authentication (MFA). You want to automate this process as much as possible. What should you do?

Accepted Answer

In Microsoft Defender for Cloud Apps, create a session policy with the 'Suspend user' governance action and configure it to revoke sessions and require re-authentication.. Microsoft Defender for Cloud Apps can create a session policy with the 'Suspend user' governance action, which integrates with Microsoft Entra ID to revoke all active sessions and require the user to re-authenticate with MFA. This automates the process of terminating sessions and enforcing re-authentication when a user is compromised. Option B is incorrect because disabling the user account terminates sessions but does not require MFA re-authentication for future access. Option C is incorrect because a conditional access policy requiring MFA for all users does not terminate existing sessions; it only applies to new authentication requests. Option D is incorrect because manually resetting the password and signing out of sessions is not automated and does not leverage the capabilities of Microsoft Defender XDR and Microsoft 365 E5 licenses.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Create a conditional access policy that requires MFA for all users.

Answer

Manually reset the user's password and sign out of all sessions.

Question 14

You are a security administrator for a company that uses Microsoft Defender XDR. You need to investigate a suspicious email that was reported by a user. You want to see the full email details, including headers, attachments, and URLs. Where should you look?

Accepted Answer

In the Microsoft Defender XDR portal, search for the email message ID or subject to open the email entity page.. The email entity page in the Microsoft Defender XDR portal allows you to search by message ID or subject to view full email details including headers, attachments, and URLs. Option A is incorrect because the Threat analytics dashboard provides information about threats and attack patterns, not individual email details. Option B is incorrect because the user entity page shows user activity and alerts, not email details. Option D is incorrect because incident details provide alerts and evidence, but not the full email entity with headers and attachments.

Answer

Use the Threat analytics dashboard to find the email.

Answer

Go to the user entity page and view their email activity.

Answer

Open the incident related to the email and view the alert details.

Question 15

A security administrator needs a single console to investigate and respond to a complex incident involving alerts from endpoints, email, and identities. Which Microsoft portal should they use?

Accepted Answer

Microsoft 365 Defender portal. The Microsoft 365 Defender portal (security.microsoft.com) is the correct choice because it provides a unified incident management console that correlates alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. This allows the security administrator to investigate and respond to a complex incident spanning endpoints, email, and identities from a single pane of glass, leveraging automated investigation and response (AIR) capabilities.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Answer

Microsoft 365 compliance center