MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 15 — 15 Questions

Question 1

A user reports that they are unable to access a file in SharePoint Online. You check the audit log and see that the file was quarantined by Microsoft Defender for Office 365. What is the most likely reason?

Accepted Answer

The file was detected as malware by Safe Attachments.. Option C is correct because Defender for Office 365 can quarantine files that are detected as malicious by Safe Attachments. Option A is wrong because DLP policies block sharing, but do not quarantine files. Option B is wrong because retention policies do not quarantine. Option D is wrong because versioning does not cause quarantine. Option E is wrong because sensitivity labels classify, not quarantine.

Answer

The file was overwritten by a previous version.

Answer

The file has a retention policy that moved it to the Preservation Hold library.

Answer

The file was labeled as highly confidential by Microsoft Purview Information Protection.

Answer

The file contains sensitive information and triggered a Data Loss Prevention (DLP) policy.

Question 2

You are a security administrator. You need to investigate a suspicious logon from an anonymous IP address. Which Microsoft Defender XDR data source should you query first?

Accepted Answer

Identity and authentication events. Option B is correct because Identity and authentication events are the primary source for logon investigations in Defender XDR. Option A is wrong because email events are for phishing. Option C is wrong because endpoint events are for device-level activities. Option D is wrong because cloud app events are for app usage. Option E is wrong because vulnerability data is for device vulnerabilities.

Answer

Cloud app events

Answer

Endpoint device events

Answer

Vulnerability and compliance events

Answer

Email & collaboration events

Question 3

Your organization uses Microsoft Defender for Identity (MDI) and Microsoft Defender for Cloud Apps. You receive an alert about a user who is performing an unusual number of failed logon attempts from a non-corporate IP address. The user is a member of the Finance group. What is the recommended first step?

Accepted Answer

Contact the user to verify if the activity is legitimate.. Option D is correct because the first step is to verify with the user whether the activity is legitimate before taking any action. Option A is wrong because immediately disabling the account may cause unnecessary disruption. Option B is wrong because resetting password without verification may not be necessary. Option C is wrong because blocking the IP may be premature. Option E is wrong because closing the alert without investigation is not appropriate.

Answer

Reset the user's password and require MFA.

Answer

Disable the user account immediately.

Answer

Block the IP address in the firewall.

Answer

Close the alert as a false positive.

Question 4

Your organization has Microsoft Defender for Office 365 Plan 2. You want to set up a policy that automatically moves messages containing malware to quarantine and notifies the security team. Which policy should you configure?

Accepted Answer

Safe Attachments policy. Option A is correct because Safe Attachments policy is specifically designed to handle email attachments with malware. Option B is wrong because Anti-Phishing policy deals with phishing attempts. Option C is wrong because Anti-Spam policy handles spam and bulk mail. Option D is wrong because DMARC policy handles email authentication. Option E is wrong because DKIM policy is for signing emails.

Answer

DKIM policy

Answer

DMARC policy

Answer

Anti-Spam policy

Answer

Anti-Phishing policy

Question 5

You are configuring Microsoft Defender for Cloud Apps to detect anomalous behavior. You need to set up a policy that triggers an alert when a user downloads more than 100 files from SharePoint Online in 10 minutes. Which policy template should you use?

Accepted Answer

Activity from anonymous IP addresses. Option B is correct because the 'Activity from anonymous IP addresses' template is used to detect unusual download volumes. Option A is wrong because 'Impossible travel' is for geographic anomalies. Option C is wrong because 'Unusual file sharing' is for sharing to external users. Option D is wrong because 'Malware detection' is for malware. Option E is wrong because 'Ransomware detection' is for ransomware.

Answer

Impossible travel

Answer

Malware detection

Answer

Ransomware detection

Answer

Unusual file sharing by user

Question 6

You run the KQL query in Microsoft Defender XDR. The query returns a list of users who logged into Exchange Online more than 10 times in the last day from a single IP address. However, you notice that some IP addresses are internal corporate IPs. What should you add to the query to focus on suspicious logons from external IPs?

Accepted Answer

Add a line: | where IPAddress !startswith "10.". Option C is correct because the query should filter by an IP range that excludes internal corporate IPs. Option A is wrong because filtering by Application would not exclude internal IPs. Option B is wrong because summarizing by Application is unnecessary. Option D is wrong because filtering by TotalLogons > 10 already exists. Option E is wrong because sorting does not exclude internal IPs.

Answer

Add a line: | where Application == "Outlook Web App"

Answer

Add a line: | summarize by Application

Answer

Add a line: | where TotalLogons > 50

Answer

Add a line: | sort by TotalLogons desc

Question 7

You are reviewing a Conditional Access policy in Microsoft Entra ID. The policy is intended to block access to Exchange Online for users with high risk level. However, users with high risk are still able to access Exchange Online. What is the most likely cause?

Accepted Answer

The policy is set to report-only mode.. Option B is correct because the policy is in report-only mode, which does not enforce block. Option A is wrong because the risk level is correctly set to high. Option C is wrong because the grant control is block, not require MFA. Option D is wrong because the policy includes Exchange Online. Option E is wrong because the policy includes all users.

Answer

The policy does not include Exchange Online.

Answer

The policy excludes the affected users.

Answer

The policy is targeting low risk instead of high risk.

Answer

The grant control is set to require multi-factor authentication.

Question 8

You are configuring a network security policy in Microsoft Defender for Cloud Apps. The exhibit shows a policy to block traffic from known Tor exit nodes. However, the policy is not blocking traffic from IP 185.220.101.5. What is the most likely reason?

Accepted Answer

Another policy with a higher priority is allowing the traffic.. Option D is correct because the policy order must be set to a higher priority (lower number) to be evaluated first. Option A is wrong because the IP is within the range. Option B is wrong because the action is AlertAndBlock. Option C is wrong because the protocol is Any. Option E is wrong because the source address condition is correct.

Answer

The action is set to Alert only, not block.

Answer

The IP address is not in the specified subnet.

Answer

The protocol condition is too restrictive.

Answer

The source address condition is missing a wildcard.

Question 9

Your organization uses Microsoft Defender for Office 365 and Microsoft Defender for Endpoint. A user receives an email with a link that leads to a malicious website. The user clicks the link, but the browser is protected by Microsoft Defender SmartScreen. However, the user is still able to download a file from the site. What should you configure to prevent this?

Accepted Answer

Enable Safe Links in Microsoft Defender for Office 365.. Option A is correct because Safe Links protects users by scanning URLs in emails and blocking malicious links at time of click. Option B is wrong because Safe Attachments is for email attachments, not links. Option C is wrong because Anti-Phishing policies deal with impersonation. Option D is wrong because Attack Surface Reduction rules apply to processes, not web downloads. Option E is wrong because network protection blocks connections to malicious IPs, but the download may occur if the site is allowed.

Answer

Enable Attack Surface Reduction rules.

Answer

Enable network protection in Microsoft Defender for Endpoint.

Answer

Enable Safe Attachments in Microsoft Defender for Office 365.

Answer

Configure an Anti-Phishing policy.

Question 10

You are configuring Microsoft Defender for Identity (MDI) to monitor for lateral movement attacks. Which of the following activities would MDI alert on as a potential lateral movement?

Accepted Answer

A user logging into multiple servers using a compromised account.. Option D is correct because using a compromised account to connect to multiple machines is a classic lateral movement technique. Option A is wrong because brute force is a separate attack. Option B is wrong because privilege escalation is different. Option C is wrong because DCSync is a domain replication attack. Option E is wrong because password spray is a type of brute force.

Answer

A user performing a DCSync attack.

Answer

A user conducting a password spray attack.

Answer

A user executing a privilege escalation tool on their workstation.

Answer

A user performing a brute force attack on a domain controller.

Question 11

Your organization uses Microsoft Defender XDR. You want to create a custom detection rule that triggers an alert when a specific process is created on multiple endpoints. Which advanced hunting table should you use?

Accepted Answer

DeviceProcessEvents. Option A is correct because DeviceProcessEvents contains process creation events. Option B is wrong because DeviceNetworkEvents is for network connections. Option C is wrong because DeviceFileEvents is for file operations. Option D is wrong because DeviceLogonEvents is for logon events. Option E is wrong because DeviceRegistryEvents is for registry changes.

Answer

DeviceNetworkEvents

Answer

DeviceFileEvents

Answer

DeviceLogonEvents

Answer

DeviceRegistryEvents

Question 12

Your organization is using Microsoft Defender for Cloud Apps. You want to generate an alert when a user shares a file containing sensitive information with an external domain. You have configured a file policy with the condition: 'Inspection method: Data Classification Service' and 'Inspection type: Sensitive information type'. However, no alerts are triggered. What is the most likely reason?

Accepted Answer

The sensitive information type is not correctly configured in the data classification service.. Option D is correct because the Data Classification Service requires a Microsoft Purview Information Protection (MIP) scanner or label to be applied. Option A is wrong because the policy applies to all apps, not just one. Option B is wrong because external sharing can be detected. Option C is wrong because user log is not required. Option E is wrong because file size is not a limiting factor.

Answer

The file is shared with an internal user only.

Answer

The policy is not applied to the specific cloud app.

Answer

The file size is too large for inspection.

Answer

The user is not licensed for Microsoft Defender for Cloud Apps.

Question 13

Your organization uses Microsoft Defender for Office 365. Users report that some phishing emails are still reaching inboxes despite the anti-phish policy being enabled. You need to reduce the number of phishing emails that bypass the filter. What should you configure?

Accepted Answer

Configure spoof intelligence in the anti-phish policy. Option B is correct because spoof intelligence allows you to analyze and block spoofed senders. Option A is wrong because Safe Attachments scans attachments, not the email body. Option C is wrong because Tenant Allow/Block List is for manual overrides. Option D is wrong because DKIM is an authentication method, not a filtering setting.

Answer

Add the phishing domains to the Tenant Allow/Block List

Answer

Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams

Answer

Enable DKIM signing for your custom domains

Question 14

You manage a Microsoft Defender for Endpoint environment. A device onboarded to Defender for Endpoint is not reporting alerts. You run the Microsoft Defender for Endpoint client analyzer and see that the service is running. Which log should you review to troubleshoot the issue?

Accepted Answer

Microsoft Defender for Endpoint sensor logs located in %ProgramData%\Microsoft\Windows Defender Advanced Threat Protection\Datamart. Option C is correct because the Microsoft Defender for Endpoint sensor logs contain detailed information about the sensor's communication with the cloud. Option A is wrong because Windows Event Logs may not contain sensor-specific errors. Option B is wrong because Microsoft 365 Defender portal logs are cloud-side. Option D is wrong because Network Protection logs are for network filtering.

Answer

Network Protection logs in %ProgramData%\Microsoft\Windows Defender\NIS

Answer

Microsoft 365 Defender portal audit log

Answer

Windows Event Log (Applications and Services Logs/Microsoft/Windows/Defender)

Question 15

Your organization has deployed Microsoft Defender for Cloud Apps. You want to detect anomalous behavior such as impossible travel for users accessing cloud apps. You need to configure the appropriate policy. Which policy type should you create?

Accepted Answer

Activity policy. Option A is correct because activity policies can detect anomalies like impossible travel. Option B is wrong because file policies monitor file sharing. Option C is wrong because app discovery policies discover shadow IT. Option D is wrong because session policies control real-time access.

Answer

App discovery policy

Answer

Session policy

Answer

File policy