MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 16 — 15 Questions

Question 1

A user reports that they cannot access a legitimate external website because Microsoft Defender for Endpoint is blocking it. The website is required for business. What should you do to allow access while maintaining security?

Accepted Answer

Add the URL to the custom indicators allow list. Option C is correct because adding the URL to the custom indicator allows the site while keeping other protections. Option A is wrong because disabling network protection removes all URL filtering. Option B is wrong because allowing the site per user is not granular. Option D is wrong because excluding the device weakens security.

Answer

Exclude the device from the policy

Answer

Disable network protection for the device

Answer

Add the user to a custom group with lower security

Question 2

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos ticket request. You need to investigate the alert. Which log should you analyze in Microsoft Defender for Identity?

Accepted Answer

Network activities. Option D is correct because Kerberos ticket requests are captured as network activities. Option A is wrong because lateral movement paths show potential attack paths. Option B is wrong because entity profiles show user or machine details. Option C is wrong because security alerts are the alerts themselves, not the underlying data.

Answer

Lateral movement paths

Answer

Entity profile

Answer

Security alerts

Question 3

You are configuring Microsoft Defender for Office 365 anti-phish policy. You want to protect against user impersonation attacks. The CEO and CFO are frequent targets. What should you configure in the anti-phish policy?

Accepted Answer

Enable user impersonation protection and add the CEO and CFO as protected users. Option B is correct because user impersonation protection allows you to define specific users to protect. Option A is wrong because domain impersonation protects against domain spoofing. Option C is wrong because mailbox intelligence is for general impersonation detection. Option D is wrong because spoof intelligence is for domain spoofing.

Answer

Configure spoof intelligence

Answer

Add the CEO and CFO's domains to domain impersonation

Answer

Enable mailbox intelligence

Question 4

Your organization uses Microsoft Defender for Cloud Apps. You discover that a user is accessing a sanctioned cloud app from an unknown IP address. You want to require multi-factor authentication (MFA) for this access. What should you configure?

Accepted Answer

Create an access policy. Option A is correct because an access policy can require MFA based on conditions like IP address. Option B is wrong because session policies control real-time access but are for monitoring. Option C is wrong because app discovery policies identify apps. Option D is wrong because file policies control file sharing.

Answer

Create a file policy

Answer

Create a session policy

Answer

Create an app discovery policy

Question 5

You manage Microsoft Defender for Endpoint. A device is showing as 'Inactive' in the device inventory. The device is turned on and connected to the network. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Endpoint sensor is not reporting. Option D is correct because the sensor needs to communicate regularly; if not, the device shows inactive. Option A is wrong because the device is on. Option B is wrong because the firewall might block, but usually the sensor communication uses HTTPS. Option C is wrong because the onboarding script is only for initial setup.

Answer

The device is turned off

Answer

A firewall is blocking communication with the Microsoft Defender for Endpoint cloud service

Answer

The onboarding script was not run successfully

Question 6

You are designing an incident response plan using Microsoft Defender XDR. You want to automate the containment of compromised devices when a high-severity incident is detected. What should you configure?

Accepted Answer

Enable automated investigation and response (AIR) in Microsoft Defender XDR. Option C is correct because automated investigation and response (AIR) in Microsoft Defender XDR can automatically contain devices. Option A is wrong because playbooks in Microsoft Sentinel require manual triggering or separate automation. Option B is wrong because custom detection rules only create alerts. Option D is wrong because device groups are for management, not automation.

Answer

Configure custom detection rules in Microsoft Defender for Endpoint

Answer

Configure device groups in Microsoft Defender for Endpoint

Answer

Create a playbook in Microsoft Sentinel

Question 7

Which TWO actions can you perform in the Microsoft Defender XDR portal to investigate a security incident?

Accepted Answer

View the incident timeline. Options B and D are correct. Viewing the incident timeline shows the sequence of events, and reviewing impacted assets shows affected devices and users. Option A is wrong because you cannot reset passwords directly in Defender XDR. Option C is wrong because advanced hunting is a separate feature. Option E is wrong because creating mail flow rules is in Exchange admin center.

Answer

Run advanced hunting queries

Answer

Create mail flow rules

Answer

Reset user passwords

Question 8

Which THREE settings can you configure in a Microsoft Defender for Office 365 anti-phish policy?

Accepted Answer

Mailbox intelligence. Options B, C, and D are correct. Anti-phish policies include spoof intelligence, mailbox intelligence, and user impersonation protection. Option A is wrong because DKIM is configured in the domain's DNS. Option E is wrong because Safe Attachments is a separate policy.

Answer

Safe Attachments

Answer

DKIM signing

Question 9

Which TWO components are part of Microsoft Defender XDR?

Accepted Answer

Microsoft Defender for Office 365. Options A and D are correct. Microsoft Defender XDR includes Microsoft Defender for Endpoint and Microsoft Defender for Office 365. Option B is wrong because Microsoft Sentinel is a separate SIEM. Option C is wrong because Microsoft Purview is for compliance. Option E is wrong because Microsoft Intune is for device management.

Answer

Microsoft Purview

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Question 10

You are reviewing a Microsoft Defender for Cloud Apps policy JSON. What does this policy do?

Accepted Answer

Blocks sign-ins from anonymous proxy IP addresses. Option B is correct. The policy blocks sign-ins from anonymous proxy IP addresses. Option A is wrong because the filter is on IP address category, not location. Option C is wrong because it blocks sign-ins, not sessions. Option D is wrong because the action is Block, not alert.

Answer

Blocks sign-ins from a specific IP address range

Answer

Alerts when a sign-in occurs from an anonymous proxy

Answer

Blocks sign-ins from risky sessions based on user behavior

Question 11

You run the above KQL query in Microsoft Defender for Endpoint advanced hunting. What is the purpose of this query?

Accepted Answer

To identify the top 10 devices with the most suspicious process injection alerts. Option C is correct. The query summarizes by DeviceName and counts alerts, then returns top 10. Option A is wrong because it does not filter by severity. Option B is wrong because it does not list individual alerts. Option D is wrong because it does not correlate with other data.

Answer

To correlate device alerts with user activities

Answer

To list all devices with high severity alerts

Answer

To find the top 10 devices with the most alerts of any type

Question 12

You are a security administrator for a large enterprise with 10,000 users. The company uses Microsoft 365 E5 licenses, which include Microsoft Defender XDR. The company has recently experienced a series of ransomware attacks where attackers gained initial access through phishing emails, then moved laterally using compromised credentials, and finally deployed ransomware on file servers. The CISO wants to implement a comprehensive defense strategy that reduces the attack surface and automates response. The requirements are: 1) Prevent phishing emails from reaching users, especially those targeting executives. 2) Detect and block lateral movement using compromised credentials. 3) Automatically contain compromised devices during an incident. 4) Provide a unified incident view across email, endpoints, and identities. You need to recommend a solution that meets all requirements with minimal manual effort. What should you do?

Accepted Answer

Configure Microsoft Defender XDR by enabling Defender for Office 365 with anti-phish and impersonation protection, Defender for Identity, and Defender for Endpoint with automated investigation and response.. Option A is correct because Microsoft Defender XDR integrates Defender for Office 365 (for anti-phish with impersonation protection), Defender for Identity (for detecting lateral movement), Defender for Endpoint (for automatic containment), and provides a unified incident view. Option B is wrong because Microsoft Sentinel alone does not include all the required protections. Option C is wrong because Microsoft Purview is for compliance, not security. Option D is wrong because Microsoft Entra ID P2 lacks endpoint and email protection.

Answer

Use Microsoft Purview to classify and protect sensitive data, and configure data loss prevention policies to block ransomware.

Answer

Deploy Microsoft Sentinel and create analytics rules to detect phishing, lateral movement, and ransomware. Configure automated playbooks to contain devices.

Answer

Upgrade to Microsoft Entra ID P2 and enable Identity Protection for risky sign-ins and user risk. Use Conditional Access to block access from compromised devices.

Question 13

Contoso uses Microsoft 365 E5 and has enabled Microsoft Defender for Office 365. Users report that legitimate external emails are being quarantined. You need to reduce false positives without reducing protection. What should you do?

Accepted Answer

Configure Advanced Delivery for trusted senders from the external domain.. Option D is correct because configuring User Mailbox Advanced Delivery allows trusted senders to bypass filtering only for specific domains, reducing false positives while maintaining general protection. Option A is wrong because allowing all senders from the same domain weakens security. Option B is wrong because reducing the spam confidence level threshold increases false negatives. Option C is wrong because disabling third-party email filtering removes necessary protection.

Answer

Disable third-party email filtering integration.

Answer

Reduce the Spam Confidence Level (SCL) threshold in anti-spam policies.

Answer

Allow all emails from the sender's domain in the Tenant Allow/Block List.

Question 14

Your organization uses Microsoft Defender for Endpoint. A security analyst reports that a critical file was quarantined on several devices, but the file is a trusted application. You need to restore the file and prevent future false positives. What should you do?

Accepted Answer

Create a custom indicator for the file hash with the action 'Allow and alert'.. Option C is correct because adding an indicator for the file hash allows and alerts on the file, preventing future quarantines. Option A is wrong because adding the file to the trusted list in Windows Defender Firewall does not affect Defender for Endpoint. Option B is wrong because allowing the file in Microsoft Defender Antivirus does not prevent it from being blocked by cloud protection. Option D is wrong because excluding the file from real-time protection is a temporary workaround that can be bypassed.

Answer

Add the file to the allowed list in Microsoft Defender Antivirus exclusions.

Answer

Disable real-time protection on affected devices.

Answer

Add the file to the trusted list in Windows Defender Firewall.

Question 15

As a Microsoft 365 administrator, you need to ensure that sensitive data is not shared externally via email. You configure Data Loss Prevention (DLP) policies in Microsoft Purview. What is the primary purpose of a DLP policy?

Accepted Answer

Detect and prevent the sharing of sensitive information via email and other channels.. Option A is correct because DLP policies are designed to detect and prevent accidental or intentional sharing of sensitive information. Option B is wrong because email encryption is provided by Azure Information Protection or Office 365 Message Encryption. Option C is wrong because malware protection is handled by Defender for Office 365. Option D is wrong because DLP does not block all external emails.

Answer

Prevent users from sending any external email.

Answer

Block all inbound emails from untrusted domains.

Answer

Encrypt all outgoing emails automatically.