MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 16 — 15 Questions

Question 1

Which TWO actions can be performed by Microsoft Defender for Identity? (Select TWO.)

Accepted Answer

Monitor domain controller activities and behavior.. Microsoft Defender for Identity is a cloud-based security solution that uses on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions. It monitors domain controller activities and security events to detect suspicious behavior (Option B). It also identifies lateral movement paths by analyzing network activities and user behavior to find potential attack paths (Option C). Option A is incorrect because managing firewall rules on endpoints is not a function of Defender for Identity; that is typically done by Microsoft Defender for Endpoint. Option D is incorrect because real-time file scanning is performed by Microsoft Defender Antivirus, not Defender for Identity. Option E is incorrect because blocking sign-ins from malicious IPs is handled by Microsoft Entra Conditional Access or Identity Protection, not Defender for Identity.

Answer

Manage firewall rules on endpoints.

Answer

Scan files for malware in real time.

Answer

Block sign-in attempts from malicious IP addresses.

Question 2

Which THREE features are part of Microsoft Defender XDR? (Select THREE.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender XDR is a unified security solution that integrates signals from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and others. The correct answers are B, C, and E. Option A (Microsoft Purview) is a data governance and compliance solution, not part of Defender XDR. Option D (Microsoft Sentinel) is a separate cloud-native SIEM and SOAR solution.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Question 3

A company experiences a ransomware attack that encrypts files on several endpoints. The security team wants to use automated investigation and response (AIR) capabilities in Microsoft Defender XDR to contain the threat. Which TWO actions can be taken automatically by AIR? (Select TWO.)

Accepted Answer

Remove malicious files detected by Defender for Endpoint.. Option B is correct because Microsoft Defender XDR's automated investigation and response (AIR) can automatically remediate endpoint threats by quarantining or removing malicious files that Defender for Endpoint detects during an investigation. Option C is correct because AIR can automatically isolate an affected device from the network to prevent lateral movement and further compromise while the investigation proceeds. Option A is not an AIR action in this context; blocking a sender's email domain is a manual or policy-driven action in Defender for Office 365, not an automatic endpoint containment response. Option D is incorrect because disabling user accounts is an identity protection action typically performed manually or via Microsoft Entra ID Protection, not an automatic AIR containment step. Option E is also incorrect because password resets are identity remediation actions handled through Microsoft Entra ID, not automated endpoint containment by AIR.

Answer

Block the sender's email domain in Defender for Office 365.

Answer

Disable user accounts associated with the attack.

Answer

Reset user passwords for affected accounts.

Question 4

An administrator deployed the above Intune device configuration policy for Microsoft Defender for Endpoint on Windows 10 devices. Users report that some potentially unwanted applications (PUA) are still being installed. What is the most likely cause?

Accepted Answer

The PUAProtection setting is in AuditMode and not blocking PUAs.. The PUAProtection setting in the Defender for Endpoint Intune policy has three modes: Off, AuditMode, and Enabled (Block). AuditMode only logs detections without blocking, so PUAs continue to install. To actually block PUAs, the setting must be set to 'Enabled' (Block), not AuditMode.

Answer

The cloud timeout value is too low, causing PUA detection to fail.

Answer

Cloud-delivered protection is set to High level, which does not affect PUAs.

Answer

Real-time monitoring is disabled.

Question 5

A security analyst runs the above KQL query in Microsoft 365 Defender. The query returns an empty result set. Which is the most likely reason?

Accepted Answer

No antivirus detection events for files with 'ransomware' or 'encrypt' in the filename occurred in the last 7 days.. The KQL query filters DeviceEvents for antivirus detection events where the filename contains 'ransomware' or 'encrypt' within the last 7 days. An empty result set simply means no such events matched the filter criteria during that period — this is a normal, expected outcome when no ransomware-like files were detected, not an error condition. The query syntax and table are valid; the absence of data is the answer.

Answer

The time range is too wide and the query times out.

Answer

The 'has_any' operator is used incorrectly; it should be 'contains' for each condition.

Answer

The DeviceEvents table does not contain antivirus detection events.

Question 6

A security administrator wants to review email messages that were blocked due to a malware detection in Microsoft Defender for Office 365. Which report should they use?

Accepted Answer

Threat Protection Status report. The Threat Protection Status report in Microsoft Defender for Office 365 provides details on email messages blocked due to malware, phishing, or other threats. It includes data on detections by type and allows administrators to review blocked messages. The Submissions report is for user/admin submissions of suspicious email, the Spoof intelligence report covers spoofing, and the Mailflow map report visualizes mail flow, not blocked malware messages.

Answer

Submissions report

Answer

Spoof intelligence report

Answer

Mailflow map report

Question 7

A company uses Microsoft Defender for Cloud Apps to monitor cloud app usage. They want to receive alerts when a user downloads a large number of files from SharePoint Online in a short time, which could indicate data exfiltration. What should they configure?

Accepted Answer

Activity policy. (Activity policy) is correct because activity policies allow you to monitor specific activities like mass download from SharePoint Online and trigger alerts. Option A (Session policy) is used to control access in real-time, not for alerting on historical activity. Option B (Anomaly detection policy) detects unusual user behavior but is less specific to a defined threshold of file downloads. Option C (File policy) focuses on file sharing and external sharing policies, not download volume. Therefore, an activity policy is the best choice for configuring alerts on large file downloads indicating data exfiltration.

Answer

Session policy

Answer

Anomaly detection policy

Answer

File policy

Question 8

A company wants to use Microsoft Defender XDR to automatically investigate and remediate threats across email, endpoints, and identities. Which role is required to configure automation settings in the Microsoft 365 Defender portal?

Accepted Answer

Security Administrator. The Security Administrator role in Microsoft Entra ID (Azure AD) grants the permissions needed to configure automation settings, including automated investigation and remediation (AIR) policies, in the Microsoft 365 Defender portal. This role is purpose-built for managing security features across Defender workloads without granting full tenant administrative rights.

Answer

Global Reader

Answer

Compliance Administrator

Answer

Security Reader

Question 9

A company uses Microsoft Defender for Office 365. They want to ensure that users cannot ignore warning messages when clicking on a malicious link in an email. What should they configure?

Accepted Answer

Configure a Safe Links policy with 'Do not allow users to click through to original URL' selected.. Safe Links policies include a setting 'Do not allow users to click through to the original URL' (or 'Block the following URLs' / 'Let users click through to the original URL' toggles). Selecting the option to prevent click-through ensures users cannot bypass the warning page and reach a malicious link. This is the direct control for the requirement.

Answer

Configure the anti-phishing policy with 'Impersonation protection' enabled.

Answer

Enable the 'Anti-malware' policy with 'Common attachments filter'.

Answer

Configure a Safe Attachments policy with 'Block' action.

Question 10

Your organization uses Microsoft Defender for Office 365. You need to ensure that all email messages containing encrypted attachments are automatically scanned for malware before delivery. What should you configure?

Accepted Answer

Safe Attachments policy. Safe Attachments policy can be configured to scan encrypted attachments. Option B is wrong because it is for scanning URLs in emails. Option C is wrong because the anti-malware policy handles malware detection but does not specifically address encrypted attachments. Option D is wrong because the anti-spam policy is designed to filter spam, not to scan attachments for malware.

Answer

Safe Links policy with URL scanning

Answer

Anti-malware policy

Answer

Anti-spam policy

Question 11

You are a security administrator. You need to configure a policy that automatically blocks sign-ins from anonymous IP addresses for all users in your Microsoft 365 tenant. Which policy should you configure in Microsoft Entra ID?

Accepted Answer

Conditional Access policy with sign-in risk condition. Anonymous IP address sign-ins are a sign-in risk detection in Microsoft Entra ID Protection. To automatically block them for all users, you configure a Conditional Access policy that targets All users and uses the sign-in risk condition set to High (or the specific 'Anonymous IP address' risk), with the access control set to Block. Sign-in risk evaluates the authentication attempt itself, which is exactly what anonymous IP represents.

Answer

Password protection policy

Answer

Conditional Access policy with user risk condition

Answer

Identity Protection user risk policy

Question 12

You are configuring Microsoft Defender for Identity to monitor on-premises Active Directory. You need to ensure that honeytoken accounts are configured to detect attackers attempting to use them. What is a honeytoken account?

Accepted Answer

A fake user account created to attract attackers. A honeytoken account is a fake user account created to lure attackers. When an attacker tries to use it, Defender for Identity triggers an alert. Option A is incorrect because honeytoken accounts are not real service accounts. Option B is incorrect because they are not necessarily disabled; they can be enabled but with no real privileges. Option D is incorrect because they are not real high-privilege accounts, but fake decoys.

Answer

A service account used for application authentication

Answer

A disabled user account that cannot be used for sign-in

Answer

A real user account with high privileges used for monitoring

Question 13

Your organization uses Microsoft 365 Defender. You need to configure automated investigation and response (AIR) to automatically remediate high-confidence phishing emails. What should you configure?

Accepted Answer

Automated investigation and response for email. Automated investigation and response (AIR) for email in Microsoft 365 Defender automatically investigates and remediates phishing emails, including high-confidence detections. Configuring AIR for email enables the system to take remediation actions like soft-deleting messages, blocking senders, and removing malicious content without manual intervention.

Answer

Automated investigation and response for collaboration content

Answer

Automated investigation and response for identities

Answer

Automated investigation and response for devices

Question 14

You are hunting for malicious activity in Microsoft 365 Defender. The exhibit shows a KQL query. What is the query searching for?

Accepted Answer

PowerShell processes with encoded command line arguments. The KQL query filters PowerShell process creation events where the command line contains encoded command indicators such as '-enc', '-EncodedCommand', or Base64-looking strings. This pattern is a classic detection for obfuscated PowerShell used by attackers to hide malicious scripts from casual inspection and simple string-based defenses.

Answer

PowerShell processes with standard command line arguments

Answer

Processes that created PowerShell processes

Answer

PowerShell processes that were downloaded from the internet

Question 15

Your company has deployed Microsoft Defender for Endpoint on all Windows devices. You are investigating an alert for a suspicious PowerShell command that was blocked by Attack Surface Reduction (ASR) rules. The alert shows the command was executed from a script embedded in a Word document. You need to identify the ASR rule that blocked this activity. Which rule is most likely responsible?

Accepted Answer

Block Office applications from creating child processes. The ASR rule 'Block Office applications from creating child processes' is designed to stop Office apps (Word, Excel, PowerPoint) from spawning processes like powershell.exe, cmd.exe, or wscript.exe. A malicious macro in a Word document that launches PowerShell is the textbook trigger for this rule, which is why it is the most likely blocker.

Answer

Block Office applications from making Win32 API calls

Answer

Block Office applications from injecting code into other processes

Answer

Block Office applications from creating executable content