MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 17 — 15 Questions

Question 1

Your company uses Microsoft Defender for Cloud Apps. You notice that a user is downloading large amounts of data from a sanctioned cloud app from an unusual location. You need to automatically suspend the user's access when such activity is detected. What should you configure?

Accepted Answer

Configure a session policy in Defender for Cloud Apps.. Option B is correct because session policies in Defender for Cloud Apps can monitor and control user activities in real time and take actions like suspending access. Option A is wrong because access policies are for conditional access, not real-time session control. Option C is wrong because file policies govern file sharing, not user sessions. Option D is wrong because anomaly detection alerts but does not automatically suspend access.

Answer

Configure an access policy in Defender for Cloud Apps.

Answer

Configure a file policy in Defender for Cloud Apps.

Answer

Configure an anomaly detection alert in Defender for Cloud Apps.

Question 2

You are investigating a potential security incident in Microsoft Defender XDR. The incident involves a user who received a phishing email and clicked a link that executed a PowerShell script. You need to perform a detailed investigation of the PowerShell script's behavior across all affected devices. Which feature should you use?

Accepted Answer

Advanced hunting in Microsoft Defender XDR.. Option C is correct because advanced hunting in Microsoft Defender XDR allows you to query across devices, emails, and other data sources to investigate the script's execution and impact. Option A is wrong because Live Response is for real-time incident response on a single device. Option B is wrong because the Action Center is for reviewing pending actions. Option D is wrong because the Microsoft 365 Defender portal's device timeline shows events on one device only.

Answer

The Action Center in Microsoft Defender XDR.

Answer

Live Response from Microsoft Defender for Endpoint.

Answer

The device timeline in the Microsoft 365 Defender portal.

Question 3

Your organization uses Microsoft Defender for Office 365. You need to ensure that malicious links in email messages are blocked at the time of click by checking the link reputation in real time. What should you enable?

Accepted Answer

Safe Links policy.. Option A is correct because Safe Links in Defender for Office 365 rewrites URLs and checks them against a dynamic list of known malicious links at click time. Option B is wrong because Safe Attachments scans email attachments, not links. Option C is wrong because anti-phishing policies protect against phishing attempts but do not provide real-time link checking. Option D is wrong because anti-spam policies filter spam, not malicious links.

Answer

Anti-spam policy.

Answer

Safe Attachments policy.

Answer

Anti-phishing policy.

Question 4

You are a Microsoft 365 administrator. A user reports that they received a Microsoft Teams message from an external user containing a link to a malicious website. The user clicked the link but did not enter any credentials. You need to prevent similar incidents in the future. What should you configure?

Accepted Answer

Enable Safe Links for Microsoft Teams in Defender for Office 365.. Option D is correct because enabling Safe Links for Microsoft Teams in Defender for Office 365 provides time-of-click protection for links shared in Teams. Option A is wrong because blocking all external messages would hinder collaboration. Option B is wrong because Safe Attachments scans files, not links. Option C is wrong because anti-phishing policies for Teams are not available in the same way; Safe Links is the appropriate protection.

Answer

Configure a Teams messaging policy to block all messages from external users.

Answer

Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams.

Answer

Configure an anti-phishing policy to protect against impersonation in Teams.

Question 5

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos authentication attempt from a domain controller. You need to determine if the account was compromised by checking for lateral movement. What should you do in the Microsoft 365 Defender portal?

Accepted Answer

Review the identity timeline for the affected user account.. Option B is correct because the identity timeline in Defender for Identity shows the sequence of activities for a user, helping to identify lateral movement. Option A is wrong because the device timeline shows events on a device, not user identity activities across multiple devices. Option C is wrong because the incident graph shows related alerts but not the detailed user activity timeline. Option D is wrong because the advanced hunting schema for IdentityLogonEvents can be used, but the identity timeline is the most direct tool for investigating lateral movement.

Answer

Review the incident graph for the related alert.

Answer

Run an advanced hunting query for IdentityLogonEvents.

Answer

Review the device timeline for the domain controller.

Question 6

Your organization has Microsoft 365 E5 and uses Microsoft Defender for Cloud Apps. You want to block downloads from an unsanctioned cloud app that is used by some employees. What should you configure?

Accepted Answer

Configure the app as unsanctioned in Defender for Cloud Apps and create a session policy to block downloads.. Option A is correct because you can unsanction the app in Defender for Cloud Apps, which will block access and provide controls like session policies. Option B is wrong because blocking by IP address is not effective for cloud apps with dynamic IPs. Option C is wrong because a conditional access policy can require controls but does not directly block an unsanctioned app. Option D is wrong because a DLP policy protects data but does not block app usage.

Answer

Create a DLP policy to block sharing of sensitive data with the app.

Answer

Create a conditional access policy to require the use of managed apps.

Answer

Block the app by its IP addresses in the firewall.

Question 7

You are configuring Microsoft Defender for Office 365. Which TWO actions should you take to protect users from phishing attacks that use impersonation?

Accepted Answer

Configure anti-phishing policies to protect users from impersonation of custom domains.. Options B and D are correct because anti-phishing policies can protect against impersonation of users and domains. Option A is wrong because Safe Attachments is for file scanning. Option C is wrong because anti-spam policies are for spam, not impersonation. Option E is wrong because DLP protects sensitive data, not from phishing.

Answer

Create a data loss prevention (DLP) policy to prevent sharing of credentials.

Answer

Configure anti-spam policies to increase the spam confidence level.

Answer

Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams.

Question 8

You are investigating an incident in Microsoft Defender XDR. The incident involves multiple alerts from different sources. Which THREE actions should you take during the investigation?

Accepted Answer

Review the incident timeline to understand the sequence of events.. Options A, C, and D are correct because during investigation, you should analyze alerts, gather evidence, and isolate affected devices. Option B is wrong because immediately deleting all related emails may destroy evidence. Option E is wrong because resetting passwords should be done after analysis.

Answer

Delete all emails related to the incident from all mailboxes.

Answer

Reset the passwords of all user accounts involved.

Question 9

Your organization uses Microsoft Defender for Cloud Apps. You want to control the use of personal cloud storage apps. Which TWO actions should you take?

Accepted Answer

Create a session policy to monitor and control downloads to personal cloud storage apps.. Options A and D are correct because you can use app governance to control app permissions and session policies to monitor downloads. Option B is wrong because blocking all personal storage apps might be too restrictive and not granular. Option C is wrong because DLP policies do not control app usage. Option E is wrong because a conditional access policy can require app protection but does not directly control cloud app usage.

Answer

Create a DLP policy to prevent sharing of sensitive data to personal cloud storage apps.

Answer

Create a conditional access policy to require managed apps for cloud storage.

Answer

Block all personal cloud storage apps using Defender for Cloud Apps.

Question 10

You are configuring Microsoft Defender for Identity. Which THREE capabilities does it provide?

Accepted Answer

Detection of compromised accounts through behavioral analytics.. Options A, C, and E are correct because Defender for Identity provides detection of compromised accounts, lateral movement, and reconnaissance activities. Option B is wrong because email scanning is done by Defender for Office 365. Option D is wrong because DLP policies are in Microsoft Purview.

Answer

Scanning of email attachments for malware.

Answer

Creation of data loss prevention (DLP) policies.

Question 11

Refer to the exhibit. You are configuring a session policy in Microsoft Defender for Cloud Apps. The policy must block downloads when both the app risk is high and the user risk is high. Based on the exhibit, which additional condition should you add to ensure the policy only applies to unsanctioned apps?

Accepted Answer

Add a condition for app tag to be 'unsanctioned'.. Option D is correct because the policy currently applies to all apps with high risk; to limit to unsanctioned apps, you need to add a condition for the app tag. Option A is wrong because the policy already checks app risk score. Option B is wrong because the policy already checks user risk. Option C is wrong because the policy already checks the activity.

Answer

Add a condition for app risk score to be medium or low.

Answer

Add a condition for user risk score to be medium.

Answer

Add a condition for activity to include upload.

Question 12

You are the security administrator for a multinational organization using Microsoft 365 E5. The organization has 10,000 users across three regions: North America, Europe, and Asia. You have deployed Microsoft Defender for Endpoint on all Windows devices and enabled Microsoft Defender for Office 365. Recently, a sophisticated phishing campaign targeted executives in Europe, using a custom domain that closely resembles your legitimate domain (e.g., contoso.com vs. contos0.com). The emails bypassed anti-spam and anti-phishing policies. You need to configure protection to block these impersonation attempts without affecting legitimate emails from the actual domain. You must also ensure that any similar future attempts using different variations are automatically detected. What should you do?

Accepted Answer

Configure an anti-phishing policy to protect against impersonation of your domain, enabling the 'Protect against impersonation of domains I own' setting and adding your legitimate domain to the list of domains to protect.. Option C is correct because adding the legitimate domain to the impersonation protection list in anti-phishing policies will protect against variations, and the policy's intelligence will detect similar domains automatically. Option A is wrong because adding the spoofed domain to the Tenant Allow/Block List would block that specific domain but not future variations. Option B is wrong because a Safe Links policy does not protect against impersonation. Option D is wrong because a mailbox intelligence policy is for user-specific phishing detection, not domain impersonation.

Answer

Create a Safe Links policy with a block action for URLs containing 'contos0.com'.

Answer

Enable mailbox intelligence in anti-phishing policies to detect unusual sender behavior.

Answer

Add the spoofed domain 'contos0.com' to the Tenant Allow/Block List in the Defender for Office 365 portal.

Question 13

Your company uses Microsoft Defender for Endpoint and Microsoft Intune. You have a group of remote users who connect to the corporate network via VPN. Recently, several of these devices were compromised due to unpatched vulnerabilities. You need to ensure that devices that are missing critical security updates are automatically blocked from accessing corporate resources. The solution must integrate with Microsoft Defender for Endpoint's threat and vulnerability management (TVM) data. What should you configure?

Accepted Answer

Create a conditional access policy in Microsoft Entra ID that uses 'Require device to be marked as compliant' and integrate Defender for Endpoint's risk level to block devices with high risk.. Option A is correct because conditional access with device compliance policies can use Defender for Endpoint's risk level to block non-compliant devices. Option B is wrong because Intune compliance policies can mark devices as non-compliant, but the question requires using TVM data; conditional access can use the risk level from Defender for Endpoint. Option C is wrong because VPN configuration does not integrate with TVM data for automatic blocking. Option D is wrong because requiring all devices to be fully patched is not automatically enforceable without compliance policies.

Answer

Configure the VPN server to only allow devices that have the latest updates installed.

Answer

Create a Microsoft Defender for Endpoint device group and set the remediation level to 'block' for devices with critical vulnerabilities.

Answer

Configure a device compliance policy in Intune that requires all critical updates to be installed, and assign it to the VPN users group.

Question 14

Your organization uses Microsoft 365 E5 and has deployed Microsoft Defender for Cloud Apps. You discover that a user in the finance department is using a personal cloud storage app to store sensitive financial data. The app is unsanctioned. You need to prevent any further uploads of sensitive data to this app. Additionally, you want to automatically alert when users attempt to access this app from unmanaged devices. You must not block access entirely, as some users need to read data already stored there. What should you configure?

Accepted Answer

Create a session policy in Defender for Cloud Apps that blocks uploads for the unsanctioned app and requires conditional access app control for unmanaged devices.. Option A is correct because a session policy can monitor and control activities in the app, blocking uploads while allowing reads, and can apply conditional access for unmanaged devices. Option B is wrong because an access policy would block all access. Option C is wrong because a file policy does not control user sessions. Option D is wrong because app governance does not provide session-level controls.

Answer

Configure app governance in Defender for Cloud Apps to revoke the app's permissions.

Answer

Create an access policy in Defender for Cloud Apps that blocks all access to the app from unmanaged devices and blocks uploads from all devices.

Answer

Create a file policy in Defender for Cloud Apps that detects sensitive data and automatically applies a DLP label.

Question 15

Your organization uses Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps. You need to configure automated remediation for a confirmed phishing email that was delivered to a user's inbox. The remediation should also block the sender's domain across the tenant. Which action should you include in the automation playbook?

Accepted Answer

Create a playbook in Microsoft Defender XDR that triggers automated actions. Option B is correct because a playbook in Microsoft Defender XDR can trigger automatic remediation actions such as soft-deleting emails and blocking sender domains. Option A is wrong because attack simulation is for testing, not remediation. Option C is wrong because Safe Links policies protect links, not remediate delivered emails. Option D is wrong because data loss prevention policies focus on data classification, not email remediation.

Answer

Create an attack simulation training campaign for the affected user

Answer

Create a data loss prevention policy to classify the email as malicious

Answer

Configure a Safe Links policy to block the URL at click time