MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 18 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Office 365. Users report that legitimate emails from a specific partner domain are being moved to Junk Email folder. You verify that the partner's SPF, DKIM, and DMARC records are correctly configured. Which two actions should you take to resolve this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the Anti-Phishing policy's spoof intelligence settings.. Legitimate emails from a partner domain are being moved to Junk Email folder despite correct SPF, DKIM, and DMARC records. This typically indicates that the emails are being misclassified as spoofed or phishing. Reviewing the Anti-Phishing policy's spoof intelligence settings (Option B) allows you to check if the partner domain is being incorrectly treated as a spoof sender and adjust the settings accordingly. Additionally, adding the partner domain to the Tenant Allow/Block List as an allowed domain (Option E) explicitly permits emails from that domain, overriding any false positive filtering. Option A (increasing spam threshold) may reduce spam filtering effectiveness and does not address the root cause. Option C (Outbound spam filter policy) affects outgoing emails, not inbound. Option D (disabling spam filter) is too aggressive and removes protection for the affected users. Therefore, the correct actions are B and E.

Answer

Modify the Anti-Spam policy to increase the spam threshold.

Answer

Configure the Outbound spam filter policy.

Answer

Disable the Spam filter for the affected users.

Question 2

A user reports that they are unable to access a file in SharePoint Online. You check the audit log and see that the file was quarantined by Microsoft Defender for Office 365. What is the most likely reason?

Accepted Answer

The file was detected as malware by Safe Attachments.. Microsoft Defender for Office 365 uses Safe Attachments to detect and quarantine malicious files in SharePoint Online. Option A is wrong because overwriting by a previous version does not trigger quarantine. Option C is wrong because retention policies move files to Preservation Hold library, not quarantine. Option D is wrong because sensitivity labels classify files but do not quarantine them. Option E is wrong because DLP policies block sharing or apply protections, but do not quarantine files.

Answer

The file was overwritten by a previous version.

Answer

The file has a retention policy that moved it to the Preservation Hold library.

Answer

The file was labeled as highly confidential by Microsoft Purview Information Protection.

Answer

The file contains sensitive information and triggered a Data Loss Prevention (DLP) policy.

Question 3

You are a security administrator. You need to investigate a suspicious logon from an anonymous IP address. Which Microsoft Defender XDR data source should you query first?

Accepted Answer

Identity and authentication events. A suspicious logon from an anonymous IP address is an identity and authentication event. Microsoft Defender XDR's Identity and authentication events data source includes sign-in logs, authentication attempts, and related identity activities. Querying this source first will provide details such as the user account, IP address, location, and success/failure status, which are crucial for investigating the logon.

Answer

Cloud app events

Answer

Endpoint device events

Answer

Vulnerability and compliance events

Answer

Email & collaboration events

Question 4

Your organization uses Microsoft Defender for Office 365. Users report that legitimate emails from a specific partner domain are being moved to Junk Email folder. You verify that the partner's SPF, DKIM, and DMARC records are correctly configured. Which two actions should you take to resolve this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Contact the user to verify if the activity is legitimate.. When an alert indicates unusual failed logon attempts from a non-corporate IP address, the recommended first step is to contact the user to verify if the activity is legitimate. This follows the principle of verification before action, as the activity could be due to a forgotten password or a misconfigured application. Option B is correct. Option A (resetting password and requiring MFA) is premature without verification, as it may disrupt legitimate access. Option C (disabling the account) could be too disruptive and should only be done after confirming malicious intent. Option D (blocking the IP) might block legitimate users or shared IPs. Option E (closing as false positive) skips investigation and could miss a real threat.

Answer

Reset the user's password and require MFA.

Answer

Disable the user account immediately.

Answer

Block the IP address in the firewall.

Answer

Close the alert as a false positive.

Question 5

You are configuring Microsoft Defender for Identity (MDI) to monitor for lateral movement attacks. Which of the following activities would MDI alert on as a potential lateral movement?

Accepted Answer

A user logging into multiple servers using a compromised account.. Microsoft Defender for Identity (MDI) can detect lateral movement when a compromised account is used to log into multiple servers, which indicates an attacker moving laterally within the network. Option B is incorrect because DCSync is a domain replication attack that targets the domain controller to extract credentials, not lateral movement. Option C is incorrect because password spray is a type of brute force attack that tries common passwords against many accounts, not lateral movement. Option D is incorrect because executing a privilege escalation tool on a workstation is a local privilege escalation attempt, not lateral movement between systems. Option E is incorrect because brute force attacks on a domain controller are authentication attacks, not lateral movement.

Answer

A user performing a DCSync attack.

Answer

A user conducting a password spray attack.

Answer

A user executing a privilege escalation tool on their workstation.

Answer

A user performing a brute force attack on a domain controller.

Question 6

Your organization uses Microsoft Defender XDR. You want to create a custom detection rule that triggers an alert when a specific process is created on multiple endpoints. Which advanced hunting table should you use?

Accepted Answer

DeviceProcessEvents. DeviceProcessEvents. This table captures process creation events, which is the required data for a detection rule on a specific process being created.

Option A (DeviceNetworkEvents) is incorrect because it logs network connections, not process creation. 
Option B (DeviceFileEvents) is incorrect because it logs file operations. 
Option C (DeviceLogonEvents) is incorrect because it logs logon events. 
Option D (DeviceRegistryEvents) is incorrect because it logs registry changes.

Answer

DeviceNetworkEvents

Answer

DeviceFileEvents

Answer

DeviceLogonEvents

Answer

DeviceRegistryEvents

Question 7

Your organization has deployed Microsoft Defender for Cloud Apps. You want to detect anomalous behavior such as impossible travel for users accessing cloud apps. You need to configure the appropriate policy. Which policy type should you create?

Accepted Answer

Activity policy. Activity policies in Microsoft Defender for Cloud Apps are designed to monitor user activity across cloud apps and trigger alerts or governance actions on anomalous behavior, including impossible travel, suspicious IP addresses, and unusual file downloads. Creating an activity policy with the 'Impossible travel' template directly detects the scenario described. This is the correct policy type for behavioral anomaly detection.

Answer

App discovery policy

Answer

Session policy

Answer

File policy

Question 8

A user reports that they cannot access a legitimate external website because Microsoft Defender for Endpoint is blocking it. The website is required for business. What should you do to allow access while maintaining security?

Accepted Answer

Add the URL to the custom indicators allow list. Adding the URL to the custom indicators allow list in Microsoft Defender for Endpoint allows the specific URL while maintaining network protection for all other traffic. This is the granular approach to permit a legitimate business site without disabling security controls. The allow list overrides block actions for that indicator.

Answer

Exclude the device from the policy

Answer

Disable network protection for the device

Answer

Add the user to a custom group with lower security

Question 9

You are configuring Microsoft Defender for Office 365 anti-phish policy. You want to protect against user impersonation attacks. The CEO and CFO are frequent targets. What should you configure in the anti-phish policy?

Accepted Answer

Enable user impersonation protection and add the CEO and CFO as protected users. User impersonation protection in anti-phish policies allows you to add specific users (e.g., CEO and CFO) as protected users. This protects against attacks where an attacker impersonates those users. Option A is incorrect because spoof intelligence protects against domain spoofing, not user impersonation. Option B is incorrect because domain impersonation protects against impersonation of entire domains, not individual users. Option D is incorrect because mailbox intelligence is a feature that learns user communication patterns to detect impersonation, but it is not the configuration to protect specific users.

Answer

Configure spoof intelligence

Answer

Add the CEO and CFO's domains to domain impersonation

Answer

Enable mailbox intelligence

Question 10

Your organization uses Microsoft Defender for Office 365. Users report that legitimate emails from a specific partner domain are being moved to Junk Email folder. You verify that the partner's SPF, DKIM, and DMARC records are correctly configured. Which two actions should you take to resolve this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an access policy. An access policy in Microsoft Defender for Cloud Apps can enforce conditional access controls, such as requiring multi-factor authentication (MFA), based on conditions like IP address. Option A is incorrect because file policies govern file sharing and cannot enforce MFA. Option C is incorrect because session policies monitor and control user activity in real time but do not directly enforce MFA. Option D is incorrect because app discovery policies identify shadow IT and do not control access conditions.

Answer

Create a file policy

Answer

Create a session policy

Answer

Create an app discovery policy

Question 11

You are designing an incident response plan using Microsoft Defender XDR. You want to automate the containment of compromised devices when a high-severity incident is detected. What should you configure?

Accepted Answer

Enable automated investigation and response (AIR) in Microsoft Defender XDR. C is correct because automated investigation and response (AIR) in Microsoft Defender XDR can automatically contain devices when a high-severity incident is detected. A is incorrect because custom detection rules in Microsoft Defender for Endpoint only create alerts; they do not automatically contain devices. B is incorrect because device groups are used for management and policy assignment, not for automated containment. D is incorrect because playbooks in Microsoft Sentinel require manual triggering or other automation; they are not configured within Defender XDR.

Answer

Configure custom detection rules in Microsoft Defender for Endpoint

Answer

Configure device groups in Microsoft Defender for Endpoint

Answer

Create a playbook in Microsoft Sentinel

Question 12

Which THREE settings can you configure in a Microsoft Defender for Office 365 anti-phish policy?

Accepted Answer

Mailbox intelligence. Mailbox intelligence (A) is a configurable setting in an anti-phish policy that uses a user's past communication patterns to detect impersonation attempts. User impersonation protection (D) is also configured in anti-phish policies, allowing you to protect specific internal or external senders from impersonation. Spoof intelligence (E) is a configurable setting in anti-phish policies that controls how the service handles senders who spoof domains you don't own. Safe Attachments (B) is a separate Defender for Office 365 policy (Safe Attachments policy), not a setting within an anti-phish policy. DKIM signing (C) is configured via DNS and Exchange Online mail flow settings, not within an anti-phish policy.

Answer

Safe Attachments

Answer

DKIM signing

Question 13

Which TWO components are part of Microsoft Defender XDR?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender XDR is a unified extended detection and response suite that natively correlates signals across Microsoft's first-party security workloads, and Microsoft Defender for Office 365 (option A) is one of its core pillars, delivering protection against phishing, malware, and business email compromise across Exchange Online, Teams, and SharePoint/OneDrive. Microsoft Defender for Endpoint (option C) is likewise a native Defender XDR component, providing endpoint detection and response, attack surface reduction, and automated investigation and remediation that feed into the unified incident queue. By contrast, Microsoft Purview (option B) is a separate compliance and data-governance solution family (information protection, DLP, eDiscovery), Microsoft Intune (option D) is the cloud-based endpoint management/MDM service in the Microsoft Intune family, and Microsoft Sentinel (option E) is a standalone cloud-native SIEM/SOAR product that integrates with Defender XDR but is not itself one of its constituent workloads.

Answer

Microsoft Purview

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Question 14

You are a security administrator for a large enterprise with 10,000 users. The company uses Microsoft 365 E5 licenses, which include Microsoft Defender XDR. The company has recently experienced a series of ransomware attacks where attackers gained initial access through phishing emails, then moved laterally using compromised credentials, and finally deployed ransomware on file servers. The CISO wants to implement a comprehensive defense strategy that reduces the attack surface and automates response. The requirements are: 1) Prevent phishing emails from reaching users, especially those targeting executives. 2) Detect and block lateral movement using compromised credentials. 3) Automatically contain compromised devices during an incident. 4) Provide a unified incident view across email, endpoints, and identities. You need to recommend a solution that meets all requirements with minimal manual effort. What should you do?

Accepted Answer

Configure Microsoft Defender XDR by enabling Defender for Office 365 with anti-phish and impersonation protection, Defender for Identity, and Defender for Endpoint with automated investigation and response.. It leverages the native Microsoft Defender XDR suite, which directly addresses all four requirements: Defender for Office 365 with anti-phish and impersonation protection prevents phishing emails (requirement 1); Defender for Identity detects lateral movement using compromised credentials by monitoring on-premises Active Directory signals (requirement 2); Defender for Endpoint with automated investigation and response automatically contains compromised devices (requirement 3); and the integrated Defender XDR portal provides a unified incident view across email, endpoints, and identities (requirement 4). This solution requires minimal manual effort because the components are natively integrated and automation is built-in.

Answer

Use Microsoft Purview to classify and protect sensitive data, and configure data loss prevention policies to block ransomware.

Answer

Deploy Microsoft Sentinel and create analytics rules to detect phishing, lateral movement, and ransomware. Configure automated playbooks to contain devices.

Answer

Upgrade to Microsoft Entra ID P2 and enable Identity Protection for risky sign-ins and user risk. Use Conditional Access to block access from compromised devices.

Question 15

As a Microsoft 365 administrator, you need to ensure that sensitive data is not shared externally via email. You configure Data Loss Prevention (DLP) policies in Microsoft Purview. What is the primary purpose of a DLP policy?

Accepted Answer

Detect and prevent the sharing of sensitive information via email and other channels.. Data Loss Prevention (DLP) policies in Microsoft Purview are designed to detect and prevent the sharing of sensitive information via email, Microsoft Teams, SharePoint, and other channels. Option A is incorrect because DLP does not block all external emails; it only blocks specific sensitive data. Option B is incorrect because blocking inbound emails from untrusted domains is typically handled by anti-spam or anti-phishing policies in Exchange Online Protection. Option C is incorrect because email encryption is provided by Azure Information Protection or Office 365 Message Encryption, not DLP.

Answer

Prevent users from sending any external email.

Answer

Block all inbound emails from untrusted domains.

Answer

Encrypt all outgoing emails automatically.