MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 18 — 15 Questions

Question 1

A security administrator needs to block executable files (e.g., .exe, .ps1) from running from the %TEMP% folder on Windows devices to prevent common malware execution. Which attack surface reduction (ASR) rule should be enabled?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion. ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) is designed specifically to block executables (including .exe, .ps1, .scr, .dll) from launching from locations like %TEMP%, %APPDATA%, and the Windows folder, which are common malware staging areas. This rule uses cloud-delivered reputation (prevalence and age) and a Microsoft-managed trusted list to allow legitimate files while blocking unknown or suspicious ones, directly addressing the requirement to prevent malware execution from %TEMP%.

Answer

Block executable content from email client and webmail

Answer

Block Office applications from creating child processes

Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Question 2

A security analyst needs to create a custom detection rule in Microsoft 365 Defender that triggers when a suspicious PowerShell process (e.g., using -EncodedCommand) is detected on a device, and within 5 minutes, an outbound network connection to a known malicious IP address occurs. Which two advanced hunting tables must be joined?

Accepted Answer

DeviceProcessEvents and DeviceNetworkEvents. The custom detection rule requires correlating a suspicious PowerShell process event with a subsequent outbound network connection to a malicious IP within a 5-minute window. DeviceProcessEvents contains process creation data (e.g., command line, process name) for detecting encoded PowerShell commands, while DeviceNetworkEvents logs network connections (destination IP, port, protocol). Joining these two tables on DeviceId and a time range allows the rule to identify the sequence of a process event followed by a network event from the same device.

Answer

DeviceEvents and DeviceFileCertificateInfo

Answer

IdentityLogonEvents and CloudAppEvents

Answer

EmailEvents and EmailAttachmentInfo

Question 3

A security administrator wants to ensure that all email attachments are scanned in a sandbox environment and blocked if malicious, with email delivery delayed until scanning completes. Which Microsoft 365 Defender policy should the administrator configure?

Accepted Answer

Safe Attachments policy. Safe Attachments policy is the correct choice because it provides sandbox scanning of email attachments. It can be configured to delay email delivery until scanning is complete, blocking malicious attachments. This directly meets the requirement.

Answer

Safe Links policy

Answer

Anti-spam policy

Answer

Anti-phishing policy

Question 4

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should fire when a Windows device exhibits this sequence of events within 3 minutes: 1) A PowerShell process runs with an encoded command, 2) A service is created with a random name, and 3) An outbound network connection to a suspicious IP address is observed. Which three Advanced Hunting tables must be joined in the KQL query to create this detection?

Accepted Answer

DeviceProcessEvents, DeviceEvents, DeviceNetworkEvents. Only option C is correct. The detection rule requires three event types: PowerShell process execution (DeviceProcessEvents), service creation (DeviceEvents, specifically Event ID 4697), and outbound network connection to a suspicious IP (DeviceNetworkEvents). DeviceRegistryEvents captures registry modifications, not the service creation event itself. DeviceFileEvents captures file creation, but service creation is a security event logged in DeviceEvents. Therefore, only the combination in option C includes all necessary tables.

Answer

DeviceProcessEvents, DeviceRegistryEvents, DeviceNetworkEvents

Answer

DeviceProcessEvents, DeviceFileEvents, DeviceNetworkEvents

Answer

DeviceProcessEvents, DeviceLogonEvents, DeviceNetworkEvents

Question 5

An organization wants to allow only specific company-approved USB devices (e.g., those with a specific hardware ID) on managed Windows devices. All other USB devices must be blocked. Which Microsoft 365 Defender feature should be configured?

Accepted Answer

Microsoft Defender for Endpoint device control. Microsoft Defender for Endpoint device control is the correct feature because it provides granular control over peripheral devices, including USB devices, based on hardware IDs. It allows administrators to create allow/block policies that enforce restrictions on managed Windows devices, ensuring only company-approved USB devices can be used.

Answer

Attack surface reduction rules

Answer

Microsoft Defender for Cloud Apps session policy

Answer

Conditional Access device compliance

Question 6

A security administrator needs to block executable files (e.g., .exe, .ps1) from running from the %TEMP% folder on Windows devices to prevent common malware execution. Which attack surface reduction (ASR) rule should be enabled?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion. The ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) specifically targets executable files (e.g., .exe, .scr) that have been downloaded from the internet by checking their Mark-of-the-Web (MoTW) attribute. When enabled, this rule prevents execution of such files unless they meet criteria like high prevalence, sufficient age, or inclusion in a trusted list, directly addressing the requirement to block internet-downloaded portable executables.

Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Answer

Block Adobe Reader from creating child processes

Answer

Block persistence through WMI event subscription

Question 7

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a user receives a phishing email containing a malicious URL and then clicks that URL within 10 minutes. Which two Advanced Hunting tables must be joined in the KQL query?

Accepted Answer

EmailEvents and UrlClickEvents. The rule requires detecting when a user receives a phishing email with a malicious URL and then clicks that URL within 10 minutes. Two separate joins can accomplish this:

- **EmailEvents and UrlClickEvents**: EmailEvents contains metadata about email delivery (including NetworkMessageId), and UrlClickEvents records user clicks on URLs in Microsoft Defender for Office 365 Safe Links. Joining these tables on NetworkMessageId (and optionally URL hash) allows correlating the email receipt with the click event, enabling the time-based trigger.

- **EmailUrlInfo and UrlClickEvents**: EmailUrlInfo provides details on URLs found within emails (including the URL and its verdict), and UrlClickEvents logs clicks. Joining on the URL hash (SHA256) directly correlates the email-delivered URL with the user's click, also enabling the time-based trigger.

Both pairs are valid and commonly used depending on the specific data needed. Option B (DeviceProcessEvents) is irrelevant as it deals with process execution, not email or URL clicks. Option D (EmailAttachmentInfo) pertains to attachments, not URLs.

Answer

EmailEvents and DeviceProcessEvents

Answer

EmailAttachmentInfo and UrlClickEvents

Question 8

A security administrator is configuring Microsoft Defender for Cloud Apps. The administrator needs to discover which cloud apps are being used in the organization and then block usage of unsanctioned apps in real time using a reverse proxy. Which two Defender for Cloud Apps features must be configured? (Select the two correct options.)

Accepted Answer

Cloud Discovery. Cloud Discovery is the correct feature because it identifies which cloud apps are in use by analyzing traffic logs from the organization's network. This provides the visibility needed to determine which apps are unsanctioned. Conditional Access App Control is the correct feature because it uses a reverse proxy to enforce real-time access controls, blocking unsanctioned apps at the session level.

Answer

App governance

Answer

OAuth app permissions

Question 9

A security analyst is investigating a suspected credential theft attack where an attacker attempts to dump credentials from LSASS. Which Attack Surface Reduction (ASR) rule should the administrator enable to block this activity from untrusted processes?

Accepted Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe). The ASR rule 'Block credential stealing from the Windows local security authority subsystem (lsass.exe)' (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2) is specifically designed to prevent untrusted processes from accessing LSASS memory and dumping credentials, such as with tools like Mimikatz. This directly addresses the described attack scenario of credential theft from LSASS, making it the correct choice.

Answer

Block Office applications from creating child processes

Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion

Answer

Block Adobe Reader from creating child processes

Question 10

A security administrator wants to configure Microsoft Defender for Cloud Apps to block downloads of sensitive files from Salesforce to unmanaged devices in real time. Which Defender for Cloud Apps component must be configured?

Accepted Answer

Conditional Access App Control. Conditional Access App Control (CAAC) is the correct component because it enables real-time session-level monitoring and control of user activities in SaaS apps like Salesforce. By integrating with Azure AD Conditional Access, CAAC can enforce policies to block downloads of sensitive files to unmanaged devices at the moment of access, using reverse proxy architecture to inspect and intervene in the traffic.

Answer

Cloud Discovery

Answer

App Connectors

Answer

Activity policies

Question 11

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should detect when a user receives a malicious email attachment and then opens the attachment, resulting in a process being created (e.g., .exe file). Which two Advanced Hunting tables must be joined to correlate the email attachment with the resulting process?

Accepted Answer

EmailAttachmentInfo and DeviceProcessEvents. Only option B (EmailAttachmentInfo and DeviceProcessEvents) is valid for directly correlating the email attachment with the resulting process. EmailAttachmentInfo contains attachment-specific details like file hash and name, which can be joined with the SHA256 hash or file name in DeviceProcessEvents to track execution. Option A joins EmailEvents with DeviceProcessEvents, but EmailEvents lacks attachment details, making it impossible to directly link the attachment to the executed process.

Answer

EmailEvents and DeviceProcessEvents

Answer

EmailAttachmentInfo and DeviceFileEvents

Answer

DeviceProcessEvents and IdentityLogonEvents

Question 12

A security administrator wants to configure Microsoft Defender for Cloud Apps so that when a user accesses a sensitive file in a sanctioned cloud app from an unmanaged device, the user is blocked from downloading the file and a block action is logged in real time. Which type of policy should the administrator configure?

Accepted Answer

Create a session policy with the action 'Block' on the download action for files with a specific sensitivity label. A session policy in Microsoft Defender for Cloud Apps allows real-time control over user activities within a sanctioned cloud app. By configuring the action 'Block' on the download action for files with a specific sensitivity label, the administrator can block the download when the session is initiated from an unmanaged device, and the block action is logged in real time. This meets the requirement of blocking the download and logging the action simultaneously.

Answer

Create a file policy that monitors for sensitive files being accessed from unmanaged devices and generates an alert

Answer

Configure an access policy that blocks access to the cloud app from unmanaged devices

Answer

Configure an activity policy that monitors download activities from unmanaged devices and triggers automatic remediation

Question 13

A company is experiencing a significant number of phishing attempts that target high-level executives by impersonating their email addresses. The security team wants to configure protection against user impersonation in Microsoft Defender for Office 365. Which setting must be enabled in the anti-phishing policy to protect these specific users?

Accepted Answer

Enable users to protect against impersonation. The 'Enable users to protect against impersonation' setting in an anti-phishing policy allows you to specify a list of users (such as high-level executives) whose email identities will be monitored for impersonation attempts. When enabled, Defender for Office 365 analyzes inbound messages for display name and email address matches against the protected users, and if a match is found with a suspicious sender, the message is flagged or quarantined. This directly addresses the scenario of attackers spoofing executive email addresses.

Answer

Enable domains to protect against impersonation

Answer

Mailbox intelligence

Answer

Spoofed sender posture

Question 14

Match each Microsoft 365 compliance feature to its purpose.

Accepted Answer

Data Loss Prevention (DLP): Prevents accidental sharing of sensitive information.. Correct matches: DLP prevents accidental sharing, eDiscovery searches for legal needs, and Sensitivity Labels classify/protect data. Common confusions include mixing DLP with retention policies and eDiscovery with automatic classification.

Answer

Data Loss Prevention (DLP): Manages data retention and deletion policies.

Answer

eDiscovery: Applies automatic classification based on content patterns.

Question 15

Match each Microsoft 365 threat scenario to the appropriate protection.

Accepted Answer

Phishing email with malicious link: Microsoft Defender for Office 365 Safe Links. Correct matches: Phishing links → Safe Links; Malware attachments → Safe Attachments; Data leaks → DLP; Ransomware → Anti-ransomware policies. Common mistakes include confusing Safe Links with Safe Attachments and DLP with Defender protections.

Answer

Phishing email with malicious link: Microsoft Defender for Office 365 Safe Attachments

Answer

Accidental data leak via email: Microsoft Defender for Office 365 Safe Links