MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 18 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Endpoint (Plan 2) and Microsoft Defender for Identity. A user reports that their device is running slowly and exhibiting unusual network traffic. You investigate in Microsoft Defender XDR and see a high number of alerts for the device. You need to determine if the device is compromised and, if so, initiate an automated investigation. What should you do first?

Accepted Answer

Use the Microsoft Defender XDR portal to trigger an automated investigation on the device. Option C is correct because using the Microsoft Defender XDR portal to initiate an automated investigation will leverage the full XDR capabilities. Option A is wrong because live response is manual and not automated. Option B is wrong because running a full scan is not automated investigation. Option D is wrong because device isolation is a manual step.

Answer

Isolate the device from the network immediately

Answer

Initiate a Live Response session to gather forensic data

Answer

Run a full antivirus scan from Microsoft Defender Antivirus

Question 2

Your organization uses Microsoft Defender for Cloud Apps. You want to detect when a user accesses a sanctioned cloud app from an anonymous IP address. What should you configure?

Accepted Answer

Create an activity policy in Defender for Cloud Apps. Option A is correct because an activity policy can detect access from anonymous IP addresses. Option B is wrong because app discovery identifies cloud apps, not detect anomalous access. Option C is wrong because session policies control access, not generate alerts. Option D is wrong because cloud discovery shadow IT reports show discovered apps.

Answer

Configure an app discovery policy

Answer

Set up a session policy to block access from anonymous IPs

Answer

Enable the cloud discovery shadow IT report

Question 3

Your organization has Microsoft Defender for Office 365 Plan 2. You need to ensure that when a user reports a phishing email using the Report Message add-in, the email is automatically submitted to Microsoft for analysis and the user is notified of the result. What should you configure?

Accepted Answer

Configure a submission policy in the Microsoft 365 Defender portal. Option B is correct because a submission policy in the Microsoft 365 Defender portal defines the behavior for user-reported messages. Option A is wrong because anti-phishing policies handle detection, not user reporting. Option C is wrong because Safe Links policies protect links. Option D is wrong because mail flow rules handle routing, not user submissions.

Answer

Create a Safe Links policy to block the reported email

Answer

Configure an anti-phishing policy to automatically submit reported emails

Answer

Use a mail flow rule to send reported emails to a custom mailbox

Question 4

Your organization uses Microsoft Defender for Endpoint (Plan 2) and Microsoft Defender for Identity. A security analyst reports that several domain controllers are generating alerts for anomalous logon activity. You need to investigate the scope of the potential compromise across the entire environment, including endpoints, identities, and cloud apps. What is the most efficient approach?

Accepted Answer

Use the Microsoft Defender XDR portal to view the unified incident. Option D is correct because Microsoft Defender XDR provides a unified incident view that correlates alerts from all workloads. Option A is wrong because checking only endpoints misses identity and cloud app alerts. Option B is wrong because checking only identities misses endpoints. Option C is wrong because using multiple portals is inefficient.

Answer

Check each workload portal individually and correlate manually

Answer

Review the alerts in Microsoft Defender for Identity only

Answer

Review the alerts in Microsoft Defender for Endpoint only

Question 5

Your organization uses Microsoft Defender for Cloud Apps. You need to generate alerts when a user downloads more than 100 files from SharePoint Online within 10 minutes. What should you configure?

Accepted Answer

Create an activity policy. Option C is correct because an anomaly detection policy in Defender for Cloud Apps can detect such activity. Option A is wrong because app discovery policies identify apps. Option B is wrong because session policies control access. Option D is wrong because OAuth app policies manage app permissions.

Answer

Create an app discovery policy

Answer

Create a session policy

Answer

Create an OAuth app policy

Question 6

Your organization uses Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps. A user reports receiving a suspicious email with a link to a known phishing site. You need to prevent other users from clicking similar links in the future. What should you configure?

Accepted Answer

Add the URL to the Tenant Allow/Block List in Microsoft 365 Defender. Option A is correct because creating a block list in the Tenant Allow/Block List will block the URL across the organization. Option B is wrong because spam filter settings are for spam, not specific URLs. Option C is wrong because Safe Attachments policies handle attachments, not URLs. Option D is wrong because phishing simulation is for training, not blocking.

Answer

Use the attack simulation training to educate users

Answer

Create a Safe Attachments policy to block the attachment

Answer

Configure a spam filter policy to block the sender

Question 7

Your organization has Microsoft Defender for Endpoint (Plan 2) and Microsoft Defender for Identity. A critical server is showing signs of a ransomware attack. You need to contain the threat while preserving forensic evidence for analysis. What should you do first?

Accepted Answer

Initiate an automated investigation in Microsoft Defender XDR. Option D is correct because initiating an automated investigation will collect and analyze evidence while containing the threat. Option A is wrong because machine isolation is immediate but may not preserve evidence. Option B is wrong because live response is manual and may be slower. Option C is wrong because full scan is slow and may not contain.

Answer

Run a Live Response session to collect forensic data

Answer

Isolate the server from the network immediately

Answer

Run a full antivirus scan on the server

Question 8

Your organization uses Microsoft Defender for Office 365. You need to ensure that emails containing malicious attachments are automatically removed from users' inboxes after detection. What should you configure?

Accepted Answer

Configure a Safe Attachments policy. Option B is correct because Safe Attachments policies can automatically remove detected malicious attachments. Option A is wrong because anti-spam policies handle spam, not malware. Option C is wrong because Safe Links policies handle URLs. Option D is wrong because phishing simulation is for training.

Answer

Configure a Safe Links policy

Answer

Configure an anti-spam policy to delete the email

Answer

Use the attack simulation training to report the email

Question 9

Your organization uses Microsoft Defender XDR. You need to configure automatic response actions for a high-severity incident. Which TWO options are available in the Microsoft Defender XDR automated investigation and response capabilities?

Accepted Answer

Isolate a device from the network. Correct: A and D. Automated investigation can initiate device isolation and collect investigation packages. Option B is wrong because mailbox delegation is not automated. Option C is wrong because resetting passwords is not an automated response action. Option E is wrong because creating a mailbox rule is not an automated action.

Answer

Create a mailbox rule to delete suspicious emails

Answer

Delegate mailbox permissions

Answer

Reset user passwords

Question 10

Your organization uses Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps. A security incident involves a user who accessed a malicious link from an email and then uploaded sensitive data to an external cloud app. Which THREE Microsoft Defender XDR components would provide relevant alerts and insights for this incident?

Accepted Answer

Microsoft Defender for Office 365. Correct: A, B, and D. Defender for Office 365 alerts on malicious links in email; Defender for Cloud Apps alerts on data upload to external apps; Microsoft Defender XDR correlates them into a single incident. Option C is wrong because Defender for Identity focuses on identity-related threats, not email or cloud app data upload. Option E is wrong because Microsoft Sentinel is a SIEM, not a component of Defender XDR.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Identity

Question 11

Your organization uses Microsoft Defender for Endpoint (Plan 2). You need to configure a custom detection rule that alerts when a specific process attempts to access the internet. Which TWO components are required to create this custom detection?

Accepted Answer

Response action in the detection rule. Correct: B and D. Custom detections use Advanced Hunting queries (KQL) to define detection logic. Alerts can trigger automated actions via response actions. Option A is wrong because attack surface reduction rules are predefined. Option C is wrong because indicators of compromise are for threat intelligence. Option E is wrong because automation rules in Microsoft Sentinel are separate.

Answer

Attack surface reduction rule

Answer

Microsoft Sentinel automation rule

Answer

Indicator of compromise (IOC)

Question 12

Refer to the exhibit. You run the KQL query and see that a device named 'WORKSTATION42' has made 1500 connections to a public IP address 203.0.113.55 in the last day. You suspect the device may be compromised. What should you do next to gain the most context?

Accepted Answer

Expand the query to join with DeviceProcessEvents to see which process initiated the connections. Option B is correct because expanding the query to include process information can reveal which process is making the connections, helping identify malware. Option A is wrong because simply isolating the device loses forensic data. Option C is wrong because Safe Links is for email, not device network. Option D is wrong because blocking the IP is reactive and may disrupt legitimate traffic.

Answer

Isolate the device immediately using Microsoft Defender for Endpoint

Answer

Add the IP address to the Tenant Allow/Block List to block it

Answer

Create a Safe Links policy to block the IP address

Question 13

Your organization is a multinational company with 10,000 users. You use Microsoft Defender for Office 365 Plan 2, Microsoft Defender for Endpoint Plan 2, Microsoft Defender for Cloud Apps, and Microsoft Defender for Identity. Recently, a sophisticated phishing campaign targeted your executives. The campaign used personalized emails with malicious links that bypassed Safe Links protection. Several executives clicked the links and entered their credentials on a fake login page. The attackers then used those credentials to access the executives' mailboxes and exfiltrate sensitive data. You need to implement a solution that prevents similar attacks in the future by automatically blocking access to newly discovered phishing sites and providing real-time protection when users click unknown URLs. The solution should also allow you to simulate phishing campaigns to train users. What should you do?

Accepted Answer

Configure Attack Simulation Training in Microsoft 365 Defender, create a simulated phishing campaign targeting executives, and use the training to educate users on reporting phishing. Additionally, ensure Safe Links policy uses the 'Do not allow users to click through to the original URL' option and enable 'URL detonation' for unknown URLs.. Option A is correct because Attack Simulation Training allows you to create and run phishing campaigns to educate users, and it integrates with Defender for Office 365 to improve detection. Option B is wrong because Safe Attachments handles attachments, not URLs. Option C is wrong because Safe Links already failed to protect; the issue is that the phishing site was new. Option D is wrong because tenant allow/block list is reactive, not proactive.

Answer

Create a Safe Links policy that blocks all URLs from domains not in the allowed list.

Answer

Deploy Safe Attachments policies with dynamic delivery and enable 'Automatic forwarding of attachments' for unknown files.

Answer

Add the known phishing domain to the Tenant Allow/Block List and block it.

Question 14

Your organization is a financial services company with 5,000 users. You use Microsoft Defender XDR, including Defender for Endpoint Plan 2, Defender for Identity, Defender for Office 365 Plan 2, and Defender for Cloud Apps. You have recently deployed Microsoft Copilot for Security to assist your security operations center (SOC) analysts. A high-severity incident is generated: 'A user named jdoe accessed a malicious IP address from their device, and then logged into Azure Portal from an anonymous IP address. Defender for Identity detected a suspicious Kerberos ticket request from the same user's domain controller. The SOC analysts are overwhelmed with alerts and need to quickly understand the full scope of the incident, including related alerts, impacted assets, and recommended actions. They also want to use natural language to ask questions about the incident. What should you do to enable the analysts to efficiently investigate this incident?

Accepted Answer

Use Microsoft Copilot for Security integrated with Microsoft Defender XDR to get a natural language summary of the incident, ask follow-up questions, and receive recommended actions.. Option D is correct because Copilot for Security is designed to summarize incidents, provide insights, and answer natural language questions, which directly addresses the analysts's needs. Option A is wrong because advanced hunting requires KQL knowledge and is not natural language. Option B is wrong because automated investigation runs but does not provide natural language interaction. Option C is wrong because custom detection rules add more alerts, not help investigate existing ones.

Answer

Train the analysts to use Advanced Hunting to query across all data sources and build custom KQL queries to correlate the alerts.

Answer

Create custom detection rules in Microsoft Defender XDR to generate more specific alerts for similar activity.

Answer

Configure automated investigation and remediation to automatically contain the threat and then review the results.

Question 15

Your organization is a small business with 200 users. You use Microsoft 365 Business Premium, which includes Microsoft Defender for Business (the small business version of Defender for Endpoint) and Microsoft Defender for Office 365 Plan 1. You want to protect against ransomware by blocking malicious processes and behaviors on endpoints. You also need to enable automated investigation and response for common threats. However, your IT team has limited security expertise and wants a simple configuration that provides out-of-the-box protection without custom policies. What should you do?

Accepted Answer

Enable the default security baseline in Microsoft Defender for Business, which includes attack surface reduction rules and automated investigation.. Option B is correct because Defender for Business provides default security baselines that include attack surface reduction rules and automated investigation, requiring minimal configuration. Option A is wrong because creating custom policies is complex and not necessary. Option C is wrong because third-party EDR adds complexity and cost. Option D is wrong because Safe Attachments is for email, not endpoint behavior.

Answer

Configure Safe Attachments policies in Microsoft Defender for Office 365 to block ransomware attachments.

Answer

Create custom attack surface reduction rules in Microsoft Defender for Business to block ransomware behaviors.

Answer

Deploy a third-party endpoint detection and response (EDR) solution alongside Microsoft Defender for Business.