MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 19 — 15 Questions

Question 1

You are investigating a potential security incident in Microsoft Defender XDR. The incident involves a user who received a phishing email and clicked a link that executed a PowerShell script. You need to perform a detailed investigation of the PowerShell script's behavior across all affected devices. Which feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Advanced hunting in Microsoft Defender XDR.. Advanced hunting in Microsoft Defender XDR allows you to run KQL queries across all affected devices, enabling detailed investigation of the PowerShell script's behavior. It provides access to raw event data from multiple sources, including device process events, network connections, and file operations, which are essential for understanding script execution and impact.

Answer

The Action Center in Microsoft Defender XDR.

Answer

Live Response from Microsoft Defender for Endpoint.

Answer

The device timeline in the Microsoft 365 Defender portal.

Question 2

Your organization uses Microsoft Defender for Office 365. You need to ensure that malicious links in email messages are blocked at the time of click by checking the link reputation in real time. What should you enable?

Accepted Answer

Safe Links policy.. Safe Links policy in Defender for Office 365 provides real-time link reputation checking at the time of click. It rewrites URLs and checks them against a dynamic list of known malicious links when users click them. Option A is incorrect because anti-spam policies filter spam emails, not malicious links. Option B is incorrect because Safe Attachments scans email attachments for malware, not links. Option D is incorrect because anti-phishing policies protect against phishing attempts but do not perform real-time link checking.

Answer

Anti-spam policy.

Answer

Safe Attachments policy.

Answer

Anti-phishing policy.

Question 3

You are a Microsoft 365 administrator. A user reports that they received a Microsoft Teams message from an external user containing a link to a malicious website. The user clicked the link but did not enter any credentials. You need to prevent similar incidents in the future. What should you configure?

Accepted Answer

Enable Safe Links for Microsoft Teams in Defender for Office 365.. Enabling Safe Links for Microsoft Teams in Defender for Office 365 provides time-of-click protection for links shared in Teams. Option A is wrong because blocking all external messages would hinder collaboration. Option B is wrong because Safe Attachments scans files, not links. Option D is wrong because anti-phishing policies protect against impersonation, not malicious links.

Answer

Configure a Teams messaging policy to block all messages from external users.

Answer

Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams.

Answer

Configure an anti-phishing policy to protect against impersonation in Teams.

Question 4

Your organization has Microsoft 365 E5 and uses Microsoft Defender for Cloud Apps. You want to block downloads from an unsanctioned cloud app that is used by some employees. What should you configure?

Accepted Answer

Configure the app as unsanctioned in Defender for Cloud Apps and create a session policy to block downloads.. Marking the app as unsanctioned in Defender for Cloud Apps and creating a session policy allows blocking downloads from that app. Option A is incorrect because a DLP policy protects data but does not block app usage. Option B is incorrect because a conditional access policy can enforce controls like requiring managed apps, but it does not directly block downloads from an unsanctioned app. Option C is incorrect because blocking by IP address is ineffective for cloud apps that use dynamic IP ranges.

Answer

Create a DLP policy to block sharing of sensitive data with the app.

Answer

Create a conditional access policy to require the use of managed apps.

Answer

Block the app by its IP addresses in the firewall.

Question 5

You are configuring Microsoft Defender for Office 365. Which TWO actions should you take to protect users from phishing attacks that use impersonation?

Accepted Answer

Configure anti-phishing policies to protect users from impersonation of custom domains.. Anti-phishing policies in Microsoft Defender for Office 365 include impersonation settings that specifically protect against spoofing of custom domains the organization owns, using domain impersonation protection with actions like quarantining or moving messages to the Junk folder. Option D is also correct because the same anti-phishing policy provides user impersonation protection, which detects messages where the display name matches an internal user (such as executives or key staff) and applies the configured action. These two settings directly address phishing attacks that rely on impersonating trusted domains and internal users. Option A is not correct because DLP policies govern sensitive information sharing, not impersonation-based phishing. Option B is not correct because raising the spam confidence level (SCL) affects bulk/spam filtering, not impersonation detection. Option E is not correct because Safe Attachments for SharePoint, OneDrive, and Teams protects against malicious files in those workloads, not impersonation phishing.

Answer

Create a data loss prevention (DLP) policy to prevent sharing of credentials.

Answer

Configure anti-spam policies to increase the spam confidence level.

Answer

Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams.

Question 6

You are investigating an incident in Microsoft Defender XDR. The incident involves multiple alerts from different sources. Which THREE actions should you take during the investigation?

Accepted Answer

Review the incident timeline to understand the sequence of events.. Option A is correct because reviewing the incident timeline in Microsoft Defender XDR lets you correlate the multiple alerts from different sources into a chronological sequence, revealing the initial access, lateral movement, and impact so you can scope the incident accurately. Option C is correct because advanced hunting uses Kusto Query Language (KQL) against the unified schema (DeviceEvents, IdentityLogonEvents, EmailEvents, etc.) to pivot beyond the original alerts and uncover related activity across devices and identities that the incident view may not surface. Option D is correct because isolating affected devices via Microsoft Defender for Endpoint (through the device page or the 'Isolate device' action) contains the threat, prevents further lateral movement or command-and-control communication, and preserves forensic evidence while investigation continues. Option B is not appropriate as a standard investigation step because bulk-deleting emails destroys evidence and is a remediation action (soft delete/hard delete via Purview) that should only follow confirmed scope, not precede it. Option E is also not a default investigation action because mass password resets can disrupt business operations and lock out users; credential remediation should be targeted based on confirmed compromise rather than applied to all involved accounts.

Answer

Delete all emails related to the incident from all mailboxes.

Answer

Reset the passwords of all user accounts involved.

Question 7

You are configuring Microsoft Defender for Identity. Which THREE capabilities does it provide?

Accepted Answer

Detection of compromised accounts through behavioral analytics.. Options B, C, and E are correct because Microsoft Defender for Identity provides detection of compromised accounts through behavioral analytics (B), detection of reconnaissance activities such as LDAP enumeration (C), and detection of lateral movement between domain-joined machines (E). Option A is incorrect because scanning email attachments for malware is a feature of Microsoft Defender for Office 365, not Defender for Identity. Option D is incorrect because creation of data loss prevention (DLP) policies is a feature of Microsoft Purview, not Defender for Identity.

Answer

Scanning of email attachments for malware.

Answer

Creation of data loss prevention (DLP) policies.

Question 8

Refer to the exhibit. You are configuring a session policy in Microsoft Defender for Cloud Apps. The policy must block downloads when both the app risk is high and the user risk is high. Based on the exhibit, which additional condition should you add to ensure the policy only applies to unsanctioned apps?

Accepted Answer

Add a condition for app tag to be 'unsanctioned'.. In Microsoft Defender for Cloud Apps session policies, to restrict the policy to unsanctioned apps, you must add a condition on the app tag. Unsanctioned apps are those that have been marked as unsanctioned in Cloud App Catalog. The condition 'app tag equals unsanctioned' ensures the policy only applies to those apps. The other conditions (app risk score, user risk score, activity) do not filter by sanction status.

Answer

Add a condition for app risk score to be medium or low.

Answer

Add a condition for user risk score to be medium.

Answer

Add a condition for activity to include upload.

Question 9

You are the security administrator for a multinational organization using Microsoft 365 E5. The organization has 10,000 users across three regions: North America, Europe, and Asia. You have deployed Microsoft Defender for Endpoint on all Windows devices and enabled Microsoft Defender for Office 365. Recently, a sophisticated phishing campaign targeted executives in Europe, using a custom domain that closely resembles your legitimate domain (e.g., contoso.com vs. contos0.com). The emails bypassed anti-spam and anti-phishing policies. You need to configure protection to block these impersonation attempts without affecting legitimate emails from the actual domain. You must also ensure that any similar future attempts using different variations are automatically detected. What should you do?

Accepted Answer

Configure an anti-phishing policy to protect against impersonation of your domain, enabling the 'Protect against impersonation of domains I own' setting and adding your legitimate domain to the list of domains to protect.. Anti-phishing policies in Microsoft Defender for Office 365 include a dedicated domain impersonation setting called 'Protect against impersonation of domains I own.' By enabling this and adding contoso.com to the protected domains list, Defender uses its impersonation detection engine to catch lookalike domains (contos0.com, contoso.co, etc.) using homoglyph, typo, and character-substitution analysis — not just exact string matches. This automatically generalizes to future variations without needing to enumerate each spoofed domain manually.

Answer

Create a Safe Links policy with a block action for URLs containing 'contos0.com'.

Answer

Enable mailbox intelligence in anti-phishing policies to detect unusual sender behavior.

Answer

Add the spoofed domain 'contos0.com' to the Tenant Allow/Block List in the Defender for Office 365 portal.

Question 10

Your organization uses Microsoft Defender for Endpoint (Plan 2) and Microsoft Defender for Identity. A user reports that their device is running slowly and exhibiting unusual network traffic. You investigate in Microsoft Defender XDR and see a high number of alerts for the device. You need to determine if the device is compromised and, if so, initiate an automated investigation. What should you do first?

Accepted Answer

Use the Microsoft Defender XDR portal to trigger an automated investigation on the device. Using the Microsoft Defender XDR portal to trigger an automated investigation leverages the full XDR capabilities to analyze the device and determine if it is compromised. Option A is incorrect because isolating the device is a containment action, not the first step to determine compromise. Option B is incorrect because Live Response is a manual forensic tool, not an automated investigation. Option D is incorrect because running a full antivirus scan is not an automated investigation and may not detect advanced threats.

Answer

Isolate the device from the network immediately

Answer

Initiate a Live Response session to gather forensic data

Answer

Run a full antivirus scan from Microsoft Defender Antivirus

Question 11

Your organization uses Microsoft Defender for Cloud Apps. You want to detect when a user accesses a sanctioned cloud app from an anonymous IP address. What should you configure?

Accepted Answer

Create an activity policy in Defender for Cloud Apps. An activity policy in Microsoft Defender for Cloud Apps is designed to monitor user activities and generate alerts based on conditions such as anonymous IP address usage. Since the requirement is to detect (not block) access from anonymous IPs, an activity policy with the 'Anonymous IP address' filter is the correct configuration. It leverages the built-in anonymous IP detection in Defender for Cloud Apps.

Answer

Configure an app discovery policy

Answer

Set up a session policy to block access from anonymous IPs

Answer

Enable the cloud discovery shadow IT report

Question 12

Your organization has Microsoft Defender for Office 365 Plan 2. You need to ensure that when a user reports a phishing email using the Report Message add-in, the email is automatically submitted to Microsoft for analysis and the user is notified of the result. What should you configure?

Accepted Answer

Configure a submission policy in the Microsoft 365 Defender portal. In Microsoft 365 Defender, user-reported messages are handled through the Submissions page, governed by a user submission policy. Configuring this policy in the Defender portal lets you route reported phish to Microsoft for analysis, set the user-reported mailbox, and enable result notifications back to the reporting user. This is the native mechanism for the Report Message/Report Phishing add-ins.

Answer

Create a Safe Links policy to block the reported email

Answer

Configure an anti-phishing policy to automatically submit reported emails

Answer

Use a mail flow rule to send reported emails to a custom mailbox

Question 13

Your organization uses Microsoft Defender for Endpoint (Plan 2) and Microsoft Defender for Identity. A security analyst reports that several domain controllers are generating alerts for anomalous logon activity. You need to investigate the scope of the potential compromise across the entire environment, including endpoints, identities, and cloud apps. What is the most efficient approach?

Accepted Answer

Use the Microsoft Defender XDR portal to view the unified incident. Microsoft Defender XDR provides a unified incident view that correlates alerts from all workloads. Option A is wrong because checking only endpoints misses identity and cloud app alerts. Option B is wrong because checking only identities misses endpoints. Option C is wrong because using multiple portals is inefficient.

Answer

Check each workload portal individually and correlate manually

Answer

Review the alerts in Microsoft Defender for Identity only

Answer

Review the alerts in Microsoft Defender for Endpoint only

Question 14

Your organization uses Microsoft Defender for Cloud Apps. You need to generate alerts when a user downloads more than 100 files from SharePoint Online within 10 minutes. What should you configure?

Accepted Answer

Create an activity policy. Activity policies in Microsoft Defender for Cloud Apps are designed to monitor user activities across connected apps and generate alerts when specific conditions are met, such as a user downloading more than 100 files from SharePoint Online within 10 minutes. This is a classic anomaly detection scenario that activity policies handle natively. The other policy types serve different purposes: app discovery for shadow IT, session policies for conditional access, and OAuth app policies for app permissions.

Answer

Create an app discovery policy

Answer

Create a session policy

Answer

Create an OAuth app policy

Question 15

Your organization uses Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps. A user reports receiving a suspicious email with a link to a known phishing site. You need to prevent other users from clicking similar links in the future. What should you configure?

Accepted Answer

Add the URL to the Tenant Allow/Block List in Microsoft 365 Defender. The Tenant Allow/Block List in Microsoft 365 Defender allows you to block specific URLs across the organization, preventing users from accessing known phishing sites. Option A is incorrect because attack simulation training is for user education, not blocking links. Option B is incorrect because Safe Attachments policies only handle email attachments, not URLs. Option C is incorrect because spam filter policies manage spam classification, not specific URLs.

Answer

Use the attack simulation training to educate users

Answer

Create a Safe Attachments policy to block the attachment

Answer

Configure a spam filter policy to block the sender