MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 2 — 15 Questions

Question 1

A security analyst wants to create a custom detection rule in Microsoft Defender XDR that triggers when a user receives a phishing email (delivered to inbox) and then, from their Windows device, establishes a network connection to a known malicious IP address. The rule will be based on an advanced hunting query. Which two tables should the analyst join in the KQL query to capture both the email delivery event and the network connection event?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

EmailEvents and DeviceNetworkEvents. The correct answers are A and C. This custom detection rule requires capturing two distinct events: the phishing email being delivered to the user's inbox and the Windows device establishing a network connection to a known malicious IP. The EmailEvents table (option A) records the initial delivery status of emails, including 'Delivered' events. The EmailPostDeliveryEvents table (option C) captures actions that occur after delivery, such as user interactions or admin remediation, but it can also be used to detect if the email was successfully delivered and subsequently interacted with. Both tables can be joined with DeviceNetworkEvents on a common identifier (like RecipientObjectId and DeviceId) to correlate the email receipt with the network connection event. Option A is more straightforward for the delivery event, while option C can be useful if the analyst wants to capture the delivery as part of post-delivery actions or if the rule requires a specific post-delivery trigger. Note that option C may include only a subset of delivery events based on the filter conditions, but it is still valid for this scenario.

Answer

EmailEvents and DeviceProcessEvents

Answer

EmailAttachmentInfo and DeviceRegistryEvents

Question 2

A security administrator needs to configure an automated investigation and response (AIR) playbook in Microsoft 365 Defender that will automatically isolate a device whenever a high-severity alert from Microsoft Defender for Endpoint is generated. The playbook must run without requiring manual approval. Which configuration must the administrator set to achieve automatic device isolation?

Accepted Answer

Set the automation level for device isolation to 'Full - automatically remediate threats' in the Advanced Features settings.. The automation level for device isolation in Microsoft 365 Defender is configured under Settings > Endpoints > Automation (not Advanced Features). Setting it to 'Full - automatically remediate threats' ensures that when a high-severity alert triggers the AIR playbook, device isolation is performed without requiring manual approval.

Answer

Create a custom detection rule that triggers on high-severity alerts and uses an automated action.

Answer

Configure the device isolation action to require approval in the automation level settings.

Answer

Enable automatic remediation only for medium severity and above.

Question 3

A security analyst is building a custom detection rule in Microsoft 365 Defender to identify when a user clicks a malicious URL in a phishing email and subsequently visits the malicious site from their corporate device. The analyst plans to use advanced hunting with Kusto Query Language (KQL). Which two tables must be joined to capture both the URL click event and the network connection to the malicious site?

Accepted Answer

EmailUrlInfo and DeviceNetworkEvents. EmailUrlInfo contains the clicked URL (URL clicks are recorded in this table) and DeviceNetworkEvents logs network connections; a direct join on the URL value captures the exact sequence of clicking the malicious link and the device connecting to that site. Option A is incorrect because EmailEvents does not include click event data; it records email delivery and other interactions but does not capture URL click actions.

Answer

EmailEvents and DeviceNetworkEvents

Answer

EmailAttachmentInfo and DeviceProcessEvents

Answer

EmailEvents and DeviceFileEvents

Question 4

A security analyst is using Microsoft 365 Defender Advanced Hunting to investigate a potential malware outbreak. The analyst needs to find all devices where a specific signed executable (known to be malicious) was created in the past 24 hours. Which Advanced Hunting table should be queried to detect the creation of the executable file?

Accepted Answer

DeviceFileEvents. The DeviceFileEvents table in Microsoft 365 Defender Advanced Hunting captures file creation, modification, and deletion events. Since the question specifically asks for detecting the creation of a signed executable file, this table provides the necessary data, including file name, path, and timestamp, to identify when and where the malicious executable was created.

Answer

DeviceProcessEvents

Answer

DeviceNetworkEvents

Answer

DeviceRegistryEvents

Question 5

A security administrator wants to prevent users from uploading files to unsanctioned cloud storage apps (e.g., personal Dropbox or Google Drive) from managed Windows devices. The solution must use a reverse proxy to control file uploads in real time. Which Microsoft Defender for Cloud Apps feature should the administrator configure?

Accepted Answer

Session policy. Session policy in Microsoft Defender for Cloud Apps uses reverse proxy capabilities to monitor and control user activities in real time. When configured with the 'Control file upload' action, it can block or restrict uploads to unsanctioned cloud storage apps like personal Dropbox or Google Drive from managed Windows devices, meeting the requirement exactly.

Answer

App discovery policy

Answer

Access policy

Answer

Activity policy

Question 6

A security administrator wants to prevent attackers from stealing credentials by blocking access to the Local Security Authority Subsystem Service (LSASS) from untrusted processes. Which Attack Surface Reduction (ASR) rule should the administrator enable to meet this requirement?

Accepted Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe).. The ASR rule 'Block credential stealing from the Windows local security authority subsystem (lsass.exe)' (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2) directly prevents untrusted processes from accessing LSASS memory, which is a common technique used by attackers to dump credentials via tools like Mimikatz. This rule blocks attempts to open lsass.exe with specific access rights (e.g., PROCESS_VM_READ) from non-trusted processes, thereby protecting credential material stored in LSASS.

Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion.

Answer

Block Office applications from creating child processes.

Answer

Block persistence through Windows Management Instrumentation (WMI) event subscription.

Question 7

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a device makes an outbound connection to a known malicious IP address, and within 10 minutes, a process with suspicious command-line arguments is started on the same device. Which two Advanced Hunting tables must be joined using a KQL query to create this detection?

Accepted Answer

DeviceNetworkEvents and DeviceProcessEvents.. The detection rule correlates an outbound network connection to a known malicious IP with a subsequent process creation on the same device within 10 minutes. This requires joining DeviceNetworkEvents (for network connections) with DeviceProcessEvents (for process creation and command-line arguments). DeviceFileEvents is not needed because the rule does not involve file events. Therefore, only Option A provides the necessary tables.

Answer

DeviceEvents and DeviceLogonEvents.

Answer

DeviceProcessEvents and DeviceFileEvents.

Answer

DeviceNetworkEvents and DeviceRegistryEvents.

Question 8

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a process named 'powershell.exe' is launched with command-line arguments containing '-EncodedCommand', and within 5 minutes a service is created on the same device. Which two Advanced Hunting tables must be joined in the KQL query to create this detection?

Accepted Answer

DeviceProcessEvents and DeviceEvents. Only A: DeviceProcessEvents and DeviceEvents. The rule requires detecting when 'powershell.exe' is launched with '-EncodedCommand' (captured by DeviceProcessEvents) and then a service creation within 5 minutes on the same device. Service creation is tracked by DeviceEvents with action type 'ServiceInstalled'. DeviceRegistryEvents captures registry modifications, but service creation also involves writing to the registry; however, the question specifies a 'service is created', which is a system-level event best captured by DeviceEvents. DeviceRegistryEvents may capture related registry changes but is not the primary table for service creation events, and the note provided indicates it does not reliably capture service creation. Therefore, only option A is correct.

Answer

DeviceProcessEvents and DeviceNetworkEvents

Answer

DeviceProcessEvents and DeviceRegistryEvents

Answer

DeviceEvents and DeviceLogonEvents

Question 9

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should detect when a user opens a malicious email attachment, which launches a PowerShell process, and then that PowerShell process makes an outbound connection to a known malicious IP address. Which two Advanced Hunting tables must be joined in the KQL query?

Accepted Answer

EmailEvents, DeviceProcessEvents, DeviceNetworkEvents. Only options A and B are correct because they include DeviceNetworkEvents, which is necessary to detect the outbound connection to a malicious IP in the attack chain. Option A combines EmailEvents (email opening), DeviceProcessEvents (PowerShell process), and DeviceNetworkEvents (network connection). Option B uses EmailAttachmentInfo instead of EmailEvents to link the attachment directly, still covering the full chain. Option C is incorrect because DeviceFileEvents captures file creation activities, not network connections, so it cannot detect the outbound connection specified in the scenario. Option D is incorrect because DeviceLogonEvents tracks logon events, which are irrelevant.

Answer

EmailEvents, DeviceProcessEvents, DeviceFileEvents

Answer

EmailAttachmentInfo, DeviceProcessEvents, DeviceLogonEvents

Question 10

A security administrator wants to reduce the risk of credential dumping from LSASS on managed Windows endpoints. Which Attack Surface Reduction rule should be enabled?

Accepted Answer

Block credential stealing from the Windows Local Security Authority Subsystem. The 'Block credential stealing from the Windows Local Security Authority Subsystem' ASR rule (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2) specifically prevents credential dumping from LSASS by blocking access to the process memory via common techniques like Mimikatz or direct API calls (e.g., OpenProcess, ReadProcessMemory). This directly reduces the risk of credential theft on managed Windows endpoints.

Answer

Block executable files from running unless they meet prevalence, age, or trusted list criteria

Answer

Block untrusted and unsigned processes that run from USB

Answer

Block JavaScript or VBScript from launching downloaded executable content

Question 11

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a user opens a malicious Office document, which launches a process named cmd.exe from Microsoft Word, and then that cmd.exe process makes an outbound connection to a known malicious IP address. Which two Advanced Hunting tables must be joined in the KQL query?

Accepted Answer

DeviceProcessEvents and DeviceNetworkEvents. Which joins DeviceProcessEvents and DeviceNetworkEvents. This correlation captures the process creation event (cmd.exe spawned by Microsoft Word) followed by the outbound network connection to a known malicious IP address. Option D (DeviceProcessEvents and DeviceRegistryEvents) is not required because the detection rule focuses on the process-to-network chain, not registry modifications. The attack chain described does not involve registry changes, so DeviceRegistryEvents is unnecessary.

Answer

EmailEvents and EmailUrlInfo

Answer

DeviceEvents and DeviceLogonEvents

Answer

DeviceProcessEvents and DeviceRegistryEvents

Question 12

A security administrator needs to discover which cloud apps are being used in the organization and then block usage of unsanctioned apps in real time using a reverse proxy. Which two Microsoft Defender for Cloud Apps features must be configured to meet these requirements? (Select all that apply.)

Accepted Answer

Cloud Discovery. Cloud Discovery (A) is correct because it analyzes traffic logs from your network to identify all cloud apps in use, providing visibility into sanctioned and unsanctioned apps. Conditional Access App Control (C) is correct because it enforces real-time access controls via a reverse proxy, allowing you to block unsanctioned apps as users attempt to access them.

Answer

App Connectors

Answer

API connectors

Question 13

A security analyst wants to create a custom detection rule in Microsoft 365 Defender Advanced Hunting that alerts when a user receives a phishing email and clicks a malicious link within 10 minutes. Which two tables must be joined in the KQL query?

Accepted Answer

EmailEvents and UrlClickEvents. To detect a user receiving a phishing email and clicking a malicious link within 10 minutes, the correct table combination is EmailEvents and UrlClickEvents (Option A). These tables can be joined on NetworkMessageId to correlate the email delivery timestamp with the click timestamp. Option B (EmailEvents and DeviceEvents) is not appropriate because DeviceEvents logs system-level events like process creation and does not record URL clicks directly. While DeviceEvents might indicate user activity after email receipt, it does not provide direct evidence of a click on a specific URL. Therefore, only Option A meets the requirement of detecting the click event itself.

Answer

EmailEvents and DeviceEvents

Answer

EmailAttachmentInfo and UrlClickEvents

Answer

EmailPostDeliveryEvents and DeviceNetworkEvents

Question 14

A security administrator needs to block unsanctioned cloud apps in real time using a reverse proxy. Which two Microsoft Defender for Cloud Apps components must be configured?

Accepted Answer

Conditional Access App Control. Conditional Access App Control (B) is the reverse proxy component in Microsoft Defender for Cloud Apps that enforces real-time session-level monitoring and control of cloud app access. Session control policies (D) are the specific policy objects that define the actions (e.g., block download, block access) applied through that reverse proxy. Together, they enable blocking unsanctioned cloud apps in real time by intercepting user traffic via the reverse proxy architecture.

Answer

Cloud Discovery

Answer

App governance

Question 15

A security analyst wants to create a custom detection rule in Microsoft 365 Defender Advanced Hunting that alerts when a process spawned by Microsoft Word (winword.exe) makes an outbound connection to a known malicious IP address. Which two Advanced Hunting tables must be joined in the KQL query?

Accepted Answer

DeviceProcessEvents and DeviceNetworkEvents. To detect a process spawned by winword.exe making an outbound connection to a known malicious IP, you need to first identify the process creation event (parent-child relationship) in DeviceProcessEvents, then correlate it with the network connection event in DeviceNetworkEvents. Joining these two tables on DeviceId and a timestamp window allows you to link the specific process (winword.exe) to its outbound network activity. DeviceEvents does not contain network connection data, so it cannot be used for this detection. Thus, only options A is correct.

Answer

DeviceProcessEvents and DeviceEvents

Answer

DeviceNetworkEvents and IdentityLogonEvents

Answer

DeviceProcessEvents and DeviceFileEvents