MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 2 — 15 Questions

Question 1

A security analyst wants to create a custom detection rule in Microsoft 365 Defender Advanced Hunting that alerts when a process spawned by Microsoft Word (winword.exe) makes an outbound connection to a known malicious IP address. Which two Advanced Hunting tables must be joined in the KQL query?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DeviceProcessEvents and DeviceNetworkEvents. To detect a process spawned by winword.exe making an outbound connection to a known malicious IP, you need to first identify the process creation event (parent-child relationship) in DeviceProcessEvents, then correlate it with the network connection event in DeviceNetworkEvents. Joining these two tables on DeviceId and a timestamp window allows you to link the specific process (winword.exe) to its outbound network activity. DeviceEvents does not contain network connection data, so it cannot be used for this detection. Thus, only options A is correct.

Answer

DeviceProcessEvents and DeviceEvents

Answer

DeviceNetworkEvents and IdentityLogonEvents

Answer

DeviceProcessEvents and DeviceFileEvents

Question 2

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should detect when a user receives a malicious email attachment and then opens the attachment, resulting in a process being created (e.g., .exe file). Which two Advanced Hunting tables must be joined to correlate the email attachment with the resulting process?

Accepted Answer

EmailAttachmentInfo and DeviceProcessEvents. Only option B (EmailAttachmentInfo and DeviceProcessEvents) is valid for directly correlating the email attachment with the resulting process. EmailAttachmentInfo contains attachment-specific details like file hash and name, which can be joined with the SHA256 hash or file name in DeviceProcessEvents to track execution. Option A joins EmailEvents with DeviceProcessEvents, but EmailEvents lacks attachment details, making it impossible to directly link the attachment to the executed process.

Answer

EmailEvents and DeviceProcessEvents

Answer

EmailAttachmentInfo and DeviceFileEvents

Answer

DeviceProcessEvents and IdentityLogonEvents

Question 3

A security analyst is investigating a potential attack where a user received a malicious email with an HTML attachment. The HTML file, when opened, fetched a JavaScript payload from a remote server that then dropped a binary on the user's machine and executed it. The analyst wants to create a custom detection rule in Microsoft 365 Defender Advanced Hunting that alerts when an email contains an HTML attachment with an external link, and that attachment is opened, causing a process creation. Which two tables should the analyst join in the KQL query to correlate the email attachment with the resulting process?

Accepted Answer

EmailAttachmentInfo and DeviceProcessEvents. To correlate an email attachment with a resulting process creation, the analyst needs to join the EmailAttachmentInfo table (which contains the SHA256 hash of the attachment) with the DeviceProcessEvents table (which records process creation events and includes the SHA256 hash of the file that initiated the process). Joining these on the SHA256 hash directly links the attachment to its execution. EmailEvents does not contain attachment details such as the SHA256 hash, so it cannot be directly joined to DeviceProcessEvents for this purpose. Therefore, only Option A is correct.

Answer

EmailEvents and DeviceProcessEvents

Answer

EmailAttachmentInfo and DeviceFileEvents

Answer

EmailUrlInfo and DeviceProcessEvents

Question 4

You are a Microsoft 365 administrator for a multinational organization. You are implementing Microsoft Defender XDR to provide centralized threat management across multiple domains. Which three of the following capabilities are core components of Microsoft Defender XDR? (Choose three.)

Accepted Answer

Microsoft Defender for Endpoint. The three core components of Microsoft Defender XDR are Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. These provide endpoint detection and response (EDR), email and collaboration protection, and identity threat detection, respectively. The other options—Microsoft Entra ID Governance, Microsoft Purview Information Protection, and Microsoft Intune Device Enrollment—are governance, compliance, or management tools and are not part of the Defender XDR suite.

Answer

Microsoft Entra ID Governance

Answer

Microsoft Purview Information Protection

Answer

Microsoft Intune Device Enrollment

Question 5

As a security administrator, you are tuning automated investigation and response (AIR) capabilities in Microsoft Defender XDR. You need to ensure that the system can automatically remediate threats while minimizing false positives. Which three of the following actions can be taken by automated investigation and response in Microsoft Defender XDR? (Choose three.)

Accepted Answer

Delete an email message from a user's mailbox that was identified as phishing. Automated investigation and response (AIR) in Microsoft Defender XDR can quarantine a file detected as malicious on a device by using built-in remediation actions that isolate the file from the operating system. It can also disable a compromised user account temporarily through integration with Microsoft Entra ID, applying a conditional account disable action to prevent further access. Additionally, AIR can delete an email message from a user's mailbox that was identified as phishing by leveraging Exchange Online Protection (EOP) and Microsoft Defender for Office 365 to perform mailbox-level remediation. Therefore, the three correct actions are: quarantine a file, disable a compromised user account, and delete a phishing email.

Answer

Uninstall an application from all devices in a tenant

Answer

Modify a Conditional Access policy to block all external access

Answer

Reset a user's password without administrator approval

Question 6

You are a Microsoft 365 administrator responsible for managing security and threats by using Microsoft Defender XDR. Which four of the following are core components or capabilities of Microsoft Defender XDR? (Choose all that apply. There are four correct answers.)

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender XDR is a unified pre- and post-breach enterprise defense suite that natively integrates signals from four core Microsoft Defender components: Defender for Endpoint (endpoint detection and response), Defender for Office 365 (email and collaboration security), Defender for Identity (on-premises Active Directory identity threat detection), and Defender for Cloud Apps (SaaS application access and shadow IT control). These four are the foundational pillars that feed into the Microsoft 365 Defender portal, enabling cross-domain correlation and automated incident response.

Answer

Microsoft Intune

Answer

Microsoft 365 Defender portal Threat Analytics

Question 7

Your organization uses Microsoft Defender for Office 365. You need to ensure that users are warned before opening potentially malicious attachments in Outlook on the web. Which policy setting should you configure?

Accepted Answer

Open in protected view. The 'Open in protected view' policy setting in Microsoft Defender for Office 365 ensures that when a user opens an email attachment in Outlook on the web, the file is opened in a sandboxed, read-only environment that warns the user of potential risks before allowing full interaction. This directly addresses the requirement to warn users before opening potentially malicious attachments, as it triggers a warning banner and restricts editing capabilities until the user explicitly enables editing.

Answer

Attachments in email are blocked

Answer

Attachments are held and scanned

Answer

Dynamic Delivery

Question 8

Your organization uses Microsoft Defender for Office 365. You need to protect users from malicious links in email messages. Which TWO features should you configure?

Accepted Answer

Safe Links. Safe Links (option B) is correct because it is the Defender for Office 365 feature that rewrites and detonates URLs in email messages at time-of-click, blocking malicious links before users reach phishing or malware sites. Safe Links for Office 365 apps (option E) is also correct because it extends the same time-of-click URL protection to links inside Office documents and apps (Word, Excel, PowerPoint, Teams), covering the broader link-based attack surface beyond email. Anti-phish policy (option A) focuses on spoofing, impersonation, and mailbox intelligence detections rather than URL detonation, so it does not directly neutralize malicious links. Safe Attachments (option C) scans email attachments in a sandbox and does not handle links. Spam filter policy (option D) applies anti-spam and bulk-mail controls, not URL protection.

Answer

Anti-phish policy

Answer

Safe Attachments

Answer

Spam filter policy

Question 9

Your organization uses Microsoft Defender for Office 365. You need to configure a policy that automatically moves emails containing malicious attachments to quarantine and notifies the security team. Additionally, you want to allow users to release their own quarantined messages if they are false positives. What should you do?

Accepted Answer

Create a new anti-malware policy and configure the quarantine policy to use 'LimitedAccess' or 'FullAccess'.. It describes creating a new anti-malware policy and associating it with a quarantine policy that permits user release (LimitedAccess or FullAccess). The default quarantine policy (AdminOnlyAccess) does not allow users to release their own messages. Options A, B, and D either use the default policy, explicitly prevent user release, or do not address the quarantine policy settings needed for user release.

Answer

Create a new anti-malware policy and use the default quarantine policy.

Answer

Create a new anti-malware policy and set 'User release' to 'False' in the quarantine policy.

Answer

Modify the anti-malware policy to set 'Quarantine' as the action and assign a custom quarantine policy with user release enabled.

Question 10

You are analyzing a custom detection rule in Microsoft Defender XDR. The rule is designed to alert on suspicious PowerShell execution. However, you notice that the rule is not triggering alerts even though you know such activity is occurring. What is the most likely reason?

Accepted Answer

The query syntax is invalid; 'has_any' requires a dynamic array.. 'has_any' in Kusto Query Language (KQL) requires a dynamic array as its argument. If the rule uses a list of strings without the dynamic wrapper, the syntax is invalid, causing the rule to fail silently or not trigger alerts. Other options are less likely: the rule being enabled/disabled is not mentioned as a factor, severity does not prevent detection, and the lookback period is not the issue if activity is known to be occurring.

Answer

The custom detection rule is not enabled.

Answer

The severity is set to Medium, which may be suppressed by other policies.

Answer

The rule only looks back 7 days, and the activity occurred more than 7 days ago.

Question 11

A security administrator needs to configure a policy that automatically blocks high-confidence phishing emails in Microsoft Defender for Office 365. The policy should be applied to all users in the finance department. The administrator wants to ensure that if an email is determined to be high-confidence phishing, it is quarantined and the user is not notified. Which type of policy should the administrator configure?

Accepted Answer

Anti-phishing policy. Anti-phishing policies in Defender for Office 365 can be configured to take action on high-confidence phishing emails, such as quarantining them. Option B is wrong because Safe Attachments policies handle malicious attachments, not the overall email classification. Option C is wrong because Anti-spam policies handle spam, not high-confidence phishing. Option D is wrong because Safe Links policies protect against malicious URLs.

Answer

Safe Attachments policy

Answer

Anti-spam policy

Answer

Safe Links policy

Question 12

Refer to the exhibit. You are reviewing an anti-phishing policy configuration in Microsoft Defender for Office 365. The policy is applied to all users. A user reports that a legitimate email from a known vendor (domain contoso.com) was quarantined. The email contained a link to a rarely visited website. The link was not malicious. Which setting in the policy is most likely causing the false positive?

Accepted Answer

EnableSimilarDomainsSafetyTips: true. EnableSimilarDomainsSafetyTips (option B) is most likely causing the false positive because it triggers warnings when the sender's domain appears similar to a known domain used in impersonation attacks. In this case, the vendor's domain contoso.com might be flagged as similar to another domain, such as contos0.com, even though the email is legitimate. Additionally, the presence of a link to a rarely visited website may increase the risk score, but the primary setting causing the quarantine is the similar domains safety tip. Option A is incorrect because MailboxIntelligence uses machine learning to reduce false positives. Option C is incorrect because PhishThresholdLevel of 2 is the default and does not directly cause false positives for legitimate domains. Option D is incorrect because EnableUnusualCharactersSafetyTips only flags unusual characters in the sender's name or domain, not a link.

Answer

EnableMailboxIntelligence: true

Answer

PhishThresholdLevel: 2

Answer

EnableUnusualCharactersSafetyTips: false

Question 13

A company is implementing Microsoft Defender for Identity (MDI) to protect its on-premises Active Directory environment. The security team needs to ensure that MDI can monitor all domain controllers. They have installed the MDI sensor on all domain controllers. However, they notice that some suspicious activities are not being detected. Which additional configuration should the team verify to ensure comprehensive coverage?

Accepted Answer

Configure port mirroring or network tap to ensure the sensor can see all relevant network traffic.. Microsoft Defender for Identity (MDI) sensors require port mirroring or a network tap to capture all relevant network traffic to and from domain controllers. Without this, some suspicious activities may not be visible to the sensor. Option B is incorrect because integrating Microsoft Defender for Cloud Apps is not necessary for MDI network traffic capture. Option C is incorrect because Microsoft Entra Connect Health does not affect MDI detection. Option D is incorrect while Event log forwarding can supplement detection, MDI primarily relies on network traffic analysis via its sensor.

Answer

Integrate Microsoft Defender for Cloud Apps with MDI.

Answer

Install Azure AD Connect Health on domain controllers.

Answer

Enable auditing on domain controllers and forward logs to Microsoft Sentinel.

Question 14

A security team is investigating a potential ransomware outbreak using Microsoft Defender XDR. They have identified a suspicious PowerShell command that was executed on several devices. The team wants to use Advanced Hunting to find all other activities associated with the same command. Which three columns should they include in their KQL query to effectively correlate the activities? (Choose three.)

Accepted Answer

SHA256. Option A (SHA256) is correct because the file hash uniquely identifies the PowerShell executable or script involved, allowing the team to pivot across all devices and processes that share the same binary regardless of filename or path. Option B (ProcessId) is correct because it identifies the specific process instance on a device, letting analysts trace child processes, network connections, and other events spawned by that exact PowerShell execution. Option E (DeviceId) is correct because it uniquely identifies each endpoint in Defender XDR, enabling correlation of the same command's activity across multiple affected devices. Option C (AccountUpn) is not required because the scenario focuses on correlating activities tied to the command itself rather than the user identity, and Option D (Timestamp) is a standard field present in every Advanced Hunting record but does not by itself correlate the specific command's related activities.

Answer

AccountUpn

Answer

Timestamp

Question 15

A security administrator is configuring Microsoft Defender for Endpoint (MDE) to automatically remediate threats. The administrator wants to ensure that when a high-severity alert is triggered, the affected device is isolated from the network. Which three components must be configured to achieve this? (Choose three.)

Accepted Answer

Alert severity. To automatically isolate a device when a high-severity alert is triggered, three components must be configured: Alert severity (A) to define which alerts trigger the action, Automation level (B) to enable automated response, and Device isolation action (E) as the specific remediation action. Option C (Device tag) is for grouping devices, not automation. Option D (Indicator of compromise) is used for blocking indicators, not for automated isolation.

Answer

Device tag

Answer

Indicator of compromise (IoC)