MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 20 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Office 365. You need to ensure that emails containing malicious attachments are automatically removed from users' inboxes after detection. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a Safe Attachments policy. Configure a Safe Attachments policy. Safe Attachments policies in Defender for Office 365 automatically scan email attachments for malicious content and can remove or quarantine emails with detected malware. Option A (Safe Links) protects against malicious URLs, not attachments. Option B (anti-spam policy) handles spam, not malware in attachments. Option D (attack simulation training) is for phishing simulations, not automatic removal of malicious attachments.

Answer

Configure a Safe Links policy

Answer

Configure an anti-spam policy to delete the email

Answer

Use the attack simulation training to report the email

Question 2

Your organization uses Microsoft Defender for Office 365. You need to ensure that emails containing malicious attachments are automatically removed from users' inboxes after detection. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate a device from the network. Option B (Isolate a device from the network) is correct because Microsoft Defender XDR automated investigation and response (AIR) can automatically contain a compromised endpoint by isolating it from the network, blocking most network traffic while preserving the Defender for Endpoint connection for remediation. Option C (Collect an investigation package from a device) is correct because AIR can automatically gather forensic data from an endpoint into an investigation package, which includes running processes, network connections, scheduled tasks, and other artifacts for analyst review. Option A (Create a mailbox rule to delete suspicious emails) is not an AIR response action; mailbox-level remediation in Defender XDR is performed through actions like soft delete, hard delete, or moving messages to Junk/Deleted Items, not by creating custom mailbox rules. Option D (Delegate mailbox permissions) is an Exchange administrative task unrelated to automated incident response. Option E (Reset user passwords) is not an automated response action provided by Defender XDR AIR; password resets are handled through identity management tools such as Microsoft Entra ID, not as a Defender XDR automated remediation.

Answer

Create a mailbox rule to delete suspicious emails

Answer

Delegate mailbox permissions

Answer

Reset user passwords

Question 3

Refer to the exhibit. You run the KQL query and see that a device named 'WORKSTATION42' has made 1500 connections to a public IP address 203.0.113.55 in the last day. You suspect the device may be compromised. What should you do next to gain the most context?

Accepted Answer

Expand the query to join with DeviceProcessEvents to see which process initiated the connections. Expanding the query to join with DeviceProcessEvents will provide context on which process initiated the connections, helping determine if the activity is malicious or benign. This is the next logical step in an investigation before taking containment actions.

Answer

Isolate the device immediately using Microsoft Defender for Endpoint

Answer

Add the IP address to the Tenant Allow/Block List to block it

Answer

Create a Safe Links policy to block the IP address

Question 4

Your organization is a financial services company with 5,000 users. You use Microsoft Defender XDR, including Defender for Endpoint Plan 2, Defender for Identity, Defender for Office 365 Plan 2, and Defender for Cloud Apps. You have recently deployed Microsoft Copilot for Security to assist your security operations center (SOC) analysts. A high-severity incident is generated: 'A user named jdoe accessed a malicious IP address from their device, and then logged into Azure Portal from an anonymous IP address. Defender for Identity detected a suspicious Kerberos ticket request from the same user's domain controller. The SOC analysts are overwhelmed with alerts and need to quickly understand the full scope of the incident, including related alerts, impacted assets, and recommended actions. They also want to use natural language to ask questions about the incident. What should you do to enable the analysts to efficiently investigate this incident?

Accepted Answer

Use Microsoft Copilot for Security integrated with Microsoft Defender XDR to get a natural language summary of the incident, ask follow-up questions, and receive recommended actions.. Microsoft Copilot for Security integrated with Microsoft Defender XDR provides natural language summaries of incidents, allows follow-up questions, and offers recommended actions. This directly addresses the SOC analysts' need to quickly understand the full scope and use natural language, reducing investigation time.

Answer

Train the analysts to use Advanced Hunting to query across all data sources and build custom KQL queries to correlate the alerts.

Answer

Create custom detection rules in Microsoft Defender XDR to generate more specific alerts for similar activity.

Answer

Configure automated investigation and remediation to automatically contain the threat and then review the results.

Question 5

Your organization is a small business with 200 users. You use Microsoft 365 Business Premium, which includes Microsoft Defender for Business (the small business version of Defender for Endpoint) and Microsoft Defender for Office 365 Plan 1. You want to protect against ransomware by blocking malicious processes and behaviors on endpoints. You also need to enable automated investigation and response for common threats. However, your IT team has limited security expertise and wants a simple configuration that provides out-of-the-box protection without custom policies. What should you do?

Accepted Answer

Enable the default security baseline in Microsoft Defender for Business, which includes attack surface reduction rules and automated investigation.. Microsoft Defender for Business includes a default security baseline that turns on recommended attack surface reduction (ASR) rules, next-generation antivirus, and automated investigation and response (AIR) out of the box. For a 200-user shop with limited security expertise, enabling this baseline delivers ransomware-blocking behavior rules and automated remediation without requiring custom policy authoring. This matches the requirement for simple, out-of-the-box protection.

Answer

Configure Safe Attachments policies in Microsoft Defender for Office 365 to block ransomware attachments.

Answer

Create custom attack surface reduction rules in Microsoft Defender for Business to block ransomware behaviors.

Answer

Deploy a third-party endpoint detection and response (EDR) solution alongside Microsoft Defender for Business.

Question 6

You are a security administrator for an organization that uses Microsoft Defender XDR. You want to provide your security operations team with a unified view of all incidents across endpoints, email, and identities. You also want to automate the creation of incidents when correlated alerts are detected. What should you do?

Accepted Answer

Navigate to the Microsoft Defender XDR portal (security.microsoft.com) and use the Incidents view.. The Microsoft Defender XDR portal (security.microsoft.com) provides a unified incident view and automatically correlates alerts from multiple workloads (endpoints, email, identities) into incidents. Option B is incorrect because Microsoft Defender for Endpoint portal focuses only on endpoint data, not the unified view across all services. Option C is incorrect because while Microsoft Sentinel can provide a unified view, it requires additional licensing, configuration, and does not automatically create incidents from correlated alerts without custom analytics rules. Option D is incorrect because custom KQL queries and workbooks provide visibility but do not automate incident creation; that requires built-in correlation from Microsoft Defender XDR.

Answer

Open the Microsoft Defender for Endpoint portal and create a dashboard for all alerts.

Answer

Install Microsoft Sentinel and configure data connectors for all workloads.

Answer

Create a custom KQL query that correlates alerts from different sources and create a workbook.

Question 7

Your organization uses Microsoft Defender for Office 365. You need to ensure that emails containing malicious attachments are automatically removed from users' inboxes after detection. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In Microsoft Defender XDR, go to Settings > Email & collaboration > User reported messages, and enable 'Send reported messages to Microsoft' and 'Notify users when analysis completes'.. The user-reported messages settings in Microsoft Defender XDR (Settings > Email & collaboration > User reported messages) allow you to automatically send reported messages to Microsoft for analysis and notify users when analysis completes, minimizing administrative effort. Option A is wrong because a mail flow rule would only forward messages to a security team mailbox, not to Microsoft, and would not provide automatic analysis or user notification. Option B is wrong because simply configuring the Report Message add-in for all users enables reporting but does not by itself automatically submit to Microsoft or notify users; the Defender XDR settings are required for those actions. Option C is wrong because manually submitting each reported email via the Microsoft 365 Defender portal defeats the goal of minimizing administrative effort and does not automatically notify the user of results.

Answer

Create a mail flow rule that forwards reported messages to a security team mailbox.

Answer

Configure the Microsoft Report Message add-in for all users.

Answer

Use the Microsoft 365 Defender portal to manually submit the email for analysis whenever a user reports it.

Question 8

Your company uses Microsoft Defender XDR and Microsoft Defender for Cloud Apps. You have discovered that a user's credentials were compromised and used to access a SaaS application from an unusual location. You need to automatically suspend the user's access to all cloud apps and require a password reset. The suspension should be immediate upon detection. What should you do?

Accepted Answer

In Microsoft Defender for Cloud Apps, create a session policy that uses the 'Suspend user' governance action and configure it to require password reset.. Microsoft Defender for Cloud Apps allows you to create a session policy with the 'Suspend user' governance action, which can automatically suspend the user's access to all cloud apps upon detection of anomalous activity. Additionally, you can configure the policy to require a password reset, ensuring immediate remediation. Option B is wrong because a Microsoft Sentinel playbook can disable the user account but does not inherently force a password reset, and the response may not be immediate due to playbook execution delays. Option C is wrong because a conditional access policy in Microsoft Entra ID can block access from unusual locations but does not suspend the user or require a password reset. Option D is wrong because Microsoft Defender XDR automated investigation rules cannot reset passwords; that action is not available in Defender XDR.

Answer

Create a playbook in Microsoft Sentinel that disables the user account in Microsoft Entra ID.

Answer

Set up a conditional access policy in Microsoft Entra ID to block all access from unusual locations.

Answer

Configure an automated investigation rule in Microsoft Defender XDR to reset the user's password.

Question 9

You are a security administrator for a company that uses Microsoft Defender XDR. You need to generate a report that shows the number of incidents closed as true positive, false positive, and benign in the last 30 days. You want to use built-in features without writing custom queries. What should you do?

Accepted Answer

In the Microsoft Defender XDR portal, go to Reports > General > Incident summary.. The Microsoft Defender XDR portal includes a built-in Reports section under General with an Incident summary report that shows incident counts by classification (true positive, false positive, benign) over a selected period such as 30 days. This requires no custom queries and directly provides the requested metrics. Navigating to Reports > General > Incident summary is the correct built-in path.

Answer

Use the Microsoft Defender for Endpoint reports section.

Answer

Use the Device health report in Microsoft Defender XDR.

Answer

Navigate to Threat analytics in the Defender XDR portal.

Question 10

Your organization uses Microsoft Defender for Office 365. You need to ensure that emails containing malicious attachments are automatically removed from users' inboxes after detection. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the Microsoft Defender XDR portal, go to Settings > Microsoft 365 Defender > Email notifications, and create a notification for high-severity incidents.. In Microsoft Defender XDR, email notifications for incidents are configured under Settings > Microsoft 365 Defender > Email notifications. You can create a notification rule that specifies the severity level (e.g., high) and recipients. This directly fulfills the requirement to receive email notifications for high-severity incidents only.

Answer

Create an incident response rule that sends an email when a high-severity incident is created.

Answer

Use the Microsoft Purview compliance portal to create an alert policy.

Answer

Configure a service health notification in the Microsoft 365 admin center.

Question 11

Your organization uses Microsoft Defender for Office 365. You need to ensure that emails containing malicious attachments are automatically removed from users' inboxes after detection. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In Microsoft Defender for Cloud Apps, create a session policy with the 'Suspend user' governance action and configure it to revoke sessions and require re-authentication.. Microsoft Defender for Cloud Apps can create a session policy with the 'Suspend user' governance action, which integrates with Microsoft Entra ID to revoke all active sessions and require the user to re-authenticate with MFA. This automates the process of terminating sessions and enforcing re-authentication when a user is compromised. Option B is incorrect because disabling the user account terminates sessions but does not require MFA re-authentication for future access. Option C is incorrect because a conditional access policy requiring MFA for all users does not terminate existing sessions; it only applies to new authentication requests. Option D is incorrect because manually resetting the password and signing out of sessions is not automated and does not leverage the capabilities of Microsoft Defender XDR and Microsoft 365 E5 licenses.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Create a conditional access policy that requires MFA for all users.

Answer

Manually reset the user's password and sign out of all sessions.

Question 12

You are a security administrator for a company that uses Microsoft Defender XDR. You need to investigate a suspicious email that was reported by a user. You want to see the full email details, including headers, attachments, and URLs. Where should you look?

Accepted Answer

In the Microsoft Defender XDR portal, search for the email message ID or subject to open the email entity page.. The email entity page in the Microsoft Defender XDR portal allows you to search by message ID or subject to view full email details including headers, attachments, and URLs. Option A is incorrect because the Threat analytics dashboard provides information about threats and attack patterns, not individual email details. Option B is incorrect because the user entity page shows user activity and alerts, not email details. Option D is incorrect because incident details provide alerts and evidence, but not the full email entity with headers and attachments.

Answer

Use the Threat analytics dashboard to find the email.

Answer

Go to the user entity page and view their email activity.

Answer

Open the incident related to the email and view the alert details.

Question 13

You are a security administrator for a company that uses Microsoft Defender XDR. A security incident involving a compromised user account has been escalated. You need to identify all devices where the compromised user account signed in within the last 7 days. Which Microsoft Defender XDR feature should you use?

Accepted Answer

Advanced hunting with the IdentityLogonEvents table. Advanced hunting with the IdentityLogonEvents table provides a comprehensive view of sign-in events across devices, including those from Defender for Identity. By querying this table for the compromised user and a 7-day timeframe, you can accurately list all devices where the account signed in, enabling effective incident response.

Answer

Incident queue filtered by the user's email address

Answer

Device inventory filtered by the user's primary email

Answer

Microsoft Defender for Cloud Apps activity log

Question 14

You are a security administrator for a company that uses Microsoft Defender XDR. You need to create a custom detection rule that triggers when a process named 'mimikatz.exe' is executed on any device. The rule should run every hour and generate an alert. Which of the following should you use to create this rule?

Accepted Answer

Microsoft Defender for Endpoint advanced hunting with a custom detection rule. Custom detection rules in Microsoft Defender for Endpoint allow security teams to create scheduled KQL queries that run against advanced hunting data and generate alerts when specific conditions are met. This is the appropriate tool for detecting process execution like mimikatz.exe on endpoints, as it provides the necessary data and scheduling capabilities.

Answer

Microsoft Defender for Office 365 threat explorer

Answer

Microsoft 365 Defender incident queue

Answer

Microsoft Defender for Cloud Apps activity log

Question 15

You are a security administrator for a company that uses Microsoft Defender XDR. You need to configure automated investigation and response (AIR) in Microsoft Defender for Endpoint to automatically remediate threats. You want to ensure that when a high-severity alert is triggered, the device is isolated and the malicious file is quarantined without manual intervention. Which setting should you configure?

Accepted Answer

Automation level in Microsoft Defender for Endpoint settings. The automation level setting in Microsoft Defender for Endpoint controls whether automated investigations automatically remediate threats. Setting it to full automation enables the system to isolate devices and quarantine files without human intervention when high-severity alerts occur, meeting the requirement.

Answer

Advanced hunting custom detection rules

Answer

Attack surface reduction rules

Answer

Alert notification rules in Microsoft 365 Defender