MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 3 — 15 Questions

Question 1

A security administrator needs to create an automated investigation and response (AIR) playbook that automatically isolates a device whenever a high-severity alert from Microsoft Defender for Endpoint is generated. The playbook should run without requiring manual approval. Which capability in Microsoft 365 Defender should the administrator configure?

Accepted Answer

Automated investigation and response (AIR) action policy. Option A is correct because Automated Investigation and Response (AIR) action policies in Microsoft 365 Defender allow administrators to define automated remediation actions—such as device isolation—that execute automatically when specific alert conditions are met, without requiring manual approval. The policy can be configured to trigger on high-severity alerts from Microsoft Defender for Endpoint, enabling fully automated containment of compromised devices.

Answer

Custom detection rule

Answer

Threat analytics

Answer

Attack simulation training

Question 2

A security analyst is investigating a potential lateral movement attack. They need to identify which processes were created on a compromised device and then which network connections were made by those processes. Which two advanced hunting tables should the analyst join in a KQL query?

Accepted Answer

A: DeviceProcessEvents and DeviceNetworkEvents. Option A is correct because the analyst needs to correlate process creation events (DeviceProcessEvents) with network connections initiated by those processes (DeviceNetworkEvents). Joining these two tables on a common field like DeviceId and ProcessId allows the analyst to trace which specific processes on the compromised device made outbound connections, directly mapping lateral movement indicators such as SMB, RDP, or WinRM traffic.

Answer

B: DeviceEvents and DeviceFileEvents

Answer

D: EmailEvents and DeviceNetworkEvents

Question 3

A security administrator wants to configure Automated Investigation and Response (AIR) in Microsoft 365 Defender to automatically isolate a device when a high-severity alert for malware is detected. Which step is required?

Accepted Answer

C: Configure the device to be part of a device group and enable automation level.. To enable Automated Investigation and Response (AIR) in Microsoft Defender for Endpoint, the device must be added to a device group, and the automation level for that group must be set to 'Full – remediate threats automatically' or a similar level. This configuration allows Defender to automatically isolate a device when a high-severity malware alert is triggered, as part of the built-in AIR playbooks.

Answer

A: Create an automation rule in Microsoft Sentinel.

Answer

B: Create a custom detection rule in advanced hunting.

Answer

D: Enable auto-removal of malware from devices.

Question 4

A security analyst wants to create a custom detection rule in Microsoft Defender XDR that triggers when a device establishes a network connection to an IP address that has been recently observed in threat intelligence feeds as a new, malicious command-and-control server. The rule should analyze network communication events. Which advanced hunting table should be the primary data source for the Kusto Query Language (KQL) query?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the correct primary data source because it captures network connection events, including source and destination IP addresses, ports, and protocols. To detect a device connecting to a newly observed malicious command-and-control server, the KQL query must analyze network communication events, which are stored exclusively in this table.

Answer

DeviceProcessEvents

Answer

EmailEvents

Answer

AlertEvidence

Question 5

A user receives an email from an unknown sender with a .zip attachment. The attachment contains a potentially malicious executable file. Microsoft Defender for Office 365 is enabled. Which feature dynamically detonates the attachment in a sandbox environment and blocks it if malicious behavior is detected?

Accepted Answer

Safe Attachments. Safe Attachments is the correct feature because it specifically detonates email attachments in a dynamic sandbox environment, analyzing behavior in real time. If the .zip file contains a malicious executable, Safe Attachments will block the email before delivery, preventing the user from accessing the threat. This is distinct from other Defender for Office 365 features that focus on URLs, phishing content, or spam filtering.

Answer

Safe Links

Answer

Anti-phishing

Answer

Anti-spam

Question 6

A security administrator wants to detect unusual user activity, such as a user downloading an abnormally large number of files from SharePoint Online in a short period. Which Microsoft Defender for Cloud Apps feature should be used to create a policy for this behavior?

Accepted Answer

Anomaly detection policy. Option C is correct because Microsoft Defender for Cloud Apps uses anomaly detection policies to identify unusual user behavior, such as a user downloading an abnormally large number of files from SharePoint Online in a short period. These policies leverage machine learning to establish a baseline of normal activity and then trigger alerts when deviations occur, like a spike in download volume or rate.

Answer

Cloud Discovery

Answer

Conditional Access App Control

Answer

App permissions

Question 7

A security analyst wants to create a custom detection rule in Microsoft Defender XDR that triggers when a user receives a phishing email (delivered to inbox) and then, from their Windows device, establishes a network connection to a known malicious IP address. The rule will be based on an advanced hunting query. Which two tables should the analyst join in the KQL query to capture both the email delivery event and the network connection event?

Accepted Answer

EmailEvents and DeviceNetworkEvents. Option A is correct because the rule requires capturing both the phishing email delivery event and the subsequent network connection to a malicious IP. The EmailEvents table records email delivery status (including 'Delivered' to inbox), and the DeviceNetworkEvents table records outbound network connections from Windows devices, including destination IP addresses. Joining these two tables on a common identifier (such as RecipientObjectId and DeviceId) allows the analyst to correlate the email receipt with the network connection event.

Answer

EmailEvents and DeviceProcessEvents

Answer

EmailAttachmentInfo and DeviceRegistryEvents

Question 8

A security administrator needs to configure an automated investigation and response (AIR) playbook in Microsoft 365 Defender that will automatically isolate a device whenever a high-severity alert from Microsoft Defender for Endpoint is generated. The playbook must run without requiring manual approval. Which configuration must the administrator set to achieve automatic device isolation?

Accepted Answer

Set the automation level for device isolation to 'Full - automatically remediate threats' in the Advanced Features settings.. Option A is correct because the automation level for device isolation in Microsoft 365 Defender's Advanced Features settings controls whether the AIR playbook executes actions automatically. Setting it to 'Full - automatically remediate threats' ensures that when a high-severity alert triggers the playbook, device isolation is performed without requiring manual approval, meeting the requirement for fully automated response.

Answer

Create a custom detection rule that triggers on high-severity alerts and uses an automated action.

Answer

Configure the device isolation action to require approval in the automation level settings.

Answer

Enable automatic remediation only for medium severity and above.

Question 9

A security administrator wants to block executable files from running from writable system directories such as %TEMP% and %APPDATA% on Windows devices. Which attack surface reduction (ASR) rule should be enabled?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion.. The ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) is designed specifically to block executables (e.g., .exe, .dll, .scr) from running from writable locations like %TEMP% and %APPDATA% unless they have sufficient global prevalence, are older than a certain age, or are on a trusted list. This directly addresses the administrator's requirement to prevent untrusted executables from executing from these directories.

Answer

Block Office communication application from creating child processes.

Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe).

Answer

Block executable content from email client and webmail.

Question 10

A security administrator needs to block outbound network connections from a compromised Windows device to a known malicious IP address. The solution should be configured in Microsoft Defender for Endpoint and must work at the network layer, not relying on a user-installed client. Which feature should the administrator enable?

Accepted Answer

Network protection. Option C, Network protection, is correct because it is a Microsoft Defender for Endpoint feature that blocks outbound connections to malicious IP addresses and domains at the network layer, using the Windows Filtering Platform (WFP) to enforce policies without requiring a user-installed client. This ensures the block applies system-wide, even if the device is compromised, as it operates before the TCP/IP stack processes the connection.

Answer

Attack surface reduction (ASR) rules

Answer

Custom detection rules (advanced hunting)

Answer

Web protection (web threat protection)

Question 11

A security analyst is building a custom detection rule in Microsoft 365 Defender to identify when a user clicks a malicious URL in a phishing email and subsequently visits the malicious site from their corporate device. The analyst plans to use advanced hunting with Kusto Query Language (KQL). Which two tables must be joined to capture both the URL click event and the network connection to the malicious site?

Accepted Answer

EmailEvents and DeviceNetworkEvents. Option B is correct because EmailUrlInfo contains the URL click events from phishing emails, and DeviceNetworkEvents logs network connections from corporate devices. Joining these two tables on the URL value captures the full chain: the user clicking the malicious link and the device subsequently connecting to that site.

Answer

EmailAttachmentInfo and DeviceProcessEvents

Answer

EmailEvents and DeviceFileEvents

Question 12

An administrator wants to configure automated investigation and response (AIR) in Microsoft 365 Defender so that when a high-severity malware alert is generated for a device from Microsoft Defender for Endpoint, the device is automatically isolated from the network without requiring a security analyst to approve the action. Which configuration step is required?

Accepted Answer

Set the automation level for device isolation to 'Full - remediate threats automatically'. Option B is correct because setting the automation level for device isolation to 'Full - remediate threats automatically' in Microsoft Defender for Endpoint's automated investigation and response (AIR) configuration allows the system to automatically isolate a device when a high-severity malware alert is triggered, without requiring analyst approval. This automation level is specifically designed to execute remediation actions like device isolation immediately based on the alert's severity and the device's risk level.

Answer

Set the automation level for device isolation to 'Semi - require approval for any remediation'

Answer

Create a custom detection rule that automatically isolates the device

Answer

Enable 'Automated device isolation' in the Microsoft 365 Defender settings

Question 13

A security administrator needs to block executable files from running from the %TEMP% folder on Windows devices to prevent common malware execution. Which attack surface reduction (ASR) rule should be enabled?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criteria. Option A is correct because the ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criteria' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) specifically targets executables launched from locations commonly used by malware, such as the %TEMP% folder. This rule uses cloud-delivered reputation data to allow only executables that are prevalent, have sufficient age, or are on a trusted list, effectively blocking unknown or suspicious binaries from running in temporary directories.

Answer

Block credential stealing from the Windows local security authority subsystem

Answer

Block all Office applications from creating child processes

Answer

Block JavaScript or VBScript from launching downloaded executable content

Question 14

A security administrator wants to monitor and control user downloads from a third-party SaaS application (e.g., Box) in real time. The administrator needs to apply session-level policies to block downloads based on risk. Which Microsoft 365 Defender feature should be used?

Accepted Answer

Conditional Access App Control. Conditional Access App Control (CAAC) is the correct feature because it enables real-time session-level monitoring and control of user activities within third-party SaaS applications like Box. By integrating with Microsoft Defender for Cloud Apps, CAAC can apply policies to block downloads based on risk signals such as user location, device compliance, or anomalous behavior, all within the user's active session.

Answer

Cloud Discovery

Answer

App Connectors

Answer

Anomaly Detection Policies

Question 15

A security administrator needs to block outbound network connections from a compromised Windows device to command-and-control servers. The solution must work at the network layer and be centrally managed via Microsoft 365 Defender. Which feature should the administrator enable?

Accepted Answer

Network Protection. Network Protection in Microsoft Defender for Endpoint blocks outbound connections to command-and-control (C2) servers at the network layer by inspecting traffic using the Windows Filtering Platform (WFP). It is centrally managed via Microsoft 365 Defender policies and does not require per-device firewall rule configuration, making it the correct choice for this scenario.

Answer

Attack Surface Reduction rules

Answer

Session control in Defender for Cloud Apps

Answer

Windows Firewall with Advanced Security