MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 3 — 15 Questions

Question 1

A security analyst is investigating a potential attack where a user received a malicious email with an HTML attachment. The HTML file, when opened, fetched a JavaScript payload from a remote server that then dropped a binary on the user's machine and executed it. The analyst wants to create a custom detection rule in Microsoft 365 Defender Advanced Hunting that alerts when an email contains an HTML attachment with an external link, and that attachment is opened, causing a process creation. Which two tables should the analyst join in the KQL query to correlate the email attachment with the resulting process?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

EmailAttachmentInfo and DeviceProcessEvents. To correlate an email attachment with a resulting process creation, the analyst needs to join the EmailAttachmentInfo table (which contains the SHA256 hash of the attachment) with the DeviceProcessEvents table (which records process creation events and includes the SHA256 hash of the file that initiated the process). Joining these on the SHA256 hash directly links the attachment to its execution. EmailEvents does not contain attachment details such as the SHA256 hash, so it cannot be directly joined to DeviceProcessEvents for this purpose. Therefore, only Option A is correct.

Answer

EmailEvents and DeviceProcessEvents

Answer

EmailAttachmentInfo and DeviceFileEvents

Answer

EmailUrlInfo and DeviceProcessEvents

Question 2

You are a Microsoft 365 administrator for a multinational organization. You are implementing Microsoft Defender XDR to provide centralized threat management across multiple domains. Which three of the following capabilities are core components of Microsoft Defender XDR? (Choose three.)

Accepted Answer

Microsoft Defender for Endpoint. The three core components of Microsoft Defender XDR are Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. These provide endpoint detection and response (EDR), email and collaboration protection, and identity threat detection, respectively. The other options—Microsoft Entra ID Governance, Microsoft Purview Information Protection, and Microsoft Intune Device Enrollment—are governance, compliance, or management tools and are not part of the Defender XDR suite.

Answer

Microsoft Intune Device Enrollment

Answer

Microsoft Entra ID Governance

Answer

Microsoft Purview Information Protection

Question 3

As a security administrator, you are tuning automated investigation and response (AIR) capabilities in Microsoft Defender XDR. You need to ensure that the system can automatically remediate threats while minimizing false positives. Which three of the following actions can be taken by automated investigation and response in Microsoft Defender XDR? (Choose three.)

Accepted Answer

Quarantine a file detected as malicious on a device. Automated investigation and response (AIR) in Microsoft Defender XDR can quarantine a file detected as malicious on a device by using built-in remediation actions that isolate the file from the operating system. It can also disable a compromised user account temporarily through integration with Microsoft Entra ID, applying a conditional account disable action to prevent further access. Additionally, AIR can delete an email message from a user's mailbox that was identified as phishing by leveraging Exchange Online Protection (EOP) and Microsoft Defender for Office 365 to perform mailbox-level remediation. Therefore, the three correct actions are: quarantine a file, disable a compromised user account, and delete a phishing email.

Answer

Reset a user's password without administrator approval

Answer

Modify a Conditional Access policy to block all external access

Answer

Uninstall an application from all devices in a tenant

Question 4

You are a Microsoft 365 administrator responsible for managing security and threats by using Microsoft Defender XDR. Which four of the following are core components or capabilities of Microsoft Defender XDR? (Choose all that apply. There are four correct answers.)

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender XDR is a unified pre- and post-breach enterprise defense suite that natively integrates signals from four core Microsoft Defender components: Defender for Endpoint (endpoint detection and response), Defender for Office 365 (email and collaboration security), Defender for Identity (on-premises Active Directory identity threat detection), and Defender for Cloud Apps (SaaS application access and shadow IT control). These four are the foundational pillars that feed into the Microsoft 365 Defender portal, enabling cross-domain correlation and automated incident response.

Answer

Microsoft Intune

Answer

Microsoft 365 Defender portal Threat Analytics

Question 5

Drag and drop the steps to configure a Conditional Access policy in Microsoft Entra ID in the correct order.

Accepted Answer

1. Create a new Conditional Access policy, 2. Assign users and groups, 3. Configure conditions (cloud apps, locations, etc.), 4. Configure access controls (Grant/Block) and enable policy. Conditional Access policies are created in Entra ID, assigned to users, conditions defined, and access controls applied.

Answer

1. Configure access controls, 2. Assign users and groups, 3. Configure conditions, 4. Create a new Conditional Access policy

Answer

1. Create a new Conditional Access policy, 2. Configure conditions, 3. Assign users and groups, 4. Configure access controls and enable policy

Answer

1. Assign users and groups, 2. Create a new Conditional Access policy, 3. Configure access controls, 4. Enable policy

Question 6

Drag and drop the steps to configure a compliance retention policy in Microsoft Purview in the correct order.

Accepted Answer

Create a retention policy → Select locations → Configure retention settings → Publish the policy. Retention policies are created in Purview, locations selected, retention settings defined, and then published.

Answer

Select locations → Create a retention policy → Configure retention settings → Publish the policy

Answer

Configure retention settings → Create a retention policy → Select locations → Publish the policy

Answer

Create a retention policy → Publish the policy → Select locations → Configure retention settings

Question 7

Your organization is implementing Microsoft Defender for Cloud Apps. You need to configure anomaly detection policies to alert when a user downloads an unusually large number of files from SharePoint Online. Which data source should you connect to enable this detection?

Accepted Answer

App connector for SharePoint Online. To detect anomalous file downloads from SharePoint Online, Microsoft Defender for Cloud Apps requires direct integration with the service via an App connector. The App connector for SharePoint Online (option B) enables the collection of metadata and activity logs necessary for anomaly detection policies, such as the 'Unusual file download by a user' policy. Without this connector, Defender for Cloud Apps cannot monitor SharePoint Online activities.

Answer

API connector for custom apps

Answer

Microsoft 365 Defender portal

Answer

Microsoft Entra ID logs

Question 8

Your organization uses Microsoft Defender for Endpoint (MDE). You need to configure an automated investigation and response (AIR) capability that will automatically remediate a confirmed malware infection on endpoints. Which action should you enable?

Accepted Answer

Automatically resolve alerts. Enabling 'Automatically resolve alerts' in Microsoft Defender for Endpoint's automated investigation and response (AIR) capabilities allows the system to automatically remediate confirmed malware infections by resolving the alert and applying the appropriate remediation actions (e.g., quarantining files, terminating processes) without manual intervention. This setting ensures that once an investigation confirms a threat, the response is executed automatically, aligning with the requirement for automated remediation.

Answer

Run antivirus scan

Answer

Notify users via email

Answer

Isolate device

Question 9

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos ticket request. You need to investigate which user account is potentially compromised. Which tool should you use to correlate the alert with user activity?

Accepted Answer

Microsoft Defender XDR portal. The Microsoft Defender XDR portal (security.microsoft.com) provides a unified incident queue that correlates alerts from Defender for Identity with user activity, including Kerberos ticket requests. This allows you to investigate the specific user account involved by examining the alert timeline, related events, and entity details such as the account's authentication patterns and potential lateral movement.

Answer

Microsoft Intune admin center

Answer

Microsoft Purview compliance portal

Answer

Microsoft Entra admin center

Question 10

Your organization uses Microsoft Defender for Office 365 and wants to simulate a phishing attack to train users. You need to configure a simulation that uses a URL link to a credential harvesting page. Which feature should you use?

Accepted Answer

Attack simulation training. Attack simulation training in Microsoft Defender for Office 365 is the dedicated feature for creating and launching realistic phishing simulations, including those that use a URL link to a credential harvesting page. It allows administrators to configure payloads, target users, and track training completion, directly meeting the requirement to simulate a phishing attack for user education.

Answer

Anti-phish policies

Answer

Safe Links policies

Answer

Safe Attachments policies

Question 11

Your organization uses Microsoft Defender for Endpoint. You need to configure a rule that automatically isolates a device from the network when a specific threat is detected, but only if the device is in a specific device group. Which approach should you use?

Accepted Answer

Automation rule. Automation rules in Microsoft Defender for Endpoint allow you to define automated actions, such as isolating a device, based on specific conditions like threat severity and device group membership. This directly meets the requirement to isolate only devices in a specific group when a specific threat is detected, as automation rules support granular scoping by device group.

Answer

Indicator of compromise (IoC)

Answer

Custom detection rule

Answer

Group policy in Intune

Question 12

Your organization uses Microsoft Defender for Cloud Apps. You need to generate a report of all external users who have shared sensitive files from SharePoint Online. Which feature should you use?

Accepted Answer

Activity log. The Activity log in Microsoft Defender for Cloud Apps captures detailed records of user activities across connected apps, including file-sharing events in SharePoint Online. By filtering the log for external users and sensitive file types, you can generate a precise report of external sharing activities. This is the correct feature because it directly records the specific actions needed for the report.

Answer

OAuth app policies

Answer

App permissions report

Answer

Cloud Discovery

Question 13

Your organization uses Microsoft Defender for Identity. You need to configure a honeytoken account to detect attackers trying to use the account. In which location should you place the honeytoken account?

Accepted Answer

A domain user account with no privileges. A honeytoken account in Microsoft Defender for Identity is designed to lure attackers by appearing as a real, low-privilege account that no legitimate user should ever authenticate with. Placing it as a domain user account with no privileges ensures that any authentication attempt using its credentials is suspicious and triggers an alert, because no legitimate activity should involve this account. This allows Defender for Identity to detect lateral movement or credential theft attempts without risking exposure of sensitive resources.

Answer

A service account with high privileges

Answer

A non-existent account alias in AD

Answer

A guest account

Question 14

Your organization uses Microsoft Defender for Endpoint. You need to configure advanced hunting to query device information. Which TWO tables contain device-related data?

Accepted Answer

DeviceInfo. DeviceInfo is correct because it is the primary table in Microsoft Defender for Endpoint advanced hunting that stores comprehensive device metadata, including OS version, device name, and sensor health. This table is essential for querying device-related information such as device inventory, onboarding status, and configuration details.

Answer

AlertInfo

Answer

EmailEvents

Answer

IdentityLogonEvents

Question 15

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that detects when a user signs in from an unknown IP address and then downloads a large number of files. Which THREE components should you configure?

Accepted Answer

Scope (users and groups). The policy must be scoped to specific users or groups to ensure that the anomaly detection rule (unknown IP followed by mass download) applies only to the intended set of accounts. Without scoping, the policy would evaluate all users, which may generate excessive noise or miss targeted monitoring. In Microsoft Defender for Cloud Apps, the Scope (users and groups) setting is a required component when creating an anomaly detection policy to define which identities are monitored.

Answer

IP address range category

Answer

Session policy