MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 4 — 15 Questions

Question 1

A security analyst wants to automatically create a Microsoft Teams message in a dedicated security channel whenever a Microsoft 365 Defender incident with severity 'High' is created. Which automation approach should the analyst use?

Accepted Answer

Power Automate. Power Automate is the correct choice because it provides a no-code/low-code workflow that can be triggered by Microsoft 365 Defender's 'When an incident is created or updated' connector, filter for severity 'High', and then post a message to a dedicated Teams channel via the 'Post a message in a chat or channel' action. This directly meets the requirement for automatic, event-driven notification without custom code.

Answer

Automation rules in Defender

Answer

Microsoft Graph API

Answer

Action Center

Question 2

A security analyst wants to create a custom detection rule in Microsoft 365 Defender that triggers when a PowerShell process with suspicious command-line arguments is detected on a device, and within 5 minutes, an outbound network connection to a known malicious IP occurs. Which two advanced hunting tables must be joined in the KQL query?

Accepted Answer

DeviceProcessEvents and DeviceNetworkEvents. Option A is correct because the detection rule requires correlating a PowerShell process event (stored in DeviceProcessEvents) with a subsequent outbound network connection to a known malicious IP (stored in DeviceNetworkEvents). Joining these two tables on the device ID and timestamp within a 5-minute window allows the KQL query to identify the specific sequence of process execution followed by network activity, which is the core behavior being monitored.

Answer

EmailEvents and DeviceNetworkEvents

Answer

IdentityLogonEvents and DeviceNetworkEvents

Question 3

A security administrator wants to prevent Microsoft Office applications (Word, Excel, PowerPoint) from creating child processes, which is a common technique used by malware to execute malicious code. Which attack surface reduction (ASR) rule should be enabled?

Accepted Answer

Block all Office applications from creating child processes. Option A is correct because the ASR rule 'Block all Office applications from creating child processes' (GUID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A) specifically prevents Word, Excel, and PowerPoint from spawning child processes such as cmd.exe, PowerShell, or wscript.exe. This directly mitigates a common malware technique where Office macros or exploits launch malicious executables. The rule is part of Microsoft Defender for Endpoint's attack surface reduction capabilities and is designed to stop process injection and lateral movement without blocking legitimate Office functionality.

Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criteria

Answer

Block Office applications from creating executable content

Answer

Block Win32 API calls from Office macros

Question 4

A security administrator wants to block users from uploading files to personal cloud storage apps (e.g., Dropbox) from managed Windows devices, while allowing access from compliant mobile devices. Which Microsoft 365 Defender feature should be used?

Accepted Answer

Microsoft Defender for Cloud Apps session policy. Microsoft Defender for Cloud Apps session policies use reverse proxy architecture to monitor and control user activities in real time. By configuring a session policy with the 'Block' action for the 'Upload file' activity on managed Windows devices, the administrator can prevent file uploads to personal cloud storage apps like Dropbox. Conditional Access App Control enforces this policy based on device compliance, allowing compliant mobile devices to bypass the block.

Answer

Microsoft Defender for Endpoint Attack Surface Reduction rules

Answer

Microsoft Defender for Office 365 Safe Attachments

Answer

Microsoft Defender for Identity

Question 5

A security administrator needs to block executable files (e.g., .exe, .ps1) from running from the %TEMP% folder on Windows devices to prevent common malware execution. Which attack surface reduction (ASR) rule should be enabled?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion. ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) is designed specifically to block executables (including .exe, .ps1, .scr, .dll) from launching from locations like %TEMP%, %APPDATA%, and the Windows folder, which are common malware staging areas. This rule uses cloud-delivered reputation (prevalence and age) and a Microsoft-managed trusted list to allow legitimate files while blocking unknown or suspicious ones, directly addressing the requirement to prevent malware execution from %TEMP%.

Answer

Block executable content from email client and webmail

Answer

Block Office applications from creating child processes

Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Question 6

A security analyst needs to create a custom detection rule in Microsoft 365 Defender that triggers when a suspicious PowerShell process (e.g., using -EncodedCommand) is detected on a device, and within 5 minutes, an outbound network connection to a known malicious IP address occurs. Which two advanced hunting tables must be joined?

Accepted Answer

DeviceProcessEvents and DeviceNetworkEvents. The custom detection rule requires correlating a suspicious PowerShell process event with a subsequent outbound network connection to a malicious IP within a 5-minute window. DeviceProcessEvents contains process creation data (e.g., command line, process name) for detecting encoded PowerShell commands, while DeviceNetworkEvents logs network connections (destination IP, port, protocol). Joining these two tables on DeviceId and a time range allows the rule to identify the sequence of a process event followed by a network event from the same device.

Answer

DeviceEvents and DeviceFileCertificateInfo

Answer

IdentityLogonEvents and CloudAppEvents

Answer

EmailEvents and EmailAttachmentInfo

Question 7

A security administrator wants to ensure that all email attachments are scanned in a sandbox environment and blocked if malicious, with email delivery delayed until scanning completes. Which Microsoft 365 Defender policy should the administrator configure?

Accepted Answer

Safe Attachments policy. Safe Attachments policy is the correct choice because it specifically provides time-of-delivery scanning of email attachments in a virtual sandbox environment. When configured with the 'Dynamic Delivery' action, the email body is delivered immediately while the attachment is held and scanned; if the attachment is found malicious, it is blocked and the user is notified. This directly meets the requirement to delay email delivery until scanning completes and block malicious attachments.

Answer

Safe Links policy

Answer

Anti-spam policy

Answer

Anti-phishing policy

Question 8

A security analyst is using Microsoft 365 Defender Advanced Hunting to investigate a potential malware outbreak. The analyst needs to find all devices where a specific signed executable (known to be malicious) was created in the past 24 hours. Which Advanced Hunting table should be queried to detect the creation of the executable file?

Accepted Answer

DeviceFileEvents. The DeviceFileEvents table in Microsoft 365 Defender Advanced Hunting captures file creation, modification, and deletion events. Since the question specifically asks for detecting the creation of a signed executable file, this table provides the necessary data, including file name, path, and timestamp, to identify when and where the malicious executable was created.

Answer

DeviceProcessEvents

Answer

DeviceNetworkEvents

Answer

DeviceRegistryEvents

Question 9

A security administrator wants to prevent users from uploading files to unsanctioned cloud storage apps (e.g., personal Dropbox or Google Drive) from managed Windows devices. The solution must use a reverse proxy to control file uploads in real time. Which Microsoft Defender for Cloud Apps feature should the administrator configure?

Accepted Answer

Session policy. Session policy in Microsoft Defender for Cloud Apps uses reverse proxy capabilities to monitor and control user activities in real time. When configured with the 'Control file upload' action, it can block or restrict uploads to unsanctioned cloud storage apps like personal Dropbox or Google Drive from managed Windows devices, meeting the requirement exactly.

Answer

App discovery policy

Answer

Access policy

Answer

Activity policy

Question 10

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should fire when a Windows device exhibits this sequence of events within 3 minutes: 1) A PowerShell process runs with an encoded command, 2) A service is created with a random name, and 3) An outbound network connection to a suspicious IP address is observed. Which three Advanced Hunting tables must be joined in the KQL query to create this detection?

Accepted Answer

DeviceProcessEvents, DeviceRegistryEvents, DeviceNetworkEvents. Option C is correct because the three required event types — PowerShell process execution, service creation, and outbound network connection — are captured by DeviceProcessEvents (for process creation), DeviceEvents (for service creation events, such as Event ID 4697 or service install events), and DeviceNetworkEvents (for network connections). DeviceEvents specifically includes security-related events like service creation, which is not covered by DeviceRegistryEvents, DeviceFileEvents, or DeviceLogonEvents.

Answer

DeviceProcessEvents, DeviceLogonEvents, DeviceNetworkEvents

Question 11

An organization wants to allow only specific company-approved USB devices (e.g., those with a specific hardware ID) on managed Windows devices. All other USB devices must be blocked. Which Microsoft 365 Defender feature should be configured?

Accepted Answer

Microsoft Defender for Endpoint device control. Microsoft Defender for Endpoint device control is the correct feature because it provides granular control over peripheral devices, including USB devices, based on hardware IDs. It allows administrators to create allow/block policies that enforce restrictions on managed Windows devices, ensuring only company-approved USB devices can be used.

Answer

Attack surface reduction rules

Answer

Microsoft Defender for Cloud Apps session policy

Answer

Conditional Access device compliance

Question 12

A security administrator wants to prevent attackers from stealing credentials by blocking access to the Local Security Authority Subsystem Service (LSASS) from untrusted processes. Which Attack Surface Reduction (ASR) rule should the administrator enable to meet this requirement?

Accepted Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe).. The ASR rule 'Block credential stealing from the Windows local security authority subsystem (lsass.exe)' (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2) directly prevents untrusted processes from accessing LSASS memory, which is a common technique used by attackers to dump credentials via tools like Mimikatz. This rule blocks attempts to open lsass.exe with specific access rights (e.g., PROCESS_VM_READ) from non-trusted processes, thereby protecting credential material stored in LSASS.

Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion.

Answer

Block Office applications from creating child processes.

Answer

Block persistence through Windows Management Instrumentation (WMI) event subscription.

Question 13

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a device makes an outbound connection to a known malicious IP address, and within 10 minutes, a process with suspicious command-line arguments is started on the same device. Which two Advanced Hunting tables must be joined using a KQL query to create this detection?

Accepted Answer

DeviceNetworkEvents and DeviceProcessEvents.. Option A is correct because the detection rule requires correlating outbound network connections (DeviceNetworkEvents) with process creation events (DeviceProcessEvents) on the same device within a 10-minute window. The KQL query would join these two tables on the DeviceId field and use a time filter to ensure the process event occurs within 10 minutes after the network event, enabling the detection of post-connection malicious activity.

Answer

DeviceEvents and DeviceLogonEvents.

Answer

DeviceNetworkEvents and DeviceRegistryEvents.

Question 14

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a process named 'powershell.exe' is launched with command-line arguments containing '-EncodedCommand', and within 5 minutes a service is created on the same device. Which two Advanced Hunting tables must be joined in the KQL query to create this detection?

Accepted Answer

DeviceProcessEvents and DeviceEvents. The correct answer is A because the detection rule requires monitoring process creation events (DeviceProcessEvents) to detect powershell.exe with '-EncodedCommand', and then service creation events (DeviceEvents) within 5 minutes on the same device. DeviceEvents captures service-related actions like 'ServiceInstalled' or 'ServiceCreated', which are essential for the second condition. Joining these two tables on DeviceId and a time window allows the KQL query to correlate the two events.

Answer

DeviceProcessEvents and DeviceNetworkEvents

Answer

DeviceEvents and DeviceLogonEvents

Question 15

A security administrator needs to block users from running portable executable files (e.g., .exe, .scr) that were downloaded from the internet on Windows devices. Which Attack Surface Reduction (ASR) rule should the administrator enable to meet this requirement?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion. Option A is correct because the ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) specifically targets executable files (e.g., .exe, .scr) that have been downloaded from the internet by checking their Mark-of-the-Web (MoTW) attribute. When enabled, this rule prevents execution of such files unless they meet criteria like high prevalence, sufficient age, or inclusion in a trusted list, directly addressing the requirement to block internet-downloaded portable executables.

Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Answer

Block Adobe Reader from creating child processes

Answer

Block persistence through WMI event subscription