MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 4 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Office 365. You need to protect users from malicious links in email messages. Which TWO features should you configure?

Accepted Answer

Safe Links. Safe Links (option B) is a core feature in Microsoft Defender for Office 365 that provides time-of-click protection by scanning and rewriting URLs in email messages to block malicious links. Safe Links for Office 365 apps (option E) extends this protection to links within Office documents (e.g., Word, Excel, PowerPoint) and other supported apps, ensuring users are protected even when opening files from email or cloud storage. Together, these two features directly address the requirement to protect users from malicious links in email messages.

Answer

Anti-phish policy

Answer

Safe Attachments

Answer

Spam filter policy

Question 2

Refer to the exhibit. What is the effect of this session policy?

Accepted Answer

Blocks download of files from SharePoint Online and OneDrive on unmanaged devices. The session policy shown in the exhibit is configured to block downloads from SharePoint Online and OneDrive for unmanaged devices. This is achieved by applying a conditional access policy that targets unmanaged devices and restricts the download action specifically, while still allowing view-only access. The correct answer is D because the policy explicitly blocks the download of files, not uploads or all access.

Answer

Allows viewing but blocks downloading files on managed devices

Answer

Blocks all access to SharePoint and OneDrive from unmanaged native clients only

Answer

Blocks upload of files to SharePoint Online and OneDrive from unmanaged devices

Question 3

Refer to the exhibit. You deploy this configuration profile to Windows devices. What is the most likely outcome?

Accepted Answer

Automated investigation will be triggered for alerts with severity Medium and above, and email notifications will be sent to admin@contoso.com.. The configuration profile sets the automated investigation action to 'Medium or higher' and specifies a single email recipient (admin@contoso.com). This means Defender for Endpoint will trigger automated investigations for alerts with severity Medium, High, or Critical, and send email notifications only to the listed address, not to all admins.

Answer

Automated investigation will be triggered only for alerts with severity High, and email notifications will be sent to all admins.

Answer

Automated investigation will be disabled, and email notifications will be sent to admin@contoso.com.

Answer

Automated investigation will be triggered for all alerts regardless of severity, and no email notifications will be sent.

Question 4

You are investigating a phishing campaign targeting your organization. In Microsoft Defender XDR, you run a KQL query in Advanced Hunting to find all email messages that contain a specific phishing URL. Which table should you query?

Accepted Answer

EmailUrlInfo. The EmailUrlInfo table in Advanced Hunting stores URL information extracted from email messages, including the specific URLs found in the body or attachments. To find all email messages containing a specific phishing URL, you must query this table because it directly maps URLs to their associated email identifiers (e.g., NetworkMessageId).

Answer

EmailAttachmentInfo

Answer

UrlClickEvents

Answer

EmailEvents

Question 5

Your organization uses Microsoft Defender for Office 365. You need to protect users from malicious links in email messages. Which TWO features should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a new anti-malware policy and configure the quarantine policy to use 'LimitedAccess' or 'FullAccess'.. It describes creating a new anti-malware policy and associating it with a quarantine policy that permits user release (LimitedAccess or FullAccess). The default quarantine policy (AdminOnlyAccess) does not allow users to release their own messages. Options A, B, and D either use the default policy, explicitly prevent user release, or do not address the quarantine policy settings needed for user release.

Answer

Create a new anti-malware policy and use the default quarantine policy.

Answer

Create a new anti-malware policy and set 'User release' to 'False' in the quarantine policy.

Answer

Modify the anti-malware policy to set 'Quarantine' as the action and assign a custom quarantine policy with user release enabled.

Question 6

You are a security administrator. You need to configure Microsoft Defender for Cloud Apps to detect anomalous user activities such as impossible travel. Which feature should you enable?

Accepted Answer

Anomaly Detection policies. Anomaly Detection policies in Microsoft Defender for Cloud Apps are specifically designed to identify user behavior anomalies, such as impossible travel (a user logging in from two geographically distant locations within an impossible timeframe). These policies leverage machine learning and user entity behavior analytics (UEBA) to establish a baseline and flag deviations, making them the correct feature for detecting impossible travel.

Answer

App Discovery

Answer

Cloud Discovery

Answer

Conditional Access App Control

Question 7

Your organization uses Microsoft Defender for Identity. You receive an alert about a potential DCSync attack. What should you do to investigate this alert in Microsoft Defender XDR?

Accepted Answer

Run a KQL query in Advanced Hunting against IdentityLogonEvents to identify suspicious replication attempts.. DCSync attacks are performed by requesting domain replication via the MS-DRSR protocol, which generates specific directory replication events. In Microsoft Defender XDR, these replication attempts are logged in the IdentityLogonEvents table when an account authenticates to a domain controller for replication purposes. Running a KQL query against this table allows you to identify the source account, target domain controller, and the specific replication activity that triggered the alert.

Answer

Review the IdentityDirectoryEvents table for replication-related events.

Answer

Use IdentityQueryEvents to find LDAP queries related to replication.

Answer

Check the IdentityAlertEvents table to see if the alert has additional context.

Question 8

You need to integrate Microsoft Defender XDR with Microsoft Sentinel for centralized monitoring. Which data connector should you use?

Accepted Answer

Microsoft Defender XDR connector. The Microsoft Defender XDR connector (option D) is the correct choice because it ingests signals from all Microsoft 365 Defender components—including Defender for Endpoint, Office 365, Identity, and Cloud Apps—into Microsoft Sentinel. This connector uses the Microsoft 365 Defender API to stream unified alerts and incidents, enabling centralized monitoring and correlation across the entire XDR stack.

Answer

Microsoft Defender for Cloud connector

Answer

Azure Security Center connector

Answer

Microsoft 365 Defender connector

Question 9

Your organization uses Microsoft Defender for Office 365. You need to protect users from malicious links in email messages. Which TWO features should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Endpoint client logs. The Microsoft Defender for Endpoint client logs (option C) are the primary source for troubleshooting onboarding issues because they contain detailed records of the client's registration, communication with the cloud service, and policy application. If a device is not receiving security updates, it often indicates a failure in the onboarding process or a connectivity problem, which these logs directly capture. Checking these logs first allows you to verify the device's enrollment status and identify any errors in the initial connection or certificate exchange.

Answer

Event Viewer Application logs

Answer

System logs

Answer

Windows Update logs

Question 10

You are configuring Microsoft Defender for Office 365 to protect against business email compromise (BEC) attacks. Which policy setting should you enable to analyze email sender behavior and detect impersonation attempts?

Accepted Answer

Anti-phishing policy - Impersonation protection. (Anti-phishing policy - Impersonation protection) is correct because anti-phishing policies in Microsoft Defender for Office 365 include impersonation protection settings that analyze email sender behavior and detect impersonation attempts, such as those used in business email compromise (BEC) attacks. Option A (Safe Attachments policy - Dynamic Delivery) focuses on scanning attachments for malicious content, not sender behavior. Option C (Safe Links policy - URL scan) provides protection against malicious URLs in emails and Office documents. Option D (Anti-malware policy - Malware filter) detects and removes malware from email messages. None of these options analyze sender behavior for impersonation.

Answer

Safe Attachments policy - Dynamic Delivery

Answer

Safe Links policy - URL scan

Answer

Anti-malware policy - Malware filter

Question 11

Your organization uses Microsoft Defender for Office 365. You need to protect users from malicious links in email messages. Which TWO features should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Activity policy. Activity policies in Defender for Cloud Apps allow you to create custom rules to detect specific activities like mass download. Option A (App Discovery policy) is used to discover apps in use in your organization. Option C (Anomaly Detection policy) is for pre-built anomalies. Option D (Cloud Discovery policy) is for shadow IT.

Answer

App Discovery policy

Answer

Anomaly Detection policy

Answer

Cloud Discovery policy

Question 12

Which TWO actions can you perform using Microsoft Defender XDR's Advanced Hunting? (Choose two.)

Accepted Answer

Create custom detection rules based on query results.. Advanced Hunting in Microsoft Defender XDR allows you to run KQL queries across data from various Defender services, so option E is correct. You can also create custom detection rules based on query results, making option C correct. Option A (deploy EDR sensors) is done via group policy or Intune, not in Advanced Hunting. Option B (configure data retention) is a tenant-level setting. Option D (manage incident status) is performed in the Incidents queue, not in Advanced Hunting.

Answer

Deploy EDR sensors to endpoints.

Answer

Configure data retention policies for logs.

Answer

Manage the status of incidents.

Question 13

Which TWO Microsoft Defender XDR components provide protection for email and collaboration tools? (Choose two.)

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 is the correct choice because it is the dedicated component that protects email and collaboration tools (Exchange Online, SharePoint Online, OneDrive for Business, and Teams) against threats like phishing, malware, and spam. It uses advanced machine learning and detonation analysis in Safe Attachments and Safe Links to inspect attachments and URLs in real time.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Endpoint

Question 14

You are analyzing a custom detection rule in Microsoft Defender XDR. The rule is designed to alert on suspicious PowerShell execution. However, you notice that the rule is not triggering alerts even though you know such activity is occurring. What is the most likely reason?

Accepted Answer

The query syntax is invalid; 'has_any' requires a dynamic array.. 'has_any' in Kusto Query Language (KQL) requires a dynamic array as its argument. If the rule uses a list of strings without the dynamic wrapper, the syntax is invalid, causing the rule to fail silently or not trigger alerts. Other options are less likely: the rule being enabled/disabled is not mentioned as a factor, severity does not prevent detection, and the lookback period is not the issue if activity is known to be occurring.

Answer

The custom detection rule is not enabled.

Answer

The severity is set to Medium, which may be suppressed by other policies.

Answer

The rule only looks back 7 days, and the activity occurred more than 7 days ago.

Question 15

You run the above PowerShell command on a Windows 10 device that is onboarded to Microsoft Defender for Endpoint. The device is reporting as healthy in the portal, but you suspect that some behavioral detection capabilities are turned off. Based on the output, which setting should you modify?

Accepted Answer

Set DisableBehaviorMonitoring to False to enable behavior monitoring.. The PowerShell command output shows that DisableBehaviorMonitoring is set to True, which disables behavioral monitoring. Since the device is healthy but behavioral detection capabilities are suspected to be off, setting DisableBehaviorMonitoring to False re-enables behavior monitoring, allowing Defender for Endpoint to analyze runtime behavior for threats.

Answer

Enable cloud-delivered protection by setting MAPSReporting to Advanced.

Answer

Set DisableBlockAtFirstSeen to True to enable Block at First Sight.

Answer

Set DisableRealtimeMonitoring to True to enable real-time monitoring.