MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 4 — 15 Questions

Question 1

A company uses Microsoft Defender for Office 365. Users report that phishing emails with malicious links are occasionally delivered to their inboxes. The security team wants to ensure that suspicious URLs are detonated in a sandbox before delivery for all recipients. What should the security team configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a Safe Links policy with 'Use Safe Attachments to scan content' enabled.. Configure a Safe Links policy with 'Use Safe Attachments to scan content' enabled. This setting causes URLs in emails to be detonated in a sandbox before delivery, as part of the Safe Attachments scanning process. Option B is incorrect because the 'Block URLs' option in anti-phishing does not provide sandbox detonation before delivery. Option C is incorrect because a Safe Attachments policy for email scans attachments, not URLs. Option D is incorrect because Safe Links for Microsoft Teams only scans links when clicked, not before delivery.

Answer

Enable the 'Block URLs' option in the anti-phishing policy.

Answer

Configure a Safe Attachments policy for email messages.

Answer

Enable 'Safe Links for Microsoft Teams' in the global settings.

Question 2

Contoso uses Microsoft Defender XDR and has a Microsoft 365 E5 license. The security team wants to automate incident response when a user is compromised. They create a custom automation rule in the Microsoft 365 Defender portal. The rule should automatically isolate the user's device, disable the user account, and reset the user's password. Which action type should they configure in the rule?

Accepted Answer

Create a playbook that performs all three actions and run it as the automation rule action.. In Microsoft Defender XDR, automation rules can trigger actions like 'Isolate device' or 'Disable user,' but a single rule action cannot chain multiple remediation steps across different entity types. To perform all three actions (isolate device, disable account, reset password) in one automated response, you must create a playbook in Microsoft Sentinel or Logic Apps that executes those steps and invoke it as the automation rule action.

Answer

Select 'Isolate device' as the incident action.

Answer

Configure a webhook to call an external API that performs the actions.

Answer

Use the 'Run script' action and provide a PowerShell script.

Question 3

A tenant administrator runs the above PowerShell command to create a Conditional Access policy. Users on iOS and Android devices report that they are still prompted for MFA, but the policy is intended to exclude those platforms. What is the issue?

Accepted Answer

The ExcludePlatforms parameter is placed incorrectly in the JSON body; it should be under conditions.platforms.excludePlatforms.. The issue is that the ExcludePlatforms parameter is placed incorrectly in the JSON body. In a Conditional Access policy, platform exclusions must be specified under conditions.platforms.excludePlatforms, not at the top level or under a different node. If the parameter is misplaced, the policy ignores the exclusion and applies MFA to all platforms, including iOS and Android, which explains why users on those platforms are still prompted.

Answer

The policy does not apply to iOS and Android because they are not listed in IncludeApplications.

Answer

The policy creation failed due to invalid syntax.

Answer

The policy requires MFA for all apps, overriding the platform exclusion.

Question 4

An organization uses Microsoft Defender for Endpoint and wants to allow only certain applications to run on managed devices. They create a custom indicator (IoA) to allow a specific application by its certificate thumbprint. However, after deployment, the application is still blocked by default Windows Defender Application Control (WDAC) policy. What is the most likely reason?

Accepted Answer

The WDAC policy is in enforce mode and does not trust the indicator.. Custom indicators for allow are not automatically trusted by Windows Defender Application Control (WDAC). When WDAC is in enforce mode, it only allows binaries that are signed by trusted publishers or have a valid signature as per its policy. By default, WDAC does not trust indicators from Defender for Endpoint; you must either configure WDAC to allow the indicator or switch WDAC to audit mode. Option C correctly identifies that the WDAC policy is in enforce mode and does not trust the indicator. Option A is incorrect because propagation delay would not cause a permanent block; the indicator would eventually become active. Option B is incorrect because a certificate thumbprint is a valid indicator type. Option D is incorrect because custom indicators can override WDAC policies if WDAC is configured to trust them.

Answer

The indicator is not yet active due to propagation delay.

Answer

The certificate thumbprint is incorrect.

Answer

Custom indicators cannot override WDAC policies.

Question 5

Contoso has a hybrid identity environment with Microsoft Defender for Identity deployed. They suspect a compromised account is being used to perform reconnaissance against domain controllers. Which Defender for Identity alert type would most likely trigger?

Accepted Answer

Suspicious service creation. Reconnaissance attacks against domain controllers are often detected by 'Suspicious service creation' alerts in Defender for Identity, as attackers may create services to move laterally or gather information. Option B is correct. Option A (Brute Force attack) is for password guessing, not reconnaissance. Option C (DCSync attack) is for credential dumping. Option D (Golden Ticket activity) is for persistence.

Answer

Brute Force attack

Answer

DCSync attack

Answer

Golden Ticket activity

Question 6

You are a security administrator for a Microsoft 365 E5 organization. You need to configure a policy that automatically blocks execution of files that have a low reputation score in Microsoft Defender for Endpoint. Which policy type should you configure?

Accepted Answer

Attack surface reduction rule in Microsoft Defender for Endpoint. Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint can be configured to block execution of files with low reputation, based on Microsoft's threat intelligence. Option B (Device control policy in Intune) manages peripheral device restrictions, not file execution. Option C (Anti-malware policy in Exchange Online Protection) focuses on email and attachment scanning, not endpoint file execution. Option D (Cloud App Security policy) governs cloud application usage, not local file execution. Therefore, the correct policy type is an Attack Surface Reduction rule.

Answer

Device control policy in Microsoft Intune

Answer

Anti-malware policy in Exchange Online Protection

Answer

Cloud App Security policy in Microsoft Defender for Cloud Apps

Question 7

Your organization uses Microsoft 365 Defender. You need to ensure that when a user reports a phishing email via the Report Message add-in, the email is automatically submitted to Microsoft for analysis and the user is notified of the analysis result. What should you configure?

Accepted Answer

Configure User Reported Settings in the Microsoft 365 Defender portal. User Reported Settings in the Microsoft 365 Defender portal is the centralized configuration that controls how user-reported messages are handled, including whether they are automatically submitted to Microsoft for analysis and whether the user receives feedback on the analysis result. This is the correct location to configure the Report Message add-in behavior.

Answer

Configure a mail flow rule to forward reported messages to Microsoft

Answer

Create a submission policy in the Microsoft 365 Defender portal

Answer

Enable Advanced Threat Protection (ATP) for SharePoint, OneDrive, and Teams

Question 8

You are investigating an incident in Microsoft 365 Defender. The incident involves a user who received a malicious link in an email and clicked it. The link led to a credential phishing page. You need to identify which user accounts might have been compromised. Which Microsoft 365 Defender feature should you use?

Accepted Answer

Investigation package. The investigation package provides a comprehensive set of evidence collected during automated investigation, including details about user actions like clicking a malicious link, which helps identify potentially compromised accounts. Option A is wrong because Live Response is used for real-time remote device access, not for reviewing evidence of compromise. Option C is wrong because file investigation focuses on analyzing specific files, not user account compromises. Option D is wrong because Action center is for managing remediation actions, not for viewing evidence of compromised accounts.

Answer

Live Response

Answer

File investigation

Answer

Action center

Question 9

Your organization uses Microsoft Defender for Cloud Apps. You discover that a user is accessing sensitive data from an unmanaged device. You need to automatically restrict the user's access to sensitive data until the device is compliant. What should you configure?

Accepted Answer

Create a session policy that monitors and controls access to sensitive data. A session policy in Microsoft Defender for Cloud Apps (integrated with Conditional Access App Control) is the correct control to monitor and restrict access to sensitive data in real time from unmanaged devices. Session policies can block downloads, block uploads, or apply sensitivity-label-based restrictions without blocking the entire app. This directly addresses the requirement to automatically restrict access until the device is compliant.

Answer

Create a Conditional Access App Control policy for all apps

Answer

Create an anomaly detection policy

Answer

Create an app discovery policy

Question 10

You are a security administrator. You need to configure a Microsoft Defender for Endpoint policy that prevents users from running executables from the Temp folder. Which Attack Surface Reduction (ASR) rule should you enable?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion. The ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' is designed to block executables that are not widely known, old, or trusted, such as those from the Temp folder. Option A is wrong because 'Block credential stealing from the Windows local security authority subsystem (lsass.exe)' prevents credential theft, not executable execution from Temp. Option B is wrong because 'Block Office communication application from creating child processes' targets Office apps, not general executables. Option C is wrong because 'Block process injections originating from Windows executable files' prevents injection attacks, not execution from Temp.

Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Answer

Block Office communication application from creating child processes

Answer

Block process injections originating from Windows executable files

Question 11

You need to configure Microsoft Defender for Office 365 to protect users from malicious links in email. Which TWO actions should you configure?

Accepted Answer

Enable URL detonation. Options C and D are correct because URL detonation (C) provides real-time analysis of links at the time of click, and Safe Links scanning for email (D) protects users from malicious links in email messages. Option A is incorrect because anti-malware engine targets attachments, not links. Option B is incorrect because anti-spam filtering addresses junk mail, not malicious links. Option E is incorrect because Safe Attachments focuses on file attachments, not links.

Answer

Enable anti-malware engine

Answer

Enable anti-spam filtering

Answer

Enable Safe Attachments

Question 12

You are investigating an incident in Microsoft 365 Defender. The incident involves a user who received a malware attachment. Which THREE actions can you take from the incident page?

Accepted Answer

Start an automated investigation. Options A, B, and D are correct because from the incident page, you can start an automated investigation, isolate the user's device, and delete the email from the user's mailbox. Option C is incorrect because resetting the user's password is not available directly from the incident page; it must be done from the user's account in the Microsoft 365 admin center. Option E is incorrect because blocking a malicious URL globally is not a direct action from the incident page; it can be done from the Threat Management Center or through custom indicators.

Answer

Reset the user's password

Answer

Block the malicious URL globally

Question 13

Your organization uses Microsoft Defender for Identity. You need to configure honeytoken accounts. Which THREE attributes should you ensure are NOT set for honeytoken accounts?

Accepted Answer

Last logon timestamp. Honeytoken accounts in Microsoft Defender for Identity should be configured to attract attackers without triggering unnecessary alerts. They should not have a recent last logon timestamp (B), as a stale logon indicates a potential compromise. They should have no group memberships (C) to prevent lateral movement. They should not have an email address (D) to avoid being targeted. The description field (A) can be set to anything and does not affect detection. The account enabled status (E) should typically be enabled so that attackers can attempt to use it; disabling it would defeat the purpose.

Answer

Description field

Answer

Account enabled status

Question 14

You are reviewing a Microsoft Defender for Cloud Apps file policy. The exhibit shows a policy snippet. What is the effect of this policy?

Accepted Answer

It allows Office files between 10 MB and 100 MB from the internet. The policy snippet shows a file policy condition that matches Office files with a size between 10 MB and 100 MB, and the action is set to 'Allow'. In Microsoft Defender for Cloud Apps, a file policy evaluates file metadata and content against conditions; when the conditions are met, the configured action (Allow, Block, or governance actions) is applied. Therefore, the policy explicitly allows Office files that fall within that size range from the internet, overriding any default block that might exist.

Answer

It blocks all Office files from the internet

Answer

It allows all Office files from the internet regardless of size

Answer

It blocks Office files larger than 10 MB from the internet

Question 15

You are configuring a mail flow rule in Exchange Online. The exhibit shows a snippet. What will this rule do?

Accepted Answer

Quarantine messages sent to example.com. The mail flow rule shown in the exhibit (though not visible here) is configured to quarantine messages sent to example.com. In Exchange Online, a mail flow rule with the action 'Quarantine the message' redirects the message to the quarantine store instead of delivering it, which is distinct from rejecting or blocking.

Answer

Reject messages sent to example.com

Answer

Block messages from example.com

Answer

Allow messages to example.com