MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 5 — 15 Questions

Question 1

You run the above KQL query in Microsoft Defender XDR Advanced Hunting. The query returns no results. What is the most likely reason?

Accepted Answer

The column name SenderDomain does not exist in EmailEvents.. The column 'SenderDomain' does not exist in the EmailEvents table; the correct column is 'SenderMailFromDomain'. This mismatch causes the query to return no results. Option A is possible but unlikely to be the primary cause if the environment receives inbound email. Option B is incorrect because the query failure is due to a column name error, not necessarily because no emails were blocked in the last 30 days. Option C is incorrect because a 30-day time range is valid; the issue is the nonexistent column.

Answer

The EmailDirection filter should be 'Outbound'.

Answer

No inbound emails were blocked in the last 30 days.

Answer

The time range should be 7 days instead of 30 days.

Question 2

A company's security team needs to investigate a suspicious email that was reported by a user. The email was not blocked by Exchange Online Protection (EOP) and was delivered to the user's inbox. The security team wants to use Microsoft Defender XDR to analyze the email and its attachments. Which feature should they use to submit the email for automated investigation?

Accepted Answer

Submissions. The Submissions feature in Microsoft 365 Defender allows security teams to manually submit emails, URLs, and attachments to Microsoft for analysis and automated investigation. Option B (Advanced Hunting) is incorrect because Advanced Hunting is a query-based tool for threat hunting, not for submitting emails. Option C (Threat Explorer) is incorrect because Threat Explorer is used for investigating threats that have already been detected, not for manual submission. Option D (Attack Simulator) is incorrect because Attack Simulator is used for simulating phishing attacks, not for submitting suspicious emails.

Answer

Advanced Hunting

Answer

Threat Explorer

Answer

Attack Simulator

Question 3

A security administrator needs to configure a policy that automatically blocks high-confidence phishing emails in Microsoft Defender for Office 365. The policy should be applied to all users in the finance department. The administrator wants to ensure that if an email is determined to be high-confidence phishing, it is quarantined and the user is not notified. Which type of policy should the administrator configure?

Accepted Answer

Anti-phishing policy. Anti-phishing policies in Defender for Office 365 can be configured to take action on high-confidence phishing emails, such as quarantining them. Option B is wrong because Safe Attachments policies handle malicious attachments, not the overall email classification. Option C is wrong because Anti-spam policies handle spam, not high-confidence phishing. Option D is wrong because Safe Links policies protect against malicious URLs.

Answer

Safe Attachments policy

Answer

Anti-spam policy

Answer

Safe Links policy

Question 4

Refer to the exhibit. You are reviewing an anti-phishing policy configuration in Microsoft Defender for Office 365. The policy is applied to all users. A user reports that a legitimate email from a known vendor (domain contoso.com) was quarantined. The email contained a link to a rarely visited website. The link was not malicious. Which setting in the policy is most likely causing the false positive?

Accepted Answer

EnableSimilarDomainsSafetyTips: true. EnableSimilarDomainsSafetyTips (option B) is most likely causing the false positive because it triggers warnings when the sender's domain appears similar to a known domain used in impersonation attacks. In this case, the vendor's domain contoso.com might be flagged as similar to another domain, such as contos0.com, even though the email is legitimate. Additionally, the presence of a link to a rarely visited website may increase the risk score, but the primary setting causing the quarantine is the similar domains safety tip. Option A is incorrect because MailboxIntelligence uses machine learning to reduce false positives. Option C is incorrect because PhishThresholdLevel of 2 is the default and does not directly cause false positives for legitimate domains. Option D is incorrect because EnableUnusualCharactersSafetyTips only flags unusual characters in the sender's name or domain, not a link.

Answer

EnableMailboxIntelligence: true

Answer

PhishThresholdLevel: 2

Answer

EnableUnusualCharactersSafetyTips: false

Question 5

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that alerts when a user downloads more than 10 files from SharePoint Online within 10 minutes. This activity should be considered anomalous. Which type of policy should you create?

Accepted Answer

Activity policy. Activity policies in Defender for Cloud Apps can detect anomalous activities based on thresholds, such as multiple file downloads. Option A is wrong because Cloud Discovery policies are used to discover cloud app usage (shadow IT). Option C is wrong because Session policies control sessions in real-time, not alert on historical activity. Option D is wrong because App discovery policies are used to discover shadow IT applications.

Answer

Cloud Discovery policy

Answer

Session policy

Answer

App discovery policy

Question 6

Refer to the exhibit. You are analyzing a KQL query in Microsoft Defender XDR Advanced Hunting. The query returns a list of devices where PowerShell or cmd.exe with encoded commands executed more than 5 times in the last 7 days. The security team suspects that one of the devices is compromised due to excessive use of encoded commands. However, a legitimate administrative script uses encoded commands regularly. How can you refine the query to reduce false positives while still detecting potentially malicious activity?

Accepted Answer

Add a filter to exclude processes signed by a trusted certificate or running under specific service accounts.. Adding a filter to exclude processes signed by a trusted certificate or running under specific service accounts directly addresses the legitimate administrative script that uses encoded commands. This refinement reduces false positives by allowing trusted, signed executables or known service accounts to bypass detection, while still flagging unsigned or anomalous encoded command executions that are more likely malicious. In Microsoft Defender XDR Advanced Hunting, you can use the `SigningCertificate` or `InitiatingProcessAccountName` fields in the KQL query to implement this exclusion.

Answer

Increase the Count threshold to 10.

Answer

Remove cmd.exe from the FileName filter.

Answer

Change the time range to 1 day instead of 7 days.

Question 7

A company is implementing Microsoft Defender for Identity (MDI) to protect its on-premises Active Directory environment. The security team needs to ensure that MDI can monitor all domain controllers. They have installed the MDI sensor on all domain controllers. However, they notice that some suspicious activities are not being detected. Which additional configuration should the team verify to ensure comprehensive coverage?

Accepted Answer

Configure port mirroring or network tap to ensure the sensor can see all relevant network traffic.. Microsoft Defender for Identity (MDI) sensors require port mirroring or a network tap to capture all relevant network traffic to and from domain controllers. Without this, some suspicious activities may not be visible to the sensor. Option B is incorrect because integrating Microsoft Defender for Cloud Apps is not necessary for MDI network traffic capture. Option C is incorrect because Azure AD Connect Health does not affect MDI detection. Option D is incorrect while Event log forwarding can supplement detection, MDI primarily relies on network traffic analysis via its sensor.

Answer

Integrate Microsoft Defender for Cloud Apps with MDI.

Answer

Install Azure AD Connect Health on domain controllers.

Answer

Enable auditing on domain controllers and forward logs to Microsoft Sentinel.

Question 8

Your organization uses Microsoft Defender for Endpoint (MDE). A security analyst needs to investigate a file that was detected as malicious on several devices. The analyst wants to see the file's prevalence across the organization and other related events. Which feature in MDE should the analyst use?

Accepted Answer

File page. The File page in Microsoft Defender for Endpoint provides a comprehensive view of a specific file, including its prevalence across the organization, a list of devices where it was observed, and related events such as alerts and detections. This allows the security analyst to investigate the file's spread and associated incidents in one centralized location.

Answer

Alert page

Answer

Device page

Answer

Investigation page

Question 9

A company is planning to deploy Microsoft Defender for Endpoint to its Windows 10 devices. The devices are managed by Microsoft Intune. The security team wants to ensure that the MDE sensor is installed automatically on new devices that are enrolled in Intune. Which method should the team use?

Accepted Answer

Create an Endpoint security policy in Intune to deploy MDE.. In a cloud-only Intune-managed environment, the recommended method to automatically install the Microsoft Defender for Endpoint (MDE) sensor on Windows 10 devices is to create an Endpoint security policy in Intune. Specifically, you can use the 'Microsoft Defender for Endpoint' profile under 'Endpoint security' > 'Antivirus' or 'Endpoint detection and response' to configure the sensor deployment. Option A is wrong because manual installation does not achieve automation. Option B is wrong because Group Policy requires on-premises Active Directory and is not suitable for cloud-only Intune-managed devices. Option C is wrong because Microsoft Configuration Manager is an on-premises management solution and not necessary when using Intune.

Answer

Manually install MDE on each device.

Answer

Use Group Policy to deploy the MDE installation package.

Answer

Deploy MDE using Microsoft Configuration Manager.

Question 10

A security administrator is configuring Microsoft Defender for Office 365 to protect against zero-day malware in attachments. The administrator wants to use dynamic delivery so that users can view the email body while the attachment is being analyzed. However, the administrator is concerned about false positives and wants to ensure that if a benign attachment is later found to be malicious, it is removed from the user's inbox. What should the administrator configure?

Accepted Answer

Configure a Safe Attachments policy with dynamic delivery and enable ZAP.. Safe Attachments policies with dynamic delivery allow users to view the email body while the attachment is being detonated in a sandbox. Zero-Hour Auto Purge (ZAP) then retroactively removes messages from the user’s inbox if a previously deemed benign attachment is later identified as malicious, addressing the false-positive concern.

Answer

Configure a Safe Links policy with URL detonation.

Answer

Configure an anti-phishing policy with mailbox intelligence.

Answer

Configure an anti-malware policy with common attachments filter.

Question 11

A security administrator is configuring Microsoft Defender for Cloud Apps to protect against data exfiltration from SaaS apps. The administrator wants to create a policy that alerts when a user attempts to download more than 50 files from SharePoint Online within 5 minutes. Which two components must be configured to achieve this? (Choose two.)

Accepted Answer

Activity policy. The correct answers are C (Activity policy) and E (App connector for SharePoint Online). An activity policy is needed to define the threshold (50 files in 5 minutes) and trigger an alert when exceeded. The app connector for SharePoint Online must be enabled to allow Defender for Cloud Apps to monitor SharePoint activity. Option A (File policy) is incorrect because file policies govern file sharing and collaboration, not download counts. Option B (Session policy) is used for real-time session control, not alerting on activity counts. Option D (Conditional Access App Control) is used to enforce access policies, not for monitoring specific activities.

Answer

File policy

Answer

Session policy

Answer

Conditional Access App Control

Question 12

A security team is investigating a potential ransomware outbreak using Microsoft Defender XDR. They have identified a suspicious PowerShell command that was executed on several devices. The team wants to use Advanced Hunting to find all other activities associated with the same command. Which three columns should they include in their KQL query to effectively correlate the activities? (Choose three.)

Accepted Answer

SHA256. Options A, B, and E are correct. SHA256 uniquely identifies the file executed, ProcessId identifies the process that ran the command, and DeviceId identifies the device. Together, these three columns allow the security team to correlate the suspicious PowerShell command across multiple devices, processes, and files. Option C (AccountUpn) is not as effective because the same user account might be used on multiple devices and is not directly tied to the specific command execution. Option D (Timestamp) is not unique and cannot be used alone for correlation.

Answer

AccountUpn

Answer

Timestamp

Question 13

A company is deploying Microsoft Defender for Office 365 to protect against advanced threats. Which two features are available only in Defender for Office 365 Plan 2 and not in Plan 1? (Choose two.)

Accepted Answer

Automated Investigation & Response. Options A and E are correct. Automated Investigation & Response (AIR) and Threat Explorer are only available in Defender for Office 365 Plan 2. Anti-phishing, Safe Attachments, and Safe Links are available in both Plan 1 and Plan 2.

Answer

Anti-phishing

Answer

Safe Attachments

Answer

Safe Links

Question 14

A security administrator is configuring Microsoft Defender for Endpoint (MDE) to automatically remediate threats. The administrator wants to ensure that when a high-severity alert is triggered, the affected device is isolated from the network. Which three components must be configured to achieve this? (Choose three.)

Accepted Answer

Alert severity. To automatically isolate a device when a high-severity alert is triggered, three components must be configured: Alert severity (A) to define which alerts trigger the action, Automation level (B) to enable automated response, and Device isolation action (E) as the specific remediation action. Option C (Device tag) is for grouping devices, not automation. Option D (Indicator of compromise) is used for blocking indicators, not for automated isolation.

Answer

Device tag

Answer

Indicator of compromise (IoC)

Question 15

Your organization uses Microsoft Defender for Cloud Apps. You need to be alerted when a user accesses a cloud app from an anonymous IP address. Which type of policy should you create?

Accepted Answer

Activity policy. An activity policy in Microsoft Defender for Cloud Apps can detect access from anonymous IP addresses by monitoring user activities. Option A is incorrect because a session policy controls user sessions in real-time but does not specifically alert on anonymous IP access. Option B is incorrect because a file policy focuses on monitoring and protecting files, not on access from anonymous IPs. Option D is incorrect because an app discovery policy is used to discover shadow IT and unsanctioned apps, not to alert on anonymous IP access.

Answer

Session policy

Answer

File policy

Answer

App discovery policy