MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 5 — 15 Questions

Question 1

Your organization uses Microsoft 365 E5 and has Microsoft Defender for Office 365 enabled. Users report that legitimate external emails are being quarantined as phishing attempts. You need to reduce false positives while maintaining security. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure user-reported message settings in Microsoft Defender for Office 365. Configuring user-reported message settings in Microsoft Defender for Office 365 allows users to report false positives (legitimate emails marked as phishing). These reports are used by Microsoft's automated investigation and machine learning to improve filtering accuracy, reducing future false positives while maintaining security. Option A is wrong because allowing all emails from external domains bypasses security protections. Option C is wrong because disabling the anti-phishing policy removes protection against genuine phishing attacks. Option D is wrong because increasing the Spam Confidence Level (SCL) threshold affects spam filtering, not specifically phishing detection, and may not address the false positive issue effectively.

Answer

Create a transport rule to allow all emails from external domains

Answer

Disable the anti-phishing policy

Answer

Increase the Spam Confidence Level (SCL) threshold for incoming mail

Question 2

Your organization has Microsoft Defender for Endpoint deployed. You are investigating a potential ransomware incident. The device timeline shows a series of events: a user downloaded a malicious attachment from an email, which then executed a script that encrypted files and attempted to propagate to other devices via SMB. You need to configure a custom detection rule to alert on similar behavior in the future. Which KQL query should you use as a basis?

Accepted Answer

DeviceProcessEvents | join DeviceNetworkEvents on DeviceId. The scenario describes a process executing a script that encrypts files and attempts to propagate via SMB, which involves both process execution and network activity. A KQL query joining DeviceProcessEvents with DeviceNetworkEvents on DeviceId can correlate the malicious process with its network connections, enabling detection of similar behavior. This is the most comprehensive basis for a custom detection rule.

Answer

DeviceFileEvents | where FileName endswith '.encrypted'

Answer

DeviceLogonEvents | where LogonType == 3

Answer

DeviceRegistryEvents | where RegistryKey contains 'Run'

Question 3

Your organization uses Microsoft Defender XDR. You need to configure a policy that automatically blocks high-risk user activities in Microsoft Defender for Cloud Apps. Which feature should you configure?

Accepted Answer

Session policy. Session policies in Defender for Cloud Apps allow real-time control over user sessions, enabling blocking of risky activities. Option B is wrong because app governance policies focus on app permissions, not real-time activity blocking. Option C is wrong because access policies control access based on conditions but do not automatically block high-risk activities. Option D is wrong because anomaly detection policies generate alerts but do not automatically block.

Answer

App governance policy

Answer

Access policy

Answer

Anomaly detection policy

Question 4

Your organization uses Microsoft Defender for Office 365. You receive a report that users are receiving spoofed email messages that appear to come from your own domain. The spoofed messages are not being filtered. You need to ensure that spoofed messages from your domain are blocked. What should you do?

Accepted Answer

Configure spoof intelligence settings to block the spoofed domain. To block spoofed emails from your own domain, you should configure spoof intelligence settings in Microsoft Defender for Office 365 to block the spoofed domain. Spoof intelligence allows you to review and manage senders who are spoofing your domain and take action to block them.

Answer

Add your domain to the allowed domains list in the anti-spam policy

Answer

Configure DKIM signing for your domain

Answer

Configure DMARC policy to reject messages that fail SPF or DKIM

Question 5

Your organization has Microsoft Defender for Endpoint deployed on all devices. You are investigating an incident where a user received a phishing email containing a link that led to a drive-by download. The download executed a script that attempted to modify registry run keys for persistence. Which THREE advanced hunting tables should you use to investigate this attack chain?

Accepted Answer

EmailEvents. EmailEvents is correct because the attack chain begins with a phishing email, and this table in Microsoft Defender for Endpoint advanced hunting records email delivery, sender, recipient, subject, and URL/attachment metadata needed to trace the initial lure. DeviceProcessEvents is correct because the drive-by download executed a script, and this table captures process creation, command lines, parent-child process relationships, and script interpreter activity (for example, powershell.exe or wscript.exe) that reveal execution. DeviceRegistryEvents is correct because the script attempted to modify registry run keys for persistence, and this table logs registry key/value creation and modification events, including Run and RunOnce keys. DeviceFileEvents is not among the marked answers because, while it can show file creation or download artifacts, the scenario's key evidence points are the email, process execution, and registry persistence. DeviceNetworkEvents is also not marked because, although it could show outbound connections, the question specifically asks for the tables matching the described phishing, script execution, and run-key modification chain.

Answer

DeviceFileEvents

Answer

DeviceNetworkEvents

Question 6

Your organization uses Microsoft Defender XDR. You need to configure automated actions for high-confidence phishing emails. Which TWO actions can be automatically taken by Microsoft Defender for Office 365?

Accepted Answer

Soft delete the email from the user's mailbox. Option C is correct because Microsoft Defender for Office 365 supports a 'Soft delete' remediation action, which moves the message to the Recoverable Items folder (Purges) in the user's mailbox, allowing recovery if needed. Option D is correct because 'Move to quarantine' is a standard automated remediation action in Defender for Office 365 that isolates the phishing email so the user cannot access it while admins can review and release it. Option A is incorrect because adding a phishing header is a mail flow/transport rule capability, not one of the automated remediation actions available for high-confidence phishing in Defender for Office 365. Option B is incorrect because 'Permanently delete' (hard delete) is not offered as an automated action for high-confidence phishing; the available delete action is soft delete. Option E is incorrect because forwarding to the security team is not a built-in automated remediation action in Defender for Office 365; notifications and alerts are used instead.

Answer

Add a header to the email indicating it is phishing

Answer

Permanently delete the email from the user's mailbox

Answer

Forward the email to the security team

Question 7

You are a security administrator for a company that uses Microsoft Defender XDR. You need to configure a policy to automatically remediate high-severity incidents involving ransomware on Windows 10 devices. The solution must minimize manual intervention. Which automation level should you configure in the automated investigation and response (AIR) capabilities?

Accepted Answer

Automatically remediate threats. 'Automatically remediate threats,' is the correct automation level for minimizing manual intervention when handling high-severity ransomware incidents on Windows 10 devices in Microsoft Defender XDR. This setting allows the automated investigation and response (AIR) engine to take remediation actions—such as isolating devices or blocking files—without requiring an administrator's approval, which is essential for rapid containment of ransomware. The 'Full - automatically remediate threats' option is not a valid selection in the AIR automation levels; the correct terminology is simply 'Automatically remediate threats.'

Answer

Full - automatically remediate threats

Answer

Semi - require approval for any remediation

Answer

No automated response

Question 8

Your organization uses Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps. You discover that a user's credentials were compromised and used to access sensitive data in SharePoint Online from an unusual location. You need to automatically suspend the user and prevent further access to cloud apps. What should you configure?

Accepted Answer

A session policy in Defender for Cloud Apps. To automatically suspend a compromised user and prevent access to cloud apps, you should configure a policy in Microsoft Defender for Cloud Apps such as an activity policy or anomaly detection policy that triggers on conditions like unusual location or impossible travel. These policy types allow you to set a governance action to 'Suspend user', which disables the user account. A session policy in Defender for Cloud Apps provides real-time session control (e.g., block or limit actions) but does not suspend the user account. Since options A, B, and C are email security policies unrelated to this scenario, the closest answer is D despite the inaccuracy in describing it as a session policy.

Answer

An anti-phishing policy in Defender for Office 365

Answer

A Safe Attachments policy in Defender for Office 365

Answer

A Safe Links policy in Defender for Office 365

Question 9

You are a security analyst. You need to create a custom detection rule in Microsoft Defender XDR that triggers an alert when a user account is created and then added to a privileged role within 24 hours. Which advanced hunting table should you primarily use?

Accepted Answer

IdentityLogonEvents. The correct table for detecting user account creation and role changes is IdentityDirectoryEvents, not IdentityLogonEvents. None of the given options (A: EmailEvents, B: IdentityLogonEvents, C: DeviceEvents, D: CloudAppEvents) are correct for this scenario.

Answer

EmailEvents

Answer

DeviceEvents

Answer

CloudAppEvents

Question 10

You are configuring policies in Microsoft Defender for Office 365. You need to ensure that users cannot click through to a malicious website that is hosted on a newly registered domain. Which policy setting should you enable?

Accepted Answer

Safe Links. Safe Links in Defender for Office 365 rewrites URLs in email and checks them at click time against Microsoft's reputation data, including newly registered domains. Enabling Safe Links with the appropriate 'block the following URLs' or 'wait for scanning' settings prevents users from reaching malicious sites on newly registered domains.

Answer

Anti-phishing

Answer

Anti-spam

Answer

Safe Attachments

Question 11

You are a security administrator for a company that uses Microsoft Defender XDR. You need to configure an automated investigation and response (AIR) policy to automatically remediate threats on devices. Which two actions can be taken automatically without requiring administrator approval? (Choose two.)

Accepted Answer

Quarantine file. In Microsoft Defender XDR AIR policies, file quarantine is an approved automatic remediation action that can be executed without admin approval when the policy's automation level is set to Full - remediate threats automatically. Option D (Isolate device) is also correct because device isolation is a supported automatic remediation action in AIR, allowing Defender for Endpoint to contain a compromised device immediately without waiting for analyst approval. Options B (Block URL), C (Run antivirus scan), and E (Collect investigation package) are not automatic remediation actions requiring no approval in this context: blocking URLs is typically handled through indicators or custom detections rather than AIR auto-remediation, running an antivirus scan is an investigation/response action that generally requires approval or manual initiation, and collecting an investigation package is a non-destructive investigation action that does not remediate threats and is not part of the automatic remediation set.

Answer

Block URL

Answer

Run antivirus scan

Answer

Collect investigation package

Question 12

You are investigating an incident in Microsoft Defender XDR where a user received a phishing email that contained a link to a malicious site. The user clicked the link but did not enter credentials. Which actions would be most effective to remediate the incident?

Accepted Answer

Use Threat Explorer to delete the phishing email from all mailboxes.. Because the user clicked the link but did not enter credentials, the primary remediation goals are to remove the phishing email from all mailboxes and to investigate the endpoint for any compromise. Using Threat Explorer to purge the message prevents other recipients from clicking it, and initiating an automated investigation on the user's device checks for malicious activity or persistence. Together these contain the campaign and verify the endpoint, which is the proportionate response when no credentials were entered.

Answer

Block the user's account from signing in.

Answer

Block the URL in the Tenant Allow/Block List.

Answer

Reset the user's password immediately.

Question 13

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Defender for Cloud Apps. You need to configure a policy that automatically blocks downloads of sensitive files from a specific cloud app if the user's risk score is high. Which integration and policy type should you use?

Accepted Answer

Create a session policy in Microsoft Defender for Cloud Apps using Conditional Access App Control.. Conditional Access App Control in Defender for Cloud Apps uses a reverse proxy to intercept sessions to cloud apps and can enforce session policies in real time, including blocking downloads of sensitive files based on user risk. A session policy is the correct policy type because it operates within the proxied session and can evaluate file sensitivity and user risk score before allowing the download. This is the only option that combines the MDE/MDCA integration with session-level blocking.

Answer

Use the Cloud Discovery dashboard to block the app.

Answer

Create an attack surface reduction rule in MDE.

Answer

Create a Conditional Access policy in Microsoft Entra ID to block access to the app.

Answer

Create a device compliance policy in Microsoft Intune.

Question 14

Your organization has Microsoft Defender for Office 365 Plan 2. You want to set up a policy that automatically moves messages containing malware to quarantine and notifies the security team. Which policy should you configure?

Accepted Answer

Safe Attachments policy. Safe Attachments is the Defender for Office 365 feature that detonates attachments in a sandbox to detect malware and can be configured with a policy action to quarantine messages containing malicious attachments. It also supports alert notifications to the security team, matching the requirement to auto-quarantine malware and notify.

Answer

DKIM policy

Answer

DMARC policy

Answer

Anti-Spam policy

Answer

Anti-Phishing policy

Question 15

You are configuring Microsoft Defender for Cloud Apps to detect anomalous behavior. You need to set up a policy that triggers an alert when a user downloads more than 100 files from SharePoint Online in 10 minutes. Which policy template should you use?

Accepted Answer

Activity from anonymous IP addresses. The 'Activity from anonymous IP addresses' template alerts when a user performs actions from an anonymous IP address, which can indicate a compromised account attempting to exfiltrate data by downloading many files. Option B (Impossible travel) detects logins from geographically improbable locations, not download volume. Option C (Malware detection) is for identifying malicious files. Option D (Ransomware detection) is for ransomware behaviors. Option E (Unusual file sharing by user) focuses on external sharing, not downloads.

Answer

Impossible travel

Answer

Malware detection

Answer

Ransomware detection

Answer

Unusual file sharing by user