MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 5 — 15 Questions

Question 1

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a user receives a phishing email containing a malicious URL and then clicks that URL within 10 minutes. Which two Advanced Hunting tables must be joined in the KQL query?

Accepted Answer

EmailEvents and UrlClickEvents. The rule requires detecting when a user receives a phishing email with a malicious URL and then clicks that URL within 10 minutes. The EmailUrlInfo table contains the URL extracted from the email (including the verdict), and the UrlClickEvents table records user clicks on URLs in Microsoft Defender for Office 365 Safe Links. Joining these two tables on the URL hash (SHA256) allows correlation of the email-delivered URL with the user's click event, enabling the time-based trigger.

Answer

EmailEvents and DeviceProcessEvents

Answer

EmailAttachmentInfo and UrlClickEvents

Question 2

A security administrator is configuring Microsoft Defender for Cloud Apps. The administrator needs to discover which cloud apps are being used in the organization and then block usage of unsanctioned apps in real time using a reverse proxy. Which two Defender for Cloud Apps features must be configured? (Select the two correct options.)

Accepted Answer

Cloud Discovery. Cloud Discovery is the correct feature because it identifies which cloud apps are in use by analyzing traffic logs from the organization's network. This provides the visibility needed to determine which apps are unsanctioned. Conditional Access App Control is the correct feature because it uses a reverse proxy to enforce real-time access controls, blocking unsanctioned apps at the session level.

Answer

App governance

Answer

OAuth app permissions

Question 3

A security analyst is investigating a suspected credential theft attack where an attacker attempts to dump credentials from LSASS. Which Attack Surface Reduction (ASR) rule should the administrator enable to block this activity from untrusted processes?

Accepted Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe). The ASR rule 'Block credential stealing from the Windows local security authority subsystem (lsass.exe)' (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2) is specifically designed to prevent untrusted processes from accessing LSASS memory and dumping credentials, such as with tools like Mimikatz. This directly addresses the described attack scenario of credential theft from LSASS, making it the correct choice.

Answer

Block Office applications from creating child processes

Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion

Answer

Block Adobe Reader from creating child processes

Question 4

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should detect when a user opens a malicious email attachment, which launches a PowerShell process, and then that PowerShell process makes an outbound connection to a known malicious IP address. Which three Advanced Hunting tables must be joined in the KQL query?

Accepted Answer

EmailEvents, DeviceProcessEvents, DeviceNetworkEvents. Option B is correct because the detection requires tracking the attachment that initiated the process (EmailAttachmentInfo), the PowerShell process execution (DeviceProcessEvents), and the outbound network connection to a malicious IP (DeviceNetworkEvents). EmailAttachmentInfo provides the link between the email and the file, while EmailEvents lacks file-level details needed for this chain.

Answer

EmailAttachmentInfo, DeviceProcessEvents, DeviceLogonEvents

Question 5

A security administrator wants to reduce the risk of credential dumping from LSASS on managed Windows endpoints. Which Attack Surface Reduction rule should be enabled?

Accepted Answer

Block credential stealing from the Windows Local Security Authority Subsystem. Option A is correct because the 'Block credential stealing from the Windows Local Security Authority Subsystem' ASR rule (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2) specifically prevents credential dumping from LSASS by blocking access to the process memory via common techniques like Mimikatz or direct API calls (e.g., OpenProcess, ReadProcessMemory). This directly reduces the risk of credential theft on managed Windows endpoints.

Answer

Block executable files from running unless they meet prevalence, age, or trusted list criteria

Answer

Block untrusted and unsigned processes that run from USB

Answer

Block JavaScript or VBScript from launching downloaded executable content

Question 6

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a user opens a malicious Office document, which launches a process named cmd.exe from Microsoft Word, and then that cmd.exe process makes an outbound connection to a known malicious IP address. Which two Advanced Hunting tables must be joined in the KQL query?

Accepted Answer

DeviceProcessEvents and DeviceNetworkEvents. Option B is correct because the detection rule requires tracking the process creation (cmd.exe launched from Microsoft Word) and the subsequent network connection from that process to a malicious IP. DeviceProcessEvents captures process creation events, including parent-child relationships, while DeviceNetworkEvents captures outbound network connections initiated by processes. Joining these tables on DeviceId and ProcessId allows correlating the specific cmd.exe instance with its network activity.

Answer

EmailEvents and EmailUrlInfo

Answer

DeviceEvents and DeviceLogonEvents

Question 7

A security administrator needs to discover which cloud apps are being used in the organization and then block usage of unsanctioned apps in real time using a reverse proxy. Which two Microsoft Defender for Cloud Apps features must be configured to meet these requirements? (Select all that apply.)

Accepted Answer

Cloud Discovery. Cloud Discovery (A) is correct because it analyzes traffic logs from your network to identify all cloud apps in use, providing visibility into sanctioned and unsanctioned apps. Conditional Access App Control (C) is correct because it enforces real-time access controls via a reverse proxy, allowing you to block unsanctioned apps as users attempt to access them.

Answer

App Connectors

Answer

API connectors

Question 8

A security analyst wants to create a custom detection rule in Microsoft 365 Defender Advanced Hunting that alerts when a user receives a phishing email and clicks a malicious link within 10 minutes. Which two tables must be joined in the KQL query?

Accepted Answer

EmailEvents and UrlClickEvents. To detect a user receiving a phishing email and clicking a malicious link within 10 minutes, you need to correlate the email delivery event with the click action. The EmailEvents table contains records of email delivery (including sender, recipient, and subject), while the UrlClickEvents table logs when a user clicks a link in an email, including the URL and timestamp. Joining these two tables on a common identifier (such as NetworkMessageId) allows you to filter for clicks that occur within 10 minutes of email delivery, satisfying the detection requirement.

Answer

EmailAttachmentInfo and UrlClickEvents

Answer

EmailPostDeliveryEvents and DeviceNetworkEvents

Question 9

A security administrator needs to block unsanctioned cloud apps in real time using a reverse proxy. Which two Microsoft Defender for Cloud Apps components must be configured?

Accepted Answer

Conditional Access App Control. Conditional Access App Control (B) is the reverse proxy component in Microsoft Defender for Cloud Apps that enforces real-time session-level monitoring and control of cloud app access. Session control policies (D) are the specific policy objects that define the actions (e.g., block download, block access) applied through that reverse proxy. Together, they enable blocking unsanctioned cloud apps in real time by intercepting user traffic via the reverse proxy architecture.

Answer

Cloud Discovery

Answer

App governance

Question 10

A security analyst wants to create a custom detection rule in Microsoft 365 Defender Advanced Hunting that alerts when a process spawned by Microsoft Word (winword.exe) makes an outbound connection to a known malicious IP address. Which two Advanced Hunting tables must be joined in the KQL query?

Accepted Answer

DeviceProcessEvents and DeviceNetworkEvents. To detect a process spawned by winword.exe making an outbound connection to a known malicious IP, you need to first identify the process creation event (parent-child relationship) in DeviceProcessEvents, then correlate it with the network connection event in DeviceNetworkEvents. Joining these two tables on DeviceId and a timestamp window allows you to link the specific process (winword.exe) to its outbound network activity.

Answer

DeviceNetworkEvents and IdentityLogonEvents

Answer

DeviceProcessEvents and DeviceFileEvents

Question 11

A security administrator wants to configure Microsoft Defender for Cloud Apps to block downloads of sensitive files from Salesforce to unmanaged devices in real time. Which Defender for Cloud Apps component must be configured?

Accepted Answer

Conditional Access App Control. Conditional Access App Control (CAAC) is the correct component because it enables real-time session-level monitoring and control of user activities in SaaS apps like Salesforce. By integrating with Azure AD Conditional Access, CAAC can enforce policies to block downloads of sensitive files to unmanaged devices at the moment of access, using reverse proxy architecture to inspect and intervene in the traffic.

Answer

Cloud Discovery

Answer

App Connectors

Answer

Activity policies

Question 12

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should detect when a user receives a malicious email attachment and then opens the attachment, resulting in a process being created (e.g., .exe file). Which two Advanced Hunting tables must be joined to correlate the email attachment with the resulting process?

Accepted Answer

EmailEvents and DeviceProcessEvents. Option B is correct because correlating email attachment information with process creation requires joining the EmailAttachmentInfo table (which contains details about attachments like file name and SHA256 hash) with the DeviceProcessEvents table (which logs process creation events). This join allows the analyst to match the attachment's hash or file name to the process that was created when the user opened the attachment, directly linking the malicious email to the resulting executable.

Answer

EmailAttachmentInfo and DeviceFileEvents

Answer

DeviceProcessEvents and IdentityLogonEvents

Question 13

A security analyst is investigating a potential attack where a user received a malicious email with an HTML attachment. The HTML file, when opened, fetched a JavaScript payload from a remote server that then dropped a binary on the user's machine and executed it. The analyst wants to create a custom detection rule in Microsoft 365 Defender Advanced Hunting that alerts when an email contains an HTML attachment with an external link, and that attachment is opened, causing a process creation. Which two tables should the analyst join in the KQL query to correlate the email attachment with the resulting process?

Accepted Answer

EmailAttachmentInfo and DeviceProcessEvents. Option A is correct because the analyst needs to correlate the email attachment (identified by its SHA256 hash in EmailAttachmentInfo) with the process creation event (DeviceProcessEvents) that occurs when the HTML attachment is opened and executes a binary. Joining these two tables on the SHA256 hash of the attachment allows the query to trace from the malicious email attachment directly to the resulting process on the same device, fulfilling the detection requirement.

Answer

EmailAttachmentInfo and DeviceFileEvents

Answer

EmailUrlInfo and DeviceProcessEvents

Question 14

A security administrator wants to configure Microsoft Defender for Cloud Apps so that when a user accesses a sensitive file in a sanctioned cloud app from an unmanaged device, the user is blocked from downloading the file and a block action is logged in real time. Which type of policy should the administrator configure?

Accepted Answer

Create a session policy with the action 'Block' on the download action for files with a specific sensitivity label. A session policy in Microsoft Defender for Cloud Apps allows real-time control over user activities within a sanctioned cloud app. By configuring the action 'Block' on the download action for files with a specific sensitivity label, the administrator can block the download when the session is initiated from an unmanaged device, and the block action is logged in real time. This meets the requirement of blocking the download and logging the action simultaneously.

Answer

Create a file policy that monitors for sensitive files being accessed from unmanaged devices and generates an alert

Answer

Configure an access policy that blocks access to the cloud app from unmanaged devices

Answer

Configure an activity policy that monitors download activities from unmanaged devices and triggers automatic remediation

Question 15

A company is experiencing a significant number of phishing attempts that target high-level executives by impersonating their email addresses. The security team wants to configure protection against user impersonation in Microsoft Defender for Office 365. Which setting must be enabled in the anti-phishing policy to protect these specific users?

Accepted Answer

Enable users to protect against impersonation. Option A is correct because the 'Enable users to protect against impersonation' setting in an anti-phishing policy allows you to specify a list of users (such as high-level executives) whose email identities will be monitored for impersonation attempts. When enabled, Defender for Office 365 analyzes inbound messages for display name and email address matches against the protected users, and if a match is found with a suspicious sender, the message is flagged or quarantined. This directly addresses the scenario of attackers spoofing executive email addresses.

Answer

Enable domains to protect against impersonation

Answer

Mailbox intelligence

Answer

Spoofed sender posture