MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 6 — 15 Questions

Question 1

You run the KQL query in Microsoft Defender XDR. The query returns a list of users who logged into Exchange Online more than 10 times in the last day from a single IP address. However, you notice that some IP addresses are internal corporate IPs. What should you add to the query to focus on suspicious logons from external IPs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a line: | where IPAddress !startswith "10.". To focus on external IPs, the query should exclude all RFC 1918 private IPv4 addresses. In KQL, this is better done with `| where not(ipv4_is_private(IPAddress))`. The provided option A only removes 10.x addresses and would still include internal IPs from other private ranges, so it does not fully meet the requirement. The other options (B, C, D, E) do not filter internal IPs at all. Therefore, none of the options is a fully correct answer.

Answer

Add a line: | where Application == "Outlook Web App"

Answer

Add a line: | summarize by Application

Answer

Add a line: | where TotalLogons > 50

Answer

Add a line: | sort by TotalLogons desc

Question 2

You are reviewing a Conditional Access policy in Microsoft Entra ID. The policy is intended to block access to Exchange Online for users with high risk level. However, users with high risk are still able to access Exchange Online. What is the most likely cause?

Accepted Answer

The policy is set to report-only mode.. Report-only mode evaluates the policy but does not enforce it, so high-risk users are not blocked. Option D is correct because the policy is likely set to report-only mode. Option A is wrong because the policy includes Exchange Online. Option B is wrong because the policy does not exclude the affected users. Option C is wrong because the policy targets high risk, not low risk. Option E is wrong because the grant control is block, not require MFA.

Answer

The policy does not include Exchange Online.

Answer

The policy excludes the affected users.

Answer

The policy is targeting low risk instead of high risk.

Answer

The grant control is set to require multi-factor authentication.

Question 3

You are configuring a network security policy in Microsoft Defender for Cloud Apps. The exhibit shows a policy to block traffic from known Tor exit nodes. However, the policy is not blocking traffic from IP 185.220.101.5. What is the most likely reason?

Accepted Answer

Another policy with a higher priority is allowing the traffic.. In Microsoft Defender for Cloud Apps, policies are evaluated in order of priority, and the first matching policy determines the action. If another policy with a higher priority (lower number) allows the traffic, the block policy will not be applied. Therefore, the most likely reason the Tor exit node IP is not blocked is that a higher-priority policy is allowing it.

Answer

The action is set to Alert only, not block.

Answer

The IP address is not in the specified subnet.

Answer

The protocol condition is too restrictive.

Answer

The source address condition is missing a wildcard.

Question 4

Your organization uses Microsoft Defender for Office 365 and Microsoft Defender for Endpoint. A user receives an email with a link that leads to a malicious website. The user clicks the link, but the browser is protected by Microsoft Defender SmartScreen. However, the user is still able to download a file from the site. What should you configure to prevent this?

Accepted Answer

Enable Safe Links in Microsoft Defender for Office 365.. Safe Links in Microsoft Defender for Office 365 protects users by scanning URLs in emails and blocking malicious links at the time of click, preventing access to malicious websites. Option A is incorrect because Attack Surface Reduction rules are designed to block specific behaviors and processes, not web downloads from a browser after clicking a link. Option B is incorrect because network protection in Microsoft Defender for Endpoint blocks connections to malicious IPs or domains at the network level, but if the website is considered safe, network protection may not block the download. Option C is incorrect because Safe Attachments is designed to scan email attachments, not URLs or links. Option D is incorrect because Anti-Phishing policies primarily protect against impersonation and phishing attempts, not direct downloads from a website.

Answer

Enable Attack Surface Reduction rules.

Answer

Enable network protection in Microsoft Defender for Endpoint.

Answer

Enable Safe Attachments in Microsoft Defender for Office 365.

Answer

Configure an Anti-Phishing policy.

Question 5

Your organization is using Microsoft Defender for Cloud Apps. You want to generate an alert when a user shares a file containing sensitive information with an external domain. You have configured a file policy with the condition: 'Inspection method: Data Classification Service' and 'Inspection type: Sensitive information type'. However, no alerts are triggered. What is the most likely reason?

Accepted Answer

The sensitive information type is not correctly configured in the data classification service.. The 'Data Classification Service' inspection method in Defender for Cloud Apps relies on the sensitive information types (SITs) defined in Microsoft Purview (Microsoft 365 compliance center). If the SIT referenced by the file policy is not properly configured or published in the data classification service, the policy engine has nothing to match against, so no alerts fire even when files are shared externally. The condition itself is valid, but the underlying classification dependency is missing.

Answer

The file is shared with an internal user only.

Answer

The policy is not applied to the specific cloud app.

Answer

The file size is too large for inspection.

Answer

The user is not licensed for Microsoft Defender for Cloud Apps.

Question 6

Your organization uses Microsoft Defender for Office 365. Users report that some phishing emails are still reaching inboxes despite the anti-phish policy being enabled. You need to reduce the number of phishing emails that bypass the filter. What should you configure?

Accepted Answer

Configure spoof intelligence in the anti-phish policy. Spoof intelligence is the specific anti-phish capability that detects and blocks inbound messages where the sender's domain is spoofed (the From: header doesn't match the sending infrastructure). Enabling it in the anti-phish policy lets Defender for Office 365 apply spoof intelligence verdicts and quarantine or junk messages that impersonate internal or trusted external domains. This directly reduces phishing that bypasses standard filtering because spoofed senders are a primary phishing vector.

Answer

Add the phishing domains to the Tenant Allow/Block List

Answer

Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams

Answer

Enable DKIM signing for your custom domains

Question 7

You manage a Microsoft Defender for Endpoint environment. A device onboarded to Defender for Endpoint is not reporting alerts. You run the Microsoft Defender for Endpoint client analyzer and see that the service is running. Which log should you review to troubleshoot the issue?

Accepted Answer

Microsoft Defender for Endpoint sensor logs located in %ProgramData%\Microsoft\Windows Defender Advanced Threat Protection\Datamart. The Microsoft Defender for Endpoint sensor logs are stored in %ProgramData%\Microsoft\Windows Defender Advanced Threat Protection\Datamart and contain detailed diagnostic information about the sensor's operation, including connectivity, authentication, and reporting issues. Reviewing these logs is the correct step when the service is running but alerts are not reporting.

Answer

Network Protection logs in %ProgramData%\Microsoft\Windows Defender\NIS

Answer

Microsoft 365 Defender portal audit log

Answer

Windows Event Log (Applications and Services Logs/Microsoft/Windows/Defender)

Question 8

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos ticket request. You need to investigate the alert. Which log should you analyze in Microsoft Defender for Identity?

Accepted Answer

Network activities. Microsoft Defender for Identity captures Kerberos authentication traffic (TGT/TGS requests) as network activities, so a suspicious Kerberos ticket request alert is investigated in the Network activities log. This log records authentication attempts, DNS queries, and lateral movement traffic observed by the sensor, which is where Kerberos-based attacks like Golden Ticket or Kerberoasting surface. The alert itself is just the trigger; the underlying evidence lives in the network activity timeline.

Answer

Lateral movement paths

Answer

Entity profile

Answer

Security alerts

Question 9

You manage Microsoft Defender for Endpoint. A device is showing as 'Inactive' in the device inventory. The device is turned on and connected to the network. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Endpoint sensor is not reporting. A device showing as 'Inactive' in Microsoft Defender for Endpoint while powered on and network-connected most likely means the Defender for Endpoint sensor is not reporting telemetry to the cloud service. The 'Inactive' status reflects the last sensor heartbeat/communication, so a non-reporting sensor is the direct cause. This is distinct from being off or blocked at the firewall, which would be secondary causes.

Answer

The device is turned off

Answer

A firewall is blocking communication with the Microsoft Defender for Endpoint cloud service

Answer

The onboarding script was not run successfully

Question 10

Which TWO actions can you perform in the Microsoft Defender XDR portal to investigate a security incident?

Accepted Answer

View the incident timeline. In the Microsoft Defender XDR portal, you can view the incident timeline (Option A) to see the sequence of events leading up to and during the incident, and you can review impacted assets (Option E) to identify affected devices and users. Option B is incorrect because advanced hunting is a separate feature for querying data, not a direct action within an incident investigation. Option C is incorrect because creating mail flow rules is done in the Exchange admin center, not in Defender XDR. Option D is incorrect because resetting user passwords is a task for Microsoft Entra ID or the Microsoft 365 admin center, not directly in Defender XDR.

Answer

Run advanced hunting queries

Answer

Create mail flow rules

Answer

Reset user passwords

Question 11

You are reviewing a Microsoft Defender for Cloud Apps policy JSON. What does this policy do?

Accepted Answer

Blocks sign-ins from anonymous proxy IP addresses. The policy blocks sign-ins from anonymous proxy IP addresses. Option A is wrong because the filter is on IP address category, not location. Option C is wrong because it blocks sign-ins, not sessions. Option D is wrong because the action is Block, not alert.

Answer

Blocks sign-ins from a specific IP address range

Answer

Alerts when a sign-in occurs from an anonymous proxy

Answer

Blocks sign-ins from risky sessions based on user behavior

Question 12

You run the above KQL query in Microsoft Defender for Endpoint advanced hunting. What is the purpose of this query?

Accepted Answer

To identify the top 10 devices with the most suspicious process injection alerts. The query filters alerts for a specific detection technique (process injection) and summarizes by device, sorting and limiting to the top 10. This matches the purpose of identifying the devices with the most suspicious process injection alerts. The KQL likely uses 'summarize count() by DeviceName' with a 'where' clause on AlertName or similar, then 'top 10 by count_'.

Answer

To correlate device alerts with user activities

Answer

To list all devices with high severity alerts

Answer

To find the top 10 devices with the most alerts of any type

Question 13

Contoso uses Microsoft 365 E5 and has enabled Microsoft Defender for Office 365. Users report that legitimate external emails are being quarantined. You need to reduce false positives without reducing protection. What should you do?

Accepted Answer

Configure Advanced Delivery for trusted senders from the external domain.. Advanced Delivery in Defender for Office 365 is designed for trusted third-party senders (like phishing simulations or secure gateways) whose mail would otherwise be filtered as malicious. Configuring it for the external domain lets their messages bypass standard filtering while still being logged and scanned, reducing false positives without weakening protection for other senders.

Answer

Disable third-party email filtering integration.

Answer

Reduce the Spam Confidence Level (SCL) threshold in anti-spam policies.

Answer

Allow all emails from the sender's domain in the Tenant Allow/Block List.

Question 14

Your organization uses Microsoft Defender for Endpoint. A security analyst reports that a critical file was quarantined on several devices, but the file is a trusted application. You need to restore the file and prevent future false positives. What should you do?

Accepted Answer

Create a custom indicator for the file hash with the action 'Allow and alert'.. Creating a custom indicator for the file hash with the action 'Allow and alert' in Microsoft Defender for Endpoint will allow the file to run and prevent future quarantines, while also generating an alert for monitoring. Custom indicators override detection logic and are the recommended method to handle false positives. Option A is incorrect because adding the file to Microsoft Defender Antivirus exclusions may not prevent detection by cloud-based protection or Defender for Endpoint's behavior monitoring. Option B is incorrect because disabling real-time protection on affected devices would weaken security and is not a sustainable solution. Option C is incorrect because Windows Defender Firewall manages network traffic, not file scanning or quarantine actions.

Answer

Add the file to the allowed list in Microsoft Defender Antivirus exclusions.

Answer

Disable real-time protection on affected devices.

Answer

Add the file to the trusted list in Windows Defender Firewall.

Question 15

Your company uses Microsoft Defender for Cloud Apps. You notice that a user is downloading large amounts of data from a sanctioned cloud app from an unusual location. You need to automatically suspend the user's access when such activity is detected. What should you configure?

Accepted Answer

Configure a session policy in Defender for Cloud Apps.. Defender for Cloud Apps session policies are used for real-time monitoring and control of user sessions in sanctioned apps, including the ability to block downloads, protect on download, and — when combined with Conditional Access App Control — suspend or block a user's session. To automatically suspend access upon detecting anomalous download activity, a session policy is the correct control.

Answer

Configure an access policy in Defender for Cloud Apps.

Answer

Configure a file policy in Defender for Cloud Apps.

Answer

Configure an anomaly detection alert in Defender for Cloud Apps.