MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 6 — 15 Questions

Question 1

A company is using Microsoft Defender for Identity (MDI) and wants to receive alerts when a user account is involved in a suspicious network connection. The security team has enabled MDI alerts but is not receiving any alerts for a specific account that is showing anomalous behavior. What should the team check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the MDI sensor is running correctly on the domain controller.. The MDI sensor must be running on the domain controller to capture network activities. If the sensor is not functional, no alerts will be generated for any accounts, including the anomalous one. The first step is to verify sensor health. Options B, C, and D are not the primary cause: B (licensing) might affect overall functionality but not specifically for a single account; C (attribute sync) is not directly related to alert generation; D (email configuration) affects notification delivery but not alert generation—alerts are still created in the portal.

Answer

Check that the user has an appropriate Microsoft 365 license.

Answer

Confirm that the user's Active Directory attributes are synced to Azure AD.

Answer

Ensure the user's email address is configured in the MDI alert settings.

Question 2

Your organization uses Microsoft Defender for Office 365 and Microsoft Defender for Endpoint. You need to ensure that when a user reports a phishing email via the Microsoft Report Message add-in, the URL in the email is automatically blocked on all endpoints. What should you configure?

Accepted Answer

Configure the Tenant Allow/Block List for URLs in the Microsoft 365 Defender portal.. The Tenant Allow/Block List for URLs in the Microsoft 365 Defender portal allows you to block URLs across both email and endpoints. When a user reports a phishing email using the Report Message add-in, the URL is automatically added to this block list, and Defender for Endpoint will enforce the block on all endpoints. Option A is incorrect because Safe Links policies only protect URLs in email and Office documents, they do not automatically block URLs on endpoints. Option B is incorrect because automated investigation and response (AIR) playbooks can automate response actions but do not automatically block the URL on all endpoints based solely on user reports. Option C is incorrect because anti-phishing policies in Defender for Office 365 are focused on email protection and do not automatically extend URL blocking to endpoints.

Answer

Configure Safe Links policies to block the URL.

Answer

Configure an automated investigation and response (AIR) playbook in Microsoft 365 Defender.

Answer

Configure anti-phishing policies in Defender for Office 365.

Question 3

Your organization has deployed Microsoft Defender for Cloud Apps. You need to ensure that all external file sharing to untrusted domains is automatically blocked. The solution must not affect internal sharing. What should you configure?

Accepted Answer

Create a file policy in Microsoft Defender for Cloud Apps with a governance action to remove external users.. A file policy in Microsoft Defender for Cloud Apps can be configured with a governance action to remove external users from shared files when sharing is detected with untrusted domains. This action automatically blocks external sharing without affecting internal sharing, as it targets only external collaborators from domains not on the trusted list.

Answer

Create an access policy in Microsoft Defender for Cloud Apps to block access from untrusted domains.

Answer

Configure an app connector for the cloud app to enforce DLP policies.

Answer

Create a session policy in Microsoft Defender for Cloud Apps to monitor external sharing.

Question 4

You need to configure Microsoft Defender for Identity to alert when a user account is assigned a high number of group memberships in Active Directory. Which attack type does this correspond to?

Accepted Answer

Golden Ticket attack. Golden Ticket attacks involve forging a Kerberos Ticket Granting Ticket (TGT) with arbitrary group memberships, including high-privilege groups like Domain Admins. Microsoft Defender for Identity detects this by alerting when a user account is assigned a high number of group memberships. Option D is wrong because Skeleton Key attacks inject a backdoor into a domain controller to allow authentication with any password. Option B is wrong because Overpass-the-Hash uses a stolen hash to request Kerberos tickets from a domain controller. Option C is wrong because DCSync attacks replicate domain credentials using the Directory Replication Service Remote Protocol.

Answer

Overpass-the-Hash attack

Answer

DCSync attack

Answer

Skeleton Key attack

Question 5

Your organization uses Microsoft Defender for Endpoint. You need to ensure that when a device is onboarded, it automatically receives all current threat intelligence signatures. What should you verify is configured?

Accepted Answer

Cloud-delivered protection is enabled in the Microsoft 365 Defender portal.. Cloud-delivered protection in the Microsoft 365 Defender portal ensures that devices receive the latest threat intelligence signatures in near real-time. When enabled, Defender for Endpoint uses the Microsoft Intelligent Security Graph to push updated signatures and machine learning models to onboarded devices automatically, without relying on manual update cycles.

Answer

The device is configured to receive updates from Microsoft Update.

Answer

Network protection is enabled in the attack surface reduction rules.

Answer

Sample submission is enabled in the advanced features.

Question 6

Your organization has Microsoft Defender for Office 365. Users report that legitimate emails from a partner domain are being quarantined. You need to ensure these emails are delivered while maintaining security. What should you do?

Accepted Answer

Add the partner domain to the Allow list in the Tenant Allow/Block List.. Adding the partner domain to the Allow list in the Tenant Allow/Block List allows emails from that domain to bypass filtering while maintaining security checks for other senders. Option B is incorrect because disabling spam filtering for a domain removes all protection and is not recommended. Option C is incorrect because lowering the SCL threshold globally reduces filtering for all external emails, increasing risk. Option D is incorrect because creating a mail flow rule to bypass spam filtering bypasses security checks and is not a best practice; the Allow list is the proper method.

Answer

Disable spam filtering for the partner domain.

Answer

Lower the spam confidence level (SCL) threshold for the organization.

Answer

Create a mail flow rule to bypass spam filtering for the partner domain.

Question 7

You need to configure Microsoft Defender for Cloud Apps to detect anomalous user behavior such as impossible travel. Which type of policy should you create?

Accepted Answer

Anomaly detection policy. Anomaly detection policy. In Microsoft Defender for Cloud Apps, anomaly detection policies are specifically designed to identify unusual user behaviors, such as impossible travel (login from geographically distant locations within a short time), unusual activity patterns, and other security anomalies. Option A (Access policy) is incorrect because it enforces access controls based on conditions like location or device, rather than detecting anomalies. Option B (Session policy) is incorrect as it monitors and controls real-time application sessions, not anomaly detection. Option D (File policy) is incorrect because it focuses on data protection by applying rules to files stored in cloud apps.

Answer

Access policy

Answer

Session policy

Answer

File policy

Question 8

Your organization uses Microsoft Defender for Endpoint. You need to ensure that when a user clicks a malicious link in an email, the endpoint is automatically isolated. What should you configure?

Accepted Answer

Configure an automated investigation and response (AIR) playbook for device isolation.. Automated investigation and response (AIR) can be configured to automatically isolate a device when a malicious link is clicked, based on alerts from Microsoft Defender for Endpoint. Option A is incorrect because network protection in block mode blocks connections to malicious domains/IPs but does not isolate the device. Option C is incorrect because attack surface reduction rules reduce the attack surface by blocking behaviors but do not automatically isolate. Option D is incorrect because while custom detection rules can trigger isolation, the built-in AIR playbook is the recommended automated method.

Answer

Enable network protection in block mode.

Answer

Configure attack surface reduction rules to block the link.

Answer

Create a custom detection rule to trigger isolation.

Question 9

Your organization is implementing Microsoft Defender XDR. Which TWO actions should you take to ensure that alerts from different workloads are correlated into incidents?

Accepted Answer

Verify that all workloads are onboarded and sending data to Microsoft 365 Defender.. For alerts from different workloads to be correlated into incidents in Microsoft Defender XDR, all relevant workloads must be onboarded and actively sending data to the Microsoft 365 Defender platform. Correlation occurs automatically when the data is available. Option A is incorrect because unified RBAC manages user permissions but does not directly ensure correlation; correlation happens regardless of RBAC settings. Option C is incorrect because data retention policies do not affect incident correlation. Option D is incorrect because sending alerts to Microsoft Sentinel is not required for correlation within Defender XDR. Option E is incorrect because licensing requirements are separate from ensuring correlation; while E5 licenses include Defender for Office 365, they are not necessary for basic correlation.

Answer

Enable unified role-based access control (RBAC) in Microsoft 365 Defender.

Answer

Ensure that all workloads are configured to use the same data retention policy.

Answer

Configure each workload to send alerts to Microsoft Sentinel.

Answer

Assign Microsoft 365 E5 licenses to all users.

Question 10

You are investigating a security incident in Microsoft 365 Defender. The incident involves a user who received a phishing email that contained a link to a malicious website. The user clicked the link and entered credentials. Which THREE components of Microsoft Defender XDR would generate alerts that contribute to this incident?

Accepted Answer

Microsoft Defender for Office 365. Options B, C, and E are correct because each component detects a different aspect of the attack: Microsoft Defender for Office 365 detects the phishing email, Microsoft Defender for Endpoint detects the malicious website access on the endpoint, and Microsoft Defender for Identity detects the credential compromise. Option A, Microsoft Sentinel, is a SIEM that can ingest alerts but does not directly generate alerts for this incident. Option D, Microsoft Defender for Cloud Apps, focuses on cloud application usage and is not directly relevant to this email-to-endpoint attack.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 11

Which TWO features in Microsoft Defender for Office 365 help protect against zero-day malware in email attachments?

Accepted Answer

Safe Attachments. Safe Attachments (Option A) is correct because it uses a detonation chamber environment to open email attachments in a virtualized sandbox, analyzing behavior for zero-day malware before delivery. This process catches unknown threats by executing the attachment and observing malicious actions, unlike signature-based detection.

Answer

Mail flow rules

Answer

Anti-spam policies

Answer

Anti-phishing policies

Question 12

Your organization uses Microsoft Defender for Cloud Apps. You need to be alerted when a user accesses a cloud app from a risky IP address. What should you configure?

Accepted Answer

Create an anomaly detection policy with the 'Activity from risky IP address' template.. An anomaly detection policy can alert on activities from risky IP addresses. Option B is wrong because session policies control real-time access. Option C is wrong because file policies monitor data. Option D is wrong because access policies control access based on conditions.

Answer

Create a session policy to monitor risky IP addresses.

Answer

Create a file policy to detect access from risky IPs.

Answer

Create an access policy to block risky IPs.

Question 13

Your organization uses Microsoft Defender for Office 365 and Microsoft Defender for Endpoint. You need to configure automatic investigation and response (AIR) to handle a phishing email that was delivered to a user's inbox and the user clicked a link that downloaded a malicious file. What should you configure?

Accepted Answer

Configure the unified automated investigation and response playbook in Microsoft Defender XDR.. The unified automated investigation and response (AIR) playbook in Microsoft Defender XDR coordinates automated actions across Defender for Office 365 and Defender for Endpoint, handling both the email and the malicious file in a single playbook. Option B is incorrect because separate playbooks in each workload do not coordinate investigations across the email and endpoint. Option C is incorrect because setting automation levels to 'Full – remediate automatically' applies to individual playbook settings, not the configuration of the unified playbook. Option D is incorrect because manual investigation triggers are not automated; the requirement is to configure automatic investigation and response.

Answer

Configure separate automated investigation playbooks in each workload.

Answer

Set the automation level for each playbook to 'Full – remediate automatically'.

Answer

Enable manual investigation triggers in Microsoft Defender XDR.

Question 14

Your organization deploys Microsoft Defender XDR and wants to use advanced hunting to detect lateral movement by an attacker who uses RDP from a compromised workstation to a domain controller. Which KQL query should you use in advanced hunting?

Accepted Answer

DeviceNetworkEvents | where RemotePort == 3389 and RemoteIP == '10.0.0.10' and InitiatingProcessAccountName == 'compromised_user'. DeviceNetworkEvents captures network connections, and filtering for RDP (port 3389) from a specific remote IP and user account directly identifies lateral movement over the network. Option B is incorrect because DeviceLogonEvents logs authentication events but does not show the network direction (source/destination) or the initiating process user. Option C is incorrect because IdentityLogonEvents tracks cloud identity logons, not endpoint network connections. Option D is incorrect because DeviceProcessEvents records process creation, not network connections, so it cannot detect RDP traffic.

Answer

DeviceLogonEvents | where RemoteIP == '10.0.0.10' and LogonType == '10'

Answer

IdentityLogonEvents | where AccountUpn == 'compromised_user@contoso.com' and Application == 'Microsoft Remote Desktop'

Answer

DeviceProcessEvents | where ProcessCommandLine contains 'mstsc.exe' and AccountName == 'compromised_user'

Question 15

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious LDAP query from a domain controller. After investigating, you determine the query is legitimate. How should you prevent future alerts for this activity?

Accepted Answer

Create a suppression rule for that alert type and entity.. Creating a suppression rule for the specific alert type and entity prevents future false positives without affecting other monitoring. Option B is wrong because a custom detection rule is used to create new detections, not to suppress existing alerts. Option C is wrong because disabling the Defender for Identity sensor on the domain controller would stop all monitoring from that controller, which is excessive. Option D is wrong because changing the alert severity to Low does not suppress the alert; it only changes its priority.

Answer

Create a custom detection rule to allow the LDAP query.

Answer

Disable the Defender for Identity sensor on the domain controller.

Answer

Change the alert severity to Low.