MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 6 — 15 Questions

Question 1

You are a Microsoft 365 administrator for a multinational organization. You are implementing Microsoft Defender XDR to provide centralized threat management across multiple domains. Which three of the following capabilities are core components of Microsoft Defender XDR? (Choose three.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender XDR is a unified pre- and post-breach enterprise defense suite that natively integrates signals from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. These three components are the core pillars that provide endpoint detection and response (EDR), email and collaboration protection, and identity threat detection, respectively, enabling automated incident correlation and remediation across the kill chain.

Answer

Microsoft Entra ID Governance

Answer

Microsoft Purview Information Protection

Answer

Microsoft Intune Device Enrollment

Question 2

As a security administrator, you are tuning automated investigation and response (AIR) capabilities in Microsoft Defender XDR. You need to ensure that the system can automatically remediate threats while minimizing false positives. Which three of the following actions can be taken by automated investigation and response in Microsoft Defender XDR? (Choose three.)

Accepted Answer

Quarantine a file detected as malicious on a device. Automated investigation and response (AIR) in Microsoft Defender XDR can quarantine a file detected as malicious on a device by using built-in remediation actions that isolate the file from the operating system. It can also disable a compromised user account temporarily through integration with Microsoft Entra ID, applying a conditional account disable action to prevent further access. Additionally, AIR can delete an email message from a user's mailbox that was identified as phishing by leveraging Exchange Online Protection (EOP) and Microsoft Defender for Office 365 to perform mailbox-level remediation.

Answer

Reset a user's password without administrator approval

Answer

Uninstall an application from all devices in a tenant

Answer

Modify a Conditional Access policy to block all external access

Question 3

You are a Microsoft 365 administrator responsible for managing security and threats by using Microsoft Defender XDR. Which four of the following are core components or capabilities of Microsoft Defender XDR? (Choose all that apply. There are four correct answers.)

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender XDR is a unified pre- and post-breach enterprise defense suite that natively integrates signals from four core Microsoft Defender components: Defender for Endpoint (endpoint detection and response), Defender for Office 365 (email and collaboration security), Defender for Identity (on-premises Active Directory identity threat detection), and Defender for Cloud Apps (SaaS application access and shadow IT control). These four are the foundational pillars that feed into the Microsoft 365 Defender portal, enabling cross-domain correlation and automated incident response.

Answer

Microsoft Intune

Answer

Microsoft 365 Defender portal Threat Analytics

Question 4

Drag and drop the steps to configure a Conditional Access policy in Microsoft Entra ID in the correct order.

Question 5

Drag and drop the steps to configure a compliance retention policy in Microsoft Purview in the correct order.

Question 6

Match each Microsoft 365 compliance feature to its purpose.

Question 7

Match each Microsoft 365 threat scenario to the appropriate protection.

Question 8

Your organization uses Microsoft Defender for Office 365. You need to ensure that users are warned before opening potentially malicious attachments in Outlook on the web. Which policy setting should you configure?

Accepted Answer

Open in protected view. Option C is correct because the 'Open in protected view' option displays a warning before opening a file in a sandboxed view. Option A is wrong because dynamic delivery delivers the email but replaces attachments with placeholders until scan completes. Option B is wrong because 'Attachments in email are blocked' completely blocks delivery. Option D is wrong because 'Attachments are held and scanned' delays delivery until scan completes.

Answer

Attachments in email are blocked

Answer

Attachments are held and scanned

Answer

Dynamic Delivery

Question 9

Your organization is implementing Microsoft Defender for Cloud Apps. You need to configure anomaly detection policies to alert when a user downloads an unusually large number of files from SharePoint Online. Which data source should you connect to enable this detection?

Accepted Answer

App connector for SharePoint Online. Option B is correct because anomaly detection policies in Defender for Cloud Apps require app connector for SharePoint to analyze user activity logs. Option A is wrong because Microsoft 365 Defender portal is the management interface, not a data source. Option C is wrong because Microsoft Entra ID provides sign-in logs but not file download activity. Option D is wrong because the API connector is used for custom applications, not native SaaS apps like SharePoint.

Answer

API connector for custom apps

Answer

Microsoft 365 Defender portal

Answer

Microsoft Entra ID logs

Question 10

Your organization uses Microsoft Defender for Endpoint (MDE). You need to configure an automated investigation and response (AIR) capability that will automatically remediate a confirmed malware infection on endpoints. Which action should you enable?

Accepted Answer

Automatically resolve alerts. Option A is correct because 'Automatically resolve alerts' enables automatic remediation actions like quarantining files or killing processes. Option B is wrong because it only isolates the device, not remediates malware. Option C is wrong because it only sends an email, not remediates. Option D is wrong because it is a response action, not automated investigation.

Answer

Run antivirus scan

Answer

Notify users via email

Answer

Isolate device

Question 11

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos ticket request. You need to investigate which user account is potentially compromised. Which tool should you use to correlate the alert with user activity?

Accepted Answer

Microsoft Defender XDR portal. Option C is correct because Microsoft Defender XDR provides a unified incident view that correlates alerts from Defender for Identity with user and device information. Option A is wrong because Microsoft 365 compliance center is for compliance, not security investigation. Option B is wrong because it manages endpoints, not identity alerts. Option D is wrong because it is for identity governance, not security incident correlation.

Answer

Microsoft Intune admin center

Answer

Microsoft Purview compliance portal

Answer

Microsoft Entra admin center

Question 12

Your organization has Microsoft Defender for Cloud Apps (MCAS) deployed. You need to create a policy that automatically blocks downloads of files classified as 'Highly Confidential' from SharePoint Online to unmanaged devices. Which policy type should you use?

Accepted Answer

Session policy. Option B is correct because session policy uses reverse proxy to monitor and control user actions in real-time, allowing blocking of downloads based on device state. Option A is wrong because access policy controls sign-in conditions, not file downloads. Option C is wrong because activity policy monitors activities but does not block in real-time. Option D is wrong because app discovery policy identifies shadow IT, not controls file downloads.

Answer

Access policy

Answer

Activity policy

Answer

App discovery policy

Question 13

Your organization uses Microsoft Defender for Office 365 and wants to simulate a phishing attack to train users. You need to configure a simulation that uses a URL link to a credential harvesting page. Which feature should you use?

Accepted Answer

Attack simulation training. Option D is correct because Attack simulation training allows you to create and launch phishing simulations with custom payloads including URLs. Option A is wrong because Safe Links is a protection feature, not simulation. Option B is wrong because Safe Attachments protects against malware in attachments. Option C is wrong because Anti-phish policies protect against phishing, not simulate it.

Answer

Anti-phish policies

Answer

Safe Links policies

Answer

Safe Attachments policies

Question 14

Your organization uses Microsoft Defender for Endpoint. You need to configure a rule that automatically isolates a device from the network when a specific threat is detected, but only if the device is in a specific device group. Which approach should you use?

Accepted Answer

Automation rule. Option B is correct because automation rules allow you to specify conditions, including device group, and actions like isolation. Option A is wrong because a custom detection rule creates custom alerts but does not automate isolation. Option C is wrong because an indicator of compromise (IoC) blocks files/processes, not isolates devices. Option D is wrong because group policy is not part of Defender for Endpoint automation.

Answer

Indicator of compromise (IoC)

Answer

Custom detection rule

Answer

Group policy in Intune

Question 15

Your organization uses Microsoft Defender for Cloud Apps. You need to generate a report of all external users who have shared sensitive files from SharePoint Online. Which feature should you use?

Accepted Answer

Activity log. Option A is correct because Cloud Discovery is used for shadow IT, not user activity. Option B is correct because Activity log can filter by external users and file actions. Option C is wrong because App permissions report shows consent grants to apps, not user file sharing. Option D is wrong because OAuth app policies govern app permissions, not user activity.

Answer

OAuth app policies

Answer

App permissions report

Answer

Cloud Discovery