MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 7 — 15 Questions

Question 1

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to stream advanced hunting data from Defender XDR to Sentinel to run analytics rules. What should you configure?

Accepted Answer

Use the Microsoft 365 Defender connector in Sentinel.. The Microsoft 365 Defender data connector in Microsoft Sentinel is specifically designed to stream advanced hunting data from Microsoft Defender XDR to Sentinel for analytics. Option B is incorrect because while there is a 'Microsoft Defender XDR data connector', the correct name is 'Microsoft 365 Defender' connector. Option A is wrong because Diagnostic settings in Defender XDR export to Log Analytics, but the direct connector is simpler and more appropriate. Option D is wrong because the Threat Intelligence connector ingests threat intel, not telemetry.

Answer

Configure Diagnostic settings in Microsoft Defender XDR to send logs to Log Analytics.

Answer

Install the Microsoft Defender XDR data connector in Microsoft Sentinel.

Answer

Configure the Threat Intelligence – TAXII connector in Sentinel.

Question 2

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to stream advanced hunting data from Defender XDR to Sentinel to run analytics rules. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an automation rule in Microsoft Defender XDR.. Automation rules in Microsoft Defender XDR allow you to automatically take action (such as isolating a device) when triggered by a vulnerability detection. Option A is incorrect because advanced hunting queries are for investigating threats, not automating responses. Option C is incorrect because device groups and configuration policies manage settings, not automated incident responses. Option D is incorrect because vulnerability management only provides visibility into vulnerabilities, it does not automate isolation actions.

Answer

Run an advanced hunting query to identify high-risk devices.

Answer

Create a device group and assign a device configuration policy.

Answer

Enable vulnerability management in Microsoft Defender for Endpoint.

Question 3

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to stream advanced hunting data from Defender XDR to Sentinel to run analytics rules. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Threat Explorer in Microsoft Defender for Office 365. Threat Explorer in Microsoft Defender for Office 365 allows you to search for emails and view detailed headers, delivery information, and detection details, enabling analysis of why a phishing email bypassed policies. Option A is wrong because Attack Simulator is used for simulating phishing campaigns for training, not for analyzing detected emails. Option C is wrong because Message trace in Exchange admin center focuses on transport flow and delivery status, not security analysis or header inspection. Option D is wrong because the Quarantine page only shows quarantined items, not emails that were delivered to users.

Answer

Attack Simulator in Microsoft Defender for Office 365

Answer

Message trace in Exchange admin center

Answer

Quarantine page in Microsoft Defender for Office 365

Question 4

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to stream advanced hunting data from Defender XDR to Sentinel to run analytics rules. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an OAuth app policy in Microsoft Defender for Cloud Apps to revoke the app.. An OAuth app policy in Microsoft Defender for Cloud Apps can revoke permissions and block access to third-party apps that use OAuth. Option A is incorrect because a Conditional Access policy in Microsoft Entra ID can block access but does not revoke OAuth permissions. Option B is incorrect because a session policy in Defender for Cloud Apps controls usage but does not block access after consent. Option D is incorrect because an app discovery policy only identifies apps, not block them.

Answer

Create a Conditional Access policy in Microsoft Entra ID to block the app.

Answer

Create a session policy in Microsoft Defender for Cloud Apps.

Answer

Create an app discovery policy in Microsoft Defender for Cloud Apps.

Question 5

Your organization uses Microsoft Defender for Endpoint. You need to collect investigation packages from multiple devices for forensic analysis. What is the most efficient method?

Accepted Answer

Use the central investigations feature to collect packages from multiple devices.. The central investigations feature in Microsoft Defender for Endpoint allows you to collect investigation packages from multiple devices simultaneously, making it the most efficient method for bulk forensic collection. It leverages automated workflows to gather device memory, registry, and file artifacts without requiring individual Live Response sessions or manual page navigation.

Answer

Use the Microsoft 365 Defender portal's forensic collection tool.

Answer

Initiate a Live Response session on each device.

Answer

Run a manual collection from each device's page.

Question 6

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to stream advanced hunting data from Defender XDR to Sentinel to run analytics rules. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create automation rules in Microsoft Defender XDR to assign incidents based on criteria.. The correct answers are B and E. Automation rules in Microsoft Defender XDR can be configured to automatically assign incidents to the appropriate analyst team based on criteria such as incident category. Custom incident fields allow you to capture and store team assignment information for automation and filtering. Option A is incorrect because the 'Assign to' option on the incident page is a manual action, not automatic. Option C is incorrect because default assignment applies to all incidents without criteria. Option D is incorrect because tags help with classification but do not automate assignment.

Answer

Use the incident page's 'Assign to' option.

Answer

Configure the default assignment rule to assign all incidents to a specific team.

Answer

Use tags to categorize incidents and then manually assign.

Question 7

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to stream advanced hunting data from Defender XDR to Sentinel to run analytics rules. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a session policy to block downloads or uploads for the app.. To detect and block a high-risk cloud app, you must first sanction the app in the Cloud App Catalog (C). Then, create a session policy to block uploads/downloads (A) and an access policy to block access (B). App discovery policies (D) only identify apps, not block them, and unsanctioning (E) would remove the app from control, allowing it.

Answer

Create an app discovery policy for the app.

Answer

Unsanction the app in the Cloud App Catalog.

Question 8

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to stream advanced hunting data from Defender XDR to Sentinel to run analytics rules. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the action to 'Block' for the file type.. B and C are correct. To block attachments with a specific file type, you must set the action to 'Block' for that file type (B) and add the file type to the policy's file type list (C). Option A is incorrect because the redirect option is for sending blocked or malicious attachments to a security mailbox for review, not for blocking. Option D is incorrect because you specify the recipient domain in the policy condition to define which emails the policy applies to, but it is not specifically for blocking a file type. Option E is incorrect because selecting users or groups is for scoping the policy, not for blocking a specific file type.

Answer

Enable the redirect option to send the attachment to a security mailbox.

Answer

Specify the recipient domain in the policy condition.

Answer

Select the user or group to apply the policy to.

Question 9

A company uses Microsoft Defender for Office 365. Users report that phishing emails with malicious links are occasionally delivered to their inboxes. The security team wants to ensure that suspicious URLs are detonated in a sandbox before delivery for all recipients. What should the security team configure?

Accepted Answer

Configure a Safe Links policy with 'Use Safe Attachments to scan content' enabled.. Configure a Safe Links policy with 'Use Safe Attachments to scan content' enabled. This setting causes URLs in emails to be detonated in a sandbox before delivery, as part of the Safe Attachments scanning process. Option B is incorrect because the 'Block URLs' option in anti-phishing does not provide sandbox detonation before delivery. Option C is incorrect because a Safe Attachments policy for email scans attachments, not URLs. Option D is incorrect because Safe Links for Microsoft Teams only scans links when clicked, not before delivery.

Answer

Enable the 'Block URLs' option in the anti-phishing policy.

Answer

Configure a Safe Attachments policy for email messages.

Answer

Enable 'Safe Links for Microsoft Teams' in the global settings.

Question 10

Contoso uses Microsoft Defender XDR and has a Microsoft 365 E5 license. The security team wants to automate incident response when a user is compromised. They create a custom automation rule in the Microsoft 365 Defender portal. The rule should automatically isolate the user's device, disable the user account, and reset the user's password. Which action type should they configure in the rule?

Accepted Answer

Create a playbook that performs all three actions and run it as the automation rule action.. In Microsoft Defender XDR automation rules, you can define actions that trigger playbooks. To perform multiple actions like isolate device, disable account, and reset password, you need to use a custom playbook (built with Microsoft Sentinel or Logic Apps) because Defender XDR automation rules only support a single action per trigger. However, by creating a playbook that includes all three steps and configuring the automation rule to run that playbook, you can achieve the desired outcome. Option A is correct because a playbook can combine multiple actions. Option B is incorrect because selecting 'Isolate device' as the incident action only performs that single action. Option C is incorrect because a webhook would require external orchestration and is not a native automation rule action. Option D is incorrect because there is no 'Run script' action in Defender XDR automation rules; native scripting is not supported.

Answer

Select 'Isolate device' as the incident action.

Answer

Configure a webhook to call an external API that performs the actions.

Answer

Use the 'Run script' action and provide a PowerShell script.

Question 11

A company wants to receive alerts when a user account is used from an unauthorized location. They have Microsoft Defender for Cloud Apps (MDA). Which policy type should they create?

Accepted Answer

Create an anomaly detection policy.. Anomaly detection policies in Microsoft Defender for Cloud Apps (MDA) detect user behavior anomalies such as impossible travel, which is relevant for alerts when a user account is used from an unauthorized location. Option D is correct. Option A is wrong because session policies control real-time access based on risk. Option B is wrong because app permissions policies manage OAuth app permissions. Option C is wrong because file policies monitor file sharing activities.

Answer

Create a session policy.

Answer

Create an app permissions policy.

Answer

Create a file policy.

Question 12

Which TWO actions can be performed by Microsoft Defender for Identity? (Select TWO.)

Accepted Answer

Monitor domain controller activities and behavior.. Microsoft Defender for Identity is a cloud-based security solution that uses on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions. It monitors domain controller activities and security events to detect suspicious behavior (Option B). It also identifies lateral movement paths by analyzing network activities and user behavior to find potential attack paths (Option C). Option A is incorrect because managing firewall rules on endpoints is not a function of Defender for Identity; that is typically done by Microsoft Defender for Endpoint. Option D is incorrect because real-time file scanning is performed by Microsoft Defender Antivirus, not Defender for Identity. Option E is incorrect because blocking sign-ins from malicious IPs is handled by Azure AD Conditional Access or Identity Protection, not Defender for Identity.

Answer

Manage firewall rules on endpoints.

Answer

Scan files for malware in real time.

Answer

Block sign-in attempts from malicious IP addresses.

Question 13

Which THREE features are part of Microsoft Defender XDR? (Select THREE.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender XDR is a unified security solution that integrates signals from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and others. The correct answers are B, C, and E. Option A (Microsoft Purview) is a data governance and compliance solution, not part of Defender XDR. Option D (Microsoft Sentinel) is a separate cloud-native SIEM and SOAR solution.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Question 14

A company experiences a ransomware attack that encrypts files on several endpoints. The security team wants to use automated investigation and response (AIR) capabilities in Microsoft Defender XDR to contain the threat. Which TWO actions can be taken automatically by AIR? (Select TWO.)

Accepted Answer

Remove malicious files detected by Defender for Endpoint.. AIR in Microsoft Defender XDR can automatically take containment actions such as isolating devices (Option C) and removing malicious files (Option B) during an active ransomware attack. These actions help prevent the spread of the threat. Option A (blocking sender's email domain) is typically handled by Defender for Office 365 policies, not automatically by AIR in this context. Option D (disabling user accounts) and Option E (resetting passwords) are not automatic actions of AIR; they require manual intervention or separate playbooks.

Answer

Block the sender's email domain in Defender for Office 365.

Answer

Disable user accounts associated with the attack.

Answer

Reset user passwords for affected accounts.

Question 15

An administrator deployed the above Intune device configuration policy for Microsoft Defender for Endpoint on Windows 10 devices. Users report that some potentially unwanted applications (PUA) are still being installed. What is the most likely cause?

Accepted Answer

The PUAProtection setting is in AuditMode and not blocking PUAs.. The PUAProtection setting is configured as 'AuditMode', which logs potentially unwanted application (PUA) detections but does not block them. To prevent PUAs from being installed, the setting must be set to 'Enabled' or 'Block'. Therefore, option B is correct. Option A is incorrect because the cloud timeout value affects cloud-based protection response time, not PUA detection. Option C is incorrect because cloud-delivered protection level does not directly control PUA blocking; PUA protection is a separate setting. Option D is incorrect because real-time monitoring is enabled in the policy and is not the cause of the issue.

Answer

The cloud timeout value is too low, causing PUA detection to fail.

Answer

Cloud-delivered protection is set to High level, which does not affect PUAs.

Answer

Real-time monitoring is disabled.