MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 7 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Identity. You need to configure a honeytoken account to detect attackers trying to use the account. In which location should you place the honeytoken account?

Accepted Answer

A domain user account with no privileges. Option B is correct because honeytoken accounts should be real user accounts with no privileges and no recent activity to attract attackers. Option A is wrong because service accounts may have elevated privileges and trigger false positives. Option C is wrong because they are often used and may cause false alerts. Option D is wrong because the account must exist in Active Directory to be monitored.

Answer

A service account with high privileges

Answer

A non-existent account alias in AD

Answer

A guest account

Question 2

Your organization uses Microsoft Defender for Endpoint. You need to configure advanced hunting to query device information. Which TWO tables contain device-related data?

Accepted Answer

DeviceInfo. Options B and D are correct because DeviceInfo and DeviceTvmInfoGathering are tables in advanced hunting that contain device information. Option A is wrong because AlertInfo contains alert metadata, not device info. Option C is wrong because EmailEvents contains email data. Option E is wrong because IdentityLogonEvents contains authentication events.

Answer

AlertInfo

Answer

EmailEvents

Answer

IdentityLogonEvents

Question 3

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that detects when a user signs in from an unknown IP address and then downloads a large number of files. Which THREE components should you configure?

Accepted Answer

Scope (users and groups). Options A, B, and D are correct because an anomaly detection policy requires a template, scope (users/groups), and alerts. Option C is wrong because the IP range is defined in the policy template itself, not separately. Option E is wrong because a session policy is used for real-time control, not detection.

Answer

IP address range category

Answer

Session policy

Question 4

Your organization uses Microsoft Defender for Office 365. You need to protect users from malicious links in email messages. Which TWO features should you configure?

Accepted Answer

Safe Links. Options B and C are correct because Safe Links protects users from malicious links in email and Office apps. Option A is wrong because Safe Attachments protects attachments, not links. Option D is wrong because Anti-phish policy protects against phishing attempts, but not specifically links. Option E is wrong because Spam filter deals with spam, not malicious links.

Answer

Anti-phish policy

Answer

Safe Attachments

Answer

Spam filter policy

Question 5

Refer to the exhibit. You run the KQL query in advanced hunting. What is the primary purpose of this query?

Accepted Answer

Identify devices with high use of encoded commands, which may indicate malicious activity. Option C is correct because the query looks for PowerShell or cmd.exe processes using -EncodedCommand, which is a common technique for obfuscating malicious commands. Option A is wrong because the query doesn't filter by execution policy. Option B is wrong because the query doesn't look for files being deleted. Option D is wrong because the query doesn't look for outbound connections.

Answer

Identify devices with outbound connections to malicious IPs

Answer

Identify devices with PowerShell execution policy set to bypass

Answer

Identify devices where a user deleted system files using cmd

Question 6

Refer to the exhibit. What is the effect of this session policy?

Accepted Answer

Blocks download of files from SharePoint Online and OneDrive on unmanaged devices. Option B is correct because the policy blocks download actions for SharePoint Online and OneDrive for Business when accessed from browsers or native clients on unmanaged devices. Option A is wrong because it blocks download, not upload. Option C is wrong because it applies to both browsers and native clients. Option D is wrong because it blocks downloads, not view.

Answer

Allows viewing but blocks downloading files on managed devices

Answer

Blocks all access to SharePoint and OneDrive from unmanaged native clients only

Answer

Blocks upload of files to SharePoint Online and OneDrive from unmanaged devices

Question 7

Refer to the exhibit. You deploy this configuration profile to Windows devices. What is the most likely outcome?

Accepted Answer

Automated investigation will be triggered for alerts with severity Medium and above, and email notifications will be sent to admin@contoso.com.. Option A is correct because the configuration enables automated investigation and sets the minimum alert severity to Medium, meaning automated investigation will trigger for alerts of severity Medium or higher. Option B is wrong because it says High or higher. Option C is wrong because the configuration enables automated investigation, not disables. Option D is wrong because it says only for alerts of severity Low or higher, which is not configured.

Answer

Automated investigation will be triggered only for alerts with severity High, and email notifications will be sent to all admins.

Answer

Automated investigation will be disabled, and email notifications will be sent to admin@contoso.com.

Answer

Automated investigation will be triggered for all alerts regardless of severity, and no email notifications will be sent.

Question 8

You are investigating a phishing campaign targeting your organization. In Microsoft Defender XDR, you run a KQL query in Advanced Hunting to find all email messages that contain a specific phishing URL. Which table should you query?

Accepted Answer

EmailUrlInfo. Option C is correct because the EmailUrlInfo table contains URL information from email messages, including URLs that can be used to identify phishing links. Option A (EmailEvents) contains email delivery events but not URL details. Option B (EmailAttachmentInfo) contains attachment info. Option D (UrlClickEvents) contains click events, not email-level URL info.

Answer

EmailAttachmentInfo

Answer

UrlClickEvents

Answer

EmailEvents

Question 9

Your organization uses Microsoft Defender for Office 365. You need to configure a policy that automatically moves emails containing malicious attachments to quarantine and notifies the security team. Additionally, you want to allow users to release their own quarantined messages if they are false positives. What should you do?

Accepted Answer

Create a new anti-malware policy and configure the quarantine policy to use 'LimitedAccess' or 'FullAccess'.. Option B is correct because the 'AdminOnlyAccessPolicy' for the quarantine policy allows only admins to release messages. To allow users to release their own quarantined messages, you must change the policy to 'LimitedAccess' or 'FullAccess'. Option A (use default policy) would not allow user release. Option C (modify anti-malware policy) does not control quarantine release permissions. Option D (set user release to false) prevents user release.

Answer

Create a new anti-malware policy and use the default quarantine policy.

Answer

Create a new anti-malware policy and set 'User release' to 'False' in the quarantine policy.

Answer

Modify the anti-malware policy to set 'Quarantine' as the action and assign a custom quarantine policy with user release enabled.

Question 10

You are a security administrator. You need to configure Microsoft Defender for Cloud Apps to detect anomalous user activities such as impossible travel. Which feature should you enable?

Accepted Answer

Anomaly Detection policies. Option D is correct because Anomaly Detection policies in Microsoft Defender for Cloud Apps detect unusual behavior like impossible travel, mass download, etc. Option A (App Discovery) finds shadow IT apps. Option B (Conditional Access App Control) provides real-time session controls. Option C (Cloud Discovery) identifies cloud app usage.

Answer

App Discovery

Answer

Cloud Discovery

Answer

Conditional Access App Control

Question 11

Your organization uses Microsoft Defender for Identity. You receive an alert about a potential DCSync attack. What should you do to investigate this alert in Microsoft Defender XDR?

Accepted Answer

Run a KQL query in Advanced Hunting against IdentityLogonEvents to identify suspicious replication attempts.. Option C is correct because in Microsoft Defender XDR, you can use Advanced Hunting to run a KQL query against the IdentityLogonEvents table to look for replication attempts. Option A (review IdentityDirectoryEvents) contains directory service events, but logon events are more relevant for DCSync. Option B (use IdentityQueryEvents) is for query events. Option D (check IdentityAlertEvents) shows alerts but not raw logon data.

Answer

Review the IdentityDirectoryEvents table for replication-related events.

Answer

Use IdentityQueryEvents to find LDAP queries related to replication.

Answer

Check the IdentityAlertEvents table to see if the alert has additional context.

Question 12

Your organization has Microsoft 365 E5 licenses and uses Microsoft Defender for Office 365. You need to ensure that users are warned before clicking on malicious URLs in email messages, even if the URL is clicked after the email is delivered. Which policy should you configure?

Accepted Answer

Safe Links policy. Option B is correct because Safe Links protection for email messages provides time-of-click protection, warning users when they click on malicious URLs after delivery. Option A (anti-phishing) does not provide URL click protection. Option C (anti-malware) deals with attachments. Option D (Safe Attachments) deals with attachments, not URLs.

Answer

Anti-malware policy

Answer

Safe Attachments policy

Answer

Anti-phishing policy

Question 13

You need to integrate Microsoft Defender XDR with Microsoft Sentinel for centralized monitoring. Which data connector should you use?

Accepted Answer

Microsoft Defender XDR connector. Option A is correct because the Microsoft Defender XDR connector in Sentinel ingests incidents and alerts from all Defender products. Option B (Microsoft 365 Defender connector) is the same as A but named differently; the official name is Microsoft Defender XDR. Option C (Azure Security Center) is for Azure resources. Option D (Microsoft Defender for Cloud) is for cloud security posture.

Answer

Microsoft Defender for Cloud connector

Answer

Azure Security Center connector

Answer

Microsoft 365 Defender connector

Question 14

Your organization uses Microsoft Defender for Endpoint. A user reports that their device is not receiving security updates. You need to ensure that the device is properly onboarded to Defender for Endpoint. Which log should you check first?

Accepted Answer

Microsoft Defender for Endpoint client logs. Option D is correct because the Microsoft Defender for Endpoint client logs (e.g., C:\ProgramData\Microsoft\Windows Defender\Platform\*\MpCmdRun.log) provide detailed information about onboarding and update issues. Option A (Event Viewer Application logs) may show some errors but not as detailed. Option B (Windows Update logs) are for Windows Update, not Defender updates. Option C (System logs) are for system events.

Answer

Event Viewer Application logs

Answer

System logs

Answer

Windows Update logs

Question 15

You are configuring Microsoft Defender for Office 365 to protect against business email compromise (BEC) attacks. Which policy setting should you enable to analyze email sender behavior and detect impersonation attempts?

Accepted Answer

Anti-phishing policy - Impersonation protection. Option C is correct because Anti-phishing policies in Defender for Office 365 include impersonation protection that analyzes sender behavior to detect impersonation attempts. Option A (Anti-malware) deals with malware. Option B (Safe Attachments) deals with attachments. Option D (Safe Links) deals with URLs.

Answer

Safe Attachments policy - Dynamic Delivery

Answer

Safe Links policy - URL scan

Answer

Anti-malware policy - Malware filter