MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 7 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos authentication attempt from a domain controller. You need to determine if the account was compromised by checking for lateral movement. What should you do in the Microsoft 365 Defender portal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the identity timeline for the affected user account.. Microsoft Defender for Identity's identity timeline for a user account aggregates all authentication, lateral movement, and directory activity associated with that identity, making it the correct place to investigate whether the account was compromised and moved laterally. The incident graph shows relationships between alerts but does not provide the chronological identity-centric view needed to trace lateral movement. The identity timeline is purpose-built for this investigation.

Answer

Review the incident graph for the related alert.

Answer

Run an advanced hunting query for IdentityLogonEvents.

Answer

Review the device timeline for the domain controller.

Question 2

Your organization uses Microsoft Defender for Cloud Apps. You want to control the use of personal cloud storage apps. Which TWO actions should you take?

Accepted Answer

Create a session policy to monitor and control downloads to personal cloud storage apps.. Option D is correct because Defender for Cloud Apps Conditional Access App Control uses session policies to monitor and control user sessions in real time, including blocking or auditing downloads to personal cloud storage apps, which directly addresses controlling their use. Option E is correct because app governance in Defender for Cloud Apps provides visibility and control over OAuth app permissions and usage, helping detect and remediate risky or unsanctioned personal cloud storage apps that access corporate data. Option A is not the best fit because a DLP policy alone prevents sharing of sensitive data but does not comprehensively control the use of personal cloud storage apps. Option B is not correct here because requiring managed apps via Conditional Access is an Intune app protection concept, not the Defender for Cloud Apps session control mechanism described. Option C is not correct because simply blocking all personal cloud storage apps is overly broad and does not reflect the granular monitoring and control capabilities expected in this scenario.

Answer

Create a DLP policy to prevent sharing of sensitive data to personal cloud storage apps.

Answer

Create a conditional access policy to require managed apps for cloud storage.

Answer

Block all personal cloud storage apps using Defender for Cloud Apps.

Question 3

Your company uses Microsoft Defender for Endpoint and Microsoft Intune. You have a group of remote users who connect to the corporate network via VPN. Recently, several of these devices were compromised due to unpatched vulnerabilities. You need to ensure that devices that are missing critical security updates are automatically blocked from accessing corporate resources. The solution must integrate with Microsoft Defender for Endpoint's threat and vulnerability management (TVM) data. What should you configure?

Accepted Answer

Create a conditional access policy in Microsoft Entra ID that uses 'Require device to be marked as compliant' and integrate Defender for Endpoint's risk level to block devices with high risk.. It combines Microsoft Entra ID Conditional Access with Defender for Endpoint's device risk signal, which is derived from threat and vulnerability management (TVM) data. Conditional Access can enforce 'Require device to be marked as compliant' and also evaluate the device risk level reported by Defender for Endpoint. When a device has unpatched critical vulnerabilities, Defender for Endpoint raises its risk level, and Conditional Access can block access to corporate resources. This directly integrates TVM data with access control, satisfying the requirement.

Answer

Configure the VPN server to only allow devices that have the latest updates installed.

Answer

Create a Microsoft Defender for Endpoint device group and set the remediation level to 'block' for devices with critical vulnerabilities.

Answer

Configure a device compliance policy in Intune that requires all critical updates to be installed, and assign it to the VPN users group.

Question 4

Your organization uses Microsoft 365 E5 and has deployed Microsoft Defender for Cloud Apps. You discover that a user in the finance department is using a personal cloud storage app to store sensitive financial data. The app is unsanctioned. You need to prevent any further uploads of sensitive data to this app. Additionally, you want to automatically alert when users attempt to access this app from unmanaged devices. You must not block access entirely, as some users need to read data already stored there. What should you configure?

Accepted Answer

Create a session policy in Defender for Cloud Apps that blocks uploads for the unsanctioned app and requires conditional access app control for unmanaged devices.. A session policy in Defender for Cloud Apps can block uploads for unsanctioned apps while allowing read access, and it can enforce conditional access app control to require managed devices for access, generating alerts. Option A is incorrect because app governance manages app permissions, not session-level controls for blocking uploads and conditional access. Option B is incorrect because an access policy blocks all access, which would prevent reading existing data. Option C is incorrect because a file policy applies DLP labels but does not control user sessions or enforce device restrictions.

Answer

Configure app governance in Defender for Cloud Apps to revoke the app's permissions.

Answer

Create an access policy in Defender for Cloud Apps that blocks all access to the app from unmanaged devices and blocks uploads from all devices.

Answer

Create a file policy in Defender for Cloud Apps that detects sensitive data and automatically applies a DLP label.

Question 5

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos authentication attempt from a domain controller. You need to determine if the account was compromised by checking for lateral movement. What should you do in the Microsoft 365 Defender portal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a playbook in Microsoft Defender XDR that triggers automated actions. The correct action is to create a playbook in Microsoft Defender XDR (option C) because playbooks can automate remediation actions such as soft-deleting a malicious email and blocking the sender's domain across the tenant. Option A is incorrect because attack simulation training is for educating users, not for remediation. Option B is incorrect because data loss prevention policies classify and protect data, not remediate already delivered emails. Option D is incorrect because Safe Links policies protect users from clicking malicious links but do not remediate emails already in the inbox.

Answer

Create an attack simulation training campaign for the affected user

Answer

Create a data loss prevention policy to classify the email as malicious

Answer

Configure a Safe Links policy to block the URL at click time

Question 6

Your organization has Microsoft Defender for Endpoint (Plan 2) and Microsoft Defender for Identity. A critical server is showing signs of a ransomware attack. You need to contain the threat while preserving forensic evidence for analysis. What should you do first?

Accepted Answer

Initiate an automated investigation in Microsoft Defender XDR. Initiating an automated investigation in Microsoft Defender XDR automatically contains the threat (e.g., by isolating the device) while collecting and preserving forensic evidence for analysis. Option A is wrong because a Live Response session is a manual, interactive process that allows collection of forensic data but does not contain the threat, and it could disrupt evidence if not performed carefully. Option B is wrong because isolating the server immediately contains the threat but may disrupt forensic evidence collection, as isolation stops processes and network traffic that might be needed for analysis. Option C is wrong because a full antivirus scan is reactive, does not contain the threat, and may take too long, potentially allowing the ransomware to spread or encrypt more data.

Answer

Run a Live Response session to collect forensic data

Answer

Isolate the server from the network immediately

Answer

Run a full antivirus scan on the server

Question 7

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos authentication attempt from a domain controller. You need to determine if the account was compromised by checking for lateral movement. What should you do in the Microsoft 365 Defender portal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 (A) is correct because it inspects email traffic and detonates URLs, so it would generate alerts for the user clicking the malicious link delivered via email (e.g., Safe Links detonation and phishing detections). Microsoft Defender for Cloud Apps (E) is correct because it provides CASB visibility and controls over cloud app usage, so it would surface the upload of sensitive data to an external cloud app via its app discovery, file policies, and anomaly detections. Microsoft Defender XDR incident correlation (B) is correct because it stitches together the email-based alert from Defender for Office 365 and the cloud-app alert from Defender for Cloud Apps into a single correlated incident, giving the unified timeline and insights needed to investigate the multi-stage attack. Microsoft Sentinel (C) is a SIEM/SOAR platform that can ingest Defender XDR data, but it is not one of the Defender XDR components that natively generates these alerts and correlated insights for this scenario. Microsoft Defender for Identity (D) monitors on-premises Active Directory signals such as lateral movement and credential theft, which are not the focus of an email link click followed by a cloud app upload, so it is not relevant here.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Identity

Question 8

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos authentication attempt from a domain controller. You need to determine if the account was compromised by checking for lateral movement. What should you do in the Microsoft 365 Defender portal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Response action in the detection rule. Custom detection rules in Microsoft Defender for Endpoint (Plan 2) are built on top of Advanced Hunting queries, so option E is required: the KQL query defines the process, network events (e.g., DeviceNetworkEvents), and logic that identifies when the specified process attempts internet access. Option B is also required because every custom detection rule must specify at least one response action (such as isolate device, run antivirus scan, restrict app execution, or collect investigation package) that Defender for Endpoint automatically executes when the rule fires. Option A is incorrect because attack surface reduction rules block or audit risky behaviors via ASR policy, not create custom alerting detections. Option C is incorrect because Microsoft Sentinel automation rules belong to Sentinel playbooks/orchestration and are not a component of a Defender for Endpoint custom detection. Option D is incorrect because an IOC is a threat-intelligence artifact (file hash, IP, URL, certificate) used for blocking or alerting, not the query-and-response construct that defines a custom detection.

Answer

Attack surface reduction rule

Answer

Microsoft Sentinel automation rule

Answer

Indicator of compromise (IOC)

Question 9

Your organization is a multinational company with 10,000 users. You use Microsoft Defender for Office 365 Plan 2, Microsoft Defender for Endpoint Plan 2, Microsoft Defender for Cloud Apps, and Microsoft Defender for Identity. Recently, a sophisticated phishing campaign targeted your executives. The campaign used personalized emails with malicious links that bypassed Safe Links protection. Several executives clicked the links and entered their credentials on a fake login page. The attackers then used those credentials to access the executives' mailboxes and exfiltrate sensitive data. You need to implement a solution that prevents similar attacks in the future by automatically blocking access to newly discovered phishing sites and providing real-time protection when users click unknown URLs. The solution should also allow you to simulate phishing campaigns to train users. What should you do?

Accepted Answer

Configure Attack Simulation Training in Microsoft 365 Defender, create a simulated phishing campaign targeting executives, and use the training to educate users on reporting phishing. Additionally, ensure Safe Links policy uses the 'Do not allow users to click through to the original URL' option and enable 'URL detonation' for unknown URLs.. The correct solution combines Attack Simulation Training to educate users and enhance Safe Links policies to block access to newly discovered phishing sites and provide real-time protection. Specifically, enabling 'Do not allow users to click through to the original URL' and 'URL detonation' ensures that even zero-day phishing URLs are detonated and blocked. Attack Simulation Training allows simulating phishing campaigns to train executives, addressing the human factor.

Answer

Create a Safe Links policy that blocks all URLs from domains not in the allowed list.

Answer

Deploy Safe Attachments policies with dynamic delivery and enable 'Automatic forwarding of attachments' for unknown files.

Answer

Add the known phishing domain to the Tenant Allow/Block List and block it.

Question 10

You are a security administrator for a company that uses Microsoft Defender XDR. You need to configure automated investigation and response (AIR) to automatically remediate threats. Which two actions should you take?

Accepted Answer

Configure action center settings to allow automatic remediation.. To enable automated investigation and response (AIR) in Microsoft Defender XDR, you must first enable the feature in the Microsoft Defender portal (option D), and then configure action center settings to allow automatic remediation (option C). Option A is incorrect because device groups are not required for AIR; they are used for device-specific policies. Option B is incorrect because the Security Administrator role should be assigned only to necessary users, not all users. Option E is incorrect because automation levels are set per policy, not globally.

Answer

Create a device group for automatic remediation.

Answer

Assign the Security Administrator role to all users.

Answer

Set the automation level to 'Full - remediate threats automatically' globally.

Question 11

You are investigating an alert in Microsoft Defender XDR that indicates a user clicked a malicious link in an email. You need to gather additional information to determine the scope of the attack. Which three sources should you examine?

Accepted Answer

Email entity page. The Email entity page (B) is correct because it provides the full email details, including sender, recipients, subject, attachments, and URLs, allowing you to trace the malicious link and identify all users who received the same message. The Alert timeline (C) is correct because it shows the sequence of events and related evidence associated with the alert, helping you understand how the attack unfolded and what other activities are linked to the same incident. The User entity page (E) is correct because it aggregates the user's related alerts, incidents, and activities, enabling you to determine whether the user's account was compromised or if other users were affected. The Incidents page (A) is not the best source here because it provides a high-level grouping of related alerts rather than the granular email, alert, and user details needed to scope this specific attack. The Device timeline (D) is not appropriate because the scenario centers on a phishing email click and user activity, not on device-level process or file events.

Answer

Incidents page

Answer

Device timeline

Question 12

You are configuring Microsoft Defender for Office 365 to protect against sophisticated phishing attacks. You need to ensure that users are warned about potentially malicious messages that bypass other filters. Which two policies should you configure?

Accepted Answer

Anti-phishing policy: Impersonation protection settings. To warn users about potentially malicious messages, you must configure anti-phishing policy settings for impersonation protection and spoof intelligence. Both are part of the anti-phishing policy. Since option D misnames the policy as anti-spam, it is not a correct choice. Only option E is correctly identified. The stem requests two policies, but as written, only one correct policy exists.

Answer

Safe Attachments policy

Answer

Safe Links policy

Answer

Anti-malware policy

Answer

Anti-spam policy: Spoof intelligence

Question 13

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos authentication attempt from a domain controller. You need to determine if the account was compromised by checking for lateral movement. What should you do in the Microsoft 365 Defender portal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Microsoft Defender XDR connector in Sentinel to receive alerts, and use the Threat Intelligence API to add indicators to Defender XDR.. The correct approach is to use the Microsoft Defender XDR connector in Microsoft Sentinel to stream alerts, and then use the Threat Intelligence API to push external indicators into Defender XDR so alerts are enriched before they reach Sentinel. This provides near-real-time enrichment with minimal latency and no custom code, leveraging native integrations.

Answer

Create a Logic App that runs on a schedule to pull alerts from Defender XDR, enrich them using external TI, and push to Sentinel.

Answer

Create an Azure Function that uses the Microsoft Graph API to get alerts, enrich them, and send to Sentinel.

Answer

Use the Microsoft Sentinel data connector for Microsoft Defender XDR and configure automatic enrichment in the data connector settings.

Question 14

You are a security administrator for a multinational company that uses Microsoft Defender XDR. You have deployed Microsoft Defender for Endpoint on all devices. The company has a strict policy that any device with a high-severity alert must be isolated from the network immediately. You need to configure an automated response that isolates the device as soon as a high-severity alert is generated. What should you do?

Accepted Answer

In Microsoft Defender XDR, navigate to Settings > Endpoints > Automated investigation and response, and configure the automation level for high-severity alerts to 'Full - remediate threats automatically'.. In Microsoft Defender XDR, you can configure automated investigation and response settings to automatically remediate threats. By setting the automation level to 'Full - remediate threats automatically' for high-severity alerts, the system will automatically isolate devices as part of the remediation actions. Option A is incorrect because enabling automatic investigation does not automatically trigger isolation; it only starts an investigation. Option B is incorrect because the Action Center is for manual actions, not automated response. Option C is incorrect because device groups and conditional access policies are not the mechanism for automatic isolation in Defender for Endpoint; that is handled by the automated investigation and response settings.

Answer

Enable 'Automatically investigate alerts' in the Microsoft Defender portal.

Answer

Use the Action Center to manually isolate devices as alerts come in.

Answer

Create a device group for high-severity alerts and configure a conditional access policy to block network access.

Question 15

Your company uses Microsoft Defender XDR and Microsoft 365 E5 licenses. You are the security administrator. The company's incident response team receives hundreds of low-severity alerts daily, causing alert fatigue. You need to reduce noise by automatically closing low-severity alerts that are determined to be false positives by Microsoft's threat intelligence. You want to minimize manual effort and ensure that only alerts with high confidence of being false positives are closed. What should you do?

Accepted Answer

Enable the built-in 'Automatic false positive suppression' feature in the Microsoft Defender XDR settings.. Microsoft Defender XDR includes a built-in 'Automatic false positive suppression' feature that uses Microsoft's threat intelligence to automatically close low-severity alerts determined to be false positives with high confidence, reducing noise without manual effort. Option B is incorrect because automated investigation and response rules are designed for taking actions on alerts based on criteria, but they do not leverage Microsoft's threat intelligence to determine false positives; they might close alerts that are not truly false positives. Option C is incorrect because using the API and PowerShell to close alerts requires significant manual effort to maintain a false positive list and does not use Microsoft's threat intelligence, and it may not be as reliable. Option D is incorrect because custom detection rules are used to create new alerts, not to suppress false positives; suppression rules (like tuning rules) require manual creation and maintenance.

Answer

Configure an automated investigation and response rule for low-severity alerts to automatically close them.

Answer

Use the Microsoft Defender XDR API to export alerts daily and run a PowerShell script to close low-severity alerts that match a known false positive list.

Answer

Create a custom detection rule that excludes low-severity alerts from known false positive indicators.