MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 8 — 15 Questions

Question 1

A security analyst runs the above KQL query in Microsoft 365 Defender. The query returns an empty result set. Which is the most likely reason?

Accepted Answer

No antivirus detection events for files with 'ransomware' or 'encrypt' in the filename occurred in the last 7 days.. The query uses 'has_any' to match filenames containing 'ransomware' or 'encrypt'. If no detections match those strings, the result is empty. Option B is correct. Option A is wrong because the query uses the correct table. Option C is wrong because the syntax is valid. Option D is wrong because the time range is 7 days, which is typical.

Answer

The time range is too wide and the query times out.

Answer

The 'has_any' operator is used incorrectly; it should be 'contains' for each condition.

Answer

The DeviceEvents table does not contain antivirus detection events.

Question 2

A tenant administrator runs the above PowerShell command to create a Conditional Access policy. Users on iOS and Android devices report that they are still prompted for MFA, but the policy is intended to exclude those platforms. What is the issue?

Accepted Answer

The ExcludePlatforms parameter is placed incorrectly in the JSON body; it should be under conditions.platforms.excludePlatforms.. The 'ExcludePlatforms' property is used to exclude platforms from the policy. However, in the New-MgIdentityConditionalAccessPolicy cmdlet, the correct property name in the body should be 'conditions' > 'platforms' > 'excludePlatforms'. The exhibit's structure is incorrect; the 'ExcludePlatforms' at the top level is ignored. Therefore, the policy applies to all platforms, including iOS and Android. Option D is correct because the ExcludePlatforms parameter is placed incorrectly in the JSON body; it should be under conditions.platforms.excludePlatforms. Options A, B, and C are incorrect: A is wrong because the policy does apply to iOS and Android due to the misplacement; B is wrong because the policy is successfully created; C is wrong because MFA is enforced as intended for other platforms, but the issue is about the exclusion not working.

Answer

The policy does not apply to iOS and Android because they are not listed in IncludeApplications.

Answer

The policy creation failed due to invalid syntax.

Answer

The policy requires MFA for all apps, overriding the platform exclusion.

Question 3

A security administrator wants to review email messages that were blocked due to a malware detection in Microsoft Defender for Office 365. Which report should they use?

Accepted Answer

Threat Protection Status report. The Threat Protection Status report displays malware detections in email messages. Option D is correct. Option A is incorrect because the Submissions report shows user-reported submissions (admin or user submissions). Option B is incorrect because the Spoof intelligence report shows spoofed senders. Option C is incorrect because the Mailflow map report shows message routing.

Answer

Submissions report

Answer

Spoof intelligence report

Answer

Mailflow map report

Question 4

A company uses Microsoft Defender for Cloud Apps to monitor cloud app usage. They want to receive alerts when a user downloads a large number of files from SharePoint Online in a short time, which could indicate data exfiltration. What should they configure?

Accepted Answer

Activity policy. (Activity policy) is correct because activity policies allow you to monitor specific activities like mass download from SharePoint Online and trigger alerts. Option A (Session policy) is used to control access in real-time, not for alerting on historical activity. Option B (Anomaly detection policy) detects unusual user behavior but is less specific to a defined threshold of file downloads. Option C (File policy) focuses on file sharing and external sharing policies, not download volume. Therefore, an activity policy is the best choice for configuring alerts on large file downloads indicating data exfiltration.

Answer

Session policy

Answer

Anomaly detection policy

Answer

File policy

Question 5

An organization uses Microsoft Defender for Endpoint and wants to allow only certain applications to run on managed devices. They create a custom indicator (IoA) to allow a specific application by its certificate thumbprint. However, after deployment, the application is still blocked by default Windows Defender Application Control (WDAC) policy. What is the most likely reason?

Accepted Answer

The WDAC policy is in enforce mode and does not trust the indicator.. Custom indicators for allow are not automatically trusted by Windows Defender Application Control (WDAC). When WDAC is in enforce mode, it only allows binaries that are signed by trusted publishers or have a valid signature as per its policy. By default, WDAC does not trust indicators from Defender for Endpoint; you must either configure WDAC to allow the indicator or switch WDAC to audit mode. Option C correctly identifies that the WDAC policy is in enforce mode and does not trust the indicator. Option A is incorrect because propagation delay would not cause a permanent block; the indicator would eventually become active. Option B is incorrect because a certificate thumbprint is a valid indicator type. Option D is incorrect because custom indicators can override WDAC policies if WDAC is configured to trust them.

Answer

The indicator is not yet active due to propagation delay.

Answer

The certificate thumbprint is incorrect.

Answer

Custom indicators cannot override WDAC policies.

Question 6

A company wants to use Microsoft Defender XDR to automatically investigate and remediate threats across email, endpoints, and identities. Which role is required to configure automation settings in the Microsoft 365 Defender portal?

Accepted Answer

Security Administrator. The Security Administrator role (Option C) is required to configure automation settings in the Microsoft 365 Defender portal. Global Reader (Option A) has read-only access, Compliance Administrator (Option B) is focused on compliance policies, and Security Reader (Option D) also has read-only access. Therefore, only the Security Administrator role has the necessary permissions.

Answer

Global Reader

Answer

Compliance Administrator

Answer

Security Reader

Question 7

A company uses Microsoft Defender for Office 365. They want to ensure that users cannot ignore warning messages when clicking on a malicious link in an email. What should they configure?

Accepted Answer

Configure a Safe Links policy with 'Do not allow users to click through to original URL' selected.. Safe Links policies with the setting 'Do not allow users to click through to original URL' ensures users cannot bypass the warning and proceed to a malicious link. Option A is incorrect because impersonation protection in anti-phishing policies deals with impersonated senders, not link click-through behavior. Option C is incorrect because anti-malware policies focus on malware detection, not link safety. Option D is incorrect because Safe Attachments policies handle email attachments, not links.

Answer

Configure the anti-phishing policy with 'Impersonation protection' enabled.

Answer

Enable the 'Anti-malware' policy with 'Common attachments filter'.

Answer

Configure a Safe Attachments policy with 'Block' action.

Question 8

Contoso has a hybrid identity environment with Microsoft Defender for Identity deployed. They suspect a compromised account is being used to perform reconnaissance against domain controllers. Which Defender for Identity alert type would most likely trigger?

Accepted Answer

Suspicious service creation. Reconnaissance attacks against domain controllers are often detected by 'Suspicious service creation' alerts in Defender for Identity, as attackers may create services to move laterally or gather information. Option B is correct. Option A (Brute Force attack) is for password guessing, not reconnaissance. Option C (DCSync attack) is for credential dumping. Option D (Golden Ticket activity) is for persistence.

Answer

Brute Force attack

Answer

DCSync attack

Answer

Golden Ticket activity

Question 9

You are a security administrator for a Microsoft 365 E5 organization. You need to configure a policy that automatically blocks execution of files that have a low reputation score in Microsoft Defender for Endpoint. Which policy type should you configure?

Accepted Answer

Attack surface reduction rule in Microsoft Defender for Endpoint. Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint can be configured to block execution of files with low reputation, based on Microsoft's threat intelligence. Option B (Device control policy in Intune) manages peripheral device restrictions, not file execution. Option C (Anti-malware policy in Exchange Online Protection) focuses on email and attachment scanning, not endpoint file execution. Option D (Cloud App Security policy) governs cloud application usage, not local file execution. Therefore, the correct policy type is an Attack Surface Reduction rule.

Answer

Device control policy in Microsoft Intune

Answer

Anti-malware policy in Exchange Online Protection

Answer

Cloud App Security policy in Microsoft Defender for Cloud Apps

Question 10

Your organization uses Microsoft 365 Defender. You need to ensure that when a user reports a phishing email via the Report Message add-in, the email is automatically submitted to Microsoft for analysis and the user is notified of the analysis result. What should you configure?

Accepted Answer

Configure User Reported Settings in the Microsoft 365 Defender portal. User Reported Settings allow automatic submission and user notification. Option A is incorrect because mail flow rules for forwarding are for admin submissions, not automatic user notification. Option C is incorrect because creating a submission policy does not configure the automatic submission and notification for user-reported messages; that is done in User Reported Settings. Option D is incorrect because enabling ATP for SharePoint, OneDrive, and Teams is unrelated to email reporting and is deprecated for this purpose.

Answer

Configure a mail flow rule to forward reported messages to Microsoft

Answer

Create a submission policy in the Microsoft 365 Defender portal

Answer

Enable Advanced Threat Protection (ATP) for SharePoint, OneDrive, and Teams

Question 11

You are investigating an incident in Microsoft 365 Defender. The incident involves a user who received a malicious link in an email and clicked it. The link led to a credential phishing page. You need to identify which user accounts might have been compromised. Which Microsoft 365 Defender feature should you use?

Accepted Answer

Investigation package. The investigation package provides a comprehensive set of evidence collected during automated investigation, including details about user actions like clicking a malicious link, which helps identify potentially compromised accounts. Option A is wrong because Live Response is used for real-time remote device access, not for reviewing evidence of compromise. Option C is wrong because file investigation focuses on analyzing specific files, not user account compromises. Option D is wrong because Action center is for managing remediation actions, not for viewing evidence of compromised accounts.

Answer

Live Response

Answer

File investigation

Answer

Action center

Question 12

Your organization uses Microsoft Defender for Office 365. You need to ensure that all email messages containing encrypted attachments are automatically scanned for malware before delivery. What should you configure?

Accepted Answer

Safe Attachments policy with Dynamic Delivery enabled. Safe Attachments policy can be configured to scan encrypted attachments. Option B is wrong because it is for scanning URLs in emails. Option C is wrong because the anti-malware policy handles malware detection but does not specifically address encrypted attachments. Option D is wrong because the anti-spam policy is designed to filter spam, not to scan attachments for malware.

Answer

Safe Links policy with URL scanning

Answer

Anti-malware policy

Answer

Anti-spam policy

Question 13

You are a security administrator. You need to configure a policy that automatically blocks sign-ins from anonymous IP addresses for all users in your Microsoft 365 tenant. Which policy should you configure in Microsoft Entra ID?

Accepted Answer

Conditional Access policy with sign-in risk condition. A Conditional Access policy with the sign-in risk condition can block sign-ins from anonymous IP addresses, as detected by Identity Protection. Option A is incorrect because Password protection policy is used to prevent weak passwords, not to block anonymous IP sign-ins. Option B is incorrect because a Conditional Access policy with user risk condition targets users with compromised credentials, not sign-in risk from anonymous IPs. Option D is incorrect because Identity Protection user risk policy handles user risk (e.g., leaked credentials), not sign-in risk.

Answer

Password protection policy

Answer

Conditional Access policy with user risk condition

Answer

Identity Protection user risk policy

Question 14

Your organization uses Microsoft Defender for Cloud Apps. You discover that a user is accessing sensitive data from an unmanaged device. You need to automatically restrict the user's access to sensitive data until the device is compliant. What should you configure?

Accepted Answer

Create a session policy that monitors and controls access to sensitive data. A session policy in Microsoft Defender for Cloud Apps can monitor and control access in real time. You can configure it to block or restrict access to sensitive data from unmanaged devices until the device becomes compliant. Option B is incorrect because Conditional Access App Control policies are used for broader conditional access scenarios, not specifically for device compliance monitoring at the app level. Option C is incorrect because anomaly detection policies are designed to detect suspicious activities, not to restrict access based on device compliance. Option D is incorrect because app discovery policies are used to discover and analyze cloud app usage, not to control access.

Answer

Create a Conditional Access App Control policy for all apps

Answer

Create an anomaly detection policy

Answer

Create an app discovery policy

Question 15

You are configuring Microsoft Defender for Identity to monitor on-premises Active Directory. You need to ensure that honeytoken accounts are configured to detect attackers attempting to use them. What is a honeytoken account?

Accepted Answer

A fake user account created to attract attackers. A honeytoken account is a fake user account created to lure attackers. When an attacker tries to use it, Defender for Identity triggers an alert. Option A is incorrect because honeytoken accounts are not real service accounts. Option B is incorrect because they are not necessarily disabled; they can be enabled but with no real privileges. Option D is incorrect because they are not real high-privilege accounts, but fake decoys.

Answer

A service account used for application authentication

Answer

A disabled user account that cannot be used for sign-in

Answer

A real user account with high privileges used for monitoring