MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 8 — 15 Questions

Question 1

Your company uses Microsoft Defender XDR and Microsoft Defender for Identity. You have detected that a domain controller is communicating with a known malicious IP address. You need to immediately contain the threat by isolating the domain controller from the network while preserving forensic data. However, you cannot afford downtime for authentication services. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In Microsoft Defender for Identity, configure a network protection policy to block communication to the malicious IP.. Microsoft Defender for Identity's network protection policies can block communication to specific malicious IP addresses without isolating the entire domain controller, thereby containing the threat while preserving authentication services. Option A is incorrect because conditional access policies apply to users and devices, not domain controllers. Option B is incorrect because isolating the domain controller with Microsoft Defender for Endpoint would block all network traffic, causing authentication downtime. Option D is incorrect because blocking at the firewall may not be immediate and could inadvertently affect legitimate traffic.

Answer

Create a conditional access policy to block the domain controller.

Answer

Use Microsoft Defender for Endpoint to isolate the domain controller.

Answer

Block the IP address at the network firewall.

Question 2

You are a security administrator for a company that uses Microsoft 365 E5 and Microsoft Defender XDR. During an investigation of a compromised user account, you need to identify all devices where the user signed in and any subsequent suspicious processes that ran. You plan to use the advanced hunting feature in Microsoft Defender XDR. Which table should you query to find sign-in events across all workloads and correlate them with device process events?

Accepted Answer

AADSignInEventsBeta. The AADSignInEventsBeta table in Microsoft Defender XDR advanced hunting provides comprehensive Microsoft Entra ID sign-in logs, including interactive and non-interactive sign-ins across all cloud apps. This allows you to see all sign-ins for the compromised user and then join with device tables like DeviceProcessEvents to identify suspicious processes. The other tables either focus on endpoint logons or lack cloud sign-in data, so they cannot provide the complete correlation required.

Answer

IdentityLogonEvents

Answer

DeviceLogonEvents

Answer

DeviceEvents

Question 3

You are a security administrator for a company that uses Microsoft Defender XDR. A security analyst wants to automatically isolate a device that is flagged with a high-severity alert in Microsoft Defender for Endpoint. The analyst needs the isolation to occur without manual intervention. What should you configure?

Accepted Answer

Configure an automated investigation and response (AIR) playbook in Microsoft Defender for Endpoint to isolate the device when a high-severity alert occurs.. Automated investigation and response (AIR) playbooks in Microsoft Defender for Endpoint are designed to automatically execute response actions like device isolation when triggered by alerts. This provides the no-touch automation the analyst needs. Custom detections and Defender for Office 365 settings do not directly isolate devices, and introducing Microsoft Sentinel is unnecessary for a native Defender XDR solution.

Answer

Create a custom detection rule in Microsoft Defender XDR that runs a KQL query and triggers an automated investigation.

Answer

Set up a Microsoft Sentinel playbook that calls the Microsoft Graph API to isolate the device upon receiving an alert.

Answer

Enable the 'Automated investigation' setting in Microsoft Defender for Office 365 to isolate the device when a high-severity alert occurs.

Question 4

You are a security administrator for a company that uses Microsoft Defender XDR. You need to configure automatic investigation and remediation for a specific set of alerts. You want to exclude a particular user account from automatic remediation actions. Where should you configure this exclusion?

Accepted Answer

In the Microsoft 365 Defender portal, under Settings > Identities > Automated investigation and remediation > User exclusions. Excluding a user from automatic remediation is configured under Settings > Identities > Automated investigation and remediation > User exclusions. This ensures that the specified account is not subject to automated actions like disabling or forcing password reset, which is crucial for service accounts or high-risk users.

Answer

In the Microsoft 365 Defender portal, under Settings > Endpoints > Advanced features

Answer

In the Microsoft 365 Defender portal, under Settings > Endpoints > Automated investigation and remediation > User exclusions

Answer

In the Microsoft 365 Defender portal, under Settings > Email & collaboration > User reported settings

Question 5

You are a security administrator for a company that uses Microsoft Defender XDR. You need to assign a role to a new security analyst that allows them to manage incidents, run advanced hunting queries, and configure custom detections, but should not be able to modify security settings. Which Microsoft Defender XDR role should you assign?

Accepted Answer

Security Operator. The Security Operator role provides the necessary permissions to manage incidents, run advanced hunting queries, and configure custom detections, while explicitly excluding the ability to modify security settings. This role is ideal for security analysts who need operational capabilities without administrative privileges.

Answer

Security Reader

Answer

Security Administrator

Answer

Global Administrator

Question 6

You are a Microsoft 365 administrator for Contoso, Ltd. A security analyst reports that several users received phishing emails that bypassed the default protection in Microsoft Defender for Office 365. The analyst wants the ability to replay the delivered messages against the current policies and, if they are found to be malicious, automatically move them out of user mailboxes. The analyst is a member of the Security Reader role group. You need to identify what the analyst must have to perform this task. What should you do?

Accepted Answer

Assign the analyst the Security Operator role in the Microsoft 365 Defender portal.. Threat Explorer investigation and the ability to replay messages against current policies and purge delivered phishing mail require action permissions provided by the Security Operator role group. Security Reader is read-only, so the analyst cannot remediate. Security Operator is the least-privilege built-in role that enables soft delete and hard delete remediation while avoiding unnecessary configuration rights.

Answer

Assign the analyst the Security Administrator role in the Microsoft 365 Defender portal.

Answer

Assign the analyst the eDiscovery Manager role in the Microsoft 365 Defender portal.

Answer

Assign the analyst the Global Reader role in the Microsoft 365 Defender portal.

Question 7

You are a security administrator for a company that uses Microsoft Defender XDR. You need to configure a policy to automatically block files that are detected as malicious by Microsoft Defender for Endpoint. The policy should apply to all devices in the organization. Which policy type should you configure in the Microsoft 365 Defender portal?

Accepted Answer

Antivirus policy. An antivirus policy in Microsoft Defender for Endpoint is designed to manage antivirus settings across devices, including the action to take when malware is detected. Configuring this policy ensures that detected malicious files are automatically blocked on all devices, meeting the requirement.

Answer

Automated investigation and response

Answer

Indicators

Answer

Attack surface reduction rules

Question 8

You are a Microsoft 365 administrator for a company that uses Microsoft Defender XDR. A security analyst reports that a device named WKS-042 is repeatedly showing up in incidents with low severity, and the analyst wants to suppress future alerts from this device for the next 30 days while it is being reimaged. You need to configure Microsoft Defender for Endpoint to automatically suppress alerts from this device without affecting other devices. What should you do?

Accepted Answer

Create an alert suppression rule in Microsoft Defender for Endpoint that filters by device name WKS-042 and set the suppression duration to 30 days.. Alert suppression rules in Microsoft Defender for Endpoint are designed to reduce alert noise by suppressing alerts that match specified conditions, such as a device name, for a defined period. This is the correct approach to temporarily suppress alerts for a single device during maintenance or reimaging without affecting other devices or broader security monitoring.

Answer

Create an indicator in Microsoft Defender for Endpoint for the device name WKS-042 and set the action to Allow.

Answer

Configure a custom detection rule in Microsoft Defender XDR that excludes WKS-042 from all incidents.

Answer

Modify the device group for WKS-042 and set the automation level to No automated response.

Question 9

You are a Microsoft 365 administrator for Contoso, Ltd. The security team wants to be alerted whenever a user's Azure AD account is added to a privileged role such as Global Administrator. You need to configure Microsoft Defender XDR to generate an alert for this activity. What should you do?

Accepted Answer

Configure an alert policy in Microsoft Defender XDR that uses the 'Privileged role assignment' activity type from the Microsoft Entra ID audit log.. Microsoft Defender XDR provides built-in alert policies that surface activities from connected Microsoft services, including Microsoft Entra ID. The 'Privileged role assignment' activity type is designed to detect when an account is granted a privileged role. Using this native capability is the most direct and appropriate way to meet the security team's requirement.

Answer

Enable and configure the 'Privileged account' alert policy in Microsoft Defender for Identity.

Answer

Create a custom detection rule in Microsoft Defender XDR that queries the IdentityLogonEvents table for role assignments.

Answer

Create a Microsoft Sentinel analytics rule that ingests the Azure AD audit log and forwards alerts to Microsoft Defender XDR.

Question 10

You are a security administrator for a company that uses Microsoft Defender XDR. You need to configure Microsoft Defender for Cloud Apps to detect and respond to risky user activities across sanctioned and unsanctioned cloud apps. You must ensure that alerts are generated for suspicious file sharing and that users are automatically suspended when a high-severity alert is triggered. Which two actions should you perform? (Choose two.)

Accepted Answer

Create an activity policy in Microsoft Defender for Cloud Apps that triggers on suspicious file sharing events and set the governance action to Suspend user.. To detect risky activities and automatically suspend users, you need to connect apps via API connectors so that Defender for Cloud Apps can monitor activities, and then create an activity policy that triggers on suspicious file sharing and includes the Suspend user governance action. Together, these provide both detection and automated response.

Answer

Configure a session policy in Microsoft Defender for Cloud Apps to block file downloads from unsanctioned apps.

Answer

Configure a file policy in Microsoft Defender for Cloud Apps to detect files with sensitive content and apply a governance action to remove sharing.

Answer

Create an anomaly detection policy in Microsoft Defender for Cloud Apps and enable automatic user suspension.

Question 11

You are a security administrator for Fabrikam, Inc. You use Microsoft Defender XDR. You need to configure a custom detection rule that will run every hour and alert when a suspicious PowerShell command is executed on any device. The rule must also automatically isolate the device. Which two actions should you perform? (Choose two.)

Accepted Answer

Create an advanced hunting query that returns the DeviceId of devices where a suspicious PowerShell command was executed.. To create a custom detection rule that runs hourly and isolates a device upon detecting a suspicious PowerShell command, you must first build an advanced hunting query that identifies the devices by DeviceId. Then, in the custom detection rule wizard, you set the frequency to hourly and specify the 'Isolate device' action. These two steps together provide the required detection and automated response.

Answer

Configure a device group in Microsoft Defender for Endpoint and set the remediation level to 'Full - remediate threats automatically'.

Answer

Create a Microsoft Sentinel analytics rule that triggers on the suspicious PowerShell event and calls a playbook to isolate the device.

Answer

Enable the 'Automated investigation' setting in Microsoft Defender for Endpoint to automatically isolate devices with suspicious PowerShell activity.

Question 12

You are a security administrator for Fabrikam, Inc. The company uses Microsoft 365 E5 and Microsoft Defender XDR. You need to configure automated investigation and response (AIR) so that when a high-severity alert is raised for a compromised user account, the account is automatically disabled. You want to minimize manual intervention. What should you do?

Accepted Answer

Use a playbook in Microsoft Sentinel that is triggered by the Microsoft Defender XDR incident and includes a step to disable the user account via Microsoft Graph API.. To automatically disable a user account in response to a Microsoft Defender XDR alert, you need an orchestration mechanism that can call the Microsoft Graph API. Microsoft Sentinel playbooks are triggered by incidents and can execute such actions. Custom detection rules and built-in automatic remediation do not support disabling user accounts directly. Conditional access blocks sign-in but does not disable the account. Therefore, the Sentinel playbook approach is the only one that achieves the required automation.

Answer

Configure a conditional access policy that blocks sign-in for users with a risk level of 'High' as determined by Microsoft Entra ID Protection.

Answer

In Microsoft Defender XDR settings, enable 'Automatic remediation' for identity alerts and configure the action to disable the user account.

Answer

Create a custom detection rule in Microsoft Defender XDR that triggers on the alert, and configure an automated response action to disable the user account.

Question 13

You are a Microsoft 365 administrator for Adatum Corporation. You have Microsoft Defender XDR deployed. You need to ensure that when a high-severity alert is generated in Microsoft Defender for Office 365, an incident is automatically created in Microsoft Defender XDR and assigned to the security operations team. What should you configure?

Accepted Answer

In Microsoft Defender XDR, create an incident assignment rule that assigns incidents with high severity to the security operations team.. Microsoft Defender XDR automatically correlates alerts from various services into incidents. To assign these incidents automatically, you use incident assignment rules. These rules can evaluate conditions like severity and assign the incident to a specific user or group. Configuring such a rule for high-severity incidents and targeting the security operations team fulfills the requirement.

Answer

In Microsoft Defender for Office 365, configure an alert policy to send email notifications to the security operations team.

Answer

In Microsoft Defender XDR, enable the 'Automatic incident creation' setting and specify the security operations team as the owner.

Answer

In Microsoft 365 Defender, create a custom detection rule that triggers on high-severity alerts and assigns the incident to the security operations team.

Question 14

You are a Microsoft 365 administrator for Adventure Works. The company uses Microsoft Defender for Office 365. A user reports receiving a phishing email that contains a malicious URL. You need to investigate the URL and determine its reputation and any associated alerts. Which Microsoft Defender XDR feature should you use?

Accepted Answer

URL reputation page in Microsoft Defender XDR. To investigate a specific URL's reputation and find associated alerts, the URL reputation page in Microsoft Defender XDR is the correct tool. It aggregates data from multiple sources and provides a verdict, along with any incidents where the URL appears. Other options like Explorer or URL detonation are used for different purposes: Explorer for email investigation and remediation, and URL detonation as an automated analysis during mail flow. The URL reputation page is specifically designed for manual URL investigation.

Answer

Threat Explorer's URL view

Answer

URL detonation

Answer

Explorer (Threat Explorer)

Question 15

A security administrator needs a single console to investigate and respond to a complex incident involving alerts from endpoints, email, and identities. Which Microsoft portal should they use?

Accepted Answer

Microsoft 365 Defender portal. The Microsoft 365 Defender portal (security.microsoft.com) is the correct choice because it provides a unified incident management console that correlates alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. This allows the security administrator to investigate and respond to a complex incident spanning endpoints, email, and identities from a single pane of glass, leveraging automated investigation and response (AIR) capabilities.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Answer

Microsoft 365 compliance center