MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 8 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud Apps. You need to generate alerts when a user downloads a large number of files from Microsoft SharePoint Online in a short period. What should you create?

Accepted Answer

Activity policy. Option B is correct because Activity policies in Defender for Cloud Apps allow you to create custom rules to detect specific activities like mass download. Option A (Anomaly Detection) is for pre-built anomalies. Option C (Cloud Discovery) is for shadow IT. Option D (App Discovery) is for identifying apps.

Answer

App Discovery policy

Answer

Anomaly Detection policy

Answer

Cloud Discovery policy

Question 2

Which TWO actions can you perform using Microsoft Defender XDR's Advanced Hunting? (Choose two.)

Accepted Answer

Create custom detection rules based on query results.. Options A and C are correct. Advanced Hunting allows you to run KQL queries across data from various Defender products (A) and create custom detection rules based on query results (C). Option B (manage incident status) is done in the Incidents queue, not Advanced Hunting. Option D (configure data retention) is a tenant setting. Option E (deploy EDR sensors) is done via GPO or Intune.

Answer

Deploy EDR sensors to endpoints.

Answer

Configure data retention policies for logs.

Answer

Manage the status of incidents.

Question 3

Which THREE features are included in Microsoft Defender for Office 365 Plan 2 but NOT in Plan 1? (Choose three.)

Accepted Answer

Automated Investigation and Response (AIR). Options A, C, and D are correct. Plan 2 includes Threat Explorer (A), Automated Investigation and Response (C), and Attack Simulation Training (D). Option B (Safe Links) is included in Plan 1. Option E (Anti-phishing) is included in Plan 1.

Answer

Anti-phishing policies

Answer

Safe Links

Question 4

Which TWO Microsoft Defender XDR components provide protection for email and collaboration tools? (Choose two.)

Accepted Answer

Microsoft Defender for Office 365. Options B and D are correct. Microsoft Defender for Office 365 protects email and collaboration tools like SharePoint, OneDrive, and Teams. Microsoft Defender for Cloud Apps provides visibility and control over cloud apps including email and collaboration platforms. Option A (Defender for Endpoint) protects endpoints. Option C (Defender for Identity) protects on-premises Active Directory. Option E (Defender for Cloud) protects cloud workloads.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Endpoint

Question 5

You are analyzing a custom detection rule in Microsoft Defender XDR. The rule is designed to alert on suspicious PowerShell execution. However, you notice that the rule is not triggering alerts even though you know such activity is occurring. What is the most likely reason?

Accepted Answer

The query syntax is invalid; 'has_any' requires a dynamic array.. Option B is correct because the query uses 'has_any' with a list of strings, but the syntax is incorrect. 'has_any' expects a dynamic array, e.g., 'has_any (dynamic(["powershell.exe", "cmd.exe"]))'. The current query will cause a syntax error. Option A (no alerts in 7 days) would not explain if activity is known. Option C (severity too low) would still trigger alerts. Option D (custom detection not enabled) is possible but less likely given the syntax error.

Answer

The custom detection rule is not enabled.

Answer

The severity is set to Medium, which may be suppressed by other policies.

Answer

The rule only looks back 7 days, and the activity occurred more than 7 days ago.

Question 6

You run the above PowerShell command on a Windows 10 device that is onboarded to Microsoft Defender for Endpoint. The device is reporting as healthy in the portal, but you suspect that some behavioral detection capabilities are turned off. Based on the output, which setting should you modify?

Accepted Answer

Set DisableBehaviorMonitoring to False to enable behavior monitoring.. Option C is correct because DisableBehaviorMonitoring is set to True, which disables behavior monitoring. You should set it to False to enable behavior monitoring. Option A (real-time monitoring) is already enabled. Option B (Block at First Sight) is already enabled. Option D (cloud-delivered protection) is not shown but is separate.

Answer

Enable cloud-delivered protection by setting MAPSReporting to Advanced.

Answer

Set DisableBlockAtFirstSeen to True to enable Block at First Sight.

Answer

Set DisableRealtimeMonitoring to True to enable real-time monitoring.

Question 7

You run the above KQL query in Microsoft Defender XDR Advanced Hunting. The query returns no results. What is the most likely reason?

Accepted Answer

The column name SenderDomain does not exist in EmailEvents.. Option B is correct because the column name is 'SenderMailFromDomain' or 'SenderDomain' might not exist; the correct column in EmailEvents is 'SenderMailFromDomain'. Option A (no inbound emails blocked) is possible but less likely if the environment has filtering. Option C (time range too short) is not the issue. Option D (only outbound emails) would still show inbound if any.

Answer

The EmailDirection filter should be 'Outbound'.

Answer

No inbound emails were blocked in the last 30 days.

Answer

The time range should be 7 days instead of 30 days.

Question 8

A company's security team needs to investigate a suspicious email that was reported by a user. The email was not blocked by Exchange Online Protection (EOP) and was delivered to the user's inbox. The security team wants to use Microsoft Defender XDR to analyze the email and its attachments. Which feature should they use to submit the email for automated investigation?

Accepted Answer

Submissions. Option C is correct because Submissions in Microsoft 365 Defender allow security teams to submit emails, URLs, and attachments to Microsoft for analysis and automated investigation. Option A is wrong because Threat Explorer is used for investigating threats after they have been detected, not for manual submission. Option B is wrong because Attack Simulator is used for simulating phishing attacks. Option D is wrong because Advanced Hunting is a query-based tool for threat detection, not for submitting emails.

Answer

Advanced Hunting

Answer

Threat Explorer

Answer

Attack Simulator

Question 9

A security administrator needs to configure a policy that automatically blocks high-confidence phishing emails in Microsoft Defender for Office 365. The policy should be applied to all users in the finance department. The administrator wants to ensure that if an email is determined to be high-confidence phishing, it is quarantined and the user is not notified. Which type of policy should the administrator configure?

Accepted Answer

Anti-phishing policy. Option A is correct because Anti-phishing policies in Defender for Office 365 can be configured to take action on high-confidence phishing emails, such as quarantining them. Option B is wrong because Safe Links policies protect against malicious URLs, not the overall email classification. Option C is wrong because Safe Attachments policies handle malicious attachments. Option D is wrong because Anti-spam policies handle spam, not high-confidence phishing.

Answer

Safe Attachments policy

Answer

Anti-spam policy

Answer

Safe Links policy

Question 10

Refer to the exhibit. You are reviewing an anti-phishing policy configuration in Microsoft Defender for Office 365. The policy is applied to all users. A user reports that a legitimate email from a known vendor (domain contoso.com) was quarantined. The email contained a link to a rarely visited website. The link was not malicious. Which setting in the policy is most likely causing the false positive?

Accepted Answer

EnableSimilarDomainsSafetyTips: true. Option D is correct because EnableSimilarDomainsSafetyTips can cause false positives when a known domain is similar to a potentially dangerous domain. The vendor's domain contoso.com might be flagged as similar to a domain that is impersonated. Option A is wrong because PhishThresholdLevel set to 2 is the default and not restrictive. Option B is wrong because MailboxIntelligence uses machine learning to reduce false positives. Option C is wrong because EnableUnusualCharactersSafetyTips only flags unusual characters in the sender's name or domain, not a link.

Answer

EnableMailboxIntelligence: true

Answer

PhishThresholdLevel: 2

Answer

EnableUnusualCharactersSafetyTips: false

Question 11

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that alerts when a user downloads more than 10 files from SharePoint Online within 10 minutes. This activity should be considered anomalous. Which type of policy should you create?

Accepted Answer

Activity policy. Option B is correct because Activity policies in Defender for Cloud Apps can detect anomalous activities based on thresholds, such as multiple file downloads. Option A is wrong because App discovery policies are used to discover shadow IT. Option C is wrong because Cloud Discovery policies are for discovering cloud app usage. Option D is wrong because Session policies control sessions in real-time, not alert on historical activity.

Answer

Cloud Discovery policy

Answer

Session policy

Answer

App discovery policy

Question 12

Refer to the exhibit. You are analyzing a KQL query in Microsoft Defender XDR Advanced Hunting. The query returns a list of devices where PowerShell or cmd.exe with encoded commands executed more than 5 times in the last 7 days. The security team suspects that one of the devices is compromised due to excessive use of encoded commands. However, a legitimate administrative script uses encoded commands regularly. How can you refine the query to reduce false positives while still detecting potentially malicious activity?

Accepted Answer

Add a filter to exclude processes signed by a trusted certificate or running under specific service accounts.. Option A is correct because adding a filter to exclude known administrative accounts or processes that are approved would reduce false positives. Option B is wrong because changing the time range to 1 day might miss legitimate administrative activity but does not target the false positive source. Option C is wrong because looking for only powershell.exe would miss cmd.exe encoded commands. Option D is wrong because increasing the count threshold to 10 might still include the legitimate script if it runs frequently.

Answer

Increase the Count threshold to 10.

Answer

Remove cmd.exe from the FileName filter.

Answer

Change the time range to 1 day instead of 7 days.

Question 13

A company is implementing Microsoft Defender for Identity (MDI) to protect its on-premises Active Directory environment. The security team needs to ensure that MDI can monitor all domain controllers. They have installed the MDI sensor on all domain controllers. However, they notice that some suspicious activities are not being detected. Which additional configuration should the team verify to ensure comprehensive coverage?

Accepted Answer

Configure port mirroring or network tap to ensure the sensor can see all relevant network traffic.. Option C is correct because MDI requires port mirroring or a network tap to capture network traffic to and from domain controllers. Without proper network traffic configuration, some activities may not be detected. Option A is wrong because Event log collection is not required; MDI uses its own sensor. Option B is wrong because Azure AD Connect Health is not related to MDI. Option D is wrong because Defender for Cloud Apps integration is optional.

Answer

Integrate Microsoft Defender for Cloud Apps with MDI.

Answer

Install Azure AD Connect Health on domain controllers.

Answer

Enable auditing on domain controllers and forward logs to Microsoft Sentinel.

Question 14

Your organization uses Microsoft Defender for Endpoint (MDE). A security analyst needs to investigate a file that was detected as malicious on several devices. The analyst wants to see the file's prevalence across the organization and other related events. Which feature in MDE should the analyst use?

Accepted Answer

File page. Option B is correct because the File page in MDE provides details about the file, including prevalence, device list, and related events. Option A is wrong because the Device page focuses on a specific device. Option C is wrong because the Alert page focuses on alerts. Option D is wrong because the Investigation page is for automated investigations.

Answer

Alert page

Answer

Device page

Answer

Investigation page

Question 15

A company is planning to deploy Microsoft Defender for Endpoint to its Windows 10 devices. The devices are managed by Microsoft Intune. The security team wants to ensure that the MDE sensor is installed automatically on new devices that are enrolled in Intune. Which method should the team use?

Accepted Answer

Create an Endpoint security policy in Intune to deploy MDE.. Option A is correct because Intune can push the MDE sensor as a 'Microsoft Defender for Endpoint' profile under Endpoint security. Option B is wrong because Group Policy is not used in a cloud-only Intune environment. Option C is wrong because Configuration Manager is on-premises and not needed. Option D is wrong because manual installation is not automatic.

Answer

Manually install MDE on each device.

Answer

Use Group Policy to deploy the MDE installation package.

Answer

Deploy MDE using Microsoft Configuration Manager.