MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 9 — 15 Questions

Question 1

A security administrator is configuring Microsoft Defender for Office 365 to protect against zero-day malware in attachments. The administrator wants to use dynamic delivery so that users can view the email body while the attachment is being analyzed. However, the administrator is concerned about false positives and wants to ensure that if a benign attachment is later found to be malicious, it is removed from the user's inbox. What should the administrator configure?

Accepted Answer

Configure a Safe Attachments policy with dynamic delivery and enable ZAP.. Option D is correct because Safe Attachments policies with dynamic delivery can be set to allow email body delivery while the attachment is scanned, and if later found malicious, the attachment can be removed using the 'Zero-hour auto purge' (ZAP) feature. Option A is wrong because Anti-phishing policies do not handle attachments. Option B is wrong because Safe Links policies handle URLs, not attachments. Option C is wrong because Anti-malware policies do not provide dynamic delivery.

Answer

Configure a Safe Links policy with URL detonation.

Answer

Configure an anti-phishing policy with mailbox intelligence.

Answer

Configure an anti-malware policy with common attachments filter.

Question 2

A security administrator is configuring Microsoft Defender for Cloud Apps to protect against data exfiltration from SaaS apps. The administrator wants to create a policy that alerts when a user attempts to download more than 50 files from SharePoint Online within 5 minutes. Which two components must be configured to achieve this? (Choose two.)

Accepted Answer

Activity policy. Options A and D are correct. An activity policy is needed to define the threshold (50 files in 5 minutes). The app connector for SharePoint Online must be enabled to allow Defender for Cloud Apps to monitor SharePoint activity. Option B is wrong because a session policy is used for real-time control, not for alerting. Option C is wrong because Conditional Access App Control is for controlling access, not alerting. Option E is wrong because a file policy is for file sharing, not downloads.

Answer

File policy

Answer

Session policy

Answer

Conditional Access App Control

Question 3

A security team is investigating a potential ransomware outbreak using Microsoft Defender XDR. They have identified a suspicious PowerShell command that was executed on several devices. The team wants to use Advanced Hunting to find all other activities associated with the same command. Which three columns should they include in their KQL query to effectively correlate the activities? (Choose three.)

Accepted Answer

SHA256. Options A, D, and E are correct. DeviceId uniquely identifies the device. ProcessId identifies the process. SHA256 identifies the file. These three columns can be used to correlate activities across devices and processes. Option B is wrong because AccountUpn may change. Option C is wrong because Timestamp is not unique.

Answer

AccountUpn

Answer

Timestamp

Question 4

A company is deploying Microsoft Defender for Office 365 to protect against advanced threats. Which two features are available only in Defender for Office 365 Plan 2 and not in Plan 1? (Choose two.)

Accepted Answer

Automated Investigation & Response. Options C and D are correct. Threat Explorer and Automated Investigation & Response (AIR) are only available in Plan 2. Option A is wrong because Safe Attachments is available in both plans. Option B is wrong because Anti-phishing is available in both plans. Option E is wrong because Safe Links is available in both plans.

Answer

Anti-phishing

Answer

Safe Attachments

Answer

Safe Links

Question 5

A security administrator is configuring Microsoft Defender for Endpoint (MDE) to automatically remediate threats. The administrator wants to ensure that when a high-severity alert is triggered, the affected device is isolated from the network. Which three components must be configured to achieve this? (Choose three.)

Accepted Answer

Alert severity. Options B, C, and D are correct. Automation levels define the response action. Device isolation is an action that can be automated. Alert severity sets the trigger. Option A is wrong because indicator of compromise (IoC) is for blocking, not automation. Option E is wrong because a tag is for grouping, not automation.

Answer

Device tag

Answer

Indicator of compromise (IoC)

Question 6

Your organization uses Microsoft Defender for Cloud Apps. You need to be alerted when a user accesses a cloud app from an anonymous IP address. Which type of policy should you create?

Accepted Answer

Activity policy. Option B is correct because an activity policy can detect access from anonymous IP addresses. Option A is wrong because an app discovery policy is for discovering shadow IT. Option C is wrong because a session policy controls sessions. Option D is wrong because a file policy monitors file sharing.

Answer

Session policy

Answer

File policy

Answer

App discovery policy

Question 7

A company is using Microsoft Defender for Identity (MDI) and wants to receive alerts when a user account is involved in a suspicious network connection. The security team has enabled MDI alerts but is not receiving any alerts for a specific account that is showing anomalous behavior. What should the team check first?

Accepted Answer

Ensure the user's email address is configured in the MDI alert settings.. Option C is correct because MDI needs to be configured with the user's email address for alerts to be sent. If the email is missing or incorrect, alerts will not be delivered. Option A is wrong because the sensor status would affect all accounts, not just one. Option B is wrong because licensing is per user. Option D is wrong because directory data is not required for alerts.

Answer

Verify that the MDI sensor is running correctly on the domain controller.

Answer

Check that the user has an appropriate Microsoft 365 license.

Answer

Confirm that the user's Active Directory attributes are synced to Azure AD.

Question 8

Your organization uses Microsoft Defender for Office 365 and Microsoft Defender for Endpoint. You need to ensure that when a user reports a phishing email via the Microsoft Report Message add-in, the URL in the email is automatically blocked on all endpoints. What should you configure?

Accepted Answer

Configure the Tenant Allow/Block List for URLs in the Microsoft 365 Defender portal.. Option C is correct because Defender for Office 365 can automatically block URLs reported as phishing in the tenant's block list, which Defender for Endpoint respects. Option A is wrong because Safe Links applies protection on email but not automatically block on endpoints. Option B is wrong because it's part of Defender for Office 365 but doesn't block on endpoints. Option D is wrong because it's for endpoint detection response, not automatic blocking based on user reports.

Answer

Configure Safe Links policies to block the URL.

Answer

Configure an automated investigation and response (AIR) playbook in Microsoft 365 Defender.

Answer

Configure anti-phishing policies in Defender for Office 365.

Question 9

Your organization has deployed Microsoft Defender for Cloud Apps. You need to ensure that all external file sharing to untrusted domains is automatically blocked. The solution must not affect internal sharing. What should you configure?

Accepted Answer

Create a file policy in Microsoft Defender for Cloud Apps with a governance action to remove external users.. Option A is correct because file policies in Defender for Cloud Apps can detect and automatically block sharing to untrusted domains. Option B is wrong because session policies control real-time access but do not automatically block file sharing. Option C is wrong because access policies control access conditions but not file sharing actions. Option D is wrong because app connectors provide visibility but do not enforce automatic blocking of file sharing.

Answer

Create an access policy in Microsoft Defender for Cloud Apps to block access from untrusted domains.

Answer

Configure an app connector for the cloud app to enforce DLP policies.

Answer

Create a session policy in Microsoft Defender for Cloud Apps to monitor external sharing.

Question 10

You need to configure Microsoft Defender for Identity to alert when a user account is assigned a high number of group memberships in Active Directory. Which attack type does this correspond to?

Accepted Answer

Golden Ticket attack. Option D is correct because Golden Ticket attacks often involve modifying group memberships to gain elevated privileges. Option A is wrong because DCSync attacks replicate domain credentials. Option B is wrong because Overpass-the-Hash uses Kerberos tickets. Option C is wrong because Skeleton Key attacks inject a backdoor.

Answer

Overpass-the-Hash attack

Answer

DCSync attack

Answer

Skeleton Key attack

Question 11

Your organization uses Microsoft Defender for Endpoint. You need to ensure that when a device is onboarded, it automatically receives all current threat intelligence signatures. What should you verify is configured?

Accepted Answer

Cloud-delivered protection is enabled in the Microsoft 365 Defender portal.. Option B is correct because cloud-delivered protection ensures devices receive the latest signatures from Microsoft. Option A is wrong because sample submission is for advanced analysis, not signature updates. Option C is wrong because it's part of the detection engine but not specifically for signature updates. Option D is wrong because network protection is a feature, not signature delivery.

Answer

The device is configured to receive updates from Microsoft Update.

Answer

Network protection is enabled in the attack surface reduction rules.

Answer

Sample submission is enabled in the advanced features.

Question 12

Your organization has Microsoft Defender for Office 365. Users report that legitimate emails from a partner domain are being quarantined. You need to ensure these emails are delivered while maintaining security. What should you do?

Accepted Answer

Add the partner domain to the Allow list in the Tenant Allow/Block List.. Option B is correct because adding the partner domain to the Allow list in the Tenant Allow/Block List allows the emails but may be used temporarily; long-term best practice is to fix authentication. Option A is wrong because disabling filtering is not recommended. Option C is wrong because it affects all external emails. Option D is wrong because creating a transport rule bypasses security checks and is not best practice.

Answer

Disable spam filtering for the partner domain.

Answer

Lower the spam confidence level (SCL) threshold for the organization.

Answer

Create a mail flow rule to bypass spam filtering for the partner domain.

Question 13

You need to configure Microsoft Defender for Cloud Apps to detect anomalous user behavior such as impossible travel. Which type of policy should you create?

Accepted Answer

Anomaly detection policy. Option A is correct because an anomaly detection policy detects impossible travel, unusual activity, etc. Option B is wrong because file policies handle data protection. Option C is wrong because session policies control real-time access. Option D is wrong because access policies control access conditions.

Answer

Access policy

Answer

Session policy

Answer

File policy

Question 14

Your organization uses Microsoft Defender for Endpoint. You need to ensure that when a user clicks a malicious link in an email, the endpoint is automatically isolated. What should you configure?

Accepted Answer

Configure an automated investigation and response (AIR) playbook for device isolation.. Option C is correct because automated investigation and response (AIR) can be configured to isolate a device when a malicious link is clicked. Option A is wrong because attack surface reduction rules reduce vulnerability but do not automatically isolate. Option B is wrong because network protection blocks connections but does not isolate. Option D is wrong because custom detection rules can trigger isolation but require additional configuration; AIR is the built-in automation.

Answer

Enable network protection in block mode.

Answer

Configure attack surface reduction rules to block the link.

Answer

Create a custom detection rule to trigger isolation.

Question 15

Your organization is implementing Microsoft Defender XDR. Which TWO actions should you take to ensure that alerts from different workloads are correlated into incidents?

Accepted Answer

Enable unified role-based access control (RBAC) in Microsoft 365 Defender.. Options A and D are correct because enabling unified roles and ensuring all workloads send data to Microsoft 365 Defender are prerequisites for incident correlation. Option B is not required because RBAC is separate. Option C is not required because data storage is independent. Option E is wrong because licensing is per workload.

Answer

Ensure that all workloads are configured to use the same data retention policy.

Answer

Configure each workload to send alerts to Microsoft Sentinel.

Answer

Assign Microsoft 365 E5 licenses to all users.