MS-102 Manage security and threats by using Microsoft Defender XDR Practice Test 9 — 15 Questions

Question 1

Your organization uses Microsoft 365 Defender. You need to configure automated investigation and response (AIR) to automatically remediate high-confidence phishing emails. What should you configure?

Accepted Answer

Automated investigation and response for email. AIR policies for email handle automated remediation of phishing. Option A is wrong because it's for device. Option B is wrong because it's for user accounts. Option D is wrong because it's for collaboration.

Answer

Automated investigation and response for collaboration content

Answer

Automated investigation and response for identities

Answer

Automated investigation and response for devices

Question 2

You are a security administrator. You need to configure a Microsoft Defender for Endpoint policy that prevents users from running executables from the Temp folder. Which Attack Surface Reduction (ASR) rule should you enable?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion. The ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' is designed to block executables that are not widely known, old, or trusted, such as those from the Temp folder. Option A is wrong because 'Block credential stealing from the Windows local security authority subsystem (lsass.exe)' prevents credential theft, not executable execution from Temp. Option B is wrong because 'Block Office communication application from creating child processes' targets Office apps, not general executables. Option C is wrong because 'Block process injections originating from Windows executable files' prevents injection attacks, not execution from Temp.

Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Answer

Block Office communication application from creating child processes

Answer

Block process injections originating from Windows executable files

Question 3

You need to configure Microsoft Defender for Office 365 to protect users from malicious links in email. Which TWO actions should you configure?

Accepted Answer

Enable URL detonation. Options C and D are correct because URL detonation (C) provides real-time analysis of links at the time of click, and Safe Links scanning for email (D) protects users from malicious links in email messages. Option A is incorrect because anti-malware engine targets attachments, not links. Option B is incorrect because anti-spam filtering addresses junk mail, not malicious links. Option E is incorrect because Safe Attachments focuses on file attachments, not links.

Answer

Enable anti-malware engine

Answer

Enable anti-spam filtering

Answer

Enable Safe Attachments

Question 4

You are investigating an incident in Microsoft 365 Defender. The incident involves a user who received a malware attachment. Which THREE actions can you take from the incident page?

Accepted Answer

Start an automated investigation. Options A, B, and D are correct because from the incident page, you can start an automated investigation, isolate the user's device, and delete the email from the user's mailbox. Option C is incorrect because resetting the user's password is not available directly from the incident page; it must be done from the user's account in the Microsoft 365 admin center. Option E is incorrect because blocking a malicious URL globally is not a direct action from the incident page; it can be done from the Threat Management Center or through custom indicators.

Answer

Reset the user's password

Answer

Block the malicious URL globally

Question 5

Your organization uses Microsoft Defender for Identity. You need to configure honeytoken accounts. Which THREE attributes should you ensure are NOT set for honeytoken accounts?

Accepted Answer

Last logon timestamp. Honeytoken accounts in Microsoft Defender for Identity should be configured to attract attackers without triggering unnecessary alerts. They should not have a recent last logon timestamp (B), as a stale logon indicates a potential compromise. They should have no group memberships (C) to prevent lateral movement. They should not have an email address (D) to avoid being targeted. The description field (A) can be set to anything and does not affect detection. The account enabled status (E) should typically be enabled so that attackers can attempt to use it; disabling it would defeat the purpose.

Answer

Description field

Answer

Account enabled status

Question 6

You are reviewing a Microsoft Defender for Cloud Apps file policy. The exhibit shows a policy snippet. What is the effect of this policy?

Accepted Answer

It allows Office files between 10 MB and 100 MB from the internet. The policy snippet shows a filter for 'Office files' with a condition 'Size larger than 10 MB' and another condition 'Size smaller than 100 MB'. The action is 'Allow'. Therefore, the effect is to allow Office files that are between 10 MB and 100 MB, matching option D. Option A is incorrect because the action is 'Allow', not 'Block'. Option B is incorrect because the policy only allows files between 10 MB and 100 MB, not all sizes. Option C is incorrect because the policy allows files larger than 10 MB, not blocks them, and it also has an upper limit of 100 MB.

Answer

It blocks all Office files from the internet

Answer

It allows all Office files from the internet regardless of size

Answer

It blocks Office files larger than 10 MB from the internet

Question 7

You are hunting for malicious activity in Microsoft 365 Defender. The exhibit shows a KQL query. What is the query searching for?

Accepted Answer

PowerShell processes with encoded command line arguments. The KQL query is searching for PowerShell processes that used encoded command line arguments, such as the '-EncodedCommand' parameter, which is commonly associated with malicious activity. Option A is incorrect because the query does not specifically target standard command line arguments. Option B is incorrect because the query does not look for processes that created PowerShell processes. Option C is incorrect because the query does not indicate that the PowerShell processes were downloaded from the internet.

Answer

PowerShell processes with standard command line arguments

Answer

Processes that created PowerShell processes

Answer

PowerShell processes that were downloaded from the internet

Question 8

You are configuring a mail flow rule in Exchange Online. The exhibit shows a snippet. What will this rule do?

Accepted Answer

Quarantine messages sent to example.com. The mail flow rule is configured to quarantine messages sent to recipients with the domain example.com. Options B, C, and D are incorrect; the rule does not reject, block, or allow messages, but instead quarantines them for review.

Answer

Reject messages sent to example.com

Answer

Block messages from example.com

Answer

Allow messages to example.com

Question 9

Your organization uses Microsoft 365 E5 and has Microsoft Defender for Office 365 enabled. Users report that legitimate external emails are being quarantined as phishing attempts. You need to reduce false positives while maintaining security. What should you do?

Accepted Answer

Configure user-reported message settings in Microsoft Defender for Office 365. Configuring user-reported message settings in Microsoft Defender for Office 365 allows users to report false positives (legitimate emails marked as phishing). These reports are used by Microsoft's automated investigation and machine learning to improve filtering accuracy, reducing future false positives while maintaining security. Option A is wrong because allowing all emails from external domains bypasses security protections. Option C is wrong because disabling the anti-phishing policy removes protection against genuine phishing attacks. Option D is wrong because increasing the Spam Confidence Level (SCL) threshold affects spam filtering, not specifically phishing detection, and may not address the false positive issue effectively.

Answer

Create a transport rule to allow all emails from external domains

Answer

Disable the anti-phishing policy

Answer

Increase the Spam Confidence Level (SCL) threshold for incoming mail

Question 10

Your company has deployed Microsoft Defender for Endpoint on all Windows devices. You are investigating an alert for a suspicious PowerShell command that was blocked by Attack Surface Reduction (ASR) rules. The alert shows the command was executed from a script embedded in a Word document. You need to identify the ASR rule that blocked this activity. Which rule is most likely responsible?

Accepted Answer

Block Office applications from creating child processes. The ASR rule 'Block Office applications from creating child processes' specifically prevents Office apps like Word from launching child processes such as PowerShell. This rule would block a PowerShell command executed from a script embedded in a Word document. Option B is incorrect because the rule 'Block Office applications from making Win32 API calls' blocks macros from making Win32 API calls, not process creation. Option C is incorrect because the rule 'Block Office applications from injecting code into other processes' prevents code injection, not spawning child processes. Option D is incorrect because the rule 'Block Office applications from creating executable content' blocks the creation of executable files, not the execution of commands.

Answer

Block Office applications from making Win32 API calls

Answer

Block Office applications from injecting code into other processes

Answer

Block Office applications from creating executable content

Question 11

Your organization uses Microsoft Defender XDR. You need to configure automated investigation and response (AIR) for email and collaboration content. Which policy type should you configure in the Microsoft 365 Defender portal?

Accepted Answer

Automated investigation and response. Automated investigation and response (AIR) for email and collaboration content is configured via the 'Automated investigation and response' policy within the Email & collaboration section of the Microsoft 365 Defender portal. This policy allows you to set up automatic remediation actions for threats in email and collaboration tools. Option A is incorrect because Attack simulation training is used for conducting phishing simulations, not for AIR. Option B is incorrect because Safe attachments policies protect against malicious attachments in email and are part of anti-malware settings. Option C is incorrect because Quarantine policies manage how quarantined messages are handled, not automated investigation and response.

Answer

Attack simulation training

Answer

Safe attachments policies

Answer

Quarantine policies

Question 12

Your organization uses Microsoft Defender for Identity (MDI) and Microsoft Defender for Cloud Apps. You receive an alert about a user account that is exhibiting suspicious behavior: unusual login times from an IP address that is not in the user's typical location. The alert recommends action. You need to determine if the account is compromised. What is the best next step?

Accepted Answer

Initiate an automated investigation in Microsoft Defender XDR. Initiating an automated investigation in Microsoft Defender XDR correlates signals across MDI, Defender for Cloud Apps, and other Microsoft 365 services to determine if the account is compromised. Option B is wrong because configuring a conditional access policy is a preventive measure, not an investigative step to confirm compromise. Option C is wrong because disabling the account immediately might be premature and could disrupt legitimate access without confirming the threat. Option D is wrong because resetting the password alone does not investigate other potential malicious activity or identify the scope of compromise.

Answer

Configure a conditional access policy in Microsoft Entra ID to block the IP

Answer

Immediately disable the user account

Answer

Reset the user's password

Question 13

Your organization has Microsoft Defender for Endpoint deployed. You are investigating a potential ransomware incident. The device timeline shows a series of events: a user downloaded a malicious attachment from an email, which then executed a script that encrypted files and attempted to propagate to other devices via SMB. You need to configure a custom detection rule to alert on similar behavior in the future. Which KQL query should you use as a basis?

Accepted Answer

DeviceProcessEvents | join DeviceNetworkEvents on DeviceId. The scenario involves a script that executed after a malicious attachment, and then the ransomware attempted to propagate via SMB. By joining DeviceProcessEvents (to capture the script execution) with DeviceNetworkEvents (to capture outbound SMB connections) on DeviceId, you can correlate the initial execution with later network propagation, creating a detection rule for similar behavior. Option A is wrong because DeviceFileEvents only shows file modifications (e.g., encrypted files), not the process or network events needed to detect the full attack chain. Option B is wrong because DeviceLogonEvents with LogonType 3 captures network logons for lateral movement, but it doesn't capture the script execution. Option C is wrong because DeviceRegistryEvents with Run keys detects persistence attempts, not the initial infection or propagation.

Answer

DeviceFileEvents | where FileName endswith '.encrypted'

Answer

DeviceLogonEvents | where LogonType == 3

Answer

DeviceRegistryEvents | where RegistryKey contains 'Run'

Question 14

Your organization uses Microsoft Defender XDR. You need to configure a policy that automatically blocks high-risk user activities in Microsoft Defender for Cloud Apps. Which feature should you configure?

Accepted Answer

Session policy. Session policies in Defender for Cloud Apps allow real-time control over user sessions, enabling blocking of risky activities. Option B is wrong because app governance policies focus on app permissions, not real-time activity blocking. Option C is wrong because access policies control access based on conditions but do not automatically block high-risk activities. Option D is wrong because anomaly detection policies generate alerts but do not automatically block.

Answer

App governance policy

Answer

Access policy

Answer

Anomaly detection policy

Question 15

Your organization uses Microsoft Defender for Office 365. You receive a report that users are receiving spoofed email messages that appear to come from your own domain. The spoofed messages are not being filtered. You need to ensure that spoofed messages from your domain are blocked. What should you do?

Accepted Answer

Configure spoof intelligence settings to block the spoofed domain. Spoof intelligence in Microsoft Defender for Office 365 allows you to block spoofed messages from your own domain. Option A is incorrect because adding your domain to the allowed domains list would actually permit spoofed messages to bypass filtering. Option C is incorrect because DKIM signing helps authenticate email but does not directly block spoofed messages. Option D is incorrect because while DMARC policy can reject messages that fail authentication, spoof intelligence provides a more direct and immediate method to block spoofed messages from your domain.

Answer

Add your domain to the allowed domains list in the anti-spam policy

Answer

Configure DKIM signing for your domain

Answer

Configure DMARC policy to reject messages that fail SPF or DKIM