MS-102 Manage security and threats by using Microsoft Defender XDR — Timed 20 Questions

Question 1

A security operations team uses Microsoft Defender XDR. They want to create a custom detection rule that alerts when a specific process (e.g., wscript.exe) launches from a user's temp directory and then performs a network connection to an external IP. Which advanced hunting query language should they use?

20 minute time limit — choose an answer to begin.

Accepted Answer

Kusto Query Language (KQL). Microsoft Defender XDR uses Kusto Query Language (KQL) for advanced hunting queries, including custom detection rules. KQL allows querying the DeviceProcessEvents and DeviceNetworkEvents tables to correlate process launches with network connections, making it the correct choice for this scenario.

Answer

PowerShell

Answer

Splunk SPL

Answer

SQL

Question 2

A security operations team wants to receive real-time alerts when a user is at high risk of having their account compromised based on unusual sign-in patterns. Which Microsoft Defender XDR component should they configure?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is the correct component because it is specifically designed to detect and alert on identity-based threats, including unusual sign-in patterns that indicate a high risk of account compromise. MDI uses behavioral analytics and machine learning to monitor on-premises Active Directory and Azure AD sign-in logs for anomalies such as impossible travel, unusual login times, or suspicious credential usage, triggering real-time alerts. This directly matches the requirement for real-time alerts on user risk from unusual sign-in patterns.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Question 3

A security analyst wants to create a custom detection rule in Microsoft Defender XDR that triggers when a user receives a phishing email and clicks a link to a known malicious domain. Which advanced hunting table should the analyst query to track the clicked URL?

Accepted Answer

EmailUrlInfo. The EmailUrlInfo table in Advanced Hunting for Microsoft Defender XDR contains records of URLs that were present in emails, including the URL domain and whether the link was clicked. By joining EmailEvents with EmailUrlInfo on the NetworkMessageId, the analyst can identify when a user clicked a URL that leads to a known malicious domain, making it the correct table for tracking clicked URLs.

Answer

EmailEvents

Answer

EmailAttachmentInfo

Answer

DeviceEvents

Question 4

A ransomware alert is confirmed in Microsoft Defender XDR on a user device that is still communicating with other endpoints. What should the administrator do first to reduce spread while preserving the ability to investigate?

Accepted Answer

Isolate the affected device from the network. Immediately isolating the affected device from the network stops the ransomware from spreading laterally to other endpoints via SMB, RDP, or other protocols, while preserving the device's state for forensic analysis. Microsoft Defender XDR's device isolation feature blocks all inbound and outbound communication except with the Defender for Endpoint cloud service, allowing investigation to continue without the risk of further infection.

Answer

Collect a forensic package before taking containment action

Answer

Run a full antivirus scan before isolating the device

Answer

Wait for automated investigation to complete before responding

Question 5

A security administrator wants to create a custom detection rule in Microsoft Defender XDR that alerts when a device initiates an outbound TCP connection to a known malicious IP address on a non-standard port (e.g., port 4444). Which advanced hunting table should be queried to find these network connections?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the correct table because it specifically captures network connection events, including outbound TCP connections to IP addresses and ports. This table contains fields like RemoteIP, RemotePort, and Protocol, making it ideal for detecting connections to known malicious IPs on non-standard ports such as 4444.

Answer

DeviceProcessEvents

Answer

EmailEvents

Answer

IdentityLogonEvents

Question 6

A security analyst wants to create a custom detection rule that triggers when a user receives a phishing email that bypassed Exchange Online Protection, and then clicks a link that leads to a known malicious domain. Which two advanced hunting tables should the analyst combine to detect this chain of events?

Accepted Answer

EmailEvents and UrlClickEvents. Combining EmailEvents (which captures email delivery) with UrlClickEvents (which records user clicks on URLs in emails) allows the analyst to identify the specific chain: a user received a phishing email and then clicked a link. This pair directly links the email receipt to the user's click action. Option D is incorrect because while UrlClickEvents and DeviceNetworkEvents can correlate a click to a network connection, they do not include the email receipt event (EmailEvents), which is essential to detect the full chain described: receiving a phishing email and then clicking a link. Without EmailEvents, there is no evidence that the click originated from an email.

Answer

EmailEvents and DeviceNetworkEvents

Answer

EmailEvents and IdentityLogonEvents

Answer

UrlClickEvents and DeviceNetworkEvents

Question 7

A security analyst needs to create a custom detection rule in Microsoft Defender XDR that triggers when a user's device establishes a network connection to a known malicious IP address on a port commonly used by a specific malware. The rule must also include process information such as the filename of the process that initiated the connection. Which advanced hunting table should be the primary data source for this rule?

Accepted Answer

DeviceNetworkEvents. The DeviceNetworkEvents table in Microsoft Defender XDR captures network connection events, including source and destination IP addresses, ports, and the initiating process's filename and ID. This makes it the ideal primary data source for a custom detection rule that must trigger on a specific malicious IP and port combination while also providing process information.

Answer

DeviceProcessEvents

Answer

DeviceFileEvents

Answer

IdentityLogonEvents

Question 8

A security analyst needs to search for devices that have been communicating with a known malicious command-and-control server over the past 7 days. The analyst wants to identify the process that initiated the connection. Which advanced hunting query would be most efficient?

Accepted Answer

DeviceNetworkEvents | where RemoteIP == 'malicious IP' and Timestamp > ago(7d) | project DeviceName, InitiatingProcessFileName, Timestamp. DeviceNetworkEvents contains network connection data including the remote IP and the initiating process details. Filtering by RemoteIP and Timestamp directly retrieves the required information without unnecessary joins or subqueries, making it the most efficient query for identifying the process that initiated the connection to a known malicious C2 server.

Answer

DeviceProcessEvents | where ProcessId in (select ProcessId from DeviceNetworkEvents where RemoteIP == 'malicious IP' and Timestamp > ago(7d)) | project DeviceName, ProcessFileName, Timestamp

Answer

DeviceNetworkEvents | where Timestamp > ago(7d) | join DeviceProcessEvents on ProcessId | where RemoteIP == 'malicious IP' | project DeviceName, ProcessFileName, Timestamp

Answer

IdentityLogonEvents | where IPAddress == 'malicious IP' | project DeviceName, Timestamp

Question 9

A security analyst wants to create a custom detection rule in Microsoft Defender XDR that triggers when a user receives a phishing email and later clicks a link to a known malicious domain from their device. The rule will use advanced hunting queries. Which two tables should be joined to detect the click event from the device?

Accepted Answer

EmailUrlInfo and DeviceNetworkEvents. Detecting a user clicking a link to a known malicious domain from their device requires joining the email URL information (EmailUrlInfo) with the device-level network event (DeviceNetworkEvents). EmailUrlInfo contains the URLs from emails, and DeviceNetworkEvents records outbound network connections from devices, including the destination domain. Joining these tables on the URL or domain allows you to correlate the email link with the subsequent device click event. Option B (EmailEvents and DeviceNetworkEvents) is incorrect because EmailEvents does not provide the specific URL clicked; it only gives email-level metadata. The URL must come from EmailUrlInfo.

Answer

EmailEvents and EmailUrlInfo

Answer

EmailEvents and DeviceNetworkEvents

Answer

EmailAttachmentInfo and DeviceProcessEvents

Question 10

A security analyst needs to identify the specific process (filename) that initiated a network connection from a device to a known malicious IP address over the last 24 hours. Which advanced hunting table in Microsoft Defender XDR provides the necessary data including the initiating process filename and the remote IP address?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the correct table because it specifically captures network connection events, including the initiating process filename (InitiatingProcessFileName) and the remote IP address (RemoteIP). This table is designed for hunting network-related activities, such as connections to known malicious IPs, within Microsoft Defender XDR's advanced hunting schema.

Answer

DeviceProcessEvents

Answer

DeviceEvents

Answer

DeviceRegistryEvents

Question 11

A security administrator wants to simulate a realistic phishing attack to train users and measure their susceptibility. The simulation should be run from within Microsoft Defender XDR and provide detailed reporting. Which feature should the administrator use?

Accepted Answer

Attack Simulation Training. Attack Simulation Training in Microsoft Defender XDR allows security administrators to create and launch realistic phishing campaigns directly from the Microsoft 365 Defender portal. It provides detailed reporting on user interactions, such as who clicked the link or entered credentials, enabling measurement of user susceptibility and targeted training follow-ups.

Answer

Advanced Hunting

Answer

Automated Investigation and Response

Answer

Threat Analytics

Question 12

A security administrator wants to prevent malware from using Office macros to spawn malicious processes. Specifically, they want to block Excel, Word, and PowerPoint from creating child processes. Which Microsoft Defender for Endpoint capability should be configured?

Accepted Answer

Attack Surface Reduction (ASR) rules. Attack Surface Reduction (ASR) rules are a Microsoft Defender for Endpoint capability specifically designed to block common malware behaviors, such as Office applications (Excel, Word, PowerPoint) from creating child processes. This rule (GUID: 26190899-1602-49e8-8b27-eb1d0a1ce869) prevents macros from spawning cmd.exe, powershell.exe, or other executables, directly addressing the administrator's requirement.

Answer

Threat & Vulnerability Management

Answer

Web Protection

Answer

Network Protection

Question 13

A security analyst wants to search for instances where a user received a phishing email that was delivered to their inbox, and then later clicked a link within that email that led to a known malicious domain. Which two advanced hunting tables should be joined to identify both the email delivery and the link click events? (Choose the option that correctly identifies the primary table pair.)

Accepted Answer

EmailEvents and DeviceEvents [CORRECT]. Only option A is correct. EmailEvents records email delivery events and includes the NetworkMessageId. DeviceEvents captures user actions such as URL clicks (ActionType 'UrlClick' or 'PhishClick') and also includes the NetworkMessageId. Joining these two tables on NetworkMessageId allows the analyst to correlate a delivered email with a subsequent click. Option B is incorrect because EmailPostDeliveryEvents does contain link click actions, but DeviceNetworkEvents logs network connections, not link clicks. To identify a link click, the analyst needs the user action event, not the network connection. Moreover, DeviceNetworkEvents may not reliably include the NetworkMessageId for all link clicks. Therefore, the correct pair is A.

Answer

EmailPostDeliveryEvents and DeviceNetworkEvents [CORRECT]

Answer

EmailUrlInfo and DeviceProcessEvents [wrong]

Answer

EmailEvents and DeviceLogonEvents [wrong]

Question 14

A security analyst is investigating a potential lateral movement attack. They need to identify which processes were created on a compromised device and then which network connections were made by those processes. Which two advanced hunting tables should the analyst join in a KQL query?

Accepted Answer

A: DeviceProcessEvents and DeviceNetworkEvents. To identify processes created on a compromised device and then the network connections made by those processes, the analyst must join DeviceProcessEvents (process creation) with DeviceNetworkEvents (network connections) on DeviceId and ProcessId. This directly maps each process to its outbound connections, enabling detection of lateral movement indicators like SMB, RDP, or WinRM traffic. Option C (IdentityLogonEvents and DeviceProcessEvents) is incorrect because it does not include network connection data, which is essential for the investigation.

Answer

B: DeviceEvents and DeviceFileEvents

Answer

C: IdentityLogonEvents and DeviceProcessEvents

Answer

D: EmailEvents and DeviceNetworkEvents

Question 15

A security analyst wants to create a custom detection rule in Microsoft Defender XDR that triggers when a device establishes a network connection to an IP address that has been recently observed in threat intelligence feeds as a new, malicious command-and-control server. The rule should analyze network communication events. Which advanced hunting table should be the primary data source for the Kusto Query Language (KQL) query?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the correct primary data source because it captures network connection events, including source and destination IP addresses, ports, and protocols. To detect a device connecting to a newly observed malicious command-and-control server, the KQL query must analyze network communication events, which are stored exclusively in this table.

Answer

DeviceProcessEvents

Answer

EmailEvents

Answer

AlertEvidence

Question 16

A security analyst wants to create a custom detection rule in Microsoft Defender XDR that triggers when a user receives a phishing email (delivered to inbox) and then, from their Windows device, establishes a network connection to a known malicious IP address. The rule will be based on an advanced hunting query. Which two tables should the analyst join in the KQL query to capture both the email delivery event and the network connection event?

Accepted Answer

EmailEvents and DeviceNetworkEvents. The correct answers are A and C. This custom detection rule requires capturing two distinct events: the phishing email being delivered to the user's inbox and the Windows device establishing a network connection to a known malicious IP. The EmailEvents table (option A) records the initial delivery status of emails, including 'Delivered' events. The EmailPostDeliveryEvents table (option C) captures actions that occur after delivery, such as user interactions or admin remediation, but it can also be used to detect if the email was successfully delivered and subsequently interacted with. Both tables can be joined with DeviceNetworkEvents on a common identifier (like RecipientObjectId and DeviceId) to correlate the email receipt with the network connection event. Option A is more straightforward for the delivery event, while option C can be useful if the analyst wants to capture the delivery as part of post-delivery actions or if the rule requires a specific post-delivery trigger. Note that option C may include only a subset of delivery events based on the filter conditions, but it is still valid for this scenario.

Answer

EmailEvents and DeviceProcessEvents

Answer

EmailAttachmentInfo and DeviceRegistryEvents

Question 17

A security administrator needs to configure an automated investigation and response (AIR) playbook in Microsoft 365 Defender that will automatically isolate a device whenever a high-severity alert from Microsoft Defender for Endpoint is generated. The playbook must run without requiring manual approval. Which configuration must the administrator set to achieve automatic device isolation?

Accepted Answer

Set the automation level for device isolation to 'Full - automatically remediate threats' in the Advanced Features settings.. The automation level for device isolation in Microsoft 365 Defender is configured under Settings > Endpoints > Automation (not Advanced Features). Setting it to 'Full - automatically remediate threats' ensures that when a high-severity alert triggers the AIR playbook, device isolation is performed without requiring manual approval.

Answer

Create a custom detection rule that triggers on high-severity alerts and uses an automated action.

Answer

Configure the device isolation action to require approval in the automation level settings.

Answer

Enable automatic remediation only for medium severity and above.

Question 18

A security analyst is building a custom detection rule in Microsoft 365 Defender to identify when a user clicks a malicious URL in a phishing email and subsequently visits the malicious site from their corporate device. The analyst plans to use advanced hunting with Kusto Query Language (KQL). Which two tables must be joined to capture both the URL click event and the network connection to the malicious site?

Accepted Answer

EmailUrlInfo and DeviceNetworkEvents. EmailUrlInfo contains the clicked URL (URL clicks are recorded in this table) and DeviceNetworkEvents logs network connections; a direct join on the URL value captures the exact sequence of clicking the malicious link and the device connecting to that site. Option A is incorrect because EmailEvents does not include click event data; it records email delivery and other interactions but does not capture URL click actions.

Answer

EmailEvents and DeviceNetworkEvents

Answer

EmailAttachmentInfo and DeviceProcessEvents

Answer

EmailEvents and DeviceFileEvents

Question 19

A security analyst is using Microsoft 365 Defender Advanced Hunting to investigate a potential malware outbreak. The analyst needs to find all devices where a specific signed executable (known to be malicious) was created in the past 24 hours. Which Advanced Hunting table should be queried to detect the creation of the executable file?

Accepted Answer

DeviceFileEvents. The DeviceFileEvents table in Microsoft 365 Defender Advanced Hunting captures file creation, modification, and deletion events. Since the question specifically asks for detecting the creation of a signed executable file, this table provides the necessary data, including file name, path, and timestamp, to identify when and where the malicious executable was created.

Answer

DeviceProcessEvents

Answer

DeviceNetworkEvents

Answer

DeviceRegistryEvents

Question 20

A security administrator wants to prevent users from uploading files to unsanctioned cloud storage apps (e.g., personal Dropbox or Google Drive) from managed Windows devices. The solution must use a reverse proxy to control file uploads in real time. Which Microsoft Defender for Cloud Apps feature should the administrator configure?

Accepted Answer

Session policy. Session policy in Microsoft Defender for Cloud Apps uses reverse proxy capabilities to monitor and control user activities in real time. When configured with the 'Control file upload' action, it can block or restrict uploads to unsanctioned cloud storage apps like personal Dropbox or Google Drive from managed Windows devices, meeting the requirement exactly.

Answer

App discovery policy

Answer

Access policy

Answer

Activity policy