MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
A company is deploying Microsoft Defender for Office 365 to protect against advanced threats. Which two features are available only in Defender for Office 365 Plan 2 and not in Plan 1? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automated Investigation & Response
Options A and E are correct. Automated Investigation & Response (AIR) and Threat Explorer are only available in Defender for Office 365 Plan 2. Anti-phishing, Safe Attachments, and Safe Links are available in both Plan 1 and Plan 2.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Automated Investigation & Response
Why this is correct
Automated Investigation and Response orchestrates multi-stage remediation across mailboxes, triggered automatically when alerts fire. It is licensed exclusively with Defender for Office 365 Plan 2; Plan 1 provides only manual investigation and basic alerting, so this feature satisfies the Plan 2-only constraint.
- ✗
Anti-phishing
Why it's wrong here
Anti-phishing is included in both Defender for Office 365 Plan 1 and Plan 2, so it does not distinguish the tiers. Plan 2 adds investigation and response capabilities such as Threat Explorer, Attack Simulator and automated investigation, which is where the plan boundary actually lies.
- ✗
Safe Attachments
Why it's wrong here
Safe Attachments is available in both Plan 1 and Plan 2, so it does not separate the tiers. Plan 2 adds Threat Explorer, Attack Simulator and automated investigation and response, which are the capabilities exclusive to the higher tier.
- ✗
Safe Links
Why it's wrong here
Safe Links is included in both Plan 1 and Plan 2, so it cannot satisfy the "Plan 2 only" requirement. It is tempting because it is a headline Defender for Office 365 capability, and it would be the right answer if the question asked which features protect against malicious URLs in either plan.
- ✓
Threat Explorer
Why this is correct
Threat Explorer provides real-time, interactive hunting across email and collaboration telemetry, including pivot filters and remediation actions. It requires Defender for Office 365 Plan 2; Plan 1 offers only the limited real-time detections view, satisfying the Plan 2-only constraint in the stem.
Go deeper
Related to this question
Learn chapter
Threat Analytics Dashboard
Key term
Threat Explorer
A Microsoft 365 security tool that provides real-time interactive reports to investigate and analyze threats detected by Microsoft Defender for Office 365.
Key term
Defender for Office 365
Microsoft Defender for Office 365 is a cloud-based email security service that protects organizations against advanced threats like phishing, malware, and business email compromise by scanning emails, attachments, and links in real time.
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.