How many Troubleshooting Scenario Questions questions are on this page?

This page has 6 Troubleshooting Scenario Questions scenario questions for the MS-102 exam, each with detailed explanations and wrong-answer analysis.

How should I approach MS-102 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Microsoft 365 Administrator MS-102 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Microsoft 365 Administrator MS-102 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

MS-102

exam code

Microsoft

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1easymultiple choice

Full question →

A security administrator needs a single console to investigate and respond to a complex incident involving alerts from endpoints, email, and identities. Which Microsoft portal should they use?

A
Microsoft 365 Defender portal
This portal provides a unified incident management view across Microsoft Defender XDR products, correlating alerts from multiple domains.
B
Microsoft Sentinel
Why wrong: Microsoft Sentinel is a cloud-native SIEM for ingesting logs from many sources but does not natively aggregate Defender product alerts into single incidents by default.
C
Microsoft Defender for Cloud
Why wrong: Microsoft Defender for Cloud focuses on cloud workload protection, not cross-domain incident correlation across endpoints, identities, and email.
D
Microsoft 365 compliance center
Why wrong: The compliance center is used for data lifecycle management, retention, and eDiscovery, not for security incident investigation.

Full breakdown with real-world context →

Question 2mediummultiple choice

Full question →

You are the Microsoft 365 administrator for a multinational company. The company has deployed Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps. Recently, the security team detected that a user's credentials were compromised and used to access SharePoint Online from an unusual location. You need to investigate the incident and determine the full scope of the breach. The solution must use Microsoft 365 Defender to correlate events. What should you do first?

A
Use the Microsoft Purview compliance portal to search for the user's activity in audit logs.
Why wrong: The Microsoft Purview compliance portal's audit log search is primarily a compliance tool, providing coarse-grained activities (e.g., 'User signed in') from a limited set of workloads, with a default retention period of only 90 days (or 180 for E5). It lacks KQL-based correlation across endpoints, email, and identity, so it cannot efficiently timeline a user's actions for a threat investigation. While useful for compliance audits, it is not the optimal first stop for hunting cross-workload activity.
B
Use advanced hunting in Microsoft 365 Defender portal to query for events related to the user across workloads.
Advanced hunting in the Microsoft 365 Defender portal (now Microsoft Defender XDR) is a KQL-based, unified query interface that spans email, identity, endpoints, and cloud apps. It lets you join schema tables such as EmailEvents, IdentityLogonEvents, and CloudAppEvents to correlate a user's actions across a single incident, enabling detection of lateral movement or exfiltration. This is the correct first step because it uses the native, integrated signal of Defender XDR without additional licensing or setup.
C
Use Microsoft Defender for Cloud Apps to investigate the user's activity log.
Why wrong: Microsoft Defender for Cloud Apps (MCAS) focuses exclusively on SaaS and cloud platform activities, such as file downloads or sign-ins from third-party apps (e.g., Dropbox, AWS). It does not cover Exchange Online mail events, Teams messages, or on-premises Active Directory sign-ins, so a user's full attack surface would be missed. Additionally, CloudAppEvents is just one schema in advanced hunting; the Defender portal provides a broader, normalized view, making a separate MCAS investigation redundant when advanced hunting is available.
D
Use Microsoft Sentinel to query the user's events from the workspace.
Why wrong: Microsoft Sentinel is a full SIEM that can consume and analyze logs, but using it for a user investigation requires ingesting data via connectors and having a workspace provisioned with the necessary pricing tier (Pay-as-you-go or Microsoft Sentinel capacity). When a threat is suspected, the integrated, default tool in Defender XDR is advanced hunting—Sentinel is more appropriate for long-term archiving or complex, multi-source correlation that extends beyond M365 data. Querying a Sentinel workspace as a first step adds latency and licensing overhead with no immediate benefit over the built-in Defender portal query.

Full breakdown with real-world context →

Question 3easymultiple choice

Full question →

A security team wants to automatically investigate and respond to security incidents across endpoints, email, and identities without manual intervention. Which Microsoft Defender XDR capability provides this automation?

A
Automated investigation and response (AIR)
AIR uses automation to investigate alerts and take predefined remediation actions, such as isolating devices or deleting malicious emails.
B
Advanced hunting
Why wrong: Advanced hunting is a query-based tool for proactive threat hunting, not automated response.
C
Threat analytics
Why wrong: Threat analytics provides reports and insights about active threats and vulnerabilities, not automated response.
D
Attack surface reduction rules
Why wrong: ASR rules are prevention mechanisms that block specific behaviors but do not provide automated investigation and response.

Full breakdown with real-world context →

Question 4mediummultiple choice

Full question →

A security team wants to automatically investigate and remediate alerts generated from Microsoft Defender for Endpoint, Office 365, and Microsoft Entra ID. Which Microsoft Defender XDR capability should be configured?

A
Threat Analytics
Why wrong: Threat Analytics in Microsoft 365 Defender aggregates threat intelligence, attack campaigns, and vulnerability reports specific to the organization's exposed assets. While it provides valuable context on active threat actors and recommended mitigation actions, it only generates static incident intelligence and does not trigger any automated investigation or remediation workflow.
B
Automated Investigation and Response
Automated Investigation and Response (AIR) in Microsoft 365 Defender orchestrates security playbooks across endpoints, email, and identity signals, automatically collecting evidence, initiating investigations, and executing remediation actions such as quarantining files, suspending accounts, and blocking URLs. AIR leverages AI and predefined automation rules to contain low-impact threats in real time, with optional human approval for destructive actions.
C
Advanced Hunting
Why wrong: Advanced Hunting in the Microsoft 365 portal is a query-based Kusto Query Language (KQL) interface that enables security analysts to interactively search raw event data across up to 30 days, pivot across tables, and customize threat hypotheses. It is a manual and retrospective exercise that requires analytical skill to identify and interpret patterns, and it never performs automated response or remediation without an integrated custom action outside its workflow.
D
Secure Score
Why wrong: Secure Score is a configuration benchmarking tool that evaluates an organization's security posture by quantifying adoption of Microsoft security controls and recommending improvement actions with a scoring system. It measures the maturity of security settings but does not analyze live signals, escalate alerts, or execute automated remediation activities, making it entirely separate from incident response automation.

Full breakdown with real-world context →

Question 5mediummultiple choice

Full question →

A security analyst investigates a potential data exfiltration incident. The analyst identifies that a user's device has made multiple connections to an unknown external IP address using a custom port. Which Microsoft Defender XDR data source would provide the most detailed network communication logs for this investigation?

A
Microsoft Defender for Office 365
Why wrong: Defender for Office 365 is an email security solution that inspects messages for phishing and malware, using safe attachments, safe links, and anti-spam policies. It does not collect endpoint network telemetry such as outbound TCP/UDP connections, so it cannot reveal the actual IP addresses or ports used during a suspected data exfiltration scenario.
B
Microsoft Defender for Cloud Apps
Why wrong: Defender for Cloud Apps focuses on shadow IT discovery and access control for sanctioned cloud apps, relying on API connectors and proxy logs from your cloud providers. It does not ingest raw network packets or process-level connection data from an individual Windows or macOS device, making it unsuitable for identifying a direct exfiltration connection from the endpoint to a remote server.
C
Microsoft Defender for Endpoint
Defender for Endpoint is the correct source because its sensor records detailed network communication events on each device, including the local process, destination IP, destination port, and protocol, which are stored in the DeviceNetworkEvents table for advanced hunting. These logs directly show an inbound or outbound connection that could represent exfiltration, with the process and user context needed for a full investigation.
D
Microsoft 365 Defender portal alerts
Why wrong: The Microsoft 365 Defender portal alerts are aggregated notifications that combine signals from various products such as Defender for Endpoint, Defender for Office 365, and Defender for Cloud Apps. While an alert may highlight suspicious activity, it does not capture or store the underlying raw endpoint network connection logs; those live in the component product's data schema, so the alert alone cannot provide the IP addresses or process details required to prove exfiltration.

Full breakdown with real-world context →

Question 6easymultiple choice

Read the full DNS explanation →

An administrator has added a custom domain 'contoso.com' to their Microsoft 365 tenant and verified ownership. However, users are unable to receive emails sent to their custom domain. Which type of DNS record must the administrator add in the public DNS zone to route emails to Exchange Online?

A
TXT record
Why wrong: TXT records are used for domain verification and SPF, DKIM, DMARC. They do not route email.
B
MX record
An MX record specifies the mail exchange server for the domain. For Exchange Online, it must point to the Microsoft mail exchanger.
C
CNAME record
Why wrong: A CNAME record is typically used for autodiscover (e.g., autodiscover.contoso.com) or other aliases, not for mail routing.
D
SPF record
Why wrong: SPF (TXT) record authorizes sending servers, but does not route incoming mail.

Full breakdown with real-world context →

These MS-102 practice questions are part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style MS-102 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related MS-102 topic practice pages

Deploy and manage a Microsoft 365 tenant practice questions

Implement and manage Microsoft Entra identity and access practice questions

Manage security and threats by using Microsoft Defender XDR practice questions

Manage compliance by using Microsoft Purview practice questions

MS-102 fundamentals practice questions

MS-102 scenario practice questions

MS-102 troubleshooting practice questions

Practice scenarios

A security administrator needs a single console to investigate and respond to a complex incident involving alerts from endpoints, email, and identities. Which Microsoft portal should they use?

A security team wants to automatically investigate and respond to security incidents across endpoints, email, and identities without manual intervention. Which Microsoft Defender XDR capability provides this automation?

A security team wants to automatically investigate and remediate alerts generated from Microsoft Defender for Endpoint, Office 365, and Microsoft Entra ID. Which Microsoft Defender XDR capability should be configured?

An administrator has added a custom domain 'contoso.com' to their Microsoft 365 tenant and verified ownership. However, users are unable to receive emails sent to their custom domain. Which type of DNS record must the administrator add in the public DNS zone to route emails to Exchange Online?