MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
You are a security administrator for Fabrikam, Inc. The company uses Microsoft Defender XDR with Microsoft Defender for Identity, Microsoft Defender for Endpoint, and Microsoft Defender for Cloud Apps onboarded. An analyst is investigating a suspected pass-the-hash attack against a domain controller. The analyst needs to correlate identity signals with device and cloud app activity in the unified incident. You must identify which Defender XDR capabilities the analyst can use to pivot from an identity alert to related device and cloud activity. (Choose two.)
⚠ Common exam trap
The trap here is treating single-workload consoles or health pages as if they provide unified cross-domain correlation, when only the incident graph and Advanced Hunting span all onboarded workloads.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run Advanced Hunting queries against the IdentityLogonEvents and DeviceLogonEvents tables in the Microsoft 365 Defender portal.
Cross-domain correlation in Microsoft Defender XDR is achieved through the unified incident graph and through Advanced Hunting across the Kusto tables exposed by each onboarded workload. The graph links accounts, devices, IP addresses, and cloud apps, while Advanced Hunting allows joining IdentityLogonEvents with DeviceLogonEvents to trace pass-the-hash lateral movement. Health alerts, cloud app activity logs, and device timelines each cover only one domain.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Run Advanced Hunting queries against the IdentityLogonEvents and DeviceLogonEvents tables in the Microsoft 365 Defender portal.
Why this is correct
Advanced Hunting exposes Kusto tables from all onboarded Defender workloads, including IdentityLogonEvents for Defender for Identity and DeviceLogonEvents for Defender for Endpoint. Joining these tables allows the analyst to correlate identity logon anomalies with device logon activity and identify lateral movement associated with a pass-the-hash attack.
- ✓
Use the incident graph in the Microsoft 365 Defender portal to expand the alert and view related entities such as accounts, devices, and IP addresses.
Why this is correct
The incident graph in the Microsoft 365 Defender portal visualizes related entities across onboarded workloads, including accounts, devices, IP addresses, and cloud applications. Expanding the alert in the graph lets the analyst pivot from an identity alert to the associated device and cloud activity, which is exactly the cross-domain correlation the scenario requires.
- ✗
Use the Microsoft Defender for Endpoint device timeline to review process creation events on the targeted domain controller.
Why it's wrong here
The device timeline shows process, network, and registry events on a specific device, which is valuable for endpoint investigation. However, it does not include identity logon events from Defender for Identity or cloud app activity, so it cannot deliver the cross-domain correlation the analyst needs in the unified incident.
- ✗
Use the Microsoft Defender for Cloud Apps activity log to review file downloads from sanctioned cloud applications.
Why it's wrong here
The Defender for Cloud Apps activity log records user activity in connected cloud apps, including file operations. It is useful for cloud app investigation but does not by itself correlate identity signals to device logon events. Using it alone would miss the endpoint evidence needed to confirm a pass-the-hash attack path.
- ✗
Use the Microsoft Defender for Identity health alerts page to review sensor configuration issues on the domain controllers.
Why it's wrong here
Health alerts in Defender for Identity report sensor health, configuration problems, and connectivity issues. They do not provide cross-domain correlation of identity, device, and cloud app activity. Reviewing health alerts would help confirm the sensor is working, but it would not surface the related device or cloud events needed for the investigation.
Go deeper
Related to this question
Learn chapter
Defender for Endpoint Deployment via Intune
Key term
XDR
XDR, or Extended Detection and Response, is a unified security platform that collects and correlates data across multiple security layers—endpoints, networks, servers, cloud workloads, and email—to improve threat detection and enable faster response.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.