MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
You are the security administrator for a multinational organization using Microsoft 365 E5. The organization has 10,000 users across three regions: North America, Europe, and Asia. You have deployed Microsoft Defender for Endpoint on all Windows devices and enabled Microsoft Defender for Office 365. Recently, a sophisticated phishing campaign targeted executives in Europe, using a custom domain that closely resembles your legitimate domain (e.g., contoso.com vs. contos0.com). The emails bypassed anti-spam and anti-phishing policies. You need to configure protection to block these impersonation attempts without affecting legitimate emails from the actual domain. You must also ensure that any similar future attempts using different variations are automatically detected. What should you do?
⚠ Common exam trap
MS-102 often tests the difference between static block lists (Tenant Allow/Block List) and dynamic impersonation detection — candidates pick the block list because it feels concrete, but the exam requires the setting that automatically generalizes to new lookalike domains.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an anti-phishing policy to protect against impersonation of your domain, enabling the 'Protect against impersonation of domains I own' setting and adding your legitimate domain to the list of domains to protect.
Anti-phishing policies in Microsoft Defender for Office 365 include a dedicated domain impersonation setting called 'Protect against impersonation of domains I own.' By enabling this and adding contoso.com to the protected domains list, Defender uses its impersonation detection engine to catch lookalike domains (contos0.com, contoso.co, etc.) using homoglyph, typo, and character-substitution analysis — not just exact string matches. This automatically generalizes to future variations without needing to enumerate each spoofed domain manually.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a Safe Links policy with a block action for URLs containing 'contos0.com'.
Why it's wrong here
Safe Links rewrites and inspects URLs at click time; it cannot block inbound messages whose sending domain merely resembles yours, nor detect future lookalike variations. It is tempting as URL-level protection, and would be correct for blocking known malicious links inside delivered mail.
- ✗
Enable mailbox intelligence in anti-phishing policies to detect unusual sender behavior.
Why it's wrong here
Mailbox intelligence builds per-user sender profiles to flag anomalous senders, but it does not evaluate domain similarity to your accepted domains, so contos0.com impersonation passes. It is tempting as behavioural anti-phishing, and would be correct for detecting compromised internal accounts sending unusual mail.
- ✗
Add the spoofed domain 'contos0.com' to the Tenant Allow/Block List in the Defender for Office 365 portal.
Why it's wrong here
The Tenant Allow/Block List blocks only the exact domain or sender you submit, so new lookalike variations pass unfiltered. It is tempting for rapid, targeted blocking of a known bad sender, which is precisely the scenario where an entry here is the right tool.
- ✓
Configure an anti-phishing policy to protect against impersonation of your domain, enabling the 'Protect against impersonation of domains I own' setting and adding your legitimate domain to the list of domains to protect.
Why this is correct
Domain impersonation protection in an anti-phishing policy uses the 'domains I own' setting, adding contoso.com so lookalike senders such as contos0.com are blocked while genuine mail passes. This satisfies the requirement to block variations without affecting legitimate domain traffic.
Go deeper
Related to this question
Learn chapter
Data Loss Prevention Policies
Key term
Custom domain
A custom domain is a personalized internet address (like contoso.com) that you can use with cloud services instead of the default domain provided by the service provider.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.