MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
Your organization has Microsoft Defender for Cloud Apps deployed. You need to be alerted when a user performs more than 50 failed login attempts in an hour from a non-corporate IP address. Which type of policy should you create?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Anomaly detection policy
An anomaly detection policy in Defender for Cloud Apps can detect unusual patterns like multiple failed login attempts from non-corporate IPs. Option A is wrong because a session policy controls real-time access but doesn't detect anomalies. Option C is wrong because a file policy monitors file activities, not login attempts. Option D is wrong because an access policy enforces conditional access based on compliance, not anomaly detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Session policy
Why it's wrong here
Session policies apply real-time proxy controls over an active user session, such as blocking downloads or protecting data. They do not aggregate failed sign-in counts per hour. An activity policy raises the alert. Session policies are correct when you must restrict actions inside a connected app session.
- ✓
Anomaly detection policy
Why this is correct
Anomaly detection policies in Defender for Cloud Apps use machine-learned behavioural baselines to flag deviations such as unusual failed-login volumes, satisfying the threshold and non-corporate IP conditions. Activity policies, by contrast, apply static, user-defined filters and cannot model anomalous sign-in behaviour.
- ✗
File policy
Why it's wrong here
File policies scan and govern content stored in connected cloud apps, matching file names, types or sensitivity labels. They cannot count authentication failures or evaluate source IP reputation. An activity policy triggers on the failed-login threshold. File policies suit detecting or quarantining sensitive documents shared externally.
- ✗
Access policy
Why it's wrong here
Access policies govern real-time session control and sign-in blocking for cloud apps, not threshold-based alerting on repeated authentication failures. An activity policy detects the 50 failed logins from a non-corporate IP. Access policies fit scenarios requiring conditional access enforcement during a live session.
Go deeper
Related to this question
Learn chapter
Named Locations and Network-Based Policies
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 712 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization has deployed Microsoft Defender for Cloud Apps. You want to detect anomalous behavior such as impossible travel for users accessing cloud apps. You need to configure the appropriate policy. Which policy type should you create?
hard- A.App discovery policy
- ✓ B.Activity policy
- C.Session policy
- D.File policy
Why B: Activity policies in Microsoft Defender for Cloud Apps are designed to monitor user activity across cloud apps and trigger alerts or governance actions on anomalous behavior, including impossible travel, suspicious IP addresses, and unusual file downloads. Creating an activity policy with the 'Impossible travel' template directly detects the scenario described. This is the correct policy type for behavioral anomaly detection.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.