MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
Your organization uses Microsoft Defender XDR. You need to configure automated investigation and response (AIR) for email and collaboration content. Which policy type should you configure in the Microsoft 365 Defender portal?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automated investigation and response
Automated investigation and response (AIR) for email and collaboration content is configured via the 'Automated investigation and response' policy within the Email & collaboration section of the Microsoft 365 Defender portal. This policy allows you to set up automatic remediation actions for threats in email and collaboration tools. Option A is incorrect because Attack simulation training is used for conducting phishing simulations, not for AIR. Option B is incorrect because Safe attachments policies protect against malicious attachments in email and are part of anti-malware settings. Option C is incorrect because Quarantine policies manage how quarantined messages are handled, not automated investigation and response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attack simulation training
Why it's wrong here
Attack simulation training is a separate capability in Defender for Office 365 used to create authentic phishing and password-spraying simulations that help test and educate users on security awareness. It measures user susceptibility and delivers training, but it does not trigger or configure automated investigation and response. It is a non-production, simulated attack tool, not an operational security policy that automates real incident response actions.
- ✗
Safe attachments policies
Why it's wrong here
Safe attachments policies protect email systems by detonating attachments in a sandbox environment before delivery and dynamically blocking or quarantining messages that contain malicious files. While these policies help prevent threats from reaching users, they are a point-in-time, pre-delivery protection mechanism, not an automated investigation and response engine. AIR can use the intelligence gained from Safe Attachments detection as part of its broader investigation and remediation workflow, but configuring Safe Attachments does not enable the full automated response functionality needed for this requirement.
- ✗
Quarantine policies
Why it's wrong here
Quarantine policies define the end-user experience and administrative controls for messages or files that have already been quarantined in Defender for Office 365, such as whether users can request release, set notification intervals, and specify retention durations. These policies do not initiate or configure automated investigation and response; they only manage the lifecycle of items isolated by other detection systems. In contrast, AIR orchestrates the entire investigation and remediation workflow, so selecting quarantine policies would not enable the automated response capabilities you need.
- ✓
Automated investigation and response
Why this is correct
Automated investigation and response (AIR) is the correct policy type in the Microsoft 365 Defender portal for configuring automated response actions for email and collaboration content. It lets administrators define which automatic actions are performed (e.g., deleting malicious email, blocking malicious URLs, or disabling compromised user accounts) and whether they should run automatically or require approval. AIR leverages predefined playbooks and machine learning to analyze alerts, correlate signals across workloads, and drive remediation, making it the appropriate setting for enabling automated investigation and response.
Go deeper
Related to this question
Learn chapter
SharePoint External Sharing and Guest Policies
Key term
Attack simulation training
Attack simulation training is a Microsoft 365 security tool that lets IT administrators run realistic phishing and password-attack campaigns against their own users to identify vulnerabilities and improve security awareness.
Key term
Safe Attachments
Safe Attachments is a Microsoft Defender for Office 365 feature that opens email attachments in a virtual sandbox to detect and block malicious content before they reach your inbox.
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.