Microsoft MS-102 Defender Vulnerability Management Prioritization And Remediation Practice Test

Practice Exams:

View All

Microsoft MS-102 Defender Vulnerability Management Prioritization And Remediation Practice Test

MS-102 skills 3.3 | 25 original questions

This MS-102 practice set focuses on defender vulnerability management prioritization and remediation through original scenario-based questions aligned to Microsoft skills measured as of April 28, 2026. Use the full ExamSnap MS-102 collection for practice across all four current skill areas. For broader exam preparation, review the Microsoft MS-102 Exam Dumps page.

Instructions: Select the best answer for each question. Review the rationale after answering. Each distractor includes a brief explanation of why it is not the strongest fit for the stated scenario.

Question 1

The operations team at Alpine Ski House needs to resolve an issue without granting broader permissions than necessary. The change advisory board wants the smallest supported control that can focus remediation on the weakness most likely to materially reduce organizational exposure. The service desk has 38 related tickets from 10 business units, so the team wants a targeted fix. The response must address the cause described in the scenario rather than simply suppressing the symptom. Which approach most directly addresses the requirement?

Use the supported Defender for Endpoint onboarding method for the device-management platform
Use an anomaly detection or app discovery policy when the requirement is behavior- or discovery-driven
Prioritize the vulnerability recommendation with the highest risk and exposure impact
Create and track a remediation activity from the vulnerability recommendation
Assign and track improvement work from the Secure Score recommendation context

Correct answer: C

Why: Defender Vulnerability Management combines vulnerability, threat, exposure, and asset context to help prioritize remediation rather than ranking by CVE count alone. It directly addresses the stated requirement.

Option review:

A: Defender for Endpoint provides multiple supported onboarding methods; choosing one aligned to the management platform improves consistency and verification. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Defender for Cloud Apps offers policy types tailored to activity anomalies and discovered-app governance scenarios. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Defender Vulnerability Management combines vulnerability, threat, exposure, and asset context to help prioritize remediation rather than ranking by CVE count alone. It directly addresses the stated requirement.

D: Remediation workflows let security teams request, track, and validate vulnerability fixes instead of treating recommendations as a static report. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Secure Score recommendations provide context for remediation and progress tracking instead of requiring administrators to infer actions from raw alert counts. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T17-Q001: Prioritize the vulnerability recommendation with the highest risk and exposure impact – Defender Vulnerability Management combines vulnerability, threat, exposure, and asset context to help prioritize remediation rather than ranking by CVE count alone.

Question 2

Southridge Video has completed a pilot and must now choose the production administration approach. Before the tenant expands to another business unit, the administrator must coordinate vulnerability remediation with the team responsible for fixing the affected software or configuration. The control owner requires a review after 55 days and evidence from 23 representative cases. The solution should use a native Microsoft control that matches the stated requirement. Which option best satisfies the requirement?

Use Microsoft Security Exposure Management to investigate exposure paths and initiatives
Drill from a Defender XDR report finding into the underlying security data
Tune alert policy thresholds or recipients instead of weakening threat protection
Create and track a remediation activity from the vulnerability recommendation
Use the supported Defender for Endpoint onboarding method for the device-management platform

Correct answer: D

Why: Remediation workflows let security teams request, track, and validate vulnerability fixes instead of treating recommendations as a static report. It directly addresses the stated requirement.

Option review:

A: Security Exposure Management helps connect exposure signals into attack paths and initiatives, supporting risk-based prioritization beyond isolated findings. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Reports identify patterns or issues; responders should use the related detailed records or incidents to determine the cause and required action. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Alerting and threat protection are separate concerns; changing the alert policy can reduce notification noise without disabling the protection itself. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Remediation workflows let security teams request, track, and validate vulnerability fixes instead of treating recommendations as a static report. It directly addresses the stated requirement.

E: Defender for Endpoint provides multiple supported onboarding methods; choosing one aligned to the management platform improves consistency and verification. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T17-Q002: Create and track a remediation activity from the vulnerability recommendation – Remediation workflows let security teams request, track, and validate vulnerability fixes instead of treating recommendations as a static report.

Question 3

City Power & Light has completed a pilot and must now choose the production administration approach. A post-incident action item requires the tenant to understand which endpoints and business assets are affected by the vulnerability. The team will validate the change with 13 pilot groups before expanding it to 72 users. The response must address the cause described in the scenario rather than simply suppressing the symptom. What is the most appropriate next step?

Review the restricted entities page for the blocked user
Validate the app connector status and granted permissions
Review the discovered app risk score and usage before sanctioning or unsanctioning it
Use Microsoft Security Exposure Management to investigate exposure paths and initiatives
Review exposed devices for the recommendation before scheduling the fix

Correct answer: E

Why: Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment. It directly addresses the stated requirement.

Option review:

A: Restricted entities identifies users or other entities blocked because of suspicious or abusive sending behavior and supports controlled remediation. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: A connector that is disabled, unhealthy, or missing required permissions can prevent expected activity from appearing. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Cloud App Discovery provides app risk information and usage context that should inform governance decisions instead of blocking solely because an app is unfamiliar. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Security Exposure Management helps connect exposure signals into attack paths and initiatives, supporting risk-based prioritization beyond isolated findings. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment. It directly addresses the stated requirement.

Learning point: MS102-T17-Q003: Review exposed devices for the recommendation before scheduling the fix – Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment.

Question 4

A quarterly control review at A. Datum Manufacturing identifies a gap that must be corrected before the next audit. The current workaround is too manual. The replacement should confirm that the security change actually reduced the vulnerability exposure. The team will validate the change with 3 pilot groups before expanding it to 89 users. The administrator must avoid granting unrelated tenant-wide privilege. Which control should the team use?

Reassess the recommendation after remediation to verify exposure decreased
Use threat and exploit context when prioritizing two vulnerabilities with similar severity
Use advanced hunting with KQL
Use preset security policies when a standardized Microsoft-recommended protection baseline meets the requirement
Review the restricted entities page for the blocked user

Correct answer: A

Why: Closing a change ticket is not proof of risk reduction; Defender Vulnerability Management should reflect improved exposure after telemetry updates. It directly addresses the stated requirement.

Option review:

A: Closing a change ticket is not proof of risk reduction; Defender Vulnerability Management should reflect improved exposure after telemetry updates. It directly addresses the stated requirement.

B: Severity alone can be insufficient; active exploitation signals and organizational exposure provide stronger prioritization context. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Advanced hunting supports flexible KQL queries across Defender XDR schema tables for proactive or investigation-driven searches. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Preset security policies bundle recommended configurations and can accelerate deployment of Standard or Strict protection baselines. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Restricted entities identifies users or other entities blocked because of suspicious or abusive sending behavior and supports controlled remediation. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T17-Q004: Reassess the recommendation after remediation to verify exposure decreased – Closing a change ticket is not proof of risk reduction; Defender Vulnerability Management should reflect improved exposure after telemetry updates.

Question 5

Consolidated Messenger is troubleshooting a Microsoft 365 behavior that affects a limited but important user population. An internal assessment finds the control technically functional but unable to choose the vulnerability with stronger evidence of active exploitation or greater tenant exposure. The team will validate the change with 16 pilot groups before expanding it to 15 users. The team wants evidence from the Microsoft 365 or Microsoft Entra control plane rather than assumptions. Which approach most directly addresses the requirement?

Create an Attack Simulation Training campaign
Use threat and exploit context when prioritizing two vulnerabilities with similar severity
Use device groups or supported scoped settings when different endpoint populations require different treatment
Use Cloud App Discovery data from supported endpoint or network traffic sources
Reassess the recommendation after remediation to verify exposure decreased

Correct answer: B

Why: Severity alone can be insufficient; active exploitation signals and organizational exposure provide stronger prioritization context. It directly addresses the stated requirement.

Option review:

A: Attack Simulation Training lets security teams run controlled simulations and associate training with the simulated attack experience. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Severity alone can be insufficient; active exploitation signals and organizational exposure provide stronger prioritization context. It directly addresses the stated requirement.

C: Scoped endpoint administration helps align settings and response permissions to device populations and operational responsibilities. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Cloud App Discovery analyzes observed cloud traffic to identify applications and usage rather than relying only on an administrator-maintained application list. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Closing a change ticket is not proof of risk reduction; Defender Vulnerability Management should reflect improved exposure after telemetry updates. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T17-Q005: Use threat and exploit context when prioritizing two vulnerabilities with similar severity – Severity alone can be insufficient; active exploitation signals and organizational exposure provide stronger prioritization context.

Question 6

Margie Travel is preparing a change requested by the hybrid identity engineer. The current workaround is too manual. The replacement should focus remediation on the weakness most likely to materially reduce organizational exposure. The initial rollout covers 6 locations and approximately 320 managed identities or devices. Existing workload settings should remain unchanged unless the requirement specifically depends on them. Which action should the administrator take?

Review exposed devices for the recommendation before scheduling the fix
Use exposure initiatives to measure progress toward a defined security objective
Prioritize the vulnerability recommendation with the highest risk and exposure impact
Configure a Safe Links policy
Create an Attack Simulation Training campaign

Correct answer: C

Option review:

A: Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Exposure initiatives organize related recommendations around measurable security objectives, making them better suited than isolated alerts for posture improvement programs. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Safe Links evaluates URLs and can block malicious destinations at click time, addressing link-based phishing threats. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Attack Simulation Training lets security teams run controlled simulations and associate training with the simulated attack experience. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T17-Q006: Prioritize the vulnerability recommendation with the highest risk and exposure impact – Defender Vulnerability Management combines vulnerability, threat, exposure, and asset context to help prioritize remediation rather than ranking by CVE count alone.

Question 7

The operations team at Fabrikam Health needs to resolve an issue without granting broader permissions than necessary. The existing configuration works for normal operations but fails the new requirement to coordinate vulnerability remediation with the team responsible for fixing the affected software or configuration. The solution should use a native Microsoft control that matches the stated requirement. The service desk has 49 related tickets from 19 business units, so the team wants a targeted fix. Which administrative choice should be recommended?

Use Threat Explorer or Real-time detections to investigate the malicious message campaign
Verify the device appears in Defender for Endpoint device inventory after onboarding
Filter the Defender for Cloud Apps activity log by user, IP address, activity, or application
Create and track a remediation activity from the vulnerability recommendation
Review exposed devices for the recommendation before scheduling the fix

Correct answer: D

Option review:

A: Defender for Office 365 investigation tools provide message-level campaign and detection details needed to scope and respond to email threats. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Successful script execution alone does not prove service connectivity; device inventory and sensor health provide evidence that onboarding completed. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: The activity log supports rich filtering so analysts can isolate the user, application, object, location, or action associated with suspicious cloud behavior. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Remediation workflows let security teams request, track, and validate vulnerability fixes instead of treating recommendations as a static report. It directly addresses the stated requirement.

E: Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T17-Q007: Create and track a remediation activity from the vulnerability recommendation – Remediation workflows let security teams request, track, and validate vulnerability fixes instead of treating recommendations as a static report.

Question 8

Wide World Importers is troubleshooting a Microsoft 365 behavior that affects a limited but important user population. A post-incident action item requires the tenant to understand which endpoints and business assets are affected by the vulnerability. The affected scope contains 66 users across 9 administrative groups. The change must be repeatable and supportable after the project team leaves. Which Microsoft 365 or Microsoft Entra capability is the best fit?

Mark the risky discovered app as unsanctioned and use supported enforcement integration where appropriate
Prioritize remediation by exposure and business context rather than score alone
Use Microsoft Defender Threat Intelligence for threat actor and indicator context
Use Threat Explorer or Real-time detections to investigate the malicious message campaign
Review exposed devices for the recommendation before scheduling the fix

Correct answer: E

Why: Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment. It directly addresses the stated requirement.

Option review:

A: Unsanctioning identifies disallowed apps and can integrate with supported controls to help restrict their use. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Secure Score is a posture indicator, not a complete risk model; exposure, asset criticality, and exploitability should inform remediation priority. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Defender Threat Intelligence provides intelligence context that helps analysts understand indicators and threat infrastructure beyond tenant telemetry alone. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Defender for Office 365 investigation tools provide message-level campaign and detection details needed to scope and respond to email threats. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment. It directly addresses the stated requirement.

Learning point: MS102-T17-Q008: Review exposed devices for the recommendation before scheduling the fix – Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment.

Question 9

Woodgrove Bank is preparing a change requested by the tenant administrator. The project board will approve the next step only if it can confirm that the security change actually reduced the vulnerability exposure. The service desk has 83 related tickets from 22 business units, so the team wants a targeted fix. The response must address the cause described in the scenario rather than simply suppressing the symptom. Which approach most directly addresses the requirement?

Reassess the recommendation after remediation to verify exposure decreased
Create a Microsoft Defender for Office 365 alert policy
Secure the compromised account before removing the sending restriction
Create an activity policy in Defender for Cloud Apps with an alert
Mark the risky discovered app as unsanctioned and use supported enforcement integration where appropriate

Correct answer: A

Option review:

A: Closing a change ticket is not proof of risk reduction; Defender Vulnerability Management should reflect improved exposure after telemetry updates. It directly addresses the stated requirement.

B: Alert policies define the conditions and notification behavior for security events that should create administrator alerts. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Unblocking without correcting the compromised credentials or malicious behavior risks immediate re-abuse of the account. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Activity policies evaluate cloud activity criteria and can trigger alerts when matching events occur. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Unsanctioning identifies disallowed apps and can integrate with supported controls to help restrict their use. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T17-Q009: Reassess the recommendation after remediation to verify exposure decreased – Closing a change ticket is not proof of risk reduction; Defender Vulnerability Management should reflect improved exposure after telemetry updates.

Question 10

An incident review at Humongous Insurance produces a single administrative requirement for the security operations analyst. Security and operations teams agree on the target state: choose the vulnerability with stronger evidence of active exploitation or greater tenant exposure. The solution should use a native Microsoft control that matches the stated requirement. The service desk has 9 related tickets from 12 business units, so the team wants a targeted fix. Which Microsoft 365 or Microsoft Entra capability is the best fit?

Integrate Defender for Endpoint signals with Cloud App Discovery when endpoints are the chosen visibility source
Use threat and exploit context when prioritizing two vulnerabilities with similar severity
Review Microsoft Secure Score improvement actions
Use Microsoft Defender XDR reports for trend and coverage analysis
Create a Microsoft Defender for Office 365 alert policy

Correct answer: B

Why: Severity alone can be insufficient; active exploitation signals and organizational exposure provide stronger prioritization context. It directly addresses the stated requirement.

Option review:

A: Defender for Endpoint integration can supply endpoint-based cloud app usage signals to Cloud App Discovery without requiring only perimeter firewall logs. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Severity alone can be insufficient; active exploitation signals and organizational exposure provide stronger prioritization context. It directly addresses the stated requirement.

C: Secure Score surfaces recommended security actions and scoring so administrators can prioritize improvements and track security posture progress. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Defender XDR reports summarize security posture, activity, and trends in ways that complement event-level investigations. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Alert policies define the conditions and notification behavior for security events that should create administrator alerts. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T17-Q010: Use threat and exploit context when prioritizing two vulnerabilities with similar severity – Severity alone can be insufficient; active exploitation signals and organizational exposure provide stronger prioritization context.

Question 11

Adventure Works is troubleshooting a Microsoft 365 behavior that affects a limited but important user population. The project board will approve the next step only if it can focus remediation on the weakness most likely to materially reduce organizational exposure. The initial rollout covers 2 locations and approximately 260 managed identities or devices. The solution should use a native Microsoft control that matches the stated requirement. What is the most appropriate next step?

Configure a Safe Attachments policy
Review simulation results to identify users or techniques that need additional training
Prioritize the vulnerability recommendation with the highest risk and exposure impact
Connect Microsoft 365 to Microsoft Defender for Cloud Apps with the app connector
Integrate Defender for Endpoint signals with Cloud App Discovery when endpoints are the chosen visibility source

Correct answer: C

Option review:

A: Safe Attachments provides additional protection against unknown malicious attachments beyond signature-based malware detection. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Simulation metrics show interaction patterns and training outcomes that can guide follow-up education and future campaign design. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: The Microsoft 365 app connector supplies supported activity and governance integration to Defender for Cloud Apps. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Defender for Endpoint integration can supply endpoint-based cloud app usage signals to Cloud App Discovery without requiring only perimeter firewall logs. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T17-Q011: Prioritize the vulnerability recommendation with the highest risk and exposure impact – Defender Vulnerability Management combines vulnerability, threat, exposure, and asset context to help prioritize remediation rather than ranking by CVE count alone.

Question 12

Adventure Works has completed a pilot and must now choose the production administration approach. Administrators have confirmed the present design does not coordinate vulnerability remediation with the team responsible for fixing the affected software or configuration. The affected scope contains 43 users across 15 administrative groups. The team must preserve a clear audit trail for the administrative decision. What is the most appropriate next step?

Pivot from a suspicious activity-log event to the related user or app context
Reassess the recommendation after remediation to verify exposure decreased
Investigate the incident in the Microsoft Defender portal
Create and track a remediation activity from the vulnerability recommendation
Configure a Safe Attachments policy

Correct answer: D

Option review:

A: Activity-log records are more useful when correlated with the involved user, app, IP, and adjacent events instead of reviewed as standalone lines. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Closing a change ticket is not proof of risk reduction; Defender Vulnerability Management should reflect improved exposure after telemetry updates. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Defender XDR incidents aggregate related alerts and evidence across supported products, giving responders a coordinated investigation view. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Remediation workflows let security teams request, track, and validate vulnerability fixes instead of treating recommendations as a static report. It directly addresses the stated requirement.

E: Safe Attachments provides additional protection against unknown malicious attachments beyond signature-based malware detection. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T17-Q012: Create and track a remediation activity from the vulnerability recommendation – Remediation workflows let security teams request, track, and validate vulnerability fixes instead of treating recommendations as a static report.

Question 13

Trey Research is preparing a change requested by the hybrid identity engineer. The implementation review is focused on one outcome: understand which endpoints and business assets are affected by the vulnerability. The affected scope contains 60 users across 5 administrative groups. The team does not want to redesign unrelated workloads. Which action should the administrator take?

Correlate a suspicious indicator with Defender Threat Intelligence before blocking it broadly
Use quarantine and remediation actions for confirmed malicious messages
Configure Defender for Endpoint settings in the Microsoft Defender portal
Pivot from a suspicious activity-log event to the related user or app context
Review exposed devices for the recommendation before scheduling the fix

Correct answer: E

Why: Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment. It directly addresses the stated requirement.

Option review:

A: Threat-intelligence context can reduce false assumptions and reveal related infrastructure before a high-impact blocking decision is made. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Quarantine and message remediation actions remove or restrict access to malicious content without relying on users to delete messages manually. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Endpoint settings in the Defender portal govern service features and integrations rather than requiring per-device manual changes for every capability. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Activity-log records are more useful when correlated with the involved user, app, IP, and adjacent events instead of reviewed as standalone lines. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment. It directly addresses the stated requirement.

Learning point: MS102-T17-Q013: Review exposed devices for the recommendation before scheduling the fix – Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment.

Question 14

Northwind Traders is standardizing administration after several teams used inconsistent procedures. An internal assessment finds the control technically functional but unable to confirm that the security change actually reduced the vulnerability exposure. The team will validate the change with 18 pilot groups before expanding it to 77 users. The change must be repeatable and supportable after the project team leaves. What is the most appropriate next step?

Reassess the recommendation after remediation to verify exposure decreased
Use an anomaly detection or app discovery policy when the requirement is behavior- or discovery-driven
Prioritize the vulnerability recommendation with the highest risk and exposure impact
Assign and track improvement work from the Secure Score recommendation context
Correlate a suspicious indicator with Defender Threat Intelligence before blocking it broadly

Correct answer: A

Option review:

A: Closing a change ticket is not proof of risk reduction; Defender Vulnerability Management should reflect improved exposure after telemetry updates. It directly addresses the stated requirement.

C: Defender Vulnerability Management combines vulnerability, threat, exposure, and asset context to help prioritize remediation rather than ranking by CVE count alone. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Secure Score recommendations provide context for remediation and progress tracking instead of requiring administrators to infer actions from raw alert counts. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Threat-intelligence context can reduce false assumptions and reveal related infrastructure before a high-impact blocking decision is made. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T17-Q014: Reassess the recommendation after remediation to verify exposure decreased – Closing a change ticket is not proof of risk reduction; Defender Vulnerability Management should reflect improved exposure after telemetry updates.

Question 15

City Power & Light has completed a pilot and must now choose the production administration approach. The organization is replacing a manual process. The replacement must choose the vulnerability with stronger evidence of active exploitation or greater tenant exposure while remaining centrally manageable. The team will validate the change with 8 pilot groups before expanding it to 94 users. The design should minimize manual per-user administration where a scoped central control exists. Which control should the team use?

Drill from a Defender XDR report finding into the underlying security data
Use threat and exploit context when prioritizing two vulnerabilities with similar severity
Tune alert policy thresholds or recipients instead of weakening threat protection
Use the supported Defender for Endpoint onboarding method for the device-management platform
Use an anomaly detection or app discovery policy when the requirement is behavior- or discovery-driven

Correct answer: B

Why: Severity alone can be insufficient; active exploitation signals and organizational exposure provide stronger prioritization context. It directly addresses the stated requirement.

Option review:

A: Reports identify patterns or issues; responders should use the related detailed records or incidents to determine the cause and required action. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Severity alone can be insufficient; active exploitation signals and organizational exposure provide stronger prioritization context. It directly addresses the stated requirement.

D: Defender for Endpoint provides multiple supported onboarding methods; choosing one aligned to the management platform improves consistency and verification. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Defender for Cloud Apps offers policy types tailored to activity anomalies and discovered-app governance scenarios. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T17-Q015: Use threat and exploit context when prioritizing two vulnerabilities with similar severity – Severity alone can be insufficient; active exploitation signals and organizational exposure provide stronger prioritization context.

Question 16

An incident review at Tailspin Toys produces a single administrative requirement for the governance lead. The project board will approve the next step only if it can focus remediation on the weakness most likely to materially reduce organizational exposure. The team will validate the change with 21 pilot groups before expanding it to 20 users. The administrator must avoid granting unrelated tenant-wide privilege. Which control should the team use?

Validate the app connector status and granted permissions
Review the discovered app risk score and usage before sanctioning or unsanctioning it
Prioritize the vulnerability recommendation with the highest risk and exposure impact
Use Microsoft Security Exposure Management to investigate exposure paths and initiatives
Drill from a Defender XDR report finding into the underlying security data

Correct answer: C

Option review:

A: A connector that is disabled, unhealthy, or missing required permissions can prevent expected activity from appearing. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Cloud App Discovery provides app risk information and usage context that should inform governance decisions instead of blocking solely because an app is unfamiliar. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Reports identify patterns or issues; responders should use the related detailed records or incidents to determine the cause and required action. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T17-Q016: Prioritize the vulnerability recommendation with the highest risk and exposure impact – Defender Vulnerability Management combines vulnerability, threat, exposure, and asset context to help prioritize remediation rather than ranking by CVE count alone.

Question 17

Coho Winery has completed a pilot and must now choose the production administration approach. The change advisory board wants the smallest supported control that can coordinate vulnerability remediation with the team responsible for fixing the affected software or configuration. The affected scope contains 37 users across 11 administrative groups. The design should minimize manual per-user administration where a scoped central control exists. Which administrative choice should be recommended?

Use advanced hunting with KQL
Use preset security policies when a standardized Microsoft-recommended protection baseline meets the requirement
Review the restricted entities page for the blocked user
Create and track a remediation activity from the vulnerability recommendation
Validate the app connector status and granted permissions

Correct answer: D

Option review:

A: Advanced hunting supports flexible KQL queries across Defender XDR schema tables for proactive or investigation-driven searches. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Preset security policies bundle recommended configurations and can accelerate deployment of Standard or Strict protection baselines. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Restricted entities identifies users or other entities blocked because of suspicious or abusive sending behavior and supports controlled remediation. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Remediation workflows let security teams request, track, and validate vulnerability fixes instead of treating recommendations as a static report. It directly addresses the stated requirement.

E: A connector that is disabled, unhealthy, or missing required permissions can prevent expected activity from appearing. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T17-Q017: Create and track a remediation activity from the vulnerability recommendation – Remediation workflows let security teams request, track, and validate vulnerability fixes instead of treating recommendations as a static report.

Question 18

During a tenant review at Contoso Retail, the governance lead identifies one unresolved requirement. The organization is replacing a manual process. The replacement must understand which endpoints and business assets are affected by the vulnerability while remaining centrally manageable. The initial rollout covers 24 locations and approximately 540 managed identities or devices. The administrator must avoid granting unrelated tenant-wide privilege. Which Microsoft 365 or Microsoft Entra capability is the best fit?

Use device groups or supported scoped settings when different endpoint populations require different treatment
Use Cloud App Discovery data from supported endpoint or network traffic sources
Use threat and exploit context when prioritizing two vulnerabilities with similar severity
Use advanced hunting with KQL
Review exposed devices for the recommendation before scheduling the fix

Correct answer: E

Why: Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment. It directly addresses the stated requirement.

Option review:

A: Scoped endpoint administration helps align settings and response permissions to device populations and operational responsibilities. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Cloud App Discovery analyzes observed cloud traffic to identify applications and usage rather than relying only on an administrator-maintained application list. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Severity alone can be insufficient; active exploitation signals and organizational exposure provide stronger prioritization context. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Advanced hunting supports flexible KQL queries across Defender XDR schema tables for proactive or investigation-driven searches. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment. It directly addresses the stated requirement.

Learning point: MS102-T17-Q018: Review exposed devices for the recommendation before scheduling the fix – Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment.

Question 19

Alpine Ski House is preparing a change requested by the security operations analyst. The existing configuration works for normal operations but fails the new requirement to confirm that the security change actually reduced the vulnerability exposure. The team must preserve a clear audit trail for the administrative decision. The service desk has 71 related tickets from 14 business units, so the team wants a targeted fix. Which administrative choice should be recommended?

Reassess the recommendation after remediation to verify exposure decreased
Use exposure initiatives to measure progress toward a defined security objective
Configure a Safe Links policy
Create an Attack Simulation Training campaign
Use device groups or supported scoped settings when different endpoint populations require different treatment

Correct answer: A

Option review:

A: Closing a change ticket is not proof of risk reduction; Defender Vulnerability Management should reflect improved exposure after telemetry updates. It directly addresses the stated requirement.

C: Safe Links evaluates URLs and can block malicious destinations at click time, addressing link-based phishing threats. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Attack Simulation Training lets security teams run controlled simulations and associate training with the simulated attack experience. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Scoped endpoint administration helps align settings and response permissions to device populations and operational responsibilities. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T17-Q019: Reassess the recommendation after remediation to verify exposure decreased – Closing a change ticket is not proof of risk reduction; Defender Vulnerability Management should reflect improved exposure after telemetry updates.

Question 20

A quarterly control review at Contoso Retail identifies a gap that must be corrected before the next audit. The administrator is comparing native Microsoft controls after documenting a requirement to choose the vulnerability with stronger evidence of active exploitation or greater tenant exposure. The affected scope contains 88 users across 4 administrative groups. The change must be repeatable and supportable after the project team leaves. Which control should the team use?

Verify the device appears in Defender for Endpoint device inventory after onboarding
Use threat and exploit context when prioritizing two vulnerabilities with similar severity
Filter the Defender for Cloud Apps activity log by user, IP address, activity, or application
Create and track a remediation activity from the vulnerability recommendation
Use exposure initiatives to measure progress toward a defined security objective

Correct answer: B

Why: Severity alone can be insufficient; active exploitation signals and organizational exposure provide stronger prioritization context. It directly addresses the stated requirement.

Option review:

A: Successful script execution alone does not prove service connectivity; device inventory and sensor health provide evidence that onboarding completed. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Severity alone can be insufficient; active exploitation signals and organizational exposure provide stronger prioritization context. It directly addresses the stated requirement.

E: Exposure initiatives organize related recommendations around measurable security objectives, making them better suited than isolated alerts for posture improvement programs. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T17-Q020: Use threat and exploit context when prioritizing two vulnerabilities with similar severity – Severity alone can be insufficient; active exploitation signals and organizational exposure provide stronger prioritization context.

Question 21

Datum Dynamics is preparing a change requested by the security operations analyst. A post-incident action item requires the tenant to focus remediation on the weakness most likely to materially reduce organizational exposure. The affected scope contains 14 users across 17 administrative groups. The response must address the cause described in the scenario rather than simply suppressing the symptom. Which action should the administrator take?

Prioritize remediation by exposure and business context rather than score alone
Use Microsoft Defender Threat Intelligence for threat actor and indicator context
Prioritize the vulnerability recommendation with the highest risk and exposure impact
Use Threat Explorer or Real-time detections to investigate the malicious message campaign
Verify the device appears in Defender for Endpoint device inventory after onboarding

Correct answer: C

Option review:

A: Secure Score is a posture indicator, not a complete risk model; exposure, asset criticality, and exploitability should inform remediation priority. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Defender Threat Intelligence provides intelligence context that helps analysts understand indicators and threat infrastructure beyond tenant telemetry alone. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Successful script execution alone does not prove service connectivity; device inventory and sensor health provide evidence that onboarding completed. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T17-Q021: Prioritize the vulnerability recommendation with the highest risk and exposure impact – Defender Vulnerability Management combines vulnerability, threat, exposure, and asset context to help prioritize remediation rather than ranking by CVE count alone.

Question 22

A quarterly control review at Trey Research identifies a gap that must be corrected before the next audit. The next migration wave is blocked until the team can coordinate vulnerability remediation with the team responsible for fixing the affected software or configuration. Existing workload settings should remain unchanged unless the requirement specifically depends on them. The team will validate the change with 7 pilot groups before expanding it to 31 users. Which administrative choice should be recommended?

Secure the compromised account before removing the sending restriction
Create an activity policy in Defender for Cloud Apps with an alert
Mark the risky discovered app as unsanctioned and use supported enforcement integration where appropriate
Create and track a remediation activity from the vulnerability recommendation
Prioritize remediation by exposure and business context rather than score alone

Correct answer: D

Option review:

A: Unblocking without correcting the compromised credentials or malicious behavior risks immediate re-abuse of the account. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Activity policies evaluate cloud activity criteria and can trigger alerts when matching events occur. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Unsanctioning identifies disallowed apps and can integrate with supported controls to help restrict their use. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Remediation workflows let security teams request, track, and validate vulnerability fixes instead of treating recommendations as a static report. It directly addresses the stated requirement.

E: Secure Score is a posture indicator, not a complete risk model; exposure, asset criticality, and exploitability should inform remediation priority. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T17-Q022: Create and track a remediation activity from the vulnerability recommendation – Remediation workflows let security teams request, track, and validate vulnerability fixes instead of treating recommendations as a static report.

Question 23

During a tenant review at Trey Research, the hybrid identity engineer identifies one unresolved requirement. An internal assessment finds the control technically functional but unable to understand which endpoints and business assets are affected by the vulnerability. The control owner requires a review after 48 days and evidence from 20 representative cases. The change must be repeatable and supportable after the project team leaves. Which administrative choice should be recommended?

Review Microsoft Secure Score improvement actions
Use Microsoft Defender XDR reports for trend and coverage analysis
Create a Microsoft Defender for Office 365 alert policy
Secure the compromised account before removing the sending restriction
Review exposed devices for the recommendation before scheduling the fix

Correct answer: E

Why: Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment. It directly addresses the stated requirement.

Option review:

A: Secure Score surfaces recommended security actions and scoring so administrators can prioritize improvements and track security posture progress. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Defender XDR reports summarize security posture, activity, and trends in ways that complement event-level investigations. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Alert policies define the conditions and notification behavior for security events that should create administrator alerts. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Unblocking without correcting the compromised credentials or malicious behavior risks immediate re-abuse of the account. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment. It directly addresses the stated requirement.

Learning point: MS102-T17-Q023: Review exposed devices for the recommendation before scheduling the fix – Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment.

Question 24

During a tenant review at Graphic Design Institute, the governance lead identifies one unresolved requirement. The organization is replacing a manual process. The replacement must confirm that the security change actually reduced the vulnerability exposure while remaining centrally manageable. The initial rollout covers 10 locations and approximately 650 managed identities or devices. The team wants evidence from the Microsoft 365 or Microsoft Entra control plane rather than assumptions. What is the most appropriate next step?

Reassess the recommendation after remediation to verify exposure decreased
Review simulation results to identify users or techniques that need additional training
Connect Microsoft 365 to Microsoft Defender for Cloud Apps with the app connector
Integrate Defender for Endpoint signals with Cloud App Discovery when endpoints are the chosen visibility source
Review Microsoft Secure Score improvement actions

Correct answer: A

Option review:

A: Closing a change ticket is not proof of risk reduction; Defender Vulnerability Management should reflect improved exposure after telemetry updates. It directly addresses the stated requirement.

C: The Microsoft 365 app connector supplies supported activity and governance integration to Defender for Cloud Apps. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Defender for Endpoint integration can supply endpoint-based cloud app usage signals to Cloud App Discovery without requiring only perimeter firewall logs. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Secure Score surfaces recommended security actions and scoring so administrators can prioritize improvements and track security posture progress. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T17-Q024: Reassess the recommendation after remediation to verify exposure decreased – Closing a change ticket is not proof of risk reduction; Defender Vulnerability Management should reflect improved exposure after telemetry updates.

Question 25

A quarterly control review at City Power & Light identifies a gap that must be corrected before the next audit. The implementation review is focused on one outcome: choose the vulnerability with stronger evidence of active exploitation or greater tenant exposure. The team will validate the change with 23 pilot groups before expanding it to 82 users. The team does not want to redesign unrelated workloads. Which administrative choice should be recommended?

Review exposed devices for the recommendation before scheduling the fix
Use threat and exploit context when prioritizing two vulnerabilities with similar severity
Investigate the incident in the Microsoft Defender portal
Configure a Safe Attachments policy
Review simulation results to identify users or techniques that need additional training

Correct answer: B

Why: Severity alone can be insufficient; active exploitation signals and organizational exposure provide stronger prioritization context. It directly addresses the stated requirement.

Option review:

B: Severity alone can be insufficient; active exploitation signals and organizational exposure provide stronger prioritization context. It directly addresses the stated requirement.

D: Safe Attachments provides additional protection against unknown malicious attachments beyond signature-based malware detection. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Simulation metrics show interaction patterns and training outcomes that can guide follow-up education and future campaign design. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T17-Q025: Use threat and exploit context when prioritizing two vulnerabilities with similar severity – Severity alone can be insufficient; active exploitation signals and organizational exposure provide stronger prioritization context.

Related posts: