Microsoft MS-102 Exam Dumps, Practice Test Questions

Review the applicable post-delivery actions and remediation status for the affected messages. is directed at a separate task: A malicious attachment was delivered and later discovered to be harmful by updated protection. It does not produce the required configuration outcome: Test impersonation mail is detected and handled under the configured policy.

Set an appropriate quarantine policy for the relevant detection class. implements a different mechanism for: A team needs to distinguish email quarantine retention from deleting messages permanently. It does not configure the mechanism needed here: Configure Defender for Office 365 anti-phishing impersonation protection for supported recipients.

Review onboarding and sensor-health reports for the newly provisioned cohort. is directed at a separate task: Security wants to track whether the Defender endpoint agent is enabled on recently provisioned machines. It does not produce the required configuration outcome: Test impersonation mail is detected and handled under the configured policy.

Spam verdicts follow the selected handling while partner false positives can be reviewed. would assess a different control. In this case it does not rule out the specific failure: CEO spoofing reaches recipients because the protected-user scope is empty.

Subsequent in-scope messages receive the intended block verdict. is evidence of another system state: An email administrator needs to block a confirmed malicious sender domain during an active campaign. The acceptance evidence here instead is: Test impersonation mail is detected and handled under the configured policy.

The discovered-app report reflects cloud usage from off-network endpoints. would assess a different control. In this case it does not rule out the specific failure: CEO spoofing reaches recipients because the protected-user scope is empty.

The training assignment or campaign follow-up rule was omitted. would fit a different circumstance involving: A team wants to assign follow-up training to users who fail a controlled phishing simulation. Here the actual symptom is: CEO spoofing reaches recipients because the protected-user scope is empty.

The inbound spam policy was tuned without considering legitimate sender behavior and quarantine review. is a plausible failure in another case: All partner messages are discarded after an aggressive spam setting change. It does not explain the current incident: CEO spoofing reaches recipients because the protected-user scope is empty.

Hunting filters failed to constrain the data source, time window or detection logic. would fit a different circumstance involving: An SOC wants repeatable analysis of unusual data exfiltration event patterns rather than manual clicking for each alert. Here the actual symptom is: CEO spoofing reaches recipients because the protected-user scope is empty.

Evaluate and apply an eligible Defender for Office 365 preset security policy. can be useful when the business wants a consistent baseline email protection configuration with minimal manual tuning. However, it does not specifically achieve: Forged messages receive an appropriate authentication/spoof verdict and action.

Enable Safe Links URL inspection for the eligible mail recipients. addresses another administrative need: Employees frequently click newly discovered malicious URLs in incoming emails. This question instead requires the outcome: Forged messages receive an appropriate authentication/spoof verdict and action.

Investigate the connector health and authorization state in Defender for Cloud Apps. can be useful when an app connector stopped reporting events after credentials or permissions changed. However, it does not specifically achieve: Forged messages receive an appropriate authentication/spoof verdict and action.

Review restricted entities, reset compromised credentials and unblock when safe. is directed at a separate task: An infected mailbox account is placed in the Defender restricted entities list. It does not produce the required configuration outcome: Forged messages receive an appropriate authentication/spoof verdict and action.

Inspect the available Teams-related evidence and affected user entities in Defender portals. implements a different mechanism for: A suspicious Teams collaboration link is reported and security needs the collaboration threat context. It does not configure the mechanism needed here: Use email authentication and anti-phishing spoof-intelligence policies.

Record affected entities and initiate appropriate credential/session remediation with identity owners. is directed at a separate task: A security analyst finds evidence of token theft and must preserve the cross-domain case context. It does not produce the required configuration outcome: Forged messages receive an appropriate authentication/spoof verdict and action.

The campaign results show training assigned to users who met the defined criterion. would assess a different control. In this case it does not rule out the specific failure: Spoofed sender mail passes through because the applicable spoof policy was disabled.

Spam verdicts follow the selected handling while partner false positives can be reviewed. is evidence of another system state: A mail administrator wants to reduce inbound spam while preserving legitimate external partner mail. The acceptance evidence here instead is: Forged messages receive an appropriate authentication/spoof verdict and action.

The report links an exposure recommendation to the affected endpoint population. would assess a different control. In this case it does not rule out the specific failure: Spoofed sender mail passes through because the applicable spoof policy was disabled.

Campaign correlation and common mail indicators were not examined. would fit a different circumstance involving: A help desk sees multiple alerts for one mass-phishing campaign and needs to group messages by campaign. Here the actual symptom is: Spoofed sender mail passes through because the applicable spoof policy was disabled.

Post-delivery response configuration or remediation coverage is missing. is a plausible failure in another case: A later malicious verdict is recorded but no eligible post-delivery response occurs. It does not explain the current incident: Spoofed sender mail passes through because the applicable spoof policy was disabled.

The app was not formally marked unsanctioned in Cloud Apps policy workflow. would fit a different circumstance involving: A company wants to mark an investigated cloud app as prohibited for corporate use. Here the actual symptom is: Spoofed sender mail passes through because the applicable spoof policy was disabled.

Configure training assignment logic in an Attack simulation training campaign. can be useful when a team wants to assign follow-up training to users who fail a controlled phishing simulation. However, it does not specifically achieve: A blocked malicious URL produces the appropriate Safe Links protection event.

Investigate the cause and resolve restricted entity status only after remediation. addresses another administrative need: An infected mailbox account is placed in the Defender restricted entities list. This question instead requires the outcome: A blocked malicious URL produces the appropriate Safe Links protection event.

Review Cloud Discovery app risk scoring and usage evidence. can be useful when a manager asks which shadow SaaS application poses the greatest risk to the business. However, it does not specifically achieve: A blocked malicious URL produces the appropriate Safe Links protection event.

Review the applicable post-delivery actions and remediation status for the affected messages. is directed at a separate task: A malicious attachment was delivered and later discovered to be harmful by updated protection. It does not produce the required configuration outcome: A blocked malicious URL produces the appropriate Safe Links protection event.

Review restricted entities, reset compromised credentials and unblock when safe. implements a different mechanism for: An infected mailbox account is placed in the Defender restricted entities list. It does not configure the mechanism needed here: Enable Safe Links URL inspection for the eligible mail recipients.

Mark the app sanctioned in Cloud Discovery with the approved governance process. is directed at a separate task: A discovered app is safe for a specific business group and should no longer be treated as shadow IT. It does not produce the required configuration outcome: A blocked malicious URL produces the appropriate Safe Links protection event.

The remediated account is removed from the restricted list and can send appropriately. would assess a different control. In this case it does not rule out the specific failure: A known malicious link remains unprotected when clicked from an eligible message.

A matching detection creates an alert for the intended analyst audience. is evidence of another system state: A security analyst needs an alert when a targeted email threat policy detects repeated attacks. The acceptance evidence here instead is: A blocked malicious URL produces the appropriate Safe Links protection event.

The discovered-app list includes cloud usage not formally approved by IT. would assess a different control. In this case it does not rule out the specific failure: A known malicious link remains unprotected when clicked from an eligible message.

The inbound spam policy was tuned without considering legitimate sender behavior and quarantine review. would fit a different circumstance involving: A mail administrator wants to reduce inbound spam while preserving legitimate external partner mail. Here the actual symptom is: A known malicious link remains unprotected when clicked from an eligible message.

Collaboration workload evidence was not included in the incident investigation. is a plausible failure in another case: An analyst ignores the Teams-origin threat because only email inboxes were searched. It does not explain the current incident: A known malicious link remains unprotected when clicked from an eligible message.

The file indicator's block action or device applicability was configured incorrectly. would fit a different circumstance involving: A suspicious file hash must be blocked across eligible onboarded devices. Here the actual symptom is: A known malicious link remains unprotected when clicked from an eligible message.