Microsoft MS-102 Exam Dumps, Practice Test Questions

The inbound spam policy was tuned without considering legitimate sender behavior and quarantine review. would fit a different circumstance involving: A mail administrator wants to reduce inbound spam while preserving legitimate external partner mail. Here the actual symptom is: A known malicious link remains unprotected when clicked from an eligible message.

Collaboration workload evidence was not included in the incident investigation. is a plausible failure in another case: An analyst ignores the Teams-origin threat because only email inboxes were searched. It does not explain the current incident: A known malicious link remains unprotected when clicked from an eligible message.

The file indicator's block action or device applicability was configured incorrectly. would fit a different circumstance involving: A suspicious file hash must be blocked across eligible onboarded devices. Here the actual symptom is: A known malicious link remains unprotected when clicked from an eligible message.

Use quarantined-message review and submission rather than disabling anti-phishing tenant-wide. can be useful when a legitimate sender's recurring invoices are quarantined as phishing and the team needs a safe review workflow. However, it does not specifically achieve: A known malicious attachment is blocked or isolated according to the policy.

Use the supported security submission and time-limited allow workflow only after investigating. addresses another administrative need: A confirmed benign file is being repeatedly blocked by an overly broad detection. This question instead requires the outcome: A known malicious attachment is blocked or isolated according to the policy.

Use supported endpoint-derived discovery telemetry rather than relying solely on a headquarters proxy. can be useful when an organization wants Cloud Discovery data for remote laptops that never traverse corporate firewalls. However, it does not specifically achieve: A known malicious attachment is blocked or isolated according to the policy.

Add the confirmed malicious domain to the appropriate blocked sender/domain entry. is directed at a separate task: An email administrator needs to block a confirmed malicious sender domain during an active campaign. It does not produce the required configuration outcome: A known malicious attachment is blocked or isolated according to the policy.

Configure applicable outbound spam policy notifications and investigate the affected account. implements a different mechanism for: A compromised account starts sending unusually large volumes of outbound spam. It does not configure the mechanism needed here: Use Defender for Office 365 Safe Attachments for applicable recipients.

Review onboarding and sensor-health reports for the newly provisioned cohort. is directed at a separate task: Security wants to track whether the Defender endpoint agent is enabled on recently provisioned machines. It does not produce the required configuration outcome: A known malicious attachment is blocked or isolated according to the policy.

An exceeded outbound threshold generates an alert and appropriate sending restriction. would assess a different control. In this case it does not rule out the specific failure: A suspicious attachment is delivered without the planned analysis behavior.

Forged messages receive an appropriate authentication/spoof verdict and action. is evidence of another system state: An email domain is being spoofed and the tenant wants better recognition of unauthenticated forged senders. The acceptance evidence here instead is: A known malicious attachment is blocked or isolated according to the policy.

The device reports onboarded status and begins sending endpoint telemetry. would assess a different control. In this case it does not rule out the specific failure: A suspicious attachment is delivered without the planned analysis behavior.

Domain impersonation protection was not configured for the organizational domain. would fit a different circumstance involving: A global executive is frequently targeted by lookalike sending-domain impersonation. Here the actual symptom is: A suspicious attachment is delivered without the planned analysis behavior.

Spoof protection or authentication handling was not correctly applied to the domain. is a plausible failure in another case: Spoofed sender mail passes through because the applicable spoof policy was disabled. It does not explain the current incident: A suspicious attachment is delivered without the planned analysis behavior.

The vulnerability remediation decision ignored actual impacted software inventory. would fit a different circumstance involving: A CVE affects one outdated application installed on a subset of corporate laptops. Here the actual symptom is: A suspicious attachment is delivered without the planned analysis behavior.

Configure Defender for Office 365 anti-phishing impersonation protection for supported recipients. can be useful when users receive phishing messages impersonating the company's chief executive. However, it does not specifically achieve: Spam verdicts follow the selected handling while partner false positives can be reviewed.

Use supported post-delivery remediation such as Zero-hour Auto Purge where applicable. addresses another administrative need: A malicious attachment was delivered and later discovered to be harmful by updated protection. This question instead requires the outcome: Spam verdicts follow the selected handling while partner false positives can be reviewed.

Compare onboarded devices against expected device inventory and sensor-health status. can be useful when security wants to track whether the Defender endpoint agent is enabled on recently provisioned machines. However, it does not specifically achieve: Spam verdicts follow the selected handling while partner false positives can be reviewed.

Select an eligible training module and assign it to the chosen simulation participant group. is directed at a separate task: A team wants to assign follow-up training to users who fail a controlled phishing simulation. It does not produce the required configuration outcome: Spam verdicts follow the selected handling while partner false positives can be reviewed.

Add the confirmed malicious domain to the appropriate blocked sender/domain entry. implements a different mechanism for: An email administrator needs to block a confirmed malicious sender domain during an active campaign. It does not configure the mechanism needed here: Use appropriate inbound anti-spam policy thresholds and quarantine actions.

Compare targeted device groups, policy status and actual endpoint protection configuration. is directed at a separate task: A Defender endpoint configuration appears deployed, but the devices are still in an unsafe state. It does not produce the required configuration outcome: Spam verdicts follow the selected handling while partner false positives can be reviewed.

A known malicious attachment is blocked or isolated according to the policy. would assess a different control. In this case it does not rule out the specific failure: All partner messages are discarded after an aggressive spam setting change.

A previously delivered harmful message is remediated according to available protection. is evidence of another system state: A malicious attachment was delivered and later discovered to be harmful by updated protection. The acceptance evidence here instead is: Spam verdicts follow the selected handling while partner false positives can be reviewed.

All intended machines show onboarded and healthy Defender sensor status. would assess a different control. In this case it does not rule out the specific failure: All partner messages are discarded after an aggressive spam setting change.

Campaign correlation and common mail indicators were not examined. would fit a different circumstance involving: A help desk sees multiple alerts for one mass-phishing campaign and needs to group messages by campaign. Here the actual symptom is: All partner messages are discarded after an aggressive spam setting change.

The simulated campaign was not clearly scoped or separated from real incidents. is a plausible failure in another case: Users click a real phishing attack that was mistakenly treated as a simulation. It does not explain the current incident: All partner messages are discarded after an aggressive spam setting change.

The response ignored cross-workload identity remediation even though the incident involved token theft. would fit a different circumstance involving: A security analyst finds evidence of token theft and must preserve the cross-domain case context. Here the actual symptom is: All partner messages are discarded after an aggressive spam setting change.

Use quarantine management with supported retention and user/admin permissions. can be useful when a team needs to distinguish email quarantine retention from deleting messages permanently. However, it does not specifically achieve: An exceeded outbound threshold generates an alert and appropriate sending restriction.

Protect high-value domains against impersonation with a scoped anti-phishing policy. addresses another administrative need: A global executive is frequently targeted by lookalike sending-domain impersonation. This question instead requires the outcome: An exceeded outbound threshold generates an alert and appropriate sending restriction.

Confirm policy applicability and device reported settings rather than relying on deployment intent. can be useful when a Defender endpoint configuration appears deployed, but the devices are still in an unsafe state. However, it does not specifically achieve: An exceeded outbound threshold generates an alert and appropriate sending restriction.

Search the reported message and inspect its URL, authentication and delivery evidence. is directed at a separate task: An analyst is investigating one reported phishing message and needs sender, URL and recipient details. It does not produce the required configuration outcome: An exceeded outbound threshold generates an alert and appropriate sending restriction.

Configure a supported Safe Attachments policy and action for the targeted mail users. implements a different mechanism for: An attacker sends booby-trapped attachments that require detonation before users open them. It does not configure the mechanism needed here: Review outbound anti-spam limits and the restricted-user response workflow.

Use the appropriate email or URL click hunting table and correlation fields in advanced hunting. is directed at a separate task: An incident handler sees unusual email links and wants to correlate click telemetry with a specific phishing campaign. It does not produce the required configuration outcome: An exceeded outbound threshold generates an alert and appropriate sending restriction.