Microsoft MS-102 Exam Dumps, Practice Test Questions

Search the reported message and inspect its URL, authentication and delivery evidence. is directed at a separate task: An analyst is investigating one reported phishing message and needs sender, URL and recipient details. It does not produce the required configuration outcome: An exceeded outbound threshold generates an alert and appropriate sending restriction.

Configure a supported Safe Attachments policy and action for the targeted mail users. implements a different mechanism for: An attacker sends booby-trapped attachments that require detonation before users open them. It does not configure the mechanism needed here: Review outbound anti-spam limits and the restricted-user response workflow.

Use the appropriate email or URL click hunting table and correlation fields in advanced hunting. is directed at a separate task: An incident handler sees unusual email links and wants to correlate click telemetry with a specific phishing campaign. It does not produce the required configuration outcome: An exceeded outbound threshold generates an alert and appropriate sending restriction.

A blocked malicious URL produces the appropriate Safe Links protection event. would assess a different control. In this case it does not rule out the specific failure: The user remains able to send bulk spam while no administrator is notified.

Subsequent in-scope messages receive the intended block verdict. is evidence of another system state: An email administrator needs to block a confirmed malicious sender domain during an active campaign. The acceptance evidence here instead is: An exceeded outbound threshold generates an alert and appropriate sending restriction.

The case contains a traceable response history across identity and endpoint signals. would assess a different control. In this case it does not rule out the specific failure: The user remains able to send bulk spam while no administrator is notified.

The alert policy condition or notification scope does not match the event. would fit a different circumstance involving: A security analyst needs an alert when a targeted email threat policy detects repeated attacks. Here the actual symptom is: The user remains able to send bulk spam while no administrator is notified.

The restricted-sender state was cleared without resolving the underlying compromise. is a plausible failure in another case: An operator unblocks a compromised account before addressing credential theft. It does not explain the current incident: The user remains able to send bulk spam while no administrator is notified.

Asset inventory or data freshness was not reconciled with the exposure recommendation. would fit a different circumstance involving: A company wants to confirm whether exposure recommendations target obsolete or still-present assets. Here the actual symptom is: The user remains able to send bulk spam while no administrator is notified.

Apply a narrowly scoped block using the supported Tenant Allow/Block List mechanism. can be useful when an email administrator needs to block a confirmed malicious sender domain during an active campaign. However, it does not specifically achieve: A matching detection creates an alert for the intended analyst audience.

Investigate the cause and resolve restricted entity status only after remediation. addresses another administrative need: An infected mailbox account is placed in the Defender restricted entities list. This question instead requires the outcome: A matching detection creates an alert for the intended analyst audience.

Use supported Conditional Access App Control session policies where eligible. can be useful when a company wants to prevent sensitive file downloads during certain monitored cloud application sessions. However, it does not specifically achieve: A matching detection creates an alert for the intended analyst audience.

Review the applicable post-delivery actions and remediation status for the affected messages. is directed at a separate task: A malicious attachment was delivered and later discovered to be harmful by updated protection. It does not produce the required configuration outcome: A matching detection creates an alert for the intended analyst audience.

Configure the protected domain entries and corresponding phishing actions. implements a different mechanism for: A global executive is frequently targeted by lookalike sending-domain impersonation. It does not configure the mechanism needed here: Use Defender for Office 365 alert policies for the defined detection.

Mark the app sanctioned in Cloud Discovery with the approved governance process. is directed at a separate task: A discovered app is safe for a specific business group and should no longer be treated as shadow IT. It does not produce the required configuration outcome: A matching detection creates an alert for the intended analyst audience.

The remediated account is removed from the restricted list and can send appropriately. would assess a different control. In this case it does not rule out the specific failure: Repeated malicious-mail activity creates no alert despite the incident threshold being met.

A previously delivered harmful message is remediated according to available protection. is evidence of another system state: A malicious attachment was delivered and later discovered to be harmful by updated protection. The acceptance evidence here instead is: A matching detection creates an alert for the intended analyst audience.

The remediation owner can distinguish active exposure from a retired asset record. would assess a different control. In this case it does not rule out the specific failure: Repeated malicious-mail activity creates no alert despite the incident threshold being met.

The exception was broader or longer-lived than the verified false positive required. would fit a different circumstance involving: A confirmed benign file is being repeatedly blocked by an overly broad detection. Here the actual symptom is: Repeated malicious-mail activity creates no alert despite the incident threshold being met.

The recipient or workload was outside the Safe Links policy scope. is a plausible failure in another case: A known malicious link remains unprotected when clicked from an eligible message. It does not explain the current incident: Repeated malicious-mail activity creates no alert despite the incident threshold being met.

Endpoint sensor health was not differentiated from a healthy no-threat state. would fit a different circumstance involving: Security needs to diagnose why an onboarded laptop has stopped sending Defender telemetry. Here the actual symptom is: Repeated malicious-mail activity creates no alert despite the incident threshold being met.

Review outbound anti-spam limits and the restricted-user response workflow. can be useful when a compromised account starts sending unusually large volumes of outbound spam. However, it does not specifically achieve: The analyst identifies the delivery verdict and related recipients of the message.

Use appropriate inbound anti-spam policy thresholds and quarantine actions. addresses another administrative need: A mail administrator wants to reduce inbound spam while preserving legitimate external partner mail. This question instead requires the outcome: The analyst identifies the delivery verdict and related recipients of the message.

Create a well-scoped advanced-hunting query to identify the defined anomaly in available telemetry. can be useful when an SOC wants repeatable analysis of unusual data exfiltration event patterns rather than manual clicking for each alert. However, it does not specifically achieve: The analyst identifies the delivery verdict and related recipients of the message.

Configure applicable outbound spam policy notifications and investigate the affected account. is directed at a separate task: A compromised account starts sending unusually large volumes of outbound spam. It does not produce the required configuration outcome: The analyst identifies the delivery verdict and related recipients of the message.

Add the confirmed malicious domain to the appropriate blocked sender/domain entry. implements a different mechanism for: An email administrator needs to block a confirmed malicious sender domain during an active campaign. It does not configure the mechanism needed here: Use Defender for Office 365 investigation tools such as Explorer or email entity detail where licensed.

Integrate eligible endpoint discovery data for remote devices and validate ingestion. is directed at a separate task: An organization wants Cloud Discovery data for remote laptops that never traverse corporate firewalls. It does not produce the required configuration outcome: The analyst identifies the delivery verdict and related recipients of the message.

Forged messages receive an appropriate authentication/spoof verdict and action. would assess a different control. In this case it does not rule out the specific failure: The message is deleted before anyone records recipients or authentication evidence.

Subsequent in-scope messages receive the intended block verdict. is evidence of another system state: An email administrator needs to block a confirmed malicious sender domain during an active campaign. The acceptance evidence here instead is: The analyst identifies the delivery verdict and related recipients of the message.

Its discovered-app classification now reflects the organization's explicit approval. would assess a different control. In this case it does not rule out the specific failure: The message is deleted before anyone records recipients or authentication evidence.

The exception was broader or longer-lived than the verified false positive required. would fit a different circumstance involving: A confirmed benign file is being repeatedly blocked by an overly broad detection. Here the actual symptom is: The message is deleted before anyone records recipients or authentication evidence.

Spoof protection or authentication handling was not correctly applied to the domain. is a plausible failure in another case: Spoofed sender mail passes through because the applicable spoof policy was disabled. It does not explain the current incident: The message is deleted before anyone records recipients or authentication evidence.

The vulnerability remediation decision ignored actual impacted software inventory. would fit a different circumstance involving: A CVE affects one outdated application installed on a subset of corporate laptops. Here the actual symptom is: The message is deleted before anyone records recipients or authentication evidence.