Microsoft MS-102 Exam Dumps, Practice Test Questions

Create an alert policy with suitable activity condition, severity and recipient notification. is directed at a separate task: A security analyst needs an alert when a targeted email threat policy detects repeated attacks. It does not produce the required configuration outcome: The campaign results show training assigned to users who met the defined criterion.

Configure a supported Safe Attachments policy and action for the targeted mail users. implements a different mechanism for: An attacker sends booby-trapped attachments that require detonation before users open them. It does not configure the mechanism needed here: Configure training assignment logic in an Attack simulation training campaign.

Open the anomaly alert and examine IP, geography, timestamps and known benign causes. is directed at a separate task: An analyst sees an impossible-travel alert for a user with two distant sign-ins. It does not produce the required configuration outcome: The campaign results show training assigned to users who met the defined criterion.

A blocked malicious URL produces the appropriate Safe Links protection event. would assess a different control. In this case it does not rule out the specific failure: Employees who clicked a test lure never receive the planned education module.

The verified benign file follows an approved exception without opening broad bypasses. is evidence of another system state: A confirmed benign file is being repeatedly blocked by an overly broad detection. The acceptance evidence here instead is: The campaign results show training assigned to users who met the defined criterion.

The team identifies both the policy condition and the user action that triggered it. would assess a different control. In this case it does not rule out the specific failure: Employees who clicked a test lure never receive the planned education module.

The alert policy condition or notification scope does not match the event. would fit a different circumstance involving: A security analyst needs an alert when a targeted email threat policy detects repeated attacks. Here the actual symptom is: Employees who clicked a test lure never receive the planned education module.

Safe Attachments policy scope or action did not match the intended protection. is a plausible failure in another case: A suspicious attachment is delivered without the planned analysis behavior. It does not explain the current incident: Employees who clicked a test lure never receive the planned education module.

Related alerts were not correlated and triaged through the shared Defender XDR incident. would fit a different circumstance involving: A suspicious sign-in and an endpoint malware alert refer to the same compromised employee. Here the actual symptom is: Employees who clicked a test lure never receive the planned education module.

Configure training assignment logic in an Attack simulation training campaign. can be useful when a team wants to assign follow-up training to users who fail a controlled phishing simulation. However, it does not specifically achieve: The correction is reviewed while broad anti-phishing protection stays enabled.

Apply a narrowly scoped block using the supported Tenant Allow/Block List mechanism. addresses another administrative need: An email administrator needs to block a confirmed malicious sender domain during an active campaign. This question instead requires the outcome: The correction is reviewed while broad anti-phishing protection stays enabled.

Use Microsoft Secure Score and Microsoft Security Exposure Management recommendations for prioritization. can be useful when a chief information security officer wants a prioritized view of actionable security posture recommendations. However, it does not specifically achieve: The correction is reviewed while broad anti-phishing protection stays enabled.

Review the applicable post-delivery actions and remediation status for the affected messages. is directed at a separate task: A malicious attachment was delivered and later discovered to be harmful by updated protection. It does not produce the required configuration outcome: The correction is reviewed while broad anti-phishing protection stays enabled.

Submit the file for analysis and apply an eligible narrow allow if justified by evidence. implements a different mechanism for: A confirmed benign file is being repeatedly blocked by an overly broad detection. It does not configure the mechanism needed here: Use quarantined-message review and submission rather than disabling anti-phishing tenant-wide.

Review the recommended improvement actions and assign accountable owners for applicable controls. is directed at a separate task: A chief information security officer wants a prioritized view of actionable security posture recommendations. It does not produce the required configuration outcome: The correction is reviewed while broad anti-phishing protection stays enabled.

The campaign results show training assigned to users who met the defined criterion. would assess a different control. In this case it does not rule out the specific failure: Administrators disable phishing protections globally to release a single legitimate invoice.

Policy reporting shows the intended preset applies to eligible recipients. is evidence of another system state: The business wants a consistent baseline email protection configuration with minimal manual tuning. The acceptance evidence here instead is: The correction is reviewed while broad anti-phishing protection stays enabled.

The results show the relevant file action and initiating identity. would assess a different control. In this case it does not rule out the specific failure: Administrators disable phishing protections globally to release a single legitimate invoice.

The malicious domain was not blocked or was overridden by conflicting handling. would fit a different circumstance involving: An email administrator needs to block a confirmed malicious sender domain during an active campaign. Here the actual symptom is: Administrators disable phishing protections globally to release a single legitimate invoice.

The recipient or workload was outside the Safe Links policy scope. is a plausible failure in another case: A known malicious link remains unprotected when clicked from an eligible message. It does not explain the current incident: Administrators disable phishing protections globally to release a single legitimate invoice.

Alert-level status was confused with the parent incident lifecycle. would fit a different circumstance involving: A SOC analyst needs to distinguish one detection alert from the investigation case that groups related alerts. Here the actual symptom is: Administrators disable phishing protections globally to release a single legitimate invoice.

Review outbound anti-spam limits and the restricted-user response workflow. can be useful when a compromised account starts sending unusually large volumes of outbound spam. However, it does not specifically achieve: Subsequent in-scope messages receive the intended block verdict.

Protect high-value domains against impersonation with a scoped anti-phishing policy. addresses another administrative need: A global executive is frequently targeted by lookalike sending-domain impersonation. This question instead requires the outcome: Subsequent in-scope messages receive the intended block verdict.

Use a supported automated server onboarding deployment method. can be useful when a large fleet of Windows servers needs consistent Defender endpoint onboarding without manual portal actions. However, it does not specifically achieve: Subsequent in-scope messages receive the intended block verdict.

Configure a supported Safe Attachments policy and action for the targeted mail users. is directed at a separate task: An attacker sends booby-trapped attachments that require detonation before users open them. It does not produce the required configuration outcome: Subsequent in-scope messages receive the intended block verdict.

Create a phishing simulation with approved target users, payload and training assignment. implements a different mechanism for: Security wants employees to practice recognizing phishing messages without using actual attacker mail. It does not configure the mechanism needed here: Apply a narrowly scoped block using the supported Tenant Allow/Block List mechanism.

Build a hunting query with the relevant data source, fields and time window. is directed at a separate task: An SOC wants repeatable analysis of unusual data exfiltration event patterns rather than manual clicking for each alert. It does not produce the required configuration outcome: Subsequent in-scope messages receive the intended block verdict.

The correction is reviewed while broad anti-phishing protection stays enabled. would assess a different control. In this case it does not rule out the specific failure: Messages from a documented malicious sender still arrive after an ineffective allow exception.

The incident record connects the suspicious collaboration artifact to affected users. is evidence of another system state: A suspicious Teams collaboration link is reported and security needs the collaboration threat context. The acceptance evidence here instead is: Subsequent in-scope messages receive the intended block verdict.

The discovered-app list includes cloud usage not formally approved by IT. would assess a different control. In this case it does not rule out the specific failure: Messages from a documented malicious sender still arrive after an ineffective allow exception.

The alert policy condition or notification scope does not match the event. would fit a different circumstance involving: A security analyst needs an alert when a targeted email threat policy detects repeated attacks. Here the actual symptom is: Messages from a documented malicious sender still arrive after an ineffective allow exception.

The simulated campaign was not clearly scoped or separated from real incidents. is a plausible failure in another case: Users click a real phishing attack that was mistakenly treated as a simulation. It does not explain the current incident: Messages from a documented malicious sender still arrive after an ineffective allow exception.

The team never reviewed Defender endpoint software inventory and version evidence. would fit a different circumstance involving: A tenant wants to reduce risky applications by understanding installed software on managed endpoints. Here the actual symptom is: Messages from a documented malicious sender still arrive after an ineffective allow exception.