Microsoft MS-102 Exam Dumps, Practice Test Questions

The alert policy condition or notification scope does not match the event. would fit a different circumstance involving: A security analyst needs an alert when a targeted email threat policy detects repeated attacks. Here the actual symptom is: Messages from a documented malicious sender still arrive after an ineffective allow exception.

The simulated campaign was not clearly scoped or separated from real incidents. is a plausible failure in another case: Users click a real phishing attack that was mistakenly treated as a simulation. It does not explain the current incident: Messages from a documented malicious sender still arrive after an ineffective allow exception.

The team never reviewed Defender endpoint software inventory and version evidence. would fit a different circumstance involving: A tenant wants to reduce risky applications by understanding installed software on managed endpoints. Here the actual symptom is: Messages from a documented malicious sender still arrive after an ineffective allow exception.

Use quarantine management with supported retention and user/admin permissions. can be useful when a team needs to distinguish email quarantine retention from deleting messages permanently. However, it does not specifically achieve: The verified benign file follows an approved exception without opening broad bypasses.

Use appropriate inbound anti-spam policy thresholds and quarantine actions. addresses another administrative need: A mail administrator wants to reduce inbound spam while preserving legitimate external partner mail. This question instead requires the outcome: The verified benign file follows an approved exception without opening broad bypasses.

Search Defender for Cloud Apps activity logs by action and user context. can be useful when an analyst needs to see which administrator downloaded sensitive files from a connected cloud application. However, it does not specifically achieve: The verified benign file follows an approved exception without opening broad bypasses.

Set an appropriate quarantine policy for the relevant detection class. is directed at a separate task: A team needs to distinguish email quarantine retention from deleting messages permanently. It does not produce the required configuration outcome: The verified benign file follows an approved exception without opening broad bypasses.

Inspect email campaign metadata and related messages in the investigation view. implements a different mechanism for: A help desk sees multiple alerts for one mass-phishing campaign and needs to group messages by campaign. It does not configure the mechanism needed here: Use the supported security submission and time-limited allow workflow only after investigating.

Review the connector status and renew required authorization or permissions. is directed at a separate task: An app connector stopped reporting events after credentials or permissions changed. It does not produce the required configuration outcome: The verified benign file follows an approved exception without opening broad bypasses.

Spam verdicts follow the selected handling while partner false positives can be reviewed. would assess a different control. In this case it does not rule out the specific failure: An unrestricted tenant-wide bypass lets unrelated malicious attachments through.

A known malicious attachment is blocked or isolated according to the policy. is evidence of another system state: An attacker sends booby-trapped attachments that require detonation before users open them. The acceptance evidence here instead is: The verified benign file follows an approved exception without opening broad bypasses.

The indicator is correlated with threat context and the affected tenant entities. would assess a different control. In this case it does not rule out the specific failure: An unrestricted tenant-wide bypass lets unrelated malicious attachments through.

Spoof protection or authentication handling was not correctly applied to the domain. would fit a different circumstance involving: An email domain is being spoofed and the tenant wants better recognition of unauthenticated forged senders. Here the actual symptom is: An unrestricted tenant-wide bypass lets unrelated malicious attachments through.

A per-message false positive was handled as a tenant-wide policy override. is a plausible failure in another case: Administrators disable phishing protections globally to release a single legitimate invoice. It does not explain the current incident: An unrestricted tenant-wide bypass lets unrelated malicious attachments through.

The app was not formally marked unsanctioned in Cloud Apps policy workflow. would fit a different circumstance involving: A company wants to mark an investigated cloud app as prohibited for corporate use. Here the actual symptom is: An unrestricted tenant-wide bypass lets unrelated malicious attachments through.

Use Defender for Office 365 campaign investigation context where available. can be useful when a help desk sees multiple alerts for one mass-phishing campaign and needs to group messages by campaign. However, it does not specifically achieve: The remediated account is removed from the restricted list and can send appropriately.

Use Defender for Office 365 Attack simulation training for a controlled exercise. addresses another administrative need: Security wants employees to practice recognizing phishing messages without using actual attacker mail. This question instead requires the outcome: The remediated account is removed from the restricted list and can send appropriately.

Create a well-scoped advanced-hunting query to identify the defined anomaly in available telemetry. can be useful when an SOC wants repeatable analysis of unusual data exfiltration event patterns rather than manual clicking for each alert. However, it does not specifically achieve: The remediated account is removed from the restricted list and can send appropriately.

Add protected users or domains and apply the appropriate anti-phishing policy actions. is directed at a separate task: Users receive phishing messages impersonating the company's chief executive. It does not produce the required configuration outcome: The remediated account is removed from the restricted list and can send appropriately.

Add the confirmed malicious domain to the appropriate blocked sender/domain entry. implements a different mechanism for: An email administrator needs to block a confirmed malicious sender domain during an active campaign. It does not configure the mechanism needed here: Investigate the cause and resolve restricted entity status only after remediation.

Initiate isolation from the Defender device action workflow and record the action. is directed at a separate task: A compromised laptop must be isolated from ordinary network communication while allowing response investigation. It does not produce the required configuration outcome: The remediated account is removed from the restricted list and can send appropriately.

Forged messages receive an appropriate authentication/spoof verdict and action. would assess a different control. In this case it does not rule out the specific failure: An operator unblocks a compromised account before addressing credential theft.

Policy reporting shows the intended preset applies to eligible recipients. is evidence of another system state: The business wants a consistent baseline email protection configuration with minimal manual tuning. The acceptance evidence here instead is: The remediated account is removed from the restricted list and can send appropriately.

The timeline identifies who isolated or remediated the affected device and when. would assess a different control. In this case it does not rule out the specific failure: An operator unblocks a compromised account before addressing credential theft.

Domain impersonation protection was not configured for the organizational domain. would fit a different circumstance involving: A global executive is frequently targeted by lookalike sending-domain impersonation. Here the actual symptom is: An operator unblocks a compromised account before addressing credential theft.

The training assignment or campaign follow-up rule was omitted. is a plausible failure in another case: Employees who clicked a test lure never receive the planned education module. It does not explain the current incident: An operator unblocks a compromised account before addressing credential theft.

The vulnerability remediation decision ignored actual impacted software inventory. would fit a different circumstance involving: A CVE affects one outdated application installed on a subset of corporate laptops. Here the actual symptom is: An operator unblocks a compromised account before addressing credential theft.

Use Defender for Office 365 alert policies for the defined detection. can be useful when a security analyst needs an alert when a targeted email threat policy detects repeated attacks. However, it does not specifically achieve: Lookalike domain messages receive the expected policy verdict.

Use supported post-delivery remediation such as Zero-hour Auto Purge where applicable. addresses another administrative need: A malicious attachment was delivered and later discovered to be harmful by updated protection. This question instead requires the outcome: Lookalike domain messages receive the expected policy verdict.

Create a well-scoped advanced-hunting query to identify the defined anomaly in available telemetry. can be useful when an SOC wants repeatable analysis of unusual data exfiltration event patterns rather than manual clicking for each alert. However, it does not specifically achieve: Lookalike domain messages receive the expected policy verdict.

Create an alert policy with suitable activity condition, severity and recipient notification. is directed at a separate task: A security analyst needs an alert when a targeted email threat policy detects repeated attacks. It does not produce the required configuration outcome: Lookalike domain messages receive the expected policy verdict.

Create or scope a Defender for Office 365 Safe Links policy for the target users. implements a different mechanism for: Employees frequently click newly discovered malicious URLs in incoming emails. It does not configure the mechanism needed here: Protect high-value domains against impersonation with a scoped anti-phishing policy.

Inspect Defender device sensor status and applicable diagnostic connectivity logs. is directed at a separate task: Security needs to diagnose why an onboarded laptop has stopped sending Defender telemetry. It does not produce the required configuration outcome: Lookalike domain messages receive the expected policy verdict.