Microsoft MS-102 Exam Dumps, Practice Test Questions

Create an alert policy with suitable activity condition, severity and recipient notification. is directed at a separate task: A security analyst needs an alert when a targeted email threat policy detects repeated attacks. It does not produce the required configuration outcome: Lookalike domain messages receive the expected policy verdict.

Create or scope a Defender for Office 365 Safe Links policy for the target users. implements a different mechanism for: Employees frequently click newly discovered malicious URLs in incoming emails. It does not configure the mechanism needed here: Protect high-value domains against impersonation with a scoped anti-phishing policy.

Inspect Defender device sensor status and applicable diagnostic connectivity logs. is directed at a separate task: Security needs to diagnose why an onboarded laptop has stopped sending Defender telemetry. It does not produce the required configuration outcome: Lookalike domain messages receive the expected policy verdict.

Policy reporting shows the intended preset applies to eligible recipients. would assess a different control. In this case it does not rule out the specific failure: A convincing lookalike domain is not detected because only a specific sender address was protected.

Subsequent in-scope messages receive the intended block verdict. is evidence of another system state: An email administrator needs to block a confirmed malicious sender domain during an active campaign. The acceptance evidence here instead is: Lookalike domain messages receive the expected policy verdict.

The hash indicator appears in applicable Defender policy and matching execution is blocked. would assess a different control. In this case it does not rule out the specific failure: A convincing lookalike domain is not detected because only a specific sender address was protected.

Post-delivery response configuration or remediation coverage is missing. would fit a different circumstance involving: A malicious attachment was delivered and later discovered to be harmful by updated protection. Here the actual symptom is: A convincing lookalike domain is not detected because only a specific sender address was protected.

Campaign correlation and common mail indicators were not examined. is a plausible failure in another case: The team treats each identical lure as an unrelated security event. It does not explain the current incident: A convincing lookalike domain is not detected because only a specific sender address was protected.

Policy alert context was not linked to its underlying activity evidence. would fit a different circumstance involving: Investigators must differentiate cloud app file-sharing policy alerts from raw individual user activities. Here the actual symptom is: A convincing lookalike domain is not detected because only a specific sender address was protected.

Investigate the cause and resolve restricted entity status only after remediation. can be useful when an infected mailbox account is placed in the Defender restricted entities list. However, it does not specifically achieve: An authorized reviewer can inspect the quarantined message within its retained window.

Use Defender for Office 365 alert policies for the defined detection. addresses another administrative need: A security analyst needs an alert when a targeted email threat policy detects repeated attacks. This question instead requires the outcome: An authorized reviewer can inspect the quarantined message within its retained window.

Use Cloud Discovery from supported endpoint or firewall/proxy telemetry. can be useful when security must discover unsanctioned cloud services used through corporate network traffic. However, it does not specifically achieve: An authorized reviewer can inspect the quarantined message within its retained window.

Add protected users or domains and apply the appropriate anti-phishing policy actions. is directed at a separate task: Users receive phishing messages impersonating the company's chief executive. It does not produce the required configuration outcome: An authorized reviewer can inspect the quarantined message within its retained window.

Review restricted entities, reset compromised credentials and unblock when safe. implements a different mechanism for: An infected mailbox account is placed in the Defender restricted entities list. It does not configure the mechanism needed here: Use quarantine management with supported retention and user/admin permissions.

Compare incident counts and true-positive/false-positive classifications for the same period. is directed at a separate task: A management dashboard must distinguish increasing threat volume from an increasing rate of false positives. It does not produce the required configuration outcome: An authorized reviewer can inspect the quarantined message within its retained window.

Subsequent in-scope messages receive the intended block verdict. would assess a different control. In this case it does not rule out the specific failure: A legitimate email is unrecoverable because the team assumed quarantine keeps it forever.

Related malicious messages are grouped by consistent campaign indicators. is evidence of another system state: A help desk sees multiple alerts for one mass-phishing campaign and needs to group messages by campaign. The acceptance evidence here instead is: An authorized reviewer can inspect the quarantined message within its retained window.

The investigation identifies relevant user evidence across linked workloads. would assess a different control. In this case it does not rule out the specific failure: A legitimate email is unrecoverable because the team assumed quarantine keeps it forever.

Collaboration workload evidence was not included in the incident investigation. would fit a different circumstance involving: A suspicious Teams collaboration link is reported and security needs the collaboration threat context. Here the actual symptom is: A legitimate email is unrecoverable because the team assumed quarantine keeps it forever.

Domain impersonation protection was not configured for the organizational domain. is a plausible failure in another case: A convincing lookalike domain is not detected because only a specific sender address was protected. It does not explain the current incident: A legitimate email is unrecoverable because the team assumed quarantine keeps it forever.

The team never reviewed Defender endpoint software inventory and version evidence. would fit a different circumstance involving: A tenant wants to reduce risky applications by understanding installed software on managed endpoints. Here the actual symptom is: A legitimate email is unrecoverable because the team assumed quarantine keeps it forever.

Use the supported security submission and time-limited allow workflow only after investigating. can be useful when a confirmed benign file is being repeatedly blocked by an overly broad detection. However, it does not specifically achieve: Policy reporting shows the intended preset applies to eligible recipients.

Apply a narrowly scoped block using the supported Tenant Allow/Block List mechanism. addresses another administrative need: An email administrator needs to block a confirmed malicious sender domain during an active campaign. This question instead requires the outcome: Policy reporting shows the intended preset applies to eligible recipients.

Review Cloud Discovery app risk scoring and usage evidence. can be useful when a manager asks which shadow SaaS application poses the greatest risk to the business. However, it does not specifically achieve: Policy reporting shows the intended preset applies to eligible recipients.

Submit the file for analysis and apply an eligible narrow allow if justified by evidence. is directed at a separate task: A confirmed benign file is being repeatedly blocked by an overly broad detection. It does not produce the required configuration outcome: Policy reporting shows the intended preset applies to eligible recipients.

Review spoof intelligence and configure the supported domain protections and actions. implements a different mechanism for: An email domain is being spoofed and the tenant wants better recognition of unauthenticated forged senders. It does not configure the mechanism needed here: Evaluate and apply an eligible Defender for Office 365 preset security policy.

Integrate eligible endpoint discovery data for remote devices and validate ingestion. is directed at a separate task: An organization wants Cloud Discovery data for remote laptops that never traverse corporate firewalls. It does not produce the required configuration outcome: Policy reporting shows the intended preset applies to eligible recipients.

The verified benign file follows an approved exception without opening broad bypasses. would assess a different control. In this case it does not rule out the specific failure: Users assume they are covered by Strict preset but the policy targets no one.

Forged messages receive an appropriate authentication/spoof verdict and action. is evidence of another system state: An email domain is being spoofed and the tenant wants better recognition of unauthenticated forged senders. The acceptance evidence here instead is: Policy reporting shows the intended preset applies to eligible recipients.

The device health view identifies the sensor or network communication problem. would assess a different control. In this case it does not rule out the specific failure: Users assume they are covered by Strict preset but the policy targets no one.

The inbound spam policy was tuned without considering legitimate sender behavior and quarantine review. would fit a different circumstance involving: A mail administrator wants to reduce inbound spam while preserving legitimate external partner mail. Here the actual symptom is: Users assume they are covered by Strict preset but the policy targets no one.

Spoof protection or authentication handling was not correctly applied to the domain. is a plausible failure in another case: Spoofed sender mail passes through because the applicable spoof policy was disabled. It does not explain the current incident: Users assume they are covered by Strict preset but the policy targets no one.

The onboarding deployment mechanism did not reach or enroll the servers. would fit a different circumstance involving: A large fleet of Windows servers needs consistent Defender endpoint onboarding without manual portal actions. Here the actual symptom is: Users assume they are covered by Strict preset but the policy targets no one.