Microsoft MS-102 Exam Dumps, Practice Test Questions

Quarantine lifecycle or retention behavior was misunderstood. would fit a different circumstance involving: A team needs to distinguish email quarantine retention from deleting messages permanently. Here the actual symptom is: Provisioned computers are assumed protected because the company owns them.

Hunting filters failed to constrain the data source, time window or detection logic. is a plausible failure in another case: An investigator uses an unrestricted all-time query and mistakes old benign events for the incident. It does not explain the current incident: Provisioned computers are assumed protected because the company owns them.

Policy tuning was replaced with a broad protection shutdown. would fit a different circumstance involving: The security team wants a repeatable review of Cloud Apps policies that produced many false alarms. Here the actual symptom is: Provisioned computers are assumed protected because the company owns them.

Use supported endpoint-derived discovery telemetry rather than relying solely on a headquarters proxy. can be useful when an organization wants Cloud Discovery data for remote laptops that never traverse corporate firewalls. However, it does not specifically achieve: The connector reports a healthy connection and eligible activity becomes available.

Use Cloud Discovery from supported endpoint or firewall/proxy telemetry. addresses another administrative need: Security must discover unsanctioned cloud services used through corporate network traffic. This question instead requires the outcome: The connector reports a healthy connection and eligible activity becomes available.

Use appropriate inbound anti-spam policy thresholds and quarantine actions. can be useful when a mail administrator wants to reduce inbound spam while preserving legitimate external partner mail. However, it does not specifically achieve: The connector reports a healthy connection and eligible activity becomes available.

Inspect discovered apps, app risk indicators and associated user/traffic patterns. is directed at a separate task: A manager asks which shadow SaaS application poses the greatest risk to the business. It does not produce the required configuration outcome: The connector reports a healthy connection and eligible activity becomes available.

Configure the supported Cloud Discovery data source and analyze discovered services. implements a different mechanism for: Security must discover unsanctioned cloud services used through corporate network traffic. It does not configure the mechanism needed here: Configure the supported Microsoft 365 app connector in Defender for Cloud Apps.

Review the recommendation details and the devices/resources still reported as exposed. is directed at a separate task: A company wants to confirm whether exposure recommendations target obsolete or still-present assets. It does not produce the required configuration outcome: The connector reports a healthy connection and eligible activity becomes available.

Eligible sessions are controlled and the disallowed download action is blocked. would assess a different control. In this case it does not rule out the specific failure: Microsoft 365 app activities never arrive in Cloud Apps after an incomplete connector wizard.

The app appears classified as unsanctioned and eligible enforcement blocks its use. is evidence of another system state: A company wants to mark an investigated cloud app as prohibited for corporate use. The acceptance evidence here instead is: The connector reports a healthy connection and eligible activity becomes available.

The remediated account is removed from the restricted list and can send appropriately. would assess a different control. In this case it does not rule out the specific failure: Microsoft 365 app activities never arrive in Cloud Apps after an incomplete connector wizard.

Conditional Access App Control session routing or applicability was not configured. would fit a different circumstance involving: A company wants to prevent sensitive file downloads during certain monitored cloud application sessions. Here the actual symptom is: Microsoft 365 app activities never arrive in Cloud Apps after an incomplete connector wizard.

Cloud Discovery lacks the supported network or endpoint telemetry source. is a plausible failure in another case: A shadow SaaS service remains invisible because no traffic source is connected. It does not explain the current incident: Microsoft 365 app activities never arrive in Cloud Apps after an incomplete connector wizard.

The exception was broader or longer-lived than the verified false positive required. would fit a different circumstance involving: A confirmed benign file is being repeatedly blocked by an overly broad detection. Here the actual symptom is: Microsoft 365 app activities never arrive in Cloud Apps after an incomplete connector wizard.

Use discovered app usage drilldowns with user and source evidence. can be useful when a Cloud Discovery report shows a risky service but the team needs to know which employees used it. However, it does not specifically achieve: A qualifying login pattern creates a Cloud Apps policy alert.

Apply an Unsanctioned tag to the discovered app with appropriate enforcement integration. addresses another administrative need: A company wants to mark an investigated cloud app as prohibited for corporate use. This question instead requires the outcome: A qualifying login pattern creates a Cloud Apps policy alert.

Prioritize remediation using vulnerability exposure and affected device evidence. can be useful when a CVE affects one outdated application installed on a subset of corporate laptops. However, it does not specifically achieve: A qualifying login pattern creates a Cloud Apps policy alert.

Mark the app sanctioned in Cloud Discovery with the approved governance process. is directed at a separate task: A discovered app is safe for a specific business group and should no longer be treated as shadow IT. It does not produce the required configuration outcome: A qualifying login pattern creates a Cloud Apps policy alert.

Inspect discovered apps, app risk indicators and associated user/traffic patterns. implements a different mechanism for: A manager asks which shadow SaaS application poses the greatest risk to the business. It does not configure the mechanism needed here: Create an applicable anomaly or activity policy in Defender for Cloud Apps.

Inspect vulnerability details and generate the list of impacted software installations. is directed at a separate task: A CVE affects one outdated application installed on a subset of corporate laptops. It does not produce the required configuration outcome: A qualifying login pattern creates a Cloud Apps policy alert.

Its discovered-app classification now reflects the organization's explicit approval. would assess a different control. In this case it does not rule out the specific failure: Repeated unusual failed logins appear in the activity log but no alert is generated.

The discovered-app list includes cloud usage not formally approved by IT. is evidence of another system state: Security must discover unsanctioned cloud services used through corporate network traffic. The acceptance evidence here instead is: A qualifying login pattern creates a Cloud Apps policy alert.

A blocked malicious URL produces the appropriate Safe Links protection event. would assess a different control. In this case it does not rule out the specific failure: Repeated unusual failed logins appear in the activity log but no alert is generated.

Cloud Discovery lacks the supported network or endpoint telemetry source. would fit a different circumstance involving: Security must discover unsanctioned cloud services used through corporate network traffic. Here the actual symptom is: Repeated unusual failed logins appear in the activity log but no alert is generated.

Conditional Access App Control session routing or applicability was not configured. is a plausible failure in another case: A policy was defined but the browser session never reached Cloud Apps controls. It does not explain the current incident: Repeated unusual failed logins appear in the activity log but no alert is generated.

Post-delivery response configuration or remediation coverage is missing. would fit a different circumstance involving: A malicious attachment was delivered and later discovered to be harmful by updated protection. Here the actual symptom is: Repeated unusual failed logins appear in the activity log but no alert is generated.

Review Cloud Discovery app risk scoring and usage evidence. can be useful when a manager asks which shadow SaaS application poses the greatest risk to the business. However, it does not specifically achieve: The results show the relevant file action and initiating identity.

Use discovered app usage drilldowns with user and source evidence. addresses another administrative need: A Cloud Discovery report shows a risky service but the team needs to know which employees used it. This question instead requires the outcome: The results show the relevant file action and initiating identity.

Use Microsoft Secure Score and Microsoft Security Exposure Management recommendations for prioritization. can be useful when a chief information security officer wants a prioritized view of actionable security posture recommendations. However, it does not specifically achieve: The results show the relevant file action and initiating identity.

Integrate eligible endpoint discovery data for remote devices and validate ingestion. is directed at a separate task: An organization wants Cloud Discovery data for remote laptops that never traverse corporate firewalls. It does not produce the required configuration outcome: The results show the relevant file action and initiating identity.

Set the discovered app as unsanctioned and integrate supported blocking controls. implements a different mechanism for: A company wants to mark an investigated cloud app as prohibited for corporate use. It does not configure the mechanism needed here: Search Defender for Cloud Apps activity logs by action and user context.

Review onboarding and sensor-health reports for the newly provisioned cohort. is directed at a separate task: Security wants to track whether the Defender endpoint agent is enabled on recently provisioned machines. It does not produce the required configuration outcome: The results show the relevant file action and initiating identity.