Microsoft MS-102 Exam Dumps, Practice Test Questions

Integrate eligible endpoint discovery data for remote devices and validate ingestion. is directed at a separate task: An organization wants Cloud Discovery data for remote laptops that never traverse corporate firewalls. It does not produce the required configuration outcome: The results show the relevant file action and initiating identity.

Set the discovered app as unsanctioned and integrate supported blocking controls. implements a different mechanism for: A company wants to mark an investigated cloud app as prohibited for corporate use. It does not configure the mechanism needed here: Search Defender for Cloud Apps activity logs by action and user context.

Review onboarding and sensor-health reports for the newly provisioned cohort. is directed at a separate task: Security wants to track whether the Defender endpoint agent is enabled on recently provisioned machines. It does not produce the required configuration outcome: The results show the relevant file action and initiating identity.

The discovered-app report reflects cloud usage from off-network endpoints. would assess a different control. In this case it does not rule out the specific failure: The team cannot connect a suspicious download to a specific user.

The review distinguishes high-risk applications from approved low-risk services. is evidence of another system state: A manager asks which shadow SaaS application poses the greatest risk to the business. The acceptance evidence here instead is: The results show the relevant file action and initiating identity.

The remediation owner can distinguish active exposure from a retired asset record. would assess a different control. In this case it does not rule out the specific failure: The team cannot connect a suspicious download to a specific user.

Cloud Discovery lacks the supported network or endpoint telemetry source. would fit a different circumstance involving: Security must discover unsanctioned cloud services used through corporate network traffic. Here the actual symptom is: The team cannot connect a suspicious download to a specific user.

The discovered app classification was not updated after the security review. is a plausible failure in another case: Approved business software continues to be flagged as an unsanctioned exception. It does not explain the current incident: The team cannot connect a suspicious download to a specific user.

Post-delivery response configuration or remediation coverage is missing. would fit a different circumstance involving: A malicious attachment was delivered and later discovered to be harmful by updated protection. Here the actual symptom is: The team cannot connect a suspicious download to a specific user.

Investigate the Cloud Apps anomaly with user and session evidence. can be useful when an analyst sees an impossible-travel alert for a user with two distant sign-ins. However, it does not specifically achieve: The discovered-app list includes cloud usage not formally approved by IT.

Configure the supported Microsoft 365 app connector in Defender for Cloud Apps. addresses another administrative need: Security wants Microsoft Defender for Cloud Apps to access supported Microsoft 365 activity using an application connector. This question instead requires the outcome: The discovered-app list includes cloud usage not formally approved by IT.

Use Microsoft Secure Score and Microsoft Security Exposure Management recommendations for prioritization. can be useful when a chief information security officer wants a prioritized view of actionable security posture recommendations. However, it does not specifically achieve: The discovered-app list includes cloud usage not formally approved by IT.

Configure Conditional Access routing and a Cloud Apps session policy for the target app. is directed at a separate task: A company wants to prevent sensitive file downloads during certain monitored cloud application sessions. It does not produce the required configuration outcome: The discovered-app list includes cloud usage not formally approved by IT.

Create a policy targeting public or external sharing with appropriate scope and alerts. implements a different mechanism for: A SaaS security owner wants to monitor files shared publicly from a connected cloud application. It does not configure the mechanism needed here: Use Cloud Discovery from supported endpoint or firewall/proxy telemetry.

Initiate isolation from the Defender device action workflow and record the action. is directed at a separate task: A compromised laptop must be isolated from ordinary network communication while allowing response investigation. It does not produce the required configuration outcome: The discovered-app list includes cloud usage not formally approved by IT.

False positive alerts decline without suppressing the core suspicious behavior. would assess a different control. In this case it does not rule out the specific failure: A shadow SaaS service remains invisible because no traffic source is connected.

The team identifies both the policy condition and the user action that triggered it. is evidence of another system state: Investigators must differentiate cloud app file-sharing policy alerts from raw individual user activities. The acceptance evidence here instead is: The discovered-app list includes cloud usage not formally approved by IT.

All intended machines show onboarded and healthy Defender sensor status. would assess a different control. In this case it does not rule out the specific failure: A shadow SaaS service remains invisible because no traffic source is connected.

The Microsoft 365 app connector was not fully authorized or enabled. would fit a different circumstance involving: Security wants Microsoft Defender for Cloud Apps to access supported Microsoft 365 activity using an application connector. Here the actual symptom is: A shadow SaaS service remains invisible because no traffic source is connected.

OAuth application permission grants were never reviewed in the cloud app security process. is a plausible failure in another case: A third-party app retains broad mailbox access without security review. It does not explain the current incident: A shadow SaaS service remains invisible because no traffic source is connected.

Exposure inventory was confused with event-by-event endpoint timeline telemetry. would fit a different circumstance involving: An endpoint security analyst wants to inspect the processes that executed before a malware incident. Here the actual symptom is: A shadow SaaS service remains invisible because no traffic source is connected.

Use discovered app usage drilldowns with user and source evidence. can be useful when a Cloud Discovery report shows a risky service but the team needs to know which employees used it. However, it does not specifically achieve: The review distinguishes high-risk applications from approved low-risk services.

Use supported Conditional Access App Control session policies where eligible. addresses another administrative need: A company wants to prevent sensitive file downloads during certain monitored cloud application sessions. This question instead requires the outcome: The review distinguishes high-risk applications from approved low-risk services.

Configure Defender for Office 365 anti-phishing impersonation protection for supported recipients. can be useful when users receive phishing messages impersonating the company's chief executive. However, it does not specifically achieve: The review distinguishes high-risk applications from approved low-risk services.

Configure a policy matching the failed-login pattern and choose an alert action. is directed at a separate task: A Cloud Apps administrator wants alerts for an unusual number of failed user logins. It does not produce the required configuration outcome: The review distinguishes high-risk applications from approved low-risk services.

Review matching events and adjust narrowly defined rules or exclusions. implements a different mechanism for: The security team wants a repeatable review of Cloud Apps policies that produced many false alarms. It does not configure the mechanism needed here: Review Cloud Discovery app risk scoring and usage evidence.

Run a focused hunting query over the supported DeviceProcessEvents schema and time range. is directed at a separate task: A responder needs to search raw endpoint events for a suspicious process execution across many devices. It does not produce the required configuration outcome: The review distinguishes high-risk applications from approved low-risk services.

A newly public file triggers the intended security signal. would assess a different control. In this case it does not rule out the specific failure: All unapproved apps are treated as identical risk regardless of their activity and characteristics.

The incident disposition records whether the impossible travel signal represents a real risk. is evidence of another system state: An analyst sees an impossible-travel alert for a user with two distant sign-ins. The acceptance evidence here instead is: The review distinguishes high-risk applications from approved low-risk services.

The timeline identifies who isolated or remediated the affected device and when. would assess a different control. In this case it does not rule out the specific failure: All unapproved apps are treated as identical risk regardless of their activity and characteristics.

The app connector became unhealthy after the permission change. would fit a different circumstance involving: An app connector stopped reporting events after credentials or permissions changed. Here the actual symptom is: All unapproved apps are treated as identical risk regardless of their activity and characteristics.

The discovered app classification was not updated after the security review. is a plausible failure in another case: Approved business software continues to be flagged as an unsanctioned exception. It does not explain the current incident: All unapproved apps are treated as identical risk regardless of their activity and characteristics.

The email investigation skipped the relevant message/entity evidence. would fit a different circumstance involving: An analyst is investigating one reported phishing message and needs sender, URL and recipient details. Here the actual symptom is: All unapproved apps are treated as identical risk regardless of their activity and characteristics.