Microsoft MS-102 Exam Dumps, Practice Test Questions

The app connector became unhealthy after the permission change. would fit a different circumstance involving: An app connector stopped reporting events after credentials or permissions changed. Here the actual symptom is: All unapproved apps are treated as identical risk regardless of their activity and characteristics.

The discovered app classification was not updated after the security review. is a plausible failure in another case: Approved business software continues to be flagged as an unsanctioned exception. It does not explain the current incident: All unapproved apps are treated as identical risk regardless of their activity and characteristics.

The email investigation skipped the relevant message/entity evidence. would fit a different circumstance involving: An analyst is investigating one reported phishing message and needs sender, URL and recipient details. Here the actual symptom is: All unapproved apps are treated as identical risk regardless of their activity and characteristics.

Use Defender for Cloud Apps OAuth application governance and consent review features where supported. can be useful when security needs to identify cloud applications receiving broad OAuth permissions from employees. However, it does not specifically achieve: The app appears classified as unsanctioned and eligible enforcement blocks its use.

Tune policy conditions based on actual Cloud Apps alert dispositions. addresses another administrative need: The security team wants a repeatable review of Cloud Apps policies that produced many false alarms. This question instead requires the outcome: The app appears classified as unsanctioned and eligible enforcement blocks its use.

Review endpoint sensor health and connectivity before assuming the device is clean. can be useful when security needs to diagnose why an onboarded laptop has stopped sending Defender telemetry. However, it does not specifically achieve: The app appears classified as unsanctioned and eligible enforcement blocks its use.

Mark the app sanctioned in Cloud Discovery with the approved governance process. is directed at a separate task: A discovered app is safe for a specific business group and should no longer be treated as shadow IT. It does not produce the required configuration outcome: The app appears classified as unsanctioned and eligible enforcement blocks its use.

Connect the Microsoft 365 service with appropriate permissions in the app connectors area. implements a different mechanism for: Security wants Microsoft Defender for Cloud Apps to access supported Microsoft 365 activity using an application connector. It does not configure the mechanism needed here: Apply an Unsanctioned tag to the discovered app with appropriate enforcement integration.

Deploy the Defender for Endpoint onboarding configuration through Intune or another supported tool. is directed at a separate task: A newly managed Windows laptop needs to appear in the Microsoft Defender for Endpoint device inventory. It does not produce the required configuration outcome: The app appears classified as unsanctioned and eligible enforcement blocks its use.

The team identifies both the policy condition and the user action that triggered it. would assess a different control. In this case it does not rule out the specific failure: An app is only discussed in email but remains unclassified in Cloud Discovery.

The discovered-app report reflects cloud usage from off-network endpoints. is evidence of another system state: An organization wants Cloud Discovery data for remote laptops that never traverse corporate firewalls. The acceptance evidence here instead is: The app appears classified as unsanctioned and eligible enforcement blocks its use.

Forged messages receive an appropriate authentication/spoof verdict and action. would assess a different control. In this case it does not rule out the specific failure: An app is only discussed in email but remains unclassified in Cloud Discovery.

The Cloud Discovery data collection excludes roaming endpoint traffic. would fit a different circumstance involving: An organization wants Cloud Discovery data for remote laptops that never traverse corporate firewalls. Here the actual symptom is: An app is only discussed in email but remains unclassified in Cloud Discovery.

Cloud Discovery lacks the supported network or endpoint telemetry source. is a plausible failure in another case: A shadow SaaS service remains invisible because no traffic source is connected. It does not explain the current incident: An app is only discussed in email but remains unclassified in Cloud Discovery.

The training assignment or campaign follow-up rule was omitted. would fit a different circumstance involving: A team wants to assign follow-up training to users who fail a controlled phishing simulation. Here the actual symptom is: An app is only discussed in email but remains unclassified in Cloud Discovery.

Apply a Sanctioned classification after the app passes organizational review. can be useful when a discovered app is safe for a specific business group and should no longer be treated as shadow IT. However, it does not specifically achieve: A newly public file triggers the intended security signal.

Use supported Conditional Access App Control session policies where eligible. addresses another administrative need: A company wants to prevent sensitive file downloads during certain monitored cloud application sessions. This question instead requires the outcome: A newly public file triggers the intended security signal.

Configure training assignment logic in an Attack simulation training campaign. can be useful when a team wants to assign follow-up training to users who fail a controlled phishing simulation. However, it does not specifically achieve: A newly public file triggers the intended security signal.

Configure the supported Cloud Discovery data source and analyze discovered services. is directed at a separate task: Security must discover unsanctioned cloud services used through corporate network traffic. It does not produce the required configuration outcome: A newly public file triggers the intended security signal.

Inspect discovered apps, app risk indicators and associated user/traffic patterns. implements a different mechanism for: A manager asks which shadow SaaS application poses the greatest risk to the business. It does not configure the mechanism needed here: Use a Defender for Cloud Apps file policy for eligible file-sharing indicators.

Review the recommendation details and the devices/resources still reported as exposed. is directed at a separate task: A company wants to confirm whether exposure recommendations target obsolete or still-present assets. It does not produce the required configuration outcome: A newly public file triggers the intended security signal.

The discovered-app report reflects cloud usage from off-network endpoints. would assess a different control. In this case it does not rule out the specific failure: Sensitive documents are shared publicly but no file policy identifies them.

The app appears classified as unsanctioned and eligible enforcement blocks its use. is evidence of another system state: A company wants to mark an investigated cloud app as prohibited for corporate use. The acceptance evidence here instead is: A newly public file triggers the intended security signal.

An exceeded outbound threshold generates an alert and appropriate sending restriction. would assess a different control. In this case it does not rule out the specific failure: Sensitive documents are shared publicly but no file policy identifies them.

Conditional Access App Control session routing or applicability was not configured. would fit a different circumstance involving: A company wants to prevent sensitive file downloads during certain monitored cloud application sessions. Here the actual symptom is: Sensitive documents are shared publicly but no file policy identifies them.

The discovered app classification was not updated after the security review. is a plausible failure in another case: Approved business software continues to be flagged as an unsanctioned exception. It does not explain the current incident: Sensitive documents are shared publicly but no file policy identifies them.

Asset inventory or data freshness was not reconciled with the exposure recommendation. would fit a different circumstance involving: A company wants to confirm whether exposure recommendations target obsolete or still-present assets. Here the actual symptom is: Sensitive documents are shared publicly but no file policy identifies them.

Use Cloud Discovery from supported endpoint or firewall/proxy telemetry. can be useful when security must discover unsanctioned cloud services used through corporate network traffic. However, it does not specifically achieve: Overprivileged third-party app consent requests can be identified for investigation.

Apply an Unsanctioned tag to the discovered app with appropriate enforcement integration. addresses another administrative need: A company wants to mark an investigated cloud app as prohibited for corporate use. This question instead requires the outcome: Overprivileged third-party app consent requests can be identified for investigation.

Use quarantine management with supported retention and user/admin permissions. can be useful when a team needs to distinguish email quarantine retention from deleting messages permanently. However, it does not specifically achieve: Overprivileged third-party app consent requests can be identified for investigation.

Review the discovered app's users, IPs and traffic metrics where collected. is directed at a separate task: A Cloud Discovery report shows a risky service but the team needs to know which employees used it. It does not produce the required configuration outcome: Overprivileged third-party app consent requests can be identified for investigation.

Integrate eligible endpoint discovery data for remote devices and validate ingestion. implements a different mechanism for: An organization wants Cloud Discovery data for remote laptops that never traverse corporate firewalls. It does not configure the mechanism needed here: Use Defender for Cloud Apps OAuth application governance and consent review features where supported.

Configure the protected domain entries and corresponding phishing actions. is directed at a separate task: A global executive is frequently targeted by lookalike sending-domain impersonation. It does not produce the required configuration outcome: Overprivileged third-party app consent requests can be identified for investigation.