Microsoft MS-102 Exam Dumps, Practice Test Questions

Review the discovered app's users, IPs and traffic metrics where collected. is directed at a separate task: A Cloud Discovery report shows a risky service but the team needs to know which employees used it. It does not produce the required configuration outcome: Overprivileged third-party app consent requests can be identified for investigation.

Integrate eligible endpoint discovery data for remote devices and validate ingestion. implements a different mechanism for: An organization wants Cloud Discovery data for remote laptops that never traverse corporate firewalls. It does not configure the mechanism needed here: Use Defender for Cloud Apps OAuth application governance and consent review features where supported.

Configure the protected domain entries and corresponding phishing actions. is directed at a separate task: A global executive is frequently targeted by lookalike sending-domain impersonation. It does not produce the required configuration outcome: Overprivileged third-party app consent requests can be identified for investigation.

The discovered-app report reflects cloud usage from off-network endpoints. would assess a different control. In this case it does not rule out the specific failure: A third-party app retains broad mailbox access without security review.

Its discovered-app classification now reflects the organization's explicit approval. is evidence of another system state: A discovered app is safe for a specific business group and should no longer be treated as shadow IT. The acceptance evidence here instead is: Overprivileged third-party app consent requests can be identified for investigation.

The specific affected devices and fixed-version recommendation are recorded. would assess a different control. In this case it does not rule out the specific failure: A third-party app retains broad mailbox access without security review.

App discovery risk and actual usage evidence were not evaluated. would fit a different circumstance involving: A manager asks which shadow SaaS application poses the greatest risk to the business. Here the actual symptom is: A third-party app retains broad mailbox access without security review.

The Cloud Discovery data collection excludes roaming endpoint traffic. is a plausible failure in another case: Remote users' SaaS traffic is absent because only office firewall logs are ingested. It does not explain the current incident: A third-party app retains broad mailbox access without security review.

The exception was broader or longer-lived than the verified false positive required. would fit a different circumstance involving: A confirmed benign file is being repeatedly blocked by an overly broad detection. Here the actual symptom is: A third-party app retains broad mailbox access without security review.

Apply an Unsanctioned tag to the discovered app with appropriate enforcement integration. can be useful when a company wants to mark an investigated cloud app as prohibited for corporate use. However, it does not specifically achieve: The connector recovers and eligible app activity resumes ingestion.

Review Cloud Discovery app risk scoring and usage evidence. addresses another administrative need: A manager asks which shadow SaaS application poses the greatest risk to the business. This question instead requires the outcome: The connector recovers and eligible app activity resumes ingestion.

Cross-check security exposure recommendations against the live affected asset inventory. can be useful when a company wants to confirm whether exposure recommendations target obsolete or still-present assets. However, it does not specifically achieve: The connector recovers and eligible app activity resumes ingestion.

Integrate eligible endpoint discovery data for remote devices and validate ingestion. is directed at a separate task: An organization wants Cloud Discovery data for remote laptops that never traverse corporate firewalls. It does not produce the required configuration outcome: The connector recovers and eligible app activity resumes ingestion.

Inspect discovered apps, app risk indicators and associated user/traffic patterns. implements a different mechanism for: A manager asks which shadow SaaS application poses the greatest risk to the business. It does not configure the mechanism needed here: Investigate the connector health and authorization state in Defender for Cloud Apps.

Compare targeted device groups, policy status and actual endpoint protection configuration. is directed at a separate task: A Defender endpoint configuration appears deployed, but the devices are still in an unsafe state. It does not produce the required configuration outcome: The connector recovers and eligible app activity resumes ingestion.

The discovered-app list includes cloud usage not formally approved by IT. would assess a different control. In this case it does not rule out the specific failure: A connected SaaS appears quiet only because its connector is disconnected.

The discovered-app report reflects cloud usage from off-network endpoints. is evidence of another system state: An organization wants Cloud Discovery data for remote laptops that never traverse corporate firewalls. The acceptance evidence here instead is: The connector recovers and eligible app activity resumes ingestion.

Spam verdicts follow the selected handling while partner false positives can be reviewed. would assess a different control. In this case it does not rule out the specific failure: A connected SaaS appears quiet only because its connector is disconnected.

Conditional Access App Control session routing or applicability was not configured. would fit a different circumstance involving: A company wants to prevent sensitive file downloads during certain monitored cloud application sessions. Here the actual symptom is: A connected SaaS appears quiet only because its connector is disconnected.

Cloud Discovery lacks the supported network or endpoint telemetry source. is a plausible failure in another case: A shadow SaaS service remains invisible because no traffic source is connected. It does not explain the current incident: A connected SaaS appears quiet only because its connector is disconnected.

The inbound spam policy was tuned without considering legitimate sender behavior and quarantine review. would fit a different circumstance involving: A mail administrator wants to reduce inbound spam while preserving legitimate external partner mail. Here the actual symptom is: A connected SaaS appears quiet only because its connector is disconnected.

Apply a Sanctioned classification after the app passes organizational review. can be useful when a discovered app is safe for a specific business group and should no longer be treated as shadow IT. However, it does not specifically achieve: The incident disposition records whether the impossible travel signal represents a real risk.

Use Cloud Discovery from supported endpoint or firewall/proxy telemetry. addresses another administrative need: Security must discover unsanctioned cloud services used through corporate network traffic. This question instead requires the outcome: The incident disposition records whether the impossible travel signal represents a real risk.

Use Defender tamper protection in the supported endpoint management configuration. can be useful when endpoint operators want a tamper-resistant Defender configuration to prevent local disabling of protection. However, it does not specifically achieve: The incident disposition records whether the impossible travel signal represents a real risk.

Review the discovered app's users, IPs and traffic metrics where collected. is directed at a separate task: A Cloud Discovery report shows a risky service but the team needs to know which employees used it. It does not produce the required configuration outcome: The incident disposition records whether the impossible travel signal represents a real risk.

Inspect discovered apps, app risk indicators and associated user/traffic patterns. implements a different mechanism for: A manager asks which shadow SaaS application poses the greatest risk to the business. It does not configure the mechanism needed here: Investigate the Cloud Apps anomaly with user and session evidence.

Add the malicious file indicator with a block action and intended scope. is directed at a separate task: A suspicious file hash must be blocked across eligible onboarded devices. It does not produce the required configuration outcome: The incident disposition records whether the impossible travel signal represents a real risk.

The review distinguishes high-risk applications from approved low-risk services. would assess a different control. In this case it does not rule out the specific failure: An alert is closed based only on the distance between cities without evaluating VPN context.

Its discovered-app classification now reflects the organization's explicit approval. is evidence of another system state: A discovered app is safe for a specific business group and should no longer be treated as shadow IT. The acceptance evidence here instead is: The incident disposition records whether the impossible travel signal represents a real risk.

A known malicious attachment is blocked or isolated according to the policy. would assess a different control. In this case it does not rule out the specific failure: An alert is closed based only on the distance between cities without evaluating VPN context.

Conditional Access App Control session routing or applicability was not configured. would fit a different circumstance involving: A company wants to prevent sensitive file downloads during certain monitored cloud application sessions. Here the actual symptom is: An alert is closed based only on the distance between cities without evaluating VPN context.

The Cloud Discovery data collection excludes roaming endpoint traffic. is a plausible failure in another case: Remote users' SaaS traffic is absent because only office firewall logs are ingested. It does not explain the current incident: An alert is closed based only on the distance between cities without evaluating VPN context.

A tenant service-health view was mistaken for the advanced-hunting event dataset. would fit a different circumstance involving: A responder needs to search raw endpoint events for a suspicious process execution across many devices. Here the actual symptom is: An alert is closed based only on the distance between cities without evaluating VPN context.