MS-102 practice questions 241–250

1. Question 241 · 396 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription and use Microsoft Defender for Cloud Apps. You need to create a file policy named Policy1 that meets the following requirements: • Inspects files in connected software as a service (SaaS) apps • Inspects protected files Which two settings should you configure? To answer, select the appropriate settings in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Correct Look into Defender > System > Settings > Cloud Apps > Files > Enables file monitoring: This enabled to see files in your SaaS apps. Microsoft Information Protection > Inspect Protected Files needs to be activated

   Source: Adapted from community discussion — JohnDoe47

   

   Next question

2. Question 242 · 396 in bank

   You have a Microsoft 365 E5 subscription. You plan to create an anti-malware policy named Policy1. You need to ensure that Policy1 can detect malicious email messages that were already delivered to a user's mailbox. What should you do in the Microsoft Defender portal?

   • AEnable zero-hour auto purge (ZAP).
   • BEnable enhanced filtering.
   • CConfigure a quarantine policy.
   • DModify the common attachments filter.

   Show answer

   Answer: A

   References

   • Microsoft Learn

   Next question

3. Question 243 · 396 in bank

   You have a Microsoft 365 E5 subscription. You need to use Microsoft Defender for Cloud Apps to monitor user mailbox activities. What should you do?

   • ACreate an activity policy.
   • BCreate an access policy.
   • CEnable mailbox audit logging.
   • DCreate an app connector for Microsoft 365.

   Show answer

   Answer: C

   Explanation

   "Exchange Mailbox audit logging must be turned on for each user mailbox before user activity in Exchange Online is logged" https://learn.microsoft.com/en-us/defender-cloud-apps/protect-office-365

   Source: Adapted from community discussion — justITtopics

   References

   • Microsoft Learn

   Next question

4. Question 244 · 396 in bank

   You have a Microsoft 365 subscription. You register two applications named App1 and App2 to Azure AD. You need to ensure that users who connect to App1 require multi-factor authentication (MFA). MFA is required only for App1. What should you do?

   • AFrom the Microsoft Entra admin center, create a conditional access policy.
   • BFrom the Microsoft 365 admin center, configure the Modem authentication settings.
   • CFrom the Enterprise applications blade of the Microsoft Entra admin center, configure the Users settings.
   • DFrom Multi-Factor Authentication, configure the service settings.

   Show answer

   Answer: A

   Explanation

   The correct answer is A. From the Microsoft Entra admin center, create a conditional access policy. A conditional access policy is a way to enable and enforce MFA for specific applications or users in Microsoft Entra.

   Source: Adapted from community discussion — sherifhamed

   Next question

5. Question 245 · 396 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains a user named User1. User1 has a Windows 11 device named Device1 that is onboarded to Microsoft Defender for Endpoint. User1 reports that various files were deleted from Device1. You need to create a filter to identify which service deleted the files. Which settings should you configure, and which type of filter should you create in the Microsoft Defender portal? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

6. Question 246 · 396 in bank

   You have a Microsoft 365 subscription that includes Microsoft Intune and Microsoft Defender XDR. All users have devices that run Windows 11. From the Microsoft Defender portal, you review the Microsoft Secure Score recommendations. One of the top recommendations is to block all Microsoft Office applications from creating child processes. You need to increase the secure score by addressing the recommendation. What should you do?

   • ASelect Safe Documents for Office clients.
   • BCreate a policy for Office applications.
   • CConfigure an endpoint detection and response (EDR) policy.
   • DCreate an attack surface reduction (ASR) policy.

   Show answer

   Answer: D

   References

   • Microsoft Learn

   Next question

7. Question 247 · 396 in bank

   You have a Microsoft 365 E5 subscription and use Microsoft Defender for Office 365. You need to implement a social engineering awareness solution that meets the following requirements: • To reset a user's password, emulate an email message that contains a link. • Track any users that selects the email message link. • Suggest further social engineering training. What should you use in the Microsoft Defender portal?

   • AExposure insights
   • BLearning hub
   • CAttack simulation training
   • DThreat tracker

   Show answer

   Answer: C

   Next question

8. Question 248 · 396 in bank

   You have a Microsoft 365 E5 subscription and use Microsoft Defender for Office 365. You are configuring Attack simulation training that will target all users and use the Credential Harvest social engineering technique. You need to ensure that the simulation sends an email message that contains a custom phishing link and company-based terminology and branding. How should you configure the simulation?

   • ACreate a Tenant payload.
   • BSelect a Global payload.
   • CSelect custom end-user notifications.
   • DCreate a tenant landing page.

   Show answer

   Answer: A

   Explanation

   Create a Tenant Payload. You can't use Global payload, this are built in payload so cannot be custom. question ask for custom phishing link

   Source: Adapted from community discussion — Xive

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 249 · 396 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

   

   You use Microsoft Entra ID Protection. For the Users at risk detected alerts setting, you configure the following: • Recipient: Admin1 • Alert on user risk level at or above: Medium User1 signs in to Microsoft 365 services and is assigned the detected risk levels shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Correct answer given Admin1 got 3 and not 2 messages. He is specifically defined as recipient. Admin2 is a Security reader. "By default users actively assigned Global Administrator, Security Administrator, or Security Reader roles are automatically added to this list if that user has a valid "Email" or "Alternate email" configured." Admin3: does not get any emails https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-notifications#users-at-risk-detected-email

   Source: Adapted from community discussion — JohnDoe47

   References

   • Microsoft Learn

   

   Next question

10. Question 250 · 396 in bank

    You have a Microsoft 365 E5 subscription that contains Windows 11 devices. All the devices are onboarded to Microsoft Defender for Endpoint. You need to compare the configuration of the devices against industry standard benchmarks. What should you use?

    • AInitiatives
    • BEvents
    • CSecurity baselines assessment
    • DAttack surface map

    Show answer

    Answer: C

    Explanation

    "By default, each security baseline is configured to meet the best practices and recommendations for the settings that affect security. Intune partners with the same Windows security team that creates group policy security baselines. These recommendations are based on guidance and extensive experience." https://learn.microsoft.com/en-us/mem/intune/protect/security-baselines

    Source: Adapted from community discussion — Krayzr

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

MS-102 practice, question 241. 396 questions available.