MS-102 practice questions 331–340

1. Question 331 · 396 in bank

   HOTSPOT - Your company uses a legacy on-premises LDAP directory that contains 100 users. The company purchases a Microsoft 365 subscription. You need to import the 100 users into Microsoft 365 by using the Microsoft 365 admin center. Which type of file should you use and which properties are required? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Correct, but bad question since there are 4 required parameters in usercreatetemplate.csv: [displayName] Required,User name [userPrincipalName] Required,Initial password [passwordProfile] Required,Block sign in (Yes/No) [accountEnabled] Required

   Source: Adapted from community discussion — Blixa

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 332 · 396 in bank

   Select 2

   You have a Microsoft 365 E3 subscription that uses Microsoft Defender for Endpoint Plan 1. Which two Defender for Endpoint features are available to the subscription? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • Aadvanced hunting
   • Bsecurity reports
   • Cdigital certificate assessment
   • Ddevice discovery
   • Eattack surface reduction (ASR)

   Show answer

   Answer: BE

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 333 · 396 in bank

   You are reviewing alerts in the Microsoft 365 Defender portal. How long are the alerts retained in the portal?

   • A30 days
   • B60 days
   • C3 months
   • D6 months
   • E12 months

   Show answer

   Answer: D

   Explanation

   Data from Microsoft Defender for Endpoint is retained for 180 days, visible across the portal. However, in the advanced hunting investigation experience, it's accessible via a query for a period of 30 days. https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/data-storage-privacy?view=o365-worldwide#how-long-will-microsoft-store-my-data-what-is-microsofts-data-retention-policy

   Source: Adapted from community discussion — northgaterebel

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 334 · 396 in bank

   You have a Microsoft 365 E5 subscription. From the Microsoft 365 Defender portal, you plan to export a detailed report of compromised users. What is the longest time range that can be included in the report?

   • A1 day
   • B7 days
   • C30 days
   • D90 days

   Show answer

   Answer: A

   Explanation

   The answer is 1 day, a lot of the questions with disputed answers are answered correctly in the Microsoft practice assessment: https://learn.microsoft.com/en-us/credentials/certifications/exams/ms-102/practice/assessment?assessmentId=75&assessment-type=practice

   Source: Adapted from community discussion — Y2

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 335 · 396 in bank

   HOTSPOT - You have a Microsoft 365 subscription. You deploy the anti-phishing policy shown in the following exhibit.

   

   Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Looks correct to me. You want to add the CEO as a protected user for impersonation protection. You also want to add the other CEO as a trusted sender so as to ensure good email delivery to that person from your senders. proof: see 5. here: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure?view=o365-worldwide "enable users to protect"

   Source: Adapted from community discussion — amurp35

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 336 · 396 in bank

   HOTSPOT - You use Microsoft Defender for Endpoint. You have the Microsoft Defender for Endpoint device groups shown in the following table.

   

   You plan to onboard computers to Microsoft Defender for Endpoint as shown in the following table.

   

   To which device group will each computer be added? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Answer is correct. Devices can only be added to one group. They get added to the highest rank lowest number if they match multiple groups.

   Source: Adapted from community discussion — Greatone1

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 337 · 396 in bank

   DRAG DROP - You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365. You need to configure policies to meet the following requirements: Customize the common attachments filter. Enable impersonation protection for sender domains. Which type of policy should you configure for each requirement? To answer, drag the appropriate policy types to the correct requirements. Each policy type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Correct, common attachments is used when blocking emails from being sent which have attachments to them. Safe attachments (which looks the nicest) checks the attachments in emails etc rather than just blocking them so is slightly differenet.

   Source: Adapted from community discussion — benpatto

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 338 · 396 in bank

   You have an Azure AD tenant and a Microsoft 365 E5 subscription. The tenant contains the users shown in the following table.

   

   You plan to implement Microsoft Defender for Endpoint. You verify that role-based access control (RBAC) is turned on in Microsoft Defender for Endpoint. You need to identify which user can view security incidents from the Microsoft 365 Defender portal. Which user should you identify?

   • AUser1
   • BUser2
   • CUser3
   • DUser4

   Show answer

   Answer: A

   Explanation

   A is correct Answer is correct "A". Security Administrator will not loose access after RBAC is enabled. Security Reader will so definitely not C. Initially, only those with Azure AD Global Administrator or Security Administrator rights will be able to create and assign roles in Microsoft Defender Security Center, therefore, having the right groups ready in Azure AD is important. Turning on role-based access control will cause users with read-only permissions (for example, users assigned to Azure AD Security reader role) to lose access until they are assigned to a role. https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/rbac?view=o365-worldwide

   Source: Adapted from community discussion — AMDf

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 339 · 396 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription. All company-owned Windows 11 devices are onboarded to Microsoft Defender for Endpoint. You need to configure Defender for Endpoint to meet the following requirements: Block a vulnerable app until the app is updated. Block an application executable based on a file hash. The solution must minimize administrative effort. What should you configure for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 340 · 396 in bank

    HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint and contains the devices shown in the following table.

    

    Defender for Endpoint has the device groups shown in the following table.

    

    You create an incident email notification rule configured as shown in the following table.

    

    For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    1. NO: You need to assign multiple alert severity. Checked this in test lab. 2. NO: Not member of Group1 and Group 2. 3. YES: Member of group 2 and low-severity alert. Answers are correct.

    Source: Adapted from community discussion — MR_Eliot

    References

    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

MS-102 practice, question 331. 396 questions available.