A user in your organization reports that a file shared via Microsoft Teams contains a malicious link. The file was uploaded to a Teams channel and shared with multiple users. You need to investigate the threat and prevent further access to the file. What should you do?

Use the Microsoft 365 Defender portal to search for the file in the 'Collaboration' section, and then use the 'Block' action to prevent access.

Use the SharePoint admin center to locate the file, and then manually change the sharing permissions to 'Only specific people'.

Use Threat Explorer to search for the file by its name, and then use the 'Take action' option to block the file.

Use the Microsoft Purview compliance portal to search for the file, and then use the 'Retention' action to preserve it for investigation.

A user reports receiving a phishing email that was delivered to their inbox. You investigate in Threat Explorer and find that the email was sent to 50 users, and 10 of them clicked the malicious link. You need to remediate the impact and prevent further access to the malicious URL. What should you do?

Soft-delete the email from all 50 mailboxes and add the URL to the Tenant Allow/Block List.

Create a mail flow rule to block the URL and then wait for the alert to fire.

Use Threat Explorer to take action on the email and then investigate the 10 users who clicked the link for further compromise.

Add the sender to the Blocked senders list and soft-delete the email.

A user in your organization shares a sensitive document in Microsoft Teams with an external user. The external user's account is later compromised, and the document is leaked. You need to investigate the sharing activity and prevent the external user from accessing any more content. What should you do?

Use the Microsoft Purview compliance portal to search the audit log for sharing events, then remove the external user from the organization's Azure AD.

Use the Microsoft 365 Defender portal to create an alert policy for external sharing, then wait for the alert to fire.

Use the Microsoft Teams admin center to view the sharing activity, then disable the external user's account in Teams.

Use the Microsoft 365 Defender portal to search for the document in Threat Explorer, then block the external user's domain.

During an investigation in Microsoft Defender for Office 365, you confirm that a user's account was compromised and used to send phishing emails to internal users. The user has since changed their password. You need to remediate the impact and prevent the account from being used for further malicious activity. What should you do first?

Reset the user's password again to ensure the attacker no longer has access.

Place the user in Restricted entities to block them from sending email.

Create a mail flow rule to reject all mail from the compromised account.

Delete all emails sent by the compromised account from the recipients' mailboxes.

Microsoft 365 Certified:Administrator Expert

Domain 3Objective 2

Implement and Manage Email and Collaboration Protection by Using Microsoft Defender for Office 365 MS-102 Practice Questions (Page 1)

Part of the Manage security and threats by using Microsoft Defender XDR domain, which accounts for 30–35% of the MS-102 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 3–6 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

10concepts

30–35%of the exam

10 Concepts in This Objective

Threat Policies Implementation
Threat Rules Configuration
Alert Policies Configuration
Email Threat Investigation
Collaboration Threat Investigation
Threat Response Actions
Attack Simulation Management
Training Campaigns Management
Restricted Entities Management
Blocked Users Management

Questions 1–5

1application · medium
A user in your organization reports that a file shared via Microsoft Teams contains a malicious link. The file was uploaded to a Teams channel and shared with multiple users. You need to investigate the threat and prevent further access to the file. What should you do?
Select an answer first
2expert · hard
A user reports receiving a phishing email that was delivered to their inbox. You investigate in Threat Explorer and find that the email was sent to 50 users, and 10 of them clicked the malicious link. You need to remediate the impact and prevent further access to the malicious URL. What should you do?
Select an answer first
3application · medium
A user in your organization shares a sensitive document in Microsoft Teams with an external user. The external user's account is later compromised, and the document is leaked. You need to investigate the sharing activity and prevent the external user from accessing any more content. What should you do?
Select an answer first
4application · medium
During an investigation in Microsoft Defender for Office 365, you confirm that a user's account was compromised and used to send phishing emails to internal users. The user has since changed their password. You need to remediate the impact and prevent the account from being used for further malicious activity. What should you do first?
Select an answer first
5foundation · easy
In Microsoft Defender for Office 365, which setting within a Safe Attachments policy determines what happens to messages that contain malware?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to MS-102

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “MS-102” is a trademark of its owner, used for identification only.

Implement and Manage Email and Collaboration Protection by Using Microsoft Defender for Office 365 MS-102 Practice Questions (Page 1)

Questions 1–5

A user in your organization reports that a file shared via Microsoft Teams contains a malicious link. The file was uploaded to a Teams channel and shared with multiple users. You need to investigate the threat and prevent further access to the file. What should you do?

In Microsoft Defender for Office 365, which setting within a Safe Attachments policy determines what happens to messages that contain malware?

Keep studying — Manage security and threats by using Microsoft Defender XDR