Implement and Manage Email and Collaboration Protection by Using Microsoft Defender for Office 365 MS-102 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In Microsoft Defender for Office 365, what is the purpose of the tenant allow/block list?

   • ATo manage user permissions in Exchange Online
   • BTo override user-level settings for specific senders
   • CTo block or allow specific senders, domains, or URLs across the organization
   • DTo track email delivery failures
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which component of a training campaign in Microsoft Defender for Office 365 specifies the users who will receive the training?

   • ATraining content
   • BEnd user notifications
   • CTarget users
   • DSimulation schedule
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company has a strict policy that all email from external senders must be scanned for malware and spam. They also have a line-of-business application that sends automated emails to users with attachments. These emails are being quarantined by the malware filter because the attachments are flagged as false positives. You need to allow these specific emails while maintaining the strict scanning policy for all other external email. What should you do?

   • AAdd the application's sender address to the Tenant Allow/Block List as an allowed sender.
   • BAdd the specific attachment hash to the Tenant Allow/Block List as an allowed file hash.
   • CCreate a new anti-phishing policy that bypasses filtering for the application's sender address.
   • DCreate a mail flow rule that sets the spam confidence level to -1 for emails from the application's sender address.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   Contoso Pharmaceuticals uses Microsoft 365 and has a zero-trust policy that requires all inbound email containing executable attachments to be blocked. A security analyst reports that a user received a .zip file containing a .js file, which was delivered to the inbox. The anti-malware policy is set to the default action. You need to ensure that nested executable files inside archives are blocked and that the incident is investigated. What should you do?

   • ACreate a new safe attachments policy that applies to the user's domain, set the action to 'Dynamic Delivery', and use the Threat Explorer to locate the message by message ID.
   • BCreate a new mail flow rule that blocks messages with .zip attachments containing .js files, set the rule to quarantine the message, and use Threat Explorer to search for the message by the user's email address.
   • CCreate a new anti-malware policy with a common attachment filter that blocks .zip and .js files, and set the action to quarantine the message.
   • DModify the default anti-malware policy to enable the common attachment filter and add .js to the list, then use Threat Explorer to search for the message by the user's email address.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A multinational company uses Microsoft Defender for Office 365. The security team notices that a specific user's account is sending a high volume of spam to internal recipients. The user claims their account was compromised and has since changed their password. You need to stop the remaining spam flow while allowing the user to continue working. What should you do?

   • AAdd the user's email address to the Blocked senders list in the Tenant Allow/Block List.
   • BIncrease the spam confidence level threshold for the user's mailbox.
   • CPlace the user in Restricted entities and then remove them after the spam flow stops.
   • DCreate a mail flow rule that rejects outgoing messages from that user's account.
   Reveal Solution Discussion Select an answer first