Your organization uses Microsoft Defender for Office 365. The security team is overwhelmed by alert fatigue from the default alert policies. They want to focus on high-impact threats, such as malware campaigns and user clicks on malicious links, while reducing noise from low-severity alerts. You need to configure alert policies to achieve this balance. What should you do?

Keep the default alert policies and increase the severity threshold to 'High' for all policies.

Create custom alert policies for the specific high-impact activities and set the severity to 'High', then disable the default policies that generate low-severity alerts.

Disable all default alert policies and create custom policies only for high-severity activities.

Use Threat Explorer to manually review all alerts and ignore low-severity ones.

A company uses Microsoft 365 and Defender for Office 365 Plan 2. The security team needs to be notified when a user reports a phishing email using the built-in Report Message add-in. They also want to automatically move the reported message to quarantine and block the sender. You need to configure the appropriate settings. What should you do?

Create a new anti-phishing policy that applies to the user's mailbox, and set the action to quarantine and block the sender.

Create a new alert policy for 'User reported messages' and set the action to send an email notification to the security team.

Create a new mail flow rule that matches messages with the 'X-MS-Exchange-Organization-UserReported' header, and set the action to quarantine and add the sender to the blocked senders list.

Create a new safe attachments policy that applies to the user's mailbox, and set the action to quarantine and block the sender.

Microsoft 365 Certified:Administrator Expert

Domain 3Objective 2

Implement and Manage Email and Collaboration Protection by Using Microsoft Defender for Office 365 MS-102 Practice Questions (Page 3)

Part of the Manage security and threats by using Microsoft Defender XDR domain, which accounts for 30–35% of the MS-102 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 3–6 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

10concepts

30–35%of the exam

10 Concepts in This Objective

Threat Policies Implementation
Threat Rules Configuration
Alert Policies Configuration
Email Threat Investigation
Collaboration Threat Investigation
Threat Response Actions
Attack Simulation Management
Training Campaigns Management
Restricted Entities Management
Blocked Users Management

Questions 11–15

11foundation · easy
In Microsoft Defender for Office 365, which policy type is used to protect against phishing attempts that impersonate your organization's users or domains?
Select an answer first
12expert · hard
Your organization uses Microsoft Defender for Office 365. The security team is overwhelmed by alert fatigue from the default alert policies. They want to focus on high-impact threats, such as malware campaigns and user clicks on malicious links, while reducing noise from low-severity alerts. You need to configure alert policies to achieve this balance. What should you do?
Select an answer first
13application · medium
A company uses Microsoft 365 and Defender for Office 365 Plan 2. The security team needs to be notified when a user reports a phishing email using the built-in Report Message add-in. They also want to automatically move the reported message to quarantine and block the sender. You need to configure the appropriate settings. What should you do?
Select an answer first
14foundation · easy
Which Microsoft Defender for Office 365 policy is used to protect users from malicious links embedded in email messages and collaboration content?
Select an answer first
15foundation · easy
When configuring an alert policy in Microsoft Defender for Office 365, which component defines the specific activity that triggers the alert?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to MS-102

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “MS-102” is a trademark of its owner, used for identification only.

Implement and Manage Email and Collaboration Protection by Using Microsoft Defender for Office 365 MS-102 Practice Questions (Page 3)

Questions 11–15

In Microsoft Defender for Office 365, which policy type is used to protect against phishing attempts that impersonate your organization's users or domains?

Which Microsoft Defender for Office 365 policy is used to protect users from malicious links embedded in email messages and collaboration content?

When configuring an alert policy in Microsoft Defender for Office 365, which component defines the specific activity that triggers the alert?

Keep studying — Manage security and threats by using Microsoft Defender XDR