During an investigation in Microsoft 365 Defender, you identify a user's mailbox that has been compromised. The attacker sent phishing emails from this mailbox to internal users. You need to respond to the incident by preventing the attacker from using the mailbox and by removing the malicious emails from the internal users' mailboxes. What should you do first?

Add the compromised user's mailbox to the restricted entities list, and then use the Message Trace tool to delete the malicious emails.

Use Threat Explorer to delete the malicious emails from the internal users' mailboxes, and then disable the compromised user's account.

Use the Microsoft Purview compliance portal to place a litigation hold on the compromised user's mailbox, and then use Content Search to delete the malicious emails.

Disable the compromised user's account, reset the user's password, and then use Threat Explorer to delete the malicious emails from the internal users' mailboxes.

After a successful attack simulation campaign, the security team wants to create a training campaign for users who clicked the phishing link. They want to assign a specific Microsoft-provided training module and track completion. What should you do?

Create a new training campaign, select the users who clicked the link, and assign a Microsoft-provided training module.

Use the Attack Simulator to re-run the simulation and enable the 'Training campaign' assignment for all users.

Create a new mail flow rule that matches the simulation payload and assigns a training module to the recipient.

Create a new alert policy for 'Users who clicked a malicious link' and set the action to assign a training module.

In Microsoft Defender for Office 365, what is the purpose of a training campaign?

To monitor user activity in real time

To automatically block phishing emails

To provide users with security awareness training

Your organization wants to run a phishing simulation to test user awareness. You need to ensure that the simulation emails are not blocked by your existing anti-phishing policies, and that users who fall for the simulation are automatically enrolled in a training campaign. What should you do?

Use the Attack simulation training feature to create a simulation and configure the 'End user notification' to include training for users who click the link.

Create a mail flow rule to bypass filtering for the simulation sender address.

Submit the simulation email to Microsoft for analysis to ensure it is not blocked.

Create a new anti-phishing policy that allows the simulation payload and assign it to the simulation users.

Which Microsoft Defender for Office 365 capability automatically scans files in SharePoint Online and OneDrive for malware and blocks access to malicious files?

Safe Attachments for SharePoint, OneDrive, and Microsoft Teams

Microsoft 365 Certified:Administrator Expert

Domain 3Objective 2

Implement and Manage Email and Collaboration Protection by Using Microsoft Defender for Office 365 MS-102 Practice Questions (Page 4)

Part of the Manage security and threats by using Microsoft Defender XDR domain, which accounts for 30–35% of the MS-102 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 3–6 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

10concepts

30–35%of the exam

10 Concepts in This Objective

Threat Policies Implementation
Threat Rules Configuration
Alert Policies Configuration
Email Threat Investigation
Collaboration Threat Investigation
Threat Response Actions
Attack Simulation Management
Training Campaigns Management
Restricted Entities Management
Blocked Users Management

Questions 16–20

16application · medium
During an investigation in Microsoft 365 Defender, you identify a user's mailbox that has been compromised. The attacker sent phishing emails from this mailbox to internal users. You need to respond to the incident by preventing the attacker from using the mailbox and by removing the malicious emails from the internal users' mailboxes. What should you do first?
Select an answer first
17application · medium
After a successful attack simulation campaign, the security team wants to create a training campaign for users who clicked the phishing link. They want to assign a specific Microsoft-provided training module and track completion. What should you do?
Select an answer first
18foundation · easy
In Microsoft Defender for Office 365, what is the purpose of a training campaign?
Select an answer first
19application · medium
Your organization wants to run a phishing simulation to test user awareness. You need to ensure that the simulation emails are not blocked by your existing anti-phishing policies, and that users who fall for the simulation are automatically enrolled in a training campaign. What should you do?
Select an answer first
20foundation · easy
Which Microsoft Defender for Office 365 capability automatically scans files in SharePoint Online and OneDrive for malware and blocks access to malicious files?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to MS-102

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “MS-102” is a trademark of its owner, used for identification only.