After a phishing simulation, you need to create a training campaign for users who clicked the malicious link. You want to track their progress and ensure they complete the training. What should you do?

Create a training campaign in Attack simulation training and assign it to the users who clicked the link.

Create an alert policy to notify you when users click a malicious link in the future.

Add the users to a restricted entities list until they complete training.

Send an email to the affected users with a link to a security awareness video.

A user in your organization has been sending spam emails due to a compromised account. The account has been secured, but you need to ensure the user can send email again after a review period. What should you do?

Wait for the automatic removal of the restriction after 24 hours.

Add the user to the Blocked senders list in the Tenant Allow/Block List.

Create a new mail flow rule to allow the user's email after a specific date.

Remove the user from the Restricted entities list after confirming the account is secure.

Your organization wants to run a phishing simulation, but the security team is concerned that the simulation emails will be blocked by the existing anti-phishing policies. They also want to track which users click the link and automatically enroll them in a training campaign. You need to configure the simulation to meet both requirements. What should you do?

Submit the simulation email to Microsoft for analysis and then create a training campaign for all users.

Use Attack simulation training to create a simulation and configure the 'End user notification' to include training for users who click the link.

Create a new anti-phishing policy that allows the simulation payload and assign it to the simulation users.

Create a mail flow rule to bypass filtering for the simulation sender and then manually enroll users in training.

Where in the Microsoft 365 Defender portal would you manage restricted entities?

Email & collaboration > Policies & rules > Threat policies

Email & collaboration > Investigation > Threat Explorer

Email & collaboration > Review > Restricted entities

Email & collaboration > Reports > Email & collaboration reports

Microsoft 365 Certified:Administrator Expert

Domain 3Objective 2

Implement and Manage Email and Collaboration Protection by Using Microsoft Defender for Office 365 MS-102 Practice Questions (Page 5)

Part of the Manage security and threats by using Microsoft Defender XDR domain, which accounts for 30–35% of the MS-102 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 3–6 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

10concepts

30–35%of the exam

10 Concepts in This Objective

Threat Policies Implementation
Threat Rules Configuration
Alert Policies Configuration
Email Threat Investigation
Collaboration Threat Investigation
Threat Response Actions
Attack Simulation Management
Training Campaigns Management
Restricted Entities Management
Blocked Users Management

Questions 21–25

21application · medium
After a phishing simulation, you need to create a training campaign for users who clicked the malicious link. You want to track their progress and ensure they complete the training. What should you do?
Select an answer first
22application · medium
A user in your organization has been sending spam emails due to a compromised account. The account has been secured, but you need to ensure the user can send email again after a review period. What should you do?
Select an answer first
23expert · hard
Your organization wants to run a phishing simulation, but the security team is concerned that the simulation emails will be blocked by the existing anti-phishing policies. They also want to track which users click the link and automatically enroll them in a training campaign. You need to configure the simulation to meet both requirements. What should you do?
Select an answer first
24foundation · easy
In Microsoft Defender for Office 365, which tool provides a detailed view of an email message's path, including sender, recipients, and actions taken by threat policies?
Select an answer first
25foundation · easy
Where in the Microsoft 365 Defender portal would you manage restricted entities?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to MS-102

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “MS-102” is a trademark of its owner, used for identification only.

Implement and Manage Email and Collaboration Protection by Using Microsoft Defender for Office 365 MS-102 Practice Questions (Page 5)

Questions 21–25

After a phishing simulation, you need to create a training campaign for users who clicked the malicious link. You want to track their progress and ensure they complete the training. What should you do?

A user in your organization has been sending spam emails due to a compromised account. The account has been secured, but you need to ensure the user can send email again after a review period. What should you do?

In Microsoft Defender for Office 365, which tool provides a detailed view of an email message's path, including sender, recipients, and actions taken by threat policies?

Where in the Microsoft 365 Defender portal would you manage restricted entities?

Keep studying — Manage security and threats by using Microsoft Defender XDR