A user shares a confidential file in SharePoint Online with an external user. The external user's account is compromised, and the file is accessed by an unauthorized party. You need to investigate the sharing activity and prevent the external user from accessing any other content in your tenant. What should you do?

Use the SharePoint admin center to remove the external user from the site.

Create an alert policy for external sharing and wait for the alert to fire.

Use Threat Explorer to find the file and then block the external user's domain.

Use the audit log to find the sharing event, then remove the external user from Azure AD.

Which response action in Microsoft Defender for Office 365 allows you to submit a suspicious email to Microsoft for analysis to improve detection?

Submit to Microsoft for analysis

In Microsoft Defender for Office 365, what is a restricted entity?

A domain that is allowed to bypass filtering

A user who is blocked from sending email

A policy that limits access to sensitive data

A file that is quarantined due to malware

In Microsoft Defender for Office 365, what is the purpose of an alert policy?

To detect specific activities and generate alerts for security teams

To block malicious senders at the organization level

To provide training to users about security threats

To automatically remediate threats without user intervention

Microsoft 365 Certified:Administrator Expert

Domain 3Objective 2

Implement and Manage Email and Collaboration Protection by Using Microsoft Defender for Office 365 MS-102 Practice Questions (Page 6)

Part of the Manage security and threats by using Microsoft Defender XDR domain, which accounts for 30–35% of the MS-102 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 3–6 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

10concepts

30–35%of the exam

10 Concepts in This Objective

Threat Policies Implementation
Threat Rules Configuration
Alert Policies Configuration
Email Threat Investigation
Collaboration Threat Investigation
Threat Response Actions
Attack Simulation Management
Training Campaigns Management
Restricted Entities Management
Blocked Users Management

Questions 26–30

26expert · hard
A user shares a confidential file in SharePoint Online with an external user. The external user's account is compromised, and the file is accessed by an unauthorized party. You need to investigate the sharing activity and prevent the external user from accessing any other content in your tenant. What should you do?
Select an answer first
27foundation · easy
Which response action in Microsoft Defender for Office 365 allows you to submit a suspicious email to Microsoft for analysis to improve detection?
Select an answer first
28foundation · easy
Which Microsoft Defender for Office 365 feature allows you to search for and analyze email threats across your organization using filters like malware family, sender, and recipient?
Select an answer first
29foundation · easy
In Microsoft Defender for Office 365, what is a restricted entity?
Select an answer first
30foundation · easy
In Microsoft Defender for Office 365, what is the purpose of an alert policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to MS-102

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “MS-102” is a trademark of its owner, used for identification only.

Implement and Manage Email and Collaboration Protection by Using Microsoft Defender for Office 365 MS-102 Practice Questions (Page 6)

Questions 26–30

Which response action in Microsoft Defender for Office 365 allows you to submit a suspicious email to Microsoft for analysis to improve detection?

Which Microsoft Defender for Office 365 feature allows you to search for and analyze email threats across your organization using filters like malware family, sender, and recipient?

In Microsoft Defender for Office 365, what is a restricted entity?

In Microsoft Defender for Office 365, what is the purpose of an alert policy?

Keep studying — Manage security and threats by using Microsoft Defender XDR