Your organization has a requirement to block downloads of sensitive files from SharePoint Online for users outside the corporate network. However, you also need to allow a specific group of executives to download files from any location. Which policy configuration should you implement?

Create an activity policy that alerts on downloads from outside the corporate network, and add an exception for the executive group.

Create an access policy that blocks access to SharePoint Online from outside the corporate network, and add an exception for the executive group.

Create a file policy that blocks downloads for users outside the corporate network, and add an exception for the executive group.

Create a session policy that blocks downloads for users outside the corporate network, and add an exception for the executive group.

A company has connected Microsoft 365 to Defender for Cloud Apps. They notice that activities from Teams are not appearing in the activity log, while SharePoint Online activities are visible. The app connector shows 'Connected' for Microsoft 365. What is the most likely cause?

The users do not have Teams licenses

The activity log retention period has expired

The Teams admin role is not assigned to the connector

The Teams workload is not enabled in the app connector settings

The security team wants to be alerted when a user downloads more than 100 files from SharePoint Online in a single hour. They have connected Microsoft 365 to Defender for Cloud Apps. What should they configure?

A file policy with a condition for download count

A session policy with a condition for download count

An access policy with a condition for download count

An activity policy with a threshold of 100 and a time window of 60 minutes

You are reviewing the activity log in Defender for Cloud Apps and notice that a user's sign-in activity shows a 'Failed' status, but the user claims they successfully accessed the app. What is the most likely explanation?

The activity log may show a failed sign-in attempt that was followed by a successful one, and the log only captured the failed attempt.

The user is lying about their access.

The app connector is not logging successful sign-ins.

The activity log is filtered to show only failed sign-ins.

An administrator is investigating a potential data exfiltration incident. The activity log shows that a user signed in to Microsoft 365 from an IP address in a foreign country and then accessed a sensitive SharePoint site. The administrator wants to see if the user also accessed other apps in the same time frame. What should the administrator do?

Use the app connector status page

Check the Cloud App Discovery report for the user

Review the file policy report for the user

Filter the activity log by the user and expand the time range

Microsoft 365 Certified:Administrator Expert

Domain 3Objective 4

Implement and Manage Microsoft Defender for Cloud Apps MS-102 Practice Questions (Page 1)

Part of the Manage security and threats by using Microsoft Defender XDR domain, which accounts for 30–35% of the MS-102 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 3–6 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

6concepts

30–35%of the exam

Questions 1–5

1expert · hard
Your organization has a requirement to block downloads of sensitive files from SharePoint Online for users outside the corporate network. However, you also need to allow a specific group of executives to download files from any location. Which policy configuration should you implement?
Select an answer first
2expert · hard
A company has connected Microsoft 365 to Defender for Cloud Apps. They notice that activities from Teams are not appearing in the activity log, while SharePoint Online activities are visible. The app connector shows 'Connected' for Microsoft 365. What is the most likely cause?
Select an answer first
3application · medium
The security team wants to be alerted when a user downloads more than 100 files from SharePoint Online in a single hour. They have connected Microsoft 365 to Defender for Cloud Apps. What should they configure?
Select an answer first
4application · medium
You are reviewing the activity log in Defender for Cloud Apps and notice that a user's sign-in activity shows a 'Failed' status, but the user claims they successfully accessed the app. What is the most likely explanation?
Select an answer first
5application · medium
An administrator is investigating a potential data exfiltration incident. The activity log shows that a user signed in to Microsoft 365 from an IP address in a foreign country and then accessed a sensitive SharePoint site. The administrator wants to see if the user also accessed other apps in the same time frame. What should the administrator do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to MS-102

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “MS-102” is a trademark of its owner, used for identification only.