A security analyst at Fabrikam is investigating a complex incident involving multiple alerts across different devices. The analyst needs to correlate events across devices and identify the root cause. The analyst has access to advanced hunting but is unsure which tables to join. Which approach should the analyst take?

Use the AlertInfo table to get alert details and then join with DeviceInfo and DeviceProcessEvents.

Use the IdentityLogonEvents table to find all sign-ins.

Use only the DeviceProcessEvents table to find all processes.

Use the EmailEvents table to find all emails.

A security admin at Northwind Traders is reviewing the Microsoft Secure Score and notices that the score has not improved despite implementing several recommended actions. The admin suspects that some actions may not be reflected in the score due to licensing or configuration issues. What should the admin do to troubleshoot this?

Contact Microsoft support immediately.

Ignore the issue because Secure Score is not important.

Run an advanced hunting query to see if the actions are actually configured.

Check the Secure Score history to see if the actions were recorded and if any dependencies are unmet.

A threat hunter at Contoso is investigating an alert about a suspicious domain accessed by multiple devices. The hunter wants to gather intelligence about the domain, including its reputation, associated malware, and any related indicators. Which tool should the hunter use?

Microsoft Defender Threat Intelligence

What is the purpose of the Microsoft Defender XDR reports?

To provide historical summaries of security trends and detections

To replace the need for real-time alert monitoring

To automatically remediate all security issues

To provide a list of all users and their permissions

Which action is appropriate when you confirm that a Microsoft Defender XDR alert is a true positive?

Take containment actions and then resolve the alert with a proper classification

Delete the alert from the portal to prevent further notifications

Ignore the alert because it is only a single event

Resolve the alert as a false positive to close it quickly

Microsoft 365 Certified:Administrator Expert

Domain 3Objective 1

Review and Respond to Security Reports and Alerts Generated by Microsoft Defender XDR MS-102 Practice Questions (Page 1)

Part of the Manage security and threats by using Microsoft Defender XDR domain, which accounts for 30–35% of the MS-102 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 3–6 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

6concepts

30–35%of the exam

Questions 1–5

1expert · hard
A security analyst at Fabrikam is investigating a complex incident involving multiple alerts across different devices. The analyst needs to correlate events across devices and identify the root cause. The analyst has access to advanced hunting but is unsure which tables to join. Which approach should the analyst take?
Select an answer first
2expert · hard
A security admin at Northwind Traders is reviewing the Microsoft Secure Score and notices that the score has not improved despite implementing several recommended actions. The admin suspects that some actions may not be reflected in the score due to licensing or configuration issues. What should the admin do to troubleshoot this?
Select an answer first
3application · medium
A threat hunter at Contoso is investigating an alert about a suspicious domain accessed by multiple devices. The hunter wants to gather intelligence about the domain, including its reputation, associated malware, and any related indicators. Which tool should the hunter use?
Select an answer first
4foundation · easy
What is the purpose of the Microsoft Defender XDR reports?
Select an answer first
5foundation · easy
Which action is appropriate when you confirm that a Microsoft Defender XDR alert is a true positive?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to MS-102

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “MS-102” is a trademark of its owner, used for identification only.

Review and Respond to Security Reports and Alerts Generated by Microsoft Defender XDR MS-102 Practice Questions (Page 1)

Questions 1–5

A threat hunter at Contoso is investigating an alert about a suspicious domain accessed by multiple devices. The hunter wants to gather intelligence about the domain, including its reputation, associated malware, and any related indicators. Which tool should the hunter use?

What is the purpose of the Microsoft Defender XDR reports?

Which action is appropriate when you confirm that a Microsoft Defender XDR alert is a true positive?

Keep studying — Manage security and threats by using Microsoft Defender XDR