A security architect at Contoso wants to proactively identify the organization's most critical security risks before they are exploited. They need a tool that provides a unified view of attack paths, exposure, and recommended actions. Which Microsoft 365 tool should they use?

Microsoft Security Exposure Management

A security admin at Fabrikam reviews the Defender XDR report and notices that the number of 'Malware detected' alerts has increased significantly. The admin wants to identify which devices are most affected and whether the detections are new or recurring. Which report feature should the admin use?

Use Microsoft Security Exposure Management to view attack paths.

Check the Microsoft Secure Score to see if it changed.

Filter the report by device and time period to see trends.

Run an advanced hunting query for all alerts.

Which capability is a key feature of Microsoft Security Exposure Management?

Attack surface discovery and security posture assessment

Real-time email filtering and anti-phishing protection

User training and simulated phishing campaign delivery

Automated patch deployment for all operating systems

A security analyst at Contoso is investigating a Defender XDR alert that indicates a user account was compromised. The analyst needs to find all email messages sent by that user in the last 24 hours that contained attachments. Which advanced hunting query should they run?

Query DeviceEvents and filter by the user's account name

Query EmailAttachmentInfo alone and filter by sender

Query EmailEvents and join with EmailAttachmentInfo on NetworkMessageId, filtering by sender and time range

Query IdentityLogonEvents and filter by the user's account

A security administrator at Contoso wants to improve their Microsoft Secure Score by focusing on the most impactful improvement actions. They also want to understand which assets are most exposed to the threats those actions address. What should the administrator do?

Check the Defender XDR report for device compliance

Review Secure Score improvement actions and cross-reference with Exposure Management insights

Use Threat Intelligence to find relevant vulnerabilities

Run an advanced hunting query for all improvement actions

Microsoft 365 Certified:Administrator Expert

Domain 3Objective 1

Review and Respond to Security Reports and Alerts Generated by Microsoft Defender XDR MS-102 Practice Questions (Page 2)

Part of the Manage security and threats by using Microsoft Defender XDR domain, which accounts for 30–35% of the MS-102 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 3–6 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

6concepts

30–35%of the exam

Questions 6–10

6application · medium
A security architect at Contoso wants to proactively identify the organization's most critical security risks before they are exploited. They need a tool that provides a unified view of attack paths, exposure, and recommended actions. Which Microsoft 365 tool should they use?
Select an answer first
7application · medium
A security admin at Fabrikam reviews the Defender XDR report and notices that the number of 'Malware detected' alerts has increased significantly. The admin wants to identify which devices are most affected and whether the detections are new or recurring. Which report feature should the admin use?
Select an answer first
8foundation · easy
Which capability is a key feature of Microsoft Security Exposure Management?
Select an answer first
9application · medium
A security analyst at Contoso is investigating a Defender XDR alert that indicates a user account was compromised. The analyst needs to find all email messages sent by that user in the last 24 hours that contained attachments. Which advanced hunting query should they run?
Select an answer first
10application · medium
A security administrator at Contoso wants to improve their Microsoft Secure Score by focusing on the most impactful improvement actions. They also want to understand which assets are most exposed to the threats those actions address. What should the administrator do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to MS-102

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “MS-102” is a trademark of its owner, used for identification only.