A security analyst at Contoso is reviewing a Defender XDR alert that has been escalated to an incident. The analyst needs to gather additional evidence, such as all network connections made by the affected device in the last hour, to support the investigation. What should the analyst do?

Check the Microsoft Secure Score for the device

Open the alert and view the related entities

Review the Defender XDR report for network anomalies

Use advanced hunting to query DeviceNetworkEvents for the device and time range

What is the primary purpose of Microsoft Security Exposure Management in the Microsoft Defender XDR portal?

To automatically remediate all identified vulnerabilities without human intervention

To manage user permissions and enforce multi-factor authentication across all applications

To replace the need for a SIEM solution by ingesting all logs from every source

To continuously assess and prioritize security risks across your organization's attack surface

A security analyst at Contoso is investigating an alert about a potential phishing email that led to a user's credentials being compromised. The analyst wants to find all emails that contained the same malicious link sent to other users. Which advanced hunting query should the analyst use?

Query AlertInfo for all alerts related to phishing.

Query DeviceProcessEvents for any process that opened the link.

Query IdentityLogonEvents for all sign-ins after the phishing email was sent.

Query EmailEvents for emails containing the malicious link URL.

A security analyst at Contoso receives a Defender XDR alert about a suspicious sign-in from an unfamiliar IP address. The analyst wants to quickly determine if this sign-in is part of a broader attack pattern affecting other users. Which action should the analyst take first?

Review the Microsoft Secure Score to see if the organization's score dropped recently.

Run an advanced hunting query to search for other sign-ins from the same IP address or similar anomalous patterns.

Escalate the alert to a senior incident responder without further investigation.

Check the Defender XDR report for a summary of all alerts generated in the last 24 hours.

A security analyst at Contoso is reviewing the Defender XDR report and notices a high volume of alerts from a specific device. The analyst wants to determine if the device is compromised or if the alerts are false positives. The analyst has limited time and needs to prioritize the investigation. Which approach should the analyst take?

Ignore the alerts because they are likely false positives.

Use advanced hunting to query the device's activity and correlate with known threat intelligence.

Check the Microsoft Secure Score to see if it changed.

Disable the device from the network immediately.

Microsoft 365 Certified:Administrator Expert

Domain 3Objective 1

Review and Respond to Security Reports and Alerts Generated by Microsoft Defender XDR MS-102 Practice Questions (Page 3)

Part of the Manage security and threats by using Microsoft Defender XDR domain, which accounts for 30–35% of the MS-102 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 3–6 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

6concepts

30–35%of the exam

Questions 11–15

11application · medium
A security analyst at Contoso is reviewing a Defender XDR alert that has been escalated to an incident. The analyst needs to gather additional evidence, such as all network connections made by the affected device in the last hour, to support the investigation. What should the analyst do?
Select an answer first
12foundation · easy
What is the primary purpose of Microsoft Security Exposure Management in the Microsoft Defender XDR portal?
Select an answer first
13application · medium
A security analyst at Contoso is investigating an alert about a potential phishing email that led to a user's credentials being compromised. The analyst wants to find all emails that contained the same malicious link sent to other users. Which advanced hunting query should the analyst use?
Select an answer first
14application · medium
A security analyst at Contoso receives a Defender XDR alert about a suspicious sign-in from an unfamiliar IP address. The analyst wants to quickly determine if this sign-in is part of a broader attack pattern affecting other users. Which action should the analyst take first?
Select an answer first
15expert · hard
A security analyst at Contoso is reviewing the Defender XDR report and notices a high volume of alerts from a specific device. The analyst wants to determine if the device is compromised or if the alerts are false positives. The analyst has limited time and needs to prioritize the investigation. Which approach should the analyst take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to MS-102

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “MS-102” is a trademark of its owner, used for identification only.