Review and Respond to Security Reports and Alerts Generated by Microsoft Defender XDR MS-102 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst at Fabrikam needs to identify all devices that are exposed to a newly disclosed critical vulnerability. The analyst also wants to see which of those devices have been involved in any suspicious activity. What should the analyst do?

   • AUse Exposure Management to find affected devices and then run an advanced hunting query for suspicious activity on those devices
   • BRun an advanced hunting query for all devices with the vulnerability
   • CCheck the Secure Score for the vulnerability
   • DReview the Defender XDR report for device health
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security administrator at Fabrikam reviews the weekly Defender XDR report and sees that the number of devices with a high-severity vulnerability has increased. The administrator wants to reduce this number by prioritizing the most impactful remediation actions. What should the administrator do?

   • ADisable the vulnerability management report to avoid confusion
   • BIncrease the Microsoft Secure Score target to force automatic remediation
   • CUse the vulnerability management report to identify the top affected devices and apply the recommended security updates
   • DRun an advanced hunting query to find all devices with missing updates
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security administrator at Contoso is reviewing a high-severity Defender XDR alert that was automatically closed as a false positive. The administrator suspects the alert was actually a true positive but was suppressed by a custom detection rule. The administrator needs to confirm the alert's validity and ensure future alerts are not suppressed. What should the administrator do?

   • AReview the alert's history and the custom detection rule that suppressed it, then modify the rule to avoid false suppression
   • BIncrease the Secure Score target to prevent future false positives
   • CReopen the alert and change its status to active
   • DRun an advanced hunting query to find similar alerts
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security administrator at Fabrikam notices that the weekly Defender XDR report shows a high number of alerts that were automatically resolved without investigation. The administrator wants to reduce the number of auto-resolved alerts while ensuring that genuine threats are not missed. What should the administrator do?

   • AReview the alert suppression rules and adjust them to be less aggressive, then monitor the impact on alert volume
   • BRun an advanced hunting query to find all auto-resolved alerts
   • CDisable all alert suppression rules
   • DIncrease the Secure Score target to force more investigations
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security administrator at Fabrikam reviews the monthly Defender XDR report and sees an increase in alerts related to a specific threat actor. The administrator wants to understand the actor's tactics and techniques and determine if any of their assets are at risk. What should the administrator do?

   • ARun an advanced hunting query for all alerts related to the actor
   • BReview the Defender XDR report for affected assets
   • CIncrease the Secure Score target to mitigate the actor's techniques
   • DUse Defender Threat Intelligence to review the actor's profile and then use Exposure Management to check asset exposure to the actor's techniques
   Reveal Solution Discussion Select an answer first