Review and Respond to Security Reports and Alerts Generated by Microsoft Defender XDR MS-102 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of Advanced Hunting in Microsoft Defender XDR?

   • ATo automatically block all malicious IP addresses
   • BTo create custom detection rules based on query results
   • CTo proactively search for threats and suspicious activities across your environment
   • DTo generate compliance reports for regulatory audits
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security analyst at Fabrikam is investigating a Defender XDR incident that involves a suspicious file. The analyst has the file's SHA-256 hash and wants to determine if the file is known malware, whether it has been seen in other incidents in the tenant, and if any devices have executed it. The analyst needs to do this efficiently without leaving the Defender XDR portal. What should the analyst do?

   • ASearch Microsoft Defender Threat Intelligence for the hash
   • BRun an advanced hunting query on DeviceFileEvents to find executions
   • CCheck the Defender XDR report for file detections
   • DUse the file's entity page to view threat intelligence, related incidents, and a list of devices that have executed the file
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst at Fabrikam is investigating a Defender XDR alert about a possible credential theft. The analyst needs to find all devices where the compromised account was used to sign in during the last 7 days. Which advanced hunting query should they run?

   • AQuery AlertInfo for the account name
   • BQuery DeviceLogonEvents for the account name
   • CQuery EmailEvents for the account name
   • DQuery IdentityLogonEvents for the account name and time range
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security analyst at Contoso is reviewing a Defender XDR alert that was generated by a custom detection rule. The alert has a low confidence score, and the analyst wants to determine if the alert is a true positive without spending too much time. The analyst also wants to see if similar activity has occurred before. What should the analyst do?

   • ACheck the Secure Score for related recommendations
   • BEscalate the alert to a senior analyst without investigation
   • CUse the alert's investigation page to review related events and run an advanced hunting query for similar activity in the past
   • DImmediately close the alert as a false positive based on the low confidence score
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security operations manager at Contoso is reviewing the team's response to a recent incident. The team received multiple alerts, but some were not investigated because they were considered low priority. The manager wants to improve the team's alert triage process. What should the manager do?

   • AInvestigate all alerts equally, regardless of severity.
   • BRely on the Microsoft Secure Score to prioritize alerts.
   • CImplement a formal alert triage process that includes severity, impact, and false-positive analysis.
   • DUse Defender XDR reports to identify which alerts to ignore.
   Reveal Solution Discussion Select an answer first