Review and Respond to Security Reports and Alerts Generated by Microsoft Defender XDR MS-102 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In the Microsoft Defender XDR portal, what is the first step when you receive a high-severity alert?

   • AChange the alert severity to low to avoid escalation
   • BReview the alert details and associated evidence to determine if it is a true positive
   • CForward the alert to the legal department for compliance review
   • DImmediately delete the alert to reduce noise
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security admin at Fabrikam reviews the Defender XDR report and notices a high number of 'Suspicious sign-in' alerts from a specific region. The admin wants to determine if this is a coordinated attack or just normal user behavior. Which additional data source should the admin review?

   • AMicrosoft Security Exposure Management to view attack paths.
   • BMicrosoft Secure Score to see if the score has changed.
   • CAdvanced hunting queries for sign-in events from that region, correlated with user travel patterns.
   • DThe Defender XDR report's summary page only.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security admin at Fabrikam receives a Defender XDR alert about a possible malware infection on a device. The admin wants to determine if the malware communicated with a known command-and-control (C2) server. Which advanced hunting query approach is most appropriate?

   • AQuery DeviceFileEvents for files downloaded from the internet.
   • BQuery DeviceNetworkEvents for connections to IPs or domains listed in Microsoft Defender Threat Intelligence.
   • CQuery IdentityLogonEvents for any user who logged on to the device.
   • DQuery DeviceProcessEvents for any process that created a network connection.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   Fabrikam's security team reviews the monthly Defender XDR report and sees a spike in alerts related to a specific phishing campaign. The team wants to understand the campaign's infrastructure and whether any internal users clicked the malicious links. What should they do?

   • AOnly review the Defender XDR report for affected users
   • BIncrease the Secure Score target to reduce phishing risk
   • CUse Microsoft Defender Threat Intelligence to analyze the campaign and then run an advanced hunting query to find user interactions
   • DDisable the phishing alerts to reduce noise
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which query language is used in Microsoft Defender XDR Advanced Hunting?

   • AKusto Query Language (KQL)
   • BPowerShell
   • CSQL
   • DPython
   Reveal Solution Discussion Select an answer first