Microsoft 365 Administrator Expert Managing Defender for Office Flashcards
7 cards from real MS-102 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Microsoft 365 Administrator Expert Managing Defender for Office flashcards as text
An administrator wants to prevent end users from releasing their own quarantined messages that were identified as high-confidence phishing. Which quarantine policy setting achieves this?
Answer: Assign a quarantine policy that grants NoAccess permissions to end users
Assigning a quarantine policy with NoAccess permissions prevents end users from viewing or releasing their quarantined messages, keeping admin control over high-confidence phishing verdicts.
Which action in Threat Explorer allows an admin to move a set of malicious emails already delivered to user inboxes into quarantine?
Answer: Move to Quarantine
The 'Move to Quarantine' remediation action in Threat Explorer allows admins to move delivered malicious messages from user mailboxes directly into quarantine.
An organization enables DMARC enforcement with a policy of 'reject'. Which Defender for Office 365 feature can override this and still deliver the email based on implicit trust?
Answer: Tenant Allow/Block List (TABL) spoofed senders
Adding a spoofed sender entry to the Tenant Allow/Block List allows messages from that sender to bypass DMARC rejection and be delivered to inboxes.
What does the 'Apply real-time URL detonation' option in Safe Attachments do?
Answer: Detonates URLs embedded within Safe Attachments-scanned files at time of click
The real-time URL detonation option in Safe Attachments causes URLs found inside scanned attachment files to be detonated at click time for additional protection.
An administrator needs to identify all emails sent from a specific domain in the last 7 days that were delivered to inboxes but contain URLs flagged as malicious post-delivery. Which tool is best suited?
Answer: Threat Explorer with URL clicks view filtered by verdict
Threat Explorer's URL clicks view can be filtered by domain, time range, and URL verdict to identify post-delivery malicious URL detections in delivered messages.
Which Defender for Office 365 Plan 2 feature automates the investigation of alerts and correlates related artifacts like emails, users, and URLs into a single incident?
Answer: Automated investigation and response (AIR)
Automated investigation and response (AIR) in Defender for Office 365 Plan 2 automatically investigates triggered alerts, correlates related evidence, and recommends or takes remediation actions.
An admin wants to allow a third-party bulk mailer's IP address to bypass spam filtering without disabling anti-malware checks. Which configuration achieves this?
Answer: Add the IP to a mail flow rule that sets SCL to -1
A mail flow (transport) rule that sets the Spam Confidence Level (SCL) to -1 for messages from the IP bypasses spam filtering while leaving anti-malware checks intact.