Microsoft 365 Administrator Expert Managing Defender for Office Flashcards
7 cards from real MS-102 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Microsoft 365 Administrator Expert Managing Defender for Office flashcards as text
An administrator needs to allow a legitimate marketing vendor's emails to bypass Defender for Office 365 anti-phishing checks temporarily. Which is the most targeted approach?
Answer: Add the vendor's domain to the Tenant Allow/Block List as an allowed sender
Adding the vendor's domain to the Tenant Allow/Block List as an allowed sender is the most targeted method, scoped to that specific domain without affecting other policies globally.
Which Defender for Office 365 report shows the top targeted users in impersonation attacks over a selected time period?
Answer: Impersonation insight report
The Impersonation insight report in the Microsoft Defender portal shows which users and domains are most frequently targeted by impersonation-based phishing attempts.
What happens to a message when the Safe Attachments policy action is set to 'Dynamic Delivery'?
Answer: The email body is delivered immediately to the recipient while the attachment is scanned in parallel and re-attached after scanning
Dynamic Delivery delivers the email body immediately while simultaneously scanning the attachment, then re-attaches the clean file once scanning is complete, minimizing delivery delays.
An organization's Defender for Office 365 tenant is generating too many false positives for bulk email from a legitimate newsletter service. Which setting should be adjusted first?
Answer: Increase the Bulk Complaint Level (BCL) threshold in the anti-spam policy
Raising the BCL threshold in the anti-spam inbound policy allows bulk email with higher BCL scores to pass through, reducing false positives from legitimate newsletter services.
A security admin wants to configure Defender for Office 365 so that end users receive a weekly digest of their quarantined messages. Where is this configured?
Answer: Quarantine policy end-user notification settings
Quarantine policies include end-user notification settings where admins can configure the frequency (daily, twice per day, or weekly) of quarantine digest emails sent to users.
Which pre-built security policy in Defender for Office 365 applies the most aggressive protection settings and is recommended for high-risk users like executives?
Answer: Strict protection preset security policy
The Strict preset security policy applies the most aggressive Defender for Office 365 protection settings and is recommended for high-value or high-risk users such as executives and privileged accounts.
An admin observes in the Threat protection status report that many messages are being delivered despite having a phish verdict due to an ETR override. What does 'ETR' stand for in this context?
Answer: Exchange Transport Rule
ETR stands for Exchange Transport Rule; when a transport rule is configured to bypass filtering (e.g., setting SCL to -1), it can override phishing verdicts and force message delivery.