MS-102 Microsoft 365 Administrator Expert Managing Defender for Office 3

Question 1

An administrator wants to prevent end users from releasing their own quarantined messages that were identified as high-confidence phishing. Which quarantine policy setting achieves this?

Accepted Answer

Assign a quarantine policy that grants NoAccess permissions to end users

Answer

Assigning a quarantine policy with NoAccess permissions prevents end users from viewing or releasing their quarantined messages, keeping admin control over high-confidence phishing verdicts.

Question 2

Which action in Threat Explorer allows an admin to move a set of malicious emails already delivered to user inboxes into quarantine?

Accepted Answer

Move to Quarantine

Answer

The 'Move to Quarantine' remediation action in Threat Explorer allows admins to move delivered malicious messages from user mailboxes directly into quarantine.

Question 3

An organization enables DMARC enforcement with a policy of 'reject'. Which Defender for Office 365 feature can override this and still deliver the email based on implicit trust?

Accepted Answer

Tenant Allow/Block List (TABL) spoofed senders

Answer

Adding a spoofed sender entry to the Tenant Allow/Block List allows messages from that sender to bypass DMARC rejection and be delivered to inboxes.

Question 4

What does the 'Apply real-time URL detonation' option in Safe Attachments do?

Accepted Answer

Detonates URLs embedded within Safe Attachments-scanned files at time of click

Answer

The real-time URL detonation option in Safe Attachments causes URLs found inside scanned attachment files to be detonated at click time for additional protection.

Question 5

An administrator needs to identify all emails sent from a specific domain in the last 7 days that were delivered to inboxes but contain URLs flagged as malicious post-delivery. Which tool is best suited?

Accepted Answer

Threat Explorer with URL clicks view filtered by verdict

Answer

Threat Explorer's URL clicks view can be filtered by domain, time range, and URL verdict to identify post-delivery malicious URL detections in delivered messages.

(MS-102) Microsoft 365 Administrator Expert Practice Test

(MS-102) Microsoft 365 Administrator Expert Practice Test

MS-102 Microsoft 365 Administrator Expert Managing Defender for Office 3