MS-102 Microsoft 365 Administrator Expert Managing Defender for Office 4 — Questions and Answers
Question 1: Which policy in Defender for Office 365 protects users from emails that impersonate a specific trusted domain by analyzing the sender's domain against a list of protected domains?
- Anti-spam policy with domain block list
- Anti-phishing policy with domain impersonation protection (Correct answer)
- DMARC enforcement policy
- Safe Attachments policy with dynamic delivery
Correct answer: Anti-phishing policy with domain impersonation protection
The anti-phishing policy's domain impersonation protection feature checks inbound sender domains against a configured list of protected domains and takes action when lookalike domains are detected.
Question 2: A Defender for Office 365 alert fires indicating that a user clicked a malicious URL. Which AIR playbook is automatically triggered in response?
- Phish delivered due to ETR or IP Allow
- User-reported phish analysis playbook
- URL click verdict changed to malicious playbook (Correct answer)
- Malware campaign detected playbook
Correct answer: URL click verdict changed to malicious playbook
When a user clicks a URL that is later determined to be malicious, the 'URL click verdict changed to malicious' AIR playbook automatically investigates the click and associated emails.
Question 3: What is the maximum number of days that a message can be retained in quarantine in Defender for Office 365 before it is automatically deleted?
- 15 days
- 30 days (Correct answer)
- 60 days
- 90 days
Correct answer: 30 days
Quarantined messages in Defender for Office 365 are retained for a maximum of 30 days, after which they are automatically and permanently deleted.
Question 4: An administrator is reviewing the Attack simulation training results and notices that a department has a very high click rate on simulated phishing emails. What is the recommended next step?
- Immediately block all external email to that department
- Assign targeted training courses to users who clicked the simulated phishing link (Correct answer)
- Enable Safe Attachments dynamic delivery only for that department
- Increase the bulk complaint level threshold for that department
Correct answer: Assign targeted training courses to users who clicked the simulated phishing link
Attack simulation training allows admins to automatically assign relevant security awareness training to users who failed (clicked) a simulation, which is the recommended remediation.
Question 5: Which configuration allows Defender for Office 365 Safe Links to track which users clicked a specific URL in a phishing campaign?
- Enable URL detonation intelligence sharing
- Enable 'Track user clicks' in the Safe Links policy (Correct answer)
- Enable 'Do not allow users to click through to the original URL' setting
- Enable user-reported message settings
Correct answer: Enable 'Track user clicks' in the Safe Links policy
The 'Track user clicks' setting in the Safe Links policy records click data, allowing administrators to see which users clicked specific URLs via Threat Explorer and URL click reports.
Question 6: Which Defender for Office 365 feature uses machine learning to detect unusual email sending patterns from a compromised internal account?
- Outbound spam policy anomaly detection
- Anti-malware heuristic scanning
- User entity behavior analytics (UEBA) via Compromised user alert policy (Correct answer)
- Safe Attachments for SharePoint
Correct answer: User entity behavior analytics (UEBA) via Compromised user alert policy
The 'User restricted from sending email' and 'Suspicious email sending patterns detected' alert policies in Defender for Office 365 use anomaly detection to identify potentially compromised accounts.
Question 7: An admin wants to ensure that Safe Attachments scans files uploaded to SharePoint Online team sites. Which PowerShell command enables this?
- Set-AtpPolicyForO365 -EnableATPForSPOTeamsODB $true (Correct answer)
- Set-SafeAttachmentPolicy -EnableForInternalSenders $true
- Set-MalwareFilterPolicy -EnableFileFilter $true
- Set-AntiPhishPolicy -EnableSpoofIntelligence $true
Correct answer: Set-AtpPolicyForO365 -EnableATPForSPOTeamsODB $true
The Set-AtpPolicyForO365 cmdlet with the -EnableATPForSPOTeamsODB $true parameter enables Safe Attachments scanning for SharePoint Online, OneDrive for Business, and Teams.
MS-102 Microsoft 365 Administrator Expert Managing Defender for Office 4
Which policy in Defender for Office 365 protects users from emails that impersonate a specific trusted domain by analyzing the sender's domain against a list of protected domains?