MS-102 Microsoft 365 Administrator Expert Managing Defender for Office 4

Question 1

Which policy in Defender for Office 365 protects users from emails that impersonate a specific trusted domain by analyzing the sender's domain against a list of protected domains?

Accepted Answer

Anti-phishing policy with domain impersonation protection

Answer

The anti-phishing policy's domain impersonation protection feature checks inbound sender domains against a configured list of protected domains and takes action when lookalike domains are detected.

Question 2

A Defender for Office 365 alert fires indicating that a user clicked a malicious URL. Which AIR playbook is automatically triggered in response?

Accepted Answer

URL click verdict changed to malicious playbook

Answer

When a user clicks a URL that is later determined to be malicious, the 'URL click verdict changed to malicious' AIR playbook automatically investigates the click and associated emails.

Question 3

What is the maximum number of days that a message can be retained in quarantine in Defender for Office 365 before it is automatically deleted?

Accepted Answer

30 days

Answer

Quarantined messages in Defender for Office 365 are retained for a maximum of 30 days, after which they are automatically and permanently deleted.

Question 4

An administrator is reviewing the Attack simulation training results and notices that a department has a very high click rate on simulated phishing emails. What is the recommended next step?

Accepted Answer

Assign targeted training courses to users who clicked the simulated phishing link

Answer

Attack simulation training allows admins to automatically assign relevant security awareness training to users who failed (clicked) a simulation, which is the recommended remediation.

Question 5

Which configuration allows Defender for Office 365 Safe Links to track which users clicked a specific URL in a phishing campaign?

Accepted Answer

Enable 'Track user clicks' in the Safe Links policy

Answer

The 'Track user clicks' setting in the Safe Links policy records click data, allowing administrators to see which users clicked specific URLs via Threat Explorer and URL click reports.

(MS-102) Microsoft 365 Administrator Expert Practice Test

(MS-102) Microsoft 365 Administrator Expert Practice Test

MS-102 Microsoft 365 Administrator Expert Managing Defender for Office 4