You have 1,000 on-premises Windows 11 Pro devices that are onboarded to Microsoft Defender for Endpoint.
You have a Microsoft 365 subscription that uses Microsoft Defender XDR.
You identify that an attacker performed the following actions on a device:
• Modified the filesystem path of a registry-based antivirus exclusion
• Downloaded a malicious file to the file system path
You initiate a live response session on the device.
You need to undo the registry change.
Which command should you run?
A. remediate
B. registry
C. scan
D. analyze
Show Answer
Correct Answer: A
Explanation: The correct live response command is 'remediate'. In Microsoft Defender for Endpoint Live Response, the 'registry' command is for inspecting/querying the registry, while 'remediate' can remove malicious artifacts, including deleting registry keys/values as part of remediation. To undo a malicious registry-based antivirus exclusion, use 'remediate'.
Question 97
You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1. WS1 has the Azure Activity connector and the Microsoft Entra ID connector configured.
You need to investigate which accounts have the most alerts and any corresponding incident information for each alert. The solution must minimize administrative effort.
What should you do first in WS1?
A. Use User and Entity Behavior Analytics (UEBA) to detect anomalies.
B. Enable User and Entity Behavior Analytics (UEBA).
C. From Content hub, install the Microsoft Purview insider risk management solution.
D. From Content hub, install Cloud Identity Threat Protection Essentials.
Show Answer
Correct Answer: B
Explanation: UEBA must be enabled before its investigations and entity insights can be used. The requirement is to investigate which accounts have the most alerts and corresponding incident information with minimal administrative effort. Enabling UEBA enriches user and entity data and supports these investigations. Simply using UEBA is not possible until it is enabled, and the Content hub solutions listed are not the required first step.
Question 98
You have a Microsoft 365 subscription that contains a user named User1 and two Windows devices named Device1 and Device2. Device1 and Device2 are onboarded to Microsoft Defender for Endpoint.
The following events occur.
• User1 signs in to Device1.
• Automatic attack disruption in Microsoft Defender XDR responds to an attack on Device1 and contains User1.
• User1 attempts to connect to Device2.
Which protocols will Device2 block when User1 attempts to connect to Device2?
A. RDP only
B. RPC only
C. SMB only
D. RDP and RPC only
E. SMB and RPC only
F. RDP, RPC, and SMB
Show Answer
Correct Answer: F
Explanation: When a user is contained by Microsoft Defender XDR automatic attack disruption, Microsoft Defender for Endpoint enforces identity containment across onboarded devices by blocking incoming remote connections from that contained identity over the supported lateral movement protocols: RDP, RPC, and SMB. Existing RDP sessions are also terminated, helping prevent lateral movement while allowing legitimate non-blocked traffic.
Question 99
You have a Microsoft 365 subscription.
You have the following KQL query.
You need to ensure that you can create a Microsoft Defender XDR custom detection rule by using the query.
What should you add to the query?
A. | summarize (Timestamp, ReportId)=arg_max(Timestamp, ReportId), count() by DeviceId
B. | summarize (ReportId)=make_set(ReportId), count() by DeviceId
C. | summarize (Timestamp, DeviceName)=arg_min(Timestamp, DeviceName), count() by DeviceId
D. | summarize (Timestamp)=range(Timestamp), count() by DeviceId
Show Answer
Correct Answer: A
Explanation: Microsoft Defender XDR custom detection queries must return a unique event with the required identifiers. Using arg_max(Timestamp, ReportId) while summarizing by DeviceId preserves the latest event and retains both Timestamp and ReportId, which are required for creating custom detection rules. The other options either aggregate ReportId into a set, use arg_min, or use an invalid range aggregation for this purpose.
Question 100
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft 365 subscription.
You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.
You need to ensure that the devices are protected from malicious artifacts that were undetected by the third-party antivirus product.
Solution: You configure endpoint detection and response (EDR) in block mode.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: EDR in block mode is designed for devices where Microsoft Defender Antivirus is running in passive mode alongside a third-party antivirus. It can detect and remediate malicious artifacts that the primary antivirus missed, providing an additional layer of protection without replacing the third-party AV.
Question 101
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft 365 subscription.
You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.
You need to ensure that the devices are protected from malicious artifacts that were undetected by the third-party antivirus product.
Solution: You configure Controlled folder access.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Controlled folder access is a Microsoft Defender Antivirus feature focused on preventing unauthorized changes to protected folders, primarily against ransomware. It does not provide the required protection against malicious artifacts missed by a third-party antivirus when Microsoft Defender Antivirus is in passive mode. The feature designed for this scenario is Microsoft Defender for Endpoint EDR in block mode, which can detect and remediate threats missed by the primary antivirus even when Defender Antivirus is passive.
Question 102
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft 365 subscription.
You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.
You need to ensure that the devices are protected from malicious artifacts that were undetected by the third-party antivirus product.
Solution: You enable automated investigation and response (AIR).
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Automated Investigation and Response (AIR) automates investigation and remediation after detections, but it is not the feature that provides protection against malware missed by a third-party antivirus when Microsoft Defender Antivirus is in passive mode. In this scenario, the required capability is Microsoft Defender for Endpoint EDR in block mode, which can block malicious artifacts even when another antivirus is the primary AV. Therefore, enabling AIR alone does not meet the stated goal.
Question 103
You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security.
You start a Copilot for Security session and enter five prompts that each provide responses.
You need to create a promptbook that will use the prompts but will NOT contain the responses. The solution must minimize administrative effort.
What should you do?
A. Select each prompt, and then select Create promptbook.
B. Create a new promptbook and include each prompt.
C. Enter a new prompt that has the following input: Create a promptbook from my session prompts.
D. Share the session, and then select Create promptbook.
Show Answer
Correct Answer: A
Explanation: Copilot for Security supports creating a promptbook directly from an existing session by selecting the prompts you want to reuse and choosing Create promptbook. This captures the prompts without including the generated responses, avoiding manual recreation of each prompt in a new promptbook. Creating a new promptbook manually requires more effort, there is no supported natural-language command to generate a promptbook this way, and sharing a session is not the workflow for creating promptbooks.
Question 104
You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security.
You plan to run the following code to create a custom Copilot for Security plugin.
You need to specify a format and complete the code segment.
Which format should you use for the
variable?
A. API
B. GPT
C. KQL
D. SQL
Show Answer
Correct Answer: C
Explanation: The correct format is KQL. Microsoft Copilot for Security supports custom plugins based on Kusto Query Language (KQL) skills, where the format specified for the skill is KQL. GPT is not a plugin format in this context, SQL is not used for Copilot Security plugins, and API refers to a different plugin type rather than the format used for the skill/code segment.
Question 105
You have a Microsoft 365 subscription that uses Microsoft Defender XDR.
You discover that when Microsoft Defender for Endpoint generates alerts for a commonly used executable file, it causes alert fatigue.
You need to tune the alerts.
Which two actions can an alert tuning rule perform for the alerts? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. delete
B. hide
C. resolve
D. merge
E. assign
Show Answer
Correct Answer: B, C
Explanation: Microsoft Defender XDR alert tuning rules support actions to hide alerts or automatically resolve alerts that match specified conditions (such as a known executable), helping reduce alert fatigue. They do not delete, merge, or assign alerts.
$19
Get all 383 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.