Crucial Exams

Microsoft 365 Administrator Expert MS-102 Practice Question

Several users report receiving a phishing message that contains the URL https://contoso-finance-update.com./ The message bypassed filtering but has since been identified as malicious. You have Microsoft 365 E5 with Microsoft Defender for Office 365 Plan 2. You must locate every copy of the message in the tenant and immediately purge it from all mailboxes.

Which action should you perform first in the Microsoft 365 Defender portal?

  • Run a URL search for https://contoso-finance-update.com/ in Threat Explorer (Email & collaboration > Explorer).

  • Run Get-MessageTrace in Exchange Online PowerShell, export the results, and pass each MessageId to the Remove-Message cmdlet.

  • Add contoso-finance-update.com as a blocked domain in the Tenant Allow/Block List.

  • Create a new content search in the Microsoft Purview compliance portal and add a purge action.

Microsoft 365 Administrator Expert MS-102
Manage security and threats by using Microsoft Defender XDR
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot