Crucial Exams

Microsoft 365 Administrator Expert MS-102 Practice Question

While reviewing an alert in Microsoft 365 Defender, you verify that a newly detected phishing campaign delivered several malicious messages to user mailboxes. You want Microsoft Defender for Office 365 to automatically analyze the campaign, correlate related artifacts, and, if confirmed malicious, remove the messages and block any associated indicators with minimal additional effort from you. Which feature should you use to initiate this workflow directly from the alert or Explorer view?

  • Start an Automated Investigation and Response (AIR) action.

  • Enable Safe Links for the affected users.

  • Create an advanced hunting query in Microsoft 365 Defender.

  • Run an Attack simulation campaign.

Microsoft 365 Administrator Expert MS-102
Manage security and threats by using Microsoft Defender XDR
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot