Crucial Exams

Microsoft 365 Administrator Expert MS-102 Practice Question

Your company uses Microsoft Defender for Office 365. You must be notified whenever any user sets up client-side forwarding that sends email to an external domain. The security team requires the notification to appear in the Microsoft 365 Defender portal and to be delivered by email, without relying on custom scripts or third-party services. What should you do first to meet the requirement with the least administrative effort?

  • Enable mailbox auditing for all users and build a scheduled advanced hunting query that emails results.

  • Configure an Exchange transport rule that blocks external forwarding and enable audit logging.

  • Create a new custom alert policy in Microsoft 365 Defender and select the activity "User created or modified an inbox rule that forwards messages".

  • Create a Conditional Access policy that prevents external forwarding of email.

Microsoft 365 Administrator Expert MS-102
Manage security and threats by using Microsoft Defender XDR
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot