Ms-102 Implement Threat Intelligence in Microsoft Defender

Question 1

To get to the Alerts Queue in Defender

Answer 1

In the navigation pane, you must select the Incidents & alerts group to expand it, and then select Alerts.

Question 2

The manage alert pane allows you to

Answer 2

view or specify:

The alert status (New, Resolved, In progress).

The user account which Microsoft Defender XDR assigned to the alert.

The alert’s classification:

Not set. This option is the default setting.

True positive. Use this classification for alerts that accurately indicate a real threat. Specifying the threat type helps your security team see threat patterns and act to defend your organization from them.

Informational, expected activity. Use the options in this category to classify alerts. For example, for security tests, red team activity, and expected unusual behavior from trusted apps and users.

False positive. Use this classification for the type of alerts related to nonmalicious activity. Classifying alerts as false positive helps Microsoft Defender XDR improve its detection quality.

Question 3

(AIR)

Answer 3

Automated investigation and response

Question 4

to select an item in the Action center

Answer 4

Go to the Microsoft Defender portal and sign in.
In the navigation pane, select Actions & submissions, and then select Action center.
On the Action center pane, the Pending tab is displayed by default. Select either the Pending or History tab and then select an item. The system displays a detail pane for the selected item.

Question 5

which of the following items triggers the start of an automated investigation?

Answer 5

An incident, in turn, can start an automated investigation. The automated investigation results in a verdict for each piece of evidence.

Question 6

How many days of raw data can you explore up to in an advanced threat hunting query?

Answer 6

30 days of raw data.

Question 7

To access Threat Analytics

Answer 7

Threat Intelligence –> Threat Analytics

Question 8

Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security)

Answer 8

identifies and combats cyberthreats across all your Microsoft and third-party cloud services.

Question 9

Cloud Discovery

Answer 9

uses an organization’s traffic logs to dynamically discover and analyze the cloud apps that it’s using.

Question 10

Cloud app catalog

Answer 10

growing catalog of over 25,000 cloud apps. Microsoft ranked and scored the apps based on industry standards.

Question 11

App connectors

Answer 11

facilitate the integration between the Cloud App Security service and cloud applications.

Question 12

Policy control

Answer 12

detect risky behavior, violations, or suspicious data points and activities in an organization’s cloud environment.

Question 13

Access the Defender for Cloud Apps portal

Answer 13

in the Microsoft Defender portal, the Cloud Apps section in the left-hand navigation pane provides links to the Microsoft Defender for Cloud Apps features. Select Settings to navigate to the Settings page.

On the Settings page, select Cloud Apps to navigate to the Settings page for Cloud Apps.

Question 14

Create a new file policy

Answer 14

On the Microsoft Defender for Cloud Apps portal, select Control in the navigation pane, and then select Policies.

On the Policies page, the All policies tab is displayed by default. Select the Information protection tab.

In the Information protection tab, select +Create policy on the menu bar. In the drop-down menu that appears, select File policy.

Question 15

Monitor alerts

Answer 15

n the Microsoft Defender portal, in the left-hand navigation pane, select Incidents & alerts to expand the group, and then select Alerts.
On the Alerts page, select Add filter on the menu bar.

Question 16

Microsoft Defender for Endpoint

Answer 16

enterprise endpoint security platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats.

Use: Endpoint behavioral sensors, Cloud security analytics, Threat intelligence

Question 17

Attack surface reduction.

Answer 17

attack surface reduction capabilities can resist attacks and exploitation. The capabilities also include network protection and web protection. These features regulate access to malicious IP addresses, domains, and URLs.

Question 18

Microsoft Defender for Endpoint Plan 1

Answer 18

Next-generation protection

Attack surface reduction

Manual response actions

Centralized management

Security reports

APIs

Question 19

Microsoft Defender for Endpoint Plan 2

Answer 19

Microsoft Defender for Endpoint Plan 1, plus:

Device discovery

Vulnerability management

Threat Analytics

Automated investigation and response

Advanced hunting

Endpoint detection and response

Microsoft Threat Experts

Question 20

Which Microsoft Defender for Endpoint capability provides the frontline of defense in the stack?

Answer 20

he attack surface reduction set of capabilities provides the frontline of defense in the stack.

Question 21

Microsoft Defender for endpoint works for what OS’s:

Answer 21

Android
iOS/iPadOS
Windows 10/11

Question 22

Enable Microsoft Defender for Endpoint in Intune

Answer 22

In the Microsoft Intune admin center, select Endpoint security in the navigation pane.

On the Endpoint security | Overview page, under the Setup section in the middle pane, select Microsoft Defender for Endpoint.

On the Endpoint security | Microsoft Defender for Endpoint page, scroll down to the Shared settings section and select Open the Microsoft Defender Security Center. This step opens the Microsoft Defender portal.

In the Microsoft Defender portal, in the left-hand navigation pane, select Settings, then Endpoints, and then Advanced features.

Set the toggle switch for the Microsoft Intune connection setting to On.

Question 23

Create the device configuration profile to onboard Windows devices

Answer 23

In the Microsoft Intune admin center, select Endpoint security in the left-hand navigation pane.

In the Endpoint security | Overview page, under the Manage section in the middle pane, select Endpoint detection and response.

In the Endpoint security | Endpoint detection and response page, select +Create Policy on the menu bar.

In the Create a profile pane that appears, select Windows 10 and Later in the Platform field.

In the Profile field, select Endpoint detection and response.

Select Create. Doing so initiates the Create profile wizard.

In the Create profile wizard, on the Basics tab, enter a Name and Description (optional) for the profile, and then select Next.

Question 24

configuring Microsoft Defender for Endpoint as part of a compliance policy:

Answer 24

In the Microsoft Intune admin center, select Devices in the left-hand navigation pane.

On the Devices | Overview page, under the Policy section in the middle pane, select Compliance policies.

On the Compliance policies | Policies page, select +Create profile on the menu bar.

In the Create a policy pane that appears, select in the Platform field and then select one of the platforms from the drop-down menu that appears. Select Create. Doing so initiates the [selected platform] compliance policy wizard.

In the [selected platform] compliance policy wizard, on the Basics tab, enter a policy Name and Description (optional). Select Next.

Question 25

Microsoft Defender Vulnerability Management

Answer 25

rapidly and continuously prioritizes the biggest vulnerabilities on an organization's most critical assets. It also provides security recommendations to mitigate risk.

Question 26

Complete the following steps to set up device discovery:

Answer 26

Navigate to the Microsoft Defender portal. In the navigation pane in the Microsoft Defender portal, select Settings, and then select Device discovery. If you want to configure Basic as the discovery mode to use on your onboarded devices, select Basic, and then select Save. If you selected the option to use Standard discovery, select one of the following options to determine which devices to use for active probing: All devices A subset of devices by specifying their device tags

Question 27

To view and use Threat Trackers

Answer 27

o to the Microsoft Defender portal, and then under the Email and collaboration section in the navigation pane, select Threat tracker.

Question 28

Threat Trackers

Answer 28

informative widgets and views that provide organizations with intelligence on different cybersecurity issues

Question 29

To access Attack simulation training,

Answer 29

navigate to the Microsoft Defender portal and select Email and collaboration > Attack simulation training.

Question 30

prerequisites to run Attack simulation training:

Answer 30

The organization must have either a Microsoft 365 E5 subscription, or Microsoft Defender for Office 365 Plan 2. The user running the attack simulation training must have one of the following Microsoft 365 roles: Global Administrator Security Administrator Either of the following roles designed specifically for Attack simulation training: Attack Simulator Administrators. Create and manage all aspects of attack simulation campaigns. Attack Simulator Payload Authors. Create attack payloads that an admin can start later.