Microsoft 365 Administrator Expert Managing Defender for Office Flashcards

Which policy in Defender for Office 365 protects users from emails that impersonate a specific trusted domain by analyzing the sender's domain against a list of protected domains?

Answer: Anti-phishing policy with domain impersonation protection

The anti-phishing policy's domain impersonation protection feature checks inbound sender domains against a configured list of protected domains and takes action when lookalike domains are detected.

A Defender for Office 365 alert fires indicating that a user clicked a malicious URL. Which AIR playbook is automatically triggered in response?

Answer: URL click verdict changed to malicious playbook

When a user clicks a URL that is later determined to be malicious, the 'URL click verdict changed to malicious' AIR playbook automatically investigates the click and associated emails.

What is the maximum number of days that a message can be retained in quarantine in Defender for Office 365 before it is automatically deleted?

Answer: 30 days

Quarantined messages in Defender for Office 365 are retained for a maximum of 30 days, after which they are automatically and permanently deleted.

An administrator is reviewing the Attack simulation training results and notices that a department has a very high click rate on simulated phishing emails. What is the recommended next step?

Answer: Assign targeted training courses to users who clicked the simulated phishing link

Attack simulation training allows admins to automatically assign relevant security awareness training to users who failed (clicked) a simulation, which is the recommended remediation.

Which configuration allows Defender for Office 365 Safe Links to track which users clicked a specific URL in a phishing campaign?

Answer: Enable 'Track user clicks' in the Safe Links policy

The 'Track user clicks' setting in the Safe Links policy records click data, allowing administrators to see which users clicked specific URLs via Threat Explorer and URL click reports.

Which Defender for Office 365 feature uses machine learning to detect unusual email sending patterns from a compromised internal account?

Answer: User entity behavior analytics (UEBA) via Compromised user alert policy

The 'User restricted from sending email' and 'Suspicious email sending patterns detected' alert policies in Defender for Office 365 use anomaly detection to identify potentially compromised accounts.

An admin wants to ensure that Safe Attachments scans files uploaded to SharePoint Online team sites. Which PowerShell command enables this?

Answer: Set-AtpPolicyForO365 -EnableATPForSPOTeamsODB $true

The Set-AtpPolicyForO365 cmdlet with the -EnableATPForSPOTeamsODB $true parameter enables Safe Attachments scanning for SharePoint Online, OneDrive for Business, and Teams.