MS-102 Practice Question 3086
Exam: MS-102
Domain: Manage security and threats using Microsoft Defender XDR
Difficulty: hard
When AIR detects that a user account has been compromised, what automated action can it recommend or take regarding user mail forwarding rules?
Answer Options
A
Detecting and removing unauthorized inbox forwarding rules
B
Formatting the user mailbox database
C
Sending a text message to the attacker
D
Converting the mailbox into a public folder
Correct Answer
A: Detecting and removing unauthorized inbox forwarding rules
Explanation
Defender for Office 365 AIR investigations identify unauthorized inbox forwarding rules created by attackers and can automatically disable or remove the malicious forwarding rule.