Microsoft 365 Administrator MS-102 MS-102 Questions 76–150 | Page 2/4

MCQmedium

Your organization uses Microsoft Defender for Office 365. You need to ensure that users are warned before opening potentially malicious attachments in Outlook on the web. Which policy setting should you configure?

A.Attachments in email are blocked

B.Open in protected view

C.Attachments are held and scanned

D.Dynamic Delivery

AnswerB

This displays a warning before opening a file in a sandboxed view.

Why this answer

The 'Open in protected view' policy setting in Microsoft Defender for Office 365 ensures that when a user opens an email attachment in Outlook on the web, the file is opened in a sandboxed, read-only environment that warns the user of potential risks before allowing full interaction. This directly addresses the requirement to warn users before opening potentially malicious attachments, as it triggers a warning banner and restricts editing capabilities until the user explicitly enables editing.

Exam trap

The trap here is that candidates often confuse 'Dynamic Delivery' with a warning mechanism, but Dynamic Delivery silently replaces the attachment with a safe preview and does not present any user-facing warning before opening.

How to eliminate wrong answers

Option A is wrong because 'Attachments in email are blocked' prevents delivery entirely, which does not warn users before opening—it simply removes the attachment, failing the requirement to provide a warning. Option C is wrong because 'Attachments are held and scanned' refers to the zero-hour auto purge (ZAP) or time-of-click protection that delays delivery for scanning, but it does not present a warning to the user at the point of opening; it either delivers or blocks after scanning. Option D is wrong because 'Dynamic Delivery' delivers a safe, previewed version of the attachment while the original is scanned, but it does not warn the user before opening—it replaces the attachment with a placeholder or preview, not a warning prompt.

Full explanation →

MCQhard

Your Microsoft 365 tenant contains sensitive financial data that must be retained for 7 years. You configure a retention policy in Microsoft Purview compliance portal. After 7 years, the data is still accessible to users. What is the most likely reason?

A.The retention policy does not include a deletion action.

B.A litigation hold is applied to the data.

C.The retention policy is configured to retain data for 7 years and then delete it.

D.The data is marked as a record and requires disposition review.

AnswerA

A retention policy without a deletion action is configured to only retain content for a specified period. In Microsoft 365, when a policy has only a retention action (no 'Delete items automatically' option selected), items remain indefinitely after the retention period expires. Because the policy never schedules a purge, the sensitive data persists in the tenant even after the retention timeframe elapses. This directly matches the scenario in the question.

Why this answer

A retention policy in Microsoft Purview can be configured to only retain data without a deletion action. If the policy lacks a deletion action, data will be preserved for the specified period but will not be automatically removed after that period expires, leaving it accessible to users. The scenario describes data still being accessible after 7 years, which directly indicates that no deletion action was configured to remove the data at the end of the retention period.

Exam trap

The trap here is that candidates often assume a retention policy automatically deletes data after the retention period ends, but Microsoft Purview requires an explicit deletion action to be configured for automatic removal; otherwise, the data is retained indefinitely.

How to eliminate wrong answers

Option B is wrong because a litigation hold preserves data indefinitely and prevents deletion, but it does not cause data to remain accessible after a retention period ends if the retention policy itself lacks a deletion action; the hold would keep the data, but the core issue is the missing deletion action. Option C is wrong because if the retention policy were configured to retain data for 7 years and then delete it, the data would be automatically removed after 7 years and would not remain accessible to users. Option D is wrong because marking data as a record and requiring disposition review means the data must be manually reviewed and approved before deletion, but this does not automatically keep the data accessible after the retention period; disposition review can delay deletion but does not explain why data remains accessible without any deletion action.

Full explanation →

MCQhard

A security analyst wants to create a custom detection rule that triggers when a device communicates with a new, unclassified IP address that has been flagged by Microsoft threat intelligence as potentially malicious. The rule should run every hour and create an incident if more than 5 such communications from the same device occur within a 24-hour window. Which advanced hunting tables should be joined in the KQL query for this rule?

A.DeviceNetworkEvents and IPReputation

B.DeviceProcessEvents and AlertInfo

C.DeviceFileEvents and DeviceIPInfo

D.EmailEvents and DeviceNetworkEvents

AnswerA

DeviceNetworkEvents records network connections including remote IPs. IPReputation provides Microsoft's threat intelligence score for IP addresses, allowing the rule to filter for connections to flagged IPs. These tables can be joined on the RemoteIP column.

Why this answer

The rule requires detecting network communications to potentially malicious IP addresses, which involves joining `DeviceNetworkEvents` (which logs network connections from devices) with `IPReputation` (which contains Microsoft's threat intelligence classifications for IP addresses). This join allows the query to filter for communications where the destination IP is flagged as malicious and then aggregate by device to trigger an incident when the count exceeds 5 within a 24-hour window.

Exam trap

The trap here is that candidates often confuse `DeviceNetworkEvents` with `DeviceProcessEvents` or `DeviceFileEvents`, mistakenly thinking process or file events can indicate network communication patterns, or they overlook that `IPReputation` is the specific table providing threat intelligence classification for IP addresses.

How to eliminate wrong answers

Option B is wrong because `DeviceProcessEvents` logs process creation events, not network communications, and `AlertInfo` contains metadata about alerts, not IP reputation data; this combination cannot detect communications with malicious IPs. Option C is wrong because `DeviceFileEvents` logs file creation/modification events, not network connections, and `DeviceIPInfo` provides IP configuration details (like DHCP leases) rather than threat intelligence reputation scores. Option D is wrong because `EmailEvents` tracks email delivery and phishing events, not device-level network communications, and joining it with `DeviceNetworkEvents` would not provide the required IP reputation data from Microsoft threat intelligence.

Full explanation →

MCQmedium

A company uses Microsoft Entra ID with Pass-through Authentication. The security team wants to block all sign-ins from countries that are not approved (e.g., high-risk regions). Which feature should they use?

A.Conditional Access policy with country location condition

B.Identity Protection sign-in risk policy

C.Identity Protection user risk policy

D.Named locations with blocked countries

AnswerA

Correct. Conditional Access allows blocking or allowing access based on country using Named Locations.

Why this answer

Conditional Access policies in Microsoft Entra ID can include a location condition that uses IP addresses to determine the country of origin. By configuring a policy to block access from specific countries (e.g., high-risk regions), the security team can enforce this requirement. This is the correct feature because it directly evaluates the geographic location of the sign-in request and applies an access control (block) accordingly.

Exam trap

The trap here is that candidates confuse Named locations (which are just definitions) with the actual enforcement mechanism, forgetting that a Conditional Access policy is required to apply the block action based on those locations.

How to eliminate wrong answers

Option B is wrong because Identity Protection sign-in risk policy evaluates the probability that a sign-in is compromised based on signals like anonymous IP addresses or atypical travel, not the geographic country of the sign-in. Option C is wrong because Identity Protection user risk policy assesses the likelihood that a user's identity has been compromised (e.g., leaked credentials), not the location of the sign-in. Option D is wrong because Named locations define a set of IP address ranges or countries/regions for use in Conditional Access policies, but they cannot directly block sign-ins; they must be referenced within a Conditional Access policy to enforce a block action.

Full explanation →

MCQmedium

A company uses Microsoft Entra ID with password hash synchronization. The security team wants to prevent users from setting passwords that include their username or common terms from a custom dictionary (e.g., company name, product names). Which feature should be configured?

A.Enable Azure AD Identity Protection with user risk policies.

B.Configure a custom banned passwords list in Microsoft Entra ID Password Protection.

C.Set a fine-grained password policy in on-premises Active Directory and sync it to Azure AD.

D.Enable MFA registration campaign to force users to register for MFA.

AnswerB

Configuring a custom banned passwords list in Microsoft Entra ID Password Protection allows you to define words, patterns, or strings that Entra ID automatically rejects whenever a user creates or resets a password. The service uses fuzzy matching (e.g., normalizing case, substitutions like '0' for 'o') and evaluates both the global Microsoft-list and your custom list, ensuring users cannot choose any password that fails the policy. This directly fulfills the requirement for a cloud-based password restriction.

Why this answer

Microsoft Entra ID Password Protection allows administrators to enforce custom banned password lists that prevent users from including specific terms (e.g., company name, product names) or their username in passwords. This feature works with password hash synchronization to block weak passwords at the cloud level, directly addressing the security team's requirement.

Exam trap

The trap here is that candidates often confuse password policies (which are set in on-premises AD and cannot be synced to Azure AD) with password protection features (which are configured directly in Microsoft Entra ID), leading them to incorrectly select Option C.

How to eliminate wrong answers

Option A is wrong because Azure AD Identity Protection with user risk policies detects and responds to compromised credentials or risky sign-ins, but it does not enforce password content restrictions like banning specific terms. Option C is wrong because fine-grained password policies in on-premises Active Directory cannot be synced to Azure AD; password hash synchronization only syncs password hashes, not password policies, and Azure AD does not support on-premises password policy enforcement. Option D is wrong because the MFA registration campaign forces users to register for multifactor authentication, which adds a second layer of security but does not prevent users from setting weak passwords that include banned terms.

Full explanation →

MCQeasy

A new employee has been hired and their account already exists in the on-premises Active Directory. The administrator needs to provide the employee with access to Microsoft 365 services as quickly as possible. What is the most efficient way to enable the user?

A.Create a new cloud-only user in the Microsoft 365 admin center and assign a license.

B.Sync the on-premises user using Azure AD Connect and then assign the license.

C.Manually create a user in Microsoft Entra ID with the same name and assign license.

D.Use Azure AD B2B collaboration to invite the on-premises user as a guest.

AnswerB

Synchronize the existing on-premises user using Microsoft Entra Connect (formerly Azure AD Connect), which creates a user object in Microsoft Entra ID with the correct sourceAnchor for a stable, immutable link. This ensures the cloud identity is the same as the on-premises identity, enabling password hash sync or pass-through authentication for unified credentials. After the user is synced and visible in the portal, assign the required Microsoft 365 license to activate services like Exchange Online and Teams, preserving a single source of identity authority.

Why this answer

The user already exists in on-premises Active Directory, and the fastest way to enable Microsoft 365 access is to synchronize that identity using Azure AD Connect. Once synchronized, the user object appears in Microsoft Entra ID (formerly Azure AD), and the administrator can immediately assign a license without re-creating the account. This avoids the delays of manual creation or guest invitations and leverages the existing identity lifecycle.

Exam trap

The trap here is that candidates often confuse the speed of creating a new cloud user (Option A) with the efficiency of leveraging an existing synchronized identity, failing to recognize that synchronization is the intended and fastest path for hybrid environments.

How to eliminate wrong answers

Option A is wrong because creating a new cloud-only user would result in a duplicate identity that is not linked to the on-premises AD account, breaking password sync and future management. Option C is wrong because manually creating a user in Microsoft Entra ID with the same name does not establish a source-of-authority connection to the on-premises object, leading to conflicts and no automatic attribute synchronization. Option D is wrong because Azure AD B2B collaboration is designed for external guest access, not for enabling an internal employee with full Microsoft 365 services; it would create a separate guest identity without proper license assignment or directory integration.

Full explanation →

Multi-Selectmedium

You are planning the initial deployment of a new Microsoft 365 tenant for Contoso Ltd. Which three of the following actions are required or recommended as part of the tenant provisioning and initial configuration process? (Choose three.)

Select 3 answers

.Register a custom domain name (e.g., contoso.com) and verify ownership via DNS TXT record.

.Assign Microsoft 365 licenses to all user accounts before creating the accounts.

.Configure the default tenant-level password expiration policy to 90 days using the Microsoft 365 admin center.

.Create the initial global administrator account with a strong, unique password and enable multi-factor authentication.

.Set up a secondary domain as the default email domain to avoid conflicts with the initial onmicrosoft.com domain.

.Configure tenant-wide service settings such as external sharing for SharePoint and OneDrive.

Why this answer

Registering and verifying a custom domain (e.g., contoso.com) via a DNS TXT record is a required step to use your own domain for email and user identities instead of the default onmicrosoft.com domain. Creating the initial global administrator account with a strong password and enabling multi-factor authentication (MFA) is a critical security best practice and is recommended by Microsoft to protect the highest-privileged role. Configuring tenant-wide service settings, such as external sharing for SharePoint and OneDrive, is recommended during initial setup to align with organizational security and collaboration policies before users begin working.

Exam trap

The trap here is that candidates may think password expiration policies are still relevant in Microsoft 365, but Microsoft deprecated them in favor of modern authentication and MFA, making the 90-day policy option a distractor.

Full explanation →

MCQhard

A compliance officer needs to preserve all communications (email and Teams messages) for employees in the legal department for a minimum of 7 years. Additionally, any deletion (by users or system) must be blocked, and after the retention period, the items must be disposed of automatically. The solution must also ensure that the communications are marked as 'records' to prevent tampering. Which Microsoft Purview solution should the officer configure?

A.Litigation hold on the legal department's mailboxes and Teams

B.retention label configured with 'Mark items as a record' and a retention period of 7 years, then delete automatically

C.Preservation hold library in SharePoint Online

D.Data Loss Prevention (DLP) policy with retention action

AnswerB

A retention label configured with 'Mark items as a record' makes content immutable: after application, users and administrators cannot edit or delete the item until the retention period expires. Setting the retention period to 7 years and selecting 'delete automatically' ensures the communication is preserved for the full regulatory period and then automatically purged. This is the only option that combines record immutability, a fixed 7-year timeframe, and automatic deletion, which matches the compliance officer's exact requirement.

Why this answer

A retention label with 'Mark items as a record' enforces immutability (prevents tampering) and, when configured with a 7-year retention period followed by automatic deletion, meets the compliance officer's requirements for preservation, blocking deletion, and automatic disposal. This label can be applied to both Exchange Online mailboxes (email) and Teams messages via auto-labeling policies, covering all communications for the legal department.

Exam trap

The trap here is that candidates often confuse Litigation Hold (which preserves indefinitely without automatic deletion) with a retention label that includes both a fixed retention period and record marking, failing to recognize that Litigation Hold does not meet the 'dispose automatically after 7 years' requirement.

How to eliminate wrong answers

Option A is wrong because a Litigation Hold preserves content indefinitely (or until manually removed) but does not enforce automatic deletion after a specific period, nor does it mark items as 'records' to prevent tampering. Option C is wrong because the Preservation Hold Library is a SharePoint Online feature that applies to document libraries, not to Exchange Online mailboxes or Teams messages, and it does not provide record marking or automatic deletion scheduling. Option D is wrong because a Data Loss Prevention (DLP) policy is designed to detect and prevent sensitive data leakage, not to enforce retention, record marking, or automatic disposal; it lacks the ability to block deletion or mark items as records.

Full explanation →

Multi-Selecthard

A security administrator is configuring Microsoft Defender for Cloud Apps. The administrator needs to discover which cloud apps are being used in the organization and then block usage of unsanctioned apps in real time using a reverse proxy. Which two Defender for Cloud Apps features must be configured? (Select the two correct options.)

Select 2 answers

A.Cloud Discovery

B.App governance

C.Conditional Access App Control

D.OAuth app permissions

AnswersA, C

Cloud Discovery is the feature in Microsoft Defender for Cloud Apps that ingests and analyzes traffic logs from network proxies and firewalls to identify all cloud apps in use, including unsanctioned shadow IT. It assigns risk scores to each discovered app and allows you to sanction or unsanction them based on organizational policy. This analysis is the foundational step for any subsequent control, such as Conditional Access App Control.

Why this answer

Cloud Discovery is the correct feature because it identifies which cloud apps are in use by analyzing traffic logs from the organization's network. This provides the visibility needed to determine which apps are unsanctioned. Conditional Access App Control is the correct feature because it uses a reverse proxy to enforce real-time access controls, blocking unsanctioned apps at the session level.

Exam trap

The trap here is that candidates confuse App governance (which manages OAuth app permissions) with the reverse proxy functionality of Conditional Access App Control, or assume Cloud Discovery alone is sufficient for blocking, when it only provides visibility.

Full explanation →

MCQeasy

A security administrator needs to view a unified incident queue that correlates alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. Which console should the administrator open?

A.Microsoft 365 Defender portal (security.microsoft.com)

B.Azure Security Center

C.Microsoft Endpoint Manager admin center

D.Microsoft Purview compliance portal

AnswerA

Microsoft 365 Defender portal (security.microsoft.com) is the single security operations console that aggregates alerts and incidents from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. Its unified incident queue correlates related alerts into a single incident, enabling triage, investigation, and response across all Microsoft 365 Defender workloads. This portal is the correct destination for viewing a unified incident queue.

Why this answer

The Microsoft 365 Defender portal (security.microsoft.com) provides a unified incident queue that aggregates and correlates alerts from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This single-pane-of-glass view enables security administrators to investigate and respond to cross-domain threats without switching between separate consoles.

Exam trap

The trap here is that candidates often confuse the Microsoft 365 Defender portal with Azure Security Center (now Defender for Cloud), mistakenly thinking that all security alerts converge in Azure, when in fact the unified incident queue for Microsoft 365 Defender workloads is exclusive to security.microsoft.com.

How to eliminate wrong answers

Option B is wrong because Azure Security Center (now Microsoft Defender for Cloud) focuses on securing cloud workloads (VMs, containers, SQL) and does not provide a unified incident queue for Microsoft 365 Defender workloads. Option C is wrong because Microsoft Endpoint Manager admin center (intune.microsoft.com) is used for device management, compliance policies, and app deployment, not for security incident correlation. Option D is wrong because the Microsoft Purview compliance portal (compliance.microsoft.com) is dedicated to data governance, eDiscovery, and compliance management, not for real-time threat alert correlation from Defender products.

Full explanation →

MCQhard

An organization has multiple Microsoft Entra ID tenants and wants to allow partner users to access internal applications using their own corporate credentials. Which feature should be used to enable this?

A.Microsoft Entra B2B collaboration

B.Microsoft Entra B2C

C.Azure AD Connect

D.Tenant-to-tenant migration

AnswerA

Microsoft Entra B2B collaboration is the appropriate feature because it allows you to invite external partner users from another Azure AD/Microsoft Entra tenant to access your resources while they authenticate with their own home-tenant credentials. This approach eliminates the need for creating separate accounts, maintains the partner's own identity lifecycle, and integrates with conditional access policies and access reviews, making it ideal for multi-tenant collaboration.

Why this answer

Microsoft Entra B2B collaboration is the correct feature because it allows partner users to access internal applications using their own corporate credentials (their home tenant identity) without requiring any external accounts or local user management. B2B collaboration uses cross-tenant trust relationships, enabling seamless single sign-on (SSO) via SAML/WS-Fed or OIDC protocols, which aligns with the requirement to use existing partner credentials.

Exam trap

The trap here is that candidates often confuse Microsoft Entra B2B (for business partners) with Microsoft Entra B2C (for customers), leading them to select B2C because both involve external identities, but B2C does not support using the partner's own corporate credentials from another Entra ID tenant.

How to eliminate wrong answers

Option B (Microsoft Entra B2C) is wrong because it is designed for customer-facing applications where users sign up with social or local accounts, not for partner users who need to use their own corporate credentials from another Entra ID tenant. Option C (Azure AD Connect) is wrong because it synchronizes on-premises Active Directory objects to a single Entra ID tenant, and does not enable cross-tenant access for external partner identities. Option D (Tenant-to-tenant migration) is wrong because it is a process for moving data and users between tenants, not a feature for granting ongoing access to partner users with their existing credentials.

Full explanation →

MCQhard

A compliance officer needs to ensure that no user can permanently delete a document from a specific SharePoint Online site. The document must be kept for at least 5 years. Which Microsoft Purview solution should the officer configure?

A.A: Sensitivity label with a retention period of 5 years.

B.B: Retention policy for the site with retention period of 5 years and action set to 'Retain'.

C.C: DLP policy to prevent deletion of documents.

D.D: eDiscovery hold on the site.

AnswerB

A retention policy applied at the site level prevents permanent deletion of content during the retention period, meeting the requirement.

Why this answer

A retention policy with the 'Retain' action ensures that documents in the SharePoint site are preserved for the specified period and cannot be permanently deleted by users or system processes. This meets the compliance requirement of a 5-year minimum retention and prevents permanent deletion, as retained items are moved to the Preservation Hold library.

Exam trap

The trap here is that candidates often confuse retention policies with sensitivity labels or eDiscovery holds, assuming that any retention setting or legal hold prevents deletion, but only a retention policy with the 'Retain' action provides the specific immutable retention and deletion prevention required for a fixed period like 5 years.

How to eliminate wrong answers

Option A is wrong because a sensitivity label with a retention period of 5 years applies retention settings at the item level based on classification, but it does not prevent permanent deletion by users; sensitivity labels primarily enforce protection and classification, not immutable retention. Option C is wrong because a DLP policy prevents data loss by blocking sharing or exfiltration of sensitive data, not by preventing deletion of documents; DLP policies do not enforce retention or deletion prevention. Option D is wrong because an eDiscovery hold preserves content for legal or investigative purposes but is designed for temporary holds, not for a fixed 5-year retention period, and it does not prevent permanent deletion by users in the same way as a retention policy with 'Retain' action.

Full explanation →

Multi-Selecthard

Which THREE features are included in Microsoft Defender for Office 365 Plan 2 but NOT in Plan 1? (Choose three.)

Select 3 answers

A.Anti-phishing policies

B.Safe Links

C.Automated Investigation and Response (AIR)

D.Threat Explorer

E.Attack Simulation Training

AnswersC, D, E

Automated Investigation and Response (AIR) is a premium Plan 2 capability that uses orchestration and automation to investigate alerts, analyze threat signals, and take recommended or automated remediation actions. It goes beyond passive detection by proactively resolving incidents without requiring continuous manual oversight, making it a key differentiator for Plan 2 licensing.

Why this answer

Options C, D, and E are correct. Plan 2 includes Automated Investigation and Response (AIR), Threat Explorer, and Attack Simulation Training. Plan 1 includes anti-phishing policies (A) and Safe Links (B), so they are not correct.

Full explanation →

MCQmedium

A company wants to require MFA for all users when they access Office 365 from any network location that is not the company's trusted IP ranges. Which Conditional Access policy configuration should be applied?

A.A: Include all users, exclude none, grant access require MFA with condition 'Location not in trusted locations'.

B.B: Include all users, exclude none, block access with condition 'Location not in trusted locations'.

C.C: Include all users, exclude trusted locations as a group, grant access require MFA.

D.D: Include all users, exclude all locations, grant access require MFA.

AnswerA

This policy correctly scopes the requirement: every user is in scope, and the location condition is evaluated during sign-in. When a user's IP address is not within a trusted location (i.e., an IP range you have designated as trusted), the grant control 'Require MFA' is enforced, prompting for multifactor authentication. When the user is in a trusted location, the condition is not satisfied and the policy does not apply, so MFA is not required—matching the business requirement exactly. The location condition acts as a filter, not an assignment, which is the intended design.

Why this answer

Ly configures a Conditional Access policy that targets all users and applies the 'Require MFA' grant control when the location condition is set to 'Any location' except the company's trusted IP ranges. This ensures MFA is enforced for all access attempts originating from outside the trusted network, meeting the requirement precisely.

Exam trap

The trap here is that candidates often confuse excluding a group (like 'All trusted users') with using the location condition to exclude trusted IP ranges, leading them to choose Option C, which incorrectly removes the location-based trigger entirely.

How to eliminate wrong answers

Option B is wrong because blocking access entirely for untrusted locations would prevent users from working remotely, which is not the requirement; the requirement is to require MFA, not block. Option C is wrong because excluding trusted locations as a group from the policy scope would mean the policy does not evaluate those locations at all, but the requirement is to apply MFA to all users when they are not in trusted locations, which is best handled by the location condition, not by excluding a group. Option D is wrong because excluding all locations would mean the policy never evaluates any location condition, effectively disabling the location-based trigger, so MFA would not be enforced based on network location.

Full explanation →

MCQmedium

A company uses Azure AD Connect with password hash synchronization. They want to allow users to reset their on-premises Active Directory passwords from the cloud Self-Service Password Reset (SSPR) portal. Which additional configuration is required in Azure AD Connect?

A.Enable password writeback

B.Enable self-service password reset in Azure AD

C.Configure Federation Services (AD FS)

D.Install Azure AD Application Proxy

AnswerA

Password writeback in Azure AD Connect is the component that synchronizes password changes from Azure AD back to on-premises Active Directory. With password hash sync, the cloud authentication works, but a cloud-initiated reset only updates the Azure AD password unless writeback is enabled. This feature requires Azure AD Premium and an on-premises service account with rights to update user passwords, ensuring the next sign-in with on-premises credentials uses the new password.

Why this answer

Password writeback is the specific feature in Azure AD Connect that enables password changes performed in the cloud (via SSPR) to be written back to the on-premises Active Directory. Without this feature enabled and configured, the SSPR portal can only reset cloud-only passwords, not synchronized on-premises passwords. Therefore, enabling password writeback is the additional configuration required beyond the existing password hash synchronization.

Exam trap

The trap here is that candidates often confuse enabling SSPR in Azure AD (a tenant-level setting) with the specific Azure AD Connect feature (password writeback) that is required to make SSPR work for synchronized users, leading them to select Option B instead of A.

How to eliminate wrong answers

Option B is wrong because enabling self-service password reset in Azure AD is a prerequisite for the SSPR portal itself, not the additional configuration required in Azure AD Connect to write the reset password back to on-premises AD. Option C is wrong because Federation Services (AD FS) is not required for password writeback; password writeback works with password hash synchronization and does not require federation. Option D is wrong because Azure AD Application Proxy is used for publishing on-premises web applications externally, not for password synchronization or writeback.

Full explanation →

MCQmedium

A security administrator wants to prevent Microsoft Office applications (Word, Excel, PowerPoint) from creating child processes, which is a common technique used by malware to execute malicious code. Which attack surface reduction (ASR) rule should be enabled?

A.Block all Office applications from creating child processes

B.Block executable files from running unless they meet a prevalence, age, or trusted list criteria

C.Block Office applications from creating executable content

D.Block Win32 API calls from Office macros

AnswerA

This Attack Surface Reduction (ASR) rule, identified by rule GUID 26190899-1602-49e8-8b27-eb1d0a1ce869, specifically targets the parent-child relationship where winword.exe, excel.exe, or powerpnt.exe attempts to launch any secondary executable. By blocking the creation of child processes such as cmd.exe, powershell.exe, or wscript.exe, it directly neutralizes the described macro-based attack chain before the payload can execute. This is the only option among these that was designed to stop exactly this process-spawn behavior.

Why this answer

The ASR rule 'Block all Office applications from creating child processes' (GUID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A) specifically prevents Word, Excel, and PowerPoint from spawning child processes such as cmd.exe, PowerShell, or wscript.exe. This directly mitigates a common malware technique where Office macros or exploits launch malicious executables. The rule is part of Microsoft Defender for Endpoint's attack surface reduction capabilities and is designed to stop process injection and lateral movement without blocking legitimate Office functionality.

Exam trap

The trap here is that candidates confuse 'creating child processes' with 'creating executable content' or 'blocking Win32 API calls,' leading them to choose options that address file writes or macro restrictions rather than the specific process spawning behavior.

How to eliminate wrong answers

Option B is wrong because 'Block executable files from running unless they meet a prevalence, age, or trusted list criteria' is an ASR rule that targets executable files (e.g., .exe, .dll) based on reputation, not Office child process creation. Option C is wrong because 'Block Office applications from creating executable content' prevents Office apps from writing executable files (e.g., .exe, .scr) to disk, but does not block the spawning of child processes. Option D is wrong because 'Block Win32 API calls from Office macros' disables macros from calling Win32 APIs (e.g., via VBA), which is a different attack vector; it does not prevent Office apps from creating child processes through other means like OLE or DDE.

Full explanation →

MCQmedium

Your organization has a Microsoft 365 tenant configured with a custom domain. You need to verify domain ownership using a TXT record. Where in the Microsoft 365 admin center would you initiate this process?

A.Settings > Domains

B.Setup > Org-wide settings

C.Users > Active Users

D.Admin centers > Azure Active Directory

AnswerA

Settings > Domains is the correct location in the Microsoft 365 admin center for adding, verifying, and managing custom domains. From this blade, you can initiate domain verification via a DNS TXT record or MX record, designate a primary domain, set the domain for services like Exchange Online, and monitor domain health. This is the unified domain management interface that most administrators use for day-to-day domain lifecycle tasks.

Why this answer

To verify domain ownership in Microsoft 365, you must add a TXT record provided by Microsoft to your domain's DNS zone. The process is initiated in the Microsoft 365 admin center under Settings > Domains, where you select the domain and click 'Start setup' to receive the verification TXT record value. This is the only location in the admin center that directly manages domain verification and DNS record validation for custom domains.

Exam trap

The trap here is that candidates may confuse domain verification with other domain-related tasks (like setting up email routing or managing user accounts) and select Setup > Org-wide settings or Users > Active Users, but only Settings > Domains provides the guided wizard for adding and verifying a custom domain via TXT records.

How to eliminate wrong answers

Option B is wrong because Setup > Org-wide settings contains organization-wide configuration options like security policies, profiles, and external sharing settings, but does not include domain management or DNS verification tasks. Option C is wrong because Users > Active Users is for managing user accounts, licenses, and permissions, not for domain ownership verification which is a DNS-level process. Option D is wrong because Admin centers > Azure Active Directory opens the Azure AD portal, which can manage custom domains but is not the primary or recommended path in the Microsoft 365 admin center for initiating TXT record verification; the correct path is Settings > Domains within the M365 admin center itself.

Full explanation →

MCQmedium

A company uses Microsoft Entra ID P2 licenses and wants to block all authentication attempts from an internal legacy application that uses POP3 and SMTP protocols. The application cannot be updated and must be blocked from accessing Exchange Online. Which Conditional Access policy setting should the administrator configure?

A.Under 'Grant', select 'Block access'

B.Under 'Conditions' > 'Client apps', configure to block 'Exchange ActiveSync clients and other clients'

C.Under 'Conditions' > 'Device platforms', select 'Android' and 'iOS' and block them

D.Under 'Conditions' > 'Locations', select 'All trusted locations' and block

AnswerB

The 'Client apps' condition in Entra ID Conditional Access directly matches the authentication protocol used by the client. By selecting 'Exchange ActiveSync clients' and 'Other clients' (which cover POP3, IMAP, SMTP, and other non-modern authentication), you can explicitly block those legacy protocols while allowing modern, MFA-capable clients to continue. This is the precise and least disruptive way to enforce the security requirement.

Why this answer

The legacy application uses POP3 and SMTP, which are non-modern authentication protocols. In Conditional Access, the 'Client apps' condition includes a setting to block 'Exchange ActiveSync clients and other clients', which specifically targets legacy authentication protocols like POP3, SMTP, and IMAP. This allows the administrator to block all authentication attempts from such clients without affecting modern authentication flows.

Exam trap

The trap here is that candidates often confuse 'Client apps' with device or location conditions, mistakenly thinking that blocking a device platform or location will stop legacy protocol traffic, when in fact legacy authentication bypasses those controls entirely because it does not use modern token-based authentication.

How to eliminate wrong answers

Option A is wrong because 'Block access' under 'Grant' is a coarse control that blocks all access for the targeted users or apps, but it does not specifically target legacy protocols like POP3/SMTP; it would block all authentication methods, including modern ones, which is not the requirement. Option C is wrong because 'Device platforms' controls access based on the operating system (e.g., Android, iOS), not the authentication protocol; blocking Android and iOS would not affect a legacy application running on a server or desktop using POP3/SMTP. Option D is wrong because 'Locations' controls access based on network location (e.g., trusted IP ranges), not the authentication protocol; blocking trusted locations would not block the legacy application if it originates from an untrusted location, and it does not address the protocol-specific requirement.

Full explanation →

Multi-Selectmedium

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a user receives a phishing email containing a malicious URL and then clicks that URL within 10 minutes. Which two Advanced Hunting tables must be joined in the KQL query?

Select 2 answers

A.EmailEvents and UrlClickEvents

B.EmailEvents and DeviceProcessEvents

C.EmailUrlInfo and UrlClickEvents

D.EmailAttachmentInfo and UrlClickEvents

AnswersA, C

EmailEvents tracks email delivery metadata only, such as sender, recipient, subject, delivery action, and message ID, but it does not enumerate the URLs contained in the message body. UrlClickEvents references the clicked URL but does not include the email's NetworkMessageId unless the URL was part of a Safe Links click from an email, and even then you need URL information to correlate. Without the URL-to-email mapping that EmailUrlInfo provides, joining EmailEvents to UrlClickEvents is not straightforward and would require a separate enrichment step, so this pairing is incorrect for URL-click detection.

Why this answer

The rule requires detecting when a user receives a phishing email with a malicious URL and then clicks that URL within 10 minutes. Two separate joins can accomplish this:

**EmailEvents and UrlClickEvents**: EmailEvents contains metadata about email delivery (including NetworkMessageId), and UrlClickEvents records user clicks on URLs in Microsoft Defender for Office 365 Safe Links. Joining these tables on NetworkMessageId (and optionally URL hash) allows correlating the email receipt with the click event, enabling the time-based trigger.

**EmailUrlInfo and UrlClickEvents**: EmailUrlInfo provides details on URLs found within emails (including the URL and its verdict), and UrlClickEvents logs clicks. Joining on the URL hash (SHA256) directly correlates the email-delivered URL with the user's click, also enabling the time-based trigger.

Both pairs are valid and commonly used depending on the specific data needed. Option B (DeviceProcessEvents) is irrelevant as it deals with process execution, not email or URL clicks. Option D (EmailAttachmentInfo) pertains to attachments, not URLs.

Exam trap

Candidates often assume that only one combination is correct, but both EmailEvents+UrlClickEvents (via NetworkMessageId) and EmailUrlInfo+UrlClickEvents (via UrlHash) are valid ways to link the email to the click. The trick is recognizing that EmailEvents is indeed needed when using that path, and EmailUrlInfo is not required if you directly join on NetworkMessageId.

Full explanation →

Matchingmedium

Match each Microsoft 365 Defender portal component to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Protects email and collaboration tools

Protects devices from threats

Protects on-premises Active Directory

Protects cloud applications

Unified threat protection dashboard

Why these pairings

The correct matches are Incidents with 'collection of related alerts', Alerts with 'individual notifications', and Hunting with 'proactive search'. The definitions for Threat Analytics and Secure Score are swapped in options C and D.

Full explanation →

MCQeasy

An administrator wants to verify ownership of a custom domain 'adatum.com' in their Microsoft 365 tenant. They have already added the domain and received the TXT record value. However, the administrator's DNS hosting provider does not support adding a TXT record. Which alternative record type can be used for domain verification?

A.record

B.MX record

C.SRV record

D.NS record

AnswerB

Microsoft 365 permits two common verification methods: a TXT record containing 'MS=msXXXXXX' or an MX record pointing to 'msXXXXXX.adatum.com'. The MX verification record is a valid alternative that works by having you create a mail exchanger record with the exact verification token as the mail host. This record is non-authoritative and does not affect mail routing because it points to a Microsoft verification endpoint that only checks for the token. Once the token is confirmed, the MX record can be safely removed.

Why this answer

When a DNS hosting provider does not support TXT records, Microsoft 365 allows the use of an MX record as an alternative for domain verification. The administrator creates an MX record with a specific subdomain (e.g., 'adatum-com.mail.protection.outlook.com') and a custom priority value provided in the TXT record value, which Microsoft's verification system checks to confirm domain ownership. This method is supported because MX records are widely available and can carry the necessary verification data in their format.

Exam trap

The trap here is that candidates may assume only TXT records can verify domain ownership, overlooking that Microsoft 365 explicitly supports MX records as an alternative when TXT records are unavailable, which is a common scenario in restrictive DNS environments.

How to eliminate wrong answers

Option A is wrong because 'A record' maps a domain to an IPv4 address and cannot carry the verification string required by Microsoft 365; it is not a supported alternative for domain verification. Option C is wrong because 'SRV record' specifies the location of services (like SIP or LDAP) and is not used for domain ownership verification in Microsoft 365. Option D is wrong because 'NS record' delegates a domain to a set of name servers and does not support embedding a verification token; it would change the domain's authoritative servers rather than prove ownership.

Full explanation →

Multi-Selectmedium

Your organization uses Microsoft Entra ID. You need to implement a solution that allows users to sign in without a password using their smartphone. Which TWO authentication methods can be used?

Select 2 answers

A.Temporary Access Pass

B.Windows Hello for Business

C.Text message (SMS) verification code

D.Microsoft Authenticator app (phone sign-in)

E.FIDO2 security keys

AnswersD, E

Authenticator app supports passwordless sign-in.

Why this answer

The Microsoft Authenticator app supports phone sign-in, which allows users to authenticate by approving a notification or entering a number displayed on the screen, eliminating the need for a password. FIDO2 security keys enable passwordless authentication using hardware-based public/private key cryptography, meeting the requirement for smartphone-based sign-in when the key is connected via USB or NFC. Both methods are supported by Microsoft Entra ID for passwordless authentication.

Exam trap

The trap here is that candidates often confuse SMS verification codes (a multi-factor authentication method) with a primary passwordless authentication method, but SMS codes require a password first and are not passwordless.

Full explanation →

MCQhard

A security analyst has identified a new malware sample with SHA256 hash 'abc123...'. They need to immediately block this file from executing on any managed endpoint across the organization. Which Microsoft Defender for Endpoint capability should they use?

A.Attack surface reduction rules

B.Indicators (IoC)

C.Automated investigation and response

D.Threat analytics

AnswerB

Indicators of compromise (IoC) in Microsoft 365 Defender for Endpoint let administrators explicitly define block actions for known malicious artifacts, including file SHA-256 hashes, IP addresses, URLs, and domains. After the analyst obtains the malware sample's exact hash, they can create a file indicator (with action 'Block and remediate') so that Defender blocks execution across managed endpoints. This is the only option here that directly provides granular, hash-based allow/block control rather than relying on behavioral heuristics or post-detection response.

Why this answer

Indicators of Compromise (IoC) in Microsoft Defender for Endpoint allow security analysts to create custom indicators (such as file hashes, IPs, or URLs) that are immediately enforced across all managed endpoints. This capability enables blocking execution of a specific SHA256 hash at the kernel level via the Microsoft Defender Antivirus driver, providing near-instant protection without requiring a signature update or policy change.

Exam trap

The trap here is that candidates confuse Indicators (IoC) with Attack Surface Reduction rules, mistakenly thinking ASR rules can block specific file hashes, when in fact ASR rules only block behavioral patterns and cannot target individual file hashes.

How to eliminate wrong answers

Option A is wrong because Attack Surface Reduction (ASR) rules are policy-based rules that target specific behaviors (e.g., blocking Office apps from creating child processes), not individual file hashes; they cannot block a single SHA256 hash on demand. Option C is wrong because Automated Investigation and Response (AIR) is a post-breach remediation workflow that triggers after detection, not a proactive blocking mechanism for a known IoC. Option D is wrong because Threat Analytics is a reporting and intelligence feature that provides threat summaries and mitigations, not a direct enforcement action to block file execution.

Full explanation →

MCQhard

A company uses Microsoft Entra ID P2 licenses and wants to implement just-in-time (JIT) privileged access for administrators. Security requirements state that Global Administrator role members must request approval and provide a business justification before their role activation expires after 4 hours. Which Microsoft Entra feature should be configured?

A.Conditional Access

B.Privileged Identity Management (PIM)

C.Identity Protection

D.Self-Service Password Reset (SSPR)

AnswerB

Privileged Identity Management (PIM) in Microsoft Entra ID P2 provides just-in-time (JIT) activation of Azure AD roles, allowing eligible members to request elevated access with a defined start time, duration, and justification. Administrators can configure PIM to require approval from designated approvers before the role becomes active, ensuring every privileged activation is audited and time-boxed. This directly fulfills the scenario’s requirement for managed, approval-based, and time-limited privileged role activation. No other Entra ID feature combines role assignment, approval workflow, and expiration in this way.

Why this answer

Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access, requiring approval and a business justification for role activation, with configurable maximum activation durations (e.g., 4 hours). This directly meets the security requirement for Global Administrator role members to request approval and provide justification before activation expires after 4 hours.

Exam trap

The trap here is that candidates often confuse Conditional Access with PIM because both involve 'access control,' but Conditional Access cannot enforce time-bound role activation with approval and justification workflows.

How to eliminate wrong answers

Option A is wrong because Conditional Access enforces access policies based on signals like location or device compliance, but it does not provide time-bound role activation with approval workflows or business justification. Option C is wrong because Identity Protection detects and remediates identity-based risks (e.g., compromised accounts) but does not manage privileged role activation or approval processes. Option D is wrong because Self-Service Password Reset (SSPR) allows users to reset their own passwords without administrator intervention, and it has no capability to control privileged role activation with approval and expiration.

Full explanation →

100

MCQeasy

You are a Microsoft 365 administrator for a small business with 50 users. The company uses Microsoft 365 Business Premium. You need to ensure that all users have multi-factor authentication (MFA) enabled. The company does not have any custom conditional access policies. You want to implement MFA as quickly as possible with minimal configuration. What should you do?

A.Enable security defaults in the Microsoft Entra admin center.

B.Configure MFA registration campaign for all users.

C.Enable per-user MFA for each user.

D.Create a conditional access policy that requires MFA for all users.

AnswerA

Security defaults in the Microsoft Entra admin center enforces MFA for every user, blocks legacy authentication, and requires users to complete MFA registration on first sign-in — all with a single toggle and no conditional access policy creation. For a small business without granular exclusion requirements, this is the fastest and most minimal-configuration path to satisfy the scenario. Microsoft recommends security defaults for tenants that do not have Microsoft Entra ID P1/P2 licenses, and even with Business Premium it provides immediate baseline protection without policy dependencies.

Why this answer

Security defaults provide a pre-configured set of security policies, including requiring MFA for all users, that can be enabled with a single toggle in the Microsoft Entra admin center. This is the fastest and simplest method for a small business with no existing conditional access policies, as it requires minimal configuration and immediately enforces MFA for every user.

Exam trap

The trap here is that candidates often confuse the MFA registration campaign (which only prompts registration) with actual MFA enforcement, or they overcomplicate the solution by choosing per-user MFA or a custom conditional access policy when security defaults are the fastest and simplest answer for a tenant with no existing policies.

How to eliminate wrong answers

Option B is wrong because the MFA registration campaign is a feature that nudges users to register for MFA but does not enforce MFA at sign-in; it only prompts registration, leaving authentication unprotected until users voluntarily comply. Option C is wrong because per-user MFA is a legacy method that requires manually enabling MFA for each of the 50 users individually, which is time-consuming and does not leverage the modern, policy-based approach of security defaults. Option D is wrong because creating a conditional access policy requires additional configuration steps (e.g., excluding break-glass accounts, defining conditions) and is not the fastest option; security defaults are designed for organizations without existing policies to achieve MFA enforcement instantly.

Full explanation →

101

MCQmedium

A company plans to enable Self-Service Password Reset (SSPR) for all users. The administrator must ensure that users are required to register at least two authentication methods: one from the 'mobile app' category and one from the 'phone call' category. Which combination of methods should the administrator select in the SSPR registration settings?

A.Mobile app notification and office phone

B.Mobile app notification and mobile app code

C.Office phone and mobile phone

D.Mobile phone and email

AnswerA

Selecting Mobile app notification satisfies the mobile app authentication method category, while Office phone is classified under the phone call category. This combination fulfills the SSPR policy requirement of having two methods from different categories, ensuring users can verify identity via either the Microsoft Authenticator push notification or a call to their office landline. It also aligns with best practices for SSPR availability by providing diverse verification options.

Why this answer

The SSPR registration policy requires users to select at least two distinct authentication methods from the allowed list. By choosing 'Mobile app notification' (from the mobile app category) and 'Office phone' (from the phone call category), the administrator satisfies the requirement of one method from each specified category. The 'Office phone' option is classified under the 'phone call' category in Microsoft Entra ID SSPR settings.

Exam trap

The trap here is that candidates often assume 'Mobile phone' and 'Office phone' are different categories, but both are classified under the 'phone call' category in SSPR, so selecting both does not satisfy the requirement for a method from the 'mobile app' category.

How to eliminate wrong answers

Option B is wrong because both 'Mobile app notification' and 'Mobile app code' belong to the same 'mobile app' category, failing the requirement to have one method from the 'phone call' category. Option C is wrong because 'Office phone' and 'Mobile phone' are both in the 'phone call' category, not covering the 'mobile app' category. Option D is wrong because 'Mobile phone' is in the 'phone call' category and 'Email' is a separate category (not 'mobile app' or 'phone call'), so it does not include a method from the 'mobile app' category.

Full explanation →

102

MCQhard

You are reviewing the following Conditional Access policy JSON in Microsoft Entra ID. What does this policy do?

A.Requires MFA for all users accessing all apps from any client type

B.Blocks access for all users except Admin@contoso.com when accessing from mobile apps

C.Requires MFA for all users except Admin@contoso.com when accessing any app from mobile apps or desktop clients

D.Requires MFA for all users accessing all apps from any device

AnswerC

Matches the policy conditions and grant controls.

Why this answer

The Conditional Access policy JSON targets all users except a specific group containing Admin@contoso.com, applies to all cloud apps, and requires MFA for the 'Browser' and 'Mobile apps and desktop clients' client app types. This effectively enforces MFA for all users except the excluded admin when accessing any app from either web browsers or native/mobile clients, as defined by the 'clientAppTypes' condition.

Exam trap

The trap here is that candidates often overlook the 'ExcludeUsers' array and assume the policy applies to all users, or they misinterpret 'clientAppTypes' as applying to all devices rather than specific client application types like browser and mobile/desktop apps.

How to eliminate wrong answers

Option A is wrong because the policy explicitly excludes a user (Admin@contoso.com) via the 'users' condition with an 'ExcludeUsers' array, so it does not require MFA for all users. Option B is wrong because the policy does not block access; it grants access with MFA, and it applies to both 'Mobile apps and desktop clients' and 'Browser' client types, not exclusively mobile apps. Option D is wrong because the policy does not apply to all devices; it applies to specific client app types (Browser and Mobile apps/desktop clients), and it excludes a specific user, so it is not universal for all users or all devices.

Full explanation →

103

MCQmedium

A compliance officer needs to ensure that all outbound emails containing credit card numbers sent to external recipients are automatically encrypted without requiring user intervention. Which Microsoft Purview feature should be configured?

A.Data Loss Prevention (DLP) policy with a rule that encrypts the message when credit card numbers are detected.

B.Sensitivity label with auto-labeling based on credit card numbers.

C.Retention policy for Exchange Online.

D.eDiscovery case for content search.

AnswerA

DLP can detect sensitive info and enforce encryption using Rights Management, all without user action.

Why this answer

A Data Loss Prevention (DLP) policy in Microsoft Purview can be configured with a rule that automatically detects credit card numbers (using a built-in sensitive info type) and applies encryption via Transport Layer Security (TLS) or Information Rights Management (IRM) to outbound emails sent to external recipients. This meets the compliance officer's requirement for automatic encryption without user intervention, as the DLP rule triggers encryption at the transport level in Exchange Online.

Exam trap

The trap here is that candidates often confuse auto-labeling with sensitivity labels (Option B) as a direct encryption mechanism, but auto-labeling does not automatically encrypt outbound emails at the transport layer—it only applies labels, and encryption requires additional configuration (e.g., via a DLP policy or a label's protection settings) that may not trigger without user action or client-side processing.

How to eliminate wrong answers

Option B is wrong because sensitivity labels with auto-labeling can classify and protect content based on credit card numbers, but they do not automatically encrypt outbound emails at the transport level; they apply protection at the item level (e.g., file or email) and require user interaction or client-side auto-labeling, which may not encrypt messages in transit to external recipients without manual steps. Option C is wrong because a retention policy for Exchange Online is used to retain or delete emails based on age or criteria, not to encrypt outbound messages; it does not provide real-time encryption triggered by content detection. Option D is wrong because an eDiscovery case for content search is used to search, hold, and export content for legal or investigative purposes, not to enforce encryption on outbound emails; it is a discovery tool, not a protection mechanism.

Full explanation →

104

MCQhard

A security administrator needs to block users from running portable executable files (e.g., .exe, .scr) that were downloaded from the internet on Windows devices. Which Attack Surface Reduction (ASR) rule should the administrator enable to meet this requirement?

A.Block executable files from running unless they meet a prevalence, age, or trusted list criterion

B.Block credential stealing from the Windows local security authority subsystem (lsass.exe)

C.Block Adobe Reader from creating child processes

D.Block persistence through WMI event subscription

AnswerA

This correct ASR rule (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) evaluates every executable launched against Microsoft's cloud reputation service, checking prevalence, age, and any tenant-configured trusted list. Files that are unknown, new, or untrusted are blocked at the point of execution, which directly addresses the requirement to block users from running portable executables like .exe and .scr downloads. Because it operates on the executable itself, it is the only option that matches the stated intent.

Why this answer

The ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) specifically targets executable files (e.g., .exe, .scr) that have been downloaded from the internet by checking their Mark-of-the-Web (MoTW) attribute. When enabled, this rule prevents execution of such files unless they meet criteria like high prevalence, sufficient age, or inclusion in a trusted list, directly addressing the requirement to block internet-downloaded portable executables.

Exam trap

The trap here is that candidates often confuse ASR rules focused on execution control (like blocking downloaded executables) with rules that block specific attack techniques (like credential theft or persistence), leading them to select a rule that addresses a different threat vector entirely.

How to eliminate wrong answers

Option B is wrong because the ASR rule 'Block credential stealing from the Windows local security authority subsystem (lsass.exe)' (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2) protects against credential theft via LSASS access, not against running internet-downloaded executables. Option C is wrong because the ASR rule 'Block Adobe Reader from creating child processes' (GUID: 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c) only restricts Adobe Reader from spawning child processes, which is unrelated to blocking execution of downloaded .exe or .scr files. Option D is wrong because the ASR rule 'Block persistence through WMI event subscription' (GUID: e6db77e5-3df2-4cf1-b95a-636979351e5b) targets WMI-based persistence techniques, not the execution of internet-downloaded portable executables.

Full explanation →

105

MCQhard

A security administrator needs to block executable files from running from the %TEMP% folder on Windows devices to prevent common malware execution. Which attack surface reduction (ASR) rule should be enabled?

A.Block executable files from running unless they meet a prevalence, age, or trusted list criteria

B.Block credential stealing from the Windows local security authority subsystem

C.Block all Office applications from creating child processes

D.Block JavaScript or VBScript from launching downloaded executable content

AnswerA

Correct. This ASR rule specifically blocks executables in writable directories unless they have been around long enough or are commonly seen.

Why this answer

The ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criteria' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) specifically targets executables launched from locations commonly used by malware, such as the %TEMP% folder. This rule uses cloud-delivered reputation data to allow only executables that are prevalent, have sufficient age, or are on a trusted list, effectively blocking unknown or suspicious binaries from running in temporary directories.

Exam trap

The trap here is that candidates often confuse ASR rules focused on script-based attacks (Option D) or credential theft (Option B) with the specific rule designed to block executables in low-reputation locations like %TEMP%, leading them to choose a rule that addresses a different attack vector.

How to eliminate wrong answers

Option B is wrong because 'Block credential stealing from the Windows local security authority subsystem' (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2) protects against credential theft via LSASS, not against executable execution from %TEMP%. Option C is wrong because 'Block all Office applications from creating child processes' (GUID: d4f940ab-401b-4efc-aadc-ad5f3c50688a) prevents Office apps from spawning child processes (e.g., PowerShell or cmd.exe), which is unrelated to blocking executables in the %TEMP% folder. Option D is wrong because 'Block JavaScript or VBScript from launching downloaded executable content' (GUID: e22096a2-2f8a-4e6c-8f3a-7a5f1c5b0c3d) targets scripts that launch downloaded executables, not the direct execution of executables from the %TEMP% folder.

Full explanation →

106

MCQhard

A security analyst needs to create a custom detection rule in Microsoft Defender XDR that triggers when a device communicates with a new, unclassified IP address flagged by Microsoft threat intelligence as potentially malicious. The rule must run every hour and create an incident if the count of such communications exceeds 10 in a 24-hour window. Which type of rule should the analyst create?

A.custom detection rule using advanced hunting

B.scheduled alert rule in Microsoft Sentinel

C.An incident creation rule in Microsoft Defender for Cloud Apps

D.custom remediation action rule

AnswerA

Custom detection rules in Microsoft Defender XDR are built on advanced hunting queries written in Kusto Query Language (KQL). These queries can be scheduled to run periodically across the tenant's extended data schema, and when the query results meet defined thresholds, the rule generates an incident for investigation. This is the native mechanism for creating custom detections directly within the Defender XDR portal, making it the correct choice.

Why this answer

A custom detection rule using advanced hunting is the correct choice because Microsoft Defender XDR allows you to create custom detection rules based on Kusto Query Language (KQL) queries that run on a scheduled interval (e.g., every hour). This rule can query the `DeviceNetworkEvents` table to identify communications with IP addresses flagged as malicious by Microsoft threat intelligence, aggregate the count over a 24-hour sliding window, and trigger an incident when the threshold of 10 is exceeded. This directly meets the requirement for a scheduled, threshold-based detection within Defender XDR.

Exam trap

The trap here is that candidates often confuse the scope of Microsoft Defender XDR custom detections with Microsoft Sentinel scheduled alert rules, assuming any scheduled query must be in Sentinel, but Defender XDR's advanced hunting custom detections natively support scheduled queries and incident creation without requiring Sentinel.

How to eliminate wrong answers

Option B is wrong because a scheduled alert rule in Microsoft Sentinel is designed for Azure-based SIEM and SOAR capabilities, not for native custom detection within Microsoft Defender XDR; Sentinel operates on a different data ingestion pipeline and is not the correct tool for creating rules that run directly in the Defender XDR portal. Option C is wrong because an incident creation rule in Microsoft Defender for Cloud Apps focuses on app-level anomalies and cloud application behaviors, not on device-level network communications with IP addresses flagged by threat intelligence. Option D is wrong because a custom remediation action rule is used to define automated response actions (e.g., isolating a device or running a script) after a detection occurs, not to define the detection logic or scheduling itself.

Full explanation →

107

MCQeasy

A user receives an email from an unknown sender with a .zip attachment. The attachment contains a potentially malicious executable file. Microsoft Defender for Office 365 is enabled. Which feature dynamically detonates the attachment in a sandbox environment and blocks it if malicious behavior is detected?

A.Safe Attachments

B.Safe Links

C.Anti-phishing

D.Anti-spam

AnswerA

Safe Attachments is the correct answer because it uses behavioral analysis, machine learning, and sandbox detonation to inspect email attachments such as a zip file. When a message contains a zip, Safe Attachments extracts the archive and detonates its contents in a controlled, isolated environment, monitoring for malicious actions like process injection, file writes, or network calls. This catches zero-day and polymorphic malware that signature-based scanners miss, and the email is held until analysis completes.

Why this answer

Safe Attachments is the correct feature because it specifically detonates email attachments in a dynamic sandbox environment, analyzing behavior in real time. If the .zip file contains a malicious executable, Safe Attachments will block the email before delivery, preventing the user from accessing the threat. This is distinct from other Defender for Office 365 features that focus on URLs, phishing content, or spam filtering.

Exam trap

The trap here is that candidates confuse Safe Attachments with Safe Links, assuming both handle attachments, but Safe Links only rewrites and checks URLs, not file payloads.

How to eliminate wrong answers

Option B is wrong because Safe Links protects against malicious URLs within emails or Office documents, not file attachments. Option C is wrong because Anti-phishing policies detect impersonation and spoofing attempts, not executable file analysis. Option D is wrong because Anti-spam policies filter bulk or junk email based on sender reputation and content, not dynamic file detonation.

Full explanation →

108

MCQmedium

A compliance officer needs to automatically retain documents in a SharePoint Online document library for 7 years and then automatically delete them. The retention must be applied based on when the document is created. Which Microsoft Purview feature should be configured?

A.Data Lifecycle Management

B.Records Management

C.eDiscovery

D.Communication Compliance

AnswerA

Data Lifecycle Management in Microsoft Purview is the solution specifically built to automate retention and deletion based on configured policies. It uses retention labels and policies to apply rules like 'retain for 7 years then delete' triggered by content age or events. This lets you meet compliance obligations without manual intervention, making it the correct choice for automatically retaining documents.

Why this answer

Data Lifecycle Management (DLM) in Microsoft Purview allows you to create retention labels that automatically retain content for a specified period (e.g., 7 years) based on the date the document was created, and then trigger a disposal action such as deletion. This feature is designed specifically for managing the lifecycle of data in SharePoint Online, including automatic retention and deletion based on metadata like creation date.

Exam trap

The trap here is that candidates often confuse Records Management with Data Lifecycle Management, assuming that any retention policy must involve records, when in fact DLM handles automated retention and deletion without requiring the content to be declared a record.

How to eliminate wrong answers

Option B (Records Management) is wrong because Records Management is focused on declaring content as records (immutable, auditable) and applying retention that prevents deletion or modification, not on automatically deleting content after a set period. Option C (eDiscovery) is wrong because eDiscovery is used for searching, holding, and exporting content for legal or investigative purposes, not for automated retention and deletion policies. Option D (Communication Compliance) is wrong because Communication Compliance is designed to detect and remediate inappropriate communications (e.g., harassment, sensitive info) in Microsoft Teams, Exchange, and Yammer, not for managing document lifecycle retention or deletion.

Full explanation →

109

MCQhard

A company uses Microsoft Entra ID P2 licenses. The security team wants to automatically block sign-ins for users with high sign-in risk, but only when the sign-in originates from outside the corporate network. For sign-ins from the corporate network, they want to require a password change for medium sign-in risk. A group of emergency access accounts (break-glass) must be excluded from all policies. What should the administrator implement?

A.single Conditional Access policy that blocks access for high risk from external locations and requires password change for medium risk from internal locations, excluding the break-glass group.

B.Two Conditional Access policies: one for external locations that blocks high risk, and one for internal locations that requires password change for medium risk. Both exclude the break-glass group.

C.An Identity Protection user risk policy that blocks high-risk users and prompts for password change for medium-risk users, configured to exclude the break-glass group.

D.Conditional Access policy that requires multi-factor authentication for all users except break-glass, and a separate sign-in risk policy for blocking high risk from external locations.

AnswerB

This meets all requirements: separate policies for different location + risk combinations, and the break-glass group is excluded from both.

Why this answer

Conditional Access policies evaluate conditions like location and sign-in risk separately, and combining both conditions (external vs. internal) with different grant controls (block vs. require password change) in a single policy is not supported. Two separate policies are required: one for external locations with high risk to block, and one for internal locations with medium risk to require password change. Both must exclude the break-glass group to ensure emergency access is never blocked.

Exam trap

The trap here is that candidates often assume a single Conditional Access policy can handle multiple condition-to-control mappings, but Microsoft Entra ID requires separate policies for each unique combination of conditions and grant controls.

How to eliminate wrong answers

Option A is wrong because a single Conditional Access policy cannot apply different grant controls (block vs. require password change) based on different location conditions within the same policy; each policy can only have one set of grant controls. Option C is wrong because an Identity Protection user risk policy applies to user risk (compromised accounts), not sign-in risk (compromised session), and does not evaluate location (corporate network vs. external). Option D is wrong because it suggests a single Conditional Access policy requiring MFA for all users, which does not address the specific sign-in risk and location requirements, and a separate sign-in risk policy cannot be combined with location-based conditions in the way described.

Full explanation →

110

MCQeasy

An administrator is managing a Microsoft 365 tenant and needs to delegate the ability to reset user passwords to a group of helpdesk staff. The helpdesk staff should not have any other administrative privileges. Which built-in role should the administrator assign?

A.Global Administrator

B.Password Administrator

C.User Administrator

D.Helpdesk Administrator

AnswerB

Password Administrator can reset passwords for non-administrator users and does not include other administrative capabilities.

Why this answer

The Password Administrator role is the correct choice because it grants the specific ability to reset passwords for non-administrator users and manage service requests, without providing broader administrative privileges like managing users, groups, or licensing. This aligns with the principle of least privilege, ensuring helpdesk staff can perform password resets without accessing other sensitive areas of the tenant.

Exam trap

The trap here is that candidates often confuse the Helpdesk Administrator role (which also resets passwords) as the correct answer, but the Password Administrator role is even more restricted and specifically designed for password-only tasks, making it the precise least-privilege choice.

How to eliminate wrong answers

Option A is wrong because the Global Administrator role grants unrestricted access to all administrative features, including security, compliance, and billing, which far exceeds the requirement to only reset passwords. Option C is wrong because the User Administrator role can create and delete users, manage user licenses, and reset passwords for all users (including admins), which provides more privileges than needed and violates the least-privilege requirement. Option D is wrong because the Helpdesk Administrator role, while limited, includes the ability to reset passwords and manage service requests, but it also grants the ability to manage support tickets and view reports, which is more than the narrow scope of password resets alone; however, the Password Administrator role is even more restricted, making it the precise fit.

Full explanation →

111

Multi-Selecthard

A compliance officer needs to ensure that all documents containing a custom sensitive info type (Employee ID with pattern EMP-####) are automatically labeled with a retention label that retains the documents for 3 years. Which two Microsoft Purview components must be configured? (Choose two.)

Select 2 answers

A.sensitivity label

B.retention label

C.data loss prevention (DLP) policy

D.An auto-labeling policy for retention labels

AnswersB, D

A retention label defines the retention and deletion rules for content at a granular level, such as preserving documents for a specific number of days, years, or permanently. You can apply it manually to individual items or through auto-labeling policies, and it triggers a retention period that cannot be overridden by users. For the compliance officer's requirement to manage document retention, this is the direct and authoritative mechanism.

Why this answer

A retention label is required to specify the retention period (3 years) for the documents. An auto-labeling policy for retention labels is needed to automatically apply that retention label based on the detection of the custom sensitive info type (Employee ID pattern EMP-####). Together, these two components enable automatic classification and retention without manual user intervention.

Exam trap

The trap here is that candidates often confuse sensitivity labels with retention labels, or think a DLP policy can apply retention labels, but Microsoft Purview separates these functions: DLP controls data movement, while auto-labeling policies for retention labels handle automatic retention label assignment.

Full explanation →

112

Multi-Selectmedium

A security analyst wants to create a custom detection rule in Microsoft 365 Defender that triggers when a PowerShell process with suspicious command-line arguments is detected on a device, and within 5 minutes, an outbound network connection to a known malicious IP occurs. Which two advanced hunting tables must be joined in the KQL query?

Select 1 answer

A.DeviceProcessEvents and DeviceNetworkEvents

B.EmailEvents and DeviceNetworkEvents

C.DeviceEvents and DeviceProcessEvents

D.IdentityLogonEvents and DeviceNetworkEvents

AnswersA

Correct. DeviceProcessEvents provides process details, and DeviceNetworkEvents provides network connections; joining them on device ID and timestamp allows correlation within the 5-minute window.

Why this answer

The detection rule requires correlating a PowerShell process event with an outbound network connection to a known malicious IP within 5 minutes. The correct approach is to join DeviceProcessEvents (for process details) with DeviceNetworkEvents (for network connections) on device ID and timestamp within the time window. Option C is incorrect because DeviceEvents does not reliably contain network connection data; it is intended for other event types.

Option B is incorrect because EmailEvents is for email events, not endpoint process or network data. Option D is incorrect because IdentityLogonEvents covers authentication events, not process or network activities.

Exam trap

The trap is that candidates may think DeviceEvents (which sounds like it covers all events) can substitute for DeviceNetworkEvents, but DeviceEvents does not include network connection telemetry needed for this correlation. Only DeviceProcessEvents plus DeviceNetworkEvents provide the precise data for process-to-network correlation.

Full explanation →

113

MCQhard

Your Microsoft 365 tenant has 50,000 users. You are planning to migrate mailboxes from on-premises Exchange Server 2019 to Exchange Online using a full hybrid configuration. During the migration, you must ensure that free/busy information is synchronized between on-premises and Exchange Online. Which component is required for free/busy synchronization in a hybrid deployment?

A.Exchange Hybrid Server (or Hybrid Agent)

B.Azure AD Connect

C.Exchange Online connector (Outbound to on-premises)

D.Hybrid Configuration Wizard

AnswerA

The Hybrid Server handles free/busy requests between on-premises and Exchange Online.

Why this answer

In a full hybrid configuration, free/busy synchronization between on-premises Exchange and Exchange Online is handled by the Exchange Hybrid Server (or the newer Hybrid Agent). This component acts as a bridge, using the Exchange Web Services (EWS) and Autodiscover service to securely relay free/busy data between the two organizations. Without it, the Availability service cannot query the remote forest for calendar information.

Exam trap

The trap here is that candidates often confuse Azure AD Connect (which handles identity sync) with the Exchange-specific component needed for calendar data, or they mistakenly think the Hybrid Configuration Wizard itself performs the runtime synchronization rather than just configuring it.

How to eliminate wrong answers

Option B is wrong because Azure AD Connect synchronizes identity objects (users, groups) and passwords, not mailbox-level free/busy data; free/busy requires Exchange-specific service endpoints. Option C is wrong because an Exchange Online connector (Outbound to on-premises) is used for mail flow routing, not for free/busy queries; free/busy relies on the Availability service and EWS, not SMTP connectors. Option D is wrong because the Hybrid Configuration Wizard is a tool that configures the hybrid deployment settings (including the Hybrid Server), but it is not the component that actually performs free/busy synchronization; the wizard enables the necessary configuration, but the Hybrid Server itself handles the runtime data exchange.

Full explanation →

114

MCQmedium

A company has a Microsoft 365 tenant with domain contoso.com. They own an additional domain fabrikam.com and have already added and verified it with a TXT record. Now they need to configure email to be routed to Exchange Online for fabrikam.com. Which DNS record must they create?

A.MX record pointing to contoso-com.mail.protection.outlook.com

B.CNAME record for autodiscover

C.TXT record for SPF

D.SRV record for SIP

AnswerA

Creating an MX record for fabrikam.com that points to `contoso-com.mail.protection.outlook.com` correctly configures email routing to Exchange Online. The MX record is the fundamental DNS mechanism that directs sending mail servers to the correct destination for a domain's email. For Microsoft 365, all verified domains within a single tenant share the same Exchange Online mail routing infrastructure. The `contoso-com` prefix identifies the specific Microsoft 365 tenant's mail protection service, ensuring that email for fabrikam.com is routed to the correct Exchange Online instance.

Why this answer

To route email for fabrikam.com to Exchange Online, you must create an MX record that points to the Exchange Online mail exchanger. The correct target is contoso-com.mail.protection.outlook.com, where 'contoso-com' is the hashed version of the primary domain (contoso.com) used by Microsoft 365. This MX record tells the internet's mail servers to deliver messages addressed to @fabrikam.com into the tenant's Exchange Online environment.

Exam trap

The trap here is that candidates often think they need to create an MX record pointing to 'fabrikam-com.mail.protection.outlook.com' (using the added domain), but Microsoft 365 always uses the primary domain's hashed value in the MX target regardless of which domain's email is being routed.

How to eliminate wrong answers

Option B is wrong because a CNAME record for autodiscover is used to automatically configure Outlook clients with Exchange Online settings, not to route email delivery. Option C is wrong because a TXT record for SPF is used to authorize sending servers and prevent spoofing, not to direct inbound email flow. Option D is wrong because an SRV record for SIP is used for VoIP and unified communications (Skype for Business/Teams), not for email routing.

Full explanation →

115

MCQeasy

A global administrator wants to track service health issues and configure notifications for service incidents. Which portal should they use to view the current health status and set up email notifications?

A.Microsoft 365 admin center

B.Azure portal

C.Microsoft 365 Defender portal

D.Microsoft Purview compliance portal

AnswerA

The Service Health page in the Microsoft 365 admin center (under Health > Service health) aggregates current and historical health status for all Microsoft 365 workloads, including incidents, advisories, and expected resolutions. From this page, a global administrator can filter by product or region, view detailed problem descriptions, and configure proactive email notifications using the 'Notify me about issues' option. This dashboard is the designated console for tracking Microsoft 365 service health and directly satisfies the requirement.

Why this answer

The Microsoft 365 admin center provides the Service Health dashboard under Health > Service Health, which displays the current status of all Microsoft 365 services and allows administrators to configure email notifications for service incidents. This is the designated portal for managing tenant-wide service health and notifications, aligning with the role of a global administrator.

Exam trap

The trap here is that candidates often confuse the Microsoft 365 admin center with the Azure portal for service health, because Azure also has a Service Health blade, but it only covers Azure services, not Microsoft 365 services like Exchange Online or Teams.

How to eliminate wrong answers

Option B is wrong because the Azure portal is used for managing Azure services and resources, not for Microsoft 365 service health or email notifications; it lacks the Service Health dashboard for Microsoft 365. Option C is wrong because the Microsoft 365 Defender portal focuses on security threats, incidents, and alerts (e.g., from Microsoft Defender for Office 365), not on service health incidents or email notifications for service availability. Option D is wrong because the Microsoft Purview compliance portal is dedicated to data governance, compliance, and eDiscovery, not to tracking service health or configuring notifications for service incidents.

Full explanation →

116

Matchingmedium

Match each Microsoft 365 compliance feature to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Prevents sensitive data from being shared

Searches and exports content for legal cases

Keeps or deletes content based on rules

Classifies and protects data

Records user and admin activities

Why these pairings

Correct matches: DLP prevents accidental sharing, eDiscovery searches for legal needs, and Sensitivity Labels classify/protect data. Common confusions include mixing DLP with retention policies and eDiscovery with automatic classification.

Full explanation →

117

MCQmedium

A company must ensure that all outgoing emails containing credit card numbers are blocked from being sent to external recipients. When a user attempts to send such an email, it should be blocked immediately, and the user should see a policy tip explaining the rule. Which Microsoft Purview solution should the administrator configure?

A.Data Loss Prevention (DLP) policy

B.Sensitivity labels

C.Retention labels

D.Communication compliance

AnswerA

DLP policies can block emails containing sensitive info and display policy tips to users.

Why this answer

A Data Loss Prevention (DLP) policy is the correct solution because it is specifically designed to detect sensitive information, such as credit card numbers, in transit (email) and enforce real-time actions like blocking the message and displaying a policy tip to the user. DLP policies in Microsoft Purview can be configured with conditions that match credit card number patterns using built-in sensitive info types, and the action 'Block messages' with a policy tip notification is available for Exchange Online mail flow. This ensures immediate blocking and user notification without requiring any manual labeling or classification.

Exam trap

The trap here is that candidates often confuse sensitivity labels with DLP because both involve 'protection,' but sensitivity labels require manual or automatic classification and do not perform real-time content inspection or blocking of outbound emails based on sensitive data patterns.

How to eliminate wrong answers

Option B is wrong because sensitivity labels are used to classify and protect data at rest (e.g., documents and emails) by applying encryption or visual markings, but they do not natively detect credit card numbers in real-time during email transmission or enforce blocking with policy tips. Option C is wrong because retention labels are designed to manage data lifecycle and retention policies (e.g., how long to keep or delete data), not to inspect email content for sensitive information or block outbound messages. Option D is wrong because communication compliance is focused on monitoring and reviewing internal and external communications for policy violations (e.g., harassment or insider trading), but it does not provide real-time blocking of emails based on sensitive data patterns or display policy tips to users.

Full explanation →

118

MCQmedium

A company wants to require that all users accessing a critical cloud application for the first time must accept a company terms of use before they are granted access. Which Conditional Access policy grant control should be added?

A.Require multi-factor authentication

B.Require device to be marked as compliant

C.Require terms of use

D.Require approved client app

AnswerC

The 'Require terms of use' grant control in Azure AD Conditional Access is the only listed option that directly presents a designated Azure AD Terms of Use document to the user at sign-in and requires an explicit Accept action before the session proceeds. Once the user accepts, Azure AD records the acceptance, and the conditional access policy can require reacceptance based on expiration or frequency. This matches the stated requirement precisely because access is gated on the user's affirmative acknowledgement of the terms.

Why this answer

The 'Require terms of use' grant control in a Conditional Access policy is specifically designed to force a user to accept a company's terms of use (TOU) before accessing a cloud application. When this control is enabled, Microsoft Entra ID presents the TOU document to the user on first access, and access is blocked until the user explicitly accepts the terms. This directly meets the requirement of requiring acceptance before granting access.

Exam trap

The trap here is that candidates often confuse 'terms of use' with a general compliance or security requirement, leading them to select 'Require device to be marked as compliant' (Option B) because they think device compliance implies policy acceptance, but Conditional Access grant controls are distinct and the terms of use control is the only one that enforces a user-facing acceptance workflow.

How to eliminate wrong answers

Option A is wrong because Require multi-factor authentication (MFA) enforces an additional authentication factor, not a legal or policy acceptance step; it does not present or require acceptance of a terms of use document. Option B is wrong because Require device to be marked as compliant checks device health and compliance status (e.g., via Intune or MDM), but does not involve any user-facing terms acceptance workflow. Option D is wrong because Require approved client app restricts access to specific client applications (e.g., Microsoft Outlook or Teams), but has no mechanism to display or enforce a terms of use acceptance.

Full explanation →

119

MCQeasy

Your organization is planning to deploy Microsoft 365 Copilot. You need to ensure that all prerequisites are met. Which of the following is a mandatory prerequisite for enabling Microsoft 365 Copilot?

A.Microsoft Purview Data Loss Prevention policies.

B.Microsoft Entra ID P2 licenses.

C.An active Azure subscription.

D.Exchange Online Plan 2 licenses.

AnswerB

Microsoft Entra ID P2 licenses are not mandatory. While Copilot uses Entra ID for identity, only the free tier or P1 is sufficient. P2 is not a requirement.

Why this answer

None of the listed options are mandatory prerequisites for Microsoft 365 Copilot. The actual mandatory requirements are a qualifying Microsoft 365 license (E3, E5, or Business Premium) and the Microsoft 365 Copilot add-on license. Microsoft Entra ID P2 is not required; a basic Entra ID (free) is sufficient.

Purview DLP, an Azure subscription, and Exchange Online Plan 2 are also not mandatory.

Exam trap

The trap here is that candidates might assume Microsoft Entra ID P2 is required because Copilot relies on identity and security features, but in reality, a standard Entra ID (free) is sufficient. The actual mandatory prerequisites are a qualifying Microsoft 365 license and the Copilot add-on.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Data Loss Prevention policies are not a prerequisite for enabling Copilot; they are an optional compliance feature that can be applied after deployment to control data sharing. Option C is wrong because an active Azure subscription is not required for Microsoft 365 Copilot, which is a SaaS add-on to Microsoft 365 and does not depend on Azure infrastructure for its core functionality. Option D is wrong because Exchange Online Plan 2 licenses are not mandatory; Copilot works with Exchange Online Plan 1 or other mail-enabled plans as long as the user has a valid Microsoft 365 license that includes Exchange Online.

Full explanation →

120

MCQhard

A security analyst is investigating a suspected credential theft attack where an attacker attempts to dump credentials from LSASS. Which Attack Surface Reduction (ASR) rule should the administrator enable to block this activity from untrusted processes?

A.Block credential stealing from the Windows local security authority subsystem (lsass.exe)

B.Block Office applications from creating child processes

C.Block executable files from running unless they meet a prevalence, age, or trusted list criterion

D.Block Adobe Reader from creating child processes

AnswerA

This Attack Surface Reduction rule is specifically engineered to prevent untrusted processes from reading the memory space of lsass.exe, the Windows Local Security Authority Subsystem. By blocking read access to LSASS, it directly thwarts credential-dumping techniques used by tools such as Mimikatz, which rely on extracting password hashes or plaintext credentials from that process's memory. This makes it the most targeted and effective rule for the described credential theft scenario.

Why this answer

The ASR rule 'Block credential stealing from the Windows local security authority subsystem (lsass.exe)' (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2) is specifically designed to prevent untrusted processes from accessing LSASS memory and dumping credentials, such as with tools like Mimikatz. This directly addresses the described attack scenario of credential theft from LSASS, making it the correct choice.

Exam trap

The trap here is that candidates may confuse generic credential theft prevention rules (like Windows Defender Credential Guard) with ASR rules, or mistakenly think that blocking child processes (Option B or D) would stop LSASS dumping, when in fact the attack often involves a direct process handle to lsass.exe rather than spawning a child process.

How to eliminate wrong answers

Option B is wrong because 'Block Office applications from creating child processes' prevents Office apps (e.g., Word, Excel) from spawning child processes like PowerShell or cmd.exe, which is a common technique for lateral movement or payload execution, not specifically for dumping credentials from LSASS. Option C is wrong because 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' is a cloud-delivered protection rule that restricts unknown executables based on reputation, not a targeted ASR rule for LSASS credential theft. Option D is wrong because 'Block Adobe Reader from creating child processes' prevents Adobe Reader from launching other executables, which is a defense against PDF-based exploits, not a rule designed to block credential dumping from LSASS.

Full explanation →

121

MCQmedium

A compliance officer needs to prevent users from sharing confidential documents with external users outside the organization. The policy should block sharing via email attachments or sharing links from SharePoint Online. Which Microsoft Purview solution should be configured?

A.Sensitivity labels

B.Data Loss Prevention (DLP)

C.Retention policies

D.Information barriers

AnswerB

DLP policies are the correct technical control because they can identify sensitive information in messages and files and automatically block specific actions such as sending an external email or creating an external sharing link in SharePoint and OneDrive. When a rule is triggered, DLP can block the activity outright, show a policy tip, or require a user to justify an override, giving compliance officers a real-time enforcement mechanism. DLP works across Exchange, SharePoint, OneDrive, Teams, and endpoints, making it the only option listed that explicitly prevents the sharing of sensitive content.

Why this answer

Data Loss Prevention (DLP) in Microsoft Purview is designed to identify, monitor, and automatically protect sensitive information across Exchange Online, SharePoint Online, and OneDrive for Business. By creating a DLP policy with a rule that blocks sharing of confidential documents via email attachments or sharing links to external users, the compliance officer can enforce the required restriction. DLP policies can inspect content for sensitive data types (e.g., credit card numbers, custom confidential labels) and apply actions such as blocking the sharing action or sending a notification.

Exam trap

The trap here is that candidates often confuse sensitivity labels (which apply protection) with DLP policies (which enforce actions like blocking), leading them to choose Option A, but labels alone cannot block sharing; they require a DLP policy to enforce the block action.

How to eliminate wrong answers

Option A is wrong because sensitivity labels are used to classify and protect data by applying encryption, markings, or access restrictions, but they do not natively block sharing actions based on external user detection; DLP policies are required to enforce such blocking rules. Option C is wrong because retention policies are designed to preserve or delete content after a specified period, not to prevent real-time sharing of documents with external users. Option D is wrong because information barriers restrict communication and collaboration between specific internal groups or users (e.g., to avoid conflicts of interest), but they do not block sharing with external users outside the organization.

Full explanation →

122

MCQmedium

A company uses Microsoft Entra ID P2 licenses. They want to block all authentication attempts from an internal app that uses legacy authentication protocols (POP3, IMAP, SMTP) because these protocols cannot enforce multi-factor authentication. Which Conditional Access policy setting should be used?

A.Grant access requiring multi-factor authentication

B.Block access for apps using legacy authentication

C.Require compliant device

D.Require approved client app

AnswerB

In a Conditional Access policy, the 'Client apps' condition includes 'Exchange ActiveSync clients' and 'Other clients'. Selecting these options explicitly targets protocols such as POP3, IMAP4, SMTP, and Exchange Web Services that rely on basic authentication instead of modern authentication. This blocks legacy authentication traffic while still allowing modern, MFA-capable clients, and it is the recommended way to enforce Microsoft's 'block legacy authentication' policy.

Why this answer

The scenario explicitly requires blocking authentication attempts from an internal app using legacy protocols (POP3, IMAP, SMTP) that cannot enforce multi-factor authentication. The 'Block access for apps using legacy authentication' Conditional Access setting targets client apps that use legacy authentication protocols, effectively preventing any authentication from those apps regardless of user or device compliance.

Exam trap

The trap here is that candidates often confuse 'Require MFA' (which still allows legacy apps to attempt authentication and fail silently) with 'Block legacy authentication' (which explicitly prevents the authentication attempt at the protocol level), leading them to choose Option A instead of B.

How to eliminate wrong answers

Option A is wrong because 'Grant access requiring multi-factor authentication' would still allow the legacy app to attempt authentication; legacy protocols cannot pass MFA claims, so the policy would either fail or be bypassed, not block the attempt. Option C is wrong because 'Require compliant device' only checks device health (e.g., Intune compliance) and does not address the protocol-level vulnerability of legacy authentication; the app could still authenticate from a compliant device using POP3/SMTP without MFA. Option D is wrong because 'Require approved client app' enforces the use of specific modern authentication apps (e.g., Microsoft Authenticator) but does not block legacy protocols; an approved client app could still use legacy authentication if not explicitly restricted.

Full explanation →

123

MCQmedium

Contoso frequently collaborates with a partner company (Fabrikam) via B2B collaboration. Contoso uses Microsoft Entra ID P2 licenses and wants to require Fabrikam's guest users to authenticate using Contoso's MFA policies, ignoring any MFA claims from the Fabrikam home tenant. Fabrikam already has MFA enabled for its users. What configuration should Contoso make in their cross-tenant access settings?

A.Configure outbound access settings to require MFA for Fabrikam users

B.Configure inbound trust settings to uncheck 'Trust multi-factor authentication from Microsoft Entra tenants' for Fabrikam

C.Create a Conditional Access policy targeting all guest users from Fabrikam that requires MFA

D.Configure B2B direct connect for Fabrikam and require MFA

AnswerB

By default, Contoso trusts MFA claims from external tenants. Unchecking this setting for Fabrikam forces Contoso to re-evaluate MFA requirements for those guest users.

Why this answer

Contoso wants to ignore MFA claims from Fabrikam's home tenant and enforce its own MFA policies on Fabrikam guest users. In cross-tenant access settings, the 'Trust multi-factor authentication from Microsoft Entra tenants' checkbox controls whether inbound MFA claims from the external tenant are accepted. By unchecking this for Fabrikam, Contoso ensures that Fabrikam's MFA claims are ignored, and Contoso's Conditional Access policies (including MFA requirements) apply to those guest users.

Exam trap

The trap here is that candidates often confuse inbound trust settings with outbound settings or Conditional Access policies, assuming that a Conditional Access policy alone can override MFA claims from the home tenant, when in fact the trust setting must be explicitly disabled to ignore those claims.

How to eliminate wrong answers

Option A is wrong because outbound access settings control how Contoso's users access Fabrikam resources, not how Fabrikam's guest users authenticate into Contoso. Option C is wrong because while a Conditional Access policy can require MFA for guest users, it does not override or ignore MFA claims from the home tenant; if the inbound trust setting trusts Fabrikam's MFA, the Conditional Access policy may not re-prompt for MFA. Option D is wrong because B2B direct connect is used for Teams Connect shared channels, not for standard B2B collaboration guest user access, and it does not provide the granular control over MFA trust needed here.

Full explanation →

124

MCQeasy

An administrator has added a custom domain 'contoso.com' to their Microsoft 365 tenant and verified ownership. However, users are unable to receive emails sent to their custom domain. Which type of DNS record must the administrator add in the public DNS zone to route emails to Exchange Online?

A.TXT record

B.MX record

C.CNAME record

D.SPF record

AnswerB

An MX record specifies the mail exchange server for the domain. For Exchange Online, it must point to the Microsoft mail exchanger.

Why this answer

The MX (Mail Exchange) record is the DNS record type that directs email messages to a specific mail server. For Exchange Online, the MX record must point to the tenant's mail exchanger (e.g., contoso-com.mail.protection.outlook.com) with a priority value (typically 0). Without this record, sending mail servers cannot route inbound emails to the custom domain's mailbox store in Exchange Online.

Exam trap

The trap here is that candidates confuse the purpose of MX records with SPF or TXT records, thinking that SPF alone enables email delivery, when in fact MX records are the fundamental requirement for inbound mail routing.

How to eliminate wrong answers

Option A (TXT record) is wrong because TXT records hold arbitrary text data, such as SPF or DKIM keys, but they do not route email traffic. Option C (CNAME record) is wrong because CNAME records alias one domain to another and are not used for mail routing; MX records are the standard for mail exchange. Option D (SPF record) is wrong because SPF records authorize sending servers to prevent spoofing, but they do not direct inbound email delivery.

Full explanation →

125

MCQeasy

An administrator needs to allow external users from a partner company to sign up for access to a SharePoint Online site using their own Azure AD accounts. Which configuration should the administrator enable?

A.Enable 'Email one-time passcode authentication' for guests

B.Enable 'External identities' > 'Self-service sign-up' in Azure AD

C.Configure a cross-tenant access policy for the partner tenant

D.Create guest user accounts manually in Azure AD

AnswerB

This setting allows external users to sign up for access to resources using their own Azure AD or Microsoft account identities.

Why this answer

Enabling 'Self-service sign-up' in Azure AD External Identities allows external users to sign up for access to applications (including SharePoint Online sites) using their own Azure AD accounts without manual admin intervention. This feature creates guest user objects automatically when the external user completes the sign-up flow, which satisfies the requirement for partner users to sign up using their existing Azure AD credentials.

Exam trap

The trap here is that candidates often confuse 'self-service sign-up' with 'cross-tenant access policies' or 'email OTP,' thinking that any guest authentication method enables self-service sign-up, but only the explicit self-service sign-up feature creates the automated user provisioning flow.

How to eliminate wrong answers

Option A is wrong because 'Email one-time passcode authentication' is an authentication method for guests who do not have an Azure AD or Microsoft account, not a mechanism for external users to sign up using their own Azure AD accounts. Option C is wrong because a cross-tenant access policy controls inbound and outbound access settings between tenants (e.g., B2B collaboration or B2B direct connect), but it does not enable self-service sign-up; it governs how existing guest users authenticate or access resources. Option D is wrong because manually creating guest user accounts in Azure AD requires administrative effort and does not allow external users to sign up on their own, which contradicts the requirement for self-service sign-up.

Full explanation →

126

MCQeasy

An organization has just purchased Microsoft 365 subscriptions and wants to add their custom domain 'fabrikam.com' to the tenant. Which record must they add to their DNS provider to verify domain ownership?

A.MX record

B.TXT record

C.CNAME record

D.SRV record

AnswerB

A TXT record is the standard method Microsoft 365 uses to verify domain ownership because it can hold an arbitrary text string. Microsoft gives you a unique verification token during the domain setup wizard; when you publish it as a TXT record, Microsoft queries your DNS zone and confirms the exact token exists. This proves you control the domain without affecting existing services, and you can remove the record after verification succeeds.

Why this answer

To verify domain ownership in Microsoft 365, you must add a TXT record provided by the Microsoft 365 admin center to your DNS hosting provider. This TXT record contains a unique verification string that Microsoft checks to confirm you control the domain. MX, CNAME, and SRV records are used for mail routing, service aliasing, and service location, respectively, but they do not serve the purpose of domain ownership verification.

Exam trap

The trap here is that candidates often confuse the TXT record used for verification with the MX record required for email routing, mistakenly thinking they can skip verification by adding an MX record directly.

How to eliminate wrong answers

Option A is wrong because an MX record is used to specify the mail exchange server for a domain, not to prove domain ownership; adding an MX record would only affect email routing. Option C is wrong because a CNAME record creates an alias from one domain name to another and is used for service redirection, not for domain verification. Option D is wrong because an SRV record defines the location (hostname and port) of specific services like SIP or LDAP, and it is not used for domain ownership validation.

Full explanation →

127

MCQhard

Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM) to manage administrative roles. You need to ensure that when a user activates the Global Administrator role, they must provide a justification and the activation is time-bound. Additionally, you want to require approval from the security team for this activation. What should you configure?

A.Configure an Identity Protection user risk policy for Global Administrators

B.Create an Access Review for Global Administrator role

C.Configure a Conditional Access policy requiring MFA for Global Administrator activation

D.Modify the PIM role settings for Global Administrator to require justification, set maximum activation duration, and require approval

AnswerD

PIM settings allow these configurations.

Why this answer

Privileged Identity Management (PIM) role settings allow you to enforce activation requirements such as justification, maximum activation duration, and approval. These settings are configured directly in the PIM role settings for the Global Administrator role, ensuring that every activation request is justified, time-bound, and requires approval from designated approvers (e.g., the security team).

Exam trap

The trap here is that candidates often confuse Conditional Access policies (which control authentication) with PIM role settings (which control role activation), leading them to select Option C even though Conditional Access cannot enforce approval workflows or activation duration limits.

How to eliminate wrong answers

Option A is wrong because Identity Protection user risk policies are designed to detect and respond to user account compromise risks (e.g., leaked credentials), not to control PIM role activation workflows. Option B is wrong because Access Reviews are used for periodic recertification of role assignments (e.g., confirming who still needs the role), not for enforcing activation-time requirements like justification, duration, or approval. Option C is wrong because Conditional Access policies can require MFA during sign-in, but they cannot enforce PIM-specific activation requirements such as justification, time-bound activation, or approval workflow; those are managed exclusively within PIM role settings.

Full explanation →

128

MCQhard

A security analyst wants to automatically create a Microsoft Teams message in a dedicated security channel whenever a Microsoft 365 Defender incident with severity 'High' is created. Which automation approach should the analyst use?

A.Power Automate

B.Automation rules in Defender

C.Microsoft Graph API

D.Action Center

AnswerA

Power Automate flows offer a native trigger for Microsoft 365 Defender incidents, such as 'When an incident is created or updated,' and can then use the Microsoft Teams connector's 'Post message in a chat or channel' action to send a message to a specific channel. This low-code solution allows filtering by severity (e.g., High), supports adaptive cards for rich context, and can automatically execute without human intervention. It is the standard tool for integrating Defender incident generation with Teams notifications.

Why this answer

Power Automate is the correct choice because it provides a no-code/low-code workflow that can be triggered by Microsoft 365 Defender's 'When an incident is created or updated' connector, filter for severity 'High', and then post a message to a dedicated Teams channel via the 'Post a message in a chat or channel' action. This directly meets the requirement for automatic, event-driven notification without custom code.

Exam trap

The trap here is that candidates confuse 'automation rules' in Defender (which handle response actions like isolation) with external notification workflows, leading them to choose Option B instead of recognizing that Power Automate is the correct integration tool for sending Teams messages.

How to eliminate wrong answers

Option B is wrong because Automation rules in Defender are designed for automated response actions (e.g., isolating a device, blocking an IP) within the Defender portal itself, not for sending external notifications like Teams messages. Option C is wrong because while Microsoft Graph API can technically achieve this, it requires custom scripting, authentication setup, and manual polling or webhook configuration, making it less straightforward than Power Automate for a security analyst without developer resources. Option D is wrong because Action Center is a centralized interface for reviewing and approving pending remediation actions from Defender, not a tool for creating automated notifications or workflows.

Full explanation →

129

MCQeasy

Your organization uses Microsoft Entra ID to manage user identities. You need to ensure that users can sign in using their existing social media accounts, such as Microsoft, Google, or Facebook. What should you configure?

A.Configure Conditional Access policies for social identity providers

B.Configure External Identities and add identity providers for social networks

C.Configure Microsoft Entra Connect to sync social account attributes

D.Configure self-service password reset (SSPR)

AnswerB

External Identities supports adding social identity providers like Google and Facebook.

Why this answer

Microsoft Entra ID supports External Identities, which allow you to add social identity providers (Microsoft, Google, Facebook) as external authentication sources. This enables users to sign in with their existing social accounts by configuring federation with those providers using OAuth 2.0 or OpenID Connect protocols, without needing to create separate Entra ID accounts.

Exam trap

The trap here is that candidates often confuse Conditional Access policies with identity provider configuration, thinking policies can add or manage external authentication sources, when in fact Conditional Access only enforces rules on already-configured providers.

How to eliminate wrong answers

Option A is wrong because Conditional Access policies evaluate sign-in risks and enforce access controls after authentication, but they cannot add or configure social identity providers; they only work with already-configured identity providers. Option C is wrong because Microsoft Entra Connect is used to synchronize on-premises Active Directory objects to Entra ID, not to sync social account attributes—social identity providers are external and not synced via directory synchronization. Option D is wrong because self-service password reset (SSPR) allows users to reset their own passwords for their Entra ID accounts, but it does not enable sign-in with social media accounts; SSPR is unrelated to external identity provider configuration.

Full explanation →

130

MCQhard

Your organization uses Microsoft Defender for Office 365. You have configured a safe attachment policy that should automatically detonate attachments in a sandbox before delivery. However, some users still receive malicious attachments. What should you check first?

A.Check whether a mail flow rule (transport rule) is bypassing Safe Attachments.

B.Check the Safe Links policy configuration.

C.Review the mailbox audit log for each affected user.

D.Verify that the Safe Attachments policy is applied to the affected users and that the action is set to 'Dynamic Delivery' or 'Replace' (not 'Monitor').

AnswerD

The policy must be applied and set to detonate attachments.

Why this answer

Safe Attachments policies can be configured with actions like 'Dynamic Delivery' or 'Replace' to actively block or detonate attachments before delivery. If the action is set to 'Monitor', attachments are delivered first and only monitored, which can allow malicious attachments to reach users. Therefore, verifying the policy action is the first step to ensure detonation occurs before delivery.

Exam trap

The trap here is that candidates often overlook the difference between 'Monitor' and 'Replace'/'Dynamic Delivery' actions, assuming any Safe Attachments policy will automatically detonate before delivery, when in fact 'Monitor' delivers first and only logs the result.

How to eliminate wrong answers

Option A is wrong because mail flow rules (transport rules) can bypass Safe Attachments processing, but this is a less common scenario and not the first check; the policy action itself is the primary cause. Option B is wrong because Safe Links policy protects URLs in messages and Office documents, not attachments, so it is irrelevant to the issue of malicious attachments being delivered. Option C is wrong because the mailbox audit log tracks user actions (like reading or deleting messages), not the delivery or detonation status of attachments, making it an incorrect starting point.

Full explanation →

131

MCQmedium

An organization wants to enforce that all administrators use a phishing-resistant authentication method (e.g., FIDO2 security keys or Windows Hello for Business) when accessing Microsoft 365 admin portals. Which Microsoft Entra ID feature should be used?

A.Conditional Access authentication strength

B.Security defaults

C.Per-user MFA

D.Identity Protection

AnswerA

Conditional Access authentication strength is the correct mechanism because it lets you create or use a built-in policy that requires a specific authentication strength, such as "Phishing-resistant MFA" (FIDO2 security keys, Windows Hello for Business, or certificate-based authentication). You apply this policy to a Conditional Access grant control scoped to the Administrator role, which forces every administrator to sign in using only a phishing-resistant method. This is more than just enabling MFA; it actively rejects weaker methods like SMS, voice call, OTP, or authenticator app verification codes, ensuring compliance with the stated requirement.

Why this answer

Conditional Access authentication strength allows administrators to define and enforce specific authentication methods, such as FIDO2 security keys or Windows Hello for Business, which are phishing-resistant. By creating a policy that targets admin roles and requires an authentication strength policy that mandates these methods, the organization can ensure that only phishing-resistant credentials are accepted when accessing Microsoft 365 admin portals. This granular control goes beyond simple MFA enforcement by specifying the exact authentication method required.

Exam trap

The trap here is that candidates often confuse the generic MFA enforcement of Security defaults or Per-user MFA with the ability to specify a particular authentication method, not realizing that only Conditional Access authentication strength provides the granularity to mandate phishing-resistant methods like FIDO2.

How to eliminate wrong answers

Option B is wrong because Security defaults enforces a baseline set of security policies, including requiring MFA for all users, but it does not allow customization to mandate a specific phishing-resistant method like FIDO2; it uses a generic MFA requirement that could be satisfied by less secure methods such as SMS or OTP. Option C is wrong because Per-user MFA enables or disables MFA on a per-user basis but cannot enforce a specific authentication method; it only requires the user to complete MFA using any method they have registered, including non-phishing-resistant ones. Option D is wrong because Identity Protection is a risk-based detection and remediation tool that identifies suspicious sign-ins and user risks, but it does not enforce specific authentication methods; it can trigger MFA via Conditional Access but cannot mandate a particular method like FIDO2.

Full explanation →

132

MCQhard

A compliance officer needs to automatically detect and apply a sensitivity label to documents in SharePoint Online that contain a custom sensitive information type (e.g., employee ID pattern). The label must be applied automatically, and users must be prompted to provide a justification when attempting to remove the label. Which combination of configurations should the officer implement?

A.Create a sensitivity label with an auto-labeling policy that uses a custom sensitive info type, and configure the label's protection settings to require user justification to remove the label.

B.Create a retention label and publish it to the site via auto-labeling policy.

C.Use a Data Loss Prevention (DLP) policy to apply the label and configure the policy to block removal.

D.Deploy the Azure Information Protection scanner to scan SharePoint Online documents.

AnswerA

This allows automatic detection and application of the label, and the justification requirement prevents easy removal.

Why this answer

Microsoft Purview sensitivity labels support auto-labeling policies that can automatically apply a label based on custom sensitive information types (e.g., employee ID patterns). Additionally, the label's protection settings include an option to require user justification when removing the label, which meets the compliance officer's requirement for both automatic detection and removal justification.

Exam trap

The trap here is that candidates confuse retention labels (which handle lifecycle) with sensitivity labels (which handle classification and protection), or they mistakenly think DLP policies can enforce label removal justification, which is a sensitivity label property, not a DLP rule action.

How to eliminate wrong answers

Option B is wrong because retention labels are designed for data lifecycle management (retention and deletion), not for sensitivity classification or protection settings like requiring justification for removal. Option C is wrong because DLP policies can apply sensitivity labels via auto-labeling, but they cannot enforce a 'block removal' of a label; removal justification is a property of the sensitivity label itself, not a DLP action. Option D is wrong because the Azure Information Protection (AIP) scanner is used for on-premises file shares and on-premises SharePoint, not for SharePoint Online; SharePoint Online uses built-in auto-labeling policies in Purview.

Full explanation →

133

Multi-Selecteasy

An administrator needs to open a Microsoft 365 support request because a critical service issue is affecting all users. Which two pieces of information should the administrator have readily available before contacting support? (Choose two.)

Select 2 answers

A.Tenant ID

B.User principal names of affected users

C.Current service health status

D.Billing contact information

AnswersA, C

The Tenant ID is required to verify the organization and locate the tenant in support systems.

Why this answer

The Tenant ID (A) is a unique, immutable identifier for the Microsoft 365 tenant, required by Microsoft Support to locate the tenant in their systems and verify administrative access. The current service health status (C) is critical because the support engineer will first check the Microsoft 365 Service Health Dashboard (admin.microsoft.com/Adminportal/Home?source=applauncher#/servicehealth) to confirm the issue is a known service incident; having this information ready avoids redundant troubleshooting and speeds up the creation of a service request.

Exam trap

The trap here is that candidates often assume user principal names (UPNs) are needed for any support request, but Microsoft Support requires the Tenant ID and service health status for tenant-wide issues, not individual user identifiers.

Full explanation →

134

MCQeasy

You are configuring Microsoft Entra ID provisioning for a SaaS application that supports SCIM 2.0. The app requires the 'manager' attribute to be mapped. However, the manager attribute is not populated for all users. What should you do to avoid provisioning failures?

A.Configure the attribute mapping to 'Ignore it if null' for the manager attribute

B.Modify the SCIM schema in the application to make manager optional

C.Use the expression language to set a default value for the manager attribute

D.Delete the manager attribute mapping from the provisioning configuration

AnswerA

In the Entra ID attribute mapping editor, the 'Ignore it if null' option instructs the provisioning engine to omit the manager attribute from the SCIM request when the source user has no manager set. This prevents the target application from receiving a null value that could fail schema validation or overwrite an existing value with empty data. As a result, users without managers are provisioned successfully, and manager relationships are only updated when a real manager actually exists.

Why this answer

When the 'manager' attribute is not populated for all users, configuring the attribute mapping to 'Ignore it if null' prevents provisioning failures by allowing the provisioning service to skip the attribute when its value is null, rather than attempting to send an empty or invalid value that the SCIM 2.0 endpoint might reject. This setting ensures that only users with a manager value trigger the mapping, avoiding errors for users without a manager.

Exam trap

The trap here is that candidates often confuse 'Ignore it if null' with setting a default value or removing the mapping, but the correct approach is to gracefully skip the null attribute rather than force a value or delete the mapping entirely.

How to eliminate wrong answers

Option B is wrong because modifying the SCIM schema in the application to make manager optional is typically not under your control—the SaaS application defines its SCIM schema, and you cannot alter it from Microsoft Entra ID. Option C is wrong because using expression language to set a default value for the manager attribute would assign a static value (e.g., 'Unknown') to users without a manager, which could cause incorrect data or provisioning failures if the application expects a valid manager reference. Option D is wrong because deleting the manager attribute mapping entirely would remove the attribute from provisioning, which might violate the application's required schema or business logic, and it does not address the need to handle null values gracefully.

Full explanation →

135

Multi-Selectmedium

Which TWO Microsoft Purview solutions can be used to detect and prevent the unauthorized sharing of sensitive information in Microsoft Teams messages?

Select 2 answers

A.Communication Compliance

B.eDiscovery (Premium)

C.Sensitivity labels

D.Information Barriers

E.Data Loss Prevention (DLP)

AnswersA, E

Communication Compliance in Microsoft Purview is designed to detect policy violations by analyzing user communications in Teams, Exchange, and Yammer for inappropriate or risky content. It uses customizable policies to flag messages that contain sensitive information, offensive language, or violations of corporate standards, enabling admins to review and take action. While it does not block sharing in real time, it is specifically built for detection and investigation of policy breaches.

Why this answer

DLP policies can scan Teams messages for sensitive content and block sharing. Communication Compliance can monitor messages for policy violations and take action. Sensitivity labels are for classification, not detection.

Information Barriers restrict communication between groups. eDiscovery is for investigation after the fact.

Full explanation →

136

MCQeasy

You run the KQL query shown in the exhibit in Microsoft Defender XDR advanced hunting. What is the primary purpose of this query?

A.Identify all PowerShell activity from a specific user

B.Detect potentially malicious PowerShell commands that are obfuscated

C.Find PowerShell processes running on a specific device

D.List all PowerShell executions in the last 7 days

AnswerB

This query deliberately searches for PowerShell processes launched with the -EncodedCommand parameter, which causes the payload to be passed as a Base64 string. Encoded commands are a hallmark of obfuscation because attackers use them to hide malicious code from casual log inspection and signature-based detection. The presence of an encoded PowerShell command is therefore a valid trigger point for investigating potentially malicious behavior.

Why this answer

The query filters for powershell.exe processes with an encoded command, which is commonly used to obfuscate malicious commands. Option A is wrong because the query does not filter for specific users. Option C is wrong because the query does not filter by device.

Option D is wrong because the query does not filter by time other than the last 7 days.

Full explanation →

137

MCQeasy

An organization has just purchased Microsoft 365 Business Standard licenses and has added the custom domain 'contoso.com' to the tenant. The administrator wants all new user email addresses to use '@contoso.com' instead of the default '@contoso.onmicrosoft.com'. How can this be achieved?

A.Set the default domain in the Microsoft 365 admin center to contoso.com

B.Change the primary SMTP address for each user manually after creation

C.Remove the onmicrosoft.com domain from the tenant

D.Edit the user creation PowerShell script to specify the domain

AnswerA

Setting contoso.com as the default domain in the Microsoft 365 admin center is the correct tenant-wide configuration. When you set a verified custom domain as the default, every new user created through the admin center automatically receives a user principal name (UPN) and email address ending with @contoso.com, without requiring any per-user steps. This setting persists for all future user creations and does not alter existing users' addresses, making it the standard way to ensure automatic assignment of the custom domain.

Why this answer

Setting the default domain to 'contoso.com' in the Microsoft 365 admin center ensures that all newly created users automatically receive an email address with the custom domain as their primary SMTP address. This is the standard method because the default domain setting controls the domain appended to new user accounts during creation, eliminating the need for manual changes.

Exam trap

The trap here is that candidates may think they must manually update each user or use PowerShell because they overlook the simple default domain configuration in the admin center, which automatically applies to all new user creations.

How to eliminate wrong answers

Option B is wrong because manually changing the primary SMTP address for each user after creation is inefficient and does not address the requirement for all new users to automatically use '@contoso.com'; it is a workaround, not a configuration. Option C is wrong because removing the 'onmicrosoft.com' domain from the tenant is not possible—it is a reserved default domain that cannot be deleted and is required for internal routing and Azure AD operations. Option D is wrong because editing a PowerShell script to specify the domain is a valid but unnecessary approach when the default domain setting in the admin center achieves the same result more simply; the question asks how to achieve this, and the admin center method is the direct, supported way.

Full explanation →

138

MCQmedium

A compliance administrator needs to automatically apply a retention label to all documents in a SharePoint Online site that contain Social Security numbers. The label should retain the documents for 5 years and then automatically delete them. Which feature should they configure?

A.Data Loss Prevention (DLP) policy

B.sensitivity label with auto-labeling

C.retention label with auto-labeling

D.An information barrier policy

AnswerC

Retention labels, when combined with auto-labeling policies, can automatically apply based on sensitive info types and enforce retention and deletion actions.

Why this answer

Retention labels with auto-labeling are designed to automatically apply retention settings based on sensitive information types, such as Social Security numbers, and can enforce a retention period (5 years) followed by automatic deletion. This feature is part of Microsoft Purview's records management and uses trainable classifiers or sensitive info types to trigger the label assignment on SharePoint Online documents.

Exam trap

The trap here is that candidates confuse DLP policies (which detect and protect) with retention labels (which manage lifecycle), leading them to choose Option A because both involve sensitive data detection, but only retention labels can enforce deletion after a set period.

How to eliminate wrong answers

Option A is wrong because a Data Loss Prevention (DLP) policy detects and protects sensitive data but does not apply retention labels or manage lifecycle actions like retention and deletion; DLP policies block or warn, not retain. Option B is wrong because sensitivity labels with auto-labeling focus on classification and protection (encryption, markings) rather than retention and deletion schedules; they do not enforce a 5-year retention followed by automatic deletion. Option D is wrong because an information barrier policy restricts communication and collaboration between groups, not document lifecycle management or retention labeling.

Full explanation →

139

MCQmedium

Your company uses Microsoft 365 and has recently deployed Microsoft Intune for mobile device management. You need to ensure that corporate data on iOS devices is protected by preventing users from copying data from managed apps to unmanaged apps. What should you configure?

A.Mobile application management (MAM) without enrollment.

B.Device compliance policies.

C.Conditional Access policies.

D.App protection policies.

AnswerD

App protection policies in Microsoft Intune are specifically designed to manage data protection at the application layer, including settings to prevent copy-paste of organizational data into unmanaged apps. These policies can be assigned directly to users across devices with or without MDM enrollment, making them the correct mechanism for this scenario. For example, the 'Restrict cut, copy, and paste' policy mode can block the action entirely or allow it only between managed apps.

Why this answer

App protection policies (APP) are the correct choice because they provide mobile application management (MAM) controls that specifically prevent data transfer between managed and unmanaged apps on iOS devices. Unlike device-level policies, APP operates at the application layer, allowing you to restrict copy/paste, cut, and data sharing actions without requiring device enrollment. This directly addresses the requirement to protect corporate data on iOS devices by blocking data leakage to unmanaged apps.

Exam trap

The trap here is that candidates confuse the deployment model (MAM without enrollment) with the actual policy configuration (app protection policies), or they mistakenly think device compliance or Conditional Access can control app-level data sharing, which they cannot.

How to eliminate wrong answers

Option A is wrong because MAM without enrollment (also known as MAM-WE) is a deployment model, not a specific policy configuration; while it can use app protection policies, the question asks what to configure, and the correct configuration is the app protection policy itself, not the deployment model. Option B is wrong because device compliance policies enforce device-level security requirements (e.g., jailbreak detection, passcode compliance) but do not control data transfer between apps at the application layer. Option C is wrong because Conditional Access policies control access to resources based on signals like device compliance or location, but they do not directly restrict copy/paste or data sharing between managed and unmanaged apps.

Full explanation →

140

MCQhard

A compliance officer needs to prevent external users from printing or copying content from documents stored in a SharePoint Online site. Which Microsoft Purview feature should be configured to enforce this restriction?

A.Sensitivity labels with encryption and usage rights

B.Data Loss Prevention (DLP) policy

C.Information Barriers

D.Microsoft Purview Information Protection without encryption

AnswerA

Sensitivity labels with encryption and usage rights directly enforce document-level restrictions by applying Azure Rights Management (RMS) protection. When an external user opens the document, the RMS client enforces usage rights that explicitly deny actions such as printing, copying, and editing, regardless of where the file is stored or how it is shared. These restrictions travel with the file itself, making them effective even after the file leaves your tenant, and they can be scoped to specific external users or groups.

Why this answer

Sensitivity labels with encryption and usage rights allow administrators to apply Azure Rights Management (Azure RMS) protection to documents, which can restrict actions such as printing and copying. By configuring a sensitivity label with specific usage rights (e.g., 'View Only' or disabling 'Extract' and 'Print'), external users are prevented from printing or copying content even after the document is downloaded or accessed in SharePoint Online. This is the only Purview feature that directly enforces persistent content-level restrictions on external users.

Exam trap

The trap here is that candidates often confuse DLP policies with content protection, assuming DLP can restrict printing or copying after access, when in fact DLP only controls data in transit or at rest and does not enforce persistent usage rights on the document itself.

How to eliminate wrong answers

Option B is wrong because Data Loss Prevention (DLP) policies detect and block sensitive information from being shared or exfiltrated, but they do not enforce persistent usage restrictions like preventing printing or copying after access is granted. Option C is wrong because Information Barriers are designed to prevent communication and collaboration between specific groups or users (e.g., to avoid conflicts of interest), not to control document-level actions like printing or copying. Option D is wrong because Microsoft Purview Information Protection without encryption applies labels for classification and auditing but does not enforce any technical restrictions on content usage; encryption is required to enforce usage rights.

Full explanation →

141

MCQmedium

Your company uses Microsoft Entra ID and has a custom line-of-business application that supports SAML-based SSO. You need to configure the application to use Microsoft Entra ID as the identity provider. Which enterprise application configuration should you use?

A.Linked Sign-on

B.SAML-based Sign-on

C.Password-based Sign-on

D.OpenID Connect-based Sign-on

AnswerB

SAML-based Sign-on is correct because it enables true federated single sign-on between Microsoft Entra ID and a custom application that supports the SAML 2.0 standard. Entra ID acts as the identity provider, authenticates the user, and sends a digitally signed SAML assertion to the app's ACS (Assertion Consumer Service) URL, allowing the app to trust the assertion without prompting for credentials again. This is the recommended SSO method for non-gallery enterprise applications, especially older line-of-business apps that lack support for modern OAuth/OIDC protocols.

Why this answer

The application supports SAML-based SSO, so the correct enterprise application configuration is SAML-based Sign-on. This allows Microsoft Entra ID to act as the identity provider by exchanging SAML assertions with the application, enabling federated authentication.

Exam trap

The trap here is that candidates may confuse SAML-based Sign-on with OpenID Connect because both are federated protocols, but the question explicitly states the application supports SAML, not OIDC.

How to eliminate wrong answers

Option A is wrong because Linked Sign-on is used to link an existing user account in an external identity provider to Microsoft Entra ID, not to configure SAML-based SSO. Option C is wrong because Password-based Sign-on uses a password vaulting approach where Microsoft Entra ID stores and replays credentials, which does not leverage SAML assertions. Option D is wrong because OpenID Connect-based Sign-on is built on OAuth 2.0 and uses ID tokens (JWT) instead of SAML assertions, making it incompatible with an application that specifically supports SAML-based SSO.

Full explanation →

142

Matchingmedium

Match each Microsoft 365 plan to its included services.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Web and mobile apps only

Desktop apps plus web and mobile

Business Standard plus security features

Full enterprise features without advanced security

E3 plus advanced security and analytics

Why these pairings

Correct matches: Business Basic = web apps only, Business Standard = desktop apps added, Business Premium = security features added, E3 = enterprise compliance. Common mistakes: confusing Business Basic with Business Standard or attributing Intune to Business Standard.

Full explanation →

143

MCQhard

Your organization is planning to deploy Microsoft 365 Copilot for all users. The compliance team has concerns about data leakage through Copilot responses. Specifically, they want to ensure that Copilot does not generate responses based on highly confidential data labeled with the 'Highly Confidential' sensitivity label. Additionally, users must be able to use Copilot for general productivity tasks. You need to configure Microsoft 365 Copilot to meet these requirements. The solution must use Microsoft Purview Information Protection. What should you do?

A.Remove the 'Highly Confidential' label from data that needs to be accessed by Copilot.

B.Configure sensitivity labels to apply encryption to 'Highly Confidential' data and use Microsoft Purview DLP to prevent Copilot from using that content.

C.Block Copilot for all users who have access to 'Highly Confidential' data.

D.Create a conditional access policy to require multi-factor authentication for Copilot access.

AnswerB

Encryption and DLP policies can restrict Copilot from accessing protected content.

Why this answer

It uses Microsoft Purview Information Protection to apply encryption via sensitivity labels to 'Highly Confidential' data, and then leverages Microsoft Purview Data Loss Prevention (DLP) policies to block Copilot from accessing or generating responses based on that encrypted content. This ensures that Copilot cannot use the protected data as a source for its responses, while still allowing users to use Copilot for general productivity tasks with non-protected data.

Exam trap

The trap here is that candidates often confuse blocking user access (Option C) with blocking data usage, or they think removing a label (Option A) is a valid compliance control, when in fact the correct approach is to use DLP policies to enforce restrictions on how Copilot can use labeled data.

How to eliminate wrong answers

Option A is wrong because removing the 'Highly Confidential' label from data does not prevent Copilot from accessing that data; it simply removes the classification, which could lead to data leakage and violates the compliance team's requirement to protect that specific data. Option C is wrong because blocking Copilot for all users who have access to 'Highly Confidential' data would prevent those users from using Copilot for general productivity tasks, which is explicitly required, and it does not address the data itself—only user access. Option D is wrong because a conditional access policy requiring multi-factor authentication for Copilot access controls authentication, not data usage; it does not prevent Copilot from generating responses based on 'Highly Confidential' data.

Full explanation →

144

MCQeasy

A compliance officer needs to preserve all mailbox data for a user who is under a legal investigation. The data must be preserved indefinitely, and no deletion (by the user or system) should be possible. Which Microsoft Purview feature should the officer use?

A.Litigation Hold

B.Retention Policy

C.Data Loss Prevention (DLP)

D.Sensitivity labels

AnswerA

Litigation Hold is the correct choice because it preserves all mailbox content indefinitely, including deleted items and prior versions, and blocks both user purges and automatic Exchange retention cleanup. In Exchange Online, Litigation Hold temporarily overrides deletion and applies an indefinite hold that is only lifted when the hold is explicitly removed by an administrator, making it a true preservation-for-compliance mechanism.

Why this answer

Litigation Hold is the correct feature because it preserves all mailbox content indefinitely, preventing any deletion by the user or automated processes like the Managed Folder Assistant. It ensures that data is immutable for eDiscovery purposes, meeting the compliance officer's requirement for indefinite preservation under legal investigation.

Exam trap

The trap here is that candidates often confuse Retention Policies with Litigation Hold, thinking a retention policy can indefinitely preserve data, but retention policies have configurable expiration periods and can allow deletion, whereas Litigation Hold provides an immutable, indefinite hold specifically for legal scenarios.

How to eliminate wrong answers

Option B (Retention Policy) is wrong because retention policies can allow deletion after a specified period or apply actions like 'Delete' or 'Retain and Delete,' which does not guarantee indefinite preservation and can be overridden by user actions. Option C (Data Loss Prevention (DLP)) is wrong because DLP policies are designed to detect and prevent accidental sharing of sensitive data, not to preserve or hold mailbox data for legal purposes. Option D (Sensitivity labels) is wrong because sensitivity labels classify and protect data based on sensitivity (e.g., encryption or marking), but they do not prevent deletion or provide indefinite hold capabilities for mailbox items.

Full explanation →

145

MCQmedium

A security analyst investigates a potential data exfiltration incident. The analyst identifies that a user's device has made multiple connections to an unknown external IP address using a custom port. Which Microsoft Defender XDR data source would provide the most detailed network communication logs for this investigation?

A.Microsoft Defender for Office 365

B.Microsoft Defender for Cloud Apps

C.Microsoft Defender for Endpoint

D.Microsoft 365 Defender portal alerts

AnswerC

Defender for Endpoint is the correct source because its sensor records detailed network communication events on each device, including the local process, destination IP, destination port, and protocol, which are stored in the DeviceNetworkEvents table for advanced hunting. These logs directly show an inbound or outbound connection that could represent exfiltration, with the process and user context needed for a full investigation.

Why this answer

Microsoft Defender for Endpoint (MDE) provides the most detailed network communication logs for this investigation because it captures full network events at the device level, including connections to external IP addresses on custom ports. MDE's advanced hunting schema includes the DeviceNetworkEvents table, which records source/destination IPs, ports, protocols, and process-level details, enabling precise analysis of anomalous outbound connections.

Exam trap

The trap here is that candidates often confuse the scope of Microsoft Defender for Cloud Apps, assuming it captures all network traffic, when in fact it only monitors cloud application usage and not raw endpoint network connections.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Office 365 focuses on email and collaboration threats (e.g., phishing, malware in attachments), not on device-level network traffic logs. Option B is wrong because Microsoft Defender for Cloud Apps provides visibility into cloud application usage and shadow IT, but it does not capture raw network connection logs from endpoints; it relies on API logs and traffic metadata from cloud apps. Option D is wrong because Microsoft 365 Defender portal alerts aggregate and correlate alerts from multiple sources but do not themselves store detailed network communication logs; they reference underlying data from MDE or other sources.

Full explanation →

146

MCQeasy

A company has purchased Microsoft 365 Business Standard and added the custom domain 'fabrikam.com' to the tenant. The company wants all new users to have 'fabrikam.com' as their default email domain instead of the onmicrosoft.com domain. How should the administrator achieve this?

A.Update the MX record in the DNS to point to Microsoft 365 with the custom domain.

B.In the admin center, go to Settings > Domains, select the custom domain, and click 'Set as default'.

C.Use the Exchange admin center to set the default email address policy to use the custom domain.

D.For each new user, manually add an email alias with the custom domain and remove the onmicrosoft.com alias.

AnswerB

This is the correct method. In the Microsoft 365 admin center, navigating to Settings > Domains, selecting the verified custom domain, and clicking 'Set as default' changes the tenant-level default domain. Once set, all new users are automatically assigned a user principal name (UPN) and primary SMTP address using that custom domain, rather than the initial onmicrosoft.com domain. This is a global, automated setting that applies to every subsequently created user, making it the intended administrative control.

Why this answer

The Microsoft 365 admin center provides a dedicated setting under Settings > Domains to mark a custom domain as the default email domain. Once set as default, all new users will automatically receive a primary email address using that domain instead of the initial onmicrosoft.com domain, without requiring manual changes or additional configuration.

Exam trap

The trap here is that candidates often confuse DNS record management (like MX records) with tenant-level domain configuration, or assume that Exchange email address policies are the only way to control default domains, when in fact the admin center's 'Set as default' option is the correct and simplest method for new users.

How to eliminate wrong answers

Option A is wrong because updating the MX record only controls mail routing (where incoming emails are delivered), not the default email domain assigned to new users. Option C is wrong because the Exchange admin center's email address policy applies to existing mailboxes and can set domain preferences, but the default domain for new users is controlled at the tenant level in the Microsoft 365 admin center, not via an email address policy. Option D is wrong because manually adding and removing aliases for each new user is inefficient and unnecessary; the default domain setting automates this process for all new users.

Full explanation →

147

MCQhard

Refer to the exhibit. The conditional access policy JSON shown above is applied to all users. A user authenticates from a trusted location and wants to access a cloud app. Which combination of controls will be enforced?

A.MFA, terms of use acceptance, sign-in frequency of 1 hour, and persistent browser never

B.Terms of use acceptance and persistent browser never only

C.MFA and terms of use acceptance only

D.MFA and sign-in frequency of 1 hour only

AnswerA

Despite the user authenticating from a trusted location, the conditional access policy's configuration dictates the enforced controls. The policy must explicitly include Multi-Factor Authentication (MFA) and terms of use acceptance within its grant controls, meaning these are required regardless of the trusted location status. Furthermore, the policy's session controls specify a sign-in frequency of 1 hour and persistent browser set to 'never', ensuring re-authentication and session termination after the specified period.

Why this answer

The conditional access policy JSON explicitly defines three grant controls: 'mfa' (require multi-factor authentication), 'termsOfUse' (require terms of use acceptance), and 'signInFrequency' (value 3600 seconds = 1 hour) combined with 'persistentBrowser' set to 'never'. Since the policy is applied to all users and the user authenticates from a trusted location, all specified controls are enforced simultaneously, as conditional access policies apply all grant controls in the 'grantControls' block unless overridden by session controls.

Exam trap

The trap here is that candidates often assume session controls (like sign-in frequency and persistent browser) are optional or ignored when grant controls are present, but in reality, all controls in both 'grantControls' and 'sessionControls' are enforced together unless explicitly conditional.

How to eliminate wrong answers

Option B is wrong because it omits the MFA requirement and the sign-in frequency control, both of which are explicitly listed in the JSON's 'grantControls' array. Option C is wrong because it ignores the 'signInFrequency' (value 3600 seconds) and 'persistentBrowser' (set to 'never') session controls, which are part of the policy's 'sessionControls' object and are enforced alongside grant controls. Option D is wrong because it omits the 'termsOfUse' grant control, which is included in the 'builtInControls' array as 'termsOfUse', and also ignores the 'persistentBrowser' session control.

Full explanation →

148

MCQeasy

A security administrator wants to detect unusual user activity, such as a user downloading an abnormally large number of files from SharePoint Online in a short period. Which Microsoft Defender for Cloud Apps feature should be used to create a policy for this behavior?

A.Cloud Discovery

B.Conditional Access App Control

C.Anomaly detection policy

D.App permissions

AnswerC

Anomaly detection policies can be configured to alert on unusual file download activities based on user context and volume.

Why this answer

Microsoft Defender for Cloud Apps uses anomaly detection policies to identify unusual user behavior, such as a user downloading an abnormally large number of files from SharePoint Online in a short period. These policies leverage machine learning to establish a baseline of normal activity and then trigger alerts when deviations occur, like a spike in download volume or rate.

Exam trap

The trap here is that candidates often confuse anomaly detection policies with Cloud Discovery, mistakenly thinking Cloud Discovery detects unusual user behavior, when in fact it only identifies unsanctioned cloud apps and services.

How to eliminate wrong answers

Option A is wrong because Cloud Discovery is designed to identify and analyze shadow IT usage by inspecting traffic logs from network proxies or firewalls, not to detect user-specific behavioral anomalies within sanctioned cloud apps like SharePoint Online. Option B is wrong because Conditional Access App Control enforces access policies (e.g., blocking downloads or requiring multi-factor authentication) at the session level, but it does not create detection policies for anomalous user behavior after access is granted. Option D is wrong because App permissions focuses on auditing and managing OAuth permissions granted to third-party apps, not on monitoring user download patterns or detecting unusual activity.

Full explanation →

149

MCQmedium

You need to enforce multifactor authentication (MFA) for all users in a Microsoft Entra ID tenant. The solution must not require users to register security info if they already have it. Which approach should you use?

A.Use identity protection to enforce MFA for risky sign-ins

B.Assign MFA per user in the Microsoft Entra admin center

C.Create a Conditional Access policy that requires MFA for all users

D.Enable security defaults

AnswerC

Conditional Access can require MFA; existing registered users can use their methods.

Why this answer

A Conditional Access policy can require MFA for all users while respecting existing security info registration. The policy triggers MFA during sign-in but does not force re-registration if the user has already registered. This meets the requirement of not requiring users to register security info if they already have it.

Exam trap

The trap here is that candidates often confuse security defaults (which enforce MFA but force registration) with Conditional Access (which can enforce MFA without forcing re-registration), leading them to choose D instead of C.

How to eliminate wrong answers

Option A is wrong because Identity Protection's risky sign-in policy only enforces MFA when a sign-in is deemed risky, not for all users, so it does not meet the requirement for universal MFA enforcement. Option B is wrong because per-user MFA assignment forces users to register security info if they haven't already, and it does not check for existing registration before prompting, violating the requirement. Option D is wrong because enabling security defaults enforces MFA for all users but also requires all users to register security info, even if they already have it, which contradicts the requirement.

Full explanation →

150

MCQhard

A company invites external partners as B2B guest users in Microsoft Entra ID. The partners' home tenants do not support MFA. The company wants to require MFA when guests access an internal application. What should the company configure?

A.Configure a Conditional Access policy that targets all guest users, require MFA, and enable MFA registration for guests in the resource tenant.

B.Ask the partners to configure MFA in their home tenant, then trust their MFA claims.

C.Use a Per-User MFA policy for guest users, but guests cannot register for MFA in the resource tenant.

D.Create a Conditional Access policy requiring MFA for all external users, but exclude guests from known networks.

AnswerA

A Conditional Access policy in the resource tenant can explicitly target guest users and apply the resource tenant's MFA requirements, independent of the home tenant's capabilities. Because the home tenants do not support MFA, the resource tenant must provide its own registration for guest users, which is enabled through MFA registration settings in the tenant. This ensures each guest can authenticate with methods governed by the resource tenant, fully satisfying the security requirement.

Why this answer

When guest users' home tenants do not support MFA, the resource tenant must enforce MFA directly. A Conditional Access policy targeting all guest users with 'Require MFA' grant control, combined with enabling MFA registration for guests in the resource tenant, allows guests to register and use MFA methods (e.g., Microsoft Authenticator) within the resource tenant. This ensures MFA is enforced regardless of the home tenant's capabilities.

Exam trap

The trap here is that candidates often assume MFA must be handled by the home tenant (Option B) or that legacy Per-User MFA (Option C) works for guests, but Microsoft Entra ID requires Conditional Access policies and resource-tenant MFA registration for guest users when the home tenant cannot provide MFA claims.

How to eliminate wrong answers

Option B is wrong because the partners' home tenants do not support MFA, so asking them to configure MFA is not feasible, and trusting their MFA claims would require the home tenant to issue MFA claims, which it cannot. Option C is wrong because Per-User MFA is a legacy policy that does not support guest user registration in the resource tenant; guests cannot register for MFA via Per-User MFA, making it ineffective. Option D is wrong because excluding guests from known networks does not address the requirement to require MFA; it would actually bypass MFA for guests on known networks, weakening security.

Full explanation →

Microsoft 365 Administrator MS-102 (MS-102) — Questions 76–150