Microsoft 365 Administrator MS-102 MS-102 Questions 151–225 | Page 3/4

151

Multi-Selecthard

Your company is implementing a Microsoft Entra ID Governance solution. You need to ensure that access reviews are performed for all guest users in the Finance department. The review must be conducted by the guest user's manager. Which THREE actions should you take?

Select 3 answers

A.Disable the 'Auto apply results to resource' setting.

B.Create an access review for the dynamic group with scope 'All guest users'.

C.Configure the access review to have reviewers be the guest user's manager.

D.Set the access review to self-review for guest users.

E.Create a dynamic group containing all guest users from the Finance department.

AnswersB, C, E

An access review must be attached to a concrete resource; here, the dynamic group of Finance guest users is that resource. By setting the review scope to 'All guest users', every member of that group is evaluated, regardless of when they were added. This ensures the review covers the exact population the business wants to recertify, rather than a static snapshot or a broader tenant-wide set.

Why this answer

A review of groups with guest members, creation of an access review for all guests in Finance, and assignment of reviewers to managers are required. Setting a self-review is not correct because the requirement is for manager review. Disabling automatic application of results is unnecessary and could prevent enforcement.

Full explanation →

152

Multi-Selecthard

You are planning a Microsoft 365 tenant migration from another tenant. You need to migrate email, OneDrive, and SharePoint content. Which THREE tools or methods can you use to migrate data?

Select 3 answers

A.Microsoft 365 Migration Manager

B.Microsoft Teams admin center

C.Third-party migration tool (e.g., BitTitan MigrationWiz)

D.Exchange Admin Center migration tools

E.PowerShell scripts using Microsoft Graph API

AnswersA, C, E

Supports email, OneDrive, and SharePoint migration.

Why this answer

Microsoft 365 Migration Manager (A) is a native tool in the admin center that supports cross-tenant migrations for Exchange Online, OneDrive, and SharePoint, making it suitable for this scenario. Third-party tools like BitTitan MigrationWiz (C) are widely used for tenant-to-tenant migrations and can handle all three workloads. PowerShell scripts using Microsoft Graph API (E) allow custom migration scripts to migrate email, OneDrive, and SharePoint data, providing flexibility.

Option B (Microsoft Teams admin center) is incorrect because it is for managing Teams settings, not migrating content. Option D (Exchange Admin Center migration tools) is incorrect because those tools are limited to mailbox migrations and do not cover OneDrive or SharePoint.

Exam trap

The trap here is that candidates often assume the Exchange Admin Center migration tools can handle all content types (email, OneDrive, SharePoint) because they are familiar with mailbox migrations, but they fail to recognize that those tools are strictly for Exchange data and do not cover SharePoint or OneDrive content.

Full explanation →

153

MCQmedium

Contoso uses Microsoft Entra ID P1 licenses and has a dedicated corporate office with static public IP addresses. The company wants to require MFA for all users, but exempt users when they connect from the corporate office. Which configuration should the administrator implement?

A.Create a Conditional Access policy that targets all users, grant access requiring MFA, and include the corporate office location as a condition.

B.Create a Conditional Access policy that targets all users, grant access requiring MFA, and exclude the corporate office location from the policy.

C.Configure a Per-User MFA policy and add the corporate office IPs to a list of trusted IPs in the MFA settings.

D.Create a Conditional Access policy that targets the corporate office location and grant access with MFA for all other locations.

AnswerB

Excluding the corporate office location ensures users connecting from those trusted IPs bypass MFA, while everyone else must satisfy the MFA requirement.

Why this answer

A Conditional Access policy can target all users, require MFA as a grant control, and exclude the corporate office location (defined by static public IP addresses as a named location). This ensures MFA is enforced for all connections except those originating from the trusted corporate network, aligning with the requirement to exempt users at the office.

Exam trap

The trap here is that candidates often confuse 'include' and 'exclude' in Conditional Access conditions, mistakenly thinking that including the office location will exempt it, when in fact excluding the location is required to bypass MFA for that trusted network.

How to eliminate wrong answers

Option A is wrong because including the corporate office location as a condition would require MFA even when users connect from the office, which contradicts the exemption requirement. Option C is wrong because Per-User MFA is a legacy, less flexible approach that does not support location-based exemptions via Conditional Access; trusted IPs in MFA settings only bypass MFA for the MFA prompt itself but do not integrate with the granular policy controls of Conditional Access. Option D is wrong because targeting the corporate office location and granting access with MFA for all other locations is syntactically incorrect—Conditional Access policies grant access based on conditions, not by targeting a location to grant MFA elsewhere; the correct approach is to exclude the trusted location from the policy that requires MFA.

Full explanation →

154

MCQeasy

A security administrator wants to ensure that all email attachments are scanned in a sandbox environment and blocked if malicious, with email delivery delayed until scanning completes. Which Microsoft 365 Defender policy should the administrator configure?

A.Safe Links policy

B.Safe Attachments policy

C.Anti-spam policy

D.Anti-phishing policy

AnswerB

Safe Attachments scans email attachments in a virtual sandbox and blocks malicious ones, delaying delivery until analysis is complete.

Why this answer

Safe Attachments policy is the correct choice because it provides sandbox scanning of email attachments. It can be configured to delay email delivery until scanning is complete, blocking malicious attachments. This directly meets the requirement.

Exam trap

The trap here is that candidates often confuse Safe Attachments with Safe Links, assuming both handle attachments, but Safe Links only handles URLs, not file attachments, and the question explicitly requires sandbox scanning of attachments.

How to eliminate wrong answers

Option A is wrong because Safe Links policy protects users from malicious URLs in email messages and Office documents, not from email attachments; it does not perform sandbox scanning of files. Option C is wrong because Anti-spam policy filters inbound and outbound email based on spam, bulk mail, and phishing indicators, but it does not scan attachments in a sandbox environment. Option D is wrong because Anti-phishing policy protects against impersonation and spoofing attacks, not against malicious attachments; it does not include sandbox-based file scanning.

Full explanation →

155

MCQhard

A company has 500 users across Sales, Marketing, and IT departments. User objects are synced from on-premises Active Directory to Microsoft Entra ID using Azure AD Connect. Each department requires different Microsoft 365 license plans (e.g., Sales needs E3, Marketing needs Business Premium, IT needs E5). The administrator wants to automatically assign the appropriate license based on the department attribute without manual intervention. Which approach should the administrator use?

A.Create a script that runs daily to sync department values and assign licenses using PowerShell.

B.Configure group-based licensing using Microsoft Entra dynamic groups with rules based on the department attribute.

C.Use Azure AD Connect to filter objects and assign licenses during sync.

D.Manually assign licenses to each user in the Microsoft 365 admin center.

AnswerB

Dynamic groups in Microsoft Entra ID evaluate membership using a rule on the department attribute, so users are automatically added or removed as their department changes. When combined with group-based licensing, a license is provisioned to every member of the group automatically, and it is removed when a user leaves the group. This approach is the recommended Microsoft solution because it scales to thousands of users without manual steps or custom code, and it integrates with Entra ID's inherent license management.

Why this answer

Microsoft Entra ID supports group-based licensing, which allows automatic license assignment to users based on their membership in dynamic groups. By creating dynamic groups with rules that filter on the department attribute (e.g., 'user.department -eq "Sales"'), the administrator can assign the appropriate license plan (E3, Business Premium, E5) to each group, and licenses are automatically applied or removed as users are added or removed from the group, without any manual or scripted intervention.

Exam trap

The trap here is that candidates may confuse Azure AD Connect's attribute filtering or sync capabilities with license assignment, or assume that a PowerShell script is the only automated method, overlooking the native group-based licensing feature that is designed exactly for this scenario.

How to eliminate wrong answers

Option A is wrong because using a script that runs daily introduces unnecessary complexity, potential delays (up to 24 hours), and administrative overhead; it also does not leverage the built-in, real-time license assignment capabilities of Microsoft Entra ID. Option C is wrong because Azure AD Connect is used for syncing identity objects and attributes, not for assigning licenses; filtering objects during sync controls which users are synced, not how licenses are assigned. Option D is wrong because manually assigning licenses to 500 users across three departments is not scalable, error-prone, and violates the requirement for automatic assignment without manual intervention.

Full explanation →

156

MCQmedium

A company wants to require that all users accessing a critical internal application must be on a compliant device (managed by Intune) and must have authenticated with multi-factor authentication in the last 30 minutes. Which Conditional Access configurations are needed?

A.Grant control 'Require multi-factor authentication' and 'Require device to be marked as compliant' with session control 'Sign-in frequency' set to 30 minutes

B.Grant control 'Require multi-factor authentication' and 'Require device to be marked as compliant' and 'Require all the selected controls'

C.Grant control 'Require multi-factor authentication' and 'Require hybrid Azure AD joined device' with session control 'App enforced restrictions'

D.Grant control 'Block access' for non-compliant devices and separate policy for MFA

AnswerA

This is the correct policy design because the grant controls 'Require multi-factor authentication' and 'Require device to be marked as compliant' are combined with the session control 'Sign-in frequency' set to 30 minutes. In Conditional Access, selecting multiple grant controls defaults to 'Require all the selected controls,' so a user must satisfy both MFA and Intune compliance at access time. The session control then enforces reauthentication for this application every 30 minutes, which forces MFA to be reperformed because the MFA grant is evaluated against the new sign-in event. Together they fully satisfy the requirement: every access attempt must come from a compliant device, and the user's MFA proof must be no older than 30 minutes.

Why this answer

It combines the required grant controls ('Require multi-factor authentication' and 'Require device to be marked as compliant') with the session control 'Sign-in frequency' set to 30 minutes. The sign-in frequency session control enforces reauthentication after the specified time window, ensuring MFA was performed within the last 30 minutes. The grant controls ensure both MFA and device compliance are satisfied simultaneously.

Exam trap

The trap here is that candidates often confuse 'Require all the selected controls' (which is a logical AND operator for grant controls) with session controls, and fail to realize that time-based MFA reauthentication requires a separate session control setting, not just a grant control.

How to eliminate wrong answers

Option B is wrong because it includes 'Require all the selected controls' but omits the session control 'Sign-in frequency', which is necessary to enforce the 30-minute MFA reauthentication window; without it, MFA is only required at initial sign-in. Option C is wrong because it requires a 'hybrid Azure AD joined device' instead of a device 'marked as compliant', and uses 'App enforced restrictions' which does not enforce a 30-minute MFA reauthentication interval. Option D is wrong because using a separate policy for MFA and a 'Block access' policy for non-compliant devices cannot enforce the 30-minute MFA reauthentication requirement; session controls like 'Sign-in frequency' are needed for time-based reauthentication, and blocking non-compliant devices alone does not ensure MFA freshness.

Full explanation →

157

MCQmedium

A compliance officer needs to retain all documents in a SharePoint Online site for 7 years and then automatically delete them. During the retention period, users must be able to edit the documents but not delete them. Which Microsoft Purview solution should the officer configure?

A.retention policy configured with a retention period of 7 years and an action to delete items automatically

B.retention label configured with a retention period and an action to delete after 7 years

C.data lifecycle management policy

D.An eDiscovery hold

AnswerA

A retention policy in Microsoft Purview applies at the container level, such as a SharePoint site or Exchange mailbox, and can be configured with a 7-year retention period followed by automatic deletion of items. This container-based scope ensures all documents in the site are covered without requiring per-item labels or manual classification. During the retention period, content is protected from permanent deletion by users, and after the 7 years the policy triggers an automatic purge, exactly matching the compliance officer's requirement.

Why this answer

A retention policy in Microsoft Purview can be applied at the site level to enforce a 7-year retention period with automatic deletion, while allowing users to edit documents during that time. The policy prevents deletion by users because the retention lock overrides user permissions, ensuring compliance with the requirement to block deletion but permit edits.

Exam trap

The trap here is that candidates confuse retention labels with retention policies, assuming labels can enforce site-wide deletion and edit permissions, but labels are item-level and require manual application or auto-labeling, whereas policies apply broadly and include the necessary deletion prevention.

How to eliminate wrong answers

Option B is wrong because a retention label requires manual or auto-classification and is typically applied to individual items, not an entire site, and it does not inherently prevent user deletion during the retention period unless combined with a retention policy. Option C is wrong because a data lifecycle management policy focuses on managing data across its lifecycle (e.g., archiving or moving to cold storage) but does not enforce a retention period with deletion prevention and automatic deletion in the same way as a retention policy. Option D is wrong because an eDiscovery hold preserves content for legal or investigative purposes but does not automatically delete items after a set period; it is designed for indefinite holds until released, not scheduled deletion.

Full explanation →

158

MCQhard

Your company recently merged with another company that uses Microsoft 365. Both tenants have the same primary domain, contoso.com. You need to merge the two tenants into a single tenant while preserving user email addresses. What should you do?

A.Use cross-tenant collaboration settings to share the domain.

B.Remove the domain from the source tenant and add it to the target tenant, then migrate users.

C.Configure a domain sharing agreement between both tenants.

D.Set up a federation trust between the two tenants.

AnswerB

Correct. Removing the domain from the source tenant and adding it to the target tenant, followed by user migration, merges the tenants while preserving email addresses.

Why this answer

To merge two Microsoft 365 tenants with the same domain, you must remove the domain from the source tenant, add it to the target tenant, and then migrate users' data. This preserves user email addresses because the domain is added to the target tenant before migration. Option B is the correct approach.

Full explanation →

159

MCQmedium

A company uses Azure AD Privileged Identity Management (PIM) to manage role activations. They have an Azure AD Premium P2 license. The security team wants to require that any activation of the Exchange Administrator role must be approved by a specific group named 'Exchange Approvers'. Additionally, activations must require a ticket number and expire after 6 hours. Which PIM configuration should the administrator modify?

A.Configure the 'Role settings' for the Exchange Administrator role to require approval and set the approvers group

B.Add the Exchange Administrator role to the 'Exchange Approvers' group's eligible assignments

C.Create a PIM alert for activations without a ticket number and set a 6-hour alert threshold

D.Define an access review for the Exchange Administrator role with a 6-hour review duration

AnswerA

In Azure AD PIM, role settings for the Exchange Administrator role live under 'Role settings' in PIM. Editing this configuration lets you toggle 'Require approval to activate' and specify one or more approver groups or users; you can also enforce justification and ticket-number fields. Setting the Exchange Approvers group as the approver group ensures that every activation request is first reviewed by the designated approvers before the role becomes active. This is the only option that actually enforces an approval gate at activation time.

Why this answer

In Azure AD PIM, the 'Role settings' for a specific role (like Exchange Administrator) allow you to configure activation requirements, including requiring approval, specifying approvers (such as the 'Exchange Approvers' group), requiring a ticket number, and setting a maximum activation duration (e.g., 6 hours). This directly meets all the security team's requirements.

Exam trap

The trap here is confusing 'eligible assignments' (who can activate a role) with 'approvers' (who must approve activations), leading candidates to incorrectly select Option B.

How to eliminate wrong answers

Option B is wrong because adding the Exchange Administrator role to the 'Exchange Approvers' group's eligible assignments would make members of that group eligible to activate the role, not approve activations of the role. Option C is wrong because PIM alerts can notify about suspicious activities but cannot enforce a ticket number requirement or set a 6-hour activation duration; those are configured in role settings. Option D is wrong because access reviews are for periodic recertification of role assignments, not for controlling activation duration or requiring approval during activation.

Full explanation →

160

Drag & Dropmedium

Drag and drop the steps to configure Microsoft 365 Groups expiration policy in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Groups expiration policy is set in the admin center with a duration, notification owner, and deletion behavior.

Full explanation →

161

MCQmedium

A compliance officer needs to prevent users from copying sensitive data (e.g., credit card numbers) from a finance application into personal email or documents. The solution must inspect the content in real-time and block the action if sensitive data is detected. Which Microsoft Purview feature should the officer configure?

A.Data Loss Prevention (DLP) policies

B.Sensitivity labels

C.Retention labels

D.eDiscovery

AnswerA

DLP policies are the correct choice because they perform real-time content inspection on endpoints and cloud apps, matching against sensitive information types (e.g., credit card numbers, PII) and then enforcing protective actions. A DLP policy can specifically block copy, paste, print, or transfer of that data to unauthorized destinations, and it can also trigger user notifications or incident reports. This is the only option that directly intercepts and prevents user copying actions at the point of resource access.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) policies are designed to inspect content in real-time as users attempt to copy, paste, or share sensitive data (e.g., credit card numbers) from applications like finance apps into personal email or documents. DLP uses deep content analysis via sensitive information types and policy tips to block the action before the data leaves the controlled environment, meeting the compliance officer's requirement for real-time blocking.

Exam trap

The trap here is that candidates often confuse sensitivity labels (which protect data at rest) with DLP policies (which enforce real-time action blocking), leading them to select sensitivity labels because they think labeling alone prevents copying, but labels do not block user actions in real-time.

How to eliminate wrong answers

Option B is wrong because sensitivity labels classify and protect data at rest (e.g., encryption or visual markings) but do not perform real-time content inspection or block copy/paste actions; they require user or automated labeling after data is created. Option C is wrong because retention labels manage data lifecycle (retention and deletion) based on policies, not real-time content inspection or blocking of data exfiltration. Option D is wrong because eDiscovery is used for searching, preserving, and exporting data for legal or investigative purposes, not for preventing data loss in real-time.

Full explanation →

162

MCQeasy

A compliance officer needs to automatically apply a retention label to all documents in SharePoint Online that contain the exact phrase 'Contract'. The label must retain the documents for 10 years. Which Microsoft Purview feature should the officer configure?

A.retention policy applied to the entire site

B.Data Loss Prevention (DLP) policy

C.An auto-apply retention label using a trainable classifier

D.An auto-apply retention label using a content query (KQL)

AnswerD

An auto-apply retention label using a content query (KQL) is the only option that directly satisfies the requirement. In Microsoft Purview, you create an auto-apply retention label policy, select "Apply label to content that matches a query," and enter a KQL expression such as "Contract" to match documents containing that exact phrase. The KQL query runs against the search index, automatically assigns the retention label to matching content, and enforces the configured retention period. This approach is rule-based and deterministic, precisely targeting the literal string "Contract" as specified.

Why this answer

An auto-apply retention label using a content query (KQL) allows you to define a specific keyword or phrase (e.g., 'Contract') to automatically label documents in SharePoint Online that contain that exact text. This meets the requirement to retain documents for 10 years by applying the label based on content matching, without needing a pre-trained classifier.

Exam trap

The trap here is that candidates often confuse auto-apply labels with trainable classifiers, thinking a machine learning model is needed for any content-based labeling, when in fact a simple KQL query is sufficient for exact phrase matching.

How to eliminate wrong answers

Option A is wrong because a retention policy applied to the entire site retains all content in the site, not just documents containing the exact phrase 'Contract', and it does not use a label—it applies retention settings directly without the granularity of label-based auto-application. Option B is wrong because a Data Loss Prevention (DLP) policy is designed to prevent data exfiltration or leakage by blocking or alerting on sensitive content, not to automatically apply retention labels for compliance purposes. Option C is wrong because a trainable classifier uses machine learning to identify patterns or categories (e.g., contracts in general), not an exact phrase match, and requires training and tuning, making it unsuitable for a simple keyword-based requirement.

Full explanation →

163

MCQmedium

A security administrator wants to automatically isolate a device in Microsoft Defender for Endpoint whenever a high-severity alert is triggered. The isolation should occur without manual intervention. Which Microsoft Defender XDR feature should be configured?

A.Attack surface reduction rules

B.Automated investigation and response

C.Threat analytics

D.Vulnerability management

AnswerB

Correct. AIR automates investigation and can take response actions like device isolation based on alert severity.

Why this answer

Automated Investigation and Response (AIR) in Microsoft Defender XDR is designed to automatically respond to threats by running playbooks that can take remediation actions, such as isolating a device, without manual intervention. When a high-severity alert triggers, AIR evaluates the alert and, if configured, executes the isolation action as part of its automated response, meeting the requirement for zero-touch isolation.

Exam trap

The trap here is that candidates often confuse proactive prevention features (like ASR rules) with automated post-breach response capabilities, assuming any security feature that 'blocks' something can also isolate a device automatically.

How to eliminate wrong answers

Option A is wrong because Attack Surface Reduction (ASR) rules are proactive policies that block specific behaviors (e.g., Office apps creating child processes) but do not perform post-breach automated isolation actions. Option C is wrong because Threat Analytics provides intelligence reports on active threats and vulnerabilities but does not execute any automated remediation or device isolation. Option D is wrong because Vulnerability Management identifies and prioritizes software vulnerabilities but lacks the capability to automatically isolate a device in response to an alert.

Full explanation →

164

MCQmedium

An administrator wants to configure automated investigation and response (AIR) in Microsoft 365 Defender so that when a high-severity malware alert is generated for a device from Microsoft Defender for Endpoint, the device is automatically isolated from the network without requiring a security analyst to approve the action. Which configuration step is required?

A.Set the automation level for device isolation to 'Semi - require approval for any remediation'

B.Set the automation level for device isolation to 'Full - remediate threats automatically'

C.Create a custom detection rule that automatically isolates the device

D.Enable 'Automated device isolation' in the Microsoft 365 Defender settings

AnswerB

Full automation means the system automatically takes action (including device isolation) without waiting for approval.

Why this answer

Setting the automation level for device isolation to 'Full - remediate threats automatically' in Microsoft Defender for Endpoint's automated investigation and response (AIR) configuration allows the system to automatically isolate a device when a high-severity malware alert is triggered, without requiring analyst approval. This automation level is specifically designed to execute remediation actions like device isolation immediately based on the alert's severity and the device's risk level.

Exam trap

The trap here is that candidates often confuse the 'Full' automation level with requiring approval for all actions, or they mistakenly think a separate toggle like 'Automated device isolation' exists, when in fact the automation level controls all remediation actions including isolation.

How to eliminate wrong answers

Option A is wrong because 'Semi - require approval for any remediation' means that any remediation action, including device isolation, will wait for a security analyst to manually approve it, which contradicts the requirement for automatic isolation without approval. Option C is wrong because creating a custom detection rule is not the standard or recommended method for configuring automated device isolation; AIR automation levels are the native mechanism to control automatic remediation actions. Option D is wrong because 'Automated device isolation' is not a standalone setting in Microsoft 365 Defender; the correct configuration is done through the automation level settings within the device group's AIR policies.

Full explanation →

165

MCQmedium

An administrator recently added a custom domain 'tailspintoys.com' to their Microsoft 365 tenant and verified it. They now need to configure the domain so that all recipient email addresses for 'info@tailspintoys.com' are delivered to a shared mailbox in Exchange Online. The domain is currently set as internal relay. What should the administrator do first to route email for this domain to Exchange Online?

A.Update the MX record at the DNS registrar to point to Exchange Online

B.Change the domain type from 'Internal relay' to 'Authoritative' in Exchange admin center

C.Create the shared mailbox 'info@tailspintoys.com' in Exchange Online

D.Disable the internal relay option for the domain in the Microsoft 365 admin center

AnswerB

In the Exchange admin center, open Mail flow > Accepted domains, select the tailspintoys.com entry, and set its type to Authoritative. This tells Exchange Online that it is the only authorized mail system for that domain, so it will accept all inbound messages and attempt to deliver them to valid mailboxes in the organization, while generating non-delivery reports for unknown recipients. This is the required first configuration task because neither creating recipients nor updating MX records will make Exchange Online the owner of the address space until the accepted domain type is changed.

Why this answer

When a domain is set to 'Internal relay' in Exchange Online, the service expects to relay messages to an on-premises server for that domain. To have Exchange Online accept and deliver messages directly to a shared mailbox (or any hosted recipient), the domain must be changed to 'Authoritative'. This tells Exchange Online that it is the final destination for all recipients in that domain, enabling local delivery.

Exam trap

The trap here is that candidates often think updating the MX record (Option A) is the first step to route email to Exchange Online, but they overlook that the domain type must be changed to 'Authoritative' first; otherwise, Exchange Online will not deliver messages to cloud recipients even after the MX record is pointed correctly.

How to eliminate wrong answers

Option A is wrong because updating the MX record to point to Exchange Online is necessary for mail flow from the internet, but it does not change how Exchange Online treats the domain internally; if the domain remains 'Internal relay', Exchange Online will still attempt to relay messages for that domain to an on-premises server rather than delivering locally. Option C is wrong because creating the shared mailbox is a subsequent step; the domain must first be set to 'Authoritative' so that Exchange Online recognizes the recipient as local and can deliver to it. Option D is wrong because disabling the internal relay option in the Microsoft 365 admin center is not a valid action; the domain type is configured in the Exchange admin center, not the Microsoft 365 admin center, and simply removing the relay setting does not change the domain to authoritative.

Full explanation →

166

MCQmedium

A security administrator wants to automatically block a file that is detected as malware on one endpoint from being executed on all other endpoints in the organization. Which Microsoft Defender for Endpoint capability provides this?

A.Attack surface reduction rules

B.Network protection

C.Tamper protection

D.Automated investigation and remediation

AnswerD

Automated investigation and remediation (AIR) in Microsoft Defender for Endpoint directly matches the requirement: when malware is detected on one device, AIR automatically performs an investigation, and then can take response actions including blocking the file's hash and containing the threat across the entire organization. By leveraging cloud-based intelligence, AIR can propagate the block to all endpoints before the malware has a chance to spread or re-enter. This is the only option that provides a post-detection, automated, organization-wide file-blocking capability.

Why this answer

Automated investigation and remediation (AIR) in Microsoft Defender for Endpoint is designed to automatically respond to detected threats by containing or blocking malicious files across the organization. When malware is detected on one endpoint, AIR can trigger a remediation action (e.g., blocking the file hash) that is propagated to all other endpoints via the Microsoft Defender security center, preventing execution elsewhere.

Exam trap

The trap here is that candidates often confuse automated investigation and remediation with proactive controls like attack surface reduction rules, but AIR is specifically the reactive, automated response capability that can block a detected file across all endpoints.

How to eliminate wrong answers

Option A is wrong because attack surface reduction rules are proactive policies that reduce exploit entry points (e.g., blocking Office apps from creating child processes), not a reactive mechanism to block a file already detected as malware across endpoints. Option B is wrong because network protection blocks outbound connections to malicious IPs/domains using the Windows Filtering Platform, not the execution of a specific file hash on endpoints. Option C is wrong because tamper protection prevents unauthorized changes to security settings (e.g., disabling real-time protection), but does not automatically block a detected malware file from running on other machines.

Full explanation →

167

MCQmedium

An organization wants to allow users to sign in to Microsoft 365 using their on-premises Active Directory credentials but does not want to synchronize password hashes to the cloud. They also want to eliminate the need for users to re-enter their credentials when accessing cloud resources from domain-joined devices. Which combination of authentication methods should they implement?

A.Pass-through Authentication (PTA) with Seamless Single Sign-On (SSO)

B.Federation with Active Directory Federation Services (AD FS)

C.Password Hash Sync (PHS) with Seamless SSO

D.Cloud-only authentication with MFA

AnswerA

PTA validates passwords on-premises without storing hashes, and Seamless SSO provides automatic sign-in for domain-joined devices.

Why this answer

Pass-through Authentication (PTA) validates user passwords directly against on-premises Active Directory without storing password hashes in the cloud, satisfying the requirement to avoid hash synchronization. Seamless SSO eliminates the need for users to re-enter credentials on domain-joined devices by using Kerberos delegation to silently authenticate against Microsoft Entra ID, meeting both stated needs.

Exam trap

The trap here is that candidates often confuse Seamless SSO as being exclusive to Password Hash Sync, but it is also fully supported with Pass-through Authentication, and the key differentiator is the requirement to avoid password hash synchronization.

How to eliminate wrong answers

Option B (Federation with AD FS) is wrong because it requires deploying and maintaining additional federation infrastructure and does not inherently avoid password hash synchronization; AD FS still relies on password validation against on-premises AD but introduces complexity and potential single points of failure. Option C (PHS with Seamless SSO) is wrong because Password Hash Sync explicitly synchronizes password hashes to the cloud, which the organization wants to avoid. Option D (Cloud-only authentication with MFA) is wrong because it does not use on-premises Active Directory credentials at all, requiring users to have separate cloud identities and failing the requirement to authenticate against on-premises AD.

Full explanation →

168

MCQeasy

An organization wants to prevent users from running executable files from the Windows Temp folder. Which Microsoft Defender for Endpoint capability should be configured?

A.Attack surface reduction rules

B.Network protection

C.Exploit protection

D.Controlled folder access

AnswerA

Attack surface reduction (ASR) rules are a Windows Defender Exploit Guard capability that can specifically block process creation from common temporary folders (such as %Temp% and %AppData%) using a predefined rule like 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' or the explicit temp-folder rule, preventing malware from launching from file paths where droppers commonly execute. ASR rules are client-side, configured via Microsoft Intune, Configuration Manager, or GPO, and operate before the executable is allowed to spawn by intercepting process creation in the kernel and user-mode. This makes ASR the correct choice because it directly restricts executable execution based on file location and reputation, rather than merely restricting network or data access.

Why this answer

Attack surface reduction (ASR) rules are a Microsoft Defender for Endpoint capability that can block executable files from running from specific locations, such as the Windows Temp folder. Rule GUID 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 specifically targets this behavior by preventing executables and scripts from launching from temporary folders. This is the correct capability because ASR rules are designed to reduce the attack surface by controlling common malware entry points and persistence mechanisms.

Exam trap

The trap here is that candidates often confuse Controlled folder access (which protects files from modification) with execution control, or they mistakenly think Network protection can block local file execution because it sounds like a broad security measure.

How to eliminate wrong answers

Option B (Network protection) is wrong because it prevents users from accessing malicious websites or IP addresses, not from running local executable files from a folder. Option C (Exploit protection) is wrong because it applies mitigations to system processes and applications to prevent exploitation of vulnerabilities, such as heap spray or code injection, not to block execution from a specific folder path. Option D (Controlled folder access) is wrong because it protects folders from unauthorized changes by untrusted applications, such as ransomware encryption, but does not block the execution of executables from the Temp folder.

Full explanation →

169

MCQhard

A security administrator wants to block executable files from running from writable system directories such as %TEMP% and %APPDATA% on Windows devices. Which attack surface reduction (ASR) rule should be enabled?

A.Block executable files from running unless they meet a prevalence, age, or trusted list criterion.

B.Block Office communication application from creating child processes.

C.Block credential stealing from the Windows local security authority subsystem (lsass.exe).

D.Block executable content from email client and webmail.

AnswerA

This is the correct Attack Surface Reduction (ASR) rule, GUID 01443614-cd74-433a-b99e-2ecdc07bfc25, which blocks executables that lack sufficient prevalence, age, or a trusted-list entry. It leverages cloud-delivered reputation checks and admin-defined trusted files to stop unknown binaries that commonly execute from writable system directories such as %TEMP%, %APPDATA%, and C:\Users\Public, where persistence mechanisms are often planted. This directly enforces the requirement to block executable files from running from writable system locations while still allowing known legitimate software.

Why this answer

The ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) is designed specifically to block executables (e.g., .exe, .dll, .scr) from running from writable locations like %TEMP% and %APPDATA% unless they have sufficient global prevalence, are older than a certain age, or are on a trusted list. This directly addresses the administrator's requirement to prevent untrusted executables from executing from these directories.

Exam trap

The trap here is that candidates often confuse the 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' rule with the 'Block executable content from email client and webmail' rule, mistakenly thinking the latter covers all executable execution from writable directories when it only applies to email/webmail sources.

How to eliminate wrong answers

Option B is wrong because 'Block Office communication application from creating child processes' targets Microsoft Office communication apps (e.g., Outlook, Teams) from spawning child processes, which is a different attack vector (e.g., script-based attacks), not executable files from writable directories. Option C is wrong because 'Block credential stealing from the Windows local security authority subsystem (lsass.exe)' specifically protects LSASS from credential dumping via tools like Mimikatz, not from executables running in %TEMP% or %APPDATA%. Option D is wrong because 'Block executable content from email client and webmail' prevents executable attachments from being launched from email clients (e.g., Outlook, Gmail), which is a different entry point than local writable system directories.

Full explanation →

170

MCQhard

A security analyst needs to create a custom detection rule in Microsoft 365 Defender that triggers when a suspicious PowerShell process (e.g., using -EncodedCommand) is detected on a device, and within 5 minutes, an outbound network connection to a known malicious IP address occurs. Which two advanced hunting tables must be joined?

A.DeviceProcessEvents and DeviceNetworkEvents

B.DeviceEvents and DeviceFileCertificateInfo

C.IdentityLogonEvents and CloudAppEvents

D.EmailEvents and EmailAttachmentInfo

AnswerA

DeviceProcessEvents records the creation of processes with full command-line arguments, capturing activities such as launching PowerShell or other executables. DeviceNetworkEvents logs network connections to remote endpoints, including destination IPs and ports. By joining these tables on DeviceId within a time window, an analyst can identify a specific process making an outbound connection, which is exactly the pattern needed for this custom detection.

Why this answer

The custom detection rule requires correlating a suspicious PowerShell process event with a subsequent outbound network connection to a malicious IP within a 5-minute window. DeviceProcessEvents contains process creation data (e.g., command line, process name) for detecting encoded PowerShell commands, while DeviceNetworkEvents logs network connections (destination IP, port, protocol). Joining these two tables on DeviceId and a time range allows the rule to identify the sequence of a process event followed by a network event from the same device.

Exam trap

The trap here is that candidates may confuse the purpose of DeviceEvents (which covers broader system events like driver loads or registry changes) with DeviceProcessEvents, or mistakenly think cloud or email tables are relevant to endpoint-based process and network correlation.

How to eliminate wrong answers

Option B is wrong because DeviceEvents and DeviceFileCertificateInfo are used for tracking system-level events (e.g., driver loading, registry changes) and file certificate information, not for correlating process execution with network connections. Option C is wrong because IdentityLogonEvents and CloudAppEvents track user authentication and cloud application activity, not device-level process or network events. Option D is wrong because EmailEvents and EmailAttachmentInfo are focused on email delivery and attachment metadata, which are irrelevant to detecting PowerShell process behavior and outbound network connections on endpoints.

Full explanation →

171

MCQmedium

A company uses Azure AD Conditional Access to enforce MFA for all cloud apps. They have some users who are physically located in countries that are considered high-risk by the security team. The team wants to require device compliance (as defined by Intune) for sign-ins from those specific countries, while still requiring MFA from all other locations. How should the administrator configure the Conditional Access policy?

A.Create two Conditional Access policies: one for the high-risk countries requiring MFA and device compliance, and another for all other locations requiring only MFA

B.Create a single Conditional Access policy that includes both conditions (locations) and grant controls (MFA and device compliance) with an 'OR' operator

C.Use Azure AD Identity Protection to automatically evaluate location risk, and let Conditional Access apply the same policy to all users

D.Configure a single Conditional Access policy with multiple location conditions and multiple grant controls using an 'AND' operator

AnswerA

A Conditional Access policy applies one set of grant controls to all users who match its conditions; it cannot vary those controls (e.g., MFA vs. MFA + device compliance) depending on which location matched. By creating two policies with distinct named locations — one for the specified high-risk countries and one for all other locations (with those countries excluded) — you ensure that users in the high-risk countries only match the first policy and must satisfy both MFA and device compliance, while users elsewhere match only the second policy and are only challenged with MFA. This design respects the logic that each policy is evaluated independently and grants are additive when multiple policies apply.

Why this answer

Conditional Access policies are evaluated independently, and each policy can target specific conditions with distinct grant controls. By creating two separate policies—one for high-risk countries requiring both MFA and device compliance, and another for all other locations requiring only MFA—the administrator can enforce the exact requirements per location group. This approach avoids conflicts and ensures that users in high-risk countries are subject to stricter controls while others are not.

Exam trap

The trap here is that candidates often think a single policy can combine multiple location conditions with an 'AND' operator, but Conditional Access treats multiple locations within one policy as an 'OR' condition, making it impossible to enforce different grant controls for different location groups in one policy.

How to eliminate wrong answers

Option B is wrong because using an 'OR' operator between grant controls (MFA OR device compliance) would allow sign-ins that meet either requirement, not both; the requirement is to enforce both MFA and device compliance for high-risk countries. Option C is wrong because Azure AD Identity Protection evaluates sign-in risk (e.g., anonymous IP, leaked credentials) not geographic location risk; it cannot be used to enforce device compliance based on country. Option D is wrong because a single policy with multiple location conditions using an 'AND' operator would require a user to be in all specified locations simultaneously, which is impossible; Conditional Access evaluates location conditions with an 'OR' logic within a single policy, not 'AND'.

Full explanation →

172

Multi-Selecthard

You are investigating an incident in Microsoft Defender XDR. The incident involves multiple alerts from different sources. Which THREE actions should you take during the investigation?

Select 3 answers

A.Review the incident timeline to understand the sequence of events.

B.Delete all emails related to the incident from all mailboxes.

C.Use advanced hunting to query for related activities across devices and identities.

D.Isolate affected devices from the network using Microsoft Defender for Endpoint.

E.Reset the passwords of all user accounts involved.

AnswersA, C, D

Reviewing the incident timeline is the critical first step in an XDR investigation because it presents a chronological, correlated view of all alerts, user activities, and device events associated with the incident. This lets you reconstruct the attack chain from initial access to lateral movement and data exfiltration, identify which entities are truly affected, and establish what evidence must be preserved. Without this context, any containment or remediation action may be premature or miss the root cause.

Why this answer

Options A, C, and D are correct because during investigation, you should analyze alerts, gather evidence, and isolate affected devices. Option B is wrong because immediately deleting all related emails may destroy evidence. Option E is wrong because resetting passwords should be done after analysis.

Full explanation →

173

MCQmedium

A security administrator wants to monitor and control user downloads from a third-party SaaS application (e.g., Box) in real time. The administrator needs to apply session-level policies to block downloads based on risk. Which Microsoft 365 Defender feature should be used?

A.Cloud Discovery

B.Conditional Access App Control

C.App Connectors

D.Anomaly Detection Policies

AnswerB

Conditional Access App Control is the session-control engine in Microsoft Defender for Cloud Apps, integrated directly with Azure AD Conditional Access. When a user signs in, Azure AD routes the session through the Defender for Cloud Apps reverse proxy, allowing identity-aware policies to inspect the user's actions in real time and enforce constraints such as block download, monitor only, or require protection. This makes it the correct choice for monitoring and controlling user downloads from a third-party SaaS application at the individual session level.

Why this answer

Conditional Access App Control (CAAC) is the correct feature because it enables real-time session-level monitoring and control of user activities within third-party SaaS applications like Box. By integrating with Microsoft Defender for Cloud Apps, CAAC can apply policies to block downloads based on risk signals such as user location, device compliance, or anomalous behavior, all within the user's active session.

Exam trap

The trap here is that candidates often confuse App Connectors (API-based control) with Conditional Access App Control (proxy-based session control), mistakenly thinking API integration can enforce real-time download blocks when it only provides retrospective or policy-based actions on stored data.

How to eliminate wrong answers

Option A is wrong because Cloud Discovery is a tool for identifying shadow IT and assessing cloud app usage from traffic logs, not for applying real-time session-level download controls. Option C is wrong because App Connectors provide API-based visibility and control for data at rest (e.g., file scanning) but cannot enforce session-level policies in real time. Option D is wrong because Anomaly Detection Policies identify suspicious activities after they occur (e.g., impossible travel) and trigger alerts, not block downloads in real time within a session.

Full explanation →

174

Multi-Selectmedium

A compliance officer needs to automatically detect and apply a sensitivity label to documents in SharePoint Online that contain personally identifiable information (PII) such as social security numbers. The label should be applied automatically, and users must be able to override the label with a justification. Which two Microsoft Purview components must be configured to achieve this?

Select 1 answer

A.sensitive info type (SIT) and an auto-labeling policy

B.sensitivity label with auto-labeling for SharePoint and a policy tip

C.data loss prevention (DLP) policy and a retention label

D.default sensitivity label and a compliance tag

AnswersA

Correct. An auto-labeling policy uses SITs to detect PII and applies a sensitivity label. The override with justification is configured in the sensitivity label policy settings.

Why this answer

An auto-labeling policy can scan SharePoint Online for sensitive info types (SITs) like social security numbers and automatically apply a sensitivity label. The policy can be configured to allow users to override the label with a justification via the 'Mandatory labeling with justification' setting in the sensitivity label policy. Option B is incorrect because policy tips are a feature of Data Loss Prevention (DLP) policies, not sensitivity label auto-labeling.

User override with justification is handled by the sensitivity label policy's 'Mandatory labeling' setting, not a policy tip. Therefore, only option A correctly identifies the required components.

Exam trap

Candidates may think that a sensitivity label with auto-labeling for SharePoint and a policy tip work together for override justification. However, policy tips are a DLP feature, not a sensitivity label mechanism. The override with justification is handled by the sensitivity label policy's 'Mandatory labeling' setting.

Full explanation →

175

MCQhard

Your organization has Microsoft 365 E5 licenses and uses Microsoft Defender for Office 365. You need to ensure that users are warned before clicking on malicious URLs in email messages, even if the URL is clicked after the email is delivered. Which policy should you configure?

A.Anti-malware policy

B.Safe Attachments policy

C.Safe Links policy

D.Anti-phishing policy

AnswerC

Safe Links provides time-of-click protection for URLs in email.

Why this answer

Safe Links policy is correct because it provides time-of-click protection, which scans URLs in email messages at the moment the user clicks them, even after delivery. This ensures users are warned or blocked from accessing malicious URLs that may have been benign at the time of delivery but later weaponized. Anti-malware, Safe Attachments, and Anti-phishing policies do not offer this post-delivery click-time verification.

Exam trap

The trap here is that candidates often confuse Safe Attachments (which handles files) with Safe Links (which handles URLs), or assume that Anti-phishing policies cover all link-based threats, but only Safe Links provides the specific time-of-click protection described in the question.

How to eliminate wrong answers

Option A is wrong because Anti-malware policy focuses on detecting and removing malware in email attachments and messages at the time of delivery, not on URL click-time protection. Option B is wrong because Safe Attachments policy specifically handles email attachments by detonating them in a sandbox environment, not URLs embedded in messages. Option D is wrong because Anti-phishing policy protects against impersonation and phishing attempts using spoofing intelligence and impersonation detection, but it does not provide click-time URL scanning or warning for malicious links.

Full explanation →

176

MCQhard

Your company recently deployed Microsoft 365 Copilot. Users report that Copilot occasionally generates responses based on sensitive internal documents that should not be shared broadly. What should you configure to restrict Copilot's access?

A.Create Data Loss Prevention (DLP) policies to block sharing.

B.Remove the sensitive documents from SharePoint Online.

C.Apply sensitivity labels to the documents and configure label scopes to exclude Copilot.

D.Configure Microsoft Search to exclude the sensitive documents.

AnswerC

Sensitivity labels can be scoped to prevent Copilot from using labeled content.

Why this answer

Sensitivity labels can be configured with a label scope that excludes Copilot from accessing the labeled content. By applying a 'Confidential' sensitivity label with the 'Copilot' scope deselected, you instruct Microsoft 365 Copilot to ignore those documents during response generation, preventing it from surfacing sensitive internal information.

Exam trap

The trap here is that candidates confuse DLP policies (which block sharing) with Copilot access controls, or assume that removing documents or excluding them from search is sufficient, when in fact sensitivity labels with the Copilot scope are the precise mechanism to control Copilot’s data access.

How to eliminate wrong answers

Option A is wrong because Data Loss Prevention (DLP) policies block sharing of sensitive data (e.g., via email or external sharing) but do not restrict Copilot’s internal access to documents for response generation. Option B is wrong because removing sensitive documents from SharePoint Online is a blunt, disruptive approach that breaks user access and collaboration, whereas the requirement is to restrict Copilot’s access while preserving normal user access. Option D is wrong because Microsoft Search exclusion controls search results for users but does not affect Copilot’s ability to index and retrieve content for response generation; Copilot uses its own semantic index, not the search index.

Full explanation →

177

MCQeasy

A company has an existing Microsoft 365 tenant with the verified custom domain 'contoso.com'. The administrator now wants to add a second custom domain, 'contoso-europe.com', to the same tenant. What is the first step the administrator should take?

A.Add the domain in the Microsoft 365 admin center.

B.Add a TXT verification record in the public DNS zone for 'contoso-europe.com'.

C.Add an MX record pointing to Exchange Online in the public DNS zone for 'contoso-europe.com'.

D.Contact Microsoft support to enable the domain addition feature.

AnswerA

The domain must first be added to the Microsoft 365 tenant to begin the verification process.

Why this answer

The first step to add a second custom domain to an existing Microsoft 365 tenant is to initiate the domain addition process in the Microsoft 365 admin center. This triggers the system to generate the unique TXT verification record that must be added to the public DNS zone to prove ownership of the domain. Without first adding the domain in the admin center, the administrator would not know the specific verification value required for the DNS record.

Exam trap

The trap here is that candidates often assume the first step is to create a DNS record (like TXT or MX) directly, but the correct sequence requires initiating the domain addition in the admin center first to obtain the necessary verification value.

How to eliminate wrong answers

Option B is wrong because adding a TXT verification record in the public DNS zone is the second step, not the first; the administrator must first add the domain in the admin center to obtain the unique verification string. Option C is wrong because adding an MX record pointing to Exchange Online is a post-verification step used to route email, and it is not required for domain ownership verification. Option D is wrong because Microsoft 365 allows domain addition without contacting support; the feature is enabled by default for all tenants with verified custom domains.

Full explanation →

178

MCQmedium

A company uses Microsoft Entra ID P2 licenses. The security team wants to automatically require a password change for users with medium sign-in risk, but only when the sign-in originates from outside the corporate network. Users with high sign-in risk should be blocked entirely. A group of break-glass accounts must be excluded from all policies. Which feature should the administrator implement?

A.Conditional Access policies with sign-in risk and location conditions

B.Identity Protection risk policies

C.Privileged Identity Management (PIM)

D.Azure AD Identity Governance

AnswerA

Conditional Access policies are the actual enforcement layer for risk-based access controls in Microsoft Entra ID. The sign-in risk condition, calculated in real time by Identity Protection, can be combined with location conditions such as named locations or trusted IPs to require MFA, force a password change, or block access entirely. This is the correct approach because it directly applies risk and geographic context to the authentication request, and your P2 licenses include the required risk detection features.

Why this answer

Conditional Access policies in Microsoft Entra ID allow combining sign-in risk conditions with location conditions (e.g., 'Not trusted IPs' or 'All trusted locations' set to false) to target only sign-ins from outside the corporate network. The policy can be configured to require a password change for medium risk and block access for high risk, while excluding break-glass accounts via the 'Exclude' tab using a dedicated group.

Exam trap

The trap here is that candidates confuse Identity Protection risk policies (which lack location scoping) with Conditional Access policies (which support both risk and location conditions), leading them to select Option B despite its inability to meet the location requirement.

How to eliminate wrong answers

Option B is wrong because Identity Protection risk policies (user risk and sign-in risk policies) operate at the tenant level and cannot be scoped to location conditions like 'outside corporate network'; they apply globally to all sign-ins. Option C is wrong because Privileged Identity Management (PIM) manages just-in-time role activation and approval workflows, not sign-in risk-based access controls or password change requirements. Option D is wrong because Azure AD Identity Governance focuses on access reviews, entitlement management, and lifecycle workflows, not real-time sign-in risk enforcement or location-based conditional access.

Full explanation →

179

Multi-Selectmedium

You are configuring Microsoft Defender for Office 365. Which TWO actions should you take to protect users from phishing attacks that use impersonation?

Select 2 answers

A.Create a data loss prevention (DLP) policy to prevent sharing of credentials.

B.Configure anti-spam policies to increase the spam confidence level.

C.Configure anti-phishing policies to protect users from impersonation of custom domains.

D.Configure anti-phishing policies to protect users from impersonation of internal users.

E.Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams.

AnswersC, D

In Defender for Office 365, an anti-phishing policy's impersonation settings let you specify custom domains to protect, and the service uses heuristics and machine learning to flag messages whose sending domain appears visually or logically similar to that protected domain. This mitigates attacks where an external sender uses a lookalike domain (e.g., typo-squatted or punycode variants) to trick users into thinking the mail originates from your organization. Because this is an identity-based detection, it is the correct policy category for the stated threat.

Why this answer

Options C and D are correct because anti-phishing policies can be configured to protect against impersonation of custom domains and internal users. Option A is wrong because DLP policies prevent sharing of sensitive data, not phishing. Option B is wrong because anti-spam policies handle spam, not impersonation.

Option E is wrong because Safe Attachments scans files for malware, not phishing impersonation.

Full explanation →

180

Matchingmedium

Match each Microsoft 365 role to its administrative scope.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Full access to all admin features

Resets passwords for non-admins

Manages Exchange Online

Manages users and groups

Manages security policies

Why these pairings

These roles are part of Azure AD role-based access control. The correct matches are: Global Administrator (full access), User Administrator (users/groups), Exchange Administrator (Exchange settings). Common confusions include mixing Global and User Administrator scopes, or User and Exchange Administrator scopes.

Full explanation →

181

MCQmedium

Your organization has a Microsoft 365 E5 tenant with 10,000 users. You need to ensure that when a user is detected as high-risk by Microsoft Entra ID Protection, the user is automatically blocked from accessing sensitive SharePoint sites. The solution should minimize administrative overhead. What should you do?

A.Create a Conditional Access policy targeting high-risk users, apply to SharePoint, and set 'Block access' or 'Use app enforced restrictions'.

B.Create a session policy in Microsoft Defender for Cloud Apps to block high-risk users from accessing SharePoint.

C.Configure a user risk policy in Microsoft Entra ID Protection to block sign-ins for high-risk users.

D.Deploy Microsoft Sentinel and create a custom analytics rule to trigger an automated response via Logic App.

AnswerA

Conditional Access policies natively consume Entra ID Protection risk signals. By selecting 'High risk' under User risk and assigning the SharePoint cloud app, you can enforce access controls directly: 'Block access' fully prevents access, while 'Use app enforced restrictions' applies SharePoint's built-in restricted-access user policy. This is the most straightforward, scenario-specific configuration for preventing high-risk users from reaching SharePoint.

Why this answer

A Conditional Access (CA) policy can directly target 'High risk' users (via Microsoft Entra ID Protection risk detection) and apply to SharePoint. By setting the grant control to 'Block access' or 'Use app enforced restrictions', you automatically block or restrict access to sensitive SharePoint sites without manual intervention, minimizing administrative overhead. This integrates natively with Microsoft 365 and requires no additional services or custom scripting.

Exam trap

The trap here is that candidates often confuse a user risk policy in Entra ID Protection (which blocks all sign-ins globally) with a Conditional Access policy (which can target specific applications like SharePoint), leading them to choose Option C instead of A.

How to eliminate wrong answers

Option B is wrong because a session policy in Microsoft Defender for Cloud Apps (MCAS) can only monitor or control access in real time after the user is already authenticated; it does not natively block access based on Entra ID Protection risk level without additional configuration, and it introduces extra overhead. Option C is wrong because a user risk policy in Microsoft Entra ID Protection blocks sign-ins globally (i.e., prevents authentication entirely), which is too broad and would block the user from all applications, not just sensitive SharePoint sites. Option D is wrong because deploying Microsoft Sentinel and creating a custom analytics rule with a Logic App is overly complex and introduces significant administrative overhead, violating the 'minimize administrative overhead' requirement; the native CA policy is simpler and more efficient.

Full explanation →

182

Multi-Selectmedium

You are a Microsoft 365 Administrator for a company that is implementing a hybrid identity solution with Active Directory Federation Services (AD FS) for single sign-on (SSO). The company has recently acquired a subsidiary with its own on-premises Active Directory domain. You need to ensure that the identity lifecycle for users from the subsidiary is managed effectively through Microsoft Entra ID (formerly Azure AD) and that licensing is assigned efficiently. Which three of the following actions should you take? (Choose three.)

Select 3 answers

.Configure Microsoft Entra Connect to synchronize identities from the subsidiary’s Active Directory domain, and use group-based licensing to automatically assign Microsoft 365 licenses to synced users based on their department attribute.

.Create a new Microsoft Entra tenant for the subsidiary and configure cross-tenant synchronization to bring users into the main tenant.

.Use Microsoft Entra Connect to implement a filtered synchronization scope so that only users from the subsidiary’s sales department are synchronized initially.

.Configure Microsoft Entra cloud sync for the subsidiary domain to synchronize users, then assign licenses manually through PowerShell scripts to avoid any inheritance issues.

.Enable Microsoft Entra ID Governance’s Entitlement Management to create access packages that include Microsoft 365 licenses and automatically assign them to users based on their membership in dynamic groups.

.Configure password hash synchronization (PHS) for the subsidiary domain because AD FS cannot coexist with directory synchronization on separate domains.

Why this answer

Options A, C, and E are correct. A: Microsoft Entra Connect can synchronize identities from multiple on-premises AD forests into a single Microsoft Entra tenant, and group-based licensing allows automatic assignment of Microsoft 365 licenses based on directory attributes like department, ensuring efficient lifecycle management. C: Filtered synchronization scope (e.g., using OU or attribute filtering) lets you initially synchronize only a subset of users (like sales) to control the rollout and test the hybrid identity configuration.

E: Microsoft Entra ID Governance’s Entitlement Management can create access packages that include licenses and assign them via dynamic group membership, providing automated, policy-driven license assignment that integrates with identity lifecycle. B is incorrect because creating a separate tenant for the subsidiary would create administrative overhead and fragmentation; cross-tenant synchronization is not needed for multi-forest sync to a single tenant. D is incorrect because Microsoft Entra cloud sync is for simple sync scenarios and does not support AD FS; in a hybrid environment with AD FS, Microsoft Entra Connect is required.

F is incorrect because password hash synchronization is not required to coexist with AD FS; AD FS can be used together with directory synchronization from multiple domains, and PHS is an optional feature.

Exam trap

The trap here is that candidates often assume a separate tenant is required for an acquired subsidiary (Option B) or that cloud sync is equivalent to Entra Connect for AD FS scenarios (Option D), when in fact multi-forest sync with a single tenant and group-based licensing is the recommended approach for hybrid identity lifecycle management.

Full explanation →

183

MCQmedium

An organization is involved in a legal case and needs to preserve all emails in a user's mailbox, including future emails, without deleting or modifying them. The user must continue to work normally. Which Microsoft Purview feature should be applied to the user's mailbox?

A.Litigation Hold

B.Retention policy

C.Sensitivity label

D.Data Loss Prevention (DLP)

AnswerA

Litigation Hold is the correct choice because it preserves all mailbox content in its original state, including items that users edit or delete, by placing the entire mailbox on hold within the Recoverable Items folder. This in-place hold suspends the normal purging of deleted items and version tracking, allowing legal teams to review everything via eDiscovery without disrupting user workflows. Unlike other options, Litigation Hold is specifically designed to meet legal preservation obligations and can be applied to a user's entire mailbox or specific folders.

Why this answer

Litigation Hold (option A) is the correct feature because it preserves all mailbox content, including future emails, in its original state without allowing deletion or modification by users or automated processes. Unlike a retention policy, Litigation Hold places the entire mailbox on indefinite hold, ensuring that any item changed or deleted by the user is retained in the Recoverable Items folder, while the user continues to work normally. This meets the legal preservation requirement without disrupting daily operations.

Exam trap

Microsoft often tests the distinction between Litigation Hold and Retention Policy, where candidates mistakenly choose Retention Policy because they think it 'retains' data, but they miss that Retention Policy can delete data after a period, whereas Litigation Hold preserves everything indefinitely without deletion.

How to eliminate wrong answers

Option B (Retention policy) is wrong because retention policies are designed to manage data lifecycle by deleting or retaining items based on age or rules, not to preserve all content indefinitely for legal hold; they can delete items after a specified period, which violates the preservation requirement. Option C (Sensitivity label) is wrong because sensitivity labels classify and protect data based on sensitivity (e.g., encryption or marking), but they do not prevent deletion or modification of emails, nor do they preserve mailbox content for legal purposes. Option D (Data Loss Prevention (DLP)) is wrong because DLP policies detect and prevent accidental sharing of sensitive information (e.g., credit card numbers) but do not impose holds or preserve mailbox items; they focus on data exfiltration prevention, not legal preservation.

Full explanation →

184

Multi-Selecthard

Which THREE actions can be taken by a Microsoft Purview Data Loss Prevention (DLP) policy in Exchange Online?

Select 3 answers

A.Block the email from being sent

B.Allow the sender to override the block

C.Block all emails from the sender

D.Notify the sender with a policy tip

E.Encrypt the email message

AnswersA, D, E

In Microsoft Purview Data Loss Prevention (DLP), a policy can be configured with an action to block the transmission of an email that contains sensitive information. When the condition is met, the DLP engine can prevent the message from leaving the sender's mailbox, either silently or with a policy tip, depending on the rule configuration. This is a primary enforcement mechanism to stop data exfiltration before it occurs, as the email is never delivered to the recipient.

Why this answer

DLP policies in Exchange Online can block sending, encrypt the message, and notify the sender with a policy tip. Justifying override is not an action; it's a user response. Blocking all emails is not granular; DLP actions are rule-based.

Full explanation →

185

MCQmedium

A security administrator wants to automatically block malicious IP addresses from sending email to Exchange Online mailboxes. Which Microsoft Defender component should be configured?

A.Exchange Online Protection (EOP)

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Identity

D.Microsoft Defender for Cloud Apps

AnswerA

Exchange Online Protection (EOP) is the correct answer because its connection filtering feature evaluates the source IP address of every inbound SMTP connection against Microsoft's default and tenant-specific IP allow/block lists and real-time reputation data. Malicious IPs are rejected at the transport layer before the message is accepted, and admins can explicitly add IPs to the block list in the anti-spam policy to enforce a custom allow/deny set for inbound mail flow.

Why this answer

Exchange Online Protection (EOP) is the cloud-based email filtering service that protects Exchange Online mailboxes from spam, malware, and malicious IP addresses. It includes connection filtering, which can automatically block messages from specified IP addresses by using the default connection filter policy or custom IP Allow/Block lists. This makes EOP the correct component for blocking malicious IPs from sending email to Exchange Online.

Exam trap

The trap here is that candidates may confuse Microsoft Defender for Endpoint (which handles device-level threats) with email security, or assume that Defender for Cloud Apps (a CASB) can filter inbound email, when in fact only EOP provides the connection filtering and IP block list functionality for Exchange Online mail flow.

How to eliminate wrong answers

Option B (Microsoft Defender for Endpoint) is wrong because it focuses on endpoint detection and response (EDR) for devices, not email traffic filtering or IP-based blocking for Exchange Online. Option C (Microsoft Defender for Identity) is wrong because it monitors on-premises Active Directory for identity-based threats (e.g., lateral movement, privilege escalation), not inbound email from IP addresses. Option D (Microsoft Defender for Cloud Apps) is wrong because it provides cloud access security broker (CASB) capabilities for SaaS applications, including shadow IT discovery and app permissions, but does not directly block IP addresses from sending email to Exchange Online.

Full explanation →

186

MCQmedium

You are the Microsoft 365 administrator for a multinational company. The company has deployed Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps. Recently, the security team detected that a user's credentials were compromised and used to access SharePoint Online from an unusual location. You need to investigate the incident and determine the full scope of the breach. The solution must use Microsoft 365 Defender to correlate events. What should you do first?

A.Use the Microsoft Purview compliance portal to search for the user's activity in audit logs.

B.Use advanced hunting in Microsoft 365 Defender portal to query for events related to the user across workloads.

C.Use Microsoft Defender for Cloud Apps to investigate the user's activity log.

D.Use Microsoft Sentinel to query the user's events from the workspace.

AnswerB

Advanced hunting in the Microsoft 365 Defender portal (now Microsoft Defender XDR) is a KQL-based, unified query interface that spans email, identity, endpoints, and cloud apps. It lets you join schema tables such as EmailEvents, IdentityLogonEvents, and CloudAppEvents to correlate a user's actions across a single incident, enabling detection of lateral movement or exfiltration. This is the correct first step because it uses the native, integrated signal of Defender XDR without additional licensing or setup.

Why this answer

Advanced hunting in the Microsoft 365 Defender portal allows you to query raw, cross-workload telemetry (e.g., from Identity, Exchange Online, SharePoint Online, and Defender for Cloud Apps) in a single Kusto Query Language (KQL) query. This is the most efficient first step to correlate events such as sign-ins, mailbox access, file downloads, and app sessions related to the compromised user, enabling you to determine the full scope of the breach across all Microsoft 365 services.

Exam trap

The trap here is that candidates often default to the audit log (Option A) because it is familiar from compliance scenarios, but the question explicitly requires correlation across workloads using Microsoft 365 Defender, which is only possible with advanced hunting's cross-table queries.

How to eliminate wrong answers

Option A is wrong because the Microsoft Purview compliance portal audit log search provides a limited, filtered view of audit records and does not natively correlate events across workloads like Identity, Defender for Cloud Apps, or advanced threat signals; it also lacks the raw telemetry and cross-query capabilities of advanced hunting. Option C is wrong because Microsoft Defender for Cloud Apps activity logs are scoped to cloud app sessions and do not include identity, mailbox, or endpoint events from other Defender workloads, making it insufficient for a full cross-workload investigation. Option D is wrong because Microsoft Sentinel is a separate SIEM that requires additional licensing, configuration, and data ingestion from Microsoft 365 Defender; it is not the first tool to use when the goal is to correlate events within the Microsoft 365 Defender portal itself.

Full explanation →

187

MCQmedium

A compliance officer needs to prevent users from accidentally sharing documents containing credit card numbers with external users via email. The block should occur at the time the user attempts to send the email. Which Microsoft Purview feature should be configured?

A.Communication compliance

B.Data Loss Prevention (DLP)

C.Records management

D.Insider risk management

AnswerB

Data Loss Prevention (DLP) policies in Microsoft 365 enforce real-time protection by inspecting email messages for sensitive info types (e.g., credit card numbers, Social Security numbers) and applying actions such as blocking the message from leaving the organization, with optional user override and notification. These policies are integrated with Exchange Online transport rules, allowing them to evaluate outbound mail before delivery. DLP is the correct choice because it directly addresses the requirement to prevent accidental sharing through proactive, policy-based blocking.

Why this answer

Data Loss Prevention (DLP) is the correct feature because it is specifically designed to inspect email content in transit for sensitive data patterns, such as credit card numbers, and enforce policy actions like blocking the message at the transport layer. In Microsoft Purview, DLP policies can be configured to scan Exchange Online messages in real time using sensitive information types (e.g., Credit Card Number) and apply a block action with an optional policy tip to the user before the email leaves the outbound queue.

Exam trap

The trap here is that candidates often confuse Communication compliance (which also monitors email) with DLP, but Communication compliance is a reactive auditing tool for policy violations, not a proactive, inline blocking mechanism for sensitive data.

How to eliminate wrong answers

Option A is wrong because Communication compliance is designed to detect and remediate inappropriate or policy-violating communications (e.g., harassment, insider trading) after they are sent, not to block outbound emails containing sensitive data in real time. Option C is wrong because Records management focuses on classifying, retaining, and disposing of records based on regulatory requirements, not on inspecting or blocking email content during transmission. Option D is wrong because Insider risk management uses analytics to identify risky user activities (e.g., data exfiltration patterns) over time, but it does not provide inline blocking of email messages at the moment of sending.

Full explanation →

188

MCQeasy

You are planning a Microsoft 365 tenant migration from an on-premises Exchange environment. You need to minimize the impact on end users during the migration. Which migration approach should you use?

A.Perform a staged migration to move mailboxes in batches.

B.Deploy a hybrid Exchange configuration.

C.Perform a cutover migration to move all mailboxes at once.

D.Use an IMAP migration to migrate only email data.

AnswerA

Staged migration moves users in batches, minimizing impact.

Why this answer

A staged migration allows you to move mailboxes in batches, which minimizes end-user disruption by spreading the migration workload over time and enabling you to test and validate each batch before proceeding. This approach is ideal for organizations with many mailboxes that need to maintain continuity, as users in later batches remain fully functional in the on-premises environment until their turn.

Exam trap

The trap here is that candidates often confuse 'hybrid configuration' as a migration method rather than a coexistence state, or they assume 'cutover' is faster and thus less impactful, when in reality it causes the most disruption due to the all-at-once cutover.

How to eliminate wrong answers

Option B is wrong because deploying a hybrid Exchange configuration is not a migration method itself; it establishes coexistence between on-premises and Exchange Online, which can be used with other migration types but adds complexity and is unnecessary if the goal is simply to minimize user impact during a full migration. Option C is wrong because a cutover migration moves all mailboxes at once, which causes a hard cutover with potential downtime and user disruption, making it unsuitable for minimizing impact. Option D is wrong because an IMAP migration only migrates email data (not calendar, contacts, or tasks) and does not support mailbox batching, leading to a less seamless user experience and missing critical mailbox items.

Full explanation →

189

MCQmedium

A compliance officer needs to prevent users from sharing documents labeled 'Confidential' via email with external recipients. If a user attempts to send such an email, the action should be blocked and a policy tip displayed. Which Microsoft Purview feature should be configured?

A.Retention labels

B.Data Loss Prevention (DLP) policy

C.Sensitivity labels

D.Information barriers

AnswerB

DLP policies are the correct control because they inspect message content and context in transit and can match sensitive information types or sensitivity labels. With a rule, DLP can block or warn when email is shared with external users, and can even block the send action entirely while allowing an override with justification. This makes DLP the only option that directly enforces a sharing restriction based on content classification.

Why this answer

A Data Loss Prevention (DLP) policy is the correct Microsoft Purview feature because it is specifically designed to inspect email content and attachments for sensitive information, such as documents labeled 'Confidential', and enforce actions like blocking the email and displaying a policy tip to the user. DLP policies can be configured with conditions that detect sensitivity labels and apply protective actions, including blocking external sharing and notifying users via policy tips.

Exam trap

Microsoft often tests the misconception that sensitivity labels alone can enforce blocking actions, but in reality, sensitivity labels only apply classification and protection (e.g., encryption) and must be combined with a DLP policy to inspect and block outbound email based on those labels.

How to eliminate wrong answers

Option A is wrong because retention labels are used to manage data lifecycle (retain or delete content) and do not have the capability to block email transmission or display policy tips. Option C is wrong because sensitivity labels classify and protect data (e.g., encryption, marking) but do not directly enforce real-time blocking of email sharing with external recipients; DLP policies are required to inspect and block outbound email based on those labels. Option D is wrong because information barriers restrict communication and collaboration between specific groups of users within an organization, not between internal and external recipients, and cannot block email based on document labels or display policy tips.

Full explanation →

190

Matchingmedium

Match each Microsoft 365 service to its primary purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Email and calendar

Document management and collaboration

Chat, meetings, and collaboration

Personal cloud storage

Enterprise social networking

Why these pairings

The correct matches associate Exchange Online with email and calendaring, SharePoint Online with document management and collaboration, Microsoft Teams with chat and meetings, and OneDrive for Business with personal cloud storage. Common confusions include misassigning Exchange's purpose to OneDrive or OneDrive's purpose to SharePoint.

Full explanation →

191

MCQeasy

A company wants to use Azure AD Identity Protection features such as user risk policies and sign-in risk policies to automatically respond to risky behavior. Which Azure AD license is required to enable these capabilities?

A.Azure AD Free

B.Azure AD Premium P1

C.Azure AD Premium P2

D.Microsoft 365 E3

AnswerC

Azure AD Premium P2 is the correct license because it includes Identity Protection, which continuously analyzes user and sign-in risk, and adds risk conditions to Conditional Access so you can enforce policies such as requiring a password change when user risk is high. Along with Privileged Identity Management and entitlement management, P2 gives you both the detection and the automated remediation capabilities. This is the only Azure AD edition listed that supports user-risk-based policies natively.

Why this answer

Azure AD Identity Protection features like user risk policies and sign-in risk policies require Azure AD Premium P2. This is because P2 includes Identity Protection, which provides risk-based conditional access policies that automatically respond to detected risks. Azure AD Premium P1 supports Conditional Access but lacks the risk detection and automated remediation capabilities of Identity Protection.

Exam trap

The trap here is that candidates often confuse Azure AD Premium P1 with P2, assuming Conditional Access alone enables risk policies, but P1 lacks the risk detection engine (Identity Protection) required for automated risk-based responses.

How to eliminate wrong answers

Option A is wrong because Azure AD Free provides no Conditional Access or Identity Protection capabilities, only basic directory services. Option B is wrong because Azure AD Premium P1 includes Conditional Access but not Identity Protection; it cannot evaluate user or sign-in risk levels or enforce risk-based policies. Option D is wrong because Microsoft 365 E3 includes Azure AD Premium P1, not P2, and therefore lacks Identity Protection features such as risk policies.

Full explanation →

192

MCQeasy

A company has purchased 1000 Microsoft 365 E5 licenses and wants to automatically assign licenses to users based on their department attribute, which is synchronized from on-premises Active Directory. The department attribute is stored in Azure AD. Which automated method should the administrator use to achieve this?

A.Group-based licensing with dynamic groups

B.scheduled PowerShell script that runs daily

C.Manual license assignment via the Microsoft 365 admin center

D.Bulk assign licenses using the admin center import feature

AnswerA

Dynamic groups in Azure AD use membership rules based on user attributes such as department or location. When a user satisfies the rule, they are automatically added to the group, and licenses assigned to the group are provisioned to that user without manual intervention. If the user no longer meets the rule, they are removed and the license is automatically revoked. This built-in, identity-driven approach scales effortlessly to 1000 users and handles future changes in membership automatically.

Why this answer

Group-based licensing with dynamic groups is the correct method because it allows automatic license assignment based on user attributes like department, which is synchronized from on-premises Active Directory via Azure AD Connect. Dynamic groups evaluate membership rules in Azure AD, and when a user's department attribute matches the rule, the group-based licensing policy automatically assigns or removes the Microsoft 365 E5 license without manual intervention.

Exam trap

The trap here is that candidates often choose a scheduled PowerShell script (Option B) thinking it is more flexible or reliable, but they overlook that group-based licensing is the native, fully automated, and supported method for attribute-driven license assignment in Azure AD.

How to eliminate wrong answers

Option B is wrong because a scheduled PowerShell script that runs daily introduces latency (up to 24 hours) and requires ongoing maintenance, whereas group-based licensing provides near-real-time assignment and revocation. Option C is wrong because manual license assignment via the Microsoft 365 admin center is not automated and does not scale to 1000 users based on a dynamic attribute. Option D is wrong because bulk assign licenses using the admin center import feature is a one-time, static assignment based on a CSV file, not an automated method that responds to changes in the department attribute.

Full explanation →

193

Multi-Selectmedium

A compliance administrator needs to automatically apply a retention label to documents in a SharePoint Online site that contain the keyword 'Project Alpha'. The label should retain the documents for 5 years and then delete them. Which two Microsoft Purview features must be configured to achieve this? (Choose two.)

Select 2 answers

A.Trainable classifiers

B.Auto-labeling policy for SharePoint Online

C.Document Fingerprinting

D.Sensitive info type with a keyword dictionary (e.g., 'Project Alpha')

AnswersB, D

Auto-labeling policy for SharePoint Online is the correct feature because it uses conditions (like sensitive info types or trainable classifiers) to automatically apply a retention label to matching documents. To satisfy the requirement, you configure the policy with a sensitive info type that includes a keyword dictionary for 'Project Alpha', and assign the 2-year retention label. This policy runs continuously and can target all or specific SharePoint sites, providing the required automatic labeling.

Why this answer

An auto-labeling policy for SharePoint Online (option B) is required because it can automatically apply a retention label to documents based on conditions such as the presence of specific keywords. The sensitive info type with a keyword dictionary (option D) defines the condition by creating a custom sensitive information type that matches the exact phrase 'Project Alpha', which the auto-labeling policy then uses to trigger the label application.

Exam trap

The trap here is that candidates often confuse trainable classifiers with keyword-based sensitive info types, assuming machine learning is needed for any content detection, when in fact a simple keyword dictionary is sufficient and more appropriate for fixed terms.

Full explanation →

194

MCQeasy

A company has just signed up for Microsoft 365 Business Standard without adding a custom domain. An administrator needs to create the first user accounts. What will be the default email address format for these new users?

A.username@contoso.com

B.username@onmicrosoft.com

C.username@<tenantname>.onmicrosoft.com

D.username@microsoftonline.com

AnswerC

When the tenant is provisioned, Microsoft creates a unique initial domain in the format <tenantname>.onmicrosoft.com, which is automatically registered and verified. New users are assigned the user principal name and email address using this domain by default, because no custom domains have been added yet. This domain remains the default until a custom domain is added and set as primary. Therefore, username@<tenantname>.onmicrosoft.com is the correct email suffix after signing up for Microsoft 365 Business Standard.

Why this answer

When a Microsoft 365 tenant is created without adding a custom domain, the default domain is the `<tenantname>.onmicrosoft.com` domain. New user accounts are automatically assigned an email address in the format `username@<tenantname>.onmicrosoft.com`, as this is the initial domain provisioned for the tenant. Option C correctly reflects this default behavior.

Exam trap

The trap here is that candidates often confuse the default `onmicrosoft.com` domain with the generic `microsoftonline.com` domain used for Azure AD authentication, or assume a custom domain like `contoso.com` is automatically assigned, leading them to select A or D instead of recognizing the tenant-specific subdomain format.

How to eliminate wrong answers

Option A is wrong because `contoso.com` is a custom domain that must be explicitly added and verified in the tenant; it is not the default domain when no custom domain is configured. Option B is wrong because `onmicrosoft.com` is a Microsoft-owned domain used for services like Outlook, but the tenant-specific subdomain (e.g., `contoso.onmicrosoft.com`) is required; a bare `@onmicrosoft.com` address is not valid for a tenant. Option D is wrong because `microsoftonline.com` is the domain used for Azure AD authentication endpoints (e.g., login.microsoftonline.com), not for user email addresses.

Full explanation →

195

MCQmedium

A company uses Azure AD Identity Protection. The security team wants to automatically block users from signing in when the user risk level is 'High'. Which policy should they configure?

A.Conditional Access policy with user risk condition

B.Sign-in risk policy

C.User risk policy

D.MFA registration policy

AnswerC

The User risk policy in Microsoft Entra ID Protection allows you to automatically respond when the system detects that a user account is likely compromised—based on signals such as leaked credentials, password spray, or anomalous user behavior—and is rated with a user risk level of High. It can be configured to 'Block access' directly at the policy level, providing the exact mechanism needed for this scenario. Separately, it can also require a secure password change or MFA, but with the condition 'User risk High' and the control 'Block access', it matches the required behavior precisely.

Why this answer

The User risk policy in Azure AD Identity Protection is specifically designed to automatically block sign-ins when the user risk level is 'High'. This policy evaluates the probability that a user's identity has been compromised based on signals like leaked credentials or anomalous behavior, and can enforce actions such as blocking access or requiring password change. Option C is correct because it directly targets user risk, not sign-in risk or other conditions.

Exam trap

The trap here is that candidates often confuse the User risk policy with the Sign-in risk policy, or think a Conditional Access policy with user risk condition is the only way to block based on user risk, but the exam expects the dedicated Identity Protection policy as the direct answer.

How to eliminate wrong answers

Option A is wrong because a Conditional Access policy with a user risk condition can also block sign-ins based on user risk, but the question asks for the specific policy to configure in Identity Protection, and the User risk policy is the dedicated, simpler policy for this purpose without requiring additional Conditional Access configuration. Option B is wrong because the Sign-in risk policy targets the risk level of individual sign-in sessions (e.g., anonymous IP, atypical travel), not the overall user risk level. Option D is wrong because the MFA registration policy enforces registration for Azure AD Multi-Factor Authentication, not blocking sign-ins based on user risk.

Full explanation →

196

MCQmedium

A company wants to automatically assign Microsoft 365 E5 licenses to all users in the Sales department. The department is identified by the department attribute in Microsoft Entra ID. The administrator needs to configure a method where licenses are assigned based on group membership, and the group membership is automatically updated based on user attributes. Which licensing approach should the administrator use?

A.Per-user licensing with a PowerShell script.

B.Group-based licensing with a dynamic group that uses the department attribute.

C.Subscription-based licensing via the Microsoft 365 admin center.

D.Group-based licensing with an assigned group that must be manually updated.

AnswerB

With Azure AD group-based licensing, you can attach Microsoft 365 E5 licenses to a dynamic security group whose membership rule is based on the department attribute. When a user's department changes, Azure AD automatically updates group membership and then applies or removes the E5 license without manual scripting. This directly satisfies the requirement for automatic license assignment to all users in a given department.

Why this answer

Group-based licensing in Microsoft Entra ID allows automatic license assignment based on group membership, and a dynamic group can automatically update its membership using the department attribute rule (e.g., `user.department -eq "Sales"`). This meets the requirement for both automated license assignment and attribute-driven membership updates without manual intervention.

Exam trap

The trap here is that candidates may confuse group-based licensing with assigned groups (Option D) and overlook the dynamic group requirement, assuming any group-based licensing approach automatically updates membership, when in fact only dynamic groups provide attribute-driven automatic membership updates.

How to eliminate wrong answers

Option A is wrong because per-user licensing with a PowerShell script requires manual execution or scheduled automation, and does not provide real-time, attribute-driven automatic membership updates; it also lacks the native integration of group-based licensing. Option C is wrong because subscription-based licensing via the Microsoft 365 admin center refers to managing subscription quantities, not assigning licenses to individual users based on attributes or group membership. Option D is wrong because group-based licensing with an assigned group requires manual updates to group membership, which contradicts the requirement for automatic membership updates based on the department attribute.

Full explanation →

197

MCQeasy

Your company, Northwind Traders, uses Microsoft Entra ID P1. You need to allow employees to reset their own passwords without help desk intervention. The company policy requires that password resets be secured with two verification methods. Additionally, users must not be able to reuse the last 10 passwords. The solution must minimize administrative effort. What should you configure?

A.Enable Microsoft Entra self-service password reset (SSPR) and configure the number of methods required to reset to 2, and set password history to enforce last 10 passwords

B.Enable Privileged Identity Management (PIM) for all users

C.Enable Microsoft Entra password protection and configure password history in the on-premises policy

D.Configure a conditional access policy to require MFA during password change

AnswerA

SSPR provides self-service reset with configurable verification and history.

Why this answer

Microsoft Entra self-service password reset (SSPR) allows users to reset their own passwords without help desk intervention. By configuring the number of methods required to reset to 2, you meet the two-verification-method policy requirement. Setting the password history to enforce the last 10 passwords prevents reuse, and since SSPR is a cloud-native feature, it minimizes administrative effort by avoiding on-premises dependencies.

Exam trap

The trap here is confusing SSPR with conditional access policies or PIM, as candidates often think MFA enforcement or privileged role management can substitute for the dedicated self-service password reset feature, but only SSPR provides the combined verification method count and password history controls required by the scenario.

How to eliminate wrong answers

Option B is wrong because Privileged Identity Management (PIM) is designed for just-in-time privileged role activation and access reviews, not for enabling self-service password resets for all users. Option C is wrong because Microsoft Entra password protection focuses on banning weak passwords and custom terms, not on password history enforcement; password history for cloud-only users is managed via SSPR settings, not on-premises policy. Option D is wrong because a conditional access policy requiring MFA during password change does not enable self-service password reset; it only enforces additional authentication during a change event, and it does not address password history reuse restrictions.

Full explanation →

198

MCQmedium

A security administrator wants to configure Automated Investigation and Response (AIR) in Microsoft 365 Defender to automatically isolate a device when a high-severity alert for malware is detected. Which step is required?

A.A: Create an automation rule in Microsoft Sentinel.

B.B: Create a custom detection rule in advanced hunting.

C.C: Configure the device to be part of a device group and enable automation level.

D.D: Enable auto-removal of malware from devices.

AnswerC

To actually turn on AIR, you place the device into a device group in Microsoft 365 Defender (under Endpoints > Device groups) and select an automation level such as 'Full - remediate threats automatically' or 'Automatic - investigate threats automatically.' The device group's automation level decides whether AIR runs automatically and what actions (isolation, file removal, etc.) can be taken without approval. Without a proper device group with the desired automation level, AIR's automatic actions remain disabled or require manual approval.

Why this answer

To enable Automated Investigation and Response (AIR) in Microsoft Defender for Endpoint, the device must be added to a device group, and the automation level for that group must be set to 'Full – remediate threats automatically' or a similar level. This configuration allows Defender to automatically isolate a device when a high-severity malware alert is triggered, as part of the built-in AIR playbooks.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel automation rules (which are for cross-source orchestration) with the device group automation settings in Microsoft Defender for Endpoint, leading them to pick Option A instead of the correct device group configuration.

How to eliminate wrong answers

Option A is wrong because Microsoft Sentinel automation rules are used for orchestration and response across multiple data sources, not for configuring device-level automated isolation in Microsoft Defender for Endpoint. Option B is wrong because custom detection rules in advanced hunting are for creating custom alerts based on KQL queries, not for enabling automated response actions like device isolation. Option D is wrong because 'auto-removal of malware' is not a configurable setting in Defender for Endpoint; remediation actions are controlled via automation levels and device groups, not a separate toggle.

Full explanation →

199

MCQhard

An organization with Microsoft Entra ID P2 licenses needs to enforce that all users accessing the Azure portal must use FIDO2 security keys for multi-factor authentication. Which configuration should be implemented?

A.Create a Conditional Access policy that requires MFA and select FIDO2 as the authentication strength in the grant controls

B.Create a Conditional Access policy that requires MFA and set the grant control to require a specific device platform

C.Configure an authentication strength policy that requires FIDO2 and assign it to a Conditional Access policy

D.Configure an authentication methods policy that allows only FIDO2 security keys

AnswerC

This is correct because Microsoft Entra ID authentication strengths let you define exactly which authentication methods are acceptable for a sign-in. To require FIDO2 security keys, you create a custom authentication strength that includes only the FIDO2 security key method, then assign that strength to a Conditional Access policy's 'Require authentication strength' grant control. This enforces the method at sign-in time, ensuring that users must authenticate with a FIDO2 security key to access the protected resource.

Why this answer

In Microsoft Entra ID, authentication strengths allow you to define a specific set of authentication methods (e.g., FIDO2 security keys) and then assign that strength to a Conditional Access policy. This ensures that only FIDO2 security keys are accepted for MFA when accessing the Azure portal, meeting the requirement precisely.

Exam trap

The trap here is that candidates often confuse the direct selection of an authentication method in Conditional Access grant controls with the correct two-step process of first defining an authentication strength policy and then assigning it to a Conditional Access policy.

How to eliminate wrong answers

Option A is wrong because selecting FIDO2 as the authentication strength in the grant controls of a Conditional Access policy is not a valid configuration; authentication strengths are defined separately and then referenced by the policy, not selected directly in grant controls. Option B is wrong because requiring a specific device platform (e.g., Windows) does not enforce the use of FIDO2 security keys; it only restricts the device type, not the authentication method. Option D is wrong because configuring an authentication methods policy to allow only FIDO2 security keys would block all other methods globally, but it does not integrate with Conditional Access to target specific apps like the Azure portal; it applies to all sign-ins, which is too broad and not the intended enforcement mechanism.

Full explanation →

200

MCQeasy

A compliance officer needs to ensure that any email sent from the organization that contains personally identifiable information (PII) such as social security numbers is automatically encrypted when the recipient is outside the organization. Which Microsoft Purview solution should the officer configure?

A.Sensitivity labels with auto-labeling

B.Data Loss Prevention (DLP) policy with encryption action

C.Office 365 Message Encryption (OME) configuration

D.Retention policy and labels

AnswerB

Microsoft Purview DLP policies are the correct solution because they operate on outbound email in transit within Exchange Online, scanning message body and attachments for sensitive data types. When a match occurs, the policy can automatically apply encryption as a protective action (via OME) and even show a policy tip or notify the sender, exactly meeting the requirement to ensure any email containing sensitive data is secured at send.

Why this answer

A Data Loss Prevention (DLP) policy in Microsoft Purview can be configured with an 'Encrypt email messages' action that automatically applies Office 365 Message Encryption (OME) to emails containing sensitive information types (e.g., Social Security Number) when sent to external recipients. This meets the compliance requirement for automatic encryption based on content detection, without requiring user intervention or manual label application.

Exam trap

The trap here is that candidates confuse the underlying encryption technology (OME) with the policy that triggers it, leading them to select OME configuration (Option C) instead of the DLP policy that actually detects PII and enforces the encryption action.

How to eliminate wrong answers

Option A is wrong because sensitivity labels with auto-labeling can apply classification and protection, but they are designed for persistent labeling across documents and emails, not specifically to trigger encryption based on PII detection at the point of sending; auto-labeling for emails requires Exchange mail flow rules or DLP policies to enforce encryption. Option C is wrong because Office 365 Message Encryption (OME) is the underlying encryption technology, not a policy or configuration that automatically detects PII and triggers encryption; OME must be invoked by a DLP policy or mail flow rule. Option D is wrong because retention policies and labels manage data lifecycle and deletion, not real-time content inspection or encryption of outbound emails.

Full explanation →

201

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a custom Line-of-Business (LOB) app to a group of devices. The app is not in the Microsoft Store. What is the recommended method to deploy the app?

A.Add the app as a Microsoft Store app (business) in Intune.

B.Use Group Policy to deploy the app via a network share.

C.Publish the app to the Microsoft Store for Business and assign it.

D.Upload the app package to Intune as a Line-of-Business app and assign it to the device group.

AnswerD

Upload the app package to Intune as a Line-of-Business app and assign it to the device group. This is the standard Intune method for side-loading a custom internal application: you navigate to Apps > All Apps > Add, choose the 'Line-of-business app' type, upload the MSI or APPX installable package, and then configure the assignment as Required to an Azure AD device group. Intune stores the package in Azure and handles download and installation on each enrolled Windows 10 device, making it the correct native deployment mechanism for a custom LOB application.

Why this answer

Intune natively supports deploying custom Line-of-Business (LOB) apps by uploading the app package (e.g., .msi, .exe, .appx) directly into the Intune console and assigning it to a device group. This method is the recommended approach for apps not available in the Microsoft Store, as it leverages Intune's mobile device management (MDM) capabilities to push the app to Windows 10 devices without requiring external infrastructure like Group Policy or the Microsoft Store for Business.

Exam trap

The trap here is that candidates may confuse the Microsoft Store for Business (now Microsoft Store) as a viable publishing platform for custom LOB apps, not realizing that the store only accepts apps that meet Microsoft's submission requirements and is not designed for internal, proprietary applications.

How to eliminate wrong answers

Option A is wrong because adding the app as a Microsoft Store app (business) in Intune is intended for apps that are already available in the Microsoft Store for Business, not for custom LOB apps that are not in the store. Option B is wrong because Group Policy deployment via a network share is a traditional on-premises method that does not integrate with Intune's cloud-based MDM, and it requires devices to be domain-joined and connected to the corporate network, which is not recommended for modern, cloud-managed environments. Option C is wrong because publishing a custom LOB app to the Microsoft Store for Business is not supported; the store only accepts apps that meet specific submission criteria and are not intended for internal, proprietary line-of-business applications.

Full explanation →

202

MCQmedium

A junior administrator needs permission to view sign-in logs, audit logs, and security recommendations in the Microsoft Entra admin center, but must not be able to reset passwords, modify settings, or manage roles. Which built-in Microsoft Entra role should the administrator assign?

A.Global Reader

B.Security Reader

C.Reports Reader

D.Security Administrator

AnswerB

Security Reader is the correct built-in role because it provides read-only access to security-related signals, including Entra ID sign-in logs, audit logs, and identity risk events. It does not allow any modification of security settings or password resets, so the junior administrator can inspect sign-in activity while remaining unable to alter configurations. This aligns precisely with the least-privilege principle for a view-only task.

Why this answer

The Security Reader role grants read-only access to security-related data, including sign-in logs, audit logs, and security recommendations, without permitting any write operations such as password resets, setting modifications, or role management. This aligns precisely with the junior administrator's required permissions.

Exam trap

The trap here is that candidates often confuse the Security Reader role with the Security Administrator role, mistakenly assuming that viewing security recommendations requires write permissions, or they overlook the legacy Reports Reader role which does not cover all required log types.

How to eliminate wrong answers

Option A is wrong because the Global Reader role provides read-only access to all aspects of Microsoft Entra ID, including settings and configurations, which is broader than the required scope and could inadvertently expose sensitive configuration data. Option C is wrong because the Reports Reader role is a legacy role that only allows viewing reports in the Azure portal, not the full set of sign-in logs, audit logs, and security recommendations in the Microsoft Entra admin center. Option D is wrong because the Security Administrator role has write permissions that include the ability to modify security policies, reset passwords, and manage roles, which exceeds the junior administrator's required restrictions.

Full explanation →

203

MCQmedium

A legal department needs to preserve all communications related to an ongoing lawsuit. They identify specific users and require that their mailbox items and OneDrive files are not altered or deleted. Which Microsoft Purview feature should be used?

A.Litigation Hold

B.Retention Policy

C.Data Loss Prevention (DLP)

D.eDiscovery

AnswerA

Litigation Hold is the correct mechanism because it places a preservation hold on an entire mailbox and OneDrive for Business site in-place, preventing items from being permanently deleted or altered. Every version of a document and every mailbox item, including deleted items and items edited by users, is retained in the Recoverable Items folder until the hold is released. Deletion by users, as well as cleanup by retention policies, is blocked for held content, ensuring all communications related to the legal matter remain discoverable in their original location.

Why this answer

Litigation Hold is the correct feature because it preserves all mailbox items and OneDrive files for specific users in their current state, preventing any alteration or deletion by users or automated processes. This is essential for legal holds where data must be immutable for eDiscovery purposes, and it applies at the user level rather than broadly across the organization.

Exam trap

The trap here is that candidates often confuse retention policies with litigation holds, thinking retention policies can preserve data indefinitely, but retention policies allow deletion after the retention period and do not block user-initiated edits or deletions during the policy's active duration.

How to eliminate wrong answers

Option B (Retention Policy) is wrong because retention policies are designed for managing data lifecycle and can delete or archive items after a specified period, but they do not prevent users from modifying or deleting content while the policy is active; litigation hold explicitly locks content. Option C (Data Loss Prevention) is wrong because DLP focuses on preventing sensitive data from being shared or leaked through rules and policies, not on preserving data from alteration or deletion. Option D (eDiscovery) is wrong because eDiscovery is a tool for searching, holding, and exporting data as part of legal investigations, but it is not a hold feature itself; litigation hold is the underlying mechanism that eDiscovery uses to preserve content.

Full explanation →

204

MCQmedium

A company uses password hash synchronization with Microsoft Entra Connect. The security team wants to enable self-service password reset (SSPR) so that users can reset their own passwords, and the password changes must be written back to the on-premises Active Directory. Which additional configuration is required to achieve password writeback?

A.Configure SSPR to use federation with on-premises AD FS

B.Enable password hash synchronization in Microsoft Entra Connect

C.Install Microsoft Entra Connect with password writeback enabled

D.Set the SSPR property 'Password writeback' to 'Yes' in the Microsoft Entra admin center

AnswerC

To allow SSPR password changes to be written back, Microsoft Entra Connect must be installed or reconfigured with the 'Password writeback' optional feature checked. This action installs the writeback service on the sync server, which connects to the on-premises AD and enables the tenant to accept cloud-originated password resets. After enabling this component, the cloud-side SSPR property must also be set to 'Yes' to complete the configuration.

Why this answer

Password writeback requires the installation of Microsoft Entra Connect with the password writeback feature explicitly enabled during setup. This allows password changes initiated via SSPR to be written back to on-premises Active Directory. Option C is correct because it directly addresses the necessary infrastructure component.

Exam trap

The trap here is that candidates often confuse configuring the SSPR policy setting (Option D) with the actual installation requirement, assuming the admin center toggle alone enables writeback without realizing the Entra Connect component must be installed first.

How to eliminate wrong answers

Option A is wrong because federation with AD FS is not required for password writeback; SSPR with password hash synchronization works independently of federation. Option B is wrong because password hash synchronization is already in place per the scenario, but enabling it again does not enable writeback; writeback is a separate feature. Option D is wrong because setting the SSPR property 'Password writeback' to 'Yes' in the admin center only configures the SSPR policy; it does not install or enable the writeback service in Entra Connect, which is a prerequisite.

Full explanation →

205

MCQeasy

An administrator adds the custom domain 'fabrikam.com' to a new Microsoft 365 tenant. After adding the domain, the status shows 'Pending verification'. Which type of DNS record must be added to the public DNS zone to complete domain ownership verification?

A.MX record

B.TXT record

C.CNAME record

D.SPF record

AnswerB

A TXT record with the verification string is added to the domain's DNS zone to confirm ownership.

Why this answer

To verify domain ownership in Microsoft 365, you must add a TXT record with a specific verification value provided by the Microsoft 365 admin center to the public DNS zone. This proves you control the domain because only the domain owner can modify DNS records. Other record types like MX, CNAME, or SPF are used for mail routing or service configuration, not for ownership verification.

Exam trap

The trap here is that candidates confuse the verification TXT record with other TXT-based records like SPF or DKIM, or assume any DNS record type can be used for verification, but Microsoft specifically requires a TXT record with a unique token for domain ownership proof.

How to eliminate wrong answers

Option A is wrong because MX records are used to specify mail exchange servers for email routing, not for domain ownership verification. Option C is wrong because CNAME records alias one domain name to another and are not used for verification; they are typically used for service-specific configurations like autodiscover. Option D is wrong because SPF records are a type of TXT record used to authorize sending servers for email authentication, but the verification process requires a specific TXT record with a unique token, not an SPF record.

Full explanation →

206

MCQmedium

A compliance officer needs to retain all email messages in a user's Exchange Online mailbox for 7 years after the message is sent or received, and then automatically delete them. The retention must be enforced regardless of user actions. Which Microsoft Purview solution should be used?

A.Litigation hold

B.Retention policy with Exchange location

C.Classification policy

D.In-place eDiscovery hold

AnswerB

A retention policy can retain and then delete content after a specified period.

Why this answer

A retention policy with the Exchange location in Microsoft Purview allows you to define a retention period (e.g., 7 years) and then automatically delete messages after that period. It enforces the retention regardless of user actions because it operates at the service level, not relying on user cooperation. This meets the compliance officer's requirement for mandatory, time-based retention and deletion.

Exam trap

The trap here is that candidates often confuse Litigation hold (which preserves indefinitely) with a retention policy (which can both preserve and delete after a set time), leading them to select Litigation hold for time-based deletion scenarios.

How to eliminate wrong answers

Option A is wrong because Litigation hold preserves all mailbox content indefinitely until the hold is removed, but it does not automatically delete messages after a specific period; it is designed for legal preservation, not time-based retention with deletion. Option C is wrong because Classification policy (e.g., sensitivity labels) applies metadata and protection actions but does not enforce time-based retention or automatic deletion of email messages. Option D is wrong because In-place eDiscovery hold is a deprecated feature that preserves content for eDiscovery purposes without automatic deletion; it also does not support time-based retention policies.

Full explanation →

207

MCQmedium

A company plans to enable Self-Service Password Reset (SSPR) for all users. The administrator needs to ensure that users are required to register at least two authentication methods before they can use SSPR. Which configuration setting should the administrator modify?

A.Set the 'Number of methods required to reset' to 2 in the SSPR authentication methods settings.

B.Enable combined registration for SSPR and Microsoft Entra ID Multi-Factor Authentication.

C.Configure a Conditional Access policy requiring MFA registration for SSPR.

D.Set the 'Number of questions required to register' to 2 in the security questions settings.

AnswerA

This setting directly enforces that users must register at least two methods to use SSPR.

Why this answer

The 'Number of methods required to reset' setting directly controls how many authentication methods a user must provide during the SSPR reset process. By setting this value to 2, the administrator ensures that users must register at least two methods (e.g., phone and email) before they can reset their password, as SSPR requires the registered methods to match the reset requirement.

Exam trap

The trap here is confusing the 'Number of methods required to reset' (which controls the reset process) with the 'Number of methods required to register' (which controls initial registration), leading candidates to mistakenly choose options that affect registration but not the reset requirement.

How to eliminate wrong answers

Option B is wrong because enabling combined registration for SSPR and Microsoft Entra ID Multi-Factor Authentication simplifies the registration process but does not enforce a minimum number of methods for SSPR usage. Option C is wrong because a Conditional Access policy requiring MFA registration for SSPR can mandate MFA registration but does not control the number of authentication methods needed for SSPR reset. Option D is wrong because the 'Number of questions required to register' setting applies only to security questions, which are a specific authentication method, and does not enforce the overall number of methods required for reset; also, security questions are not a recommended method for SSPR.

Full explanation →

208

MCQeasy

An organization has just purchased Microsoft 365 Business Standard licenses. The administrator adds a new user through the admin center. By default, does the new user receive a welcome email with sign-in instructions?

A.Yes, always, regardless of how the user is created.

B.Yes, if the administrator does not clear the 'Send welcome email' checkbox during user creation.

C.No, the administrator must manually send the welcome email using a script.

D.No, welcome emails are only sent when using the 'Add multiple users' option.

AnswerB

Correct — when an administrator adds a user through the admin center, either individually or in bulk, the 'Send welcome email' checkbox appears on the 'Finish' or 'Settings' page and is checked by default. As long as that box remains checked during the creation process, Microsoft 365 automatically sends the welcome email to the user's designated email address with the temporary password and sign-in information. If the administrator unchecks the box, no email is sent and the admin must distribute credentials another way.

Why this answer

When an administrator adds a new user through the Microsoft 365 admin center, the default behavior is to send a welcome email containing the user's sign-in name and temporary password. The administrator can opt out by clearing the 'Send welcome email in email' checkbox during the creation process. Therefore, the user receives the email unless the administrator explicitly deselects that option.

Exam trap

The trap here is that candidates may assume the welcome email is always sent or never sent, overlooking the specific checkbox control that allows the administrator to suppress the email during user creation.

How to eliminate wrong answers

Option A is wrong because the welcome email is not always sent; it depends on the checkbox state during user creation, and if the user is created via other methods (e.g., PowerShell, bulk CSV import), the email may not be sent by default. Option C is wrong because the administrator does not need to manually send the email using a script; the admin center provides a built-in checkbox to control sending, and the email is sent automatically unless the checkbox is cleared. Option D is wrong because the welcome email is sent for single user creation as well, not only when using the 'Add multiple users' option; the checkbox exists in both single and bulk creation flows.

Full explanation →

209

MCQmedium

The exhibit shows a KQL query used in Microsoft 365 Defender. The query returns no results for admin@contoso.com. What is the most likely reason?

A.The user does not have the Global Administrator role.

B.The KQL query syntax is invalid.

C.The role name in the query is misspelled.

D.Microsoft Defender for Identity is not enabled for the tenant.

AnswerD

IdentityInfo is not derived from the Microsoft Graph or role directory alone; it is continuously synchronized by Microsoft Defender for Identity (MDI) sensors from on-premises Active Directory and Azure AD. MDI enriches identities with role, group, and resource access data. When MDI is not onboarded or properly licensed, the IdentityInfo table remains empty or contains only incomplete data, so any query filtering it returns no rows. This is the root cause consistent with an empty result set and a valid query, making it the only correct answer here.

Why this answer

The KQL query uses the `IdentityLogonEvents` table, which is populated by Microsoft Defender for Identity (MDI). If MDI is not enabled for the tenant, this table contains no data, so the query returns no results regardless of the user's role or query syntax. The query itself is syntactically correct and the role name 'GlobalAdministrator' is valid, but without MDI being provisioned, the table is empty.

Exam trap

The trap here is that candidates often assume a query returning no results must have a syntax error or a misspelled value, when in fact the underlying data source (Defender for Identity) may not be provisioned, causing the table to be empty.

How to eliminate wrong answers

Option A is wrong because the query filters on the `AccountUpn` field, not on administrative roles; even if the user lacks the Global Administrator role, the query would still return logon events for that user if MDI were enabled. Option B is wrong because the KQL syntax is valid: it correctly uses the `where` operator with a string comparison and a logical `and` to filter on `ActionType`. Option C is wrong because 'GlobalAdministrator' is the correct role name as stored in the `AccountSid` or related fields in Defender for Identity; a misspelling would cause a syntax error or no match, but the query returns no results for a valid user, indicating the data source itself is missing.

Full explanation →

210

Multi-Selectmedium

Your organization uses Microsoft Defender for Cloud Apps. You want to control the use of personal cloud storage apps. Which TWO actions should you take?

Select 2 answers

A.Create a DLP policy to prevent sharing of sensitive data to personal cloud storage apps.

B.Create a conditional access policy to require managed apps for cloud storage.

C.Block all personal cloud storage apps using Defender for Cloud Apps.

D.Create a session policy to monitor and control downloads to personal cloud storage apps.

E.Use app governance to monitor and control app permissions.

AnswersD, E

Session policies can monitor and restrict activities within cloud apps in real time.

Why this answer

The correct answers are D and E. Option D is correct because session policies in Microsoft Defender for Cloud Apps (via Conditional Access App Control) allow you to monitor and control downloads to personal cloud storage apps in real time. Option E is correct because app governance provides visibility into app permissions and behaviors, enabling you to monitor and control which apps can access cloud storage.

Option A is incorrect because a DLP policy prevents sharing of sensitive data but does not control the use of personal cloud storage apps directly. Option B is incorrect because a conditional access policy requiring managed apps controls access to corporate resources but does not specifically govern personal cloud storage usage. Option C is incorrect because blocking all personal cloud storage apps is overly restrictive; Defender for Cloud Apps supports granular controls through policies rather than blanket blocks.

Full explanation →

211

Multi-Selecthard

Your organization uses Microsoft Entra ID and has strict security requirements. You need to implement a Zero Trust security model. Which THREE of the following are foundational principles of Zero Trust that should be implemented?

Select 3 answers

A.Assume trust based on location

B.Segment access

C.Use least privilege access

D.Assume breach

E.Verify explicitly

AnswersC, D, E

Limit user access with Just-In-Time and Just-Enough-Access (JIT/JEA).

Why this answer

Least privilege access is a foundational principle of Zero Trust, ensuring users and devices are granted only the minimum permissions necessary to perform their tasks. In Microsoft Entra ID, this is implemented through features like Privileged Identity Management (PIM) and conditional access policies that restrict access based on role and context, reducing the attack surface.

Exam trap

Microsoft often tests the distinction between security best practices (like segmentation) and the specific foundational principles of Zero Trust, causing candidates to select 'Segment access' because it sounds correct, but it is not one of the three core pillars defined by Microsoft.

Full explanation →

212

MCQmedium

A security administrator needs to implement a just-in-time (JIT) privileged access solution for the Global Administrator role. Users must request activation and provide a business justification. The request must be approved by a separate group of approvers, and the role activation should expire after 4 hours. Which Microsoft Entra feature should be configured?

A.Conditional Access

B.Privileged Identity Management (PIM)

C.Azure AD Roles (default role settings)

D.Identity Protection

AnswerB

PIM enables time-bound role activation with approval, justification, and automatic deactivation.

Why this answer

Privileged Identity Management (PIM) is the Microsoft Entra feature specifically designed for just-in-time (JIT) privileged access. It allows you to configure role activation with approval workflows, require a business justification, set a maximum activation duration (e.g., 4 hours), and designate specific approvers. This directly matches all requirements in the question.

Exam trap

The trap here is that candidates often confuse Conditional Access (which controls access to apps) with PIM (which controls privileged role activation), or they assume default role settings can enforce JIT activation without realizing that PIM is the only feature that provides time-bound, approval-based role elevation.

How to eliminate wrong answers

Option A is wrong because Conditional Access enforces access policies based on signals like user location or device state, but it does not provide JIT role activation, approval workflows, or time-bound role elevation. Option C is wrong because Azure AD Roles (default role settings) only define static role assignments and permissions; they lack the ability to require activation requests, business justification, or approval from a separate group. Option D is wrong because Identity Protection focuses on detecting and remediating identity risks (e.g., leaked credentials, anomalous sign-ins) and does not manage privileged role activation or approval processes.

Full explanation →

213

MCQmedium

A company is planning to migrate from on-premises Exchange to Exchange Online and needs to ensure that mail flow can coexist between the two environments during the transition. Which tool should the administrator use to configure this hybrid deployment?

A.Azure AD Connect

B.Exchange Hybrid Configuration Wizard

C.Microsoft 365 Admin Center

D.Exchange Admin Center

AnswerB

This wizard guides through the steps to establish a hybrid relationship between on-premises Exchange and Exchange Online, including mail flow and free/busy sharing.

Why this answer

The Exchange Hybrid Configuration Wizard (HCW) is the correct tool because it automates the configuration of coexistence features between on-premises Exchange and Exchange Online, including mail flow routing, free/busy sharing, and OAuth authentication. It generates the necessary connectors and settings to support a hybrid deployment, ensuring seamless mail flow during migration.

Exam trap

The trap here is that candidates often confuse Azure AD Connect's directory synchronization role with hybrid mail flow configuration, assuming it handles all hybrid setup, when in fact it only syncs objects and does not configure Exchange-specific routing or coexistence.

How to eliminate wrong answers

Option A is wrong because Azure AD Connect synchronizes directory objects (users, groups) but does not configure mail flow or hybrid coexistence settings between Exchange environments. Option C is wrong because the Microsoft 365 Admin Center provides high-level tenant management and licensing but lacks the granular Exchange-specific hybrid configuration capabilities. Option D is wrong because the Exchange Admin Center (EAC) in Exchange Online or on-premises can manage individual connectors and settings but does not provide the guided, automated workflow of the HCW for establishing a full hybrid deployment.

Full explanation →

214

MCQeasy

A new administrator needs to automatically assign Microsoft 365 E5 licenses to all users in the Sales department. The Sales department is identified by the 'department' attribute in Azure AD. Which licensing method should the administrator use to minimize manual effort?

A.Manual license assignment per user

B.Group-based licensing using a dynamic group

C.PowerShell script to assign licenses

D.Bulk license assignment via CSV file

AnswerB

Dynamic groups automatically update membership based on attributes, and group-based licensing assigns licenses to all members.

Why this answer

Group-based licensing using a dynamic group is the correct method because it automatically assigns Microsoft 365 E5 licenses to all users in the Sales department based on the 'department' attribute in Azure AD. Dynamic groups evaluate membership rules in real time, so when a user's department attribute is set to 'Sales', the license is assigned without manual intervention. This minimizes administrative effort by eliminating the need for per-user or batch operations.

Exam trap

The trap here is that candidates often choose PowerShell scripting (Option C) thinking it is the most automated method, but they overlook that group-based licensing provides true zero-touch, attribute-driven automation without requiring custom code or scheduled tasks.

How to eliminate wrong answers

Option A is wrong because manual license assignment per user requires an administrator to individually assign licenses to each Sales department user, which is labor-intensive and does not scale. Option C is wrong because a PowerShell script, while automatable, still requires manual execution or scheduling and does not provide real-time, attribute-based automatic assignment like group-based licensing does. Option D is wrong because bulk license assignment via CSV file is a one-time operation that does not automatically handle new users or attribute changes, requiring repeated manual exports and imports.

Full explanation →

215

MCQeasy

A security administrator needs a single console to investigate and respond to a complex incident involving alerts from endpoints, email, and identities. Which Microsoft portal should they use?

A.Microsoft 365 Defender portal

B.Microsoft Sentinel

C.Microsoft Defender for Cloud

D.Microsoft 365 compliance center

AnswerA

This portal provides a unified incident management view across Microsoft Defender XDR products, correlating alerts from multiple domains.

Why this answer

The Microsoft 365 Defender portal (security.microsoft.com) is the correct choice because it provides a unified incident management console that correlates alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. This allows the security administrator to investigate and respond to a complex incident spanning endpoints, email, and identities from a single pane of glass, leveraging automated investigation and response (AIR) capabilities.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel (a SIEM) with the Microsoft 365 Defender portal (an XDR console), assuming that any security investigation must go through a SIEM, but the question specifically asks for the single console that natively correlates alerts from endpoints, email, and identities without additional data ingestion setup.

How to eliminate wrong answers

Option B is wrong because Microsoft Sentinel is a cloud-native SIEM/SOAR platform that ingests logs from multiple sources, but it is not the single console designed for native XDR incident correlation across Microsoft 365 Defender workloads; it requires additional configuration and data connectors to unify alerts from endpoints, email, and identities. Option C is wrong because Microsoft Defender for Cloud is focused on securing cloud workloads (IaaS, PaaS, and data services) and does not natively integrate email and identity alerts from Microsoft 365 Defender. Option D is wrong because the Microsoft 365 compliance center is designed for data governance, eDiscovery, and compliance management, not for real-time security incident investigation and response.

Full explanation →

216

MCQmedium

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their Google Workspace credentials without creating external identities. What should you configure?

A.Enable Microsoft Entra Verified ID for Google Workspace users

B.Configure Google as a social identity provider in Microsoft Entra External ID

C.Configure Microsoft Entra B2B collaboration with Google Workspace

D.Configure SAML/WS-Fed identity provider federation with Google Workspace

AnswerD

Configuring SAML/WS-Fed identity provider federation is the correct approach because Microsoft Entra ID supports direct federation with Google Workspace by exchanging metadata and establishing a trust relationship. This allows Google Workspace users to authenticate with their existing corporate credentials and gain SSO access to Entra ID-integrated apps and resources. It provides a true federation experience where Google is treated as an external IdP within the Entra tenant.

Why this answer

Configuring SAML/WS-Fed identity provider federation with Google Workspace allows users to sign in using their Google Workspace credentials directly, without creating external identities. This federation establishes a trust relationship between Microsoft Entra ID and Google Workspace as an identity provider, enabling seamless authentication for users who already have Google accounts.

Exam trap

The trap here is that candidates often confuse social identity provider configuration (Option B) with enterprise federation, but social IdPs are designed for consumer scenarios and create external identities, whereas SAML/WS-Fed federation preserves the user's existing identity without creating new objects in the directory.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Verified ID is a decentralized identity solution using verifiable credentials, not designed for federating with Google Workspace for sign-in. Option B is wrong because configuring Google as a social identity provider in Microsoft Entra External ID is intended for consumer-facing applications and creates external identities, not for enterprise users with existing Google Workspace accounts. Option C is wrong because Microsoft Entra B2B collaboration creates external guest user objects in the directory, which contradicts the requirement to avoid creating external identities.

Full explanation →

217

MCQeasy

A compliance officer wants to prevent users from sending emails that contain personally identifiable information (PII), such as social security numbers, to external recipients. If a user attempts to send such an email from Outlook, the email should be blocked and a policy tip explaining the block should be displayed. Which Microsoft Purview solution should the officer configure?

A.Microsoft Purview Data Loss Prevention (DLP) policy

B.Microsoft Purview Information Protection sensitivity label

C.Microsoft Purview Records Management retention label

D.Microsoft Purview eDiscovery case

AnswerA

A Microsoft Purview Data Loss Prevention (DLP) policy is exactly designed for this scenario: when applied to Exchange Online, it inspects outbound messages in transit against sensitive info types (such as social security numbers or credit card numbers) and can take corrective actions like blocking the message before it leaves the organization, optionally allowing an end-user override with justification and a policy tip in Outlook. This combination of content inspection, transport-level enforcement, and real-time user notification makes it the correct choice for preventing users from sending emails with specific sensitive data.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to detect and block sensitive information, such as PII (e.g., social security numbers), in transit. When a DLP rule matches, it can block the email and display a policy tip in Outlook, informing the user why the message was blocked. This meets the compliance officer's requirement to prevent external sending of PII with real-time user notification.

Exam trap

The trap here is that candidates confuse sensitivity labels (which apply protection at rest) with DLP policies (which enforce actions on data in motion), leading them to choose Option B because they associate labels with 'protecting' PII, but labels do not block outbound email or trigger policy tips.

How to eliminate wrong answers

Option B is wrong because sensitivity labels classify and protect data at rest (e.g., encryption, visual markings) but do not natively block outbound email based on content inspection or display policy tips in Outlook. Option C is wrong because retention labels manage data lifecycle (retention and deletion) and are not designed to inspect or block email content in transit. Option D is wrong because eDiscovery cases are used for legal hold, search, and export of content, not for real-time prevention of email sending or policy tip enforcement.

Full explanation →

218

MCQmedium

A compliance officer needs to prevent users from sending emails that contain sensitive information, such as social security numbers, to external recipients. If a user attempts to send such an email, the action should be blocked and a policy tip should be displayed to the user. Which Microsoft Purview solution should the officer configure?

A.Data Loss Prevention (DLP) policy

B.sensitivity label with encryption

C.Information Rights Management (IRM)

D.retention label with deletion

AnswerA

A DLP policy in Microsoft Purview integrates with Exchange Online to inspect email content in transit and at the client. It uses sensitive information types (e.g., U.S. Social Security Number) as conditions and can apply an action to 'Block the message' from being sent, optionally allowing the sender to override with a business justification. At the same time, policy tips are displayed in Outlook, Outlook on the web, and Mail for iOS/Android during composition, providing real-time guidance before the message leaves the client. This is the only option that actually prevents the email from being sent and educates the sender.

Why this answer

A Data Loss Prevention (DLP) policy in Microsoft Purview is designed to inspect email content for sensitive information (e.g., social security numbers) and can block the message while displaying a policy tip to the user. This matches the requirement exactly, as DLP policies enforce actions on data in transit (email) with user notifications.

Exam trap

The trap here is that candidates confuse sensitivity labels (which protect data at rest) with DLP (which protects data in motion), leading them to choose Option B because they think encryption prevents sending, but encryption does not block the email or show a policy tip at the point of sending.

How to eliminate wrong answers

Option B (sensitivity label with encryption) is wrong because sensitivity labels primarily classify and protect data at rest (e.g., files in SharePoint) and can apply encryption, but they do not natively block outbound email in real-time or display policy tips during send. Option C (Information Rights Management) is wrong because IRM protects content after delivery by restricting actions like forwarding or printing, but it does not inspect or block emails before they are sent based on sensitive data patterns. Option D (retention label with deletion) is wrong because retention labels manage data lifecycle (e.g., how long to keep or when to delete) and have no capability to scan outbound email content or block transmission.

Full explanation →

219

Multi-Selecthard

A Microsoft Purview auto-labeling policy for sensitivity labels is matching too many SharePoint documents after simulation. Which two changes would most directly reduce false positives before enabling automatic labeling? (Choose two.)

Select 2 answers

A.Increase the confidence level or instance-count requirement for the sensitive information type

B.Add supporting keyword or contextual conditions to the auto-labeling rule

C.Turn on automatic labeling immediately and wait for users to report problems

D.Replace the sensitivity label with a retention label

AnswersA, B

Raising the confidence level or instance-count threshold in the sensitive information type (SIT) increases the probability that the detected pattern is a genuine match rather than an isolated or coincidental string. Confidence reflects the match strength of the classification engine, and instance count requires multiple occurrences in the same item, both of which reduce false positives in an auto-labeling policy.

Why this answer

Increasing the confidence level or instance-count requirement for the sensitive information type (SIT) directly reduces false positives by raising the threshold for what qualifies as a match. A higher confidence level means the classification engine requires stronger evidence (e.g., more keywords or a closer proximity to a pattern), while a higher instance count requires the sensitive data to appear multiple times in the document. Both adjustments make the auto-labeling rule more selective, ensuring only documents with a high likelihood of containing the specified sensitive content are labeled.

Exam trap

The trap here is that candidates may think immediate enforcement (Option C) is the fastest way to fix false positives, but Microsoft explicitly recommends using simulation mode to tune rules before enabling automatic labeling, and waiting for user reports is not a valid tuning strategy.

Full explanation →

220

MCQeasy

You need to configure self-service password reset (SSPR) for users in Microsoft Entra ID. Which license is required?

A.Microsoft 365 F3

B.Microsoft 365 E3

C.Microsoft Entra ID P1

D.Microsoft Entra ID Free

AnswerC

Correct. Microsoft Entra ID P1 is the specific license that provides SSPR functionality.

Why this answer

Self-service password reset (SSPR) requires a Microsoft Entra ID P1 or P2 license. Both Microsoft 365 F3 and Microsoft 365 E3 include Microsoft Entra ID P1 licenses, which support SSPR. However, the question directly asks which license is required for SSPR, and the correct answer is the standalone Microsoft Entra ID P1 license.

While F3 and E3 include this license, they are suite licenses and not the specific license component being asked for.

Exam trap

The trap is that candidates may incorrectly assume Microsoft 365 E3 and F3 only include Entra ID Free, but in fact they include Entra ID P1, which supports SSPR. This can lead candidates to dismiss these options, but the correct answer is still the specific Entra ID P1 license.

How to eliminate wrong answers

Option A is wrong because Microsoft 365 F3 includes only Azure AD Free, which does not support SSPR. Option B is wrong because Microsoft 365 E3 also includes only Azure AD Free, lacking the premium SSPR capability. Option D is wrong because Microsoft Entra ID Free explicitly excludes SSPR; SSPR requires at least a P1 license.

Full explanation →

221

MCQmedium

A company adds and verifies the custom domain 'contoso.com' in their Microsoft 365 tenant. However, emails sent to new users at user@contoso.com bounce back. The existing MX record for contoso.com points to the on-premises mail server. What is the most likely cause of the bounce?

A.The domain verification failed and needs to be repeated

B.The MX record must be updated to point to Exchange Online

C.Users must be added to the domain in the admin center

D.The SPF record is missing or misconfigured

AnswerB

The MX record is the DNS instruction that tells sending mail servers where to deliver messages for your domain. When you add a verified custom domain to Microsoft 365, you must change this record from your previous email provider to the Exchange Online endpoint (for example, contoso-com.mail.protection.outlook.com). If you leave the old MX value in place, inbound mail continues to route to the legacy mail server, which has no mailbox for the recipient, causing the bounce. Correcting the MX record is the precise fix for bounced incoming mail after domain provisioning.

Why this answer

B is correct because the MX record for contoso.com still points to the on-premises mail server. When a user is created in Exchange Online with the domain contoso.com, inbound email is routed according to the MX record. Since the MX record directs mail to the on-premises server, which does not have a mailbox for the new user, the message bounces.

To deliver mail to Exchange Online, the MX record must be updated to point to Exchange Online (e.g., contoso-com.mail.protection.outlook.com).

Exam trap

The trap here is that candidates often confuse domain verification (a one-time DNS check) with ongoing mail routing (MX record), leading them to think verification failure is the cause, when in fact the MX record is the direct culprit.

How to eliminate wrong answers

Option A is wrong because domain verification is a one-time DNS TXT record check; once verified, it remains valid and does not cause email bounces for new users. Option C is wrong because users are already added to the domain in the admin center (the question states 'adds and verifies the custom domain'), and adding users does not affect mail routing. Option D is wrong because a missing or misconfigured SPF record can cause email to be rejected or marked as spam, but it does not cause a bounce due to the MX record pointing to the wrong server; the immediate cause is the MX record destination.

Full explanation →

222

MCQeasy

A company has recently signed up for Microsoft 365 Business Premium. They want to change the default domain from onmicrosoft.com to a custom domain they own. Which step must be completed first before the custom domain can be used for user email addresses?

A.Add the custom domain in the Microsoft 365 admin center

B.Verify domain ownership by adding a TXT record to the domain's DNS

C.Create user accounts with the new domain as their primary email

D.Configure email exchange records (MX)

AnswerA

Adding the custom domain in the Microsoft 365 admin center is the mandatory first step to associate your existing DNS namespace with your tenant. From Domains > Add domain, you enter the domain name, which triggers Microsoft's verification wizard and generates the exact DNS records you must publish. Until this addition is completed, no downstream tasks like verification or user provisioning can begin.

Why this answer

Before a custom domain can be used for user email addresses in Microsoft 365, the domain must first be added to the tenant in the Microsoft 365 admin center. This step creates a domain object in Azure AD that allows Microsoft to associate the domain with your tenant and prepare for ownership verification. Without adding the domain first, subsequent steps like DNS verification or user creation cannot proceed because the system has no record of the domain.

Exam trap

The trap here is that candidates often confuse the order of operations, assuming DNS verification (Option B) is the first step, but Microsoft 365 requires the domain to be added to the tenant as a prerequisite before any DNS records can be validated.

How to eliminate wrong answers

Option B is wrong because verifying domain ownership by adding a TXT record is a required step, but it must occur after the domain is added in the admin center; you cannot verify a domain that hasn't been registered in the tenant. Option C is wrong because creating user accounts with the new domain as their primary email is a later step that requires the domain to be both added and verified first. Option D is wrong because configuring MX records is part of the final DNS configuration for mail routing, which depends on the domain being verified and the tenant ready to accept mail.

Full explanation →

223

MCQmedium

You manage Microsoft Defender for Endpoint. A device is showing as 'Inactive' in the device inventory. The device is turned on and connected to the network. What is the most likely cause?

A.The device is turned off

B.A firewall is blocking communication with the Microsoft Defender for Endpoint cloud service

C.The Microsoft Defender for Endpoint sensor is not reporting

D.The onboarding script was not run successfully

AnswerC

If the sensor stops reporting, the device shows as inactive.

Why this answer

An 'Inactive' status in Microsoft Defender for Endpoint means the sensor has not communicated with the cloud service for a defined period (typically 7 days). Since the device is on and connected, the most likely cause is that the Microsoft Defender for Endpoint sensor is not reporting. Option A is incorrect because the device is explicitly stated as turned on.

Option B, while a firewall could potentially block communication, is less likely than sensor failure, and Defender for Endpoint uses HTTPS which is typically allowed. Option D is incorrect because a failed onboarding script would prevent the device from appearing or show it as 'Not onboarded', not 'Inactive'.

Full explanation →

224

MCQmedium

Your organization uses Microsoft Entra Conditional Access. You need to block access from countries where your company does not operate. The list of blocked countries changes frequently. What is the most efficient way to manage this?

A.Enable Microsoft Entra multifactor authentication for all users from blocked countries

B.Create a Conditional Access policy that blocks all locations except the allowed countries

C.Use IP ranges in Conditional Access to block specific country IPs

D.Create Named Locations for blocked countries and use them in Conditional Access

AnswerD

Named Locations can be easily updated with new countries.

Why this answer

Named Locations in Microsoft Entra Conditional Access allow you to define countries by IP ranges and then use those locations in a policy to block access. This is the most efficient approach because you can update the list of blocked countries in the Named Locations configuration without modifying the Conditional Access policy itself, which is ideal when the list changes frequently.

Exam trap

The trap here is that candidates often think using IP ranges directly in the policy (Option C) is more precise, but they overlook the administrative overhead of maintaining those ranges manually, whereas Named Locations with country selection provide a simpler and more scalable solution for frequently changing country lists.

How to eliminate wrong answers

Option A is wrong because enabling MFA for users from blocked countries does not block access; it only adds an authentication challenge, which is not a block action and does not meet the requirement to prevent access. Option B is wrong because creating a policy that blocks all locations except allowed countries is inefficient when the list of blocked countries changes frequently, as you would need to constantly update the allowed list, and it is easier to manage a list of blocked countries directly. Option C is wrong because using IP ranges in Conditional Access to block specific country IPs is impractical and inefficient; you would need to manually gather and maintain a list of all IP ranges for each blocked country, which is error-prone and does not leverage the built-in country-based location detection that Named Locations provide.

Full explanation →

225

MCQhard

Your company has implemented Microsoft Entra ID tenant restrictions to prevent data exfiltration. You need to ensure that external users from a partner organization can access a SharePoint Online site without being blocked by tenant restrictions. What should you do?

A.Add the partner tenant ID to the AllowedTenants list in the tenant restrictions policy.

B.Create a Conditional Access policy to exclude partner users from tenant restriction evaluation.

C.Configure Azure AD B2B collaboration and invite partner users as guests.

D.Configure cross-tenant access settings in Microsoft Entra ID to allow partner tenant.

AnswerA

Adding the partner tenant ID to the AllowedTenants list allows users from that tenant to access resources without being blocked.

Why this answer

Tenant restrictions use the X-MS-Cloud-Extension header to block or allow access based on tenant IDs. To allow external users from a partner organization to access SharePoint Online, you must add the partner's tenant ID to the 'AllowedTenants' list in the tenant restrictions policy (Option A). Option B (Conditional Access) does not bypass tenant restrictions.

Option C (Azure AD B2B) invites users but does not override tenant restrictions. Option D (cross-tenant access settings) controls inbound/outbound access but is separate from tenant restrictions.

Full explanation →

Microsoft 365 Administrator MS-102 (MS-102) — Questions 151–225