Select Two (Multi-Select) Questions

Add members to the group

Members inherit license.

Create a security group

Group must exist to assign license.

Assign a license to the group

License is assigned to group.

Microsoft Authenticator app (phone sign-in)

Authenticator app supports passwordless sign-in.

FIDO2 security keys

FIDO2 keys provide passwordless authentication.

Define sanctioned and unsanctioned app categories in Microsoft Defender for Cloud Apps

After discovery, you categorize apps to control access.

Use Cloud Discovery in Microsoft Defender for Cloud Apps to analyze traffic logs

Cloud Discovery identifies unsanctioned apps from traffic logs.

Create a DLP policy that prevents users from sharing credit card numbers via email with external recipients.

A Data Loss Prevention (DLP) policy in Microsoft 365 can be configured to detect the presence of sensitive information such as credit card numbers in emails and block sharing with external recipients. Using policy rules with conditions, actions, and user notifications, the policy scans outbound messages and prevents the transmission, thereby helping organizations comply with data protection standards like PCI-DSS.

Use a retention label to automatically delete documents containing trade secrets after 7 years.

Retention labels allow administrators to apply a configurable retention period to documents based on classification or content. By assigning a label that deletes content after 7 years, the document is automatically disposed of through a disposition review or directly based on the label's retention action, ensuring regulatory compliance and lifecycle management.

Configure a sensitivity label with sublabels that apply different markings (e.g., 'Confidential' and 'Highly Confidential') to the same document.

Sensitivity labels support sublabels, which are child labels under a parent label. You can configure sublabels with different markings, such as 'Confidential' and 'Highly Confidential,' to be applied to the same document depending on context. This enables granular classification while keeping the parent label's protection settings intact.

Enable auditing in the Microsoft 365 compliance portal to track user activities such as file downloads and mailbox access.

Enabling auditing in the Microsoft 365 compliance portal activates unified auditing across services like Exchange, SharePoint, and OneDrive. It captures events such as file downloads and mailbox access, storing them in a searchable audit log. This provides administrators with a forensic trail to investigate security incidents, insider threats, or compliance violations.

Create a sensitive information type to detect custom data patterns, such as employee IDs.

Microsoft Purview's sensitive information types (SITs) are pattern-based definitions that use regex or keyword lists to identify data such as credit cards, or in this case a custom employee ID format. A global administrator can create a custom SIT in the Compliance portal specifying the exact pattern, supporting characters, and confidence level. Once created, this SIT can be used across DLP, auto-labeling, and retention policies, making it a foundational step for classifying a uniquely structured data attribute.

Enable auto-labeling policies in Microsoft Purview to automatically apply sensitivity labels to documents containing trade secrets.

An auto-labeling policy lets you configure content matching conditions and apply a sensitivity label at the time of scanning across SharePoint, OneDrive, and Exchange. Because the policy can reference SITs or trainable classifiers as conditions, it is the correct mechanism for automatically labeling documents containing trade secrets. This is distinct from manual labeling or default labeling, as it proactively scans content in place without user intervention.

Configure a trainable classifier to identify and label content that matches specific organizational patterns, such as legal contracts.

Trainable classifiers use machine learning to recognize a category of content based on examples of positive and negative text, rather than pattern matching or keywords. After you train and publish a classifier for legal contracts, you can include it as a condition inside auto-labeling policies and DLP rules. This allows nuanced classification of organizational content that may not have a fixed format, such as contracts, which a simple regex SIT would miss.

Configure anti-phishing policies to protect users from impersonation of custom domains.

In Defender for Office 365, an anti-phishing policy's impersonation settings let you specify custom domains to protect, and the service uses heuristics and machine learning to flag messages whose sending domain appears visually or logically similar to that protected domain. This mitigates attacks where an external sender uses a lookalike domain (e.g., typo-squatted or punycode variants) to trick users into thinking the mail originates from your organization. Because this is an identity-based detection, it is the correct policy category for the stated threat.

Configure anti-phishing policies to protect users from impersonation of internal users.

Anti-phishing policies also include mailbox intelligence and a 'users to protect' list that learns typical communication patterns and flags senders who impersonate specific internal individuals, such as executives or administrators. When an external message appears to use an internal user's display name or an altered variant of their email address, the policy can apply configured actions like redirecting the message or prepending a warning. This addresses the user-impersonation variant of the attack, which is distinct from protecting an entire domain.

Register a custom domain name (e.g., contoso.com) and verify ownership via DNS TXT record.

Registering and verifying a custom domain like contoso.com via a DNS TXT record is one of the first tasks in a Microsoft 365 deployment. It proves you control the domain and allows users to have email addresses and user principal names (UPNs) that match your corporate identity, rather than the placeholder onmicrosoft.com domain. This verification is mandatory before you can configure services like Exchange Online for that domain.

Create the initial global administrator account with a strong, unique password and enable multi-factor authentication.

The initial global administrator account holds the highest level of privilege, so creating it with a strong, unique password and immediately enabling MFA is a critical security baseline for a new tenant. If this account is compromised, an attacker gains full control over the entire directory and any connected services. Use a dedicated, non-personal account and store the credentials securely, and consider creating additional emergency access accounts as well.

Configure tenant-wide service settings such as external sharing for SharePoint and OneDrive.

Configuring tenant-wide service settings, such as external sharing for SharePoint and OneDrive, is an essential governance step during initial deployment. These settings control how users can share content with people outside the organization and help prevent data leakage. You should establish external sharing policies before users start using these services, because retroactively restricting sharing can be both disruptive and error-prone. Other settings like password expiration are less critical than this.

Communication Compliance

Communication Compliance in Microsoft Purview is designed to detect policy violations by analyzing user communications in Teams, Exchange, and Yammer for inappropriate or risky content. It uses customizable policies to flag messages that contain sensitive information, offensive language, or violations of corporate standards, enabling admins to review and take action. While it does not block sharing in real time, it is specifically built for detection and investigation of policy breaches.

Data Loss Prevention (DLP)

Data Loss Prevention (DLP) in Microsoft Purview can detect and block the sharing of sensitive information in Teams by analyzing messages for defined data types, such as credit card numbers or health records. DLP policies offer both detection and preventive actions like blocking the transmission or notifying users, making it a valid solution for real-time monitoring. This distinguishes it from detection-only solutions, as it actively enforces protection against unauthorized sharing.

Email entity page

The Email entity page is the definitive scoped view for email-borne alerts, exposing the full message record: internet message ID, sender and recipient addresses, subject, delivery status, and SPF/DKIM/DMARC authentication outcomes. It also presents linked URLs with click verdicts and extracted attachments with detonation results, enabling you to confirm the email's malicious intent. In Microsoft 365 Defender, this page is the canonical place to start when the alert originated from an email, because it centers the investigation on the artifact itself.

Alert timeline

The Alert timeline provides a chronological, event-by-event narrative surrounding the email alert, including actions like email forwarding, mailbox login, URL clicks, and file detonation events. It is valuable because it reveals the sequence of attacker and user activity after the email arrived, helping you establish whether the threat propagated beyond the mailbox. For an email investigation, the timeline complements the email entity page by answering 'what happened next' rather than 'what is in this email.'

User entity page

The User entity page aggregates identity-related signals for the affected mailbox owner, including sign-in logs, risk events, conditional access decisions, and user actions such as message reads or replies. This page is crucial for determining whether the email alert escalated into account compromise or data exfiltration, but it does not expose the email's internal headers, attachment scans, or URL detonation results. It is a valid investigative surface, yet it addresses the identity scope, not the email artifact scope, which is the core of this alert.

Automated Investigation and Response (AIR)

Automated Investigation and Response (AIR) is a premium Plan 2 capability that uses orchestration and automation to investigate alerts, analyze threat signals, and take recommended or automated remediation actions. It goes beyond passive detection by proactively resolving incidents without requiring continuous manual oversight, making it a key differentiator for Plan 2 licensing.

Threat Explorer

Threat Explorer is a real-time, interactive investigative tool that lets security teams view and analyze threat detections, search across mail and collaboration data, and take targeted actions on threats. It is exclusively available in Microsoft Defender for Office 365 Plan 2, providing advanced hunting and incident response capabilities that are not present in Plan 1.

Attack Simulation Training

Attack Simulation Training is a Plan 2 feature that allows administrators to create and launch realistic phishing and password-attack simulations, then deliver user education modules based on the results. It is designed to measure and improve an organization's security posture by training employees against social engineering attacks. This feature is licensed only with Plan 2, reinforcing its classification as a Plan 2 exclusive.

Retention labels

Retention labels are a required component because they apply retention and disposal rules to individual items, such as a single email or document, enabling granular control over the content lifecycle. Unlike policies that target entire locations, labels can be manually assigned by users or automatically applied based on conditions, and they are essential for record management and item-level compliance.

Retention policies

Retention policies are required because they apply retention settings to entire locations like SharePoint sites, OneDrive accounts, and Exchange mailboxes at scale, ensuring that all items residing in those containers inherit a default retention and deletion schedule. They work alongside retention labels to provide broad coverage for bulk content while labels handle exceptions and specific item-level requirements.

File plan

File plan is a required component because it is the central management interface in Microsoft Purview that organizes and controls the lifecycle of retention labels, allowing administrators to create a structured taxonomy based on regulatory and business requirements. It also enables exporting label details for compliance audits and bulk operations, making it foundational to deploying a consistent retention label strategy.

retention label

A retention label defines the retention and deletion rules for content at a granular level, such as preserving documents for a specific number of days, years, or permanently. You can apply it manually to individual items or through auto-labeling policies, and it triggers a retention period that cannot be overridden by users. For the compliance officer's requirement to manage document retention, this is the direct and authoritative mechanism.

An auto-labeling policy for retention labels

An auto-labeling policy is the correct way to apply a retention label to all matching documents at scale, using criteria such as sensitive info types, keywords, or trainable classifiers. This policy automates the assignment of the chosen retention label, ensuring that every affected document receives the retention treatment without manual intervention. It is correct because it operationalizes the retention label across all required content.

Use least privilege access

Limit user access with Just-In-Time and Just-Enough-Access (JIT/JEA).

Assume breach

Assume that breaches have happened and will happen, and design accordingly.

Verify explicitly

Always authenticate and authorize based on all available data points.

Review the incident timeline to understand the sequence of events.

Reviewing the incident timeline is the critical first step in an XDR investigation because it presents a chronological, correlated view of all alerts, user activities, and device events associated with the incident. This lets you reconstruct the attack chain from initial access to lateral movement and data exfiltration, identify which entities are truly affected, and establish what evidence must be preserved. Without this context, any containment or remediation action may be premature or miss the root cause.

Use advanced hunting to query for related activities across devices and identities.

Advanced hunting in Microsoft Defender XDR allows you to write KQL (Kusto Query Language) queries to pivot on specific indicators across data schemas like EmailEvents, IdentityLogonEvents, and DeviceProcessEvents. This correlative analysis goes beyond the preset incident timeline and lets you uncover related activities on other devices or identities that were not initially flagged as alerts. It is invaluable for mapping the full scope of the attack and for testing hypotheses about attacker behavior in your specific environment.

Isolate affected devices from the network using Microsoft Defender for Endpoint.

Isolating affected devices using Microsoft Defender for Endpoint is a proper containment move because it immediately stops the device from communicating with other assets and the internet, which limits lateral movement and disrupts command-and-control traffic while preserving the device's disk and memory for later forensic analysis. This action is reversible and can be applied selectively (for example, allowing certain Microsoft services) depending on the investigation needs. It is a standard incident-response step that prevents the attack from spreading without destroying evidence.

Create a session policy to monitor and control downloads to personal cloud storage apps.

Session policies can monitor and restrict activities within cloud apps in real time.

Use app governance to monitor and control app permissions.

App governance allows you to oversee and restrict app permissions in your environment.

Auto-labeling

Auto-labeling is a primary Purview solution used to classify data by automatically applying sensitivity labels to content. It evaluates files, emails, and other content against sensitive info types, patterns, and conditions, then assigns the appropriate label without manual intervention. This enables consistent, bulk classification across hybrid environments, and it can run in client-side or service-side (server-side) modes to label content before or after it is stored.

Sensitivity labels

Sensitivity labels are the core classification mechanism in Microsoft Purview, letting users and administrators tag data with a label that conveys its sensitivity and defines protective settings. Labels can be applied manually or automatically, and they persist through copying, export, and sharing, driving encryption, access restrictions, and visual markings. They are the foundation of a holistic information protection strategy, enabling downstream solutions like DLP and auto-labeling to operate.

Microsoft 365 Migration Manager

Supports email, OneDrive, and SharePoint migration.

Third-party migration tool (e.g., BitTitan MigrationWiz)

Third-party tools can migrate all workloads.

PowerShell scripts using Microsoft Graph API

PowerShell can automate data migration via Graph API.

DeviceProcessEvents and DeviceNetworkEvents

Correct. DeviceProcessEvents provides process details, and DeviceNetworkEvents provides network connections; joining them on device ID and timestamp allows correlation within the 5-minute window.

Tenant ID

The Tenant ID is required to verify the organization and locate the tenant in support systems.

Current service health status

The support team will ask for the service health dashboard status to confirm the issue and find any active advisories.

Require password change

Standard remediation for compromised users.

Block sign-in

Blocks access for high-risk users.

Require multifactor authentication

MFA can be required as remediation.