Scenario practice questions

A development team builds a background service that needs to read all users' calendars via Microsoft Graph without a signed-in user. The service will run on a server with a client secret. Which OAuth 2.0 grant flow should the application use?

Trap 1: Authorization code grant

This flow requires a signed-in user to delegate consent, not suitable for a background service.

Trap 2: Device authorization grant

This flow is designed for devices with no browser, but still requires a user to sign in on another device.

Trap 3: Implicit grant

The implicit grant is for single-page applications (SPAs) and cannot use secrets securely in a background service.

A
Authorization code grant
Why wrong: This flow requires a signed-in user to delegate consent, not suitable for a background service.
B
Device authorization grant
Why wrong: This flow is designed for devices with no browser, but still requires a user to sign in on another device.
C
Client credentials grant
This flow authenticates the application itself and is ideal for daemon services without user interaction.
D
Implicit grant
Why wrong: The implicit grant is for single-page applications (SPAs) and cannot use secrets securely in a background service.

Question 2mediummultiple choice

An administrator has configured group-based licensing in Azure AD. After adding users to the group, some users do not receive licenses. The users are in the group and have an assigned usage location. What is a possible reason?

Trap 1: The group is a mail-enabled security group, which is not supported…

Mail-enabled security groups are supported for group-based licensing.

Trap 2: The license product name in the group setting does not match the…

If the product name is incorrect, the group would not apply licenses to any user; this would affect all users, not just some.

Trap 3: The users have not accepted the Microsoft Online Service Terms

Acceptance of service terms does not block license assignment; licenses are assigned regardless.

A
The group is a mail-enabled security group, which is not supported for group-based licensing
Why wrong: Mail-enabled security groups are supported for group-based licensing.
B
The license product name in the group setting does not match the available licenses in the tenant
Why wrong: If the product name is incorrect, the group would not apply licenses to any user; this would affect all users, not just some.
C
The users have conflicting license assignments from another source
Conflicting license assignments (e.g., direct assignment or another group) can cause group-based licensing to skip those users. The licensing status in Azure AD will show an error.
D
The users have not accepted the Microsoft Online Service Terms
Why wrong: Acceptance of service terms does not block license assignment; licenses are assigned regardless.

Question 3hardmultiple choice

A security administrator needs to block outbound network connections from a compromised Windows device to command-and-control servers. The solution must work at the network layer and be centrally managed via Microsoft 365 Defender. Which feature should the administrator enable?

Trap 1: Attack Surface Reduction rules

Attack Surface Reduction rules reduce vulnerability by blocking risky local processes (e.g., macro execution), not network connections.

Trap 2: Session control in Defender for Cloud Apps

Session control in Defender for Cloud Apps applies to cloud app sessions, not system-level network connections.

Trap 3: Windows Firewall with Advanced Security

Windows Firewall with Advanced Security can block connections but is not centrally managed through Microsoft 365 Defender; policies must be configured via Group Policy or PowerShell.

A
Network Protection
Network Protection prevents outbound connections to malicious endpoints, providing network-layer blocking managed via Defender for Endpoint.
B
Attack Surface Reduction rules
Why wrong: Attack Surface Reduction rules reduce vulnerability by blocking risky local processes (e.g., macro execution), not network connections.
C
Session control in Defender for Cloud Apps
Why wrong: Session control in Defender for Cloud Apps applies to cloud app sessions, not system-level network connections.
D
Windows Firewall with Advanced Security
Why wrong: Windows Firewall with Advanced Security can block connections but is not centrally managed through Microsoft 365 Defender; policies must be configured via Group Policy or PowerShell.

Question 4mediummatching

Match each Microsoft 365 threat scenario to the appropriate protection.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Anti-phishing policy in Defender for Office 365

Safe Attachments policy

Safe Links policy

Identity Protection and Conditional Access

Data Loss Prevention policy

Question 5easymultiple choice

A company uses hybrid identity with Azure AD Connect and password hash synchronization. They want to enable Self-Service Password Reset (SSPR) with password writeback so that users can reset their on-premises Active Directory passwords. Which Azure AD license is required?

Trap 1: Azure AD Free

Azure AD Free does not include password writeback functionality.

Trap 2: Azure AD Premium P2

Premium P2 also includes writeback, but it is not the minimum required.

Trap 3: Microsoft 365 E3

Microsoft 365 E3 includes Azure AD P1, but the license name is Azure AD Premium P1.

A
Azure AD Free
Why wrong: Azure AD Free does not include password writeback functionality.
B
Azure AD Premium P1
Premium P1 includes password writeback and SSPR with on-premises integration.
C
Azure AD Premium P2
Why wrong: Premium P2 also includes writeback, but it is not the minimum required.
D
Microsoft 365 E3
Why wrong: Microsoft 365 E3 includes Azure AD P1, but the license name is Azure AD Premium P1.

Question 6mediummultiple choice

A company uses Microsoft Entra ID P2 licenses. They want to block all authentication attempts from an internal app that uses legacy authentication protocols (POP3, IMAP, SMTP) because these protocols cannot enforce multi-factor authentication. Which Conditional Access policy setting should be used?

Trap 1: Grant access requiring multi-factor authentication

Legacy authentication clients cannot perform MFA, so this condition would block them, but it's better to explicitly block them via the client apps condition.

Trap 2: Require compliant device

This requires the device to be managed and compliant, but legacy auth clients may not be able to report compliance, and this does not specifically target legacy auth.

Trap 3: Require approved client app

This restricts access to approved apps (e.g., Outlook mobile), but legacy auth protocols are not considered approved apps.

A
Grant access requiring multi-factor authentication
Why wrong: Legacy authentication clients cannot perform MFA, so this condition would block them, but it's better to explicitly block them via the client apps condition.
B
Block access for apps using legacy authentication
Under 'Client apps', you can select 'Exchange ActiveSync clients' and 'Other clients' to block legacy authentication protocols.
C
Require compliant device
Why wrong: This requires the device to be managed and compliant, but legacy auth clients may not be able to report compliance, and this does not specifically target legacy auth.
D
Require approved client app
Why wrong: This restricts access to approved apps (e.g., Outlook mobile), but legacy auth protocols are not considered approved apps.

Question 7hardmultiple choice

A security analyst is investigating a suspected credential theft attack where an attacker attempts to dump credentials from LSASS. Which Attack Surface Reduction (ASR) rule should the administrator enable to block this activity from untrusted processes?

Trap 1: Block Office applications from creating child processes

This rule prevents Office apps from creating child processes, which may be used in macro-based attacks but does not specifically block LSASS access.

Trap 2: Block executable files from running unless they meet a prevalence,…

This rule controls execution of untrusted executables, not direct access to LSASS.

Trap 3: Block Adobe Reader from creating child processes

This rule is specific to Adobe Reader and child processes, not related to LSASS credential theft.

A
Block credential stealing from the Windows local security authority subsystem (lsass.exe)
This rule prevents untrusted processes from reading LSASS memory, directly blocking credential dumping.
B
Block Office applications from creating child processes
Why wrong: This rule prevents Office apps from creating child processes, which may be used in macro-based attacks but does not specifically block LSASS access.
C
Block executable files from running unless they meet a prevalence, age, or trusted list criterion
Why wrong: This rule controls execution of untrusted executables, not direct access to LSASS.
D
Block Adobe Reader from creating child processes
Why wrong: This rule is specific to Adobe Reader and child processes, not related to LSASS credential theft.

Question 8mediummultiple choice

An organization uses Microsoft Entra ID P2 licenses. They need to require multi-factor authentication (MFA) for all users accessing a critical financial application, but they must exclude a set of service accounts that are members of the 'Service Accounts' group. Which policy should they create?

Trap 1: An Identity Protection user risk policy configured to require MFA…

User risk policy is based on risk level, not application targeting, and cannot exclude specific groups easily.

Trap 2: Per-user MFA enforced on all users, then disabled for the service…

Per-user MFA is legacy and not recommended; it does not support application-specific exclusions and is harder to manage.

Trap 3: Conditional Access sign-in risk policy requiring MFA for risky…

Sign-in risk policy is risk-based and does not target a specific application or allow static group exclusions for all users.

A
Conditional Access policy with a grant block requiring MFA and an exclude assignment for the 'Service Accounts' group.
Conditional Access can target the application and exclude specific groups, ensuring service accounts are not prompted for MFA.
B
An Identity Protection user risk policy configured to require MFA for high-risk users.
Why wrong: User risk policy is based on risk level, not application targeting, and cannot exclude specific groups easily.
C
Per-user MFA enforced on all users, then disabled for the service accounts individually.
Why wrong: Per-user MFA is legacy and not recommended; it does not support application-specific exclusions and is harder to manage.
D
Conditional Access sign-in risk policy requiring MFA for risky sign-ins.
Why wrong: Sign-in risk policy is risk-based and does not target a specific application or allow static group exclusions for all users.

Question 9hardmulti select

You are planning a Microsoft 365 tenant migration from another tenant. You need to migrate email, OneDrive, and SharePoint content. Which THREE tools or methods can you use to migrate data?

Trap 1: Microsoft Teams admin center

Teams admin center does not migrate data.

Trap 2: Exchange Admin Center migration tools

Only covers email migration.

A
Microsoft 365 Migration Manager
Supports email, OneDrive, and SharePoint migration.
B
Microsoft Teams admin center
Why wrong: Teams admin center does not migrate data.
C
Third-party migration tool (e.g., BitTitan MigrationWiz)
Third-party tools can migrate all workloads.
D
Exchange Admin Center migration tools
Why wrong: Only covers email migration.
E
PowerShell scripts using Microsoft Graph API
PowerShell can automate data migration via Graph API.

Question 10hardmultiple choice

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that automatically blocks downloads of files containing sensitive information from SharePoint Online to unmanaged devices. What type of policy should you create?

Trap 1: Microsoft Purview Data Loss Prevention policy

Incorrect: While DLP can block, the scenario specifically asks for Defender for Cloud Apps.

Trap 2: Activity policy

Incorrect: Activity policies detect anomalous activities but do not block downloads.

Trap 3: File policy

Incorrect: File policies alert on files but do not block downloads in real-time.

A
Session policy
Correct: Session policies can block downloads based on content inspection.
B
Microsoft Purview Data Loss Prevention policy
Why wrong: Incorrect: While DLP can block, the scenario specifically asks for Defender for Cloud Apps.
C
Activity policy
Why wrong: Incorrect: Activity policies detect anomalous activities but do not block downloads.
D
File policy
Why wrong: Incorrect: File policies alert on files but do not block downloads in real-time.

Question 11hardmultiple choice

You create a custom detection rule in Microsoft Defender XDR using the KQL query shown in the exhibit. The rule is intended to detect lateral movement via SMB. After deploying the rule, you notice that it generates many false positives from legitimate administrative activity. What is the most effective way to reduce false positives?

Exhibit

Refer to the exhibit.
```json
{
  "displayName": "Custom Detection - Lateral Movement via SMB",
  "queryText": "DeviceNetworkEvents | where RemotePort == 445 and ActionType == 'ConnectionSuccess' | join kind=inner (DeviceProcessEvents | where FileName == 'powershell.exe') on DeviceId | project Timestamp, DeviceName, AccountName, RemoteIP"
}
```

Trap 1: Filter for only inbound SMB connections

Lateral movement often uses outbound connections.

Trap 2: Remove the join with DeviceProcessEvents

This would remove the correlation that defines lateral movement.

Trap 3: Increase the time window of the query

This would likely increase false positives.

A
Filter for only inbound SMB connections
Why wrong: Lateral movement often uses outbound connections.
B
Remove the join with DeviceProcessEvents
Why wrong: This would remove the correlation that defines lateral movement.
C
Add a filter to exclude specific administrative accounts or IP ranges
Excluding known good activity reduces false positives.
D
Increase the time window of the query
Why wrong: This would likely increase false positives.

Question 12hardmultiple choice

You are reviewing a Conditional Access policy JSON for your Microsoft Entra ID tenant. The first policy blocks access from high-risk IP addresses. The second policy requires MFA for all users from trusted locations. You notice that users from high-risk IP addresses are still prompted for MFA instead of being blocked. What is the most likely cause?

Exhibit

Refer to the exhibit.

{
  "rules": [
    {
      "name": "Block High Risk IP",
      "id": "12345678-1234-1234-1234-123456789012",
      "priority": "1",
      "action": "BlockAccess",
      "conditions": {
        "applications": ["All"],
        "clientType": "All",
        "devicePlatforms": ["All"],
        "locations": ["HighRiskIP"]
      },
      "grantControls": null
    },
    {
      "name": "Require MFA for External Users",
      "id": "87654321-4321-4321-4321-210987654321",
      "priority": "2",
      "action": "GrantAccess",
      "conditions": {
        "applications": ["All"],
        "clientType": "All",
        "devicePlatforms": ["All"],
        "locations": ["AllTrusted"]
      },
      "grantControls": {
        "builtInControls": ["mfa"]
      }
    }
  ]
}

Trap 1: The block policy does not specify MFA, so it is ignored.

Block policies do not require MFA to block.

Trap 2: The block policy has a lower priority than the grant policy.

Priority 1 is higher than 2, so block should apply first.

Trap 3: The grant policy requires MFA for all users, overriding the block.

Block policies take precedence over grant policies when both apply.

A
The block policy does not specify MFA, so it is ignored.
Why wrong: Block policies do not require MFA to block.
B
The block policy is set to report-only mode, so it is not enforced.
If report-only, the policy logs but doesn't block, so the grant policy applies.
C
The block policy has a lower priority than the grant policy.
Why wrong: Priority 1 is higher than 2, so block should apply first.
D
The grant policy requires MFA for all users, overriding the block.
Why wrong: Block policies take precedence over grant policies when both apply.

Question 13mediummulti select

Your organization is deploying Microsoft Purview Data Lifecycle Management to manage data retention and deletion. You need to design a retention policy for SharePoint Online sites that automatically deletes documents after 7 years, but allows users to manually delete documents earlier if needed. Which THREE actions should you take? (Select THREE.)

Trap 1: Set a default retention label for the SharePoint document library.

A default label would automatically apply, overriding manual control.

Trap 2: Create a file plan in Microsoft Purview Records Management for the…

File plans are for records management, not general retention.

A
Create a retention policy with a retention rule that retains content for 7 years and then deletes it.
This policy meets the 7-year requirement.
B
Set a default retention label for the SharePoint document library.
Why wrong: A default label would automatically apply, overriding manual control.
C
Use preservation lock to prevent users from modifying the retention policy.
Preservation lock prevents changes to the policy.
D
Create a file plan in Microsoft Purview Records Management for the documents.
Why wrong: File plans are for records management, not general retention.
E
Configure a retention label that allows manual deletion and publish it to SharePoint.
Users can apply the label to documents they want to delete early.