Microsoft Cybersecurity Architect SC-100 Questions 76–150 | Page 2/3

Multi-Selecthard

A company is implementing a Zero Trust security model using Microsoft 365 Defender. Which THREE of the following are key principles they should follow?

Select 3 answers

A.Trust all traffic originating from within the corporate network.

B.Use least privilege access by limiting user permissions with Just-In-Time and Just-Enough-Access.

C.Provide implicit trust to known users and devices.

D.Assume breach and segment access to minimize blast radius.

E.Verify explicitly based on all available data points (user, device, location, etc.).

AnswersB, D, E

Minimizes the blast radius of a breach.

Why this answer

Zero Trust mandates least privilege access, and Microsoft 365 Defender integrates with Azure AD Privileged Identity Management (PIM) to enforce Just-In-Time (JIT) and Just-Enough-Access (JEA) policies. This ensures users receive only the permissions necessary for a specific task, for a limited duration, reducing the risk of lateral movement and privilege escalation.

Exam trap

The trap here is that candidates often confuse Zero Trust with traditional perimeter-based security, mistakenly believing that internal network origin or known user status should be trusted implicitly, when in fact Zero Trust requires explicit verification for every access request regardless of source.

Full explanation →

MCQeasy

You are designing an incident response plan for a company using Microsoft Defender XDR. The team needs to automatically notify the SOC via email when an incident of high severity is created. What should you use?

A.Modify the analytics rule to send an email when an alert fires.

B.Create a playbook that sends an email when an incident is created.

C.Configure an automation rule with an action to send an email notification.

D.Use advanced hunting to query high severity incidents and send email.

AnswerC

Configuring an automation rule with an action to send an email notification is the correct approach in Microsoft Sentinel for alerting on incident creation. Automation rules are specifically designed to handle incident lifecycle events (created, updated, etc.) and can perform one or more actions immediately, without needing an external logic app. The 'Send Email' action directly sends an email to a specified recipient, using configured SMTP or Microsoft 365 settings, and can include incident details in the body. This method is natively supported, requires minimal setup, and ensures timely notification whenever an incident meets the condition (e.g., high severity).

Why this answer

Automation rules in Microsoft Defender XDR are specifically designed to trigger automated actions—including sending email notifications—when an incident is created or updated. Unlike playbooks, automation rules can directly send email without requiring a Logic Apps connector, and they operate natively within the Defender portal's incident lifecycle.

Exam trap

The trap here is that candidates often confuse Microsoft Defender XDR automation rules with Microsoft Sentinel playbooks or analytics rules, assuming that playbooks are the only way to send email, when in fact Defender XDR has a built-in email notification action within automation rules.

How to eliminate wrong answers

Option A is wrong because analytics rules are used in Microsoft Sentinel, not Microsoft Defender XDR; Defender XDR uses detection rules, and modifying an analytics rule would not apply to Defender incidents. Option B is wrong because a playbook (Logic Apps) can send email but requires additional configuration and licensing, and is not the simplest or most direct method for email notification on incident creation. Option D is wrong because advanced hunting is a query tool for threat hunting and does not have native capabilities to automatically send email notifications; it would require custom scripting and external integration.

Full explanation →

Multi-Selecthard

Which THREE of the following are key components of a security operations strategy according to Microsoft's best practices?

Select 3 answers

A.Detection and analysis

B.Preparation including playbooks and training

C.Microsoft Sentinel deployment

D.Post-incident activity (containment, eradication, recovery)

E.Policy and standards development

AnswersA, B, D

Detection and analysis is the core of security operations, identifying and investigating threats.

Why this answer

Detection and analysis is a core component of a security operations strategy because it defines how security events are identified, triaged, and investigated. Microsoft's NIST-based SOC maturity model emphasizes continuous monitoring and analytics (e.g., using Microsoft Sentinel analytics rules, UEBA, and threat intelligence) to reduce mean time to detect (MTTD). Without robust detection and analysis, an organization cannot effectively respond to threats.

Exam trap

The trap here is confusing a specific Microsoft product (Sentinel) with a strategic component of the security operations lifecycle, leading candidates to select a tool name instead of the process phase it supports.

Full explanation →

MCQhard

You are a security architect for a global financial services company. The company is adopting Microsoft Sentinel as its primary SIEM and Microsoft Defender XDR for endpoint, email, and identity protection. The company has a hybrid environment with on-premises Active Directory and Microsoft Entra ID. The SOC team needs to be able to investigate incidents that involve lateral movement between on-premises and cloud resources. Additionally, the company must comply with GDPR, requiring that personal data be protected and that data residency requirements are met: all security logs for EU users must remain within the EU. The company already has a Microsoft Sentinel workspace in the West Europe region. You need to design a solution that meets these requirements while minimizing administrative overhead. What should you do?

A.Deploy Azure Arc on on-premises servers and use Azure Policy to enforce log collection to the West Europe workspace.

B.Use the existing West Europe Sentinel workspace and ensure that all EU user logs are sent to that workspace via diagnostic settings.

C.Create a new Sentinel workspace in the EU region for EU logs and a separate workspace for non-EU logs.

D.Deploy a separate Sentinel workspace in each region where you have users.

AnswerB

Correct. A single Sentinel workspace can collect logs from multiple regions. By using the existing West Europe workspace and configuring diagnostic settings to send all EU user logs there, data residency requirements are met with minimal administrative overhead.

Why this answer

A single Microsoft Sentinel workspace in West Europe can collect logs from multiple regions via diagnostic settings, satisfying GDPR data residency by keeping EU logs within the EU. This minimizes administrative overhead. Option A is incorrect because Azure Arc does not address data residency and adds unnecessary complexity.

Option C is incorrect because creating a separate workspace increases overhead without benefit, as the existing workspace meets requirements. Option D is incorrect because per-region workspaces greatly increase administrative overhead.

Full explanation →

MCQhard

Contoso, a healthcare provider, is deploying a new patient portal on Azure App Service that stores electronic health records (EHR) in Azure Cosmos DB for NoSQL. The solution must comply with HIPAA and HITRUST. You need to ensure that data is encrypted at rest and in transit, and that access is restricted based on user roles. Cosmos DB must be configured with a private endpoint to prevent public internet access. You plan to use Azure Key Vault to manage encryption keys. Additionally, the application will access Cosmos DB using a system-assigned managed identity. Which of the following is the most complete and secure design?

A.Enable encryption at rest using service-managed keys, enforce TLS 1.2, configure a service endpoint for Cosmos DB, and grant the managed identity access using Cosmos DB built-in roles (e.g., Cosmos DB Built-in Data Contributor).

B.Disable encryption at rest to improve performance, enforce TLS 1.2, configure a private endpoint, and use the managed identity with a read-write key in Azure Key Vault.

C.Enable encryption at rest using service-managed keys, enforce TLS 1.2, configure a firewall to allow only the App Service outbound IP, and use read-write keys in application settings.

D.Enable encryption at rest using a customer-managed key in Azure Key Vault, enforce TLS 1.2, configure a private endpoint for Cosmos DB, and grant the managed identity access via Azure RBAC with a custom role that allows read/write to specific containers.

AnswerD

CMK provides key control, private endpoint isolates network, managed identity eliminates key management, and RBAC provides fine-grained access.

Why this answer

It provides the most comprehensive security for HIPAA/HITRUST compliance. Customer-managed keys in Azure Key Vault give Contoso control over encryption keys, which is required by HIPAA. TLS 1.2 ensures encryption in transit.

A private endpoint for Cosmos DB prevents public internet access, offering better isolation than service endpoints or firewall rules. Finally, granting the managed identity access via Azure RBAC with a custom role allows granular, least-privilege access to specific containers, which is more secure than using built-in roles or connection strings. Option A is wrong because service-managed keys do not provide the key control required for HIPAA, and service endpoints are less secure than private endpoints.

Option B is wrong because disabling encryption at rest is a security risk and contrary to compliance requirements; also, storing a read-write key in Key Vault (to be retrieved by the app) is less secure than using managed identity with RBAC. Option C is wrong because firewall rules are less secure than private endpoints, and storing read-write keys in application settings is a security risk.

Full explanation →

MCQhard

A large enterprise is designing a secure infrastructure for a multi-region application deployment. They have a hub-spoke topology in two Azure regions (East US and West US) with VNet peering between the hubs. Each region has a shared services spoke containing Azure AD Domain Services (AAD DS) and management jump boxes. Application spokes in each region host VMs that need to authenticate to the local AAD DS. The company mandates that all traffic between regions must traverse a network virtual appliance (NVA) for inspection, except for Azure management traffic. They also require that all outbound internet traffic from application VMs goes through a single Azure Firewall in the East US hub. They have deployed ExpressRoute to on-premises. Currently, application VMs in West US cannot authenticate to the local AAD DS. What is the most likely cause?

A.The Azure Firewall in East US is not configured to allow traffic from West US to AAD DS.

B.The VNet peering between East and West US hubs is not properly configured with 'Allow forwarded traffic' enabled.

C.The ExpressRoute circuit is down, causing traffic to be routed over the internet.

D.The route table for the West US application spoke has a default route (0.0.0.0/0) pointing to the NVA, causing traffic to AAD DS to be sent across regions.

AnswerD

The route table on the West US application spoke's subnet contains a default route (0.0.0.0/0) that specifies the NVA as the next hop, overriding Azure's system default route. When the application resolves the AAD DS domain name, it receives a private IP address in the East US VNet, and because the default route matches all destinations, the traffic is sent to the NVA instead of being routed directly via the established VNet peering or hub. If the NVA is not configured to forward traffic to the East US region, or if it sends it over the internet or a different path, the traffic never reaches AAD DS while return traffic may arrive via a different route, causing asymmetric routing and session failures. The correct fix is to add a more specific route for the AAD DS IP range pointing to the East US hub or directly to the peered VNet, ensuring traffic stays within the Azure backbone and avoids the unintended NVA detour.

Why this answer

The most likely cause is that the route table for the West US application spoke has a default route (0.0.0.0/0) pointing to the NVA. This forces all outbound traffic, including traffic destined for the local AAD DS (which resides in the same region's shared services spoke), to be routed through the NVA and potentially across regions via the hub peering, rather than staying within the local VNet. Since AAD DS requires low-latency, direct connectivity within the same region, this misrouting prevents authentication.

Exam trap

The trap here is that candidates often assume the Azure Firewall or VNet peering is misconfigured, but the real issue is a routing override that forces local traffic through a non-local path, a classic 'asymmetric routing' or 'forced tunneling' pitfall in multi-region hub-spoke topologies.

How to eliminate wrong answers

Option A is wrong because the Azure Firewall in East US only inspects outbound internet traffic from application VMs; it does not handle intra-region traffic between West US application VMs and West US AAD DS, so its configuration is irrelevant to this issue. Option B is wrong because VNet peering between hubs is used for inter-region traffic, but the problem is that traffic is being forced across regions unnecessarily; the peering itself is likely functional, but the routing misdirects traffic. Option C is wrong because ExpressRoute is used for on-premises connectivity, not for Azure-to-Azure traffic between regions or within a region; its status does not affect local AAD DS authentication.

Full explanation →

MCQhard

Your organization uses Microsoft Defender XDR for detection and response. You need to create a custom detection rule that alerts when a user performs more than 10 failed sign-ins from different countries within 5 minutes. Which component should you use?

A.Automation rule in Microsoft Sentinel

B.Custom detection rule in Microsoft 365 Defender

C.Analytics rule in Microsoft Sentinel

D.Attack simulation training

AnswerB

Custom detection rules in Microsoft Defender XDR leverage Advanced Hunting Kusto Query Language (KQL) queries to continuously monitor event data across email, endpoints, identities, and cloud apps. When the query returns results, the rule triggers an alert and can also create an incident, enabling bespoke detection logic beyond built-in detections. This is the native detection engine for Defender XDR, distinct from SIEM-based rules.

Why this answer

Custom detection rules in Microsoft 365 Defender allow you to define advanced hunting queries that trigger alerts based on specific event patterns, such as more than 10 failed sign-ins from different countries within 5 minutes. This is the correct component because it operates directly on data within the Defender XDR ecosystem (e.g., AADSignInEventsBeta) without requiring data ingestion into Sentinel.

Exam trap

The trap here is that candidates confuse Microsoft Sentinel analytics rules (which require data ingestion) with Microsoft 365 Defender custom detection rules (which operate natively on Defender XDR data), leading them to choose Sentinel options when the question explicitly states 'Microsoft Defender XDR' as the platform.

How to eliminate wrong answers

Option A is wrong because automation rules in Microsoft Sentinel are used to automate incident response actions (e.g., assigning ownership or running playbooks), not to define detection logic based on raw event patterns. Option C is wrong because analytics rules in Microsoft Sentinel require data to be ingested into the Sentinel workspace first, whereas the question specifies using Microsoft Defender XDR directly for detection and response. Option D is wrong because attack simulation training is a phishing simulation and security awareness tool, not a detection mechanism for sign-in anomalies.

Full explanation →

MCQeasy

A company uses Azure DevOps for CI/CD. The security team wants to ensure that secrets like API keys and connection strings are never stored in code repositories. Which best practice should they recommend?

A.Use environment variables in the pipeline YAML

B.Use Azure Key Vault references in Azure DevOps variable groups

C.Encrypt secrets using Git-secret and commit to repo

D.Store secrets in Azure App Configuration with encryption

AnswerB

Azure Key Vault references in variable groups are the secure, recommended approach because secrets are stored only in Key Vault and are fetched at pipeline runtime via a managed identity or service principal. This eliminates the need to store secrets in the pipeline definition or repository, and access to the secrets is controlled by Azure role-based access on the Key Vault, allowing fine-grained permissions and auditability. Secrets can also be rotated in Key Vault without modifying the pipeline, and the variable group automatically retrieves the latest value, making this solution both secure and maintainable.

Why this answer

Azure Key Vault references in Azure DevOps variable groups allow secrets to be securely linked to pipelines without ever storing them in code repositories. At pipeline runtime, the agent retrieves the secret value directly from Azure Key Vault using a managed identity or service principal, ensuring secrets are never exposed in YAML files, logs, or build artifacts.

Exam trap

The trap here is that candidates confuse Azure App Configuration (which is for app-level settings) with Azure Key Vault (which is the correct service for secret management in CI/CD pipelines), or they assume that encrypting secrets before committing them is acceptable, when the best practice is to never store secrets in repositories at all.

How to eliminate wrong answers

Option A is wrong because environment variables in pipeline YAML still require the secret value to be defined somewhere in the pipeline definition or as a plain-text variable, which can be exposed in logs or repository history. Option C is wrong because committing encrypted secrets to a repo using Git-secret still stores the encrypted blob in the repository, violating the principle of never storing secrets in code; decryption keys must also be managed, increasing risk. Option D is wrong because Azure App Configuration with encryption is designed for application configuration settings, not for CI/CD pipeline secrets; it lacks native integration with Azure DevOps variable groups and does not support dynamic secret retrieval during pipeline execution.

Full explanation →

MCQhard

A global enterprise uses Microsoft Entra ID with Privileged Identity Management (PIM) and Conditional Access. They need to ensure that all privileged role activations require an approval workflow, and that the approval process is documented for compliance. What configuration should they implement?

A.Create a Conditional Access policy requiring an Authentication Strength

B.In PIM, edit the role settings to require approval for activation

C.Configure an access review for the privileged roles

D.Create a role-assignable group and assign the privileged role to the group

AnswerB

This enforces approval each time a role is activated.

Why this answer

In PIM, you can configure role settings to require approval for activation, which ensures that every privileged role activation goes through an approval workflow and is documented in audit logs. Option A is incorrect because Authentication Strength in Conditional Access enforces MFA, not approval. Option C is incorrect because access reviews are for periodic attestation, not for per-activation approval.

Option D is incorrect because role-assignable groups allow group-based role assignments but do not enforce an approval workflow for activation.

Full explanation →

MCQhard

A financial services organization is designing a zero-trust architecture for its Azure environment. They need to ensure that all administrative access to critical systems uses just-in-time (JIT) access and that privileged role assignments are time-bound. Which combination of Microsoft security best practices should they implement?

A.Azure AD Conditional Access and Azure AD Identity Protection

B.Azure Policy and Azure Blueprints

C.Azure Sentinel and Azure Workbook

D.Azure AD Privileged Identity Management (PIM) and Azure Bastion

AnswerD

Azure AD Privileged Identity Management (PIM) and Azure Bastion are the correct pair. PIM provides time-bound, approval-required role activation for Azure AD roles and Azure resource roles, eliminating standing privileged access and aligning with zero-trust JIT principles. Azure Bastion enables secure, browser-based RDP/SSH access to virtual machines without public IP exposure, and when combined with Azure Defender for Cloud's JIT VM access, it can further scope access to specific ports and time windows. Together they enable a complete JIT and JEA (just-enough-access) workflow: PIM governs privileged identity elevation, while Bastion enforces a secure, monitored, and ephemeral VM access path.

Why this answer

Azure AD Privileged Identity Management (PIM) provides just-in-time (JIT) activation and time-bound role assignments for privileged roles, directly meeting the requirement for time-bound administrative access. Azure Bastion enables secure, audited RDP/SSH access to Azure VMs without exposing public IP addresses, ensuring that administrative sessions are isolated and monitored. Together, they enforce zero-trust principles by granting ephemeral, scoped access to critical systems.

Exam trap

The trap here is that candidates confuse Azure AD Conditional Access (which controls sign-in conditions) with PIM’s JIT role activation, or they assume Azure Bastion is only a connectivity tool rather than a critical component of zero-trust administrative access.

How to eliminate wrong answers

Option A is wrong because Azure AD Conditional Access and Identity Protection focus on user sign-in risk and session controls, not on time-bound role assignments or JIT access to Azure resources. Option B is wrong because Azure Policy and Blueprints enforce compliance and resource governance (e.g., tagging, allowed locations), but they do not provide JIT activation or time-bound privileged role management. Option C is wrong because Azure Sentinel and Workbooks are for security information and event management (SIEM) and visualization, not for controlling privileged access or session isolation.

Full explanation →

Multi-Selecthard

Which THREE components are required to implement a Zero Trust network architecture using Microsoft Entra Internet Access (formerly Microsoft 365 Network Connectivity)?

Select 3 answers

A.Conditional Access policies

B.Azure AD Application Proxy

C.Site-to-site VPN

D.Microsoft Intune device compliance policies

E.Microsoft Entra Internet Access (Microsoft Global Secure Access)

AnswersA, D, E

Conditional Access policies enforce real-time access decisions based on user, device, location, and risk signals before granting connectivity through Microsoft Entra Internet Access. This satisfies the stem’s requirement for a Zero Trust component by implementing the “explicitly verify” principle—each session is evaluated against policy rather than relying on implicit network trust.

Why this answer

Options A, D, and E are correct. Conditional Access policies enforce access controls based on user, device, and location signals. Microsoft Intune device compliance policies ensure devices meet security requirements before access.

Microsoft Entra Internet Access (formerly Microsoft Global Secure Access) is the core Zero Trust network gateway, providing secure internet and SaaS access. Option B (Azure AD Application Proxy, now Entra Application Proxy) is incorrect because it is designed for publishing legacy on-premises apps, not as a core component of Zero Trust network architecture. Option C (Site-to-site VPN) is incorrect as it represents traditional perimeter-based network access, which Zero Trust aims to replace.

Full explanation →

MCQhard

Your company uses Microsoft Defender for Cloud Apps (MDA). You need to create a policy that automatically suspends a user's access to a cloud app if the user is confirmed as compromised by Microsoft Entra ID Protection. Which policy type should you use?

A.Session policy

B.Access policy

C.App permissions policy

D.Anomaly detection policy

AnswerA

Session policies can use risk from Microsoft Entra ID Protection to block access.

Why this answer

A session policy in Microsoft Defender for Cloud Apps can be configured to take real-time actions based on risk signals from Microsoft Entra ID Protection. When a user is confirmed as compromised, a session policy can enforce automatic suspension of access to cloud apps by blocking the session or requiring reauthentication, directly addressing the requirement.

Exam trap

The trap here is that candidates often confuse session policies with access policies, assuming access policies handle user risk-based suspension, but access policies lack the real-time session control and direct Entra ID Protection integration that session policies provide.

How to eliminate wrong answers

Option B (Access policy) is wrong because access policies in Defender for Cloud Apps control access based on device, location, or app permissions, but they do not natively integrate with Entra ID Protection's user risk signals to trigger automatic suspension upon compromise confirmation. Option C (App permissions policy) is wrong because it governs OAuth app permissions (e.g., revoking app consent) rather than user-level access suspension based on identity risk. Option D (Anomaly detection policy) is wrong because it detects unusual behavior patterns (e.g., impossible travel) but does not directly respond to a confirmed compromise signal from Entra ID Protection; it generates alerts rather than enforcing automatic access suspension.

Full explanation →

Multi-Selectmedium

A company uses Microsoft Defender for Cloud to assess compliance with Azure Security Benchmark (ASB). The security team wants to ensure that all recommendations are being followed. Which three actions should the team take to manage and remediate recommendations effectively?

Select 3 answers

A.Enable continuous export of compliance data to Log Analytics or Event Hubs.

B.Manually remediate all high-severity recommendations each month.

C.Create exemption rules for resources that are compliant by other means.

D.Enable automatic provisioning of the Log Analytics agent for all supported VMs.

E.Disable recommendations that are not applicable to the environment.

AnswersA, C, D

Continuous export allows for long-term retention and analysis of compliance data.

Why this answer

Enabling continuous export of compliance data to Log Analytics or Event Hubs allows the security team to centralize, query, and monitor compliance data over time. This is essential for tracking the status of all Azure Security Benchmark recommendations, creating custom alerts, and integrating with SIEM or automation workflows. Option C is correct because creating exemption rules for resources that are compliant by other means (e.g., via a third-party tool or compensating controls) prevents false positives and reduces alert fatigue while maintaining accurate compliance posture.

Option D is correct because enabling automatic provisioning of the Log Analytics agent ensures that all supported VMs are monitored and can report their compliance status, which is a foundational requirement for many ASB recommendations. Options B and E are incorrect: manual monthly remediation is not scalable or continuous, and disabling recommendations should be done via exemptions rather than outright disabling to maintain auditability.

Exam trap

The trap here is that candidates may think manual monthly remediation (Option B) is sufficient for compliance, but the SC-100 exam emphasizes continuous, automated monitoring and remediation as a core principle of a secure operations strategy.

Full explanation →

MCQhard

Your company is designing a Zero Trust network for a hybrid workforce. Remote users connect via VPN to on-premises resources, while cloud apps use Microsoft Entra ID. You need to enforce conditional access based on device compliance and user risk. Which Microsoft security solution should you integrate with Entra ID to provide real-time device posture signals?

A.Microsoft Purview

B.Microsoft Intune

C.Microsoft Defender for Cloud Apps

D.Microsoft Sentinel

AnswerB

Correct. Microsoft Intune manages device compliance policies and integrates with Entra ID Conditional Access to enforce access based on device compliance and user risk.

Why this answer

Microsoft Intune provides device compliance policies and can send device posture signals to Entra ID Conditional Access. With Intune, you can enforce device health and compliance requirements before granting access. Option A is wrong because Microsoft Purview focuses on data governance and compliance, not device management.

Option C is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) and does not directly manage device compliance. Option D is wrong because Microsoft Sentinel is a security information and event management (SIEM) solution and does not provide device posture signals.

Full explanation →

MCQhard

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. What is the purpose of this query?

A.Correlate malware alerts with device OS version

B.List all malware alerts in the last 7 days

C.Identify malware alerts on unmanaged devices

D.Show device inventory for unmanaged devices

AnswerC

Exactly: filters on IsManaged == false.

Why this answer

The query uses the `DeviceInfo` table to filter for devices where `IsManaged` is `false`, then joins with `SecurityAlert` to find alerts where `AlertName` contains 'Malware'. This specifically identifies malware alerts generated on unmanaged devices, not all malware alerts or a general device inventory.

Exam trap

The trap here is that candidates may confuse the purpose of the query as simply listing all malware alerts (Option B) or showing device inventory (Option D), overlooking the critical `IsManaged == false` filter that narrows the scope to unmanaged devices.

How to eliminate wrong answers

Option A is wrong because the query does not correlate malware alerts with device OS version; it only filters on `IsManaged` and `AlertName`, with no reference to OS version fields. Option B is wrong because the query does not list all malware alerts in the last 7 days; it restricts results to alerts on unmanaged devices (IsManaged == false) and does not include a time filter for the last 7 days. Option D is wrong because the query returns alerts, not a device inventory; the output includes alert details (e.g., AlertName, TimeGenerated) rather than a list of devices.

Full explanation →

MCQhard

Refer to the exhibit. You are an Azure security engineer reviewing a custom Azure Policy definition. The policy is intended to audit virtual machines to ensure they have the Azure Security extension installed. However, the policy is not triggering on any resources. What is the most likely reason?

A.The policy condition requires a managed disk, but the VMs might have unmanaged disks.

B.The 'existenceCondition' field path is incorrect; it should be 'Microsoft.Compute/virtualMachines/extensions/publisher'.

C.The policy is assigned to a management group, but the VMs are in a subscription under a different management group.

D.The policy effect should be 'Deny' instead of 'auditIfNotExists'.

AnswerA

The policy definition's 'if' clause matches only VMs that have a managed disk (e.g., by checking that the 'managedDisk' property is present). VMs that still use unmanaged disks do not satisfy this condition, so the 'auditIfNotExists' effect is never evaluated for them. Consequently, the policy silently ignores the very machines that likely need the missing-extension audit, making the compliance report incomplete rather than identifying all noncompliant VMs.

Why this answer

The policy condition uses `field` to check for `Microsoft.Compute/virtualMachines/storageProfile.osDisk.managedDisk.id`, which requires the VM to have a managed disk. If the VMs use unmanaged disks (i.e., the `managedDisk` property is absent), the condition evaluates to false, and the `auditIfNotExists` effect never triggers the existence check for the Azure Security extension.

Exam trap

The trap here is that candidates focus on the `existenceCondition` or effect syntax, overlooking that the parent `field` condition silently fails on VMs without managed disks, preventing the entire policy from evaluating.

How to eliminate wrong answers

Option B is wrong because the `existenceCondition` field path `Microsoft.Compute/virtualMachines/extensions/publisher` is syntactically valid for checking the extension's publisher property; the issue is not with the path but with the parent condition failing. Option C is wrong because policy assignment inheritance works correctly across management group hierarchies—if the policy is assigned to a management group, it applies to all descendant subscriptions, so VMs in a child subscription would still be evaluated. Option D is wrong because changing the effect to `Deny` would not fix the triggering issue; the policy is not evaluating resources at all due to the condition, not because of the effect type.

Full explanation →

MCQmedium

Your organization uses Microsoft Sentinel for security operations. You need to ensure that an attacker cannot disable data collection by deleting the diagnostic settings on the Sentinel workspace. What should you configure?

A.Enable Sentinel's workspace deletion protection.

B.Assign the Log Analytics Contributor role only to specific users.

C.Apply a CanNotDelete resource lock on the Log Analytics workspace.

D.Create an Azure Policy to audit diagnostic settings.

AnswerC

Applying a CanNotDelete resource lock on the Log Analytics workspace is the only option that actively blocks any delete operation on the workspace and all its child resources, including diagnostic settings. This lock enforces a deny at the Azure Resource Manager level, overriding even elevated RBAC permissions unless a matching delete lock is removed first. As a result, it provides a robust, unbreakable-by-default safeguard that directly prevents the diagnostic settings from being deleted.

Why this answer

Applying a CanNotDelete resource lock on the Log Analytics workspace prevents any user or process, including an attacker, from deleting the workspace or its diagnostic settings. This lock overrides all role-based permissions, ensuring that even if an attacker gains high-privileged access, they cannot remove the diagnostic settings that stream telemetry to Microsoft Sentinel. Sentinel's data collection relies entirely on these diagnostic settings, so protecting them with a resource lock is the most direct and effective defense against deletion attacks.

Exam trap

The trap here is that candidates confuse workspace deletion protection (which only prevents workspace deletion) with diagnostic settings deletion protection, or they assume that RBAC alone (Option B) is sufficient to block a privileged attacker, when in fact a resource lock is the only control that enforces a hard deny on deletion regardless of permissions.

How to eliminate wrong answers

Option A is wrong because Sentinel's workspace deletion protection only prevents the accidental deletion of the Sentinel workspace itself, not the deletion of diagnostic settings on that workspace; an attacker could still remove the diagnostic settings and stop data ingestion without deleting the workspace. Option B is wrong because assigning the Log Analytics Contributor role only to specific users limits who can modify the workspace, but it does not prevent an attacker with compromised credentials or a privileged user from deleting diagnostic settings; role-based access control (RBAC) alone is insufficient against a determined attacker with elevated permissions. Option D is wrong because creating an Azure Policy to audit diagnostic settings only reports on compliance (e.g., whether settings exist) but does not block deletion; it provides no preventive control and cannot stop an attacker from removing the settings in real time.

Full explanation →

Multi-Selectmedium

Which THREE capabilities are provided by Microsoft Defender for Cloud Apps (MDA) when integrated with Microsoft Defender XDR?

Select 3 answers

A.Email protection against phishing and malware.

B.Discovery of shadow IT cloud apps.

C.App permissions and OAuth app governance.

D.Endpoint detection and response (EDR) for devices.

E.Conditional access session controls for cloud apps.

AnswersB, C, E

MDA discovers apps used in the organization.

Why this answer

Microsoft Defender for Cloud Apps (MDA) integrates with Microsoft Defender XDR to provide shadow IT discovery by analyzing traffic logs from network devices and cloud app catalogs, identifying unsanctioned cloud applications used in the organization. This capability is core to MDA's Cloud Discovery feature, which uses log parsing and machine learning to detect and classify shadow IT.

Exam trap

The trap here is that candidates often confuse the capabilities of Microsoft Defender for Cloud Apps with those of other Microsoft Defender XDR components, such as Defender for Office 365 (email security) or Defender for Endpoint (EDR), leading them to select options that are valid security features but not provided by MDA.

Full explanation →

MCQhard

Your organization uses Microsoft Defender XDR to correlate alerts across endpoints, email, and identities. You need to create a custom detection rule that triggers when a user receives a phishing email and then attempts to log in from a new location. Which approach should you use?

A.Use Advanced Hunting to create a custom detection rule

B.Create a custom detection rule in Microsoft Defender for Endpoint

C.Use an automation rule in Microsoft Defender XDR

D.Create an analytics rule in Microsoft Sentinel

AnswerA

Advanced Hunting is the XDR-native KQL query interface spanning the unified Defender XDR data schema, including endpoint, email, identity, and cloud app tables. By saving an advanced hunting query as a custom detection rule, Defender XDR continuously evaluates cross-domain signals and generates alerts, making it the correct mechanism for correlating evidence from multiple sources.

Why this answer

Advanced Hunting in Microsoft Defender XDR allows you to write Kusto Query Language (KQL) queries that correlate events across multiple data tables (e.g., EmailEvents, IdentityLogonEvents). You can then create a custom detection rule from that query, which will trigger an alert when a user receives a phishing email and subsequently logs in from a new location, enabling cross-domain correlation within Defender XDR.

Exam trap

The trap here is that candidates often confuse the scope of custom detection rules in Defender for Endpoint (endpoint-only) with the cross-domain capability of Advanced Hunting in Defender XDR, or they mistakenly think automation rules can create new detection logic rather than just automate responses to existing alerts.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Endpoint custom detection rules are limited to endpoint data (e.g., DeviceEvents, DeviceProcessEvents) and cannot query email or identity events, so they cannot correlate a phishing email with a login from a new location. Option C is wrong because automation rules in Microsoft Defender XDR are designed to automate responses (e.g., isolate a device, block an IP) based on existing alerts, not to create new detection logic that correlates raw events across different data sources. Option D is wrong because analytics rules in Microsoft Sentinel are used for SIEM-style detection across multiple data sources ingested into Sentinel, but the question specifies using Microsoft Defender XDR (not Sentinel) to correlate alerts, and Sentinel requires separate licensing and data ingestion pipelines.

Full explanation →

Multi-Selecthard

Your organization is implementing Microsoft Defender for Identity to protect on-premises Active Directory. Which THREE activities does Defender for Identity monitor?

Select 3 answers

A.Privilege escalation attempts

B.Lateral movement paths using Pass-the-Hash

C.File integrity changes on domain controllers

D.Reconnaissance attacks using LDAP queries

E.Network traffic to external IP addresses

AnswersA, B, D

Defender for Identity monitors for privilege escalation.

Why this answer

Correct answers: A, B, D. Defender for Identity monitors privilege escalation attempts (A) by detecting suspicious changes in user privileges. Lateral movement paths using Pass-the-Hash (B) are detected by analyzing network activity and authentication patterns.

Reconnaissance attacks using LDAP queries (D) are identified by unusual LDAP search patterns. Option C is incorrect: file integrity changes on domain controllers are monitored by Defender for Servers or Azure Policy, not Defender for Identity. Option E is incorrect: network traffic to external IP addresses is monitored by Defender for Network or network security groups, not Defender for Identity.

Exam trap

A common trap is confusing file integrity monitoring with identity-based monitoring. Defender for Identity focuses on user behaviors and authentication patterns, not file changes.

Full explanation →

MCQhard

You are a security architect for a large financial services company. The company has a hybrid identity environment with on-premises Active Directory synchronized to Microsoft Entra ID using Microsoft Entra Connect. They use Microsoft 365 E5 licenses and have deployed Microsoft Defender for Cloud, Microsoft Defender for Identity, Microsoft Sentinel, and Microsoft Purview. The company has recently suffered a ransomware attack where an attacker gained access via a compromised service account that had permanent Global Administrator privileges. The attacker then used the account to create a backdoor user and exfiltrate sensitive data from SharePoint Online. After the incident, the CISO mandates a Zero Trust security transformation with the following requirements: 1. Eliminate standing privileged access for all cloud admins. 2. Require phishing-resistant authentication for all privileged roles. 3. Ensure that all sensitive data in SharePoint Online is automatically classified and protected. 4. Enable detection of lateral movement using anomalous behavior analytics. Which combination of actions should you recommend?

A.Implement Privileged Identity Management (PIM) for Global Administrator roles, configure Authentication Strengths to require FIDO2, create auto-labeling policies for credit card numbers, and enable Defender for Identity lateral movement path detection.

B.Deploy Microsoft Entra Identity Protection for all users, configure Azure AD Conditional Access with MFA, use Microsoft Purview Information Protection with manual labeling, and enable Microsoft Sentinel analytics for lateral movement.

C.Configure Conditional Access to require MFA for admins, enable Microsoft Purview DLP for SharePoint, deploy Defender for Cloud Apps, and use Identity Protection for user risk.

D.Remove all permanent admin roles and use just-in-time access via PIM, enforce MFA via Conditional Access, apply sensitivity labels via Microsoft Purview Data Map, and use Microsoft Defender for Cloud for network security groups.

AnswerA

Privileged Identity Management removes standing Global Administrator access and activates roles just-in-time with approval, time limits, and audit trail, meeting the privileged access requirement. Configuring Authentication Strengths to require FIDO2 enforces phishing-resistant MFA specifically for activation and sign-in, satisfying the hardened MFA mandate. Auto-labeling policies for credit card numbers apply sensitivity labels automatically based on sensitive info types, ensuring data protection without manual effort. Defender for Identity lateral movement path detection analyzes entity activities to expose vulnerable paths attackers could exploit, fulfilling the lateral movement detection requirement.

Why this answer

It directly addresses all four CISO requirements: Privileged Identity Management (PIM) eliminates standing Global Administrator privileges by requiring just-in-time activation; Authentication Strengths with FIDO2 enforces phishing-resistant authentication for privileged roles; auto-labeling policies in Microsoft Purview automatically classify and protect sensitive data like credit card numbers in SharePoint Online; and Defender for Identity lateral movement path detection uses behavioral analytics to detect anomalous lateral movement, fulfilling the detection requirement.

Exam trap

The trap here is that candidates often confuse MFA (which can be phishable) with phishing-resistant authentication (e.g., FIDO2 or certificate-based), and they may overlook that automatic classification requires auto-labeling policies, not manual labeling or data discovery tools like Data Map.

How to eliminate wrong answers

Option B is wrong because it relies on manual labeling instead of automatic classification, which fails to meet the requirement for automatic protection of sensitive data in SharePoint Online; additionally, Identity Protection does not provide lateral movement detection. Option C is wrong because it only enforces MFA via Conditional Access, which is not phishing-resistant (e.g., it allows TOTP or phone call verification), and it lacks automatic data classification and lateral movement detection. Option D is wrong because it enforces MFA via Conditional Access instead of phishing-resistant authentication (e.g., FIDO2), and it uses Microsoft Defender for Cloud for network security groups, which does not address lateral movement detection; Purview Data Map is for data discovery, not automatic classification and protection.

Full explanation →

MCQmedium

A company uses Microsoft Entra ID for identity management. They want to ensure that only managed devices can access corporate email. Which Conditional Access policy setting should be configured?

A.Require multifactor authentication

B.Block legacy authentication

C.Require approved client app

D.Require device to be marked as compliant

AnswerD

This ensures only managed and compliant devices can access.

Why this answer

To ensure only managed devices can access corporate email, you need to enforce device compliance. The Conditional Access policy setting 'Require device to be marked as compliant' checks that the device is enrolled in Microsoft Intune and meets all compliance policies (e.g., encryption, OS version, jailbreak detection) before granting access. This directly restricts access to managed devices only.

Exam trap

The trap here is that candidates often confuse 'Require device to be marked as compliant' with 'Require approved client app' or 'Require multifactor authentication,' thinking that MFA or app approval alone ensures device management, but only compliance enforcement ties directly to Intune-managed device policies.

How to eliminate wrong answers

Option A is wrong because requiring multifactor authentication (MFA) verifies the user's identity but does not enforce any device management or compliance; a personal device with MFA could still access email. Option B is wrong because blocking legacy authentication prevents protocols like POP3, IMAP, or SMTP that don't support modern authentication, but it does not ensure the device is managed or compliant; a managed device using legacy auth would still be blocked, but an unmanaged device using modern auth would not be blocked. Option C is wrong because requiring an approved client app (e.g., Outlook mobile) ensures the app is from a trusted source but does not enforce device management; an unmanaged device with the approved app could still access email.

Full explanation →

MCQmedium

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to prevent users from sharing credit card numbers in email but allow sharing via encrypted email. What should they configure?

A.Assign a sensitivity label that encrypts the email automatically

B.Create a Microsoft Purview Message Encryption policy

C.Configure a DLP rule that blocks sharing unless the email is encrypted, with user override

D.Use Exchange mail flow rules to block unencrypted credit card data

AnswerC

To enforce that unencrypted emails containing credit card data are blocked, you need a Microsoft Purview DLP rule. The rule can include the condition "Content contains" the sensitive info type for credit card numbers, and an action to "Block" the message if it is not encrypted, with an option to allow users to override the block for legitimate business needs. DLP integrates with Exchange Online to inspect the message in transit and conditionally allow encrypted messages as an exception, directly addressing the stated requirement, whereas proactive encryption strategies alone cannot guarantee compliance.

Why this answer

Microsoft Purview DLP can enforce a policy that blocks sharing of credit card numbers unless the email is encrypted, with a user override option to allow legitimate encrypted sharing. This directly meets the requirement to prevent unencrypted sharing while permitting encrypted email transmission, leveraging DLP's ability to inspect email content and conditionally apply actions based on encryption status.

Exam trap

The trap here is that candidates often confuse DLP's conditional encryption check with Message Encryption policies or mail flow rules, failing to recognize that DLP provides the specific 'unless the email is encrypted' condition and user override capability needed for this requirement.

How to eliminate wrong answers

Option A is wrong because assigning a sensitivity label that encrypts the email automatically does not provide a conditional mechanism to block unencrypted sharing; it would either always encrypt or require manual labeling, failing to prevent users from sending unencrypted credit card data. Option B is wrong because Microsoft Purview Message Encryption is a service that encrypts email messages but does not include DLP rules to block unencrypted sharing; it lacks the policy-driven conditional enforcement needed to prevent non-encrypted transmission. Option D is wrong because Exchange mail flow rules (transport rules) can block or encrypt messages based on patterns, but they do not natively integrate with DLP's sensitive information types for credit card numbers and lack the user override capability that DLP provides for justified business exceptions.

Full explanation →

MCQmedium

A company is migrating its on-premises Active Directory to Microsoft Entra ID. They need to ensure that all user authentication for cloud apps uses passwordless methods. Which security best practice should they implement?

A.Implement Microsoft Entra ID passwordless authentication

B.Configure conditional access policies to block legacy authentication

C.Enable Microsoft Entra ID Privileged Identity Management (PIM)

D.Require multifactor authentication (MFA) for all users

AnswerA

Implementing Microsoft Entra ID passwordless authentication replaces the password with a cryptographic key pair bound to the user's device or a FIDO2 security key. Methods such as Windows Hello for Business, FIDO2 security keys, or the Microsoft Authenticator app's passwordless mode allow authentication through a biometric gesture or PIN, with the private key never leaving the device. This directly eliminates the shared-secret model that attackers can phish or replay, and it aligns with Zero Trust by verifying possession and intent without ever transmitting a password over the network.

Why this answer

The company's requirement is specifically to ensure all user authentication for cloud apps uses passwordless methods. Microsoft Entra ID passwordless authentication (e.g., Windows Hello for Business, FIDO2 security keys, or Microsoft Authenticator) directly eliminates passwords from the authentication flow, aligning with the stated goal. Other options, while enhancing security, do not enforce passwordless authentication.

Exam trap

The trap here is that candidates often confuse 'blocking legacy authentication' or 'requiring MFA' with achieving passwordless authentication, but neither eliminates the password as a factor; only a dedicated passwordless method does.

How to eliminate wrong answers

Option B is wrong because blocking legacy authentication (e.g., POP3, IMAP, SMTP) prevents older protocols that cannot enforce modern authentication, but it does not mandate passwordless methods; users could still authenticate with passwords via modern protocols. Option C is wrong because Microsoft Entra ID Privileged Identity Management (PIM) provides just-in-time privileged access management and does not address user authentication methods for cloud apps. Option D is wrong because requiring multifactor authentication (MFA) adds a second factor but still allows password-based authentication as the first factor, failing to meet the passwordless requirement.

Full explanation →

100

MCQmedium

A company is designing a defense-in-depth strategy for their Azure environment. They want to ensure that if a virtual machine is compromised, the attacker cannot move laterally to other VMs in the same virtual network. Which security control should they prioritize?

A.Enable Azure DDoS Protection on the virtual network

B.Implement network segmentation using NSGs and application security groups

C.Enable multi-factor authentication (MFA) for all admin accounts

D.Deploy Azure Bastion for secure remote access

AnswerB

Implementing network segmentation with Network Security Groups (NSGs) and Application Security Groups (ASGs) explicitly controls east-west traffic by enforcing allow-listed rules based on workload roles, protocols, and ports. NSGs act as distributed firewalls at the subnet and NIC level, while ASGs simplify grouping VMs by function (e.g., web, app, data) so you can deny all traffic by default and permit only required inter-tier flows. This zero-trust network approach directly limits an attacker's ability to move laterally from a compromised VM to other resources, making it the correct defense-in-depth measure for this threat.

Why this answer

Network segmentation using NSGs and application security groups is the correct priority because it directly controls east-west traffic between VMs within the same virtual network. By defining explicit inbound and outbound rules that restrict communication to only necessary ports and protocols (e.g., TCP 443 for HTTPS), an attacker who compromises one VM cannot initiate lateral movement to other VMs, as the NSG will drop unauthorized traffic at the subnet or NIC level.

Exam trap

The trap here is that candidates often confuse network-level controls (NSGs) with identity or access controls (MFA, Bastion) or perimeter defenses (DDoS Protection), failing to recognize that lateral movement is a network traffic problem that requires explicit east-west traffic filtering.

How to eliminate wrong answers

Option A is wrong because Azure DDoS Protection protects against volumetric attacks from the internet, not against lateral movement from a compromised VM inside the same virtual network. Option C is wrong because MFA protects authentication to the Azure portal or management plane, but does not prevent an attacker who already has a foothold on a VM from moving laterally via network traffic. Option D is wrong because Azure Bastion provides secure RDP/SSH access to VMs without exposing public IPs, but once a VM is compromised, Bastion does not restrict the attacker's ability to initiate outbound connections to other VMs in the same network.

Full explanation →

101

MCQmedium

Refer to the exhibit. You are reviewing a Conditional Access policy JSON. What is the effect of this policy?

A.Blocks sign-ins from locations with high sign-in risk

B.Blocks sign-ins from users with high user risk

C.Blocks all sign-ins from any user

D.Requires multifactor authentication for high-risk users

AnswerB

This is the correct interpretation: the policy sets the 'User risk' condition to 'High' and the access control to 'Block.' When a user's risk level, as determined by Microsoft Entra ID Protection detections, is high, the conditional access engine denies the sign-in attempt. Thus, the policy's effective behavior is to block sign-ins from users with high user risk.

Why this answer

The policy JSON specifies `"userRiskLevels": ["high"]` under the conditions block, which means it targets only users whose user risk level is assessed as high by Microsoft Entra ID Protection. The grant control is set to `"builtInControls": ["block"]`, so the policy blocks sign-ins for those high-risk users. Option B is correct because the policy explicitly blocks sign-ins from users with high user risk, not sign-in risk or all users.

Exam trap

Microsoft often tests the distinction between `userRiskLevels` and `signInRiskLevels` in Conditional Access policies, and candidates frequently confuse the two, thinking a high user risk policy blocks sign-in risk events rather than user account risk.

How to eliminate wrong answers

Option A is wrong because the policy uses `userRiskLevels`, not `signInRiskLevels`; sign-in risk levels are a separate property in Conditional Access policies that assess the risk of a specific authentication attempt, not the user account. Option C is wrong because the policy has a condition targeting only high user risk levels, not all users; a block-all policy would omit the risk level condition or use an empty conditions block. Option D is wrong because the grant control is `"block"`, not `"mfa"`; requiring multifactor authentication would use `"mfa"` in the builtInControls array, and the policy does not include any authentication requirement.

Full explanation →

102

MCQhard

You are the security architect for a large financial services company. The company has a hybrid environment with on-premises Active Directory, Azure AD, and multiple Azure subscriptions. They use Microsoft Sentinel as their SIEM and have deployed Microsoft Defender for Cloud to assess their cloud security posture. Recently, the security team discovered that a critical Azure SQL database was exposed to the internet with a firewall rule allowing 'AllowAllWindowsAzureIps'. This misconfiguration was not flagged by Defender for Cloud because the corresponding recommendation was disabled in the security policy. The company wants to prevent such misconfigurations in the future and ensure that all critical resources are covered by security recommendations. They also need to ensure that any changes to security policies are reviewed and approved. Which of the following actions should you recommend as the most comprehensive solution?

A.Review and enable all relevant security recommendations in Defender for Cloud, and implement a change management process using Azure Policy and a custom workflow that requires approval before modifying security policies.

B.Deploy Azure Monitor alerts on all SQL Server firewall rule changes and instruct the security team to manually review each change.

C.Assign the Contributor role to the security team on the subscription so they can directly modify firewall rules if needed.

D.Enable the specific recommendation for SQL Server firewall rules in Defender for Cloud and set up an automation rule to send alerts when the recommendation is triggered.

AnswerA

Reviewing and enabling all relevant Defender for Cloud security recommendations establishes a comprehensive security baseline across the subscription, ensuring misconfigurations such as exposed SQL firewall rules are proactively identified and remediated. Pairing this with a change management process built on Azure Policy and a custom approval workflow enforces governance, so any modification to security policies requires audited, authorized action—directly addressing the root cause of disabled recommendations rather than reacting to individual incidents.

Why this answer

It addresses the root cause—disabled security recommendations—by enabling all relevant recommendations in Defender for Cloud, and it enforces a change management process using Azure Policy with a custom approval workflow. This ensures that any modifications to security policies are reviewed and approved, preventing future misconfigurations like the 'AllowAllWindowsAzureIps' rule from going unnoticed. The combination of policy enforcement and approval workflow provides a comprehensive, automated governance layer that covers both detection and prevention.

Exam trap

The trap here is that candidates often focus on a single technical fix (like enabling a recommendation or setting an alert) rather than recognizing the need for a comprehensive governance solution that combines policy enforcement with a change management approval process to prevent and detect misconfigurations across all critical resources.

How to eliminate wrong answers

Option B is wrong because Azure Monitor alerts on firewall rule changes only provide reactive notifications; they do not prevent misconfigurations or ensure that security policies are reviewed and approved, leaving the manual review process prone to human error and delays. Option C is wrong because assigning the Contributor role to the security team grants them broad permissions to modify firewall rules directly, which increases the risk of unauthorized or accidental changes without any approval gate, contradicting the requirement for reviewed and approved changes. Option D is wrong because enabling only the specific recommendation for SQL Server firewall rules and setting up automation alerts is a narrow, reactive fix that does not address the broader need to ensure all critical resources are covered by security recommendations, nor does it implement a change management process for policy modifications.

Full explanation →

103

Multi-Selecteasy

Which TWO configurations are required to enable Microsoft Defender for Cloud Apps to monitor cloud app usage?

Select 2 answers

A.Add app connectors for the cloud apps you want to monitor

B.Configure Microsoft Intune device compliance policies

C.Deploy Azure Information Protection scanner

D.Synchronize with Microsoft Entra ID

E.Enable Conditional Access App Control

AnswersA, E

App connectors enable API-based monitoring.

Why this answer

A is correct because Microsoft Defender for Cloud Apps requires app connectors to establish API-based connections with cloud applications (e.g., Office 365, Salesforce, AWS). These connectors enable the service to ingest activity logs, file metadata, and user sessions for monitoring and threat detection. Without app connectors, Defender for Cloud Apps cannot access the cloud app's data plane to perform its core monitoring functions.

Exam trap

The trap here is that candidates often confuse prerequisites (like Microsoft Entra ID sync) with the actual enabling configurations, or they assume device compliance policies (Intune) are required for cloud app monitoring when they are only relevant for conditional access grant controls.

Full explanation →

104

MCQmedium

Your organization is implementing Microsoft Entra ID Conditional Access. You need to require multi-factor authentication (MFA) for all users accessing financial applications, but only when the sign-in risk is medium or higher. What is the most efficient way to achieve this?

A.Create a Microsoft Entra ID Protection user risk policy to require MFA

B.Enable MFA per user for all users in the financial team

C.Create a Conditional Access policy that targets all users, includes a named location, and requires MFA

D.Create a Conditional Access policy that targets the financial applications, uses sign-in risk as a condition, and requires MFA

AnswerD

A Conditional Access policy can be precisely scoped to the financial applications as the assigned target resources, while using sign-in risk as a condition to trigger MFA. Sign-in risk is calculated in real time by Microsoft Entra ID Protection, and Conditional Access allows it to be set to a threshold such as Low, Medium, or High. When a sign-in to a financial app has a risk level that meets the threshold, MFA is required, directly fulfilling the requirement for risk-based MFA protection on the financial applications without affecting unrelated apps or users.

Why this answer

It uses a single Conditional Access policy to target the specific financial applications and sets the sign-in risk condition to medium or higher, which triggers MFA only when the risk threshold is met. This approach is efficient as it avoids per-user MFA configuration and leverages Microsoft Entra ID Protection's risk detection to dynamically enforce MFA based on real-time sign-in risk, aligning with the principle of adaptive access control.

Exam trap

The trap here is that candidates often confuse user risk policies with sign-in risk conditions, or they default to per-user MFA or location-based policies, missing the precise combination of application scoping and risk-based conditions that the question requires.

How to eliminate wrong answers

Option A is wrong because a user risk policy in Microsoft Entra ID Protection targets user-level risk (e.g., compromised credentials) rather than sign-in risk, and it cannot be scoped to specific applications like financial apps; it would apply MFA based on user risk, not sign-in risk. Option B is wrong because enabling MFA per user forces MFA on every authentication for those users, regardless of sign-in risk level, which violates the requirement to only require MFA when risk is medium or higher and is less efficient than a risk-based policy. Option C is wrong because it includes a named location condition, which is irrelevant to sign-in risk, and targets all users without application scoping, meaning it would apply MFA to all applications for all users, not just financial apps when risk is elevated.

Full explanation →

105

MCQhard

Refer to the exhibit. You are reviewing a Conditional Access policy in Azure AD. The policy requires MFA and a compliant device for all users and all cloud apps. Some users report that they are able to access apps without being prompted for MFA even though their devices are compliant. What is the most likely reason?

A.The policy does not include all cloud apps

B.The policy is set to 'Report-only' mode

C.The policy excludes specific locations

D.The policy does not include session controls to enforce MFA re-prompt

AnswerB

In report-only mode, policies are not enforced, so users are not prompted for MFA.

Why this answer

A Conditional Access policy set to 'Report-only' mode evaluates the policy and logs results but does not enforce any controls, such as requiring MFA or a compliant device. Users can access apps without MFA prompts because the policy is not actively blocking or challenging them, even if their devices are compliant. This mode is used for testing before enabling enforcement.

Exam trap

The trap here is that candidates may overlook the 'Report-only' mode setting and assume the policy is enforcing controls, focusing instead on app scope or location exclusions, which are common red herrings in Conditional Access troubleshooting questions.

How to eliminate wrong answers

Option A is wrong because the policy explicitly states it includes 'all cloud apps,' so missing apps is not the issue. Option C is wrong because excluding specific locations would only bypass MFA for users from those locations, but the question states users report access without MFA even though devices are compliant, implying the issue is not location-based. Option D is wrong because session controls for MFA re-prompt are not required for initial MFA enforcement; the policy's grant controls (requiring MFA and compliant device) are sufficient to prompt MFA on first access, and the lack of re-prompt controls does not explain why MFA is never prompted.

Full explanation →

106

MCQhard

A global organization uses Microsoft Sentinel for SIEM and Microsoft Defender for Cloud for cloud security posture management. The security team notices that critical alerts from Azure Active Directory Identity Protection are not triggering automated response playbooks in Sentinel. The team needs to ensure that all high-severity Identity Protection risk detections automatically create incidents in Sentinel and trigger a playbook to block the user. What should the team configure?

A.Enable the Identity Protection data connector and create a Microsoft Security incident creation rule for Identity Protection.

B.Enable the Azure Active Directory Identity Protection data connector in Sentinel.

C.Configure diagnostic settings on Azure AD to stream logs to Sentinel and create a playbook automation rule.

D.Configure the Identity Protection connector with the 'Create incidents' toggle enabled.

AnswerA

This is the correct, complete configuration for Microsoft Sentinel. The Identity Protection data connector ingests risk detections and alerts from Azure AD Identity Protection into Sentinel, and the Microsoft Security incident creation rule for Identity Protection is the required analytics rule that automatically generates incidents from those ingested alerts. Without this analytics rule, the alerts remain as raw events with no incident lifecycle, so enabling both together satisfies the requirement to create incidents automatically.

Why this answer

To have Identity Protection risk detections automatically create incidents in Microsoft Sentinel and trigger a playbook, you must first enable the Identity Protection data connector (which brings the alerts into Sentinel) and then create a Microsoft Security incident creation rule specifically for Identity Protection. This rule ingests the alerts as security incidents, and you can attach an automation rule to run a playbook (e.g., to block the user) when a high-severity incident is created. Without the incident creation rule, the alerts would be ingested as raw events but not automatically turned into incidents.

Exam trap

The trap here is that candidates confuse simply enabling a data connector (which only ingests data) with the separate requirement of creating an incident creation rule to transform those alerts into actionable incidents, leading them to pick Option B or D.

How to eliminate wrong answers

Option B is wrong because simply enabling the Azure AD Identity Protection data connector only ingests the alerts into Sentinel as raw data; it does not automatically create incidents or trigger playbooks. Option C is wrong because configuring diagnostic settings on Azure AD streams sign-in and audit logs, not Identity Protection risk detections; Identity Protection alerts are not sent via diagnostic settings and require the dedicated connector. Option D is wrong because the Identity Protection connector does not have a 'Create incidents' toggle; incident creation is handled by a separate Microsoft Security incident creation rule, not by a toggle on the connector itself.

Full explanation →

107

MCQmedium

Your organization is planning to deploy Microsoft Purview Information Protection to classify and protect sensitive data. You need to design a solution that automatically applies sensitivity labels to documents containing personally identifiable information (PII) when they are uploaded to SharePoint Online. Which configuration should you use?

A.Set a default sensitivity label for the SharePoint site

B.Use trainable classifiers to identify PII and apply labels

C.Create an auto-labeling policy that uses a sensitive info type for PII

D.Configure a manual labeling policy that prompts users to classify documents

AnswerC

Creating an auto-labeling policy in the Microsoft Purview compliance portal lets you define a rule that scans SharePoint sites, OneDrive accounts, and Exchange for content containing sensitive info types (SITs) for PII, such as U.S. SSN, EU debit card number, or U.S. individual taxpayer identification number. When a match is found, the policy automatically applies the configured sensitivity label and can optionally enforce encryption or a visual marking. This is a rule-based, deterministic detection that works immediately on existing and new content, without user intervention, and is the intended mechanism for automatically classifying PII.

Why this answer

Microsoft Purview auto-labeling policies can automatically apply sensitivity labels to documents containing PII when they are uploaded to SharePoint Online. By configuring a policy with a sensitive info type (e.g., U.S. Social Security Number) as the condition, the service scans content at rest and applies the label without user intervention, meeting the requirement for automatic classification.

Exam trap

The trap here is confusing trainable classifiers with sensitive info types; candidates often pick trainable classifiers because they sound like a smart AI solution, but they are designed for broader content categories, not specific PII patterns like SSNs or credit card numbers.

How to eliminate wrong answers

Option A is wrong because setting a default sensitivity label for a SharePoint site applies a label to all new documents in that site, but it does not automatically detect and label only those containing PII; it labels everything regardless of content. Option B is wrong because trainable classifiers are used for pattern-based content categorization (e.g., contracts or resumes) and are not designed to identify specific PII data types like credit card numbers or SSNs; sensitive info types are the correct mechanism for PII detection. Option D is wrong because a manual labeling policy requires users to classify documents themselves, which does not meet the requirement for automatic labeling upon upload.

Full explanation →

108

MCQeasy

Your organization is migrating to Microsoft 365 and wants to implement a defense-in-depth strategy for email security. Which combination of Microsoft services should you use?

A.Microsoft Defender for Office 365 and Exchange Online Protection

B.Microsoft Purview Compliance Manager and Microsoft Defender for Cloud Apps

C.Microsoft Intune and Microsoft Entra ID

D.Microsoft Sentinel and Microsoft Defender for Identity

AnswerA

Exchange Online Protection (EOP) provides the always-on baseline filtering for all Exchange Online mailboxes, including spam, bulk mail, malware, and spoof intelligence before a message reaches the user. Microsoft Defender for Office 365 (MDO) layers on top with Safe Attachments, Safe Links, and advanced anti-phishing policy that checks URLs and attachments in real time, plus impersonation and domain-based protection. Together they form the native email security stack, with EOP as the foundation and MDO handling zero-day or social-engineering threats that basic filters miss.

Why this answer

Defense-in-depth for email security requires layered protection at the transport, filtering, and post-delivery stages. Exchange Online Protection (EOP) provides baseline anti-malware, anti-spam, and transport rules, while Microsoft Defender for Office 365 adds advanced threat protection like Safe Attachments, Safe Links, and anti-phishing policies that inspect URLs and attachments in real time. Together, they cover the full email threat chain from ingress to user interaction.

Exam trap

The trap here is that candidates confuse compliance or identity services with email security layers, forgetting that defense-in-depth for email specifically requires both transport-level (EOP) and post-delivery (Defender for Office 365) protections.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview Compliance Manager focuses on compliance posture and risk assessments, not on email security filtering or threat detection. Option C is wrong because Microsoft Intune manages device compliance and application policies, and Microsoft Entra ID handles identity and access management; neither provides email transport or content inspection. Option D is wrong because Microsoft Sentinel is a SIEM for centralized security analytics and Microsoft Defender for Identity detects on-premises Active Directory attacks; they do not directly protect email transport or attachments.

Full explanation →

109

MCQeasy

Your organization wants to implement a security baseline for Azure resources using built-in policies. Which Azure service should you use to assign policies that enforce compliance with security best practices?

A.Azure Blueprints

B.Microsoft Defender for Cloud

C.Azure Policy

D.Azure Role-Based Access Control (RBAC)

AnswerC

Azure Policy is the correct service for implementing a security baseline because it creates, assigns, and manages rules that audit, deny, or remediate resource properties. It includes built-in policy definitions for the Azure Security Benchmark and other regulatory standards, enabling consistent enforcement across all resources. Policies can be applied to resource groups, subscriptions, and management groups, ensuring that new and existing resources continuously meet security requirements like encryption, network restrictions, and version compliance.

Why this answer

Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules and effects on your Azure resources. These policies can be used to implement a security baseline by ensuring resources comply with built-in security best practices, such as requiring encryption or restricting resource types. Azure Policy evaluates resources against assigned policies and can automatically remediate non-compliant resources.

Exam trap

The trap here is that candidates often confuse Azure Policy with Microsoft Defender for Cloud, thinking Defender for Cloud is the tool for enforcing security baselines, but Defender for Cloud only recommends policies and monitors compliance, while Azure Policy is the actual service that enforces them.

How to eliminate wrong answers

Option A is wrong because Azure Blueprints is used to orchestrate the deployment of resource templates, policies, and role assignments as a repeatable set of artifacts, but it is not the service for directly assigning and enforcing individual policies; it can include Azure Policy definitions as part of a blueprint, but the core policy enforcement mechanism is Azure Policy itself. Option B is wrong because Microsoft Defender for Cloud provides security posture management, threat detection, and recommendations based on security benchmarks, but it does not directly assign or enforce policies; it can integrate with Azure Policy to apply regulatory compliance initiatives, but the assignment and enforcement of policies is done through Azure Policy. Option D is wrong because Azure Role-Based Access Control (RBAC) manages who has access to Azure resources and what actions they can perform, but it does not enforce compliance rules or security baselines on resource configurations; RBAC is about authorization, not about ensuring resources meet specific security standards.

Full explanation →

110

Multi-Selecteasy

A company uses Microsoft Defender for Cloud to secure their Azure workloads. They need to ensure that all Azure SQL databases have threat detection enabled. Which TWO actions should they take? (Choose two.)

Select 2 answers

A.Enable Microsoft Defender for Cloud's 'SQL servers on machines' plan

B.Enable Azure Defender for SQL at the subscription level

C.Configure SQL Vulnerability Assessment

D.Enable Advanced Threat Protection on each SQL server individually

E.Configure SQL auditing on each database

AnswersB, D

Enabling Azure Defender for SQL at the subscription level automatically enables Advanced Threat Protection for all Azure SQL databases in the subscription, ensuring threat detection across all databases.

Why this answer

The 'SQL servers on machines' plan applies to SQL Server instances on Azure VMs (IaaS), not to Azure SQL Database (PaaS). Option B is correct: enabling Azure Defender for SQL at the subscription level automatically enables threat detection for all Azure SQL databases in that subscription. Option C is incorrect: SQL Vulnerability Assessment identifies vulnerabilities but does not enable threat detection.

Option D is correct: enabling Advanced Threat Protection on each SQL server individually also ensures threat detection for all databases on that server, though it is less efficient than subscription-level enablement. Option E is incorrect: SQL auditing is for compliance and auditing, not threat detection.

Exam trap

Candidates may incorrectly select Option A, thinking it covers Azure SQL Database, or Option C, confusing vulnerability assessment with threat detection. The correct approaches are subscription-level (B) or server-level (D) enablement.

Full explanation →

111

Multi-Selectmedium

Which TWO Azure policies should you assign to enforce secure configuration of Azure SQL Database? (Select two.)

Select 2 answers

A.Ensure that 'Auditing' is set to 'On' for SQL Database

B.Ensure that 'TDE' is enabled for SQL Server VMs

C.Audit SQL Server level audit setting

D.Ensure that 'Firewall and virtual network settings' for SQL Database are configured

E.Ensure secure transfer to storage accounts is enabled

AnswersA, D

This policy enables auditing for Azure SQL Database.

Why this answer

Enabling Auditing on Azure SQL Database captures all database events and writes them to an audit log in your Azure storage account, Log Analytics workspace, or Event Hubs. This is a fundamental security control for compliance and forensic analysis, as it provides a record of who did what and when, which is essential for detecting and investigating unauthorized access or changes.

Exam trap

The trap here is that candidates confuse SQL Server VM policies (like TDE or SQL Server-level audit settings) with Azure SQL Database policies, or they mistakenly apply storage account policies to SQL Database, which is a separate Azure service with its own security controls.

Full explanation →

112

MCQeasy

Adventure Works is a startup that uses Microsoft 365 Business Premium. They have 20 employees and no cloud expertise. The CEO has been hearing about ransomware attacks on small businesses. They want to implement basic protection against ransomware using built-in Microsoft 365 features. They also want to ensure they can recover from an attack quickly. What should you recommend?

A.Purchase Azure Backup for all user devices. Configure backup policies to run daily. Use Microsoft Intune to enforce encryption. Implement Conditional Access to require MFA.

B.Enable Microsoft Defender for Office 365 to block malicious attachments and links. Configure Microsoft Defender for Business to enable controlled folder access and ransomware protection. Educate users on phishing. Use OneDrive Files Restore to recover from ransomware.

C.Use Microsoft Sentinel as a SIEM to detect ransomware patterns. Deploy Azure ATP for identity protection. Use Azure Policy to enforce backup.

D.Implement Azure Site Recovery for on-premises servers. Use Microsoft Defender for Cloud for threat detection. Deploy a third-party antivirus.

AnswerB

This option is correct because it leverages the built-in, integrated protections of Microsoft 365 Business Premium. Microsoft Defender for Office 365 filters malicious attachments and link-time detonation in Exchange Online, while Defender for Business provides endpoint detection and response plus controlled folder access that blocks unauthorized processes from modifying user files. Phishing education reduces initial compromise, and OneDrive Files Restore enables users to roll back an entire library to a known-good state within 30 days without heavy IT administration.

Why this answer

It leverages built-in Microsoft 365 Business Premium features to provide immediate ransomware protection without requiring cloud expertise. Microsoft Defender for Office 365 blocks malicious attachments and links at the email gateway, while Defender for Business provides endpoint protection with controlled folder access. OneDrive Files Restore enables self-service recovery of files from ransomware within the last 30 days, aligning with the startup's need for quick recovery without additional infrastructure.

Exam trap

The trap here is that candidates often over-engineer the solution by recommending enterprise-grade tools like Azure Backup or Sentinel, failing to recognize that Microsoft 365 Business Premium includes sufficient built-in capabilities for a small startup with no cloud expertise.

How to eliminate wrong answers

Option A is wrong because Azure Backup is not included in Microsoft 365 Business Premium and requires additional licensing and cloud expertise to configure; it also does not address ransomware prevention at the email or endpoint level. Option C is wrong because Microsoft Sentinel and Azure ATP are advanced security tools requiring significant cloud expertise and additional licensing, far beyond the scope of a 20-employee startup with no cloud expertise. Option D is wrong because Azure Site Recovery is designed for on-premises server disaster recovery, not for user devices or Microsoft 365 data, and deploying a third-party antivirus contradicts the requirement to use built-in Microsoft 365 features.

Full explanation →

113

MCQhard

Contoso is a large enterprise with a complex Azure environment. They have multiple management groups, subscriptions, and a hub-spoke network topology. The security team wants to implement a consistent security baseline across all subscriptions using Azure Policy. They need to ensure that: 1) All resources must be deployed in approved regions only. 2) Network security groups must have specific rules to block high-risk ports. 3) All storage accounts must enforce HTTPS traffic. 4) The policies must be applied at the management group level to ensure inheritance. 5) Non-compliant resources must be automatically remediated where possible. What should you do?

A.Use Azure Policy Guest Configuration to enforce region and NSG rules. Assign policies at each subscription. Use Azure Automation runbooks for remediation.

B.Create custom Azure Policy definitions for the required configurations (allowed locations, NSG rule blocking ports, storage HTTPS). Assign the policies at the root management group. Enable 'deployIfNotExists' effect for automatic remediation of non-compliant resources. Use Azure Policy remediation tasks to fix existing non-compliant resources.

C.Use Azure Blueprints to define the environment. Include Azure Policy assignments in the blueprint. Assign blueprint to each management group. Remediate manually.

D.Create a custom script using Azure PowerShell to check compliance daily. Use Azure Logic Apps to send alerts for non-compliance. Have IT staff manually fix issues.

AnswerB

This is the correct approach because Azure Policy is the native, continuous compliance service for resource-level configurations. By creating custom policy definitions for allowed locations, NSG rules, and storage HTTPS and assigning them at the root management group, the policies inherit to all child subscriptions and resource groups, providing a single, central governance baseline. Enabling the DeployIfNotExists effect makes Azure Policy automatically deploy the required configuration (e.g., a compliant NSG or secure storage setting) whenever a non-compliant resource is created or updated, and remediation tasks then correct pre-existing non-compliant resources, closing the compliance gap without manual intervention.

Why this answer

It uses Azure Policy at the root management group to enforce inheritance across all subscriptions, with custom policy definitions for allowed locations, NSG rules blocking high-risk ports, and storage HTTPS. The 'deployIfNotExists' effect enables automatic remediation of non-compliant resources, and remediation tasks fix existing non-compliant resources, meeting all requirements without manual intervention.

Exam trap

The trap here is confusing Azure Policy's 'deployIfNotExists' effect with manual remediation or third-party automation, leading candidates to choose options that lack native, automatic, and inherited policy enforcement at the management group level.

How to eliminate wrong answers

Option A is wrong because Azure Policy Guest Configuration is designed for in-guest machine settings (e.g., OS configuration), not for enforcing region, NSG rules, or storage HTTPS; assigning policies at each subscription breaks inheritance, and Azure Automation runbooks are not the native remediation mechanism for Azure Policy. Option C is wrong because Azure Blueprints are used for orchestrating resource deployments (including policy assignments) but do not provide automatic remediation; manual remediation violates the requirement for automatic remediation where possible. Option D is wrong because a custom PowerShell script with Logic Apps alerts and manual fixes is not a scalable, automated, or policy-driven solution; it lacks inheritance, automatic remediation, and centralized enforcement at the management group level.

Full explanation →

114

Multi-Selecthard

A company is designing a data classification strategy for their Azure environment. They need to identify sensitive data stored in Azure SQL Database. Which TWO solutions should they consider?

Select 2 answers

A.Azure Information Protection

B.Azure SQL Data Discovery & Classification

C.Azure Purview

D.SQL Vulnerability Assessment

E.Azure Policy

AnswersB, D

Built-in classification for SQL DB.

Why this answer

Azure SQL Data Discovery & Classification is correct because it is a native feature of Azure SQL Database that automatically discovers, classifies, and labels sensitive columns (e.g., credit card numbers, PII) directly within the database engine. It provides a built-in dashboard for auditing and monitoring classification status, making it the primary tool for identifying sensitive data stored in Azure SQL Database.

Exam trap

The trap here is that candidates often confuse Azure Information Protection (AIP) with Azure SQL Data Discovery & Classification, assuming AIP can classify database columns, when in fact AIP is designed for unstructured data like documents and emails, not structured SQL data.

Full explanation →

115

MCQhard

Your company is deploying a new line-of-business application in Azure that must comply with PCI DSS. The application uses Azure SQL Database. You need to design a solution to encrypt sensitive data at rest and in transit, and to audit access to sensitive columns. Which combination of Microsoft security capabilities should you recommend?

A.Dynamic Data Masking and Azure SQL Firewall rules

B.Transparent Data Encryption, Always Encrypted, and Azure SQL Auditing

C.Azure Policy and Microsoft Defender for Cloud

D.Azure Storage Service Encryption and Azure Key Vault

AnswerB

Transparent Data Encryption (TDE) encrypts entire database files, backups, and transaction logs at rest using a database encryption key, protecting data at the storage layer. Always Encrypted goes further by encrypting sensitive columns with client-side keys so that database administrators and cloud operators see only ciphertext, ensuring data remains confidential even during queries. Azure SQL Auditing captures a trace of database events and queries, enabling compliance monitoring and forensic analysis of access to sensitive data. Together, these three technologies deliver encryption at rest, column-level encryption with key separation, and a clear audit trail, fully addressing typical enterprise data protection and compliance requirements.

Why this answer

Transparent Data Encryption (TDE) encrypts the SQL database at rest, Always Encrypted protects sensitive columns in transit and at rest by ensuring encryption keys are never exposed to the database engine, and Azure SQL Auditing logs all access to sensitive columns for compliance with PCI DSS requirements.

Exam trap

The trap here is that candidates often confuse Dynamic Data Masking with encryption, but masking does not protect data at rest or in transit and can be bypassed by privileged users, whereas Always Encrypted and TDE provide true encryption required by PCI DSS.

How to eliminate wrong answers

Option A is wrong because Dynamic Data Masking only obfuscates data at query time for unauthorized users but does not encrypt data at rest or in transit, and Azure SQL Firewall rules control network access but do not provide encryption or auditing. Option C is wrong because Azure Policy enforces compliance rules and Microsoft Defender for Cloud provides threat detection, but neither directly encrypts data at rest or in transit nor audits column-level access. Option D is wrong because Azure Storage Service Encryption applies only to Azure Blob and File storage, not to Azure SQL Database, and Azure Key Vault is a key management service that must be paired with an encryption mechanism like TDE or Always Encrypted to actually encrypt data.

Full explanation →

116

Multi-Selectmedium

Your organization is designing a security solution for a new web application that will be deployed on Azure App Service. The application will access an Azure SQL Database and an Azure Storage account. The security requirements include: (1) use managed identities for authentication, (2) encrypt data at rest and in transit, (3) restrict network access to the database and storage account to only the App Service, and (4) use Azure Key Vault for secrets management. Which TWO of the following should you implement?

Select 2 answers

A.Configure the App Service to use a connection string with a storage account access key.

B.Configure private endpoints for the SQL Database and Storage account.

C.Configure the App Service to use a system-assigned managed identity.

D.Use shared access signatures (SAS) for the App Service to access the Storage account.

E.Configure service endpoints for the SQL Database and Storage account.

AnswersB, C

Private endpoints for Azure SQL Database and Azure Storage assign each resource a private IP address from your virtual network, ensuring that all traffic to these PaaS services traverses the Microsoft backbone network and never the public internet. This provides strong network-level isolation because the service endpoint is only reachable from your VNet, and you can disable public access entirely, eliminating exposure to internet-based attacks. Private endpoints also support Azure Private Link, which integrates with network security groups, route tables, and on-premises connectivity via VPN or ExpressRoute. Unlike service endpoints, private endpoints give you granular control over which specific resource instances can be accessed, not just the service as a whole.

Why this answer

(Configure private endpoints) ensures that network traffic to the SQL Database and Storage account is isolated to the virtual network, meeting the requirement to restrict network access to only the App Service. Option C (system-assigned managed identity) enables the App Service to authenticate to Azure SQL Database and Storage without storing credentials, aligning with the managed identity and Key Vault requirements. Option A is incorrect because using a connection string with a storage account access key introduces a secret and bypasses managed identity.

Option D is incorrect because SAS tokens are also secrets and less secure than managed identities. Option E is incorrect because service endpoints do not provide the same level of private network isolation as private endpoints and rely on public endpoints with network rules.

Full explanation →

117

MCQmedium

Your company, Fabrikam, is a global financial services firm that handles sensitive customer data. You are designing a security solution for a new customer-facing web application that processes credit card transactions. The application will be deployed on Azure Kubernetes Service (AKS) and will use Azure SQL Database for data storage. Compliance requirements include PCI DSS and GDPR. You need to ensure that data at rest and in transit is encrypted, and that access to the database is tightly controlled. You plan to use Azure Key Vault for managing encryption keys. Which combination of actions should you implement?

A.Enable TDE with a customer-managed key in Azure Key Vault, use Always Encrypted for sensitive columns, enforce TLS 1.2, and use Azure AD managed identities for authentication with a firewall rule to allow only the AKS cluster's outbound IP.

B.Enable TDE with a customer-managed key stored in the application's configuration file, enforce TLS 1.2, and use Azure AD authentication.

C.Implement application-level encryption for credit card data, enforce TLS 1.2, and use Azure AD managed identities with no database firewall rules.

D.Enable Transparent Data Encryption (TDE) with a service-managed key, enforce TLS 1.0, and use SQL authentication.

AnswerA

This provides encryption at rest (TDE and Always Encrypted), encryption in transit (TLS 1.2), and secure access with managed identities and IP restrictions.

Why this answer

It provides comprehensive encryption: TDE with a customer-managed key in Azure Key Vault encrypts data at rest, Always Encrypted protects sensitive columns (e.g., credit card numbers) with column-level encryption, TLS 1.2 secures data in transit, and Azure AD managed identities with a firewall rule restricted to the AKS cluster's outbound IP ensure secure authentication and access control. This combination meets PCI DSS and GDPR requirements.

Option B is incorrect because storing the customer-managed key in the application's configuration file is insecure and violates best practices for key management; keys must be stored in a secure vault like Azure Key Vault.

Option C is incorrect because application-level encryption alone does not guarantee data-at-rest encryption within Azure SQL Database, and disabling firewall rules (using no firewall) exposes the database to unauthorized access.

Option D is incorrect because it uses a service-managed key (less control), TLS 1.0 (not PCI DSS compliant), and SQL authentication (less secure than Azure AD managed identities).

Full explanation →

118

MCQeasy

Your company uses Microsoft Defender for Cloud to secure Azure workloads. You need to ensure that all storage accounts have the 'Secure transfer required' setting enabled. What should you use?

A.Azure role-based access control (RBAC)

B.Azure Blueprints

C.Microsoft Defender for Cloud regulatory compliance dashboard

D.Azure Policy

AnswerD

Azure Policy can audit or enforce the 'Secure transfer required' property on storage accounts.

Why this answer

Azure Policy can audit and enforce the 'Secure transfer required' setting across all storage accounts. Option A (RBAC) is incorrect because RBAC controls access permissions, not resource configuration. Option B (Azure Blueprints) is deprecated and not the direct solution for this requirement.

Option C (Microsoft Defender for Cloud regulatory compliance dashboard) provides visibility but does not enforce settings.

Full explanation →

119

MCQeasy

A company is designing a security operations strategy using Microsoft Sentinel. They want to prioritize triage of incidents that involve critical assets. The SOC manager suggests using the entity behavior analytics feature. Which capability of entity behavior analytics helps achieve this goal?

A.It combines multiple alerts into a single incident using Fusion.

B.It uses threat intelligence to correlate with known bad actors.

C.It profiles entities and assigns an anomaly score based on deviations from baseline behaviors.

D.It automatically groups incidents by severity and asset criticality.

AnswerC

UEBA in Microsoft Sentinel profiles entities such as users, devices, and applications by establishing a baseline of their typical activities—like login times, geo-locations, accessed resources, and peer-group interactions. It then assigns an anomaly score to each deviation from that baseline, with high scores indicating potentially malicious or risky behavior. This method detects threats that may be unrecognized by signature-based tools because it focuses on behavioral change rather than known attack patterns, enabling identification of compromised entities or insider threats.

Why this answer

Entity behavior analytics (UEBA) in Microsoft Sentinel profiles entities such as users, hosts, or applications by establishing baseline behaviors over time. It then assigns an anomaly score to deviations from that baseline, enabling SOC analysts to prioritize incidents involving critical assets based on unusual activity rather than static rules. This directly supports the goal of triaging incidents by highlighting anomalous behavior on high-value targets.

Exam trap

The trap here is that candidates confuse entity behavior analytics (UEBA) with Fusion or threat intelligence correlation, assuming any 'intelligent' feature must involve combining alerts or external threat data, rather than recognizing that UEBA is specifically about profiling internal entity behavior and scoring anomalies.

How to eliminate wrong answers

Option A is wrong because Fusion is a correlation engine that combines multiple alerts from different products into a single incident using machine learning, not entity behavior profiling or anomaly scoring. Option B is wrong because threat intelligence correlation with known bad actors is a separate capability (e.g., TI integration), not entity behavior analytics, which focuses on internal behavioral baselines rather than external threat feeds. Option D is wrong because automatic grouping by severity and asset criticality is a feature of incident classification or automation rules, not a function of entity behavior analytics, which provides per-entity anomaly scores rather than grouping incidents.

Full explanation →

120

MCQhard

Your organization, Contoso Ltd., is migrating its on-premises workloads to Azure. The environment includes 200 virtual machines (VMs) running Windows Server and 50 VMs running Linux. You are responsible for designing the security infrastructure. The company has the following requirements: 1) All VMs must be protected against malware. 2) Security updates must be applied automatically to Windows VMs within 24 hours of release. 3) Linux VMs must receive critical security patches within 48 hours. 4) A central dashboard must provide visibility into the security posture of all VMs. 5) All VMs must be onboarded to Microsoft Defender for Cloud to enable advanced threat protection. 6) The solution must minimize administrative overhead. You have implemented the following: - All VMs are enrolled in Microsoft Defender for Cloud with the enhanced security features enabled. - Azure Update Manager is configured to schedule updates. - Microsoft Defender for Endpoint is installed on all Windows VMs. However, after a month, the security team reports that: - 50 Windows VMs did not receive security updates within 24 hours. - 10 Linux VMs have not received any patches. - The central dashboard shows that 30 VMs are not reporting their security status. - A malware outbreak occurred on 5 Windows VMs that were not protected by Defender for Endpoint. You need to identify the most likely root cause and recommend a corrective action.

A.Onboard the VMs to Azure Arc and enable the Azure Update Manager on all VMs via Arc.

B.Implement Azure Policy to enforce that all VMs have the 'Deploy default Microsoft IaaS anti-malware extension for Windows' policy assigned and create a remediation task.

C.Configure Microsoft Entra Privileged Identity Management (PIM) to require approval for update deployments.

D.Review the network security groups (NSGs) and firewall rules to ensure outbound connectivity to the required Microsoft endpoints for Microsoft Defender for Endpoint and Windows Update.

AnswerD

Reviewing NSGs and firewall rules is correct because VMs require outbound connectivity to Microsoft endpoints for both Windows Update and Microsoft Defender for Endpoint cloud services. If egress is blocked, update scans fail, definition updates cannot download, and Defender for Endpoint sensors cannot upload machine telemetry or receive policy. The fix should ensure NSG rules and any network virtual appliance or firewall allow traffic to the service tags (e.g., WindowsUpdate, AzureFrontDoor, and Defender for Endpoint URLs/IPs). This directly addresses the root cause rather than layering management, policy, or identity tools.

Why this answer

The symptoms—VMs missing updates, not reporting status, and lacking Defender for Endpoint protection—point to a connectivity failure. Microsoft Defender for Endpoint and Windows Update require outbound connectivity to specific Microsoft endpoints (e.g., *.endpoint.microsoft.com, *.update.microsoft.com). Without this, VMs cannot receive updates, report security posture, or download Defender definitions, directly explaining all reported issues.

Exam trap

The trap here is that candidates often focus on configuration or policy gaps (like missing extensions or update schedules) instead of recognizing that all symptoms—missing updates, no reporting, and unprotected VMs—stem from a single underlying network connectivity issue.

How to eliminate wrong answers

Option A is wrong because Azure Arc is used to manage non-Azure machines; all VMs are already in Azure, so onboarding to Arc adds unnecessary complexity and does not address the root cause of connectivity or missing Defender protection. Option B is wrong because the 'Deploy default Microsoft IaaS anti-malware extension for Windows' policy deploys the legacy Microsoft Antimalware extension, not Microsoft Defender for Endpoint, and does not solve the update or reporting failures. Option C is wrong because Microsoft Entra PIM controls privileged access and approval workflows for role assignments, not update deployment scheduling or connectivity; it does not fix missing patches or Defender protection.

Full explanation →

121

MCQmedium

A company is deploying Azure SQL Database with Azure Active Directory authentication for their application. They want to ensure that only specific Azure AD users can access the database, and that these users are authenticated at the database level. What should they do?

A.Create a server-level login for each user

B.Assign the Azure AD admin to the SQL server

C.Configure firewall rules to allow specific IPs

D.Create contained database users mapped to Azure AD identities

AnswerD

Contained database users mapped to Azure AD identities are the correct mechanism for authenticating users at the database scope. These users are defined entirely inside the database, and Azure SQL validates their Azure AD bearer token during login, so no server-level login is needed. This approach supports least privilege because permissions are scoped to the database, and you can map the user to an individual Azure AD user or a group using CREATE USER ... FROM EXTERNAL PROVIDER.

Why this answer

Contained database users in Azure SQL Database are authenticated directly at the database level using Azure AD identities, without requiring a server-level login. This allows you to grant access to specific Azure AD users or groups while enforcing authentication within the database itself, aligning with the requirement for database-level authentication.

Exam trap

The trap here is that candidates often confuse server-level Azure AD admin assignment (which enables Azure AD authentication at the server level) with the ability to control specific user access at the database level, leading them to select Option B instead of understanding that contained database users are required for granular, database-scoped authentication.

How to eliminate wrong answers

Option A is wrong because server-level logins are SQL Server authentication principals that exist at the server scope, not Azure AD identities, and they require a login to be created in the master database, which does not meet the requirement for Azure AD authentication at the database level. Option B is wrong because assigning an Azure AD admin to the SQL server grants that user or group full administrative access to the server, not the ability to restrict specific users at the database level; it is a prerequisite for Azure AD authentication but does not by itself control database-level access. Option C is wrong because firewall rules control network access by IP address, not user authentication; they are a separate security layer that allows or blocks connections from specific IP ranges but do not authenticate individual Azure AD users.

Full explanation →

122

MCQmedium

Refer to the exhibit. You are reviewing an ARM template that deploys a network security group (NSG) for a web application. The NSG allows inbound HTTP traffic from any source and then denies all other inbound traffic. However, after deployment, you find that HTTP traffic is being blocked. What is the most likely cause?

A.The AllowHTTP rule uses sourcePortRange '*' which conflicts with the DenyAll rule.

B.The NSG is not associated with the subnet or network interface where the web server is deployed.

C.The DenyAll rule has a higher priority than the AllowHTTP rule, so it takes precedence.

D.The DenyAll rule uses protocol '*' which blocks all traffic including HTTP.

AnswerC

In Azure, NSG rules are evaluated in ascending priority order, where smaller numbers are processed first and the first matching rule determines the outcome. If DenyAll has a numerically lower priority (e.g., 100) than AllowHTTP (e.g., 200), then incoming TCP port 80 HTTP traffic matches DenyAll first, and since its action is Deny, the packet is dropped before AllowHTTP is ever considered. This explicit numeric precedence is the direct cause of the HTTP failure, making the higher priority of DenyAll the definitive reason.

Why this answer

The DenyAll rule has a higher priority (lower priority number) than the AllowHTTP rule, so it is evaluated first and blocks all traffic, including HTTP. To fix this, the AllowHTTP rule should have a higher priority (lower number) than the DenyAll rule.

Exam trap

Candidates often overlook that NSG rules are evaluated in priority order (lower number = higher priority). A deny-all rule with a priority lower than the allow rule will block the intended traffic.

How to eliminate wrong answers

Option A is wrong because sourcePortRange '*' is the default wildcard that matches any source port and does not conflict with the DenyAll rule; port ranges are evaluated independently, and a wildcard source port does not cause blocking. Option C is wrong because the DenyAll rule must have a higher priority number (lower precedence) than the AllowHTTP rule to be effective; if the DenyAll rule had a higher priority (lower number), it would override the Allow rule, but the question implies the Allow rule is correctly prioritized, so this is not the cause. Option D is wrong because protocol '*' matches all protocols, including HTTP (TCP port 80), but the DenyAll rule is intended to block all traffic; the issue is not the protocol wildcard but the lack of NSG association, as the DenyAll rule would only block traffic if the NSG were applied.

Full explanation →

123

MCQmedium

Fabrikam is a healthcare organization that uses Microsoft 365 E5 and Azure. They have a hybrid identity environment with Active Directory on-premises synced to Microsoft Entra ID. The security team wants to implement a Zero Trust strategy following the 'verify explicitly' principle. They need to ensure that all access to Microsoft 365 services and Azure applications is conditionally enforced based on real-time risk signals. Additionally, they want to block legacy authentication protocols that do not support modern authentication. The solution must integrate with Microsoft Defender XDR and Microsoft Sentinel for threat intelligence. Which combination of technologies should you recommend?

A.Implement Azure AD Identity Governance with access reviews. Use Conditional Access to require hybrid Azure AD joined devices. Block legacy authentication by disabling protocols in Exchange Online. Use Azure Sentinel without Defender XDR.

B.Use Azure AD B2B for external users only. Configure Conditional Access with MFA for all users. Use Azure AD Identity Protection for risk. Block legacy authentication at the firewall level.

C.Deploy Microsoft Intune for mobile device management and require compliant devices. Use Conditional Access to block legacy protocols. Rely on Azure ATP (now Microsoft Defender for Identity) for risk signals.

D.Use Microsoft Entra Conditional Access policies with session controls from Microsoft Defender for Cloud Apps. Enable Microsoft Entra ID Protection to feed risk signals into Conditional Access. Block legacy authentication via a Conditional Access policy targeting 'Exchange Active Sync' and 'Other clients'. Integrate Microsoft Sentinel to ingest alerts from Defender XDR.

AnswerD

This solution combines real-time risk assessment from Microsoft Entra ID Protection with adaptive Conditional Access policies, allowing sign-in risk to trigger MFA, block, or session restrictions dynamically. Session controls from Microsoft Defender for Cloud Apps enable granular cloud app session monitoring and policy enforcement, such as blocking download of sensitive files based on user risk. Blocking legacy authentication explicitly via a Conditional Access policy on client apps 'Exchange ActiveSync' and 'Other clients' is the documented method to prevent credential replay attacks. Finally, integrating Microsoft Sentinel with Defender XDR centralizes alerts from across the identity, endpoint, and cloud app domains, enabling advanced hunting and a unified incident response workflow.

Why this answer

It directly implements the 'verify explicitly' principle by using Microsoft Entra ID Protection to feed real-time risk signals into Conditional Access policies, which then enforce session controls via Microsoft Defender for Cloud Apps. It blocks legacy authentication through a targeted Conditional Access policy (not just disabling protocols in Exchange Online or at the firewall), and integrates Microsoft Sentinel to ingest alerts from Defender XDR for centralized threat intelligence. This combination ensures all access to Microsoft 365 and Azure applications is conditionally enforced based on dynamic risk, while also addressing the requirement to block legacy protocols that lack modern authentication support.

Exam trap

The trap here is that candidates often think blocking legacy authentication must be done at the protocol level (e.g., disabling in Exchange Online or firewall) rather than using a Conditional Access policy, which is the recommended and more comprehensive method in a Zero Trust architecture.

How to eliminate wrong answers

Option A is wrong because it relies on disabling legacy protocols in Exchange Online (which is incomplete—does not block protocols like POP3/IMAP/SMTP across all services) and uses Azure Sentinel without Defender XDR, violating the requirement to integrate both. Option B is wrong because it blocks legacy authentication at the firewall level (which is not granular enough and does not address protocol-level blocking within Microsoft 365), and Azure AD B2B is only for external users, not the core Zero Trust strategy for internal access. Option C is wrong because it relies on Azure ATP (now Microsoft Defender for Identity) for risk signals, but the correct modern approach is Microsoft Entra ID Protection, which provides real-time risk detection and feeds directly into Conditional Access; also, Intune for compliant devices is not the primary mechanism for risk-based conditional access.

Full explanation →

124

Multi-Selecthard

Your organization uses Microsoft Purview Information Protection and Microsoft Defender for Cloud Apps. You need to design a solution that automatically applies a 'Confidential' sensitivity label to documents that contain credit card numbers and are shared externally. The solution should also generate an alert when this occurs. Which two configurations should you implement? (Choose TWO.)

Select 2 answers

A.Configure a Microsoft Sentinel analytics rule that queries audit logs for external sharing of labeled documents and generates an incident.

B.Create a Conditional Access policy in Microsoft Entra ID that requires device compliance when accessing documents labeled 'Confidential'.

C.Configure a Microsoft Purview Data Loss Prevention (DLP) policy that blocks the sharing of documents containing credit card numbers.

D.Create a Microsoft Purview auto-labeling policy that includes the 'Credit Card Number' sensitive info type and specifies the 'Confidential' label.

E.Create a Microsoft Defender for Cloud Apps app governance policy that monitors file sharing and triggers an alert when a document with a 'Confidential' label is shared externally.

AnswersD, E

A Microsoft Purview auto-labeling policy directly meets the requirement by using Microsoft 365 built-in sensitive info types (e.g., 'Credit Card Number') to inspect content and automatically assign the 'Confidential' sensitivity label. This is an automated classification control that runs in the background, scanning files in SharePoint, OneDrive, Exchange, and other supported workloads, and can be configured with a simulation mode before enforcement. It is the only option that both detects the sensitive data and applies the label as an end result.

Why this answer

Options D and E are correct because an auto-labeling policy in Microsoft Purview can scan for sensitive info types (credit card numbers) and automatically apply the 'Confidential' label to documents. A Microsoft Defender for Cloud Apps app governance policy can monitor file sharing and trigger an alert when a document with the 'Confidential' label is shared externally. Option A (Microsoft Sentinel analytics rule) could generate alerts but is not the primary mechanism for labeling, and option B (Conditional Access) controls access, not labeling.

Option C (Data Loss Prevention) is for blocking, not labeling.

Full explanation →

125

Multi-Selecthard

A financial services company uses Microsoft Sentinel for SIEM. They need to detect potential data exfiltration from their Azure SQL Database. Which THREE data sources should they connect to Sentinel to achieve this? (Choose THREE.)

Select 3 answers

A.Microsoft Defender for Cloud alerts

B.Azure AD sign-in logs

C.Azure Network Watcher NSG flow logs

D.Azure SQL Database audit logs

E.Azure Activity Logs

AnswersC, D, E

Provide network traffic data to detect unusual data transfers.

Why this answer

Azure SQL Database audit logs (Option D) capture detailed information about database queries and operations, which can help detect unauthorized data access. Azure Activity Logs (Option E) provide visibility into management-plane events such as changes to database configurations or firewall rules. Network Security Group (NSG) flow logs (Option C) show network traffic patterns to and from Azure SQL Database, enabling the detection of abnormal data transfer volume or patterns indicative of exfiltration.

Options A and B are incorrect: Microsoft Defender for Cloud alerts provide security recommendations and alerts but not raw data exfiltration details; Azure AD sign-in logs focus on user authentication events, not database operations.

Full explanation →

126

MCQhard

Your organization uses Microsoft Defender for Cloud to secure multi-cloud resources. You need to ensure that security recommendations are automatically remediated for non-compliant resources without manual intervention. What should you configure?

A.Azure Policy initiatives with remediation tasks

B.Set a Secure Score target and alert on changes

C.Use Quick Fix remediation for security recommendations and enable automation

D.Enable automatic provisioning of Log Analytics agent

AnswerC

Quick Fix allows one-click remediation, and automation can trigger it automatically.

Why this answer

Quick Fix remediation allows you to automatically apply a predefined remediation step for a security recommendation, and when combined with automation (such as a logic app or Azure Automation runbook triggered by Defender for Cloud), non-compliant resources can be auto-remediated without manual intervention. Option A is incorrect because Azure Policy initiatives with remediation tasks require manual trigger or a separate automation setup to run automatically; they do not directly auto-remediate within Defender for Cloud recommendations. Option B is incorrect because setting a Secure Score target and alerting on changes only monitors the secure score, it does not perform any remediation.

Option D is incorrect because automatic provisioning of Log Analytics agent is about collecting data, not remediation.

Full explanation →

127

Multi-Selectmedium

A company is designing a data classification strategy using Microsoft Purview. They need to automatically classify and protect sensitive data stored in Azure Blob Storage. Which TWO capabilities should they use? (Choose TWO.)

Select 2 answers

A.Sensitivity labels

B.Data Loss Prevention (DLP) policies

C.Information Barriers

D.Microsoft Purview Data Map

E.Azure Policy

AnswersA, D

Sensitivity labels are a correct part of a Microsoft Purview classification strategy because they allow you to tag files and emails with classification, and optionally apply encryption or watermarks. They can be auto-applied through content inspection of sensitive information types and can extend to other workloads, yet they mark the content rather than maintain a centralized data map. In an Azure-centric design, they complement, rather than replace, Purview Data Map's asset-level classification.

Why this answer

The correct options are A and D. Sensitivity labels (A) can be applied to automatically classify and protect sensitive data, including in Azure Blob Storage. Microsoft Purview Data Map (D) provides auto-discovery and classification of data assets.

Option B (DLP policies) is primarily for endpoint and Microsoft 365 workloads, not for Azure Blob. Option C (Information Barriers) is for restricting communication, not data classification. Option E (Azure Policy) is for governance, not data classification or protection.

Full explanation →

128

MCQhard

Refer to the exhibit. An Azure policy is defined as shown. Which resources will be audited?

A.All Azure resources that are not compliant

B.All virtual machines with unmanaged disks

C.Virtual machines with Standard_LRS managed disks

D.Virtual machines with Premium_LRS managed disks and disk size 1024 GB

AnswerC

Standard_LRS is a managed disk SKU but does not equal Premium_LRS, so the policy's notEquals Premium_LRS condition evaluates to true for any VM using it. This makes those VMs non-compliant because the policy mandates Premium_LRS for all managed disks attached to virtual machines. The disk size is not part of the condition, so every Standard_LRS disk, regardless of capacity, triggers the same non-compliance result.

Why this answer

The Azure policy definition in the exhibit uses the 'audit' effect to evaluate a condition that checks whether the virtual machine's managed disk storage account type is 'Standard_LRS'. When the condition is true (i.e., the VM has a Standard_LRS managed disk), the policy triggers an audit event. Therefore, the policy audits all virtual machines with Standard_LRS managed disks, making option C correct.

Options A, B, and D are incorrect because the policy does not audit all non-compliant resources, unmanaged disks, or VMs with Premium_LRS disks of size 1024 GB.

Exam trap

Microsoft often tests the nuance of 'auditIfNotExists' vs. 'audit' effects, where candidates mistakenly think the policy audits all non-compliant resources or unmanaged disks, but the policy actually audits only when the specified condition (Standard_LRS disk exists) is true, not when it is false.

How to eliminate wrong answers

Option A is wrong because the policy is scoped to virtual machines and their associated disks, not all Azure resources; it does not audit general non-compliance across resource types. Option B is wrong because the policy audits virtual machines that have Standard_LRS managed disks, not unmanaged disks; unmanaged disks would not match the 'Microsoft.Compute/disks' resource type with a managed disk SKU, so they would not trigger the audit. Option D is wrong because the policy does not include a condition on disk size; it only checks for the presence of a Standard_LRS managed disk, so a Premium_LRS disk of any size would not be audited.

Full explanation →

129

MCQmedium

Refer to the exhibit. You are reviewing a conditional access policy JSON in Microsoft Entra ID. The policy is enabled but users with the Global Administrator role are not being prompted for MFA. What is the most likely reason?

A.The policy does not include any users except by role.

B.The policy does not include any applications.

C.The grant control requires a compliant device instead of MFA.

D.The policy state is disabled.

AnswerA

The conditional access policy defines user targeting exclusively through the includeRoles array and omits the includeUsers array entirely. This means the policy only applies to sign-ins from users assigned to the specified directory roles, leaving every non-role user outside the policy scope. The absence of an includeUsers entry, such as the shortcut value 'All', prevents the policy from being universally enforced and is the root cause of the misconfiguration.

Why this answer

The Conditional Access policy JSON shows that the 'users' object does not include an 'includeUsers' property for all users or specific groups; instead, users are only included by directory role (e.g., through 'includeRoles'). If the 'includeRoles' array is either empty or does not contain the 'Global Administrator' role, then Global Administrators are not targeted by the policy. Therefore, they are not prompted for MFA despite the policy being enabled.

This is the most likely reason because the other options are incorrect: the policy may include applications (option B), the grant control could be set to MFA (not requiring compliant device) (option C), and the policy is enabled (option D).

Exam trap

The trap here is that candidates assume 'All users' includes all users regardless of role, but they overlook that the exclusion of specific roles or users can completely bypass the policy, and the exam tests whether you understand that exclusion rules override inclusion rules in Conditional Access policies.

How to eliminate wrong answers

Option B is wrong because the policy does not need to include any specific applications; if no applications are selected, the policy applies to all applications by default, which would still trigger MFA for included users. Option C is wrong because the grant control in the policy explicitly requires MFA ('mfa' in the grantControls), not a compliant device, so that does not explain why Global Administrators are not prompted. Option D is wrong because the policy state is set to 'enabled' (as shown in the JSON), so it is active and should enforce MFA for users who are not excluded.

Full explanation →

130

MCQhard

A company is designing a secure hybrid network architecture. They have an on-premises network connected to Azure via ExpressRoute and a site-to-site VPN as backup. They want to ensure that traffic from Azure to on-premises always uses ExpressRoute when available, but automatically fails over to VPN if ExpressRoute goes down. Which configuration should they implement?

A.Configure the VPN to have a lower BGP weight than ExpressRoute.

B.Use both connections in active-active mode with BGP and rely on ECMP.

C.Disable BGP on the VPN connection and use static routes with a higher metric for the VPN.

D.Configure BGP on both connections and assign a higher local preference (e.g., 200) to routes learned via ExpressRoute.

AnswerD

BGP local preference is a standard, AS-wide attribute used to select the preferred path for outbound traffic, with higher values (e.g., 200) being preferred over the default of 100. By enabling BGP on both connections and assigning a higher local preference to routes learned via ExpressRoute, both on-premises devices and (with appropriate configuration) peers will consistently prefer ExpressRoute for all traffic. When ExpressRoute fails and its routes are withdrawn, the VPN route automatically becomes the best path because it carries the lower local preference, enabling seamless and deterministic failover. This approach is platform-independent, unlike proprietary weight, and gives explicit control over the primary/backup relationship.

Why this answer

BGP local preference is an attribute used to influence outbound traffic from an AS. By assigning a higher local preference (e.g., 200) to routes learned via ExpressRoute, Azure will prefer those routes over VPN routes (which default to local preference 100). This ensures that traffic from Azure to on-premises uses ExpressRoute when available, and automatically fails over to the VPN if the ExpressRoute BGP session drops, as the VPN routes will then be selected.

Exam trap

The trap here is that candidates often confuse BGP weight (Cisco-proprietary, local to a router) with local preference (standard, AS-wide), and incorrectly assume that lowering weight on the VPN would achieve the same result as raising local preference on ExpressRoute, but Azure does not support Cisco weight and local preference is the correct attribute for influencing outbound traffic from Azure to on-premises.

How to eliminate wrong answers

Option A is wrong because BGP weight is a Cisco-proprietary attribute that influences inbound traffic on a single router, not outbound traffic from Azure; Azure does not use Cisco weight, and lowering VPN weight would not reliably force ExpressRoute preference. Option B is wrong because active-active mode with ECMP would load-balance traffic across both connections simultaneously, not provide a primary/backup failover where ExpressRoute is always preferred. Option C is wrong because disabling BGP on the VPN connection and using static routes with a higher metric would work for simple failover, but it prevents dynamic route propagation and failover detection; BGP provides faster convergence and automatic route withdrawal, which is critical for reliable failover.

Full explanation →

131

MCQmedium

Your organization is implementing a secure DevOps pipeline for a critical application. You need to design a solution that scans container images for vulnerabilities before they are deployed to production. Which Azure service should you integrate into the pipeline?

A.Azure Key Vault

B.Azure Policy

C.Microsoft Defender for Cloud

D.Azure Security Center

AnswerC

Microsoft Defender for Cloud is the correct choice because it includes built-in vulnerability scanning for container images in Azure Container Registry and other supported registries. It continuously scans images when they are pushed, detects known vulnerabilities using integrated CVE databases, and provides actionable remediation recommendations. Integrating this into a secure DevOps pipeline allows automated gating to block vulnerable images from reaching production.

Why this answer

Microsoft Defender for Cloud (formerly Azure Security Center) provides integrated vulnerability assessment for container images stored in Azure Container Registry (ACR). When integrated into a DevOps pipeline, Defender for Cloud can scan images on push or on demand, using the Qualys scanner to detect CVEs and generate detailed security reports. This allows the pipeline to block or flag vulnerable images before they reach production, directly addressing the requirement for pre-deployment vulnerability scanning.

Exam trap

The trap here is that candidates may confuse the old name 'Azure Security Center' with the current service 'Microsoft Defender for Cloud', or assume that Azure Policy can perform vulnerability scanning when it only enforces configuration compliance, not image-level security analysis.

How to eliminate wrong answers

Option A is wrong because Azure Key Vault is a secrets management service for storing keys, certificates, and passwords, not a container image vulnerability scanner. Option B is wrong because Azure Policy enforces compliance rules on Azure resources (e.g., requiring ACR to use private endpoints) but does not perform runtime or image-level vulnerability scanning. Option D is wrong because Azure Security Center was the previous name for what is now Microsoft Defender for Cloud; the current service name is Defender for Cloud, and the exam expects the updated terminology.

Full explanation →

132

MCQhard

Your company uses Microsoft Entra ID for identity management. You need to implement a solution that allows external partners to access a specific application using their own identity providers, while ensuring that their accounts are automatically deprovisioned when removed from their home organization. Which feature should you use?

A.B2B direct federation

B.Entitlement management with connected organizations

C.Self-service sign-up

D.Identity Governance access reviews

AnswerB

Correct. Entitlement management with connected organizations automates the lifecycle of external identities, including deprovisioning when the user is removed from the partner's identity provider.

Why this answer

Entitlement management with connected organizations allows automatic provisioning and deprovisioning of external users based on their lifecycle in the partner organization. Option A is wrong because B2B direct federation only enables authentication without automatic deprovisioning. Option C is wrong because self-service sign-up does not manage deprovisioning.

Option D is wrong because Identity Governance access reviews are periodic and do not automatically deprovision based on removal from the home organization.

Full explanation →

133

MCQmedium

Your organization uses Microsoft Entra ID and plans to implement a Zero Trust security model. You need to ensure that all access requests to corporate applications are continuously evaluated based on user risk, device compliance, and location. Which Microsoft Entra ID feature should you configure?

A.Identity Governance

B.Privileged Identity Management (PIM)

C.Identity Protection

D.Conditional Access

AnswerD

Conditional Access enforces policies based on user, device, and location signals.

Why this answer

Conditional Access is the correct feature because it enables real-time policy evaluation of access requests based on signals such as user risk (from Identity Protection), device compliance (via Microsoft Intune), and location (IP address ranges or named locations). This aligns directly with the Zero Trust principle of 'never trust, always verify' by continuously re-evaluating each access attempt rather than relying on static permissions.

Exam trap

The trap here is that candidates often confuse Identity Protection (which only detects risk) with Conditional Access (which enforces policies based on that risk), leading them to select Option C instead of D.

How to eliminate wrong answers

Option A is wrong because Identity Governance focuses on managing user lifecycle, access reviews, and entitlement management, not on real-time risk-based access evaluation. Option B is wrong because Privileged Identity Management (PIM) provides just-in-time privileged role activation and approval workflows, but it does not evaluate device compliance or location for general application access. Option C is wrong because Identity Protection detects and reports user and sign-in risks (e.g., leaked credentials, anonymous IP addresses) but does not enforce access decisions itself; it requires integration with Conditional Access to block or require MFA based on those risks.

Full explanation →

134

MCQmedium

A company, Fabrikam, has a hybrid identity environment with on-premises Active Directory synchronized to Azure AD using Azure AD Connect. They have implemented a Zero Trust strategy that includes requiring multi-factor authentication (MFA) for all users accessing cloud applications. They use Conditional Access policies to enforce MFA. Recently, they noticed that users who authenticate from the on-premises network are not being prompted for MFA when accessing cloud apps, even though the Conditional Access policy is configured to require MFA for all users. The network location is not excluded in the policy. The Conditional Access policy is enabled and in 'Enforce' mode. The users' devices are not domain-joined. What is the most likely reason for this behavior?

A.Azure AD Connect is not configured for Pass-through Authentication

B.The Conditional Access policy does not include session controls

C.The Conditional Access policy is not targeting the correct user group

D.Users are using legacy authentication protocols that do not support MFA

AnswerD

Legacy authentication protocols such as POP3, IMAP4, and SMTP do not support modern authentication and therefore cannot present additional MFA challenges or respond to Conditional Access grant controls. Azure AD treats these clients as unmanaged and typically exempts them from Conditional Access policies unless explicitly blocked via a separate legacy authentication policy. As a result, users relying on legacy clients can authenticate with only a password, explaining why MFA is being bypassed.

Why this answer

The most likely reason is that users are using legacy authentication protocols (e.g., POP3, IMAP, SMTP, or older Office clients) that do not support modern authentication and thus cannot enforce MFA via Conditional Access. Even though the policy requires MFA, legacy protocols bypass the Conditional Access engine entirely, allowing authentication without MFA prompts.

Exam trap

The trap here is that candidates often focus on policy configuration (e.g., user targeting, session controls) or authentication methods, but the real issue is that legacy protocols completely bypass Conditional Access, making MFA enforcement impossible regardless of policy settings.

How to eliminate wrong answers

Option A is wrong because Pass-through Authentication is an authentication method (not related to MFA enforcement) and does not affect whether Conditional Access policies prompt for MFA; the issue is about protocol support, not authentication flow. Option B is wrong because session controls (e.g., app-enforced restrictions, sign-in frequency) are optional and not required for MFA enforcement; the core MFA requirement is a grant control, not a session control. Option C is wrong because the scenario states the policy targets 'all users' and is in 'Enforce' mode, so user group targeting is not the issue; the problem is protocol-level bypass.

Full explanation →

135

Multi-Selectmedium

Your organization is implementing Microsoft Intune for mobile device management. You need to design a solution that ensures corporate data on mobile devices is protected if the device is lost or stolen. Which TWO actions should you configure?

Select 2 answers

A.Enforce a minimum PIN length on devices

B.Configure a compliance policy that requires device encryption

C.Deploy a selective wipe policy that removes corporate data

D.Require app protection policies (MAM) for all apps

E.Enable jailbreak detection in a device compliance policy

AnswersB, C

A compliance policy that mandates device encryption ensures that the storage medium (e.g., internal flash) is encrypted, typically using the hardware security module and a recovery key managed by the device, so that if the device is lost, the data is unreadable without the decryption key. This is a protective measure at rest; in addition, the compliance policy can trigger conditional access to block non-compliant devices, but the encryption itself is the core safeguard that prevents data exposure from physical access.

Why this answer

A compliance policy requiring device encryption ensures that if a device is lost or stolen, the data stored on it is unreadable without the decryption key. Intune compliance policies evaluate encryption status (e.g., BitLocker on Windows, FileVault on macOS, or device encryption on iOS/Android) and mark noncompliant devices for conditional access blocking, preventing unauthorized access to corporate data.

Exam trap

The trap here is that candidates often confuse device-level encryption (compliance policy) with app-level protection (MAM) or access controls (PIN, jailbreak detection), failing to recognize that only encryption and selective wipe directly address data protection on a lost or stolen device.

Full explanation →

136

MCQmedium

Your organization uses Microsoft Intune to manage devices. You need to ensure that devices that are not compliant with your organization's security policies are blocked from accessing corporate resources. Which Intune feature should you configure?

A.App protection policies

B.Device configuration profiles

C.Compliance policies

D.Enrollment restrictions

AnswerC

Compliance policies in Intune define the specific conditions a device must meet to be considered compliant, such as required OS versions, password requirements, encryption status, and threats detected by Mobile Threat Defense. Each device periodically uploads its health and configuration to the Intune service, which computes a compliant/non-compliant state. This state can then be consumed by Azure AD Conditional Access to allow or block access to emails, apps, and data based on real-time compliance. When a policy is combined with a Conditional Access policy requiring device compliance, non-compliant devices are blocked from accessing protected resources—making this the correct answer.

Why this answer

Compliance policies in Microsoft Intune define the rules and settings that devices must meet to be considered compliant (e.g., requiring a minimum OS version, encryption, or a healthy device health attestation). When a device is marked as non-compliant, Intune can automatically block access to corporate resources such as Exchange Online, SharePoint, or VPN by integrating with Conditional Access in Microsoft Entra ID. This is the correct feature because it directly evaluates device compliance and enforces access control.

Exam trap

The trap here is that candidates confuse device configuration profiles (which apply settings) with compliance policies (which evaluate settings and enforce access), leading them to select Option B when the question specifically asks about blocking access based on non-compliance.

How to eliminate wrong answers

Option A is wrong because App protection policies (MAM) manage how data is accessed and shared within apps on devices that may not be enrolled in Intune, but they do not block device-level access to corporate resources based on device compliance. Option B is wrong because Device configuration profiles push settings (e.g., Wi-Fi, VPN, email) to devices but do not evaluate or enforce compliance; they are separate from the compliance evaluation and conditional access workflow. Option D is wrong because Enrollment restrictions control which devices can enroll in Intune (e.g., by platform or OS version), but they do not block access for devices that are already enrolled and become non-compliant after enrollment.

Full explanation →

137

Multi-Selecthard

You are designing a secure access strategy for Azure App Service web applications. The requirements are: use Azure AD for authentication, restrict access to specific IP ranges, and require multi-factor authentication (MFA) for all users. Which two components should you configure? (Choose two.)

Select 2 answers

A.Apply a network security group (NSG) to the App Service subnet

B.Configure Azure App Service authentication with Microsoft Entra ID

C.Create a Conditional Access policy in Microsoft Entra ID that requires MFA and restricts IP ranges

D.Deploy Azure Firewall to filter inbound traffic

E.Register the application in Microsoft Entra ID

AnswersB, C

Azure App Service authentication can be configured to use Microsoft Entra ID, which is required for user authentication.

Why this answer

Options B and C are correct. Azure App Service authentication can be configured to use Microsoft Entra ID for user authentication, and a Conditional Access policy can enforce MFA and restrict IP ranges. Option A is incorrect because applying an NSG to the App Service subnet is not the direct method for IP restriction; IP restrictions can be configured directly in the App Service settings.

Option D is incorrect because Azure Firewall is a network-level firewall and does not handle user authentication or application-level access control. Option E is incorrect because registering the application is a prerequisite but not a component that directly enforces access rules.

Full explanation →

138

MCQhard

Your organization is implementing a zero-trust security model. You need to design a solution that continuously verifies user identity, device compliance, and access context before granting access to corporate resources. The solution should also support risk-based policies. Which Microsoft security capability should be at the core of this design?

A.Microsoft Defender for Identity

B.Microsoft Entra ID Conditional Access

C.Microsoft Sentinel

D.Microsoft Intune

AnswerB

Conditional Access is the central policy engine that incorporates user, device, location, and risk signals to enforce zero-trust access.

Why this answer

Microsoft Entra ID Conditional Access is the core policy engine for zero-trust, enabling continuous verification of user identity, device compliance, and access context before granting resource access. It integrates with risk signals from Microsoft Entra ID Protection to enforce risk-based policies, such as requiring multi-factor authentication when sign-in risk is high. This aligns directly with the zero-trust principle of 'never trust, always verify' by evaluating conditions in real time.

Exam trap

The trap here is that candidates often confuse Microsoft Intune's device compliance enforcement with the actual policy decision engine, not realizing that Intune provides the device compliance state but Conditional Access is the component that evaluates that state along with identity and risk to make the access decision.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Identity is a security solution that detects on-premises Active Directory attacks using behavioral analytics, not a policy engine for continuous access verification or risk-based conditional access. Option C is wrong because Microsoft Sentinel is a cloud-native SIEM/SOAR for threat detection and incident response, not a tool for enforcing access policies based on user identity, device compliance, or risk context at the point of authentication. Option D is wrong because Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) service that enforces device compliance policies, but it does not evaluate identity, access context, or risk signals to grant or deny access—it relies on Conditional Access to consume its compliance status.

Full explanation →

139

MCQeasy

A company uses Azure SQL Database and needs to implement column-level encryption for a column containing social security numbers (SSNs). The encryption must use a customer-managed key stored in Azure Key Vault. The application queries this column using parameterized queries. Which technology should be used?

A.Dynamic Data Masking (DDM)

B.Row-Level Security (RLS)

C.Transparent Data Encryption (TDE) with customer-managed keys

D.Always Encrypted with secure enclaves

AnswerD

Always Encrypted with secure enclaves is the correct solution because it provides true column-level encryption where plaintext values are never exposed to the Azure SQL Database engine. Client-side drivers encrypt data before transmission, and the database only sees ciphertext; secure enclaves (based on Intel SGX or Windows Virtualization-Based Security) enable confidential computing operations such as equality and pattern matching on encrypted columns without revealing plaintext to the engine. This accomplishes both at-rest and in-use column protection, which is exactly what the requirement asks for.

Why this answer

Always Encrypted with secure enclaves is the correct choice because it enables client-side encryption of specific columns (like SSNs) using a customer-managed key stored in Azure Key Vault, while still allowing rich computations (e.g., equality, pattern matching) on the encrypted data within a secure enclave. This meets the requirement for column-level encryption with customer-managed keys and supports parameterized queries without exposing plaintext to the database engine.

Exam trap

The trap here is that candidates often confuse Transparent Data Encryption (TDE) with column-level encryption, mistakenly believing TDE protects data from the database engine or privileged users, whereas TDE only protects data at rest on disk and does not prevent in-memory exposure.

How to eliminate wrong answers

Option A is wrong because Dynamic Data Masking (DDM) only obfuscates data at query results time for unauthorized users, but does not encrypt the data at rest or in transit, and the underlying plaintext remains accessible to the database engine. Option B is wrong because Row-Level Security (RLS) controls access to rows based on user predicates but does not encrypt individual columns or protect data from the database engine itself. Option C is wrong because Transparent Data Encryption (TDE) encrypts the entire database at rest, not individual columns, and does not prevent the database engine or privileged users from seeing plaintext data in memory or during query execution.

Full explanation →

140

MCQmedium

Your organization uses Microsoft Intune for mobile device management and Microsoft Entra ID for identity. You are designing a solution to ensure that only devices that are compliant with security policies can access corporate resources. The requirements are: 1) Devices must have a minimum OS version. 2) Devices must have encryption enabled. 3) Devices must not be jailbroken or rooted. 4) Access to corporate apps must be blocked if the device is non-compliant. 5) The solution should automatically remediate non-compliant devices when possible. You need to recommend the minimum configuration. What should you do?

A.Configure Microsoft Purview Compliance Manager to assess compliance and block access.

B.Create an app protection policy in Intune that requires minimum OS and encryption.

C.Create a device compliance policy in Intune with the required settings, and create a Conditional Access policy that requires compliant devices.

D.Create a device configuration policy in Intune for the settings, and use Azure AD Identity Protection to block access.

AnswerC

Compliance policies define requirements; Conditional Access enforces them.

Why this answer

Intune device compliance policies define the required security settings (minimum OS, encryption, jailbreak/root detection) and can include actions for automatic remediation when possible. A Conditional Access policy in Entra ID then requires devices to be marked compliant before accessing corporate resources. Option A is incorrect because Microsoft Purview Compliance Manager is a compliance management tool that does not enforce real-time access control.

Option B is incorrect because app protection policies (MAM) operate at the app level and do not enforce device-level compliance. Option D is incorrect because device configuration policies are for settings management, not compliance enforcement, and Entra ID Identity Protection is for risk-based policies, not device compliance checks.

Full explanation →

141

MCQhard

Your organization is implementing a data loss prevention (DLP) strategy using Microsoft Purview. The compliance team needs to automatically classify and label sensitive data in Microsoft 365, Azure SQL Database, and Amazon S3. Which Purview feature should you use?

A.Microsoft Purview Data Map

B.Microsoft Purview Information Protection

C.Microsoft Purview Records Management

D.Microsoft Defender for Cloud Apps

AnswerA

Microsoft Purview Data Map is the correct choice because it provides automated scanning and classification of sensitive data across hybrid and multi-cloud environments, including on-premises, Azure, and other clouds such as AWS S3. Its data scanners can connect to Azure SQL databases and S3 buckets, inspect schemas and content, and apply classifications that feed into DLP policies. This makes it uniquely capable of discovering and mapping sensitive data at rest in non-Microsoft 365 sources, which is the core requirement here.

Why this answer

Microsoft Purview Data Map is the correct choice because it provides unified data governance across hybrid and multi-cloud environments, including Microsoft 365, Azure SQL Database, and Amazon S3. It automatically scans, classifies, and labels sensitive data using built-in classifiers and sensitivity labels, enabling consistent DLP policies across these disparate data sources.

Exam trap

The trap here is that candidates often confuse the scanning and classification capabilities of Microsoft Purview Data Map with the labeling and protection features of Microsoft Purview Information Protection, but the Data Map is the service that actually discovers and classifies data across multiple clouds, while Information Protection applies the labels after classification.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview Information Protection focuses on applying sensitivity labels and encryption to data within Microsoft 365 and Azure, but it does not natively scan or classify data in Amazon S3. Option C is wrong because Microsoft Purview Records Management is designed for managing retention, disposition, and legal hold of records, not for automatic classification and labeling of sensitive data across multi-cloud sources. Option D is wrong because Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides threat protection and visibility for cloud apps, but it does not perform automatic data classification and labeling across Microsoft 365, Azure SQL, and Amazon S3 as a primary function.

Full explanation →

142

MCQhard

Your organization is designing a hybrid identity infrastructure with Microsoft Entra ID. You need to ensure that users can access on-premises applications using passwordless authentication and that the solution minimizes latency for authentication requests. What should you implement?

A.Join the on-premises servers to Microsoft Entra Domain Services and use passwordless authentication.

B.Use Microsoft Entra application proxy to publish the on-premises applications and enable passwordless authentication.

C.Install Web Application Proxy (WAP) on-premises and integrate with Microsoft Entra ID for passwordless.

D.Deploy a VPN and use Microsoft Entra ID with passwordless sign-in.

AnswerB

Correct. Microsoft Entra application proxy publishes on-premises apps and supports passwordless authentication with low latency.

Why this answer

Microsoft Entra application proxy provides secure remote access to on-premises web applications by publishing them through the Microsoft Entra ID service. It allows users to authenticate using passwordless methods (e.g., Windows Hello, FIDO2, Microsoft Authenticator) and minimizes latency by proxying requests through Microsoft's infrastructure without requiring a VPN. Option A is incorrect because Microsoft Entra Domain Services is for domain-joined VMs, not for publishing applications.

Option C is incorrect because Web Application Proxy is a legacy on-premises component that does not integrate with passwordless authentication and lacks the software-defined perimeter capabilities of Entra application proxy. Option D is incorrect because VPNs introduce latency and do not inherently support passwordless authentication.

Full explanation →

143

MCQhard

You are the security architect for a multinational corporation that uses Azure Active Directory (Azure AD) and Microsoft 365. The company has recently experienced a security incident where a compromised user account was used to access sensitive data from a legacy application that does not support modern authentication. To mitigate this risk, you have been asked to recommend a set of security best practices and priorities. The environment includes 50,000 users, 200 applications (many legacy), and a hybrid identity setup with Active Directory Domain Services (AD DS) synchronized to Azure AD via Azure AD Connect. The security team wants to reduce the attack surface, enforce least privilege, and improve identity protection. Current issues include: (1) many users have standing admin privileges on workstations, (2) legacy apps use shared service accounts with weak passwords, (3) Conditional Access policies are not applied consistently, and (4) there is no process for reviewing privileged role assignments. Which course of action should you recommend as the highest priority?

A.Migrate legacy applications to support modern authentication and use Azure AD Application Proxy

B.Implement Azure AD Privileged Identity Management (PIM) for just-in-time access and role approval workflows

C.Deploy Azure AD Password Protection and enforce banned password lists

D.Implement Conditional Access policies to block legacy authentication and require MFA for all users

AnswerB

Directly reduces standing admin privileges and adds review.

Why this answer

Implementing Azure AD Privileged Identity Management (PIM) directly addresses the highest-priority risk: the lack of oversight and control over privileged role assignments. With 50,000 users and many standing admin privileges on workstations, PIM enables just-in-time (JIT) activation, approval workflows, and time-bound roles, which drastically reduces the attack surface by eliminating permanent privileged access. This is the most critical first step because unmanaged privileged accounts are the primary vector for lateral movement and data exfiltration, as demonstrated in the incident.

Exam trap

The trap here is that candidates often prioritize blocking legacy authentication (Option D) or password policies (Option C) because they seem directly related to the incident, but the highest priority in a hybrid environment with 50,000 users is eliminating standing privileged access through PIM, which is the root cause of the attack surface expansion.

How to eliminate wrong answers

Option A is wrong because migrating legacy applications to support modern authentication and using Azure AD Application Proxy is a long-term architectural change that does not address the immediate, highest-priority risk of unmanaged privileged role assignments; it also does not mitigate the standing admin privileges on workstations or the shared service account issue. Option C is wrong because deploying Azure AD Password Protection and enforcing banned password lists, while useful, only addresses weak passwords for shared service accounts and does not solve the core problem of standing admin privileges, inconsistent Conditional Access, or lack of privileged role review. Option D is wrong because implementing Conditional Access policies to block legacy authentication and require MFA for all users is important but does not directly address the lack of privileged role assignment review or the standing admin privileges on workstations; it also cannot enforce JIT access or approval workflows for privileged roles.

Full explanation →

144

MCQmedium

A company uses Microsoft Purview to classify data and enforce retention policies. They need to automatically apply a retention label to all documents containing credit card numbers. Which approach should they use?

A.Configure an auto-labeling policy with a sensitive info type

B.Use a trainable classifier

C.Create a manual labeling policy for users

D.Use a default label for SharePoint libraries

AnswerA

Auto-labeling applies labels based on content.

Why this answer

Microsoft Purview auto-labeling policies can automatically apply retention labels to documents based on sensitive info types (SITs), such as credit card numbers. This approach uses pattern matching to detect the credit card number format and applies the label without user intervention, meeting the requirement for automatic enforcement.

Exam trap

The trap here is that candidates may confuse trainable classifiers with sensitive info types, thinking that 'intelligent' classification is always better, but SITs are the correct choice for specific, pattern-based data like credit card numbers.

How to eliminate wrong answers

Option B is wrong because trainable classifiers are designed to identify content based on context and patterns (e.g., contracts or resumes), not specific sensitive data like credit card numbers, which are better matched by SITs. Option C is wrong because manual labeling policies require users to apply labels themselves, contradicting the requirement for automatic application. Option D is wrong because a default label for SharePoint libraries applies a label to all documents in the library regardless of content, not selectively to those containing credit card numbers.

Full explanation →

145

Drag & Dropmedium

Order the steps to configure a Conditional Access policy requiring MFA for all users.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Conditional Access policy creation involves assignments for users and apps, then access controls like MFA.

Full explanation →

146

MCQhard

Refer to the exhibit. You are reviewing a Microsoft Defender for Cloud automation resource. You want the automation to trigger a playbook in Microsoft Sentinel when a high-severity security assessment is found. Based on the exhibit, what is the missing configuration?

A.The severity filter should be 'Low' to capture all assessments

B.The action type should be 'LogicApp' instead of 'EventHub'

C.The eventSource should be 'Alerts' instead of 'Assessments'

D.The API version should be '2020-01-01'

AnswerB

To invoke a playbook in Microsoft Defender for Cloud, the automation action must be of type 'LogicApp' and contain the playbook's callback URL, not 'EventHub'. An EventHub action simply exports the event to an event hub for ingestion by external systems, whereas LogicApp directly triggers the playbook's workflow. Because the requirement is to run a playbook, the action type is the misconfigured property, and correcting it from EventHub to LogicApp is the necessary fix.

Why this answer

Microsoft Defender for Cloud automation can trigger a playbook in Microsoft Sentinel only by using a LogicApp action. The exhibit shows an EventHub action type, which is used for streaming events to an event hub, not for invoking a playbook. To trigger a Sentinel playbook from a Defender for Cloud assessment, the action type must be set to 'LogicApp' and configured with the playbook's trigger URL.

Exam trap

The trap here is that candidates may focus on the severity filter or event source, overlooking that the action type must be specifically 'LogicApp' to invoke a playbook, as 'EventHub' is a valid action but for a different purpose.

How to eliminate wrong answers

Option A is wrong because setting the severity filter to 'Low' would capture low-severity assessments, not high-severity ones; the requirement is to trigger on high-severity assessments, so the filter should be 'High'. Option C is wrong because the eventSource should remain 'Assessments' to trigger on security assessments; changing it to 'Alerts' would trigger on security alerts instead, which is a different data type. Option D is wrong because the API version '2020-01-01' is not relevant to the missing configuration; the automation resource uses the correct API version for its definition, and the issue is the action type, not the API version.

Full explanation →

147

MCQmedium

Your organization uses Microsoft Sentinel and wants to correlate security events from multiple sources to detect multi-stage attacks. What should you create?

A.Scheduled query rule

B.NRT rule

C.Anomaly rule

D.Fusion rule

AnswerD

Fusion rules are built-in analytics rules in Microsoft Sentinel that use machine learning to correlate alerts from multiple Microsoft security products (e.g., Microsoft Defender for Identity, Defender for Office 365, Microsoft Entra ID Protection) into a single incident. The fusion engine maps alerts to MITRE ATT&CK stages, linking actions like initial access, lateral movement, and exfiltration into one coherent story. Because it automatically identifies multi-stage attack patterns without custom KQL, Fusion is the correct rule type for the organization's requirement to correlate multi-stage attacks.

Why this answer

Fusion rules in Microsoft Sentinel are specifically designed to correlate security events from multiple sources and detect multi-stage attacks by combining alerts from different detection technologies into a single incident. This matches the requirement to correlate events across sources for complex attack chains, unlike other rule types that focus on single-source or single-event detection.

Exam trap

The trap here is that candidates often confuse scheduled query rules or NRT rules as the primary tool for correlation, but those require manual KQL logic to join data across sources, whereas Fusion provides automated, built-in multi-source correlation for multi-stage attacks.

How to eliminate wrong answers

Option A is wrong because scheduled query rules run queries at regular intervals against a single data source or table, and they cannot natively correlate events from multiple disparate sources to detect multi-stage attacks. Option B is wrong because NRT (Near-Real-Time) rules provide low-latency detection but still operate on a single query against one or more tables, lacking the built-in multi-source correlation logic of Fusion. Option C is wrong because anomaly rules use machine learning to detect deviations from baseline behavior on a single data source, not to correlate events across multiple sources for multi-stage attack detection.

Full explanation →

148

MCQmedium

Your organization uses Microsoft Entra ID and needs to ensure that external partners can access only specific applications for 30 days. What should you configure?

A.Entitlement management and create an access package with an expiration of 30 days

B.B2B direct connect

C.Self-service group management

D.Conditional Access policy with session control

AnswerA

Access packages in entitlement management allow you to grant time-limited access to applications for external users.

Why this answer

Entitlement management in Microsoft Entra ID allows you to create access packages that govern external partner access to specific applications. By configuring an access package with a 30-day expiration, you enforce time-limited access, ensuring partners can only access the designated applications for the required duration. This directly meets the requirement of restricting access to specific apps with a defined expiry.

Exam trap

The trap here is that candidates often confuse Conditional Access session controls (which manage sign-in frequency or app restrictions) with the ability to grant and expire access to specific applications, overlooking that entitlement management is the correct identity governance solution for time-limited external access.

How to eliminate wrong answers

Option B (B2B direct connect) is wrong because it is designed for mutual two-way access between organizations, typically for Teams Connect shared channels, and does not provide granular control over application-specific access or automatic expiration. Option C (self-service group management) is wrong because it allows users to create and manage their own groups, but it does not enforce time-bound access to specific applications or support external partner lifecycle management. Option D (Conditional Access policy with session control) is wrong because while it can enforce session restrictions like sign-in frequency, it cannot grant or expire access to specific applications for external users; it only controls access conditions for users who already have access.

Full explanation →

149

MCQhard

A company uses Microsoft Sentinel and wants to prioritize incidents using user risk scores from Microsoft Entra ID Protection. Which configuration should they use to automatically assign a Sentinel severity based on the user's risk level?

A.Create a custom analytics rule that uses the RiskLevel field to set severity

B.Configure an automation rule to set severity when risk is high

C.Use a watchlist to map risk levels to severity

D.Create a playbook that assigns severity based on risk

AnswerA

Creating a custom analytics rule is the technically correct approach because analytics rules in Microsoft Sentinel evaluate telemetry at ingestion time and can dynamically assign incident severity by referencing data fields such as the RiskLevel attribute from Microsoft Entra ID Protection. By setting the Alert Severity to a value derived from RiskLevel (e.g., High if risk is medium, Higher if risk is high), the incident is created with the appropriate priority immediately, enabling efficient triage without further post-processing. This native, rule-based mapping is the only option among the listed alternatives that directly controls initial incident severity as the incident is generated from raw log data.

Why this answer

A is correct because Microsoft Sentinel's custom analytics rules can directly reference the `RiskLevel` field from Microsoft Entra ID Protection user risk data ingested via the UEBA connector. By writing a KQL query that checks the user's risk level (e.g., `RiskLevel == 'high'`) and mapping it to a Sentinel severity (e.g., High, Medium, Low) within the rule's incident creation settings, you automate severity assignment without external dependencies. This native integration ensures real-time synchronization of risk levels to incident priority.

Exam trap

The trap here is that candidates often assume automation rules or playbooks are required for any custom severity assignment, overlooking that custom analytics rules can directly map query results to severity fields without additional automation layers.

How to eliminate wrong answers

Option B is wrong because automation rules can set severity based on conditions like incident properties or entities, but they cannot directly read the `RiskLevel` field from Entra ID Protection user risk data; they operate on incident metadata after creation, not on raw risk signals. Option C is wrong because watchlists are static reference tables used for enrichment or correlation, not for dynamic, real-time mapping of continuously changing user risk levels to severity. Option D is wrong because playbooks (Azure Logic Apps) can assign severity, but they introduce latency and complexity compared to a native analytics rule, and they require additional permissions and orchestration, making them less efficient for this straightforward mapping.

Full explanation →

150

MCQeasy

Your organization needs to enforce multi-factor authentication (MFA) for all users accessing sensitive applications. You plan to use Microsoft Entra ID Conditional Access. Which grant control should you configure?

A.Require multi-factor authentication

B.Require authentication strength (e.g., phishing-resistant MFA)

C.Require device to be marked as compliant

D.Use app enforced restrictions

AnswerA

This grant control directly enforces MFA.

Why this answer

The question specifies a requirement to enforce MFA for all users accessing sensitive applications. In Microsoft Entra ID Conditional Access, the 'Require multi-factor authentication' grant control directly enforces Azure AD MFA (e.g., via Microsoft Authenticator, OATH tokens, or SMS) as the primary authentication method. This is the simplest and most direct control to meet the stated goal of requiring MFA, without adding additional constraints like device compliance or authentication strength levels.

Exam trap

The trap here is that candidates often confuse 'Require authentication strength' (which is a newer, more specific control for phishing-resistant MFA) with the general 'Require multi-factor authentication' control, leading them to select the more complex option when the question simply asks for MFA enforcement.

How to eliminate wrong answers

Option B is wrong because 'Require authentication strength' is a more granular control that enforces a specific MFA method (e.g., phishing-resistant MFA via FIDO2 or certificate-based authentication), which is overkill for a general 'enforce MFA' requirement and may not be supported by all users. Option C is wrong because 'Require device to be marked as compliant' enforces device health (e.g., Intune compliance) but does not inherently require MFA; a user could satisfy this control with a compliant device and password only. Option D is wrong because 'Use app enforced restrictions' is a control that delegates MFA enforcement to the application itself (e.g., Exchange Online or SharePoint Online), which may not support MFA natively or may have inconsistent behavior, and it does not guarantee MFA at the identity provider level.

Full explanation →

Microsoft Cybersecurity Architect (SC-100) — Questions 76–150