Knowledge + Practice

CCNA Design security operations, identity, and compliance capabilities Questions

58 questions · Design security operations, identity, and compliance capabilities · All types, answers revealed

Practice these questions Domain overview All questions

1

MCQmedium

Your company uses Microsoft Defender for Cloud Apps and wants to prevent users from uploading sensitive files to personal cloud storage apps. What should you configure?

A.Activity policy

B.App connector

C.Session policy

D.File policy

AnswerC

Session policies, part of Conditional Access App Control, route user traffic through Defender for Cloud Apps as a reverse proxy, allowing synchronous inspection of each request and response. The proxy can evaluate conditions like device compliance, user risk, or file sensitivity and then block, allow, or restrict actions — including preventing uploads to unsanctioned apps before the request is passed through. This real-time inline enforcement is exactly what the scenario requires, making session policy the correct choice.

Why this answer

Session policy in Microsoft Defender for Cloud Apps allows real-time monitoring and control of user activities based on app and content inspection. By configuring a session policy, you can block or restrict uploads of sensitive files to personal cloud storage apps like Dropbox or Google Drive during the user's session, leveraging reverse proxy capabilities to inspect and intervene in traffic.

Exam trap

The trap here is that candidates confuse 'File policy' (which governs files at rest) with 'Session policy' (which governs files in motion), leading them to select D, even though real-time upload prevention requires session-level control via reverse proxy.

How to eliminate wrong answers

Option A is wrong because Activity policies are used for auditing and generating alerts on specific activities (e.g., multiple failed logins), not for real-time blocking of file uploads. Option B is wrong because App connectors enable API-based visibility and control for connected apps (e.g., retrieving logs), but they cannot intercept and block uploads in real time during a user session. Option D is wrong because File policies are designed for scanning and governing files already stored in cloud apps (e.g., detecting DLP violations in SharePoint), not for preventing uploads at the point of action.

Practice this question →

2

MCQeasy

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?

A.Create a Conditional Access policy that requires compliant device

B.Set up enrollment restrictions in Intune

C.Create a device configuration policy that blocks non-compliant devices

D.Configure an app protection policy for email apps

AnswerA

Conditional Access policies are the access-control layer that evaluates the device's compliance state at sign-in. When combined with an Intune compliance policy, the 'Require device to be marked as compliant' grant control forces Azure AD to check the device's compliance status and block access if the device is non-compliant. This is the correct approach because it directly enforces the access requirement for corporate resources, unlike enrollment or configuration policies that only manage settings or enrollment.

Why this answer

A Conditional Access policy in Microsoft Entra ID (formerly Azure AD) can enforce the requirement that only devices marked as compliant by Intune can access corporate email. This policy evaluates the device compliance status at authentication time and blocks or grants access based on that signal, ensuring that only managed and compliant devices can connect to services like Exchange Online.

Exam trap

The trap here is that candidates often confuse device configuration policies (which set device settings) with Conditional Access (which enforces access control based on compliance), leading them to choose option C instead of the correct policy-based access control.

How to eliminate wrong answers

Option B is wrong because enrollment restrictions in Intune control which devices can enroll into management (e.g., by platform or ownership type), but they do not enforce compliance at the point of access to corporate email. Option C is wrong because device configuration policies in Intune are used to set settings and features on devices (like password policies or restrictions), not to block non-compliant devices from accessing resources; blocking access is done via Conditional Access. Option D is wrong because an app protection policy (MAM) protects data within apps (e.g., preventing copy/paste or requiring PIN) but does not evaluate device compliance; it can be used without device enrollment but does not replace the need for a Conditional Access policy that checks device compliance.

Practice this question →

3

MCQhard

Your organization uses Microsoft Defender for Cloud to secure multi-cloud workloads. You need to ensure that Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) resources are assessed against the same security baseline. What should you do?

A.Configure AWS Config and GCP Security Command Center to export findings to Microsoft Sentinel

B.Connect AWS and GCP accounts to Defender for Cloud and use Azure Policy to enforce the Microsoft Cloud Security Benchmark

C.Use regulatory compliance standards for each cloud separately

D.Enable the Cloud Security Posture Management (CSPM) plan and configure AWS and GCP connectors

AnswerB

Connecting AWS and GCP accounts to Defender for Cloud surfaces those resources in Azure Resource Graph, where Azure Policy can apply the Microsoft Cloud Security Benchmark (MCSB), a unified initiative built on CIS/NIST plus Microsoft controls. This gives continuous compliance assessment and enforcement, like DeployIfNotExists remediation, across all clouds. As a result, every subscription or cloud account is measured against the same baseline, regardless of native cloud tooling—this is the only option that both centralizes and enforces a single baseline.

Why this answer

Microsoft Defender for Cloud's multi-cloud CSPM capabilities allow you to connect AWS and GCP accounts directly, and then apply Azure Policy to enforce the Microsoft Cloud Security Benchmark (MCSB) across all connected clouds. This ensures a unified security baseline assessment for Azure, AWS, and GCP resources, as MCSB is the default policy initiative in Defender for Cloud.

Exam trap

The trap here is that candidates confuse enabling the CSPM plan and connectors (Option D) with the complete solution, forgetting that a specific baseline policy (MCSB) must be assigned via Azure Policy to enforce the unified assessment.

How to eliminate wrong answers

Option A is wrong because exporting findings from AWS Config and GCP Security Command Center to Microsoft Sentinel is for centralized SIEM and threat detection, not for enforcing a unified security baseline across clouds. Option C is wrong because using separate regulatory compliance standards for each cloud would not enforce a single, consistent security baseline; it would result in fragmented assessments. Option D is wrong because enabling the CSPM plan and configuring connectors is a prerequisite step, but it does not by itself enforce a specific security baseline; you must also assign the Microsoft Cloud Security Benchmark policy via Azure Policy to achieve the stated goal.

Practice this question →

4

MCQmedium

Your organization uses Microsoft Purview and needs to prevent users from copying sensitive data to USB drives. Which solution should you implement?

A.Sensitivity labels with encryption

B.Insider Risk Management

C.Endpoint data loss prevention (DLP)

D.Communication Compliance

AnswerC

Endpoint data loss prevention (Endpoint DLP) is the correct choice because it installs an agent on Windows and macOS endpoints that inspects data in real time as users interact with files. It can enforce policies to block the copying of sensitive items, such as those matching sensitive info types or trainable classifiers, to removable USB devices, and optionally show a policy tip to the user. This direct, pre-action enforcement provides the precise control needed to prevent data leakage via USB.

Why this answer

Endpoint DLP is the correct solution because it extends data loss prevention policies to endpoints, enabling the detection and blocking of sensitive data being copied to removable USB drives. Unlike other controls, Endpoint DLP can monitor and restrict data exfiltration actions at the device level, such as copying files to USB media, based on the content's sensitivity classification.

Exam trap

The trap here is that candidates often confuse Insider Risk Management (a detective control) with Endpoint DLP (a preventive control), assuming that risk management can block actions, when in fact it only alerts on suspicious behavior after the fact.

How to eliminate wrong answers

Option A is wrong because sensitivity labels with encryption protect data at rest and in transit by restricting access, but they do not block the act of copying labeled data to a USB drive; encryption alone does not prevent data exfiltration via removable media. Option B is wrong because Insider Risk Management is a detection and investigation tool that identifies risky user activities (e.g., unusual file copying) but does not actively block or prevent the copy action in real time. Option D is wrong because Communication Compliance focuses on monitoring and analyzing communications (e.g., email, Teams) for policy violations, not on controlling data movement to USB drives.

Practice this question →

5

Multi-Selectmedium

Which TWO of the following are valid methods to protect privileged accounts in Microsoft Entra ID?

Select 2 answers

A.Configure Conditional Access policies for privileged roles

B.Implement Privileged Identity Management (PIM)

C.Enable Identity Protection for all users

D.Enable Self-Service Password Reset (SSPR)

E.Use Azure AD Connect to sync privileged accounts

AnswersA, B

Conditional Access can enforce MFA and other controls for privileged roles.

Why this answer

Conditional Access policies can be configured to require stronger authentication, device compliance, or location-based controls specifically for users assigned to privileged roles (e.g., Global Administrator, Privileged Role Administrator). This directly protects privileged accounts by enforcing additional security requirements before granting access to Entra ID resources.

Exam trap

The trap here is that candidates often confuse general security features (like Identity Protection or SSPR) with dedicated privileged account protection mechanisms, failing to recognize that only PIM and Conditional Access policies for privileged roles directly control and restrict privileged access in Entra ID.

Practice this question →

6

Multi-Selecteasy

Your organization uses Microsoft Purview Information Protection to label sensitive emails. You need to ensure that labels are applied automatically based on content. Which THREE methods can you use?

Select 3 answers

A.Manual labeling by users

B.File plan (for records management)

C.Sensitive information types

D.Auto-labeling policies in Microsoft Purview

E.Trainable classifiers

AnswersC, D, E

Sensitive info types detect data like credit cards for automatic labeling.

Why this answer

Sensitive information types (C) are predefined or custom patterns that detect sensitive data such as credit card numbers or social security numbers, enabling automatic label application. Auto-labeling policies in Microsoft Purview (D) apply labels automatically to emails and files based on conditions like sensitive information types or trainable classifiers. Trainable classifiers (E) use machine learning to identify content patterns and automatically apply labels without requiring explicit pattern definitions.

Exam trap

The trap here is that candidates may confuse manual labeling or records management tools (like file plans) with automatic content-based labeling mechanisms, but only sensitive information types, auto-labeling policies, and trainable classifiers directly support automatic label application based on content analysis.

Practice this question →

7

Multi-Selectmedium

Which TWO actions should you take to implement a zero-trust identity strategy in Microsoft Entra ID?

Select 2 answers

A.Enable single sign-on for all applications

B.Require multi-factor authentication for all users

C.Implement passwordless authentication for all users

D.Synchronize all on-premises identities to the cloud

E.Configure Conditional Access policies based on user risk and device compliance

AnswersB, E

MFA is a key zero-trust principle.

Why this answer

For a zero-trust identity strategy in Microsoft Entra ID, requiring multi-factor authentication (MFA) for all users (option B) is a fundamental control to verify identity. Configuring Conditional Access policies based on user risk and device compliance (option E) enforces adaptive, context-aware access. Option A (single sign-on) improves user experience but does not directly enforce zero-trust.

Option C (passwordless authentication) enhances security but is not a specific zero-trust action; MFA is more critical. Option D (synchronizing identities) supports hybrid scenarios but does not advance zero-trust principles.

Practice this question →

8

MCQeasy

Your organization uses Microsoft Sentinel and wants to automatically respond to high-severity incidents. Which feature should you configure?

A.Configure an automation rule to run a playbook automatically

B.Create a playbook and run it manually for each incident

C.Set up an analytics rule with automatic response

D.Use a workbook to trigger a playbook

AnswerA

Automation rules in Microsoft Sentinel are event-driven orchestration mechanisms that evaluate newly created or updated incidents against configured conditions—such as severity or name—and then execute one or more linked playbooks automatically. Playbooks are Azure Logic Apps that can perform remediation steps like isolation, data collection, or notification, ensuring consistent, immediate response without human involvement. This is the only approach listed that satisfies 'automatically' while honoring incident context, since automation rules trigger exactly when incidents are created or changed.

Why this answer

Automation rules in Microsoft Sentinel allow you to define automated responses that trigger when an incident is created or updated, including running playbooks (Azure Logic Apps workflows) automatically. This is the correct approach for automatically responding to high-severity incidents because it eliminates manual intervention and ensures consistent, immediate action based on incident properties like severity.

Exam trap

The trap here is confusing analytics rule automated responses (which run on alerts before incident creation) with automation rules (which run on incidents after creation), leading candidates to incorrectly select Option C for incident-level automation.

How to eliminate wrong answers

Option B is wrong because running a playbook manually for each incident defeats the purpose of automation and does not scale for high-severity incidents that require immediate response. Option C is wrong because analytics rules generate alerts, not incidents, and while they can have automated responses, those responses run on alerts before incidents are created; for incident-level automated response, you need automation rules. Option D is wrong because workbooks are visualization and reporting tools, not triggers for playbooks; they cannot initiate automated response actions.

Practice this question →

9

MCQhard

Your organization uses Microsoft Defender for Cloud Apps. You need to detect and block data exfiltration from sanctioned cloud apps to personal devices. What should you configure?

A.Create an OAuth app policy to revoke permissions.

B.Create an app discovery policy to identify unsanctioned apps.

C.Create a file policy to detect sensitive data in sanctioned apps.

D.Create a session policy with app governance to block download.

AnswerD

Session policies can block data exfiltration in real time.

Why this answer

A session policy with app governance in Microsoft Defender for Cloud Apps allows you to monitor and control user activities in real time. By configuring a session policy to block downloads, you can prevent data exfiltration from sanctioned cloud apps to personal devices, as the policy inspects HTTP/HTTPS traffic and enforces access controls based on user context and device compliance.

Exam trap

The trap here is that candidates often confuse file policies (which detect sensitive data after it is stored) with session policies (which prevent exfiltration in real time), leading them to choose Option C instead of D.

How to eliminate wrong answers

Option A is wrong because an OAuth app policy revokes permissions for third-party apps that have been granted access to cloud app data, but it does not control user download actions from sanctioned apps to personal devices. Option B is wrong because an app discovery policy identifies and monitors unsanctioned cloud apps in the environment, but it does not block data exfiltration from already sanctioned apps. Option C is wrong because a file policy detects sensitive data within sanctioned apps and can trigger alerts or automated actions, but it does not block downloads in real time; it is reactive rather than preventive.

Practice this question →

10

MCQhard

Your organization uses Microsoft Intune to manage devices and wants to ensure that only compliant devices can access corporate email. Which conditional access policy setting should you configure?

A.Require device to be marked as compliant

B.Require approved client app

C.Require Multi-Factor Authentication

D.Require domain join

AnswerA

The 'Require device to be marked as compliant' grant control is correct because Intune compliance policies evaluate the device's configuration, health, and security posture. In Conditional Access, this control blocks access unless the device meets the specific compliance criteria defined in Intune, such as encryption, patch level, and threat detection. It ensures a device-level trust boundary before granting access to corporate resources, making it the appropriate device compliance control.

Why this answer

The 'Require device to be marked as compliant' setting in a Conditional Access policy enforces that only devices meeting your Intune compliance policies (e.g., encryption, OS version, threat level) can access corporate email. This setting checks the device's compliance status reported by Intune to Azure AD during authentication, blocking non-compliant devices before they reach Exchange Online.

Exam trap

The trap here is that candidates often confuse 'Require approved client app' (which controls app-level access) with device compliance, thinking that restricting the app is sufficient to secure email, but it does not enforce device health or configuration.

How to eliminate wrong answers

Option B is wrong because 'Require approved client app' controls which client applications (e.g., Outlook mobile, Teams) can access data, not the device's compliance state; it does not enforce device health or configuration. Option C is wrong because 'Require Multi-Factor Authentication' adds an authentication factor but does not evaluate device compliance; a compromised but MFA-enabled device could still access email. Option D is wrong because 'Require domain join' is for Windows devices joined to on-premises Active Directory, not for mobile or BYOD devices managed by Intune; it does not check Intune compliance policies.

Practice this question →

11

Multi-Selecthard

Which THREE capabilities does Microsoft Purview provide for compliance management?

Select 3 answers

A.Identity protection and risk detection

B.Information protection with sensitivity labels

C.Data classification and labeling

D.Endpoint detection and response

E.eDiscovery and audit

AnswersB, C, E

Purview provides sensitivity labels.

Why this answer

Microsoft Purview provides compliance management capabilities including information protection with sensitivity labels, which allow organizations to classify and protect sensitive data across Microsoft 365 services, endpoints, and third-party apps. Sensitivity labels enforce encryption, visual markings, and access restrictions based on policy, directly supporting data loss prevention and governance.

Exam trap

The trap here is that candidates confuse Microsoft Purview's compliance-focused capabilities (like eDiscovery, audit, and sensitivity labels) with security operations tools (like identity protection and endpoint detection), which belong to separate Microsoft 365 security solutions.

Practice this question →

12

Multi-Selectmedium

Your organization uses Microsoft Purview to classify sensitive data. You need to automatically apply a sensitivity label to documents that contain personally identifiable information (PII). Which TWO components should you configure?

Select 2 answers

A.Auto-labeling policy

B.Retention label

C.Data Loss Prevention (DLP) policy

D.Sensitivity label

E.Trainable classifier

AnswersA, D

An auto-labeling policy in Microsoft Purview applies sensitivity labels automatically based on conditions such as the presence of sensitive information types, including PII. This satisfies the stem’s requirement for automatic application without user intervention, using machine learning or exact data match classifiers to detect PII patterns within documents.

Why this answer

Auto-labeling policy (A) is correct because it automatically applies sensitivity labels to documents based on conditions such as the presence of sensitive data types (e.g., PII). Sensitivity label (D) is correct because it defines the classification and protection settings (e.g., encryption, markings) that are applied to the content. Together, they enable automatic classification of PII documents without manual user intervention.

Exam trap

The trap here is that candidates often confuse DLP policies (which detect and block data exfiltration) with auto-labeling policies (which apply classification labels), leading them to incorrectly select DLP policy as a component for automatic labeling.

Practice this question →

13

MCQeasy

You need to design a solution to synchronize on-premises Active Directory users to Microsoft Entra ID for hybrid identity. Which tool should you use?

A.Microsoft Identity Manager (MIM)

B.Microsoft Entra Connect

C.Microsoft Entra Connect Cloud Sync

D.Active Directory Federation Services (AD FS)

AnswerB

Microsoft Entra Connect is the primary, purpose-built tool for synchronizing on-premises Active Directory identities to Microsoft Entra ID. It replicates user, group, and device objects, and supports password hash synchronization, pass-through authentication, and federation integration. As the successor to DirSync and Azure AD Sync, it's the standard first-party solution for hybrid identity, and it is the correct choice when a straightforward, sanctioned sync mechanism is required.

Why this answer

Microsoft Entra Connect is the correct tool for synchronizing on-premises Active Directory users to Microsoft Entra ID for hybrid identity because it provides a comprehensive, full-featured synchronization engine that supports password hash synchronization, pass-through authentication, and federation integration. It is the primary tool for hybrid identity scenarios where you need to synchronize a single on-premises AD forest to a single Entra ID tenant, handling attributes, password writeback, and device synchronization.

Exam trap

The trap here is that candidates often confuse Microsoft Entra Connect Cloud Sync with the full Entra Connect tool, assuming the 'Cloud Sync' name implies it is the primary or newer replacement, but in reality, Entra Connect Cloud Sync is a lighter agent for specific multi-forest or limited scenarios, while Entra Connect remains the standard for full hybrid identity synchronization.

How to eliminate wrong answers

Option A is wrong because Microsoft Identity Manager (MIM) is an identity management and governance tool for managing on-premises identities and synchronization between multiple identity stores, not the primary tool for synchronizing a single on-premises AD to Entra ID for hybrid identity; it is more complex and typically used for advanced scenarios like cross-forest synchronization or identity lifecycle management. Option C is wrong because Microsoft Entra Connect Cloud Sync is a lightweight agent designed for synchronizing users from multiple on-premises AD forests to Entra ID, but it lacks full feature parity with Entra Connect (e.g., no device writeback, no pass-through authentication with seamless SSO, and limited attribute filtering) and is intended for specific scenarios like merging multiple forests or replacing older sync tools, not as the default for standard hybrid identity. Option D is wrong because Active Directory Federation Services (AD FS) is a federation service that provides single sign-on and claims-based authentication, not a synchronization tool; it does not synchronize user objects or attributes from on-premises AD to Entra ID.

Practice this question →

14

MCQhard

Your organization uses Microsoft Sentinel. You need to design a solution to detect and automatically respond to a potential brute-force attack against an on-premises application that is published via Azure AD Application Proxy. The solution should block the attacker's IP address in Azure AD Conditional Access for one hour after detecting more than 10 failed login attempts within 5 minutes. What should you implement?

A.Create a Microsoft Purview Data Loss Prevention policy to block the IP address based on the login pattern.

B.Create a Microsoft Sentinel analytics rule that triggers on a KQL query detecting the failed logins, then use a playbook to add the IP to a Conditional Access block list via the Azure AD API.

C.Deploy a web application firewall (WAF) in front of the application and configure rate limiting to block the IP.

D.Configure a Microsoft Entra ID Protection sign-in risk policy to automatically block the user's sign-in after detecting anomalous activity.

AnswerB

Microsoft Sentinel can ingest sign-in logs from Azure AD Application Proxy. An analytics rule with a KQL query can detect the brute-force pattern, and when triggered, a playbook can call the Azure AD API to add the IP to a Conditional Access block list for one hour, effectively blocking the attacker.

Why this answer

You can create a Microsoft Sentinel analytics rule with a KQL query that detects more than 10 failed login attempts within 5 minutes. When the rule triggers, it runs a playbook that uses the Azure AD API to add the attacker's IP to a Conditional Access block list, blocking further access for one hour. Option A is incorrect because Microsoft Purview DLP policies are for data protection, not authentication blocking.

Option C is incorrect because a WAF rate limit blocks at the network layer but does not integrate with Azure AD Conditional Access, and it cannot read authentication logs from Azure AD App Proxy. Option D is incorrect because Microsoft Entra ID Protection sign-in risk policies are user-based and cannot block specific IPs or apply custom logic like a 1-hour block.

Practice this question →

15

Multi-Selecthard

A company wants to automate incident response in Microsoft 365 Defender. Which THREE actions can be automated using automated investigation and response (AIR) capabilities? (Choose three.)

Select 3 answers

A.Block a file hash across the organization.

B.Reset a user's password.

C.Isolate a device from the network.

D.Create a new user account.

E.Delete a malicious email from all mailboxes.

AnswersA, C, E

AIR can block indicators of compromise.

Why this answer

Microsoft 365 Defender's automated investigation and response (AIR) can automatically block a file hash at the tenant level using threat intelligence and cloud-delivered protection. When a malicious file is detected, AIR can create an indicator to block the hash across all endpoints via Microsoft Defender for Endpoint, preventing further execution.

Exam trap

Candidates often mistake identity-related actions like password resets as part of AIR, but these are handled by separate Azure AD Identity Protection workflows. AIR actions are limited to endpoint, email, and collaboration containment.

Practice this question →

16

MCQhard

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. The policy is enabled but users who are detected as high risk are still able to sign in. What is the most likely reason?

A.No users or groups are assigned to the policy

B.The policy state is set to 'enabled' but not 'enforced'

C.The user risk level is set to 'high' but sign-in risk is 'medium'

D.The grant control is set to 'block' but should be 'require MFA'

AnswerA

The exhibit does not show user assignment; if none, the policy won't apply.

Why this answer

A Conditional Access policy must have at least one user or group assigned to it to be evaluated. If no users or groups are assigned, the policy is effectively inactive, even if enabled. In this scenario, the policy is enabled but not applied to any identities, so high-risk users are not subject to its controls.

Exam trap

The SC-100 exam often tests the misconception that an enabled policy is automatically applied to all users, but the trap here is that the policy must have explicit assignments to take effect.

How to eliminate wrong answers

Option B is wrong because Conditional Access policies do not have an 'enforced' state; they are either 'enabled' or 'disabled'. An enabled policy is active and enforced. Option C is wrong because the user risk level and sign-in risk are separate conditions; setting user risk to 'high' does not require sign-in risk to be set, and the policy would still block high-risk users if assigned.

Option D is wrong because the grant control 'block' is the correct setting to prevent sign-ins; changing it to 'require MFA' would allow sign-ins with MFA, not block them.

Practice this question →

17

Multi-Selectmedium

Your organization uses Microsoft Entra ID and Microsoft Intune. You need to design a solution that allows only hybrid Azure AD joined devices to access a sensitive application. The solution must also require that the device is compliant with company policies. Which two components should you configure? (Choose TWO.)

Select 2 answers

A.Intune app protection policy

B.Conditional Access policy with 'Require multifactor authentication'

C.Conditional Access policy with 'Require hybrid Azure AD joined device'

D.Intune device enrollment

E.Intune device compliance policy

AnswersC, E

This ensures only hybrid Azure AD joined devices can access the application.

Why this answer

Options C and E are correct. A Conditional Access policy with the 'Require hybrid Azure AD joined device' grant control ensures that only devices joined to both on-premises AD and Azure AD can access the application. An Intune device compliance policy defines the security and configuration requirements that devices must meet to be considered compliant.

Combining these two components enforces both device identity and compliance. Option A (Intune app protection policy) is incorrect because it protects app data at the app level, not device-level access. Option B (Require MFA) is not required by the scenario.

Option D (Intune device enrollment) is a prerequisite for management but not an access control.

Practice this question →

18

MCQeasy

Your organization is implementing a zero-trust security model and needs to ensure that all access to cloud resources is verified in real-time. You plan to use Microsoft Entra ID Conditional Access. Which policy component enforces real-time verification of user identity and device compliance before granting access?

A.Enable Microsoft Secure Score

B.Use Azure AD Application Proxy

C.Conditional Access policy with conditions and grant controls

D.Assign users and groups to the policy

AnswerC

Conditional Access policies are the core enforcement mechanism for zero trust in Azure AD. They combine conditions such as user or group membership, location, device state, and sign-in risk with grant controls like requiring MFA, a compliant device, or a hybrid Azure AD joined device. These policies enforce real-time verification for every access attempt, ensuring that access is granted only when all configured conditions and controls are satisfied, aligning with the zero trust principle of 'verify explicitly'.

Why this answer

Conditional Access policies with conditions and grant controls enforce real-time verification by evaluating signals such as user identity, device compliance (via Microsoft Intune), and location before allowing access to cloud resources. The grant controls block or require multi-factor authentication (MFA) or device compliance, ensuring zero-trust principles of explicit verification and least privilege.

Exam trap

The trap here is that candidates confuse policy assignment (users/groups) with the enforcement mechanism (conditions and grant controls), thinking that merely assigning a policy to a user group enforces real-time verification, when in fact the conditions and grant controls are the components that perform the actual evaluation and access decision.

How to eliminate wrong answers

Option A is wrong because Microsoft Secure Score is a security posture measurement tool, not a policy component that enforces real-time access verification. Option B is wrong because Azure AD Application Proxy provides secure remote access to on-premises web applications, not real-time identity and device compliance checks for cloud resources. Option D is wrong because assigning users and groups to a policy defines scope but does not enforce real-time verification; the conditions and grant controls are the components that perform the actual evaluation and enforcement.

Practice this question →

19

MCQeasy

A company uses Microsoft Defender for Cloud Apps to discover and control Shadow IT. They want to block the use of a newly discovered unsanctioned app. What should they do?

A.Create a Conditional Access policy to block the app

B.Use Microsoft Purview Data Loss Prevention to block the app

C.Mark the app as unsanctioned in Defender for Cloud Apps

D.Block the app's domain in Microsoft Intune

AnswerC

Defender for Cloud Apps presents discovered apps in the Shadow IT dashboard, where an admin can mark an app as unsanctioned to actively block it. Unsanctioning is the native CASB control point that works with the Conditional Access App Control (reverse proxy) or app connectors to terminate sessions and prevent access to the app for all users. This is the exact feature designed to govern newly discovered unsanctioned cloud applications, and it works even for apps that are not federated with Microsoft Entra ID.

Why this answer

Marking an app as unsanctioned in Microsoft Defender for Cloud Apps is the direct mechanism to block access to a discovered Shadow IT app. When an app is marked unsanctioned, Defender for Cloud Apps automatically enforces a block by integrating with Conditional Access to prevent users from accessing the app, and it can also generate alerts and session controls. This action is specifically designed for the discovered app governance workflow within Defender for Cloud Apps.

Exam trap

The trap here is that candidates often assume creating a Conditional Access policy directly is the correct action, but the SC-100 exam tests the understanding that marking the app as unsanctioned in Defender for Cloud Apps is the prerequisite step that triggers the automatic Conditional Access policy enforcement.

How to eliminate wrong answers

Option A is wrong because creating a Conditional Access policy to block the app is not the first step; the app must first be marked as unsanctioned in Defender for Cloud Apps, which then automatically creates the necessary Conditional Access policy via the app governance integration. Option B is wrong because Microsoft Purview Data Loss Prevention (DLP) is designed to prevent data exfiltration and sensitive data sharing, not to block access to an entire unsanctioned app. Option D is wrong because blocking the app's domain in Microsoft Intune would only affect managed devices and does not address the broader Shadow IT discovery and control workflow that Defender for Cloud Apps provides.

Practice this question →

20

MCQhard

Your organization uses Microsoft Sentinel as a SIEM. The security team wants to use Microsoft Copilot for Security to assist in incident investigation. You need to ensure that Copilot can access Sentinel data while meeting compliance requirements. Which integration should you configure?

A.Deploy a playbook to query Sentinel data

B.Enable Microsoft Copilot for Security plugin for Sentinel

C.Enable Sentinel's Threat Intelligence connectors

D.Use Microsoft Defender for Cloud

AnswerB

Enabling the Microsoft Copilot for Security plugin for Sentinel is the direct, secure integration that lets Copilot query and interact with Sentinel data using natural language. When enabled, a security analyst can ask Copilot questions like 'summarize the most recent high-severity alerts' or 'show all open incidents involving user X,' and Copilot translates that into KQL queries against Sentinel's underlying Log Analytics workspace. This plugin explicitly bridges Copilot to Sentinel, providing incident summaries, guided investigations, and context-aware responses, which is exactly what the organization needs to leverage Copilot as a SIEM interface.

Why this answer

The Microsoft Copilot for Security plugin for Sentinel is the correct integration because it enables Copilot to directly query and analyze Sentinel data through a native, compliant connection. This plugin uses Sentinel's API and role-based access control (RBAC) to ensure that Copilot only accesses data the user is authorized to see, meeting compliance requirements without additional data movement.

Exam trap

The trap here is that candidates often confuse enabling Threat Intelligence connectors (Option C) with granting data access, but those connectors only import external threat data and do not provide Copilot with read access to Sentinel's internal logs or incidents.

How to eliminate wrong answers

Option A is wrong because deploying a playbook to query Sentinel data introduces unnecessary complexity and latency; playbooks are designed for automated response workflows, not for providing real-time, compliant data access to Copilot. Option C is wrong because enabling Sentinel's Threat Intelligence connectors only ingests external threat intelligence feeds into Sentinel, it does not grant Copilot access to Sentinel's existing security data or logs. Option D is wrong because Microsoft Defender for Cloud is a separate cloud security posture management (CSPM) tool that does not natively integrate with Copilot for Security to access Sentinel data; it focuses on workload protection, not SIEM data access.

Practice this question →

21

MCQeasy

You are designing an incident response plan for a company using Microsoft Defender XDR. The team needs to automatically notify the SOC via email when an incident of high severity is created. What should you use?

A.Modify the analytics rule to send an email when an alert fires.

B.Create a playbook that sends an email when an incident is created.

C.Configure an automation rule with an action to send an email notification.

D.Use advanced hunting to query high severity incidents and send email.

AnswerC

Configuring an automation rule with an action to send an email notification is the correct approach in Microsoft Sentinel for alerting on incident creation. Automation rules are specifically designed to handle incident lifecycle events (created, updated, etc.) and can perform one or more actions immediately, without needing an external logic app. The 'Send Email' action directly sends an email to a specified recipient, using configured SMTP or Microsoft 365 settings, and can include incident details in the body. This method is natively supported, requires minimal setup, and ensures timely notification whenever an incident meets the condition (e.g., high severity).

Why this answer

Automation rules in Microsoft Defender XDR are specifically designed to trigger automated actions—including sending email notifications—when an incident is created or updated. Unlike playbooks, automation rules can directly send email without requiring a Logic Apps connector, and they operate natively within the Defender portal's incident lifecycle.

Exam trap

The trap here is that candidates often confuse Microsoft Defender XDR automation rules with Microsoft Sentinel playbooks or analytics rules, assuming that playbooks are the only way to send email, when in fact Defender XDR has a built-in email notification action within automation rules.

How to eliminate wrong answers

Option A is wrong because analytics rules are used in Microsoft Sentinel, not Microsoft Defender XDR; Defender XDR uses detection rules, and modifying an analytics rule would not apply to Defender incidents. Option B is wrong because a playbook (Logic Apps) can send email but requires additional configuration and licensing, and is not the simplest or most direct method for email notification on incident creation. Option D is wrong because advanced hunting is a query tool for threat hunting and does not have native capabilities to automatically send email notifications; it would require custom scripting and external integration.

Practice this question →

22

MCQhard

You are a security architect for a global financial services company. The company is adopting Microsoft Sentinel as its primary SIEM and Microsoft Defender XDR for endpoint, email, and identity protection. The company has a hybrid environment with on-premises Active Directory and Microsoft Entra ID. The SOC team needs to be able to investigate incidents that involve lateral movement between on-premises and cloud resources. Additionally, the company must comply with GDPR, requiring that personal data be protected and that data residency requirements are met: all security logs for EU users must remain within the EU. The company already has a Microsoft Sentinel workspace in the West Europe region. You need to design a solution that meets these requirements while minimizing administrative overhead. What should you do?

A.Deploy Azure Arc on on-premises servers and use Azure Policy to enforce log collection to the West Europe workspace.

B.Use the existing West Europe Sentinel workspace and ensure that all EU user logs are sent to that workspace via diagnostic settings.

C.Create a new Sentinel workspace in the EU region for EU logs and a separate workspace for non-EU logs.

D.Deploy a separate Sentinel workspace in each region where you have users.

AnswerB

Correct. A single Sentinel workspace can collect logs from multiple regions. By using the existing West Europe workspace and configuring diagnostic settings to send all EU user logs there, data residency requirements are met with minimal administrative overhead.

Why this answer

A single Microsoft Sentinel workspace in West Europe can collect logs from multiple regions via diagnostic settings, satisfying GDPR data residency by keeping EU logs within the EU. This minimizes administrative overhead. Option A is incorrect because Azure Arc does not address data residency and adds unnecessary complexity.

Option C is incorrect because creating a separate workspace increases overhead without benefit, as the existing workspace meets requirements. Option D is incorrect because per-region workspaces greatly increase administrative overhead.

Practice this question →

23

MCQhard

Your organization uses Microsoft Defender XDR for detection and response. You need to create a custom detection rule that alerts when a user performs more than 10 failed sign-ins from different countries within 5 minutes. Which component should you use?

A.Automation rule in Microsoft Sentinel

B.Custom detection rule in Microsoft 365 Defender

C.Analytics rule in Microsoft Sentinel

D.Attack simulation training

AnswerB

Custom detection rules in Microsoft Defender XDR leverage Advanced Hunting Kusto Query Language (KQL) queries to continuously monitor event data across email, endpoints, identities, and cloud apps. When the query returns results, the rule triggers an alert and can also create an incident, enabling bespoke detection logic beyond built-in detections. This is the native detection engine for Defender XDR, distinct from SIEM-based rules.

Why this answer

Custom detection rules in Microsoft 365 Defender allow you to define advanced hunting queries that trigger alerts based on specific event patterns, such as more than 10 failed sign-ins from different countries within 5 minutes. This is the correct component because it operates directly on data within the Defender XDR ecosystem (e.g., AADSignInEventsBeta) without requiring data ingestion into Sentinel.

Exam trap

The trap here is that candidates confuse Microsoft Sentinel analytics rules (which require data ingestion) with Microsoft 365 Defender custom detection rules (which operate natively on Defender XDR data), leading them to choose Sentinel options when the question explicitly states 'Microsoft Defender XDR' as the platform.

How to eliminate wrong answers

Option A is wrong because automation rules in Microsoft Sentinel are used to automate incident response actions (e.g., assigning ownership or running playbooks), not to define detection logic based on raw event patterns. Option C is wrong because analytics rules in Microsoft Sentinel require data to be ingested into the Sentinel workspace first, whereas the question specifies using Microsoft Defender XDR directly for detection and response. Option D is wrong because attack simulation training is a phishing simulation and security awareness tool, not a detection mechanism for sign-in anomalies.

Practice this question →

24

MCQhard

A global enterprise uses Microsoft Entra ID with Privileged Identity Management (PIM) and Conditional Access. They need to ensure that all privileged role activations require an approval workflow, and that the approval process is documented for compliance. What configuration should they implement?

A.Create a Conditional Access policy requiring an Authentication Strength

B.In PIM, edit the role settings to require approval for activation

C.Configure an access review for the privileged roles

D.Create a role-assignable group and assign the privileged role to the group

AnswerB

This enforces approval each time a role is activated.

Why this answer

In PIM, you can configure role settings to require approval for activation, which ensures that every privileged role activation goes through an approval workflow and is documented in audit logs. Option A is incorrect because Authentication Strength in Conditional Access enforces MFA, not approval. Option C is incorrect because access reviews are for periodic attestation, not for per-activation approval.

Option D is incorrect because role-assignable groups allow group-based role assignments but do not enforce an approval workflow for activation.

Practice this question →

25

MCQhard

Your company uses Microsoft Defender for Cloud Apps (MDA). You need to create a policy that automatically suspends a user's access to a cloud app if the user is confirmed as compromised by Microsoft Entra ID Protection. Which policy type should you use?

A.Session policy

B.Access policy

C.App permissions policy

D.Anomaly detection policy

AnswerA

Session policies can use risk from Microsoft Entra ID Protection to block access.

Why this answer

A session policy in Microsoft Defender for Cloud Apps can be configured to take real-time actions based on risk signals from Microsoft Entra ID Protection. When a user is confirmed as compromised, a session policy can enforce automatic suspension of access to cloud apps by blocking the session or requiring reauthentication, directly addressing the requirement.

Exam trap

The trap here is that candidates often confuse session policies with access policies, assuming access policies handle user risk-based suspension, but access policies lack the real-time session control and direct Entra ID Protection integration that session policies provide.

How to eliminate wrong answers

Option B (Access policy) is wrong because access policies in Defender for Cloud Apps control access based on device, location, or app permissions, but they do not natively integrate with Entra ID Protection's user risk signals to trigger automatic suspension upon compromise confirmation. Option C (App permissions policy) is wrong because it governs OAuth app permissions (e.g., revoking app consent) rather than user-level access suspension based on identity risk. Option D (Anomaly detection policy) is wrong because it detects unusual behavior patterns (e.g., impossible travel) but does not directly respond to a confirmed compromise signal from Entra ID Protection; it generates alerts rather than enforcing automatic access suspension.

Practice this question →

26

MCQmedium

Your organization uses Microsoft Sentinel for security operations. You need to ensure that an attacker cannot disable data collection by deleting the diagnostic settings on the Sentinel workspace. What should you configure?

A.Enable Sentinel's workspace deletion protection.

B.Assign the Log Analytics Contributor role only to specific users.

C.Apply a CanNotDelete resource lock on the Log Analytics workspace.

D.Create an Azure Policy to audit diagnostic settings.

AnswerC

Applying a CanNotDelete resource lock on the Log Analytics workspace is the only option that actively blocks any delete operation on the workspace and all its child resources, including diagnostic settings. This lock enforces a deny at the Azure Resource Manager level, overriding even elevated RBAC permissions unless a matching delete lock is removed first. As a result, it provides a robust, unbreakable-by-default safeguard that directly prevents the diagnostic settings from being deleted.

Why this answer

Applying a CanNotDelete resource lock on the Log Analytics workspace prevents any user or process, including an attacker, from deleting the workspace or its diagnostic settings. This lock overrides all role-based permissions, ensuring that even if an attacker gains high-privileged access, they cannot remove the diagnostic settings that stream telemetry to Microsoft Sentinel. Sentinel's data collection relies entirely on these diagnostic settings, so protecting them with a resource lock is the most direct and effective defense against deletion attacks.

Exam trap

The trap here is that candidates confuse workspace deletion protection (which only prevents workspace deletion) with diagnostic settings deletion protection, or they assume that RBAC alone (Option B) is sufficient to block a privileged attacker, when in fact a resource lock is the only control that enforces a hard deny on deletion regardless of permissions.

How to eliminate wrong answers

Option A is wrong because Sentinel's workspace deletion protection only prevents the accidental deletion of the Sentinel workspace itself, not the deletion of diagnostic settings on that workspace; an attacker could still remove the diagnostic settings and stop data ingestion without deleting the workspace. Option B is wrong because assigning the Log Analytics Contributor role only to specific users limits who can modify the workspace, but it does not prevent an attacker with compromised credentials or a privileged user from deleting diagnostic settings; role-based access control (RBAC) alone is insufficient against a determined attacker with elevated permissions. Option D is wrong because creating an Azure Policy to audit diagnostic settings only reports on compliance (e.g., whether settings exist) but does not block deletion; it provides no preventive control and cannot stop an attacker from removing the settings in real time.

Practice this question →

27

Multi-Selectmedium

Which THREE capabilities are provided by Microsoft Defender for Cloud Apps (MDA) when integrated with Microsoft Defender XDR?

Select 3 answers

A.Email protection against phishing and malware.

B.Discovery of shadow IT cloud apps.

C.App permissions and OAuth app governance.

D.Endpoint detection and response (EDR) for devices.

E.Conditional access session controls for cloud apps.

AnswersB, C, E

MDA discovers apps used in the organization.

Why this answer

Microsoft Defender for Cloud Apps (MDA) integrates with Microsoft Defender XDR to provide shadow IT discovery by analyzing traffic logs from network devices and cloud app catalogs, identifying unsanctioned cloud applications used in the organization. This capability is core to MDA's Cloud Discovery feature, which uses log parsing and machine learning to detect and classify shadow IT.

Exam trap

The trap here is that candidates often confuse the capabilities of Microsoft Defender for Cloud Apps with those of other Microsoft Defender XDR components, such as Defender for Office 365 (email security) or Defender for Endpoint (EDR), leading them to select options that are valid security features but not provided by MDA.

Practice this question →

28

MCQhard

Your organization uses Microsoft Defender XDR to correlate alerts across endpoints, email, and identities. You need to create a custom detection rule that triggers when a user receives a phishing email and then attempts to log in from a new location. Which approach should you use?

A.Use Advanced Hunting to create a custom detection rule

B.Create a custom detection rule in Microsoft Defender for Endpoint

C.Use an automation rule in Microsoft Defender XDR

D.Create an analytics rule in Microsoft Sentinel

AnswerA

Advanced Hunting is the XDR-native KQL query interface spanning the unified Defender XDR data schema, including endpoint, email, identity, and cloud app tables. By saving an advanced hunting query as a custom detection rule, Defender XDR continuously evaluates cross-domain signals and generates alerts, making it the correct mechanism for correlating evidence from multiple sources.

Why this answer

Advanced Hunting in Microsoft Defender XDR allows you to write Kusto Query Language (KQL) queries that correlate events across multiple data tables (e.g., EmailEvents, IdentityLogonEvents). You can then create a custom detection rule from that query, which will trigger an alert when a user receives a phishing email and subsequently logs in from a new location, enabling cross-domain correlation within Defender XDR.

Exam trap

The trap here is that candidates often confuse the scope of custom detection rules in Defender for Endpoint (endpoint-only) with the cross-domain capability of Advanced Hunting in Defender XDR, or they mistakenly think automation rules can create new detection logic rather than just automate responses to existing alerts.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Endpoint custom detection rules are limited to endpoint data (e.g., DeviceEvents, DeviceProcessEvents) and cannot query email or identity events, so they cannot correlate a phishing email with a login from a new location. Option C is wrong because automation rules in Microsoft Defender XDR are designed to automate responses (e.g., isolate a device, block an IP) based on existing alerts, not to create new detection logic that correlates raw events across different data sources. Option D is wrong because analytics rules in Microsoft Sentinel are used for SIEM-style detection across multiple data sources ingested into Sentinel, but the question specifies using Microsoft Defender XDR (not Sentinel) to correlate alerts, and Sentinel requires separate licensing and data ingestion pipelines.

Practice this question →

29

MCQmedium

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to prevent users from sharing credit card numbers in email but allow sharing via encrypted email. What should they configure?

A.Assign a sensitivity label that encrypts the email automatically

B.Create a Microsoft Purview Message Encryption policy

C.Configure a DLP rule that blocks sharing unless the email is encrypted, with user override

D.Use Exchange mail flow rules to block unencrypted credit card data

AnswerC

To enforce that unencrypted emails containing credit card data are blocked, you need a Microsoft Purview DLP rule. The rule can include the condition "Content contains" the sensitive info type for credit card numbers, and an action to "Block" the message if it is not encrypted, with an option to allow users to override the block for legitimate business needs. DLP integrates with Exchange Online to inspect the message in transit and conditionally allow encrypted messages as an exception, directly addressing the stated requirement, whereas proactive encryption strategies alone cannot guarantee compliance.

Why this answer

Microsoft Purview DLP can enforce a policy that blocks sharing of credit card numbers unless the email is encrypted, with a user override option to allow legitimate encrypted sharing. This directly meets the requirement to prevent unencrypted sharing while permitting encrypted email transmission, leveraging DLP's ability to inspect email content and conditionally apply actions based on encryption status.

Exam trap

The trap here is that candidates often confuse DLP's conditional encryption check with Message Encryption policies or mail flow rules, failing to recognize that DLP provides the specific 'unless the email is encrypted' condition and user override capability needed for this requirement.

How to eliminate wrong answers

Option A is wrong because assigning a sensitivity label that encrypts the email automatically does not provide a conditional mechanism to block unencrypted sharing; it would either always encrypt or require manual labeling, failing to prevent users from sending unencrypted credit card data. Option B is wrong because Microsoft Purview Message Encryption is a service that encrypts email messages but does not include DLP rules to block unencrypted sharing; it lacks the policy-driven conditional enforcement needed to prevent non-encrypted transmission. Option D is wrong because Exchange mail flow rules (transport rules) can block or encrypt messages based on patterns, but they do not natively integrate with DLP's sensitive information types for credit card numbers and lack the user override capability that DLP provides for justified business exceptions.

Practice this question →

30

Multi-Selecteasy

Which TWO configurations are required to enable Microsoft Defender for Cloud Apps to monitor cloud app usage?

Select 2 answers

A.Add app connectors for the cloud apps you want to monitor

B.Configure Microsoft Intune device compliance policies

C.Deploy Azure Information Protection scanner

D.Synchronize with Microsoft Entra ID

E.Enable Conditional Access App Control

AnswersA, E

App connectors enable API-based monitoring.

Why this answer

A is correct because Microsoft Defender for Cloud Apps requires app connectors to establish API-based connections with cloud applications (e.g., Office 365, Salesforce, AWS). These connectors enable the service to ingest activity logs, file metadata, and user sessions for monitoring and threat detection. Without app connectors, Defender for Cloud Apps cannot access the cloud app's data plane to perform its core monitoring functions.

Exam trap

The trap here is that candidates often confuse prerequisites (like Microsoft Entra ID sync) with the actual enabling configurations, or they assume device compliance policies (Intune) are required for cloud app monitoring when they are only relevant for conditional access grant controls.

Practice this question →

31

MCQhard

Your company is deploying a new line-of-business application in Azure that must comply with PCI DSS. The application uses Azure SQL Database. You need to design a solution to encrypt sensitive data at rest and in transit, and to audit access to sensitive columns. Which combination of Microsoft security capabilities should you recommend?

A.Dynamic Data Masking and Azure SQL Firewall rules

B.Transparent Data Encryption, Always Encrypted, and Azure SQL Auditing

C.Azure Policy and Microsoft Defender for Cloud

D.Azure Storage Service Encryption and Azure Key Vault

AnswerB

Transparent Data Encryption (TDE) encrypts entire database files, backups, and transaction logs at rest using a database encryption key, protecting data at the storage layer. Always Encrypted goes further by encrypting sensitive columns with client-side keys so that database administrators and cloud operators see only ciphertext, ensuring data remains confidential even during queries. Azure SQL Auditing captures a trace of database events and queries, enabling compliance monitoring and forensic analysis of access to sensitive data. Together, these three technologies deliver encryption at rest, column-level encryption with key separation, and a clear audit trail, fully addressing typical enterprise data protection and compliance requirements.

Why this answer

Transparent Data Encryption (TDE) encrypts the SQL database at rest, Always Encrypted protects sensitive columns in transit and at rest by ensuring encryption keys are never exposed to the database engine, and Azure SQL Auditing logs all access to sensitive columns for compliance with PCI DSS requirements.

Exam trap

The trap here is that candidates often confuse Dynamic Data Masking with encryption, but masking does not protect data at rest or in transit and can be bypassed by privileged users, whereas Always Encrypted and TDE provide true encryption required by PCI DSS.

How to eliminate wrong answers

Option A is wrong because Dynamic Data Masking only obfuscates data at query time for unauthorized users but does not encrypt data at rest or in transit, and Azure SQL Firewall rules control network access but do not provide encryption or auditing. Option C is wrong because Azure Policy enforces compliance rules and Microsoft Defender for Cloud provides threat detection, but neither directly encrypts data at rest or in transit nor audits column-level access. Option D is wrong because Azure Storage Service Encryption applies only to Azure Blob and File storage, not to Azure SQL Database, and Azure Key Vault is a key management service that must be paired with an encryption mechanism like TDE or Always Encrypted to actually encrypt data.

Practice this question →

32

Multi-Selecthard

Your organization uses Microsoft Purview Information Protection and Microsoft Defender for Cloud Apps. You need to design a solution that automatically applies a 'Confidential' sensitivity label to documents that contain credit card numbers and are shared externally. The solution should also generate an alert when this occurs. Which two configurations should you implement? (Choose TWO.)

Select 2 answers

A.Configure a Microsoft Sentinel analytics rule that queries audit logs for external sharing of labeled documents and generates an incident.

B.Create a Conditional Access policy in Microsoft Entra ID that requires device compliance when accessing documents labeled 'Confidential'.

C.Configure a Microsoft Purview Data Loss Prevention (DLP) policy that blocks the sharing of documents containing credit card numbers.

D.Create a Microsoft Purview auto-labeling policy that includes the 'Credit Card Number' sensitive info type and specifies the 'Confidential' label.

E.Create a Microsoft Defender for Cloud Apps app governance policy that monitors file sharing and triggers an alert when a document with a 'Confidential' label is shared externally.

AnswersD, E

A Microsoft Purview auto-labeling policy directly meets the requirement by using Microsoft 365 built-in sensitive info types (e.g., 'Credit Card Number') to inspect content and automatically assign the 'Confidential' sensitivity label. This is an automated classification control that runs in the background, scanning files in SharePoint, OneDrive, Exchange, and other supported workloads, and can be configured with a simulation mode before enforcement. It is the only option that both detects the sensitive data and applies the label as an end result.

Why this answer

Options D and E are correct because an auto-labeling policy in Microsoft Purview can scan for sensitive info types (credit card numbers) and automatically apply the 'Confidential' label to documents. A Microsoft Defender for Cloud Apps app governance policy can monitor file sharing and trigger an alert when a document with the 'Confidential' label is shared externally. Option A (Microsoft Sentinel analytics rule) could generate alerts but is not the primary mechanism for labeling, and option B (Conditional Access) controls access, not labeling.

Option C (Data Loss Prevention) is for blocking, not labeling.

Practice this question →

33

MCQhard

Your organization uses Microsoft Defender for Cloud to secure multi-cloud resources. You need to ensure that security recommendations are automatically remediated for non-compliant resources without manual intervention. What should you configure?

A.Azure Policy initiatives with remediation tasks

B.Set a Secure Score target and alert on changes

C.Use Quick Fix remediation for security recommendations and enable automation

D.Enable automatic provisioning of Log Analytics agent

AnswerC

Quick Fix allows one-click remediation, and automation can trigger it automatically.

Why this answer

Quick Fix remediation allows you to automatically apply a predefined remediation step for a security recommendation, and when combined with automation (such as a logic app or Azure Automation runbook triggered by Defender for Cloud), non-compliant resources can be auto-remediated without manual intervention. Option A is incorrect because Azure Policy initiatives with remediation tasks require manual trigger or a separate automation setup to run automatically; they do not directly auto-remediate within Defender for Cloud recommendations. Option B is incorrect because setting a Secure Score target and alerting on changes only monitors the secure score, it does not perform any remediation.

Option D is incorrect because automatic provisioning of Log Analytics agent is about collecting data, not remediation.

Practice this question →

34

MCQhard

Your organization is implementing a zero-trust security model. You need to design a solution that continuously verifies user identity, device compliance, and access context before granting access to corporate resources. The solution should also support risk-based policies. Which Microsoft security capability should be at the core of this design?

A.Microsoft Defender for Identity

B.Microsoft Entra ID Conditional Access

C.Microsoft Sentinel

D.Microsoft Intune

AnswerB

Conditional Access is the central policy engine that incorporates user, device, location, and risk signals to enforce zero-trust access.

Why this answer

Microsoft Entra ID Conditional Access is the core policy engine for zero-trust, enabling continuous verification of user identity, device compliance, and access context before granting resource access. It integrates with risk signals from Microsoft Entra ID Protection to enforce risk-based policies, such as requiring multi-factor authentication when sign-in risk is high. This aligns directly with the zero-trust principle of 'never trust, always verify' by evaluating conditions in real time.

Exam trap

The trap here is that candidates often confuse Microsoft Intune's device compliance enforcement with the actual policy decision engine, not realizing that Intune provides the device compliance state but Conditional Access is the component that evaluates that state along with identity and risk to make the access decision.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Identity is a security solution that detects on-premises Active Directory attacks using behavioral analytics, not a policy engine for continuous access verification or risk-based conditional access. Option C is wrong because Microsoft Sentinel is a cloud-native SIEM/SOAR for threat detection and incident response, not a tool for enforcing access policies based on user identity, device compliance, or risk context at the point of authentication. Option D is wrong because Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) service that enforces device compliance policies, but it does not evaluate identity, access context, or risk signals to grant or deny access—it relies on Conditional Access to consume its compliance status.

Practice this question →

35

MCQmedium

Your organization uses Microsoft Intune for mobile device management and Microsoft Entra ID for identity. You are designing a solution to ensure that only devices that are compliant with security policies can access corporate resources. The requirements are: 1) Devices must have a minimum OS version. 2) Devices must have encryption enabled. 3) Devices must not be jailbroken or rooted. 4) Access to corporate apps must be blocked if the device is non-compliant. 5) The solution should automatically remediate non-compliant devices when possible. You need to recommend the minimum configuration. What should you do?

A.Configure Microsoft Purview Compliance Manager to assess compliance and block access.

B.Create an app protection policy in Intune that requires minimum OS and encryption.

C.Create a device compliance policy in Intune with the required settings, and create a Conditional Access policy that requires compliant devices.

D.Create a device configuration policy in Intune for the settings, and use Azure AD Identity Protection to block access.

AnswerC

Compliance policies define requirements; Conditional Access enforces them.

Why this answer

Intune device compliance policies define the required security settings (minimum OS, encryption, jailbreak/root detection) and can include actions for automatic remediation when possible. A Conditional Access policy in Entra ID then requires devices to be marked compliant before accessing corporate resources. Option A is incorrect because Microsoft Purview Compliance Manager is a compliance management tool that does not enforce real-time access control.

Option B is incorrect because app protection policies (MAM) operate at the app level and do not enforce device-level compliance. Option D is incorrect because device configuration policies are for settings management, not compliance enforcement, and Entra ID Identity Protection is for risk-based policies, not device compliance checks.

Practice this question →

36

MCQhard

Your organization is implementing a data loss prevention (DLP) strategy using Microsoft Purview. The compliance team needs to automatically classify and label sensitive data in Microsoft 365, Azure SQL Database, and Amazon S3. Which Purview feature should you use?

A.Microsoft Purview Data Map

B.Microsoft Purview Information Protection

C.Microsoft Purview Records Management

D.Microsoft Defender for Cloud Apps

AnswerA

Microsoft Purview Data Map is the correct choice because it provides automated scanning and classification of sensitive data across hybrid and multi-cloud environments, including on-premises, Azure, and other clouds such as AWS S3. Its data scanners can connect to Azure SQL databases and S3 buckets, inspect schemas and content, and apply classifications that feed into DLP policies. This makes it uniquely capable of discovering and mapping sensitive data at rest in non-Microsoft 365 sources, which is the core requirement here.

Why this answer

Microsoft Purview Data Map is the correct choice because it provides unified data governance across hybrid and multi-cloud environments, including Microsoft 365, Azure SQL Database, and Amazon S3. It automatically scans, classifies, and labels sensitive data using built-in classifiers and sensitivity labels, enabling consistent DLP policies across these disparate data sources.

Exam trap

The trap here is that candidates often confuse the scanning and classification capabilities of Microsoft Purview Data Map with the labeling and protection features of Microsoft Purview Information Protection, but the Data Map is the service that actually discovers and classifies data across multiple clouds, while Information Protection applies the labels after classification.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview Information Protection focuses on applying sensitivity labels and encryption to data within Microsoft 365 and Azure, but it does not natively scan or classify data in Amazon S3. Option C is wrong because Microsoft Purview Records Management is designed for managing retention, disposition, and legal hold of records, not for automatic classification and labeling of sensitive data across multi-cloud sources. Option D is wrong because Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides threat protection and visibility for cloud apps, but it does not perform automatic data classification and labeling across Microsoft 365, Azure SQL, and Amazon S3 as a primary function.

Practice this question →

37

MCQmedium

A company uses Microsoft Purview to classify data and enforce retention policies. They need to automatically apply a retention label to all documents containing credit card numbers. Which approach should they use?

A.Configure an auto-labeling policy with a sensitive info type

B.Use a trainable classifier

C.Create a manual labeling policy for users

D.Use a default label for SharePoint libraries

AnswerA

Auto-labeling applies labels based on content.

Why this answer

Microsoft Purview auto-labeling policies can automatically apply retention labels to documents based on sensitive info types (SITs), such as credit card numbers. This approach uses pattern matching to detect the credit card number format and applies the label without user intervention, meeting the requirement for automatic enforcement.

Exam trap

The trap here is that candidates may confuse trainable classifiers with sensitive info types, thinking that 'intelligent' classification is always better, but SITs are the correct choice for specific, pattern-based data like credit card numbers.

How to eliminate wrong answers

Option B is wrong because trainable classifiers are designed to identify content based on context and patterns (e.g., contracts or resumes), not specific sensitive data like credit card numbers, which are better matched by SITs. Option C is wrong because manual labeling policies require users to apply labels themselves, contradicting the requirement for automatic application. Option D is wrong because a default label for SharePoint libraries applies a label to all documents in the library regardless of content, not selectively to those containing credit card numbers.

Practice this question →

38

MCQhard

Refer to the exhibit. You are reviewing a Microsoft Defender for Cloud automation resource. You want the automation to trigger a playbook in Microsoft Sentinel when a high-severity security assessment is found. Based on the exhibit, what is the missing configuration?

A.The severity filter should be 'Low' to capture all assessments

B.The action type should be 'LogicApp' instead of 'EventHub'

C.The eventSource should be 'Alerts' instead of 'Assessments'

D.The API version should be '2020-01-01'

AnswerB

To invoke a playbook in Microsoft Defender for Cloud, the automation action must be of type 'LogicApp' and contain the playbook's callback URL, not 'EventHub'. An EventHub action simply exports the event to an event hub for ingestion by external systems, whereas LogicApp directly triggers the playbook's workflow. Because the requirement is to run a playbook, the action type is the misconfigured property, and correcting it from EventHub to LogicApp is the necessary fix.

Why this answer

Microsoft Defender for Cloud automation can trigger a playbook in Microsoft Sentinel only by using a LogicApp action. The exhibit shows an EventHub action type, which is used for streaming events to an event hub, not for invoking a playbook. To trigger a Sentinel playbook from a Defender for Cloud assessment, the action type must be set to 'LogicApp' and configured with the playbook's trigger URL.

Exam trap

The trap here is that candidates may focus on the severity filter or event source, overlooking that the action type must be specifically 'LogicApp' to invoke a playbook, as 'EventHub' is a valid action but for a different purpose.

How to eliminate wrong answers

Option A is wrong because setting the severity filter to 'Low' would capture low-severity assessments, not high-severity ones; the requirement is to trigger on high-severity assessments, so the filter should be 'High'. Option C is wrong because the eventSource should remain 'Assessments' to trigger on security assessments; changing it to 'Alerts' would trigger on security alerts instead, which is a different data type. Option D is wrong because the API version '2020-01-01' is not relevant to the missing configuration; the automation resource uses the correct API version for its definition, and the issue is the action type, not the API version.

Practice this question →

39

MCQmedium

Your organization uses Microsoft Sentinel and wants to correlate security events from multiple sources to detect multi-stage attacks. What should you create?

A.Scheduled query rule

B.NRT rule

C.Anomaly rule

D.Fusion rule

AnswerD

Fusion rules are built-in analytics rules in Microsoft Sentinel that use machine learning to correlate alerts from multiple Microsoft security products (e.g., Microsoft Defender for Identity, Defender for Office 365, Microsoft Entra ID Protection) into a single incident. The fusion engine maps alerts to MITRE ATT&CK stages, linking actions like initial access, lateral movement, and exfiltration into one coherent story. Because it automatically identifies multi-stage attack patterns without custom KQL, Fusion is the correct rule type for the organization's requirement to correlate multi-stage attacks.

Why this answer

Fusion rules in Microsoft Sentinel are specifically designed to correlate security events from multiple sources and detect multi-stage attacks by combining alerts from different detection technologies into a single incident. This matches the requirement to correlate events across sources for complex attack chains, unlike other rule types that focus on single-source or single-event detection.

Exam trap

The trap here is that candidates often confuse scheduled query rules or NRT rules as the primary tool for correlation, but those require manual KQL logic to join data across sources, whereas Fusion provides automated, built-in multi-source correlation for multi-stage attacks.

How to eliminate wrong answers

Option A is wrong because scheduled query rules run queries at regular intervals against a single data source or table, and they cannot natively correlate events from multiple disparate sources to detect multi-stage attacks. Option B is wrong because NRT (Near-Real-Time) rules provide low-latency detection but still operate on a single query against one or more tables, lacking the built-in multi-source correlation logic of Fusion. Option C is wrong because anomaly rules use machine learning to detect deviations from baseline behavior on a single data source, not to correlate events across multiple sources for multi-stage attack detection.

Practice this question →

40

MCQmedium

Your organization uses Microsoft Entra ID and needs to ensure that external partners can access only specific applications for 30 days. What should you configure?

A.Entitlement management and create an access package with an expiration of 30 days

B.B2B direct connect

C.Self-service group management

D.Conditional Access policy with session control

AnswerA

Access packages in entitlement management allow you to grant time-limited access to applications for external users.

Why this answer

Entitlement management in Microsoft Entra ID allows you to create access packages that govern external partner access to specific applications. By configuring an access package with a 30-day expiration, you enforce time-limited access, ensuring partners can only access the designated applications for the required duration. This directly meets the requirement of restricting access to specific apps with a defined expiry.

Exam trap

The trap here is that candidates often confuse Conditional Access session controls (which manage sign-in frequency or app restrictions) with the ability to grant and expire access to specific applications, overlooking that entitlement management is the correct identity governance solution for time-limited external access.

How to eliminate wrong answers

Option B (B2B direct connect) is wrong because it is designed for mutual two-way access between organizations, typically for Teams Connect shared channels, and does not provide granular control over application-specific access or automatic expiration. Option C (self-service group management) is wrong because it allows users to create and manage their own groups, but it does not enforce time-bound access to specific applications or support external partner lifecycle management. Option D (Conditional Access policy with session control) is wrong because while it can enforce session restrictions like sign-in frequency, it cannot grant or expire access to specific applications for external users; it only controls access conditions for users who already have access.

Practice this question →

41

MCQeasy

Your organization needs to enforce multi-factor authentication (MFA) for all users accessing sensitive applications. You plan to use Microsoft Entra ID Conditional Access. Which grant control should you configure?

A.Require multi-factor authentication

B.Require authentication strength (e.g., phishing-resistant MFA)

C.Require device to be marked as compliant

D.Use app enforced restrictions

AnswerA

This grant control directly enforces MFA.

Why this answer

The question specifies a requirement to enforce MFA for all users accessing sensitive applications. In Microsoft Entra ID Conditional Access, the 'Require multi-factor authentication' grant control directly enforces Azure AD MFA (e.g., via Microsoft Authenticator, OATH tokens, or SMS) as the primary authentication method. This is the simplest and most direct control to meet the stated goal of requiring MFA, without adding additional constraints like device compliance or authentication strength levels.

Exam trap

The trap here is that candidates often confuse 'Require authentication strength' (which is a newer, more specific control for phishing-resistant MFA) with the general 'Require multi-factor authentication' control, leading them to select the more complex option when the question simply asks for MFA enforcement.

How to eliminate wrong answers

Option B is wrong because 'Require authentication strength' is a more granular control that enforces a specific MFA method (e.g., phishing-resistant MFA via FIDO2 or certificate-based authentication), which is overkill for a general 'enforce MFA' requirement and may not be supported by all users. Option C is wrong because 'Require device to be marked as compliant' enforces device health (e.g., Intune compliance) but does not inherently require MFA; a user could satisfy this control with a compliant device and password only. Option D is wrong because 'Use app enforced restrictions' is a control that delegates MFA enforcement to the application itself (e.g., Exchange Online or SharePoint Online), which may not support MFA natively or may have inconsistent behavior, and it does not guarantee MFA at the identity provider level.

Practice this question →

42

MCQmedium

Your organization uses Microsoft Entra ID and wants to implement a passwordless authentication strategy. Users have smartphones. Which method should you recommend as the primary authentication method?

A.FIDO2 security keys

B.Microsoft Authenticator app with passwordless sign-in

C.SMS-based authentication

D.Windows Hello for Business

AnswerB

Microsoft Authenticator app with passwordless sign-in is the correct choice because it leverages the user's smartphone as a possession factor, using a cryptographic challenge-response protocol. When the user enters their username, the Authenticator app displays a number or a number match prompt; the user's approval signs the request with a private key stored in the device's secure enclave, eliminating the password entirely. This method is phishing-resistant, supports conditional access policies, and works seamlessly on iOS and Android, making it ideal for smartphone-centric users.

Why this answer

The Microsoft Authenticator app with passwordless sign-in is the correct primary method because it leverages the user's smartphone to provide a seamless, phishing-resistant authentication experience using public/private key cryptography (FIDO2/WebAuthn). This method aligns with the organization's goal of eliminating passwords while utilizing existing smartphone hardware, and it supports a simple user experience by requiring only a biometric or PIN verification on the phone.

Exam trap

The trap here is that candidates often confuse 'passwordless' with 'MFA' and select SMS-based authentication, not realizing that SMS still relies on a shared secret (the code) and is not truly passwordless or phishing-resistant.

How to eliminate wrong answers

Option A is wrong because FIDO2 security keys are hardware tokens that require additional procurement and distribution, making them less practical as a primary method for all users who already have smartphones. Option C is wrong because SMS-based authentication is not passwordless (it still relies on a one-time code sent via text) and is vulnerable to SIM-swapping and phishing attacks, failing to meet the passwordless strategy's security goals. Option D is wrong because Windows Hello for Business is tied to Windows devices and does not leverage smartphones, so it cannot serve as the primary method for users who may not always have access to a Windows PC.

Practice this question →

43

Multi-Selecteasy

Your organization needs to comply with regulatory requirements for data retention and deletion. Which TWO Microsoft Purview features should you use?

Select 2 answers

A.Retention policies

B.Data Loss Prevention (DLP) policies

C.Audit logs

D.Retention labels

E.eDiscovery

AnswersA, D

Define retention periods for locations.

Why this answer

Retention policies (A) are the correct choice because they allow you to define automated rules for retaining or deleting data at the container level (e.g., entire SharePoint sites, Exchange mailboxes, or OneDrive accounts) to meet regulatory requirements. Retention labels (D) are also correct because they provide granular, item-level control (e.g., specific documents or emails) for retention and deletion, and can be applied manually or automatically via trainable classifiers or sensitive information types. Together, they form the core of Microsoft Purview's data lifecycle management, ensuring compliance with data retention and deletion mandates.

Exam trap

The trap here is that candidates often confuse Data Loss Prevention (DLP) policies with retention policies because both involve data governance, but DLP focuses on preventing data exfiltration, not on lifecycle management of data retention and deletion.

Practice this question →

44

MCQeasy

Your organization is required to retain all Microsoft Teams chat messages for 7 years due to regulatory compliance. You need to design a solution that automatically retains and, if needed, e-discovery searches these messages. What should you configure?

A.Microsoft Purview retention policies and eDiscovery

B.Microsoft Purview Data Loss Prevention policies

C.Azure Policy

D.Sensitivity labels auto-labeling

AnswerA

Microsoft Purview retention policies can be assigned to Teams channel and chat messages to preserve data for a defined period such as seven years, protecting it from permanent deletion. eDiscovery tools in the same compliance portal provide search, legal hold, and export capabilities, enabling the organization to locate and produce retained Teams communications when required. Together they satisfy the retention mandate because retention preserves the data and eDiscovery operationalizes access to it.

Why this answer

Microsoft Purview retention policies are designed to retain data for a specified period (e.g., 7 years) and can be applied to Microsoft Teams chat messages. eDiscovery (now part of Microsoft Purview eDiscovery) allows authorized users to search, hold, and export retained content for legal or compliance purposes. Together, they meet the regulatory requirement for retention and searchability.

Exam trap

The trap here is that candidates often confuse Data Loss Prevention (DLP) policies with retention policies, thinking DLP can also retain data, but DLP only monitors and blocks data exfiltration, not retention or search.

How to eliminate wrong answers

Option B is wrong because Data Loss Prevention (DLP) policies are used to prevent sensitive information from being shared or leaked, not to enforce retention or enable eDiscovery searches. Option C is wrong because Azure Policy is used to enforce organizational standards and assess compliance at the Azure resource level (e.g., VMs, storage), not to manage Microsoft Teams chat message retention or eDiscovery. Option D is wrong because sensitivity labels auto-labeling applies classification and protection (e.g., encryption, markings) to content based on sensitive data, but does not provide retention or eDiscovery search capabilities.

Practice this question →

45

MCQhard

Your organization is a multi-national corporation that uses Microsoft 365 E5 and Azure. You need to design a security operations center (SOC) to detect and respond to threats across identities, endpoints, and cloud apps. The SOC team will use a single pane of glass for incident management. Requirements: (1) Centralize alerts from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps, (2) Automate incident response playbooks, (3) Use advanced hunting across all data sources, (4) Integrate with external threat intelligence feeds, (5) Provide role-based access control for SOC analysts. Which Microsoft solution should you implement?

A.Microsoft 365 Defender portal

B.Microsoft Sentinel

C.Microsoft Purview Compliance Manager

D.Microsoft Defender for Cloud

AnswerB

Microsoft Sentinel is the only option that functions as a true cloud-native SIEM/SOAR, ingesting security telemetry from across Microsoft Defender products, Azure services, and third-party sources. It provides automation playbooks for incident response, advanced hunting with Kusto Query Language (KQL), built-in threat intelligence connectors, and role-based access control for the SOC. This centralized architecture is essential for aggregating identity, endpoint, and app signals into a single detection and response workflow, meeting the requirement for a security operations center.

Why this answer

Microsoft Sentinel is a cloud-native SIEM/SOAR that ingests alerts from all Microsoft Defender products, supports automation playbooks, advanced hunting via KQL, threat intelligence connectors, and RBAC. Option A is wrong because the Microsoft 365 Defender portal provides visibility across Defender products but lacks the full SIEM/SOAR capabilities needed for automation, advanced hunting, and external threat intelligence integration. Option C is wrong because Microsoft Purview Compliance Manager is a data governance and compliance solution, not a security operations platform.

Option D is wrong because Microsoft Defender for Cloud is a cloud workload protection platform (CWPP) that does not serve as a unified SIEM across identities, endpoints, and apps.

Practice this question →

46

MCQeasy

Your organization uses Microsoft Sentinel and has enabled User and Entity Behavior Analytics (UEBA). The security team receives an alert for a user who has failed authentication 10 times in 5 minutes. What should you configure to reduce false positives while ensuring legitimate brute-force attacks are still detected?

A.Customize the anomaly threshold in UEBA

B.Disable UEBA for that user

C.Modify the analytics rule that triggered the alert

D.Create a playbook to auto-acknowledge the alert

AnswerA

Customizing the anomaly threshold in UEBA is the correct approach because UEBA uses machine learning models that assign anomaly scores to user behaviors, and these models expose threshold and sensitivity settings you can tune. By adjusting the sensitivity, you directly influence the score required to trigger an alert, effectively filtering out low-confidence anomalies that cause false positives while still detecting genuinely suspicious activity. This is the intended, documented method for reducing noise from UEBA-detected behaviors without sacrificing the underlying behavioral analytics capability.

Why this answer

Customizing the anomaly threshold in UEBA allows you to adjust the sensitivity of the behavioral baseline, reducing false positives for users who legitimately fail authentication multiple times while still detecting true brute-force attacks. UEBA learns normal behavior patterns and flags deviations; by raising the threshold, you require a higher deviation from the baseline before an alert fires, preserving detection of actual attacks.

Exam trap

The trap here is that candidates assume modifying the analytics rule (Option C) is the correct tuning mechanism, but UEBA-specific thresholds are configured separately from the underlying analytics rule, and adjusting the rule itself would affect all users and all detection logic, not just the behavioral anomaly component.

How to eliminate wrong answers

Option B is wrong because disabling UEBA for that user would stop all behavioral analytics for that user, preventing detection of any future anomalous activity, including legitimate brute-force attacks. Option C is wrong because modifying the analytics rule that triggered the alert would change the detection logic for all users, potentially missing real attacks or increasing noise across the board, rather than tuning the behavioral sensitivity for this specific pattern. Option D is wrong because creating a playbook to auto-acknowledge the alert does not reduce false positives; it merely automates ignoring the alert, which could cause a real brute-force attack to be overlooked.

Practice this question →

47

MCQeasy

You are designing a compliance solution for your organization that must enforce retention policies for documents stored in SharePoint Online. Which Microsoft Purview solution should you use?

A.Microsoft Purview Data Lifecycle Management

B.Microsoft Purview eDiscovery

C.Microsoft Purview Communication Compliance

D.Microsoft Purview Insider Risk Management

AnswerA

Data Lifecycle Management is the dedicated service for enforcing retention and deletion policies across Microsoft 365 workloads. It provides retention labels and policies that let you preserve content for a specified period, then automatically dispose of it, optionally with disposition review. This directly addresses compliance needs for record keeping, regulatory retention, and data minimization. Other services lack the policy-driven automation that DLM offers for lifecycle control.

Why this answer

Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it is specifically designed to enforce retention policies for documents in SharePoint Online. It allows you to apply retention labels and policies that automatically retain or delete content based on compliance requirements, without user intervention.

Exam trap

The trap here is that candidates often confuse 'retention' with 'eDiscovery holds' or 'compliance monitoring,' leading them to select eDiscovery or Communication Compliance, but Data Lifecycle Management is the only solution that directly enforces retention schedules for content in SharePoint Online.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview eDiscovery is used for searching, holding, and exporting content for legal or investigative purposes, not for enforcing retention policies. Option C is wrong because Microsoft Purview Communication Compliance is designed to detect and manage inappropriate communications (e.g., harassment, sensitive info sharing), not to apply retention schedules. Option D is wrong because Microsoft Purview Insider Risk Management focuses on identifying and mitigating internal security risks (e.g., data theft, policy violations), not on lifecycle retention of documents.

Practice this question →

48

Multi-Selecthard

Your organization uses Microsoft Intune for mobile device management. You need to configure a compliance policy for iOS devices that requires the device to be jailbreak-detected and have a minimum OS version. Which two settings should you configure in the compliance policy? (Choose two.)

Select 2 answers

A.Require passcode

B.Minimum OS version

C.Device encryption

D.Jailbreak detection

AnswersB, D

The Minimum OS version setting specifies the lowest operating system version a device must run to be considered compliant, such as iOS 16.0 or Windows 10, version 22H2. This rule directly enforces that devices are on a supported and permitted OS release, but it does not detect jailbreaks or root access—a device can be jailbroken while running a fully up-to-date OS. For the scenario described, this is the correct answer because it is the only option among those listed that explicitly checks the OS version level required by the policy.

Why this answer

B is correct because the compliance policy must specify a minimum OS version to ensure iOS devices meet the required security baseline, preventing outdated devices with known vulnerabilities from accessing corporate resources. D is correct because jailbreak detection is a specific compliance setting that identifies compromised devices, which are a significant security risk as they bypass iOS security controls.

Exam trap

The trap here is that candidates may confuse 'jailbreak detection' with 'device encryption' or 'passcode requirements,' but the question explicitly asks for the two settings that directly address jailbreak detection and minimum OS version, not general security settings.

Practice this question →

49

MCQhard

Your organization uses Microsoft Sentinel and wants to reduce alert fatigue by grouping related alerts into incidents. Which configuration should you use?

A.Configure incident creation in the analytics rule properties

B.Use a workbook to aggregate alerts

C.Use a playbook to create incidents

D.Create an automation rule to group alerts

AnswerA

The analytics rule's 'Incident settings' tab (in the rule wizard or via API) controls whether alerts generated by that rule are automatically turned into incidents, and whether related alerts are grouped into a single incident based on entity or alert properties such as account, host, or IP. This is the correct and intended mechanism because incident creation and grouping are natively executed by the rule itself at alert generation time, ensuring the grouping logic is atomic with the rule's detection and does not require separate orchestration. To reduce noise, you set the rule to create incidents and choose an entity-based grouping key (e.g., 'Group alerts by entities into a single incident') or alert property, which Microsoft Sentinel then uses to merge correlated alerts into one incident before any automation or response.

Why this answer

In Microsoft Sentinel, incident creation is configured directly within the analytics rule properties. When you create or edit a scheduled or Microsoft Security analytics rule, the 'Incident settings' tab allows you to enable incident creation and define how alerts are grouped into incidents. This is the native mechanism for reducing alert fatigue by automatically grouping related alerts into a single incident based on criteria such as entity matching or time window.

Exam trap

The trap here is that candidates often confuse automation rules with incident grouping logic, assuming that automation rules can create or group incidents, when in fact automation rules only manage incidents after they are created by analytics rules.

How to eliminate wrong answers

Option B is wrong because workbooks in Microsoft Sentinel are visualization tools that display data from queries; they do not create or group incidents. Option C is wrong because playbooks are automated workflows triggered by incidents or alerts (using Azure Logic Apps) and can perform response actions, but they are not designed to initially group alerts into incidents; incident creation is a function of the analytics rule. Option D is wrong because automation rules in Sentinel are used to automate incident management tasks (e.g., assigning, tagging, or running playbooks) after an incident is created, not to group alerts into incidents at creation time.

Practice this question →

50

MCQhard

Your organization uses Microsoft Sentinel as its SIEM. You receive a large number of low-severity alerts from various sources, overwhelming the security operations team. You need to design a solution to reduce alert fatigue while ensuring that critical incidents are not missed. The solution should also automatically collect feedback from analysts when they close an incident. What should you implement?

A.Tune analytics rules to generate incidents only for high-fidelity alerts and use automation rules to collect feedback on incident closure

B.Create a separate analytics rule for each severity level

C.Implement a playbook that automatically closes low-severity alerts and collects feedback

D.Increase the severity threshold for all analytics rules

AnswerA

Tuning analytics rules is the correct approach because it targets the root cause of alert fatigue: noisy or overly broad detection logic. By refining query thresholds, alert grouping, and incident creation settings, you ensure that only high-fidelity findings become incidents, while automation rules can trigger a playbook (e.g., an HTTP request or Teams message) to gather analyst feedback at incident closure. This feedback loop lets security operations continuously improve rule tuning without adding manual burden.

Why this answer

Tuning analytics rules to generate incidents only for high-fidelity alerts directly reduces alert volume without compromising detection of critical threats. Automation rules in Microsoft Sentinel can trigger a playbook or run a logic app on incident closure, enabling automatic collection of analyst feedback via custom fields or external systems.

Exam trap

The trap here is that candidates confuse 'automatically closing low-severity alerts' (Option C) with a valid noise-reduction technique, failing to recognize that automatic closure without analyst review can suppress true positives and violates the requirement to not miss critical incidents.

How to eliminate wrong answers

Option B is wrong because creating a separate analytics rule for each severity level does not reduce alert volume—it merely organizes alerts by severity, still overwhelming the SOC. Option C is wrong because automatically closing low-severity alerts via a playbook bypasses analyst review and risks missing critical incidents that may initially appear low-severity; feedback collection should be tied to incident closure, not automatic closure. Option D is wrong because increasing the severity threshold for all analytics rules is a blunt approach that can cause high-fidelity, critical alerts to be downgraded or missed entirely, violating the requirement to not miss critical incidents.

Practice this question →

51

MCQhard

Your organization has Microsoft Sentinel. You need to create an analytics rule that detects when a user account is created outside of business hours (9 AM to 5 PM, Monday-Friday). Which KQL query should you use as the rule query?

A.... | where dayofweek(TimeGenerated) between (1 .. 5) and datetime_part("hour", TimeGenerated) !between (9 .. 17)

B.... | where dayofweek(TimeGenerated) between (2 .. 6) and datetime_part("hour", TimeGenerated) !between (9 .. 17)

C.... | where dayofweek(TimeGenerated) between (2 .. 6) and datetime_part("hour", TimeGenerated) between (9 .. 17)

D.... | where dayofweek(TimeGenerated) !between (2 .. 6) or datetime_part("hour", TimeGenerated) between (9 .. 17)

AnswerB

This query is correct because KQL's dayofweek() returns an integer where Sunday=1, Monday=2, ..., Saturday=7. The range 2..6 therefore includes Monday, Tuesday, Wednesday, Thursday, and Friday exactly, and the !between (9..17) operator excludes hours that are greater than or equal to 9 and less than or equal to 17, so only hours before 9 AM or after 5 PM remain. Combining these conditions with AND yields all events that occurred on weekdays and outside standard business hours, which is precisely the requirement.

Why this answer

`dayofweek()` returns 1 for Sunday, 2 for Monday, ..., 7 for Saturday. To represent Monday (2) through Friday (6), the range must be `between (2 .. 6)`. The `!between (9 .. 17)` correctly excludes the 9 AM to 5 PM business hours, so the rule triggers only when a user account is created outside those hours on a weekday.

Exam trap

The trap here is that `dayofweek()` uses a 1-based index starting on Sunday (1), not Monday (1), so candidates often incorrectly use `between (1 .. 5)` expecting Monday through Friday, but that actually covers Sunday through Thursday.

How to eliminate wrong answers

Option A is wrong because `dayofweek(TimeGenerated) between (1 .. 5)` includes Sunday (1) through Thursday (5), which misses Friday and incorrectly includes Sunday. Option C is wrong because it uses `between (9 .. 17)` instead of `!between (9 .. 17)`, so it would detect accounts created *during* business hours, not outside them. Option D is wrong because it uses `!between (2 .. 6)` which includes weekends (Sunday and Saturday) and `or` with `between (9 .. 17)`, so it would fire for any account created during business hours on any day, including weekends, failing to target only weekday after-hours creation.

Practice this question →

52

MCQeasy

Your organization has a Microsoft 365 E5 subscription and wants to detect insider data exfiltration attempts. You need to design a solution that can identify users copying sensitive data to personal cloud storage services. Which Microsoft Purview capability should you use?

A.Data Loss Prevention (DLP) policies

B.eDiscovery (Premium)

C.Communication Compliance

D.Insider Risk Management

AnswerD

Correct. Insider Risk Management uses behavioral analytics to detect risky activities like copying data to personal cloud storage.

Why this answer

Insider Risk Management in Microsoft Purview is specifically designed to detect insider data exfiltration scenarios, including copying data to personal cloud storage. Option A is wrong because Data Loss Prevention (DLP) policies are preventive controls that block or warn about sharing sensitive data but do not detect exfiltration attempts based on user activities. Option B is wrong because eDiscovery (Premium) is used for legal discovery and investigations, not for real-time detection of insider risks.

Option C is wrong because Communication Compliance focuses on identifying inappropriate communications (e.g., harassment, sharing sensitive info via email or Teams), not on monitoring data exfiltration to personal cloud services.

Practice this question →

53

MCQeasy

Your company uses Microsoft Purview to protect sensitive data. You need to automatically apply a retention label to documents containing credit card numbers detected in SharePoint Online. What should you configure?

A.Configure a Data Loss Prevention (DLP) policy to apply the label.

B.Create a sensitivity label with auto-labeling for SharePoint.

C.Use a trainable classifier to detect credit card numbers and apply the label.

D.Create an auto-labeling policy for retention labels targeting sensitive info types.

AnswerD

An auto-labeling policy for retention labels is the correct solution because it natively supports automatic application of retention labels to content that matches sensitive info types, such as credit card numbers. These policies run across a tenant and can target SharePoint sites, OneDrive accounts, and Exchange mailboxes, evaluating content against built-in sensitive information types and applying the designated retention label. This approach directly aligns with the requirement to protect sensitive data while ensuring it is retained appropriately. Auto-labeling for retention labels is distinct from sensitivity-label auto-labeling, as it specifically governs data lifecycle rather than classification.

Why this answer

Auto-labeling policies in Microsoft Purview can automatically apply retention labels to documents based on sensitive info types, such as credit card numbers. This allows you to enforce retention rules without manual intervention, directly targeting the detected sensitive data in SharePoint Online.

Exam trap

The trap here is that candidates confuse retention labels with sensitivity labels, or assume DLP policies can apply retention labels directly, when in fact DLP applies sensitivity labels and auto-labeling policies are the correct mechanism for retention labels.

How to eliminate wrong answers

Option A is wrong because DLP policies are designed to prevent data loss by blocking or alerting on sensitive data, not to apply retention labels; they can apply sensitivity labels but not retention labels. Option B is wrong because sensitivity labels with auto-labeling are for classification and protection (e.g., encryption), not for retention; retention labels are a separate concept in Purview. Option C is wrong because trainable classifiers are used to identify content based on patterns or machine learning, but they do not directly apply retention labels; they can be used in auto-labeling policies, but the policy itself must be configured for retention labels targeting sensitive info types.

Practice this question →

54

MCQmedium

A company plans to implement Microsoft Purview to enforce data loss prevention (DLP) policies. They need to prevent users from sharing credit card numbers via email. What should they configure?

A.Create a sensitivity label and apply it to emails

B.Enable communication compliance policies

C.Create a DLP policy that detects and blocks credit card numbers in Exchange Online

D.Configure a retention policy for email

AnswerC

DLP policies in Microsoft Purview can detect sensitive info types like credit card numbers and block sharing via email.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) policies can be configured to detect sensitive data types, such as credit card numbers, in Exchange Online emails. When a DLP policy is created with a rule that identifies credit card numbers and blocks the email from being sent, it directly prevents users from sharing that data via email. This is the native mechanism for enforcing DLP on email traffic in Microsoft 365.

Exam trap

The trap here is that candidates often confuse sensitivity labels (which classify data) with DLP policies (which enforce actions on data in motion), leading them to select Option A instead of the correct DLP policy.

How to eliminate wrong answers

Option A is wrong because sensitivity labels are used to classify and protect data based on sensitivity, but they do not inherently detect or block specific sensitive information like credit card numbers in transit; they require manual or automatic labeling and rely on other controls (like DLP) for enforcement. Option B is wrong because communication compliance policies are designed to detect and remediate inappropriate or policy-violating communications (e.g., harassment, insider trading), not to block the sharing of specific sensitive data patterns like credit card numbers. Option D is wrong because retention policies control how long data is kept or deleted, not how data is shared or blocked in real-time; they have no effect on preventing the transmission of credit card numbers via email.

Practice this question →

55

MCQeasy

Your organization uses Microsoft Defender XDR to detect and respond to threats. The SOC team wants to automatically isolate a device when a high-severity incident is confirmed. Which automation feature should you configure?

A.Microsoft Defender for Office 365 Safe Attachments policy

B.Automated investigation and response (AIR)

C.Manual device isolation from Microsoft 365 Defender portal

D.Microsoft Defender for Endpoint's endpoint detection and response (EDR)

AnswerB

AIR can automatically isolate devices based on incident severity.

Why this answer

Automated investigation and response (AIR) in Microsoft Defender XDR is designed to automatically respond to confirmed high-severity incidents, including isolating devices, without manual intervention. This feature leverages playbooks and machine learning to contain threats rapidly, aligning with the SOC's requirement for automatic isolation upon incident confirmation.

Exam trap

The trap here is that candidates confuse EDR's detection capabilities with automated response, forgetting that AIR is the specific feature that orchestrates and executes automatic containment actions like device isolation.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Office 365 Safe Attachments policy is a email security feature that scans attachments for malware, not a device isolation mechanism. Option C is wrong because manual device isolation from the Microsoft 365 Defender portal requires human action, contradicting the requirement for automatic isolation. Option D is wrong because Microsoft Defender for Endpoint's endpoint detection and response (EDR) provides detection and investigation capabilities but does not include automated response actions like device isolation; that is handled by AIR.

Practice this question →

56

MCQeasy

Your organization needs to enforce multi-factor authentication (MFA) for all users accessing Microsoft Entra ID integrated applications. However, users in the finance department should be exempted from MFA when accessing a specific legacy financial app that does not support modern authentication. What should you design?

A.Enable security defaults for all users

B.Enable per-user MFA and exclude the finance department

C.Use Microsoft Entra Identity Protection to require MFA based on risk

D.Create a Conditional Access policy that requires MFA for all cloud apps except the legacy app

AnswerD

A Conditional Access policy can include all cloud apps in the 'target resources' assignment and then exclude the legacy application from the same assignment, allowing you to require MFA for every other cloud app. When the finance department is included in the users/groups, they will be prompted for MFA unless the sign-in targets the excluded legacy app, which precisely matches the stated requirement. Conditional Access policies are evaluated at sign-in time and provide the granular, app-level scoping that the other options lack.

Why this answer

Conditional Access policies allow granular control over which applications require MFA. By creating a policy that requires MFA for all cloud apps except the legacy financial app, you can enforce MFA broadly while exempting the specific app that does not support modern authentication. This approach is more flexible and secure than per-user MFA or security defaults, as it can target specific applications and conditions.

Exam trap

The trap here is that candidates may think per-user MFA (Option B) is sufficient for granular exclusions, but it lacks application-level control and would either block the legacy app or leave the entire finance department unprotected.

How to eliminate wrong answers

Option A is wrong because enabling security defaults enforces MFA for all users without any exclusion capability, which would block the finance department from accessing the legacy app that does not support modern authentication. Option B is wrong because per-user MFA is a legacy method that does not allow application-specific exclusions; it either enables MFA for a user entirely or not, and excluding the entire finance department would leave them unprotected for all other apps. Option C is wrong because Identity Protection risk-based policies require MFA based on user or sign-in risk, not application-specific exemptions; it cannot exempt a specific legacy app from MFA requirements.

Practice this question →

57

Multi-Selecthard

A company uses Microsoft Intune to manage devices. They need to ensure that only compliant devices can access corporate email. They plan to use Conditional Access in Microsoft Entra ID. Which THREE components must be configured?

Select 3 answers

A.Device registration in Entra ID

B.Conditional Access policy in Entra ID

C.Windows Autopilot deployment profile

D.Compliance policy in Intune

E.Configuration profile in Intune

AnswersA, B, D

Devices must be registered to be evaluated.

Why this answer

Device registration in Entra ID (A) is required because Conditional Access policies evaluate device compliance based on the device's identity in Entra ID. Without registration, the device lacks a unique identity that Entra ID can assess for compliance status, making it impossible to enforce access controls based on device state.

Exam trap

The trap here is that candidates often confuse Configuration profiles (which apply settings) with Compliance policies (which define security requirements), leading them to incorrectly select Configuration profile instead of Compliance policy for enforcing device-based access control.

Practice this question →

58

MCQeasy

Refer to the exhibit. You configure this mail flow rule in Exchange Online. What happens to emails with 'FREE' in the subject?

A.Emails are deleted

B.Emails have a custom header added

C.Emails are moved to the Junk Email folder

D.Emails are blocked and not delivered

AnswerC

This is the correct behavior. The 'mark as spam' action sets the message's SCL to 6, which is the threshold used by Exchange Online to route the email to the recipient's Junk Email folder (depending on the mailbox's safe sender settings). It does not delete or reject the email; instead, it delivers it to the spam quarantine location within the mailbox, allowing the user to review it later.

Why this answer

The mail flow rule is configured to add the header 'X-CustomHeader' with the value 'Free' to emails that have 'FREE' in the subject. However, the rule also has the action 'Increase the spam confidence level (SCL) to 9', which causes Exchange Online to treat the message as high-confidence spam. When the SCL is set to 9, Exchange Online automatically moves the email to the Junk Email folder for the recipient, unless a transport rule or mailbox setting overrides this behavior.

Therefore, the emails are not deleted, blocked, or simply have a header added; they are moved to the Junk Email folder due to the SCL increase.

Exam trap

The trap here is that candidates see the 'add a custom header' action and assume that is the only effect, overlooking that the subsequent 'increase SCL to 9' action takes precedence and causes the email to be moved to the Junk Email folder, making the header addition secondary.

How to eliminate wrong answers

Option A is wrong because the rule does not include a 'Delete the message without notifying anyone' action; it only adds a header and increases the SCL, which does not result in deletion. Option B is wrong because while the rule does add a custom header ('X-CustomHeader: Free'), this is not the final outcome—the SCL increase to 9 overrides this action by causing the message to be moved to Junk Email, so the primary effect is the junking, not just header addition. Option D is wrong because the rule does not use a 'Reject the message' action (such as with a non-delivery report or 550 status code); increasing the SCL to 9 does not block delivery but instead routes the message to the Junk Email folder.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Design security operations, identity, and compliance capabilities questions.

Start 20-question session