Courseiva

CCNA Design solutions that align with security best practices and priorities Questions

72 questions · Design solutions that align with security best practices and priorities · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQeasy

Your organization uses Microsoft Intune for mobile device management. You need to ensure that only devices compliant with security policies can access corporate email. What should you implement?

A.Conditional Access policy requiring compliant device
B.Microsoft Purview Data Lifecycle Management
C.Microsoft Defender for Endpoint integration
D.Microsoft Intune App Protection Policies
AnswerA

A Conditional Access policy requiring a compliant device acts as a real-time access gate at authentication, checking the device's compliance state reported by Intune against defined compliance policies. It evaluates signals such as enrollment status, device health attestation, and configured security settings, and blocks or allows access to Microsoft 365 or other cloud apps. This is the appropriate control because it enforces device-level access decisions before any session begins.

Why this answer

A is correct because a Conditional Access policy in Microsoft Entra ID can evaluate device compliance status reported by Intune before granting access to corporate email. By configuring a policy that requires a device to be marked as compliant, only devices that meet your security policies (e.g., encryption, OS version, threat level) will be allowed to authenticate and access email. This directly enforces the requirement that only compliant devices can access corporate email.

Exam trap

The trap here is that candidates often confuse Intune App Protection Policies (MAM) with device-based compliance, but MAM policies protect data at the app level and do not require the device itself to be compliant, so they do not meet the requirement of 'only compliant devices'.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview Data Lifecycle Management governs data retention and deletion policies, not real-time access control based on device compliance. Option C is wrong because Microsoft Defender for Endpoint integration provides threat detection and response on endpoints, but does not itself block access to email based on compliance status; it can feed signals into Conditional Access but is not the primary control. Option D is wrong because Intune App Protection Policies (MAM) protect data within apps without requiring device enrollment or compliance, so they do not ensure that only compliant devices can access email—they apply to apps on any device, including non-compliant ones.

Practice this question →
2
Multi-Selectmedium

A company is designing a data security strategy using Microsoft Purview. They need to identify sensitive data across their data estate, including on-premises SQL Server, Azure SQL Database, and Amazon S3. Which THREE components should they use? (Choose three.)

Select 3 answers
A.Microsoft Purview Data Estate Insights
B.Microsoft Purview External Identities
C.Microsoft Purview Data Catalog
D.Microsoft Purview Compliance Manager
E.Microsoft Purview Data Map
AnswersA, C, E

Data Estate Insights provides monitoring and reporting.

Why this answer

Microsoft Purview Data Estate Insights provides visibility into data estate health and security posture, including sensitive data discovery across on-premises SQL Server, Azure SQL Database, and Amazon S3. It aggregates scan results and offers dashboards to identify where sensitive data resides, enabling targeted classification and protection actions.

Exam trap

The trap here is that candidates confuse Compliance Manager (a compliance posture tool) with data discovery capabilities, or think External Identities (an identity feature) is relevant to scanning data sources, when in fact only Data Map, Data Catalog, and Data Estate Insights form the core trio for sensitive data identification across hybrid estates.

Practice this question →
3
MCQhard

A security team is designing a Microsoft Sentinel deployment. They need to minimize costs while ensuring critical alerts are always processed. Which data retention and ingestion strategy should they use?

A.Use Basic Logs for all data and retain for 90 days
B.Use Analytics Logs for all data and retain for 30 days
C.Use Basic Logs for critical alerts and retain for 30 days
D.Use Basic Logs for high-volume low-value data and Analytics Logs for critical alerts
AnswerD

This is the correct cost-performance trade-off: route high-volume, low-value data such as verbose firewall logs, debug traces, and raw DNS events to Basic Logs to slash ingestion costs, while steering critical security alerts and curated detection data into Analytics Logs for full KQL querying, alerting, and hunting workflows. Basic Logs' lower cost and acceptable simple-search capability align perfectly with data that is retained mainly for compliance or ad-hoc troubleshooting, while Analytics Logs' rich analytical features and long retention match the needs of high-priority security detections. Microsoft Sentinel supports this pattern natively by configuring table-level plans, enabling a single workspace to hold both tiers and ensuring that analysts can query the data that matters most with low latency. This balanced design meets both cost optimization and security operational requirements, making it the only viable answer.

Why this answer

It aligns with cost optimization and reliability requirements by using Basic Logs for high-volume, low-value data (e.g., firewall logs) and reserving Analytics Logs for critical alerts that require full query capabilities and interactive retention. This tiered approach ensures critical alerts are always processed with full fidelity while reducing storage costs for less important data.

Exam trap

The trap here is that candidates assume all data must be in Analytics Logs for security monitoring, overlooking the cost-saving strategy of tiered ingestion where Basic Logs handle high-volume, low-value data without sacrificing critical alert processing.

How to eliminate wrong answers

Option A is wrong because using Basic Logs for all data prevents critical alerts from being processed with full Analytics Logs features (e.g., advanced KQL queries, scheduled analytics rules), and 90-day retention on Basic Logs incurs unnecessary cost for low-value data. Option B is wrong because using Analytics Logs for all data maximizes cost (Analytics Logs are more expensive per GB) and 30-day retention may not meet compliance or investigation needs for critical alerts. Option C is wrong because using Basic Logs for critical alerts means they lose access to Analytics Logs capabilities (e.g., near-real-time detection, custom detections), and 30-day retention is insufficient for forensic analysis of critical incidents.

Practice this question →
4
MCQhard

Your organization uses Microsoft Sentinel and has deployed the Analytics rule 'TI map IP entity to AzureActivity' to detect suspicious activities based on threat intelligence. The SOC team reports that the rule has a high false positive rate because it matches benign IP addresses used by legitimate services. What design change should you recommend to reduce false positives while maintaining detection coverage?

A.Increase the alert threshold to require multiple occurrences within a time window.
B.Disable the rule and rely on manual hunting queries.
C.Create a watchlist of trusted IP addresses and modify the rule to exclude those IPs.
D.Create a separate analytics rule that suppresses alerts when the source IP is in a trusted list.
AnswerC

Creating a watchlist of trusted IP addresses and modifying the rule to exclude those IPs directly addresses the source of the false positives without disabling detection. In Sentinel, you can build a watchlist (e.g., via CSV or PowerShell) and then reference it in the analytics rule's KQL query using the `_GetWatchlist` function—for instance, adding a `where IPAddress !in (_GetWatchlist('TrustedIPs'))` clause. This keeps the rule active for all other IPs, ensuring genuine threat-intelligence matches still generate alerts while known benign entities are filtered out, and it allows easy updates to the trusted list without re-editing the rule each time.

Why this answer

Creating a watchlist of trusted IP addresses and modifying the TI map IP entity to AzureActivity rule to exclude those IPs directly addresses the high false positive rate caused by benign IPs. This approach preserves detection coverage for all other threat intelligence matches while filtering out known legitimate services, leveraging Sentinel's watchlist feature for dynamic exclusion without disabling the rule.

Exam trap

The trap here is that candidates may choose Option D, thinking a separate suppression rule is needed, but Microsoft Sentinel's analytics rules support direct exclusion via watchlists in the query logic, making a separate rule redundant and less reliable.

How to eliminate wrong answers

Option A is wrong because increasing the alert threshold to require multiple occurrences within a time window does not address the root cause—benign IPs matching threat intelligence—and may delay detection of genuine threats or miss single-occurrence attacks. Option B is wrong because disabling the rule and relying on manual hunting queries eliminates automated detection entirely, increasing risk and workload, which contradicts the goal of maintaining detection coverage. Option D is wrong because creating a separate analytics rule that suppresses alerts when the source IP is in a trusted list introduces unnecessary complexity and potential race conditions; suppression logic should be integrated into the original rule via exclusion, not handled as a separate rule that may not suppress alerts in time or could conflict with other rules.

Practice this question →
5
MCQeasy

Your organization uses Microsoft Sentinel as its SIEM. The security team needs to detect brute-force attacks against Azure VMs by analyzing Windows Security Event logs. Which data connector should you enable?

A.Office 365 connector
B.Azure Activity log connector
C.Microsoft Defender for Cloud connector
D.Windows Security Events via AMA connector
AnswerD

The Windows Security Events via Azure Monitor Agent (AMA) connector is purpose-built to stream Windows Event logs from servers and workstations directly into Microsoft Sentinel. Using a Data Collection Rule (DCR), it can collect the Security channel and other event channels, preserving the raw event details for detections and investigations. This is the correct connector when your organization must ingest Windows security events into Sentinel.

Why this answer

The Windows Security Events via AMA connector (D) is correct because it ingests Windows Event Logs (specifically Security logs with Event ID 4625 for failed logons) from Azure VMs into Microsoft Sentinel, enabling detection of brute-force patterns. This connector uses the Azure Monitor Agent (AMA) to collect events, which is the recommended method for modern Windows event collection in Sentinel.

Exam trap

The trap here is that candidates may confuse the Azure Activity log connector (which shows administrative actions like 'Deallocate VM') with guest OS-level security events, or mistakenly think Defender for Cloud provides raw Windows event logs instead of aggregated security alerts.

How to eliminate wrong answers

Option A is wrong because the Office 365 connector ingests audit logs from Microsoft 365 services (Exchange, SharePoint, Teams), not Windows Security Event logs from Azure VMs. Option B is wrong because the Azure Activity log connector collects subscription-level control plane events (e.g., VM creation, resource changes), not guest OS-level security events like logon failures. Option C is wrong because the Microsoft Defender for Cloud connector ingests security alerts and posture data from Defender for Cloud, not raw Windows Security Event logs needed for brute-force detection.

Practice this question →
6
MCQhard

Your organization is implementing a privileged access strategy using Microsoft Entra Privileged Identity Management (PIM). The compliance team requires that all privileged role activations be approved by a manager and that an audit trail is maintained for at least one year. Which configuration should you recommend?

A.Configure access reviews for privileged roles
B.Set PIM role settings to require approval and enable audit logging
C.Enable Conditional Access policies for privileged roles
D.Require Azure MFA for role activation
AnswerB

PIM supports approval workflow and logs are retained for auditing.

Why this answer

It directly addresses both compliance requirements: requiring approval ensures a manager authorizes each activation, and enabling audit logging in PIM retains activation history for at least one year. PIM role settings allow you to configure approval workflows and automatically log all activations to the Microsoft Entra audit log, which can be exported and retained for compliance purposes.

Exam trap

The trap here is that candidates confuse access reviews (periodic recertification) with the real-time approval workflow required for each activation, or they assume MFA alone satisfies the audit and approval requirements.

How to eliminate wrong answers

Option A is wrong because access reviews are used for periodic recertification of role assignments, not for real-time approval of activations or audit trail retention. Option C is wrong because Conditional Access policies control access based on conditions like location or device state, but they do not provide the required manager approval workflow or dedicated audit logging for role activations. Option D is wrong because Azure MFA for role activation enhances security but does not satisfy the compliance requirement for manager approval or the one-year audit trail retention.

Practice this question →
7
MCQmedium

A company uses Microsoft Purview to manage data governance. They need to classify sensitive data automatically in Azure SQL Database. What should they configure?

A.Microsoft Defender for Cloud regulatory compliance
B.Microsoft Purview Data Map scanning rules
C.Microsoft Sentinel data connectors
D.Microsoft Entra ID Protection
AnswerB

Microsoft Purview Data Map scanning rules automatically connect to various data sources, both on-premises and multi-cloud, and run scans to profile and classify assets. These rules apply built-in or custom classification patterns—like regex for PII, financial, or health information—and assign sensitivity labels to structured and unstructured data. This is exactly the mechanism that enables data governance by building a searchable, classified inventory of enterprise data, making it the correct choice for a company using Purview.

Why this answer

Microsoft Purview Data Map scanning rules are the correct choice because they enable automated classification of sensitive data in Azure SQL Database by scanning the database schema and content against built-in or custom sensitive data types. This is the native mechanism within Purview to discover and label sensitive columns, such as credit card numbers or PII, directly in Azure SQL Database.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud's regulatory compliance dashboard with actual data classification, but Defender for Cloud only checks configuration settings against compliance frameworks, not the content of the data itself.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud regulatory compliance assesses the security posture of Azure resources against compliance standards (e.g., SOC 2, PCI DSS) but does not perform data classification or scanning of sensitive data within Azure SQL Database. Option C is wrong because Microsoft Sentinel data connectors ingest security logs and alerts from various sources for threat detection and SIEM purposes, not for scanning or classifying sensitive data in databases. Option D is wrong because Microsoft Entra ID Protection focuses on identity-based risks such as compromised credentials and sign-in anomalies, not on data classification within Azure SQL Database.

Practice this question →
8
MCQhard

A company uses Azure DevOps and wants to implement a DevSecOps practice by scanning code for secrets and vulnerabilities before deployment. Which tool should they integrate into their pipeline?

A.Azure Policy
B.Microsoft Purview
C.GitHub Advanced Security
D.Microsoft Defender for DevOps
AnswerD

Microsoft Defender for DevOps is a dedicated service that integrates directly with Azure DevOps (and GitHub) to provide continuous security scanning of code, secrets, infrastructure-as-code templates, and open-source dependencies. It leverages built-in scanners like Credential Scanner and integrates with Defender for Cloud to aggregate findings across the software development life cycle. This makes it the correct choice for an Azure DevOps-centric organization seeking DevOpsSec capabilities.

Why this answer

Microsoft Defender for DevOps is the correct choice because it is a unified DevSecOps solution that integrates directly into Azure DevOps pipelines to scan code for secrets, vulnerabilities, and open-source dependencies before deployment. It provides actionable security insights and remediation guidance, aligning with the requirement to implement a DevSecOps practice by scanning code for secrets and vulnerabilities.

Exam trap

The trap here is that candidates may confuse GitHub Advanced Security (which is for GitHub repositories) with Microsoft Defender for DevOps (which is for Azure DevOps pipelines), leading them to choose Option C even though the question explicitly states the company uses Azure DevOps.

How to eliminate wrong answers

Option A is wrong because Azure Policy is a governance tool that enforces compliance rules on Azure resources (e.g., tagging, location restrictions) and does not scan code for secrets or vulnerabilities. Option B is wrong because Microsoft Purview is a data governance and classification service for data estates (e.g., sensitive data discovery in storage) and lacks the capability to scan source code in a CI/CD pipeline. Option C is wrong because GitHub Advanced Security is a suite of security features for GitHub repositories (e.g., secret scanning, code scanning) but is not natively integrated into Azure DevOps pipelines; it requires a GitHub repository, whereas the question specifies Azure DevOps.

Practice this question →
9
MCQeasy

You are designing a security solution for Azure resources. You need to ensure that any changes to network security groups (NSGs) are automatically logged and sent to a central Log Analytics workspace. Which Azure feature should you use?

A.Diagnostic settings on the Azure Activity Log
B.Azure Policy
C.NSG flow logs
D.Azure Monitor alerts
AnswerA

Diagnostic settings on the Azure Activity Log are the correct mechanism because the Activity Log itself records every control-plane operation—such as resource creation, deletion, and configuration changes—for your Azure resources. By configuring a diagnostic setting on this log, you can stream those management events directly into a Log Analytics workspace, enabling centralized querying, alerting, and long-term retention for security auditing. This is the built-in, supported way to capture and route resource-level change activity to your security monitoring pipeline.

Why this answer

Diagnostic settings on the Azure Activity Log capture all control-plane operations, including changes to NSGs (e.g., rule additions or deletions). By configuring a diagnostic setting to stream the Activity Log to a Log Analytics workspace, you ensure that every NSG modification is automatically logged and centralized for monitoring and alerting.

Exam trap

The trap here is confusing NSG flow logs (which log network traffic) with the Activity Log (which logs configuration changes), leading candidates to select NSG flow logs instead of diagnostic settings on the Activity Log.

How to eliminate wrong answers

Option B (Azure Policy) is wrong because Azure Policy enforces compliance rules (e.g., preventing NSG changes that allow all inbound traffic) but does not automatically log changes; it can trigger remediation but not send logs to Log Analytics. Option C (NSG flow logs) is wrong because NSG flow logs capture IP traffic data (source/destination, ports, protocols) through the NSG, not configuration changes to the NSG itself. Option D (Azure Monitor alerts) is wrong because alerts are reactive notifications based on log data or metrics; they do not capture or forward logs themselves.

Practice this question →
10
MCQeasy

You are designing a security operations strategy for Microsoft 365. You need to prioritize alerts from Microsoft Defender XDR based on their impact on business operations. Which security best practice should you follow?

A.Prioritize alerts based on a risk assessment that considers asset criticality, threat severity, and business impact
B.Prioritize alerts based on a qualitative risk assessment only
C.Treat all alerts with equal severity to ensure none are missed
D.Prioritize alerts based solely on the MITRE ATT&CK technique involved
AnswerA

Risk-based prioritization that scores asset criticality, threat severity, and business impact is the industry-standard approach because it translates raw signals into actionable decisions aligned with organizational value. By quantifying each alert's potential damage against the importance of the affected system, security operations teams can focus containment and investigation resources on events most likely to cause significant harm. This method also supports continuous improvement by allowing thresholds to be tuned based on telemetry and incident outcomes.

Why this answer

Microsoft Defender XDR integrates with Microsoft 365 Defender's risk-based alert prioritization, which uses a combination of asset criticality (e.g., from Microsoft Purview or Defender for Cloud Apps), threat severity (e.g., from the Microsoft Defender portal's alert severity levels: Informational, Low, Medium, High), and business impact (e.g., via sensitivity labels or data classification). This aligns with the security best practice of risk-based alert triage, ensuring that high-impact alerts are addressed first to minimize business disruption.

Exam trap

The trap here is that candidates may choose Option D because MITRE ATT&CK is a common framework in security operations, but they overlook that Microsoft Defender XDR's prioritization engine uses a multi-faceted risk assessment (including asset criticality and business impact) rather than a single technique-based filter.

How to eliminate wrong answers

Option B is wrong because a qualitative risk assessment alone lacks the quantitative data (e.g., asset criticality scores, threat severity levels) that Microsoft Defender XDR uses to dynamically prioritize alerts, leading to subjective and inconsistent triage. Option C is wrong because treating all alerts with equal severity ignores the risk-based prioritization built into Microsoft Defender XDR, which uses machine learning and threat intelligence to assign different severity levels (e.g., High, Medium, Low) and would overwhelm security operations with noise. Option D is wrong because prioritizing solely on the MITRE ATT&CK technique ignores asset criticality and business impact; for example, a low-severity technique on a critical server may be more impactful than a high-severity technique on a non-critical endpoint, and Microsoft Defender XDR's alert enrichment includes asset context beyond just the technique.

Practice this question →
11
MCQeasy

A company is adopting Microsoft Purview for data security. They need to prevent users from sharing sensitive data like credit card numbers via email. Which feature should you configure?

A.Audit log search
B.Data Loss Prevention (DLP) policy
C.Insider Risk Management policy
D.Sensitivity labels
AnswerB

Data Loss Prevention (DLP) policies in Microsoft Purview are the correct inline control to block sharing of sensitive information. They use built-in sensitive info types (e.g., credit card numbers, personally identifiable information) and trainable classifiers to evaluate content in real time, then enforce actions such as 'Block' with the option to allow overrides for Exchange, SharePoint, OneDrive, and endpoints. By applying conditions like 'sharing with people outside the organization,' DLP can prevent the sharing action before any data leaves the tenant, making it the only option here that directly provides ex-ante prevention rather than detection or classification.

Why this answer

Data Loss Prevention (DLP) policies in Microsoft Purview are specifically designed to detect and prevent the accidental or intentional sharing of sensitive information, such as credit card numbers, through email and other channels. By configuring a DLP policy with a rule that scans for credit card number patterns (using predefined or custom sensitive info types), the system can block, quarantine, or notify users when such data is sent via Exchange Online. This directly addresses the requirement to prevent sharing sensitive data via email.

Exam trap

The trap here is that candidates often confuse Sensitivity labels as a direct replacement for DLP, but labels are for classification and protection (e.g., encryption), not for real-time content inspection and blocking of specific data patterns like credit card numbers in email.

How to eliminate wrong answers

Option A is wrong because Audit log search is a forensic tool for reviewing past activities, not a preventive control that blocks data sharing in real time. Option C is wrong because Insider Risk Management policies focus on identifying and investigating risky user behaviors (e.g., data exfiltration patterns) rather than enforcing content-based restrictions on outbound email. Option D is wrong because Sensitivity labels classify and protect data through encryption and visual markings, but they do not inherently block the transmission of specific sensitive data types like credit card numbers via email without being combined with a DLP policy.

Practice this question →
12
MCQeasy

Tailwind Traders is a small business that uses Microsoft 365 Business Premium. They have no dedicated IT staff. The owner wants to implement basic security measures to protect against common threats like phishing, ransomware, and unauthorized access. They need a simple, cost-effective solution that aligns with Microsoft's security best practices for small businesses. Which set of actions should you recommend?

A.Implement Privileged Identity Management (PIM) for all accounts. Use Azure Information Protection to classify all emails. Set up a SIEM using Microsoft Sentinel.
B.Deploy Microsoft Intune to manage devices. Configure Conditional Access policies to require compliant devices. Use Microsoft Defender for Endpoint for antivirus. Set up a VPN for remote access.
C.Purchase Azure AD Premium P2 for all users. Use Identity Protection to detect risks. Configure Conditional Access with session controls. Use Azure AD Identity Governance for access reviews.
D.Enable Security Defaults in Microsoft Entra ID to enforce MFA for all users. Configure Microsoft Defender for Office 365 to protect against phishing and malware. Use Microsoft Defender for Business (included) for endpoint protection. Regularly review the Microsoft 365 Secure Score and implement top recommendations.
AnswerD

Security Defaults in Microsoft Entra ID automatically enforce MFA for all users and block legacy authentication, providing a strong baseline without extra licensing or complex policy setup. Defender for Office 365 protects against phishing, malware, and malicious links in email, which is critical for small businesses that rely heavily on email communication. Defender for Business is included in Microsoft 365 Business plans and provides managed endpoint protection tailored to smaller organizations. Regularly reviewing the Secure Score helps prioritize low-effort, high-impact security improvements that align with the business's actual risk profile.

Why this answer

It aligns with Microsoft's security best practices for small businesses with no dedicated IT staff. Security Defaults in Microsoft Entra ID provide a baseline of MFA enforcement without requiring complex configuration. Microsoft Defender for Office 365 and Defender for Business (included in Microsoft 365 Business Premium) offer integrated phishing, malware, and endpoint protection.

Regularly reviewing the Secure Score ensures continuous improvement against common threats like ransomware and unauthorized access.

Exam trap

The trap here is that candidates often over-engineer the solution by selecting advanced identity or endpoint management options (like PIM, Intune, or Azure AD Premium P2) that are technically valid but inappropriate for a small business with no IT staff, ignoring the cost and complexity constraints explicitly stated in the scenario.

How to eliminate wrong answers

Option A is wrong because Privileged Identity Management (PIM) requires Azure AD Premium P2 licensing, which is not included in Microsoft 365 Business Premium and adds unnecessary complexity for a small business with no IT staff; Azure Information Protection and Microsoft Sentinel are also overkill and not cost-effective. Option B is wrong because Microsoft Intune requires additional licensing beyond Business Premium and managing device compliance via Conditional Access policies demands dedicated IT expertise; a VPN is not a core security control for phishing or ransomware and adds complexity. Option C is wrong because Azure AD Premium P2 for all users is expensive and unnecessary for a small business; Identity Protection and Identity Governance are advanced features designed for larger enterprises with dedicated identity teams, not a simple, cost-effective baseline.

Practice this question →
13
MCQeasy

Your organization needs to audit all changes to Azure resources, including who made the change and what was changed. Which Azure service should you use to collect and analyze this audit data?

A.Azure Policy
B.Azure Monitor with activity logs
C.Microsoft Defender for Cloud
D.Microsoft Sentinel
AnswerB

The Azure Activity Log records every control-plane write operation (create, update, delete) on Azure resources, including the caller identity, timestamp, operation name, and resource ID—precisely the data required for change auditing. Azure Monitor provides a unified platform to query and analyze these logs via Log Analytics, configure alerts on specific changes, and export them to storage or event hubs for retention. This combination yields a comprehensive, queryable audit trail of all resource modifications, making it the correct foundational service for auditing every change to Azure resources.

Why this answer

Azure Monitor with activity logs is the correct service because it captures all control-plane operations on Azure resources, including who performed the change (via Azure Active Directory authentication), what was changed (the resource and properties), and when it occurred. Activity logs are retained for 90 days by default and can be exported to Log Analytics workspaces for advanced querying and alerting, making them the native audit trail for Azure resource modifications.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel as the audit service because it is a SIEM, but Sentinel ingests logs from other sources (including activity logs) and is not the native collection mechanism; the question specifically asks for the service that collects and analyzes the audit data, which is Azure Monitor with activity logs.

How to eliminate wrong answers

Option A is wrong because Azure Policy is a governance tool that enforces compliance rules on resources (e.g., requiring specific tags or denying certain SKUs) and does not natively log who made changes or what was changed; it evaluates resource configurations against policies but does not provide an audit trail of modifications. Option C is wrong because Microsoft Defender for Cloud focuses on security posture management, threat detection, and vulnerability assessments, not on auditing all resource changes; it uses activity logs for some security alerts but is not designed as a primary audit log service. Option D is wrong because Microsoft Sentinel is a SIEM (Security Information and Event Management) solution that ingests logs from multiple sources, including activity logs, but it is not the service that collects the audit data itself; the underlying source for resource change auditing remains Azure Monitor activity logs.

Practice this question →
14
MCQeasy

Your organization is adopting Microsoft Entra ID as the identity provider for all SaaS applications. The security team wants to enforce multifactor authentication (MFA) for all users accessing these applications. Which approach aligns with security best practices and minimizes user friction?

A.Enable per-user MFA for all users in Microsoft Entra ID.
B.Disable MFA and rely on strong password policies.
C.Enable Microsoft Entra ID Security defaults.
D.Create a Conditional Access policy requiring MFA for all cloud apps, excluding trusted locations and devices.
AnswerD

A Conditional Access policy gives granular control to require MFA for all cloud apps while excluding trusted locations and devices, enabling risk-based, context-aware enforcement. It can leverage named locations, device compliance, and sign-in risk, and integrate with session controls, session persistence, and break-glass accounts, directly satisfying both the MFA mandate and the need for exception handling.

Why this answer

Conditional Access policies allow granular, risk-based MFA enforcement that excludes trusted locations (e.g., corporate offices) and trusted devices (e.g., compliant or hybrid-joined devices). This aligns with the Zero Trust principle of 'verify explicitly' while minimizing user friction by not prompting for MFA when the user is already in a trusted context. Security defaults (Option C) enforce MFA for all users but lack the ability to exclude trusted locations or devices, which can cause unnecessary friction.

Exam trap

The trap here is that candidates often confuse Security defaults (Option C) as the best practice for MFA enforcement, but Security defaults lack the exclusion capabilities of Conditional Access, which is the recommended approach for minimizing friction while maintaining security.

How to eliminate wrong answers

Option A is wrong because per-user MFA is a legacy approach that forces MFA on every authentication attempt regardless of context, leading to high user friction and no ability to exclude trusted locations or devices; it also lacks the granular control of Conditional Access. Option B is wrong because disabling MFA and relying solely on strong password policies violates security best practices, as passwords alone are vulnerable to phishing, credential stuffing, and brute-force attacks, and does not meet the requirement to enforce MFA. Option C is wrong because while Security defaults enforce MFA for all users, they do not allow exclusion of trusted locations or devices, which means users are prompted for MFA even from the corporate network or on compliant devices, increasing friction unnecessarily.

Practice this question →
15
MCQmedium

A company uses Microsoft Intune to manage devices. They want to ensure that only devices that have passed health attestation can access corporate email. Which method should they use?

A.Use Microsoft Defender for Endpoint to block devices that fail health attestation
B.Create a device compliance policy for health attestation and use Conditional Access to require compliant devices
C.Create an app protection policy to require device health attestation
D.Create a device configuration policy to enforce health attestation
AnswerB

Device compliance policies in Microsoft Intune include a 'Device Health Attestation' section that reports security boot, BitLocker, and code integrity state from supported Windows devices. After the policy is evaluated, Conditional Access can require 'Device to be marked as compliant' as a grant control, preventing sign-in from devices that fail attestation checks. This pairing is the correct sequence: Intune establishes the health baseline and Conditional Access enforces access, making it the only option here that actually gates authentication.

Why this answer

It combines a device compliance policy that evaluates health attestation (e.g., BitLocker status, Secure Boot, code integrity) with a Conditional Access policy that grants access to corporate email only when the device is marked as compliant. This is the standard Microsoft approach for enforcing health attestation before granting access to cloud resources like Exchange Online.

Exam trap

The trap here is confusing device compliance policies (which evaluate and report health state) with device configuration policies (which only apply settings), leading candidates to pick Option D, which cannot enforce access control.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Endpoint can detect and alert on device health issues but cannot directly block access to corporate email; blocking requires integration with Conditional Access or a network enforcement point. Option C is wrong because app protection policies (MAM) manage data protection at the app level without evaluating device health attestation; they rely on app-level conditions like jailbreak detection, not hardware-attested health. Option D is wrong because device configuration policies set settings (e.g., BitLocker enablement) but do not enforce real-time attestation checks or block access; compliance is determined by a separate compliance policy, not a configuration profile.

Practice this question →
16
MCQhard

A company is designing a security strategy for their AI-powered applications using Microsoft Azure OpenAI Service. They need to ensure that the AI models are not used to generate harmful content and that the data sent to the models is protected. Which Microsoft Purview feature should they use?

A.Microsoft Purview Endpoint DLP
B.Microsoft Purview Information Protection
C.Microsoft Purview Data Loss Prevention (DLP) for AI
D.Microsoft Purview Audit
AnswerC

Microsoft Purview Data Loss Prevention (DLP) for AI extends DLP policies to AI services, allowing administrators to detect sensitive information—like financial, health, or personal data—within user prompts and AI-generated responses. It can enforce real-time actions such as blocking or warning users when sensitive data is exchanged, and it integrates with services like Microsoft Copilot. This makes it the only option that actively prevents harmful content from being processed or generated in AI interactions.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) for AI is the correct feature because it is specifically designed to monitor and control the data sent to and from AI applications, including Azure OpenAI Service, to prevent the generation of harmful content and protect sensitive data. It uses deep content analysis and policy-based controls to detect and block policy violations in real-time, directly addressing the dual requirements of content safety and data protection.

Exam trap

The trap here is that candidates often confuse general data protection features (like Information Protection or Endpoint DLP) with the specialized AI-focused DLP capability, assuming any DLP or protection feature can handle AI workloads, when only DLP for AI is purpose-built for Azure OpenAI Service interactions.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Endpoint DLP focuses on monitoring and controlling data on endpoints (e.g., Windows 10/11 devices) and does not natively integrate with Azure OpenAI Service to inspect AI model prompts or outputs. Option B is wrong because Microsoft Purview Information Protection is primarily for classifying, labeling, and protecting sensitive data at rest (e.g., files and emails) using encryption and rights management, not for real-time content filtering of AI interactions. Option D is wrong because Microsoft Purview Audit provides logging and investigation of user and admin activities (e.g., who accessed what) but does not enforce policies to prevent harmful content generation or protect data in transit to AI models.

Practice this question →
17
MCQmedium

Your company uses Microsoft Purview to classify and label sensitive data. The data protection team needs to automatically apply a 'Confidential' label to documents that contain a custom sensitive info type for employee IDs. Which should you create?

A.A trainable classifier
B.A sensitivity label
C.A retention label
D.A custom sensitive information type and an auto-labeling policy
AnswerD

A custom sensitive information type (SIT) lets you define a precise regex or keyword-based pattern for the employee ID, giving Purview deterministic detection logic for that exact structure. An auto-labeling policy then continuously scans documents in SharePoint, OneDrive, and Exchange for that SIT and automatically applies a sensitivity label when matches are found. Together, these two components provide end-to-end, content-based discovery and labeling — the correct combination for classifying files based on a custom employee ID pattern.

Why this answer

To automatically apply a 'Confidential' label based on the presence of a custom sensitive info type (employee IDs), you need both a custom sensitive information type (SIT) to define the pattern and an auto-labeling policy to trigger the label application. The auto-labeling policy uses the SIT to scan documents and automatically applies the specified sensitivity label when a match is found. This is the only option that combines the detection mechanism with automated labeling.

Exam trap

The trap here is that candidates often confuse the role of a sensitivity label (which is just the label definition) with the auto-labeling policy (which provides the detection and automation), leading them to select only the sensitivity label without the necessary policy.

How to eliminate wrong answers

Option A is wrong because a trainable classifier uses machine learning to identify content based on examples, not a custom pattern like employee IDs, and it cannot directly apply labels without an auto-labeling policy. Option B is wrong because a sensitivity label alone defines the label and its protection settings but does not include the detection logic or automation to apply it automatically based on content. Option C is wrong because a retention label is used for data lifecycle management (retention and deletion), not for sensitivity classification or automatic application based on sensitive info types.

Practice this question →
18
MCQmedium

A company uses Microsoft Defender for Cloud to manage security across hybrid workloads. They need to ensure that all Azure VMs have guest-level threat detection enabled. Which security policy should they assign?

A.Azure Security Benchmark
B.Microsoft cloud security benchmark
C.Microsoft Defender for Cloud Apps
D.NIST SP 800-53
AnswerB

The Microsoft cloud security benchmark (MCSB) is the unified, built-in policy initiative that evolved from the Azure Security Benchmark and includes policies that deploy the Guest Configuration extension onto VMs and enable Microsoft Defender for Servers, which provides guest-level threat detection. When this initiative is assigned, its DeployIfNotExists policies automatically install required agents and extensions, directly fulfilling the stated requirement. Thus, it is the correct initiative for enabling guest-level threat detection.

Why this answer

The Microsoft cloud security benchmark (MCSB) is the correct policy because it includes built-in guest-level threat detection recommendations for Azure VMs, such as deploying the Log Analytics agent and enabling Microsoft Defender for Servers with guest-level monitoring. This benchmark is the default initiative in Defender for Cloud and directly maps to the requirement of enabling guest-level threat detection across all VMs.

Exam trap

The trap here is that candidates confuse the deprecated 'Azure Security Benchmark' with the current 'Microsoft cloud security benchmark' or mistakenly think a compliance framework like NIST SP 800-53 can be directly assigned as a security policy in Defender for Cloud to enable technical controls like guest-level threat detection.

How to eliminate wrong answers

Option A is wrong because the Azure Security Benchmark is the predecessor to the Microsoft cloud security benchmark and has been deprecated; it does not include the specific guest-level threat detection policies required for this scenario. Option C is wrong because Microsoft Defender for Cloud Apps is a CASB (Cloud Access Security Broker) for SaaS applications, not a security policy for enabling guest-level threat detection on Azure VMs. Option D is wrong because NIST SP 800-53 is a compliance framework from the U.S.

National Institute of Standards and Technology, not a security policy initiative in Defender for Cloud that can be assigned to enable guest-level threat detection.

Practice this question →
19
MCQeasy

A company wants to implement a secure web application gateway to protect their public-facing web apps from common exploits like SQL injection and cross-site scripting. Which Azure service should they use?

A.Azure Front Door with WAF
B.Azure Firewall
C.Azure DDoS Protection
D.Azure Application Gateway with WAF
AnswerD

Azure Application Gateway with WAF is a regional Layer 7 load balancer that handles HTTP(S) traffic with features like cookie-based session affinity, URL-path routing, and SSL termination. Its WAF SKU enforces managed rule sets from the OWASP Core Rule Set, including rules that detect and block SQL injection, cross-site scripting, command injection, and other common exploits. This makes it the ideal choice for a single web app that needs application-layer inspection and protection close to the backend.

Why this answer

Azure Application Gateway with WAF is the correct choice because it is a regional, layer-7 load balancer that includes a built-in Web Application Firewall (WAF) specifically designed to protect web applications from common exploits such as SQL injection and cross-site scripting (XSS). The WAF uses OWASP Core Rule Sets (CRS) to inspect HTTP/HTTPS traffic and block malicious payloads at the application layer, making it the ideal service for securing public-facing web apps.

Exam trap

The trap here is that candidates often confuse Azure Front Door with WAF as a direct alternative to Application Gateway with WAF, but Front Door is a global service for multi-region distribution, while Application Gateway is the regional, layer-7 load balancer with WAF that is the correct choice for protecting a single-region web application gateway.

How to eliminate wrong answers

Option A is wrong because Azure Front Door with WAF is a global, multi-region load balancer and CDN service that also includes WAF capabilities, but it is optimized for global distribution and edge caching, not for protecting a single regional web application gateway; the question implies a single gateway deployment, and Application Gateway is the standard regional choice. Option B is wrong because Azure Firewall is a stateful, network-layer firewall that filters traffic based on IP addresses, ports, and protocols (layers 3-4), and it does not inspect application-layer payloads like SQL injection or XSS; it lacks the WAF functionality required for web application exploits. Option C is wrong because Azure DDoS Protection provides mitigation against volumetric distributed denial-of-service attacks at layers 3 and 4, but it does not inspect or block application-layer attacks such as SQL injection or XSS, which require a WAF.

Practice this question →
20
MCQhard

You are designing a secure DevOps pipeline in GitHub that deploys to Azure Kubernetes Service (AKS). The security team requires that no secrets are stored in the pipeline variables and that all container images are scanned for vulnerabilities before deployment. Which approach aligns with security best practices?

A.Use Azure DevOps with a service principal that has a client secret stored in Azure Key Vault. Use Trivy to scan images.
B.Use GitHub Actions with OpenID Connect to authenticate to Azure without storing any secrets. Integrate Microsoft Defender for Containers to scan images in Azure Container Registry.
C.Use GitHub Actions with a managed identity for the GitHub runner. Disable image scanning to speed up deployments.
D.Use GitHub Actions with environment secrets for Azure service principal credentials. Use Docker Hub's vulnerability scanning.
AnswerB

OpenID Connect (OIDC) lets GitHub Actions authenticate to Azure AD using federated credentials, so the workflow receives a short-lived token without storing any client secret, password, or persistent key in the repository. Microsoft Defender for Containers integrates natively with Azure Container Registry to scan images for vulnerabilities on push, continuously assessing compliance and providing runtime protection without adding third-party components.

Why this answer

It uses OpenID Connect (OIDC) to authenticate GitHub Actions to Azure without storing any long-lived secrets, which aligns with the requirement that no secrets be stored in pipeline variables. Additionally, integrating Microsoft Defender for Containers provides vulnerability scanning for container images in Azure Container Registry (ACR), meeting the image scanning requirement before deployment to AKS.

Exam trap

The trap here is that candidates may assume Azure DevOps is the only secure option or that storing secrets in Azure Key Vault is acceptable, but the question explicitly requires 'no secrets stored in the pipeline variables,' and OIDC eliminates secrets entirely, while Key Vault still requires a secret retrieval step that counts as a stored secret in the pipeline context.

How to eliminate wrong answers

Option A is wrong because it uses Azure DevOps instead of GitHub Actions as specified in the question, and it stores a client secret in Azure Key Vault, which still requires a secret to be retrieved and used in the pipeline, violating the 'no secrets stored in pipeline variables' requirement. Option C is wrong because it disables image scanning, which directly contradicts the requirement that all container images be scanned for vulnerabilities before deployment. Option D is wrong because it uses environment secrets for Azure service principal credentials, which stores secrets in the pipeline environment, and Docker Hub's vulnerability scanning does not integrate with ACR or AKS for pre-deployment scanning in the Azure context.

Practice this question →
21
MCQmedium

A company plans to implement a Zero Trust architecture using Microsoft security solutions. They want to ensure that all access to corporate resources is verified explicitly, uses least privilege, and assumes breach. Which Microsoft service should be the central policy engine for enforcing conditional access decisions?

A.Microsoft Entra ID Conditional Access
B.Microsoft Defender for Cloud
C.Microsoft Sentinel
D.Microsoft Intune
AnswerA

Microsoft Entra ID Conditional Access is the core policy engine for Zero Trust, evaluating signals such as user identity, device health, location, and risk in real time. It enforces 'never trust, always verify' by granting, blocking, or requiring step-up authentication based on conditional policies. As the central access decision point, it integrates with all other Zero Trust pillars and is the primary mechanism for securing user access.

Why this answer

Microsoft Entra ID Conditional Access is the correct central policy engine because it directly enforces Zero Trust principles by evaluating signals (user, device, location, risk) in real time to grant or block access. It acts as the policy decision point (PDP) that enforces explicit verification, least privilege, and assumes breach by requiring continuous authentication and authorization for every access request.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud's security policy (which governs cloud resource configurations) with Entra ID's conditional access policy (which governs user access decisions), leading them to select Defender for Cloud as the central policy engine.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and workload protection platform, not a policy engine for conditional access decisions. Option C is wrong because Microsoft Sentinel is a SIEM/SOAR solution for threat detection and response, not a real-time access policy enforcer. Option D is wrong because Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) service that manages devices and apps but does not make conditional access policy decisions.

Practice this question →
22
MCQhard

Your organization uses Microsoft Sentinel for SIEM. You need to ensure that security incidents are automatically responded to without human intervention for known false positives. What should you implement?

A.An analytics rule with alert suppression
B.A playbook that runs on incident creation
C.An entity behavior analytics rule
D.An automation rule with incident closure action
AnswerD

Automation rules can auto-close incidents based on conditions.

Why this answer

Automation rules in Microsoft Sentinel can be configured to automatically close incidents when specific conditions are met, such as when an incident is identified as a known false positive. This eliminates the need for human intervention by triggering an incident closure action based on predefined criteria, directly addressing the requirement for automated response to false positives.

Exam trap

The trap here is that candidates often confuse alert suppression (which prevents duplicate alerts) with incident closure automation, or they assume a playbook is always required for automation, when in fact a simple automation rule with a closure action is the direct and correct solution for automatically handling known false positives.

How to eliminate wrong answers

Option A is wrong because analytics rules with alert suppression only prevent the creation of duplicate alerts for the same event within a specified time window; they do not automatically respond to or close incidents that have already been created. Option B is wrong because a playbook that runs on incident creation can automate responses, but it requires a separate automation rule to trigger it and is typically used for complex orchestration, not simply for closing known false positives without human intervention. Option C is wrong because entity behavior analytics rules are designed to detect anomalous behavior based on historical patterns, not to automatically respond to or close incidents identified as false positives.

Practice this question →
23
MCQmedium

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The security team wants to prioritize remediation of high-severity findings based on the greatest potential business impact. Which security policy or framework should you configure to align remediation with business priorities?

A.Use the Azure Security Benchmark initiative
B.Enable the Regulatory Compliance dashboard
C.Set up workflow automation for high-severity findings
D.Configure the Secure Score dashboard
AnswerB

The Regulatory Compliance dashboard in Microsoft Defender for Cloud maps security findings to specific regulatory standards (e.g., CIS, NIST SP 800-53, PCI DSS, ISO 27001) and tracks compliance status for each control. This directly ties security gaps to business and legal obligations, enabling you to prioritize remediation efforts based on which non-compliant controls carry the highest regulatory and business impact. By focusing on the standards that matter to your organization, you can align operational security work with audit deadlines, contractual obligations, and risk tolerance, making it the correct method for business-impact-centric prioritization.

Why this answer

The Regulatory Compliance dashboard in Microsoft Defender for Cloud allows you to map security controls to specific regulatory standards (e.g., SOC 2, ISO 27001, PCI DSS) and track compliance posture. By selecting a framework that aligns with your organization's business obligations (e.g., a standard required by customers or regulators), you can prioritize remediation of high-severity findings based on the greatest potential business impact, such as fines or loss of certification.

Exam trap

The trap here is that candidates often confuse the Secure Score dashboard (which measures overall security posture) with the Regulatory Compliance dashboard (which aligns remediation to specific business-impacting standards), leading them to select D instead of B.

How to eliminate wrong answers

Option A is wrong because the Azure Security Benchmark initiative is a Microsoft-defined set of best practices for Azure security, but it does not inherently map to business-specific regulatory or compliance priorities; it focuses on technical security posture rather than business impact. Option C is wrong because workflow automation (e.g., sending emails or creating tickets) is a response mechanism for findings, not a framework for prioritizing which findings to remediate based on business impact. Option D is wrong because the Secure Score dashboard provides a numerical score based on security recommendations, but it does not allow you to configure or align remediation with specific business or regulatory frameworks; it is a general health indicator, not a prioritization tool.

Practice this question →
24
MCQeasy

Your organization is adopting a Zero Trust security model. You need to design a solution that ensures continuous verification of user identity and device health before granting access to resources. Which Microsoft Entra ID feature should you prioritize?

A.Microsoft Entra ID Domain Services
B.Microsoft Entra ID Identity Protection
C.Microsoft Entra ID Conditional Access
D.Microsoft Entra ID Privileged Identity Management (PIM)
AnswerC

Microsoft Entra ID Conditional Access is the correct answer because it is the policy engine that evaluates real-time signals—such as user identity, group membership, location, device compliance, and sign-in risk—to allow or restrict access. It enables Zero Trust policies like requiring compliant devices, enforcing multi-factor authentication, and blocking sessions when risk is detected. Conditional Access also integrates with continuous access evaluation (CAE) to revoke access in near real-time when conditions change, directly aligning with the 'never trust, always verify' principle and your requirement for device health verification before access.

Why this answer

Conditional Access is the primary Microsoft Entra ID feature that enforces continuous verification by evaluating user identity, device health (via compliance policies or Microsoft Defender for Endpoint signals), location, and risk in real-time before granting access. It directly supports the Zero Trust principle of 'never trust, always verify' by requiring authentication and authorization at every access attempt, not just at the perimeter.

Exam trap

The trap here is that candidates confuse Identity Protection's risk detection capabilities with the enforcement mechanism, but Identity Protection alone cannot block access based on device health or enforce conditional policies—it only provides signals that must be consumed by Conditional Access to make a decision.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Domain Services provides managed domain services like LDAP, Kerberos, and NTLM for legacy applications, not continuous identity or device health verification. Option B is wrong because Identity Protection focuses on detecting and responding to identity-based risks (e.g., leaked credentials, anomalous sign-ins) but does not enforce access decisions based on device health or real-time verification; it feeds risk signals into Conditional Access. Option D is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role activation and approval workflows, not continuous verification of all user identities or device health for general resource access.

Practice this question →
25
MCQmedium

Your organization wants to implement a zero-trust security model for on-premises and cloud resources. As part of this strategy, you need to ensure that all access requests are authenticated and authorized based on dynamic risk signals. Which Microsoft security solution should you use to enforce conditional access policies based on real-time risk?

A.Microsoft Entra ID Conditional Access
B.Microsoft Intune
C.Microsoft Sentinel
D.Microsoft Defender for Cloud
AnswerA

Microsoft Entra ID Conditional Access is the policy enforcement engine that operationalizes zero trust by evaluating real-time signals such as user identity, device health, location, and risk level at the moment of authentication. It dynamically allows or blocks access, or requires additional controls like MFA or session policies, integrated directly with identity authentication. This makes it the central decision point for enforcing conditional access policies, rather than a supporting or monitoring tool.

Why this answer

Microsoft Entra ID Conditional Access is the correct solution because it enables you to enforce access policies based on real-time risk signals, such as user risk, sign-in risk, and device compliance. It integrates with Identity Protection to evaluate dynamic risk levels and can block or require multi-factor authentication (MFA) accordingly, directly supporting the zero-trust principle of 'never trust, always verify'.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel (a SIEM) with a real-time access control solution, but Sentinel only provides detection and response after the fact, not inline policy enforcement during authentication.

How to eliminate wrong answers

Option B (Microsoft Intune) is wrong because it is a mobile device management (MDM) and mobile application management (MAM) solution that focuses on device compliance and app protection policies, not on real-time risk-based conditional access enforcement. Option C (Microsoft Sentinel) is wrong because it is a security information and event management (SIEM) and security orchestration automated response (SOAR) solution that aggregates logs and detects threats, but it does not natively enforce conditional access policies at the authentication layer. Option D (Microsoft Defender for Cloud) is wrong because it is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides recommendations and threat protection for cloud workloads, not real-time risk-based access control for user sign-ins.

Practice this question →
26
MCQhard

Your organization plans to use Microsoft Purview to protect sensitive data in Microsoft 365. The compliance team needs to detect when users share credit card numbers via email and automatically apply encryption. Which solution should you implement?

A.Microsoft Purview Audit
B.Microsoft Purview eDiscovery
C.Microsoft Purview Information Protection
D.Microsoft Purview Data Loss Prevention (DLP)
AnswerD

Microsoft Purview Data Loss Prevention (DLP) policies continuously monitor emails for sensitive information types such as credit card numbers or social security numbers, and when a match is detected, the policy can automatically trigger protection actions. In Exchange Online, DLP leverages transport rules to apply IRM encryption to outbound messages, ensuring only intended recipients can read them. This capability directly aligns with the requirement to automatically encrypt emails based on content, making DLP the correct choice.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect sensitive data types—such as credit card numbers—in email messages and automatically apply protective actions like encryption. DLP policies can inspect email content in transit via Exchange Online, match patterns against predefined sensitive info types (e.g., credit card number regex), and trigger actions such as 'Encrypt the message' using Azure Rights Management. This directly meets the requirement to detect sharing of credit card numbers and enforce encryption automatically.

Exam trap

Microsoft often tests the distinction between Information Protection (labeling/classification) and Data Loss Prevention (content inspection and automated enforcement), leading candidates to pick Information Protection because they confuse 'protecting data' with 'detecting and acting on sensitive content.'

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Audit only logs user and admin activities for forensic review; it cannot inspect email content for sensitive data or apply encryption. Option B is wrong because Microsoft Purview eDiscovery is used for searching and exporting content in legal or compliance investigations, not for real-time detection and automated protection of sensitive data in transit. Option C is wrong because Microsoft Purview Information Protection focuses on classifying and labeling documents and emails (e.g., sensitivity labels), but it does not natively scan for specific sensitive data patterns like credit card numbers or enforce automatic encryption based on content detection—that requires DLP policies to trigger the label or encryption action.

Practice this question →
27
MCQeasy

Your organization is implementing a Zero Trust security model. Which Microsoft security solution should you use to enforce conditional access policies based on user, device, location, and real-time risk signals?

A.Microsoft Entra ID Conditional Access
B.Microsoft Defender for Cloud Apps
C.Microsoft Intune
D.Microsoft Purview
AnswerA

Microsoft Entra ID Conditional Access is the direct policy engine for access control in a Zero Trust architecture. It continuously evaluates signals such as user identity, group membership, location, device compliance, and real-time risk (from Entra ID Protection) to enforce granular decisions like allow, deny, or require MFA. Because it applies these conditions to every sign-in and session in real time, it is the core mechanism for implementing 'explicit verification' in Zero Trust.

Why this answer

Microsoft Entra ID Conditional Access is the correct solution because it is the native policy engine in Azure AD that evaluates signals from user identity, device compliance, location (IP ranges or countries), and real-time risk from Microsoft Entra ID Protection to enforce access decisions. It directly implements the 'explicit verification' and 'assume breach' principles of Zero Trust by blocking or requiring step-up authentication based on these dynamic conditions.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud Apps as the primary policy enforcement point because of its session monitoring capabilities, but it is actually a downstream consumer of Conditional Access decisions, not the engine that evaluates user, device, location, and risk signals in real time.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides shadow IT discovery, session controls, and data protection, but it does not natively enforce conditional access policies based on user, device, location, and risk signals—it integrates with Conditional Access for those decisions. Option C is wrong because Microsoft Intune is a Mobile Device Management (MDM) and Mobile Application Management (MAM) solution that manages device compliance and app protection policies, but it does not evaluate real-time risk signals or enforce access policies at the authentication layer. Option D is wrong because Microsoft Purview is a data governance, compliance, and information protection solution focused on data classification, labeling, and eDiscovery, not on enforcing authentication-time conditional access based on user, device, location, or risk.

Practice this question →
28
MCQmedium

Your company uses Microsoft Defender XDR to protect endpoints. The security team wants to implement automated response actions when a malicious file is detected on a device. Which Microsoft security feature should you configure to automatically isolate the affected device from the network?

A.Automated investigation and response (AIR) capabilities
B.Microsoft Sentinel automation rules
C.Attack surface reduction rules
D.Microsoft Intune compliance policies
AnswerA

Automated investigation and response (AIR) is a built-in Microsoft Defender XDR engine that orchestrates detection, investigation, and remediation across endpoints. When malicious activity such as a suspected ransomware or credential theft is identified, AIR can automatically perform device isolation — a native action that severs the endpoint's network connections while preserving communication with Defender for Endpoint services. This isolation can be executed without human intervention or with approval depending on the automation level configured, making it the appropriate capability for this requirement.

Why this answer

Automated investigation and response (AIR) in Microsoft Defender XDR is the correct feature because it includes built-in playbooks that can automatically isolate a device from the network when a malicious file is detected. AIR leverages the Microsoft 365 Defender portal's automation capabilities to run investigation steps and execute response actions, such as device isolation, without manual intervention. This directly meets the requirement for automated response upon file detection.

Exam trap

The trap here is that candidates often confuse the proactive prevention capabilities of Attack surface reduction rules with the automated response capabilities of AIR, or they overestimate the real-time response abilities of Intune compliance policies, which are designed for configuration enforcement rather than incident response actions like network isolation.

How to eliminate wrong answers

Option B is wrong because Microsoft Sentinel automation rules are designed for cloud-scale SIEM and SOAR across multiple data sources, not for endpoint-specific automated isolation triggered by Defender XDR detections; they require custom analytics and playbooks to achieve similar behavior, making them less direct for this use case. Option C is wrong because Attack surface reduction rules are proactive policies that block or audit specific behaviors (e.g., Office apps creating child processes) to prevent infection, but they do not perform automated response actions like device isolation after a file is already detected as malicious. Option D is wrong because Microsoft Intune compliance policies enforce device configuration and health requirements (e.g., requiring encryption or a minimum OS version) and can trigger conditional access blocks, but they cannot automatically isolate a device from the network in real time based on a malicious file detection; that action is outside Intune's scope.

Practice this question →
29
MCQhard

A company needs to design a secure DevOps pipeline using GitHub Actions and Microsoft Defender for Cloud. They want to scan infrastructure-as-code (IaC) templates for misconfigurations before deployment. What should they integrate?

A.Microsoft Defender for Cloud Infrastructure as Code scanning
B.Microsoft Purview Compliance Manager
C.Microsoft Sentinel
D.Microsoft Defender for Cloud Apps
AnswerA

Microsoft Defender for Cloud Infrastructure as Code scanning is the correct choice because it directly integrates with DevOps platforms like GitHub and Azure DevOps to continuously scan Infrastructure as Code templates (e.g., ARM, Bicep, Terraform) in pull requests and pipelines. It leverages Defender for Cloud's security recommendations and policy library to identify misconfigurations before deployment, preventing insecure cloud resources from ever being provisioned. This is a native cloud security posture management capability purpose-built for IaC validation.

Why this answer

Microsoft Defender for Cloud includes a native Infrastructure as Code (IaC) scanning capability that integrates directly with GitHub Actions. This feature automatically analyzes IaC templates (such as ARM, Bicep, Terraform, and CloudFormation) for security misconfigurations during the CI/CD pipeline, providing pre-deployment guardrails. By failing the pipeline on critical findings, it ensures only compliant infrastructure is deployed, aligning with the secure DevOps principle of shifting security left.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud's IaC scanning with Microsoft Sentinel's threat detection capabilities, mistakenly thinking Sentinel can scan code before deployment, when in fact Sentinel only analyzes logs and alerts from already-deployed resources.

How to eliminate wrong answers

Option B (Microsoft Purview Compliance Manager) is wrong because it focuses on regulatory compliance posture management and risk assessments, not on scanning IaC templates for misconfigurations in a DevOps pipeline. Option C (Microsoft Sentinel) is wrong because it is a SIEM and SOAR solution for threat detection and incident response after deployment, not a pre-deployment IaC scanning tool. Option D (Microsoft Defender for Cloud Apps) is wrong because it is a CASB (Cloud Access Security Broker) for controlling user access and data protection in SaaS applications, not for scanning infrastructure code.

Practice this question →
30
MCQmedium

Wide World Importers uses Azure Active Directory (now Microsoft Entra ID) and Microsoft 365. They have a hybrid identity with password hash sync. They want to implement a passwordless authentication strategy to improve security and user experience. They have a mix of Windows 10/11 devices and mobile devices (iOS/Android). They also have some shared computers in kiosk mode. The solution must support all user scenarios and align with Microsoft's authentication best practices. What should you recommend?

A.Use SMS-based authentication for all users. Deploy OATH tokens for shared computers. Implement Azure AD Conditional Access to require passwordless for admins only.
B.Implement Windows Hello for Business for all Windows devices. Use smart cards for mobile devices. Use FIDO2 keys for shared computers.
C.Implement Windows Hello for Business for Windows 10/11 devices. Deploy Microsoft Authenticator for mobile devices for passwordless sign-in. Use FIDO2 security keys for shared computers and kiosk scenarios. Enable combined registration for self-service password reset and Microsoft Authenticator.
D.Use the Microsoft Authenticator app for all users. Configure passwordless sign-in with the app. Use QR codes for kiosk computers.
AnswerC

Comprehensive passwordless approach covering all device types.

Why this answer

It aligns with Microsoft's passwordless authentication best practices by using Windows Hello for Business for Windows 10/11 devices (which supports biometric and PIN-based sign-in), Microsoft Authenticator for mobile devices (enabling phone-sign-in passwordless authentication), and FIDO2 security keys for shared computers and kiosk scenarios (which provide hardware-backed, phishing-resistant credentials). Combined registration streamlines the user enrollment process for both SSPR and Microsoft Authenticator, ensuring a seamless deployment across all device types.

Exam trap

The trap here is that candidates may assume SMS-based authentication or smart cards are acceptable passwordless methods, but Microsoft's best practices explicitly exclude SMS due to security weaknesses and smart cards due to lack of mobile device support, while FIDO2 keys are the only recommended solution for shared/kiosk computers.

How to eliminate wrong answers

Option A is wrong because SMS-based authentication is not truly passwordless (it relies on a phone number and one-time code, which is susceptible to SIM-swap attacks and does not meet Microsoft's passwordless best practices), and OATH tokens for shared computers are not a recommended passwordless solution for kiosk scenarios (FIDO2 keys are preferred for phishing resistance). Option B is wrong because smart cards are not a practical or supported passwordless solution for mobile devices (iOS/Android do not natively support smart card authentication without additional hardware and middleware), and Windows Hello for Business is not available on all Windows devices (it requires Windows 10/11 Pro or Enterprise with TPM 2.0, and shared computers in kiosk mode may not support it). Option D is wrong because using Microsoft Authenticator for all users ignores Windows Hello for Business for Windows devices (which provides a better integrated experience), and QR codes for kiosk computers are not a supported passwordless authentication method for shared devices (FIDO2 keys are required for kiosk scenarios).

Practice this question →
31
MCQmedium

A security architect needs to design a solution that provides a unified view of security alerts from multiple clouds (Azure, AWS, GCP) and on-premises systems. The solution must also support automated response using playbooks. Which Microsoft service should they use?

A.Microsoft Defender XDR
B.Microsoft Defender for Cloud
C.Microsoft Purview
D.Microsoft Sentinel
AnswerD

Microsoft Sentinel is a cloud-native SIEM and SOAR that natively ingests data from Azure and, via built-in connectors, from AWS, Google Cloud, other SaaS platforms, and on-premises sources such as syslog and CEF, allowing centralized multi-cloud log collection. Its analytical rules use Kusto Query Language to detect suspicious activity and trigger automated response playbooks built on Azure Logic Apps, providing real-time containment like device isolation or account disablement. Sentinel's architecture includes Common Event Format (CEF) and Syslog agents for on-premises, plus API connectors for AWS CloudTrail and GCP, making it the only option that fulfills the full multi-cloud SIEM/SOAR requirement with integrated UEBA and threat intelligence.

Why this answer

Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution that ingests security alerts from multiple clouds (Azure, AWS, GCP) and on-premises systems via connectors. It supports automated response through playbooks built on Azure Logic Apps, enabling unified alert management and remediation workflows.

Exam trap

The trap here is confusing Microsoft Defender for Cloud (a CSPM tool) with Microsoft Sentinel (a SIEM/SOAR), as both appear in the Azure portal and deal with security alerts, but only Sentinel provides native multi-cloud SIEM ingestion and automated playbook orchestration for cross-cloud incident response.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender XDR is an extended detection and response solution focused on correlating signals across Microsoft 365, endpoints, and identities, but it does not natively ingest alerts from AWS, GCP, or on-premises systems for a unified multi-cloud SIEM view. Option B is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and workload protection platform that provides security recommendations and alerts primarily for Azure and hybrid environments, but it lacks the native multi-cloud SIEM ingestion and SOAR playbook automation of Sentinel. Option C is wrong because Microsoft Purview is a data governance, risk, and compliance solution (e.g., data classification, eDiscovery, insider risk management) and does not provide SIEM alert correlation or automated response playbooks for security incidents.

Practice this question →
32
MCQhard

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. What is the purpose of this query?

A.Correlate malware alerts with device OS version
B.List all malware alerts in the last 7 days
C.Identify malware alerts on unmanaged devices
D.Show device inventory for unmanaged devices
AnswerC

Exactly: filters on IsManaged == false.

Why this answer

The query uses the `DeviceInfo` table to filter for devices where `IsManaged` is `false`, then joins with `SecurityAlert` to find alerts where `AlertName` contains 'Malware'. This specifically identifies malware alerts generated on unmanaged devices, not all malware alerts or a general device inventory.

Exam trap

The trap here is that candidates may confuse the purpose of the query as simply listing all malware alerts (Option B) or showing device inventory (Option D), overlooking the critical `IsManaged == false` filter that narrows the scope to unmanaged devices.

How to eliminate wrong answers

Option A is wrong because the query does not correlate malware alerts with device OS version; it only filters on `IsManaged` and `AlertName`, with no reference to OS version fields. Option B is wrong because the query does not list all malware alerts in the last 7 days; it restricts results to alerts on unmanaged devices (IsManaged == false) and does not include a time filter for the last 7 days. Option D is wrong because the query returns alerts, not a device inventory; the output includes alert details (e.g., AlertName, TimeGenerated) rather than a list of devices.

Practice this question →
33
MCQhard

Refer to the exhibit. You are an Azure security engineer reviewing a custom Azure Policy definition. The policy is intended to audit virtual machines to ensure they have the Azure Security extension installed. However, the policy is not triggering on any resources. What is the most likely reason?

A.The policy condition requires a managed disk, but the VMs might have unmanaged disks.
B.The 'existenceCondition' field path is incorrect; it should be 'Microsoft.Compute/virtualMachines/extensions/publisher'.
C.The policy is assigned to a management group, but the VMs are in a subscription under a different management group.
D.The policy effect should be 'Deny' instead of 'auditIfNotExists'.
AnswerA

The policy definition's 'if' clause matches only VMs that have a managed disk (e.g., by checking that the 'managedDisk' property is present). VMs that still use unmanaged disks do not satisfy this condition, so the 'auditIfNotExists' effect is never evaluated for them. Consequently, the policy silently ignores the very machines that likely need the missing-extension audit, making the compliance report incomplete rather than identifying all noncompliant VMs.

Why this answer

The policy condition uses `field` to check for `Microsoft.Compute/virtualMachines/storageProfile.osDisk.managedDisk.id`, which requires the VM to have a managed disk. If the VMs use unmanaged disks (i.e., the `managedDisk` property is absent), the condition evaluates to false, and the `auditIfNotExists` effect never triggers the existence check for the Azure Security extension.

Exam trap

The trap here is that candidates focus on the `existenceCondition` or effect syntax, overlooking that the parent `field` condition silently fails on VMs without managed disks, preventing the entire policy from evaluating.

How to eliminate wrong answers

Option B is wrong because the `existenceCondition` field path `Microsoft.Compute/virtualMachines/extensions/publisher` is syntactically valid for checking the extension's publisher property; the issue is not with the path but with the parent condition failing. Option C is wrong because policy assignment inheritance works correctly across management group hierarchies—if the policy is assigned to a management group, it applies to all descendant subscriptions, so VMs in a child subscription would still be evaluated. Option D is wrong because changing the effect to `Deny` would not fix the triggering issue; the policy is not evaluating resources at all due to the condition, not because of the effect type.

Practice this question →
34
MCQhard

You are a security architect for a large financial services company. The company has a hybrid identity environment with on-premises Active Directory synchronized to Microsoft Entra ID using Microsoft Entra Connect. They use Microsoft 365 E5 licenses and have deployed Microsoft Defender for Cloud, Microsoft Defender for Identity, Microsoft Sentinel, and Microsoft Purview. The company has recently suffered a ransomware attack where an attacker gained access via a compromised service account that had permanent Global Administrator privileges. The attacker then used the account to create a backdoor user and exfiltrate sensitive data from SharePoint Online. After the incident, the CISO mandates a Zero Trust security transformation with the following requirements: 1. Eliminate standing privileged access for all cloud admins. 2. Require phishing-resistant authentication for all privileged roles. 3. Ensure that all sensitive data in SharePoint Online is automatically classified and protected. 4. Enable detection of lateral movement using anomalous behavior analytics. Which combination of actions should you recommend?

A.Implement Privileged Identity Management (PIM) for Global Administrator roles, configure Authentication Strengths to require FIDO2, create auto-labeling policies for credit card numbers, and enable Defender for Identity lateral movement path detection.
B.Deploy Microsoft Entra Identity Protection for all users, configure Azure AD Conditional Access with MFA, use Microsoft Purview Information Protection with manual labeling, and enable Microsoft Sentinel analytics for lateral movement.
C.Configure Conditional Access to require MFA for admins, enable Microsoft Purview DLP for SharePoint, deploy Defender for Cloud Apps, and use Identity Protection for user risk.
D.Remove all permanent admin roles and use just-in-time access via PIM, enforce MFA via Conditional Access, apply sensitivity labels via Microsoft Purview Data Map, and use Microsoft Defender for Cloud for network security groups.
AnswerA

Privileged Identity Management removes standing Global Administrator access and activates roles just-in-time with approval, time limits, and audit trail, meeting the privileged access requirement. Configuring Authentication Strengths to require FIDO2 enforces phishing-resistant MFA specifically for activation and sign-in, satisfying the hardened MFA mandate. Auto-labeling policies for credit card numbers apply sensitivity labels automatically based on sensitive info types, ensuring data protection without manual effort. Defender for Identity lateral movement path detection analyzes entity activities to expose vulnerable paths attackers could exploit, fulfilling the lateral movement detection requirement.

Why this answer

It directly addresses all four CISO requirements: Privileged Identity Management (PIM) eliminates standing Global Administrator privileges by requiring just-in-time activation; Authentication Strengths with FIDO2 enforces phishing-resistant authentication for privileged roles; auto-labeling policies in Microsoft Purview automatically classify and protect sensitive data like credit card numbers in SharePoint Online; and Defender for Identity lateral movement path detection uses behavioral analytics to detect anomalous lateral movement, fulfilling the detection requirement.

Exam trap

The trap here is that candidates often confuse MFA (which can be phishable) with phishing-resistant authentication (e.g., FIDO2 or certificate-based), and they may overlook that automatic classification requires auto-labeling policies, not manual labeling or data discovery tools like Data Map.

How to eliminate wrong answers

Option B is wrong because it relies on manual labeling instead of automatic classification, which fails to meet the requirement for automatic protection of sensitive data in SharePoint Online; additionally, Identity Protection does not provide lateral movement detection. Option C is wrong because it only enforces MFA via Conditional Access, which is not phishing-resistant (e.g., it allows TOTP or phone call verification), and it lacks automatic data classification and lateral movement detection. Option D is wrong because it enforces MFA via Conditional Access instead of phishing-resistant authentication (e.g., FIDO2), and it uses Microsoft Defender for Cloud for network security groups, which does not address lateral movement detection; Purview Data Map is for data discovery, not automatic classification and protection.

Practice this question →
35
MCQmedium

A company uses Microsoft Entra ID for identity management. They want to ensure that only managed devices can access corporate email. Which Conditional Access policy setting should be configured?

A.Require multifactor authentication
B.Block legacy authentication
C.Require approved client app
D.Require device to be marked as compliant
AnswerD

This ensures only managed and compliant devices can access.

Why this answer

To ensure only managed devices can access corporate email, you need to enforce device compliance. The Conditional Access policy setting 'Require device to be marked as compliant' checks that the device is enrolled in Microsoft Intune and meets all compliance policies (e.g., encryption, OS version, jailbreak detection) before granting access. This directly restricts access to managed devices only.

Exam trap

The trap here is that candidates often confuse 'Require device to be marked as compliant' with 'Require approved client app' or 'Require multifactor authentication,' thinking that MFA or app approval alone ensures device management, but only compliance enforcement ties directly to Intune-managed device policies.

How to eliminate wrong answers

Option A is wrong because requiring multifactor authentication (MFA) verifies the user's identity but does not enforce any device management or compliance; a personal device with MFA could still access email. Option B is wrong because blocking legacy authentication prevents protocols like POP3, IMAP, or SMTP that don't support modern authentication, but it does not ensure the device is managed or compliant; a managed device using legacy auth would still be blocked, but an unmanaged device using modern auth would not be blocked. Option C is wrong because requiring an approved client app (e.g., Outlook mobile) ensures the app is from a trusted source but does not enforce device management; an unmanaged device with the approved app could still access email.

Practice this question →
36
MCQmedium

A company is migrating its on-premises Active Directory to Microsoft Entra ID. They need to ensure that all user authentication for cloud apps uses passwordless methods. Which security best practice should they implement?

A.Implement Microsoft Entra ID passwordless authentication
B.Configure conditional access policies to block legacy authentication
C.Enable Microsoft Entra ID Privileged Identity Management (PIM)
D.Require multifactor authentication (MFA) for all users
AnswerA

Implementing Microsoft Entra ID passwordless authentication replaces the password with a cryptographic key pair bound to the user's device or a FIDO2 security key. Methods such as Windows Hello for Business, FIDO2 security keys, or the Microsoft Authenticator app's passwordless mode allow authentication through a biometric gesture or PIN, with the private key never leaving the device. This directly eliminates the shared-secret model that attackers can phish or replay, and it aligns with Zero Trust by verifying possession and intent without ever transmitting a password over the network.

Why this answer

The company's requirement is specifically to ensure all user authentication for cloud apps uses passwordless methods. Microsoft Entra ID passwordless authentication (e.g., Windows Hello for Business, FIDO2 security keys, or Microsoft Authenticator) directly eliminates passwords from the authentication flow, aligning with the stated goal. Other options, while enhancing security, do not enforce passwordless authentication.

Exam trap

The trap here is that candidates often confuse 'blocking legacy authentication' or 'requiring MFA' with achieving passwordless authentication, but neither eliminates the password as a factor; only a dedicated passwordless method does.

How to eliminate wrong answers

Option B is wrong because blocking legacy authentication (e.g., POP3, IMAP, SMTP) prevents older protocols that cannot enforce modern authentication, but it does not mandate passwordless methods; users could still authenticate with passwords via modern protocols. Option C is wrong because Microsoft Entra ID Privileged Identity Management (PIM) provides just-in-time privileged access management and does not address user authentication methods for cloud apps. Option D is wrong because requiring multifactor authentication (MFA) adds a second factor but still allows password-based authentication as the first factor, failing to meet the passwordless requirement.

Practice this question →
37
MCQmedium

Refer to the exhibit. You are reviewing a Conditional Access policy JSON. What is the effect of this policy?

A.Blocks sign-ins from locations with high sign-in risk
B.Blocks sign-ins from users with high user risk
C.Blocks all sign-ins from any user
D.Requires multifactor authentication for high-risk users
AnswerB

This is the correct interpretation: the policy sets the 'User risk' condition to 'High' and the access control to 'Block.' When a user's risk level, as determined by Microsoft Entra ID Protection detections, is high, the conditional access engine denies the sign-in attempt. Thus, the policy's effective behavior is to block sign-ins from users with high user risk.

Why this answer

The policy JSON specifies `"userRiskLevels": ["high"]` under the conditions block, which means it targets only users whose user risk level is assessed as high by Microsoft Entra ID Protection. The grant control is set to `"builtInControls": ["block"]`, so the policy blocks sign-ins for those high-risk users. Option B is correct because the policy explicitly blocks sign-ins from users with high user risk, not sign-in risk or all users.

Exam trap

Microsoft often tests the distinction between `userRiskLevels` and `signInRiskLevels` in Conditional Access policies, and candidates frequently confuse the two, thinking a high user risk policy blocks sign-in risk events rather than user account risk.

How to eliminate wrong answers

Option A is wrong because the policy uses `userRiskLevels`, not `signInRiskLevels`; sign-in risk levels are a separate property in Conditional Access policies that assess the risk of a specific authentication attempt, not the user account. Option C is wrong because the policy has a condition targeting only high user risk levels, not all users; a block-all policy would omit the risk level condition or use an empty conditions block. Option D is wrong because the grant control is `"block"`, not `"mfa"`; requiring multifactor authentication would use `"mfa"` in the builtInControls array, and the policy does not include any authentication requirement.

Practice this question →
38
MCQmedium

Your organization is implementing Microsoft Entra ID Conditional Access. You need to require multi-factor authentication (MFA) for all users accessing financial applications, but only when the sign-in risk is medium or higher. What is the most efficient way to achieve this?

A.Create a Microsoft Entra ID Protection user risk policy to require MFA
B.Enable MFA per user for all users in the financial team
C.Create a Conditional Access policy that targets all users, includes a named location, and requires MFA
D.Create a Conditional Access policy that targets the financial applications, uses sign-in risk as a condition, and requires MFA
AnswerD

A Conditional Access policy can be precisely scoped to the financial applications as the assigned target resources, while using sign-in risk as a condition to trigger MFA. Sign-in risk is calculated in real time by Microsoft Entra ID Protection, and Conditional Access allows it to be set to a threshold such as Low, Medium, or High. When a sign-in to a financial app has a risk level that meets the threshold, MFA is required, directly fulfilling the requirement for risk-based MFA protection on the financial applications without affecting unrelated apps or users.

Why this answer

It uses a single Conditional Access policy to target the specific financial applications and sets the sign-in risk condition to medium or higher, which triggers MFA only when the risk threshold is met. This approach is efficient as it avoids per-user MFA configuration and leverages Microsoft Entra ID Protection's risk detection to dynamically enforce MFA based on real-time sign-in risk, aligning with the principle of adaptive access control.

Exam trap

The trap here is that candidates often confuse user risk policies with sign-in risk conditions, or they default to per-user MFA or location-based policies, missing the precise combination of application scoping and risk-based conditions that the question requires.

How to eliminate wrong answers

Option A is wrong because a user risk policy in Microsoft Entra ID Protection targets user-level risk (e.g., compromised credentials) rather than sign-in risk, and it cannot be scoped to specific applications like financial apps; it would apply MFA based on user risk, not sign-in risk. Option B is wrong because enabling MFA per user forces MFA on every authentication for those users, regardless of sign-in risk level, which violates the requirement to only require MFA when risk is medium or higher and is less efficient than a risk-based policy. Option C is wrong because it includes a named location condition, which is irrelevant to sign-in risk, and targets all users without application scoping, meaning it would apply MFA to all applications for all users, not just financial apps when risk is elevated.

Practice this question →
39
MCQmedium

Your organization is planning to deploy Microsoft Purview Information Protection to classify and protect sensitive data. You need to design a solution that automatically applies sensitivity labels to documents containing personally identifiable information (PII) when they are uploaded to SharePoint Online. Which configuration should you use?

A.Set a default sensitivity label for the SharePoint site
B.Use trainable classifiers to identify PII and apply labels
C.Create an auto-labeling policy that uses a sensitive info type for PII
D.Configure a manual labeling policy that prompts users to classify documents
AnswerC

Creating an auto-labeling policy in the Microsoft Purview compliance portal lets you define a rule that scans SharePoint sites, OneDrive accounts, and Exchange for content containing sensitive info types (SITs) for PII, such as U.S. SSN, EU debit card number, or U.S. individual taxpayer identification number. When a match is found, the policy automatically applies the configured sensitivity label and can optionally enforce encryption or a visual marking. This is a rule-based, deterministic detection that works immediately on existing and new content, without user intervention, and is the intended mechanism for automatically classifying PII.

Why this answer

Microsoft Purview auto-labeling policies can automatically apply sensitivity labels to documents containing PII when they are uploaded to SharePoint Online. By configuring a policy with a sensitive info type (e.g., U.S. Social Security Number) as the condition, the service scans content at rest and applies the label without user intervention, meeting the requirement for automatic classification.

Exam trap

The trap here is confusing trainable classifiers with sensitive info types; candidates often pick trainable classifiers because they sound like a smart AI solution, but they are designed for broader content categories, not specific PII patterns like SSNs or credit card numbers.

How to eliminate wrong answers

Option A is wrong because setting a default sensitivity label for a SharePoint site applies a label to all new documents in that site, but it does not automatically detect and label only those containing PII; it labels everything regardless of content. Option B is wrong because trainable classifiers are used for pattern-based content categorization (e.g., contracts or resumes) and are not designed to identify specific PII data types like credit card numbers or SSNs; sensitive info types are the correct mechanism for PII detection. Option D is wrong because a manual labeling policy requires users to classify documents themselves, which does not meet the requirement for automatic labeling upon upload.

Practice this question →
40
MCQeasy

Your organization is migrating to Microsoft 365 and wants to implement a defense-in-depth strategy for email security. Which combination of Microsoft services should you use?

A.Microsoft Defender for Office 365 and Exchange Online Protection
B.Microsoft Purview Compliance Manager and Microsoft Defender for Cloud Apps
C.Microsoft Intune and Microsoft Entra ID
D.Microsoft Sentinel and Microsoft Defender for Identity
AnswerA

Exchange Online Protection (EOP) provides the always-on baseline filtering for all Exchange Online mailboxes, including spam, bulk mail, malware, and spoof intelligence before a message reaches the user. Microsoft Defender for Office 365 (MDO) layers on top with Safe Attachments, Safe Links, and advanced anti-phishing policy that checks URLs and attachments in real time, plus impersonation and domain-based protection. Together they form the native email security stack, with EOP as the foundation and MDO handling zero-day or social-engineering threats that basic filters miss.

Why this answer

Defense-in-depth for email security requires layered protection at the transport, filtering, and post-delivery stages. Exchange Online Protection (EOP) provides baseline anti-malware, anti-spam, and transport rules, while Microsoft Defender for Office 365 adds advanced threat protection like Safe Attachments, Safe Links, and anti-phishing policies that inspect URLs and attachments in real time. Together, they cover the full email threat chain from ingress to user interaction.

Exam trap

The trap here is that candidates confuse compliance or identity services with email security layers, forgetting that defense-in-depth for email specifically requires both transport-level (EOP) and post-delivery (Defender for Office 365) protections.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview Compliance Manager focuses on compliance posture and risk assessments, not on email security filtering or threat detection. Option C is wrong because Microsoft Intune manages device compliance and application policies, and Microsoft Entra ID handles identity and access management; neither provides email transport or content inspection. Option D is wrong because Microsoft Sentinel is a SIEM for centralized security analytics and Microsoft Defender for Identity detects on-premises Active Directory attacks; they do not directly protect email transport or attachments.

Practice this question →
41
MCQeasy

Your organization wants to implement a security baseline for Azure resources using built-in policies. Which Azure service should you use to assign policies that enforce compliance with security best practices?

A.Azure Blueprints
B.Microsoft Defender for Cloud
C.Azure Policy
D.Azure Role-Based Access Control (RBAC)
AnswerC

Azure Policy is the correct service for implementing a security baseline because it creates, assigns, and manages rules that audit, deny, or remediate resource properties. It includes built-in policy definitions for the Azure Security Benchmark and other regulatory standards, enabling consistent enforcement across all resources. Policies can be applied to resource groups, subscriptions, and management groups, ensuring that new and existing resources continuously meet security requirements like encryption, network restrictions, and version compliance.

Why this answer

Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules and effects on your Azure resources. These policies can be used to implement a security baseline by ensuring resources comply with built-in security best practices, such as requiring encryption or restricting resource types. Azure Policy evaluates resources against assigned policies and can automatically remediate non-compliant resources.

Exam trap

The trap here is that candidates often confuse Azure Policy with Microsoft Defender for Cloud, thinking Defender for Cloud is the tool for enforcing security baselines, but Defender for Cloud only recommends policies and monitors compliance, while Azure Policy is the actual service that enforces them.

How to eliminate wrong answers

Option A is wrong because Azure Blueprints is used to orchestrate the deployment of resource templates, policies, and role assignments as a repeatable set of artifacts, but it is not the service for directly assigning and enforcing individual policies; it can include Azure Policy definitions as part of a blueprint, but the core policy enforcement mechanism is Azure Policy itself. Option B is wrong because Microsoft Defender for Cloud provides security posture management, threat detection, and recommendations based on security benchmarks, but it does not directly assign or enforce policies; it can integrate with Azure Policy to apply regulatory compliance initiatives, but the assignment and enforcement of policies is done through Azure Policy. Option D is wrong because Azure Role-Based Access Control (RBAC) manages who has access to Azure resources and what actions they can perform, but it does not enforce compliance rules or security baselines on resource configurations; RBAC is about authorization, not about ensuring resources meet specific security standards.

Practice this question →
42
MCQeasy

Adventure Works is a startup that uses Microsoft 365 Business Premium. They have 20 employees and no cloud expertise. The CEO has been hearing about ransomware attacks on small businesses. They want to implement basic protection against ransomware using built-in Microsoft 365 features. They also want to ensure they can recover from an attack quickly. What should you recommend?

A.Purchase Azure Backup for all user devices. Configure backup policies to run daily. Use Microsoft Intune to enforce encryption. Implement Conditional Access to require MFA.
B.Enable Microsoft Defender for Office 365 to block malicious attachments and links. Configure Microsoft Defender for Business to enable controlled folder access and ransomware protection. Educate users on phishing. Use OneDrive Files Restore to recover from ransomware.
C.Use Microsoft Sentinel as a SIEM to detect ransomware patterns. Deploy Azure ATP for identity protection. Use Azure Policy to enforce backup.
D.Implement Azure Site Recovery for on-premises servers. Use Microsoft Defender for Cloud for threat detection. Deploy a third-party antivirus.
AnswerB

This option is correct because it leverages the built-in, integrated protections of Microsoft 365 Business Premium. Microsoft Defender for Office 365 filters malicious attachments and link-time detonation in Exchange Online, while Defender for Business provides endpoint detection and response plus controlled folder access that blocks unauthorized processes from modifying user files. Phishing education reduces initial compromise, and OneDrive Files Restore enables users to roll back an entire library to a known-good state within 30 days without heavy IT administration.

Why this answer

It leverages built-in Microsoft 365 Business Premium features to provide immediate ransomware protection without requiring cloud expertise. Microsoft Defender for Office 365 blocks malicious attachments and links at the email gateway, while Defender for Business provides endpoint protection with controlled folder access. OneDrive Files Restore enables self-service recovery of files from ransomware within the last 30 days, aligning with the startup's need for quick recovery without additional infrastructure.

Exam trap

The trap here is that candidates often over-engineer the solution by recommending enterprise-grade tools like Azure Backup or Sentinel, failing to recognize that Microsoft 365 Business Premium includes sufficient built-in capabilities for a small startup with no cloud expertise.

How to eliminate wrong answers

Option A is wrong because Azure Backup is not included in Microsoft 365 Business Premium and requires additional licensing and cloud expertise to configure; it also does not address ransomware prevention at the email or endpoint level. Option C is wrong because Microsoft Sentinel and Azure ATP are advanced security tools requiring significant cloud expertise and additional licensing, far beyond the scope of a 20-employee startup with no cloud expertise. Option D is wrong because Azure Site Recovery is designed for on-premises server disaster recovery, not for user devices or Microsoft 365 data, and deploying a third-party antivirus contradicts the requirement to use built-in Microsoft 365 features.

Practice this question →
43
MCQhard

Contoso is a large enterprise with a complex Azure environment. They have multiple management groups, subscriptions, and a hub-spoke network topology. The security team wants to implement a consistent security baseline across all subscriptions using Azure Policy. They need to ensure that: 1) All resources must be deployed in approved regions only. 2) Network security groups must have specific rules to block high-risk ports. 3) All storage accounts must enforce HTTPS traffic. 4) The policies must be applied at the management group level to ensure inheritance. 5) Non-compliant resources must be automatically remediated where possible. What should you do?

A.Use Azure Policy Guest Configuration to enforce region and NSG rules. Assign policies at each subscription. Use Azure Automation runbooks for remediation.
B.Create custom Azure Policy definitions for the required configurations (allowed locations, NSG rule blocking ports, storage HTTPS). Assign the policies at the root management group. Enable 'deployIfNotExists' effect for automatic remediation of non-compliant resources. Use Azure Policy remediation tasks to fix existing non-compliant resources.
C.Use Azure Blueprints to define the environment. Include Azure Policy assignments in the blueprint. Assign blueprint to each management group. Remediate manually.
D.Create a custom script using Azure PowerShell to check compliance daily. Use Azure Logic Apps to send alerts for non-compliance. Have IT staff manually fix issues.
AnswerB

This is the correct approach because Azure Policy is the native, continuous compliance service for resource-level configurations. By creating custom policy definitions for allowed locations, NSG rules, and storage HTTPS and assigning them at the root management group, the policies inherit to all child subscriptions and resource groups, providing a single, central governance baseline. Enabling the DeployIfNotExists effect makes Azure Policy automatically deploy the required configuration (e.g., a compliant NSG or secure storage setting) whenever a non-compliant resource is created or updated, and remediation tasks then correct pre-existing non-compliant resources, closing the compliance gap without manual intervention.

Why this answer

It uses Azure Policy at the root management group to enforce inheritance across all subscriptions, with custom policy definitions for allowed locations, NSG rules blocking high-risk ports, and storage HTTPS. The 'deployIfNotExists' effect enables automatic remediation of non-compliant resources, and remediation tasks fix existing non-compliant resources, meeting all requirements without manual intervention.

Exam trap

The trap here is confusing Azure Policy's 'deployIfNotExists' effect with manual remediation or third-party automation, leading candidates to choose options that lack native, automatic, and inherited policy enforcement at the management group level.

How to eliminate wrong answers

Option A is wrong because Azure Policy Guest Configuration is designed for in-guest machine settings (e.g., OS configuration), not for enforcing region, NSG rules, or storage HTTPS; assigning policies at each subscription breaks inheritance, and Azure Automation runbooks are not the native remediation mechanism for Azure Policy. Option C is wrong because Azure Blueprints are used for orchestrating resource deployments (including policy assignments) but do not provide automatic remediation; manual remediation violates the requirement for automatic remediation where possible. Option D is wrong because a custom PowerShell script with Logic Apps alerts and manual fixes is not a scalable, automated, or policy-driven solution; it lacks inheritance, automatic remediation, and centralized enforcement at the management group level.

Practice this question →
44
MCQmedium

Refer to the exhibit. You are reviewing an ARM template that deploys a network security group (NSG) for a web application. The NSG allows inbound HTTP traffic from any source and then denies all other inbound traffic. However, after deployment, you find that HTTP traffic is being blocked. What is the most likely cause?

A.The AllowHTTP rule uses sourcePortRange '*' which conflicts with the DenyAll rule.
B.The NSG is not associated with the subnet or network interface where the web server is deployed.
C.The DenyAll rule has a higher priority than the AllowHTTP rule, so it takes precedence.
D.The DenyAll rule uses protocol '*' which blocks all traffic including HTTP.
AnswerC

In Azure, NSG rules are evaluated in ascending priority order, where smaller numbers are processed first and the first matching rule determines the outcome. If DenyAll has a numerically lower priority (e.g., 100) than AllowHTTP (e.g., 200), then incoming TCP port 80 HTTP traffic matches DenyAll first, and since its action is Deny, the packet is dropped before AllowHTTP is ever considered. This explicit numeric precedence is the direct cause of the HTTP failure, making the higher priority of DenyAll the definitive reason.

Why this answer

The DenyAll rule has a higher priority (lower priority number) than the AllowHTTP rule, so it is evaluated first and blocks all traffic, including HTTP. To fix this, the AllowHTTP rule should have a higher priority (lower number) than the DenyAll rule.

Exam trap

Candidates often overlook that NSG rules are evaluated in priority order (lower number = higher priority). A deny-all rule with a priority lower than the allow rule will block the intended traffic.

How to eliminate wrong answers

Option A is wrong because sourcePortRange '*' is the default wildcard that matches any source port and does not conflict with the DenyAll rule; port ranges are evaluated independently, and a wildcard source port does not cause blocking. Option C is wrong because the DenyAll rule must have a higher priority number (lower precedence) than the AllowHTTP rule to be effective; if the DenyAll rule had a higher priority (lower number), it would override the Allow rule, but the question implies the Allow rule is correctly prioritized, so this is not the cause. Option D is wrong because protocol '*' matches all protocols, including HTTP (TCP port 80), but the DenyAll rule is intended to block all traffic; the issue is not the protocol wildcard but the lack of NSG association, as the DenyAll rule would only block traffic if the NSG were applied.

Practice this question →
45
MCQmedium

Fabrikam is a healthcare organization that uses Microsoft 365 E5 and Azure. They have a hybrid identity environment with Active Directory on-premises synced to Microsoft Entra ID. The security team wants to implement a Zero Trust strategy following the 'verify explicitly' principle. They need to ensure that all access to Microsoft 365 services and Azure applications is conditionally enforced based on real-time risk signals. Additionally, they want to block legacy authentication protocols that do not support modern authentication. The solution must integrate with Microsoft Defender XDR and Microsoft Sentinel for threat intelligence. Which combination of technologies should you recommend?

A.Implement Azure AD Identity Governance with access reviews. Use Conditional Access to require hybrid Azure AD joined devices. Block legacy authentication by disabling protocols in Exchange Online. Use Azure Sentinel without Defender XDR.
B.Use Azure AD B2B for external users only. Configure Conditional Access with MFA for all users. Use Azure AD Identity Protection for risk. Block legacy authentication at the firewall level.
C.Deploy Microsoft Intune for mobile device management and require compliant devices. Use Conditional Access to block legacy protocols. Rely on Azure ATP (now Microsoft Defender for Identity) for risk signals.
D.Use Microsoft Entra Conditional Access policies with session controls from Microsoft Defender for Cloud Apps. Enable Microsoft Entra ID Protection to feed risk signals into Conditional Access. Block legacy authentication via a Conditional Access policy targeting 'Exchange Active Sync' and 'Other clients'. Integrate Microsoft Sentinel to ingest alerts from Defender XDR.
AnswerD

This solution combines real-time risk assessment from Microsoft Entra ID Protection with adaptive Conditional Access policies, allowing sign-in risk to trigger MFA, block, or session restrictions dynamically. Session controls from Microsoft Defender for Cloud Apps enable granular cloud app session monitoring and policy enforcement, such as blocking download of sensitive files based on user risk. Blocking legacy authentication explicitly via a Conditional Access policy on client apps 'Exchange ActiveSync' and 'Other clients' is the documented method to prevent credential replay attacks. Finally, integrating Microsoft Sentinel with Defender XDR centralizes alerts from across the identity, endpoint, and cloud app domains, enabling advanced hunting and a unified incident response workflow.

Why this answer

It directly implements the 'verify explicitly' principle by using Microsoft Entra ID Protection to feed real-time risk signals into Conditional Access policies, which then enforce session controls via Microsoft Defender for Cloud Apps. It blocks legacy authentication through a targeted Conditional Access policy (not just disabling protocols in Exchange Online or at the firewall), and integrates Microsoft Sentinel to ingest alerts from Defender XDR for centralized threat intelligence. This combination ensures all access to Microsoft 365 and Azure applications is conditionally enforced based on dynamic risk, while also addressing the requirement to block legacy protocols that lack modern authentication support.

Exam trap

The trap here is that candidates often think blocking legacy authentication must be done at the protocol level (e.g., disabling in Exchange Online or firewall) rather than using a Conditional Access policy, which is the recommended and more comprehensive method in a Zero Trust architecture.

How to eliminate wrong answers

Option A is wrong because it relies on disabling legacy protocols in Exchange Online (which is incomplete—does not block protocols like POP3/IMAP/SMTP across all services) and uses Azure Sentinel without Defender XDR, violating the requirement to integrate both. Option B is wrong because it blocks legacy authentication at the firewall level (which is not granular enough and does not address protocol-level blocking within Microsoft 365), and Azure AD B2B is only for external users, not the core Zero Trust strategy for internal access. Option C is wrong because it relies on Azure ATP (now Microsoft Defender for Identity) for risk signals, but the correct modern approach is Microsoft Entra ID Protection, which provides real-time risk detection and feeds directly into Conditional Access; also, Intune for compliant devices is not the primary mechanism for risk-based conditional access.

Practice this question →
46
MCQmedium

Refer to the exhibit. You are reviewing a conditional access policy JSON in Microsoft Entra ID. The policy is enabled but users with the Global Administrator role are not being prompted for MFA. What is the most likely reason?

A.The policy does not include any users except by role.
B.The policy does not include any applications.
C.The grant control requires a compliant device instead of MFA.
D.The policy state is disabled.
AnswerA

The conditional access policy defines user targeting exclusively through the includeRoles array and omits the includeUsers array entirely. This means the policy only applies to sign-ins from users assigned to the specified directory roles, leaving every non-role user outside the policy scope. The absence of an includeUsers entry, such as the shortcut value 'All', prevents the policy from being universally enforced and is the root cause of the misconfiguration.

Why this answer

The Conditional Access policy JSON shows that the 'users' object does not include an 'includeUsers' property for all users or specific groups; instead, users are only included by directory role (e.g., through 'includeRoles'). If the 'includeRoles' array is either empty or does not contain the 'Global Administrator' role, then Global Administrators are not targeted by the policy. Therefore, they are not prompted for MFA despite the policy being enabled.

This is the most likely reason because the other options are incorrect: the policy may include applications (option B), the grant control could be set to MFA (not requiring compliant device) (option C), and the policy is enabled (option D).

Exam trap

The trap here is that candidates assume 'All users' includes all users regardless of role, but they overlook that the exclusion of specific roles or users can completely bypass the policy, and the exam tests whether you understand that exclusion rules override inclusion rules in Conditional Access policies.

How to eliminate wrong answers

Option B is wrong because the policy does not need to include any specific applications; if no applications are selected, the policy applies to all applications by default, which would still trigger MFA for included users. Option C is wrong because the grant control in the policy explicitly requires MFA ('mfa' in the grantControls), not a compliant device, so that does not explain why Global Administrators are not prompted. Option D is wrong because the policy state is set to 'enabled' (as shown in the JSON), so it is active and should enforce MFA for users who are not excluded.

Practice this question →
47
MCQmedium

Your organization is implementing a secure DevOps pipeline for a critical application. You need to design a solution that scans container images for vulnerabilities before they are deployed to production. Which Azure service should you integrate into the pipeline?

A.Azure Key Vault
B.Azure Policy
C.Microsoft Defender for Cloud
D.Azure Security Center
AnswerC

Microsoft Defender for Cloud is the correct choice because it includes built-in vulnerability scanning for container images in Azure Container Registry and other supported registries. It continuously scans images when they are pushed, detects known vulnerabilities using integrated CVE databases, and provides actionable remediation recommendations. Integrating this into a secure DevOps pipeline allows automated gating to block vulnerable images from reaching production.

Why this answer

Microsoft Defender for Cloud (formerly Azure Security Center) provides integrated vulnerability assessment for container images stored in Azure Container Registry (ACR). When integrated into a DevOps pipeline, Defender for Cloud can scan images on push or on demand, using the Qualys scanner to detect CVEs and generate detailed security reports. This allows the pipeline to block or flag vulnerable images before they reach production, directly addressing the requirement for pre-deployment vulnerability scanning.

Exam trap

The trap here is that candidates may confuse the old name 'Azure Security Center' with the current service 'Microsoft Defender for Cloud', or assume that Azure Policy can perform vulnerability scanning when it only enforces configuration compliance, not image-level security analysis.

How to eliminate wrong answers

Option A is wrong because Azure Key Vault is a secrets management service for storing keys, certificates, and passwords, not a container image vulnerability scanner. Option B is wrong because Azure Policy enforces compliance rules on Azure resources (e.g., requiring ACR to use private endpoints) but does not perform runtime or image-level vulnerability scanning. Option D is wrong because Azure Security Center was the previous name for what is now Microsoft Defender for Cloud; the current service name is Defender for Cloud, and the exam expects the updated terminology.

Practice this question →
48
MCQmedium

Your organization uses Microsoft Entra ID and plans to implement a Zero Trust security model. You need to ensure that all access requests to corporate applications are continuously evaluated based on user risk, device compliance, and location. Which Microsoft Entra ID feature should you configure?

A.Identity Governance
B.Privileged Identity Management (PIM)
C.Identity Protection
D.Conditional Access
AnswerD

Conditional Access enforces policies based on user, device, and location signals.

Why this answer

Conditional Access is the correct feature because it enables real-time policy evaluation of access requests based on signals such as user risk (from Identity Protection), device compliance (via Microsoft Intune), and location (IP address ranges or named locations). This aligns directly with the Zero Trust principle of 'never trust, always verify' by continuously re-evaluating each access attempt rather than relying on static permissions.

Exam trap

The trap here is that candidates often confuse Identity Protection (which only detects risk) with Conditional Access (which enforces policies based on that risk), leading them to select Option C instead of D.

How to eliminate wrong answers

Option A is wrong because Identity Governance focuses on managing user lifecycle, access reviews, and entitlement management, not on real-time risk-based access evaluation. Option B is wrong because Privileged Identity Management (PIM) provides just-in-time privileged role activation and approval workflows, but it does not evaluate device compliance or location for general application access. Option C is wrong because Identity Protection detects and reports user and sign-in risks (e.g., leaked credentials, anonymous IP addresses) but does not enforce access decisions itself; it requires integration with Conditional Access to block or require MFA based on those risks.

Practice this question →
49
Multi-Selectmedium

Your organization is implementing Microsoft Intune for mobile device management. You need to design a solution that ensures corporate data on mobile devices is protected if the device is lost or stolen. Which TWO actions should you configure?

Select 2 answers
A.Enforce a minimum PIN length on devices
B.Configure a compliance policy that requires device encryption
C.Deploy a selective wipe policy that removes corporate data
D.Require app protection policies (MAM) for all apps
E.Enable jailbreak detection in a device compliance policy
AnswersB, C

A compliance policy that mandates device encryption ensures that the storage medium (e.g., internal flash) is encrypted, typically using the hardware security module and a recovery key managed by the device, so that if the device is lost, the data is unreadable without the decryption key. This is a protective measure at rest; in addition, the compliance policy can trigger conditional access to block non-compliant devices, but the encryption itself is the core safeguard that prevents data exposure from physical access.

Why this answer

A compliance policy requiring device encryption ensures that if a device is lost or stolen, the data stored on it is unreadable without the decryption key. Intune compliance policies evaluate encryption status (e.g., BitLocker on Windows, FileVault on macOS, or device encryption on iOS/Android) and mark noncompliant devices for conditional access blocking, preventing unauthorized access to corporate data.

Exam trap

The trap here is that candidates often confuse device-level encryption (compliance policy) with app-level protection (MAM) or access controls (PIN, jailbreak detection), failing to recognize that only encryption and selective wipe directly address data protection on a lost or stolen device.

Practice this question →
50
MCQmedium

Your organization uses Microsoft Intune to manage devices. You need to ensure that devices that are not compliant with your organization's security policies are blocked from accessing corporate resources. Which Intune feature should you configure?

A.App protection policies
B.Device configuration profiles
C.Compliance policies
D.Enrollment restrictions
AnswerC

Compliance policies in Intune define the specific conditions a device must meet to be considered compliant, such as required OS versions, password requirements, encryption status, and threats detected by Mobile Threat Defense. Each device periodically uploads its health and configuration to the Intune service, which computes a compliant/non-compliant state. This state can then be consumed by Azure AD Conditional Access to allow or block access to emails, apps, and data based on real-time compliance. When a policy is combined with a Conditional Access policy requiring device compliance, non-compliant devices are blocked from accessing protected resources—making this the correct answer.

Why this answer

Compliance policies in Microsoft Intune define the rules and settings that devices must meet to be considered compliant (e.g., requiring a minimum OS version, encryption, or a healthy device health attestation). When a device is marked as non-compliant, Intune can automatically block access to corporate resources such as Exchange Online, SharePoint, or VPN by integrating with Conditional Access in Microsoft Entra ID. This is the correct feature because it directly evaluates device compliance and enforces access control.

Exam trap

The trap here is that candidates confuse device configuration profiles (which apply settings) with compliance policies (which evaluate settings and enforce access), leading them to select Option B when the question specifically asks about blocking access based on non-compliance.

How to eliminate wrong answers

Option A is wrong because App protection policies (MAM) manage how data is accessed and shared within apps on devices that may not be enrolled in Intune, but they do not block device-level access to corporate resources based on device compliance. Option B is wrong because Device configuration profiles push settings (e.g., Wi-Fi, VPN, email) to devices but do not evaluate or enforce compliance; they are separate from the compliance evaluation and conditional access workflow. Option D is wrong because Enrollment restrictions control which devices can enroll in Intune (e.g., by platform or OS version), but they do not block access for devices that are already enrolled and become non-compliant after enrollment.

Practice this question →
51
MCQhard

A company uses Microsoft Sentinel and wants to prioritize incidents using user risk scores from Microsoft Entra ID Protection. Which configuration should they use to automatically assign a Sentinel severity based on the user's risk level?

A.Create a custom analytics rule that uses the RiskLevel field to set severity
B.Configure an automation rule to set severity when risk is high
C.Use a watchlist to map risk levels to severity
D.Create a playbook that assigns severity based on risk
AnswerA

Creating a custom analytics rule is the technically correct approach because analytics rules in Microsoft Sentinel evaluate telemetry at ingestion time and can dynamically assign incident severity by referencing data fields such as the RiskLevel attribute from Microsoft Entra ID Protection. By setting the Alert Severity to a value derived from RiskLevel (e.g., High if risk is medium, Higher if risk is high), the incident is created with the appropriate priority immediately, enabling efficient triage without further post-processing. This native, rule-based mapping is the only option among the listed alternatives that directly controls initial incident severity as the incident is generated from raw log data.

Why this answer

A is correct because Microsoft Sentinel's custom analytics rules can directly reference the `RiskLevel` field from Microsoft Entra ID Protection user risk data ingested via the UEBA connector. By writing a KQL query that checks the user's risk level (e.g., `RiskLevel == 'high'`) and mapping it to a Sentinel severity (e.g., High, Medium, Low) within the rule's incident creation settings, you automate severity assignment without external dependencies. This native integration ensures real-time synchronization of risk levels to incident priority.

Exam trap

The trap here is that candidates often assume automation rules or playbooks are required for any custom severity assignment, overlooking that custom analytics rules can directly map query results to severity fields without additional automation layers.

How to eliminate wrong answers

Option B is wrong because automation rules can set severity based on conditions like incident properties or entities, but they cannot directly read the `RiskLevel` field from Entra ID Protection user risk data; they operate on incident metadata after creation, not on raw risk signals. Option C is wrong because watchlists are static reference tables used for enrichment or correlation, not for dynamic, real-time mapping of continuously changing user risk levels to severity. Option D is wrong because playbooks (Azure Logic Apps) can assign severity, but they introduce latency and complexity compared to a native analytics rule, and they require additional permissions and orchestration, making them less efficient for this straightforward mapping.

Practice this question →
52
MCQeasy

A company wants to use Microsoft Defender XDR to correlate alerts across endpoints, email, and identities. Which component enables this correlation?

A.Microsoft 365 Defender
B.Microsoft Defender XDR
C.Microsoft Sentinel
D.Microsoft Defender for Cloud
AnswerB

Microsoft Defender XDR is the correct answer because it is the integrated, cloud-native extended detection and response (XDR) platform that natively correlates alerts from Microsoft Defender for Endpoint, Office 365, Identity, and Cloud Apps. By combining signals across domains into a single incident queue, it performs the automatic cross-product correlation the company requires. Its machine-learning-driven analytics unify threat hunting and response without needing external SIEM logic.

Why this answer

Microsoft Defender XDR (the new name for Microsoft 365 Defender) is the unified pre- and post-breach enterprise defense suite that natively correlates signals from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. Its correlation engine uses machine learning and the Microsoft Intelligent Security Graph to fuse alerts across these domains into a single incident, enabling security teams to see the full attack chain from email to endpoint to identity.

Exam trap

The trap here is that candidates confuse the old branding (Microsoft 365 Defender) with the new branding (Microsoft Defender XDR) and pick the outdated name, or they mistake Microsoft Sentinel's broader SIEM capabilities for the native cross-domain correlation engine that Defender XDR provides.

How to eliminate wrong answers

Option A is wrong because 'Microsoft 365 Defender' is the previous name for the same product now called Microsoft Defender XDR; the question explicitly uses the current name, so selecting the old name would be technically inaccurate. Option C is wrong because Microsoft Sentinel is a cloud-native SIEM and SOAR solution that ingests logs from many sources, including Defender XDR, but it does not perform the native, real-time cross-domain alert correlation that Defender XDR's built-in engine does; Sentinel correlates at a higher level using analytics rules and is not the component that directly correlates alerts across endpoints, email, and identities. Option D is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) focused on securing Azure, AWS, and GCP resources, not on correlating alerts across endpoints, email, and identities.

Practice this question →
53
MCQmedium

A company is using Microsoft Intune to manage devices. They need to ensure that only devices with a specific operating system version can access corporate resources. Which Intune policy should they use?

A.App protection policy
B.Enrollment restriction
C.Compliance policy
D.Device configuration policy
AnswerC

Compliance policies enforce OS version requirements to grant access.

Why this answer

Compliance policies in Microsoft Intune define the rules that devices must meet to be considered compliant, such as requiring a specific operating system version. When a device is marked non-compliant, Conditional Access policies can block access to corporate resources. This directly enforces the requirement that only devices with the correct OS version can access company data.

Exam trap

The trap here is confusing the purpose of Compliance policies (which enforce ongoing access rules based on device health) with Enrollment restrictions (which only gate initial enrollment) or Device configuration policies (which apply settings but do not evaluate compliance).

How to eliminate wrong answers

Option A is wrong because App protection policies (MAM) manage how apps handle data (e.g., preventing copy/paste) and do not enforce device-level OS version requirements. Option B is wrong because Enrollment restrictions control which devices can enroll in Intune (e.g., by platform or manufacturer) but do not enforce ongoing compliance with OS version after enrollment. Option D is wrong because Device configuration policies push settings (e.g., Wi-Fi, VPN, certificates) to devices but do not evaluate or enforce OS version compliance; they are not used for access control decisions.

Practice this question →
54
MCQmedium

Your company is migrating on-premises Active Directory to Microsoft Entra ID. The security team requires that users must use passwordless authentication methods for all sign-ins. Which Microsoft Entra ID feature should you enable to support passwordless authentication?

A.Microsoft Entra ID passwordless authentication methods
B.Password hash synchronization
C.Seamless Single Sign-On (Seamless SSO)
D.Pass-through authentication
AnswerA

These methods replace the password with a device-bound cryptographic key (e.g., Windows Hello for Business, FIDO2 security keys) or a biometric gesture in the Microsoft Authenticator app. By requiring proof of possession and user presence, they eliminate the password secret entirely and are inherently phishing-resistant, which aligns with the passwordless goal of the migration.

Why this answer

Microsoft Entra ID passwordless authentication methods (such as Windows Hello for Business, FIDO2 security keys, and Microsoft Authenticator) are the native features designed to eliminate passwords entirely. These methods satisfy the security team's requirement by enabling users to sign in without a password, using biometrics or cryptographic keys instead.

Exam trap

The trap here is that candidates often confuse 'passwordless authentication' with features that reduce password usage (like Seamless SSO or PHS) rather than understanding that only the dedicated passwordless methods in Entra ID actually remove the password requirement entirely.

How to eliminate wrong answers

Option B is wrong because Password hash synchronization (PHS) synchronizes password hashes from on-premises AD to Entra ID for authentication, but it does not enable passwordless methods; it still relies on passwords. Option C is wrong because Seamless SSO provides automatic sign-in when users are on domain-joined devices connected to the corporate network, but it does not eliminate the need for passwords—it just skips the password prompt in certain scenarios. Option D is wrong because Pass-through authentication (PTA) validates passwords directly against on-premises AD, but it still requires a password to be entered and does not support passwordless authentication.

Practice this question →
55
MCQhard

Your organization is migrating to Microsoft 365 and wants to implement a data classification strategy. The compliance team needs to automatically detect and label documents containing personal data (e.g., Social Security numbers) in SharePoint Online. Which Microsoft Purview solution should you use?

A.Auto-labeling policies
B.Records Management
C.eDiscovery
D.Data Loss Prevention policies
AnswerA

Auto-labeling uses sensitive info types to automatically apply labels.

Why this answer

Auto-labeling policies in Microsoft Purview are designed to automatically detect sensitive data types (e.g., Social Security numbers) using built-in or custom sensitive information types and apply sensitivity labels to documents in SharePoint Online. This meets the requirement for automatic detection and labeling without user intervention, as the compliance team needs.

Exam trap

The trap here is confusing Data Loss Prevention (DLP) policies with auto-labeling policies, as both can detect sensitive data, but DLP policies enforce protective actions (block/alert) while auto-labeling policies apply sensitivity labels for classification and downstream protection.

How to eliminate wrong answers

Option B (Records Management) is wrong because it focuses on managing retention and disposition of content, not on automatic detection and labeling of sensitive data. Option C (eDiscovery) is wrong because it is used for searching and exporting content for legal or investigative purposes, not for applying classification labels. Option D (Data Loss Prevention policies) is wrong because DLP policies are designed to prevent unauthorized sharing or leakage of sensitive data by blocking or alerting on activities, not to automatically apply sensitivity labels to documents at rest.

Practice this question →
56
MCQmedium

A company deploys Microsoft Defender for Cloud Apps. They need to detect anomalous behavior in user activities across multiple cloud apps. Which feature should they enable?

A.Session policies
B.Anomaly detection policies
C.Data loss prevention policies
D.App governance
AnswerB

This is the correct feature for detecting anomalous user activities.

Why this answer

Anomaly detection policies in Microsoft Defender for Cloud Apps are specifically designed to identify unusual patterns in user activities across connected cloud apps, such as impossible travel, mass file downloads, or ransomware-like behavior. These policies leverage machine learning and behavioral analytics to establish a baseline of normal user behavior and trigger alerts when deviations occur, making them the correct choice for detecting anomalous behavior.

Exam trap

The trap here is that candidates often confuse session policies (which enforce real-time access controls) with anomaly detection policies (which analyze historical patterns), leading them to select session policies when the question specifically asks for detecting anomalous behavior rather than controlling it.

How to eliminate wrong answers

Option A is wrong because session policies are used for real-time control of user sessions based on risk level, not for detecting anomalous behavior patterns over time. Option C is wrong because data loss prevention policies focus on preventing unauthorized sharing or leakage of sensitive data, not on detecting behavioral anomalies in user activities. Option D is wrong because app governance provides visibility and control over app permissions and compliance, but it does not include the behavioral anomaly detection capabilities needed for user activity monitoring.

Practice this question →
57
MCQmedium

Your organization is migrating on-premises applications to Azure and needs to secure secrets (database connection strings, API keys) used by these applications. You are required to rotate secrets automatically without downtime. Which Azure service should you use?

A.Microsoft Purview Information Protection
B.Azure App Configuration with feature flags
C.Azure Key Vault with managed identity and certificate auto-rotation
D.Azure AD Application Proxy
AnswerC

Azure Key Vault is the appropriate service for securely storing and managing sensitive information such as certificates, keys, and secrets. By combining it with a managed identity, an application authenticates to Key Vault without any hardcoded credentials, and the built-in certificate auto-rotation ensures certificates are renewed and renewed versions are made available transparently. This integrated approach fully addresses secret storage, access control, and lifecycle management for your migration.

Why this answer

Azure Key Vault with managed identity and certificate auto-rotation is correct because it provides a centralized, secure store for secrets like database connection strings and API keys, supports automatic rotation of certificates and secrets via Event Grid notifications or lifecycle policies, and integrates with Azure resources using managed identities to enable zero-downtime rotation without exposing credentials in code or configuration.

Exam trap

The trap here is that candidates confuse Azure App Configuration (which can store configuration values but not secrets securely with rotation) with Azure Key Vault, or mistakenly think Purview Information Protection handles secrets management, when only Key Vault provides the required secure storage and automated rotation capabilities.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Information Protection is a data classification and labeling service for protecting sensitive data at rest and in transit, not a secrets management or rotation service. Option B is wrong because Azure App Configuration with feature flags is designed for managing application configuration settings and feature toggles, not for securely storing or rotating secrets like connection strings or API keys. Option D is wrong because Azure AD Application Proxy provides secure remote access to on-premises web applications by publishing them through Azure AD, not for storing or rotating secrets.

Practice this question →
58
MCQmedium

A company uses Microsoft Entra ID Governance. They need to automate the process of granting access to a SaaS application based on the user's department attribute. Which feature should they use?

A.Lifecycle workflows
B.Entitlement management
C.Access reviews
D.Privileged identity management
AnswerB

Entitlement management in Microsoft Entra ID Governance provides access packages that bundle resources, roles, and policies. It can automate assignment based on member attributes through dynamic membership rules or by connecting to a source like an HR system, and it supports time-bound assignments, self-service requests, and approvals. This makes it the appropriate tool for automatically granting access to applications based on an attribute such as the user's department, aligning directly with the stated need.

Why this answer

Entitlement management in Microsoft Entra ID Governance allows you to create access packages that define collections of resources (like SaaS apps) and policies for who can request access. By configuring a dynamic membership rule based on the user's department attribute, you can automate granting access to the SaaS application without manual intervention. This directly meets the requirement to automate access based on a user attribute.

Exam trap

The trap here is that candidates confuse Lifecycle workflows (which automate HR-driven provisioning events) with Entitlement management (which automates attribute-based access requests), leading them to choose Option A incorrectly.

How to eliminate wrong answers

Option A is wrong because Lifecycle workflows automate joiner, mover, and leaver processes (e.g., account provisioning, email forwarding) but do not handle attribute-based access requests to SaaS applications. Option C is wrong because Access reviews are periodic attestation processes to review existing access, not an automated mechanism to grant access based on a user attribute. Option D is wrong because Privileged identity management (PIM) provides just-in-time privileged access to Azure AD roles and Azure resources, not automated entitlement to a SaaS application based on a department attribute.

Practice this question →
59
MCQeasy

Your security team needs to receive alerts when a user is assigned a privileged role in Microsoft Entra ID. Which service should you use to create an alert for privileged role assignments?

A.Microsoft Entra ID Privileged Identity Management (PIM)
B.Microsoft Defender for Identity
C.Microsoft Sentinel
D.Microsoft Defender for Cloud Apps
AnswerA

PIM is the native Microsoft Entra ID identity governance engine that delivers built-in, out-of-the-box alerting for privileged role assignments and activations. It monitors for suspicious activities such as permanent privileged assignments, off-hours role activation, or activation attempts that bypass just-in-time access policies, and can trigger email notifications or integrate with SIEM tools. These alerts are natively scoped to Entra ID roles, requiring no additional log ingestion or custom rule authoring, making it the correct choice for this requirement.

Why this answer

Microsoft Entra ID Privileged Identity Management (PIM) is the correct service because it provides built-in alerting capabilities specifically for privileged role assignments in Microsoft Entra ID. PIM can generate alerts when a user is assigned a privileged role, such as Global Administrator, without requiring additional configuration or external data sources. This aligns directly with the requirement to receive alerts for privileged role assignments within the identity platform.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Identity or Microsoft Sentinel as the primary alerting tool for Entra ID role assignments, but PIM is the native, purpose-built service for this specific identity governance task.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Identity is a security solution that monitors on-premises Active Directory signals and hybrid identities for threats like lateral movement and compromised accounts, not for generating alerts on Entra ID role assignments. Option C is wrong because Microsoft Sentinel is a SIEM/SOAR platform that ingests logs from multiple sources, including Entra ID, but it requires custom analytics rules and log ingestion to create alerts for role assignments, making it an indirect and more complex solution compared to PIM's native alert. Option D is wrong because Microsoft Defender for Cloud Apps focuses on cloud application discovery, session controls, and anomaly detection for SaaS apps, not on monitoring Entra ID privileged role assignments.

Practice this question →
60
MCQhard

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to design a solution that ensures all user authentication requests are evaluated by Conditional Access policies before granting access to cloud apps. However, some legacy apps still require basic authentication. What should you recommend?

A.Enable authentication policies in Microsoft Entra ID to block legacy authentication
B.Configure Active Directory Federation Services (AD FS) as the identity provider
C.Deploy Microsoft Entra Application Proxy for all legacy apps
D.Enable pass-through authentication (PTA) to forward authentication requests
AnswerA

Enabling authentication policies in Microsoft Entra ID, such as the legacy authentication block, is the correct approach because legacy protocols like POP3, IMAP4, and SMTP do not support modern authentication and thus cannot be evaluated against Conditional Access policies. Blocking these protocols forces clients to use modern authentication (OAuth 2.0, OpenID Connect, SAML), ensuring multi-factor authentication and device compliance checks are enforced on every sign-in.

Why this answer

Enabling authentication policies in Microsoft Entra ID to block legacy authentication ensures that all user authentication requests are evaluated by Conditional Access policies before granting access to cloud apps. Legacy authentication protocols (e.g., POP3, IMAP, SMTP, basic auth) bypass modern authentication and Conditional Access, so blocking them forces clients to use modern protocols (OAuth 2.0, OpenID Connect) that are subject to Conditional Access evaluation. This directly addresses the requirement while allowing legacy apps to be updated or replaced over time.

Exam trap

The trap here is that candidates often confuse 'blocking legacy authentication' with 'disabling basic authentication' in Exchange Online or other services, but the correct approach is to use the tenant-wide Conditional Access policy to block all legacy authentication protocols, which is a distinct setting in Microsoft Entra ID.

How to eliminate wrong answers

Option B is wrong because configuring AD FS as the identity provider does not inherently block legacy authentication; AD FS can still accept legacy authentication requests unless explicitly configured to block them, and it does not enforce Conditional Access policies for cloud apps as effectively as Entra ID. Option C is wrong because deploying Microsoft Entra Application Proxy for all legacy apps provides secure remote access but does not block legacy authentication protocols; the apps themselves may still use basic authentication, which bypasses Conditional Access. Option D is wrong because enabling pass-through authentication (PTA) forwards authentication requests to on-premises AD but does not block legacy authentication; PTA works with modern authentication but legacy protocols still bypass Conditional Access unless explicitly blocked.

Practice this question →
61
MCQhard

A company uses Microsoft Defender for Endpoint to protect endpoints. They want to configure attack surface reduction rules to block executable files from running unless they meet a specific prevalence, age, or trust level. Which ASR rule should they enable?

A.Block Office communication application from creating child processes
B.Block credential stealing from the Windows local security authority subsystem
C.Block untrusted and unsigned processes that run from USB
D.Block executable files from running unless they meet a prevalence, age, or trusted list criteria
AnswerD

This is the exact Microsoft Defender for Endpoint ASR rule that uses cloud-delivered reputation to block executable files that lack sufficient prevalence, are too new (low age), or do not appear on a trusted list. Before allowing the process to run, the endpoint consults Microsoft's reputation service and enforces the decision based on those collective metadata signals. This behavior directly matches the scenario in the question, making it the correct choice.

Why this answer

The ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criteria' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) is specifically designed to block executables that do not meet Microsoft's cloud-based prevalence, age, or trustworthiness criteria. This rule uses the Microsoft Intelligent Security Graph to evaluate files against global telemetry, blocking those that are new, rare, or unsigned, which directly matches the requirement to block executables based on prevalence, age, or trust level.

Exam trap

The trap here is that candidates confuse the USB-specific rule (Option C) with the global executable prevalence rule (Option D), because both mention 'untrusted' or 'unsigned', but only Option D explicitly includes prevalence, age, and trusted list criteria as stated in the question.

How to eliminate wrong answers

Option A is wrong because 'Block Office communication application from creating child processes' (GUID: 26190899-1602-49e8-8b27-eb1d0a1ce869) targets child processes spawned by Office communication apps (e.g., Outlook, Skype) to prevent lateral movement via macro-based attacks, not executable file prevalence or trust. Option B is wrong because 'Block credential stealing from the Windows local security authority subsystem' (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2) protects LSASS memory from credential theft tools like Mimikatz, not executable file execution policies. Option C is wrong because 'Block untrusted and unsigned processes that run from USB' (GUID: b2b3f03d-6a4c-4b7e-8c97-3f0e5c7b8a9d) only applies to USB-removable media, not all executable files, and does not consider prevalence or age criteria.

Practice this question →
62
MCQmedium

A global retail company, Northwind Traders, is adopting a cloud-first strategy using Azure and Microsoft 365. They have a large number of temporary seasonal workers who need access to specific applications and data for limited periods. The security team wants to minimize the risk of standing privileges and ensure that access is granted only when needed and for a limited duration. They also need to audit all privileged access actions. The environment includes Microsoft Entra ID, Azure resources, and Microsoft 365 services. You need to design a privileged access strategy that follows the principle of least privilege and aligns with Microsoft's best practices for privileged identity management. What should you recommend?

A.Use Microsoft Entra Privileged Identity Management (PIM) to grant just-in-time access to Azure AD roles and Azure resources. Configure approval workflows for high-privilege roles. Set maximum activation durations. For non-Azure resources, use Privileged Access Groups (PAG) to manage access. Enable audit logging to a Log Analytics workspace for monitoring.
B.Create a custom role in Azure AD with limited permissions. Assign the role to a security group. Have users request access via a manual email process. The IT team approves and assigns the group membership temporarily.
C.Assign permanent roles to seasonal workers for the duration of their contract. Use Azure AD access reviews to periodically confirm access. Enable Azure AD audit logs. Use Conditional Access to require MFA for privileged roles.
D.Create separate Azure AD roles for each seasonal worker with granular permissions. Use Azure AD Identity Governance to automate access requests. Do not enable PIM to reduce complexity.
AnswerA

This is correct because Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) administrative access, meaning users get the rights only when needed and for a limited, configurable duration. For high-privilege roles, you can require approval workflows so that activations are explicitly authorized, and setting maximum activation durations enforces a time-bound window that minimizes standing privilege. For non-Azure resources such as on-premises apps or Azure AD-joined groups, Privileged Access Groups (PAG) extend PIM's JIT and approval controls to group membership. Additionally, routing audit logs to a Log Analytics workspace centralizes monitoring and enables alerting on suspicious activations, which satisfies both security and compliance requirements.

Why this answer

It leverages Microsoft Entra Privileged Identity Management (PIM) to enforce just-in-time (JIT) access for Azure AD roles and Azure resources, aligning with the principle of least privilege and minimizing standing privileges. It includes approval workflows for high-privilege roles, maximum activation durations to limit exposure, and Privileged Access Groups (PAG) to manage access to non-Azure resources like Microsoft 365 workloads. Audit logging to a Log Analytics workspace provides comprehensive monitoring of all privileged actions, meeting the auditing requirement.

Exam trap

The trap here is that candidates may assume permanent role assignments with periodic access reviews are sufficient, but this fails to eliminate standing privileges between reviews, which is the core risk the question targets.

How to eliminate wrong answers

Option B is wrong because a manual email process for access requests is insecure, lacks automation, and does not enforce just-in-time activation or time-bound access, violating the requirement to minimize standing privileges. Option C is wrong because assigning permanent roles to seasonal workers for the duration of their contract creates standing privileges, which contradicts the goal of granting access only when needed and for a limited duration; access reviews alone do not prevent persistent access between reviews. Option D is wrong because creating separate Azure AD roles for each seasonal worker is administratively unsustainable and violates least privilege by not using PIM, which is essential for JIT activation and approval workflows; disabling PIM increases complexity and risk.

Practice this question →
63
MCQmedium

A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They want to ensure that all virtual machines have the Log Analytics agent installed and that missing system updates are remediated automatically. Which two recommendations should be enabled in a single policy initiative?

A.Assign two separate Azure Policy initiatives, one for each requirement.
B.Create a custom Azure Policy initiative that combines the two requirements.
C.Use Azure Blueprints to assign the policies to all subscriptions.
D.Enable the Microsoft Defender for Cloud 'System Updates' and 'Log Analytics agent' recommendations via a built-in initiative.
AnswerD

Enabling the System Updates and Log Analytics agent recommendations through Defender for Cloud's built-in initiative directly leverages the Microsoft cloud security benchmark (or the legacy ASC default) that Microsoft manages and updates. This approach automatically applies the underlying Azure Policy definitions across all selected subscriptions, correlates assessment results to secure-score and regulatory compliance controls, and requires no custom coding or manual policy maintenance—making it the intended, simplest path for meeting both requirements.

Why this answer

Microsoft Defender for Cloud includes a built-in policy initiative (the 'ASC Default' initiative) that contains both the 'System Updates' and 'Log Analytics agent' recommendations. Enabling this single initiative automatically assigns both requirements to the selected scope, ensuring that missing system updates are remediated and the Log Analytics agent is installed on all virtual machines without needing custom policies or separate assignments.

Exam trap

The trap here is that candidates often think they need to create custom initiatives or use separate assignments (Option A or B) because they assume the two requirements are unrelated, but Microsoft Defender for Cloud's built-in initiative already bundles them together, making Option D the simplest and most correct approach.

How to eliminate wrong answers

Option A is wrong because it suggests assigning two separate Azure Policy initiatives, which would require managing two distinct assignments and could lead to inconsistent enforcement; the built-in initiative already combines both requirements into a single assignment. Option B is wrong because creating a custom Azure Policy initiative is unnecessary and adds complexity when a built-in initiative that exactly meets the requirements already exists in Defender for Cloud. Option C is wrong because Azure Blueprints are used for deploying and governing entire environments with multiple artifacts (including policies, role assignments, and resource groups), not for simply enabling two specific recommendations within Defender for Cloud; using Blueprints here would be over-engineering and not the intended use case.

Practice this question →
64
MCQmedium

Refer to the exhibit. You are reviewing a KQL query in Microsoft Sentinel. What is the primary purpose of this query?

A.To identify accounts with multiple failed logon attempts from a single IP.
B.To list all successful logon events in the last 7 days.
C.To calculate the total number of failed logons per hour.
D.To detect account lockout events.
AnswerA

The query aggregates failed logons by account and IP, filtering for >10 attempts.

Why this answer

The query uses the `SecurityEvent` table and filters for `EventID == 4625`, which indicates a failed logon attempt. By summarizing `count()` by `IPAddress` and `Account` and filtering for `FailedAttempts > 5`, the query identifies accounts with multiple failed logon attempts from a single IP address. This is typical for detecting brute-force or password-spray attacks, making option A correct.

Exam trap

Candidates may confuse EventID 4625 with successful logon (EventID 4624) or account lockout (EventID 4740). They might also overlook that the query groups by both IP and account, not by time, leading them to select options B, C, or D.

How to eliminate wrong answers

Option B is wrong because the query filters for `ResultType == 50057`, which is a failed logon event, not a successful one; successful logons would use `ResultType == 0`. Option C is wrong because the query summarizes by `IPAddress` and `UserPrincipalName`, not by time bins (e.g., `bin(TimeGenerated, 1h)`), so it cannot calculate failed logons per hour. Option D is wrong because account lockout events are represented by a different `ResultType` value (e.g., 50053 or 50074 in Azure AD), and the query does not filter for those codes.

Practice this question →
65
MCQmedium

Litware, a software development company, has adopted a DevOps culture and uses Azure DevOps for CI/CD pipelines. They deploy applications to Azure Kubernetes Service (AKS) and Azure App Services. The security team wants to ensure that secrets (API keys, connection strings) are not exposed in source code or pipeline logs. They also need to scan container images for vulnerabilities before deployment and ensure that only approved images are used in production. The solution must integrate with Microsoft Defender for Cloud and follow security best practices. What should you include in the design?

A.Use Azure App Configuration to store secrets with encryption. Run vulnerability scans using a third-party tool integrated into the pipeline. Create a custom script to check image registry location.
B.Store secrets in Azure Key Vault and use Azure DevOps Variable Groups linked to Key Vault for retrieval during pipelines. Enable Microsoft Defender for Containers on AKS to scan container images for vulnerabilities. Use Azure Policy (specifically Azure Policy for AKS with Gatekeeper) to enforce that only images from approved registries are deployed.
C.Store secrets as encrypted pipeline variables in Azure DevOps. Use Azure Container Registry (ACR) tasks to scan images. Implement manual approval gates in release pipelines to verify image source.
D.Store secrets in Azure Key Vault but use a custom task to retrieve them. Scan images using Microsoft Defender for Cloud after deployment. Use role-based access control to restrict registry access.
AnswerB

Azure Key Vault is the correct service for secrets because it offers centralized management, access policies, rotation, and auditing; linking Azure DevOps Variable Groups to Key Vault retrieves secrets securely at pipeline runtime without exposing them in logs. Enabling Microsoft Defender for Containers on AKS automatically scans container images in ACR for vulnerabilities and provides runtime threat detection. Azure Policy with Gatekeeper (the AKS admission controller) enforces that only images from approved registries are deployed, providing governance and preventing unauthorized or malicious image usage.

Why this answer

It aligns with security best practices by using Azure Key Vault to securely store secrets and linking them to Azure DevOps Variable Groups for secure retrieval during pipelines, preventing exposure in source code or logs. It enables Microsoft Defender for Containers on AKS to scan container images for vulnerabilities before deployment, and uses Azure Policy with Gatekeeper to enforce that only images from approved registries are deployed, ensuring compliance and integration with Microsoft Defender for Cloud.

Exam trap

The trap here is that candidates often confuse Azure App Configuration with Azure Key Vault for secret storage, or assume that post-deployment scanning is acceptable, but the requirement explicitly demands scanning before deployment and integration with Microsoft Defender for Cloud.

How to eliminate wrong answers

Option A is wrong because Azure App Configuration is not designed for secret storage (it lacks native key rotation and access policies compared to Key Vault), and using a third-party tool for vulnerability scanning and a custom script for registry checks does not integrate with Microsoft Defender for Cloud as required. Option C is wrong because storing secrets as encrypted pipeline variables in Azure DevOps still exposes them in pipeline logs and does not provide centralized secret management or rotation, and ACR tasks scan images only after push, not before deployment, while manual approval gates do not enforce policy-based image source control. Option D is wrong because using a custom task to retrieve secrets from Key Vault bypasses the secure, native integration of Variable Groups linked to Key Vault, and scanning images after deployment (post-deployment) violates the requirement to scan before deployment, while RBAC alone does not enforce that only approved images are used.

Practice this question →
66
MCQmedium

Refer to the exhibit. You are reviewing an ARM template for an Azure storage account. Which security best practice is implemented?

A.Enforce HTTPS traffic only
B.Restrict network access by IP address
C.Deny all network traffic by default
D.Enable soft delete for blobs
AnswerC

Deny all network traffic by default is correct because the storage account template sets the networkAcls.defaultAction property to Deny. With this configuration, any request that does not match an explicitly permitted rule (such as a service endpoint or virtual network rule) is blocked at the network layer. This enforces a strict zero-trust baseline: all inbound traffic is denied unless an exception is explicitly defined, making it the primary network hardening control in the template.

Why this answer

The ARM template snippet shows the 'defaultAction' property set to 'Deny' under 'networkAcls', which explicitly denies all network traffic by default. This is a security best practice because it implements a zero-trust network model, ensuring that only explicitly allowed traffic (via IP rules or virtual network rules) can access the storage account. Option C correctly identifies this as the default deny behavior.

Exam trap

The trap here is that candidates may confuse 'defaultAction: Deny' with 'restrict network access by IP address' (Option B), but the default deny does not itself restrict by IP—it simply blocks everything until explicit allow rules are added.

How to eliminate wrong answers

Option A is wrong because the template does not include the 'supportsHttpsTrafficOnly' property or set it to true; enforcing HTTPS traffic only is a separate best practice not shown here. Option B is wrong because while IP rules can be added to allow specific addresses, the template only shows the default deny action, not any IP-based restrictions. Option D is wrong because soft delete for blobs is configured via the 'deleteRetentionPolicy' property on blob services, which is absent from this storage account-level network ACL configuration.

Practice this question →
67
MCQmedium

A company plans to implement a Zero Trust security model. Which of the following is the primary principle that should guide their strategy?

A.Assume breach and verify explicitly
B.Use a strong perimeter firewall as the primary defense
C.Grant trusted users full access to all resources
D.Trust but verify all internal traffic
AnswerA

This is a foundational Zero Trust principle.

Why this answer

The primary principle of Zero Trust is 'never trust, always verify,' which is operationalized as 'assume breach and verify explicitly.' This means every access request—regardless of source (internal or external)—must be authenticated, authorized, and encrypted before granting access. It eliminates implicit trust based on network location and enforces least-privilege access, which is foundational to the Zero Trust architecture.

Exam trap

The trap here is that candidates often confuse 'trust but verify' (Option D) with Zero Trust, but Zero Trust explicitly rejects any pre-established trust and requires verification at every access attempt, making 'assume breach and verify explicitly' the correct guiding principle.

How to eliminate wrong answers

Option B is wrong because relying on a strong perimeter firewall as the primary defense violates Zero Trust's core tenet of eliminating implicit trust based on network location; Zero Trust assumes the network is already compromised and requires micro-segmentation and per-request verification instead. Option C is wrong because granting trusted users full access to all resources contradicts the least-privilege principle of Zero Trust, which mandates that access be limited to only what is necessary for a specific task, regardless of user trust level. Option D is wrong because 'trust but verify' is the opposite of Zero Trust; Zero Trust requires 'never trust, always verify'—verification must occur before access is granted, not after trust is assumed.

Practice this question →
68
MCQhard

Your organization is adopting Microsoft Copilot for Security. You need to ensure that the AI model does not expose sensitive data during interactions. What is the primary security control you should implement?

A.Microsoft Entra Conditional Access policies
B.Microsoft Entra Privileged Identity Management
C.Microsoft Purview Information Protection sensitivity labels
D.Microsoft Purview Data Loss Prevention policies for Copilot
AnswerD

Data Loss Prevention policies for Copilot are specifically designed to detect sensitive information types—such as credit card numbers or personally identifiable information—within Copilot prompts and responses, and can take automatic actions like blocking or warning the user. These policies integrate with the Microsoft Purview console and apply contextual constraints based on the data being processed, making them a content-aware control that mitigates exposure at the point of interaction. Unlike identity or classification-only controls, DLP actively prevents exfiltration by interrupting the prompt/response flow when a violation is matched.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) policies for Copilot for Security are the primary control to prevent sensitive data exposure because they can inspect and block sensitive information (e.g., credit card numbers, health records) in real-time during Copilot interactions. DLP policies integrate directly with Copilot to enforce data protection rules on both prompts and responses, ensuring that sensitive data is not leaked through the AI model. This is the most direct and effective control for preventing data exposure in AI interactions.

Exam trap

The trap here is that candidates often confuse data classification (sensitivity labels) with data loss prevention (DLP), assuming that labeling data is sufficient to prevent exposure, but DLP is the active enforcement mechanism required for real-time AI interactions.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Conditional Access policies control access to resources based on conditions like location or device compliance, but they do not inspect or block sensitive data within Copilot interactions. Option B is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time privileged role assignments and does not have any capability to scan or prevent data leakage in AI conversations. Option C is wrong because Microsoft Purview Information Protection sensitivity labels classify and protect data at rest (e.g., documents, emails) but do not enforce real-time data loss prevention rules during active Copilot sessions.

Practice this question →
69
MCQmedium

You are designing a security solution for a hybrid identity environment that uses Microsoft Entra ID and on-premises Active Directory. The company wants to enforce Zero Trust principles by continuously verifying user access. Which feature should you implement?

A.Implement Microsoft Entra Hybrid Join for all devices
B.Implement Conditional Access policies that evaluate session risk in real time using continuous access evaluation
C.Implement Microsoft Entra Seamless Single Sign-On
D.Implement Microsoft Entra ID Protection to require multi-factor authentication for all users
AnswerB

Continuous Access Evaluation (CAE) is the correct mechanism because it forces Microsoft Entra ID to re-evaluate Conditional Access policies when critical events occur, such as user account disablement, password reset, or session revocation, rather than waiting for token expiration. It uses a multi-party token that carries a time-limited claim, and resource providers listen for cancellation signals, allowing access to be cut off within minutes. This is true continuous verification because both the token lifetime is shortened and the risk or compliance state is rechecked proactively.

Why this answer

Continuous access evaluation (CAE) is the correct feature because it enforces Zero Trust by evaluating access decisions in real time when critical events occur (e.g., user risk changes, device compliance loss, or token revocation), rather than relying on token lifetime. This ensures that session risk is continuously verified, aligning with the Zero Trust principle of 'never trust, always verify'.

Exam trap

The trap here is that candidates often confuse 'Conditional Access policies' (which are static, policy-based controls evaluated at sign-in) with 'continuous access evaluation' (which dynamically re-evaluates access during an active session), leading them to choose a generic MFA or device join option instead of the real-time evaluation feature.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Hybrid Join only registers devices in both on-premises AD and Entra ID, enabling device-based Conditional Access, but it does not provide continuous real-time session risk evaluation. Option C is wrong because Seamless SSO only eliminates password prompts for users on domain-joined devices; it does not enforce continuous verification or evaluate session risk. Option D is wrong because requiring MFA for all users via Identity Protection is a static, policy-based control that does not continuously re-evaluate access during an active session based on real-time risk changes.

Practice this question →
70
Multi-Selecthard

You are designing a Microsoft Purview data security solution for a multinational organization subject to GDPR and CCPA. Which THREE Purview capabilities should you include to meet regulatory requirements?

Select 3 answers
A.Data Loss Prevention (DLP) policies
B.Advanced eDiscovery
C.Microsoft Purview Audit (Premium) and Activity Explorer
D.Data classification and sensitivity labels
E.Data Lifecycle Management (retention policies)
AnswersA, C, D

Prevents unauthorized sharing of personal data.

Why this answer

Data Loss Prevention (DLP) policies are correct because they allow the organization to detect and prevent the accidental or intentional sharing of sensitive data—such as personally identifiable information (PII) covered under GDPR and CCPA—across email, SharePoint, OneDrive, and endpoints. By scanning content for sensitive information types (e.g., credit card numbers, EU passport numbers) and applying protective actions (e.g., blocking transmission, showing policy tips), DLP directly enforces data protection mandates required by these regulations.

Exam trap

The trap here is that candidates often confuse 'detective' controls (like eDiscovery) with 'preventive' controls (like DLP and sensitivity labels), or they mistakenly think retention policies alone satisfy data security requirements, when in fact GDPR and CCPA demand active protection against data breaches and unauthorized disclosure.

Practice this question →
71
MCQeasy

Your organization wants to implement a security information and event management (SIEM) solution that can ingest logs from multiple sources, including on-premises servers, Azure resources, and third-party SaaS applications. Which Microsoft service should you choose?

A.Microsoft Purview
B.Microsoft Defender for Cloud
C.Microsoft Sentinel
D.Azure Monitor
AnswerC

Microsoft Sentinel is the correct answer because it is a scalable, cloud-native SIEM and SOAR service that ingests logs from a wide range of sources, including Microsoft 365, Azure, third-party apps, and on-premises systems. It uses Kusto Query Language (KQL) for advanced hunting and custom analytics, and it provides built-in connectors for many security products. Sentinel centralizes security data, triggers alerts based on correlation rules, and supports automated response playbooks for end-to-end incident management.

Why this answer

Microsoft Sentinel is the correct choice because it is a cloud-native SIEM solution specifically designed to ingest logs from diverse sources, including on-premises servers, Azure resources, and third-party SaaS applications, using built-in connectors for over 100 data sources. It provides centralized security analytics, threat detection, and incident response, making it the appropriate service for this multi-source log ingestion requirement.

Exam trap

The trap here is that candidates often confuse Azure Monitor with a SIEM because it collects logs and metrics, but it lacks the security-specific correlation, threat intelligence integration, and incident management features that define a true SIEM like Microsoft Sentinel.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview is a data governance and compliance solution focused on data classification, labeling, and risk management, not a SIEM for ingesting and analyzing security logs. Option B is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and workload protection platform that provides security recommendations and alerts for Azure and hybrid resources, but it lacks the comprehensive log ingestion and SIEM capabilities needed for multi-source log aggregation. Option D is wrong because Azure Monitor is a monitoring and diagnostics service for Azure resources and applications, primarily collecting metrics and logs for performance and operational health, not a SIEM solution designed for security event correlation and threat hunting across diverse sources.

Practice this question →
72
MCQeasy

A company wants to protect sensitive email data from being exfiltrated by malicious insiders. They need a solution that can detect and block anomalous outbound email traffic in real time. Which Microsoft solution should they use?

A.Microsoft Purview Information Protection
B.Microsoft Defender for Cloud Apps
C.Microsoft Defender for Office 365
D.Microsoft Sentinel
AnswerC

Microsoft Defender for Office 365 is the correct choice because it is the email security service built into Exchange Online Protection and Microsoft 365. It inspects every inbound and outbound message in near real time with anti-phishing, anti-spam, anti-malware, Safe Links, and Safe Attachments, and can quarantine suspicious messages before they reach mailboxes. Its outbound spam and mail-flow rules also allow administrators to block or restrict internal users from sending messages containing sensitive content, directly preventing data exfiltration.

Why this answer

Microsoft Defender for Office 365 (MDO) is the correct solution because it provides real-time detection and blocking of anomalous outbound email traffic through its outbound spam filtering and anti-phishing policies. MDO uses machine learning models to analyze email sending patterns, such as sudden spikes in volume or unusual recipient domains, and can automatically quarantine or block suspicious outbound messages to prevent data exfiltration by malicious insiders.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud Apps (a CASB for cloud app activity monitoring) with Defender for Office 365, which is specifically built to protect email traffic at the transport layer, including outbound anomaly detection.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Information Protection focuses on classifying, labeling, and encrypting data at rest or in transit, but it does not provide real-time detection or blocking of anomalous outbound email traffic. Option B is wrong because Microsoft Defender for Cloud Apps is a CASB that monitors cloud app usage and can detect anomalous behavior, but it is not designed to inspect and block outbound email traffic in real time at the email transport layer. Option D is wrong because Microsoft Sentinel is a SIEM/SOAR solution that aggregates and analyzes security logs for threat detection and response, but it does not natively perform real-time email traffic inspection or blocking at the mail flow level.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Design solutions that align with security best practices and priorities questions.

Start 20-question session