Select Two (Multi-Select) Questions

Microsoft Purview External Identities

Why wrong: External Identities is for B2B collaboration, not data classification.

Microsoft Purview Compliance Manager

Why wrong: Compliance Manager helps manage compliance activities, not data scanning.

Manual labeling by users

Why wrong: Manual labeling is not automatic.

File plan (for records management)

Why wrong: File plan is for retention, not automatic labeling.

Identity protection and risk detection

Why wrong: Identity Protection is in Entra ID.

Endpoint detection and response

Why wrong: EDR is part of Defender for Endpoint.

Advanced eDiscovery

Why wrong: Used for legal investigation, not ongoing data security compliance.

Data Lifecycle Management (retention policies)

Why wrong: Important for governance but not a direct security control for CCPA/GDPR.

Ensure that 'TDE' is enabled for SQL Server VMs

Why wrong: This policy applies to SQL Server on VMs, not Azure SQL Database.

Audit SQL Server level audit setting

Why wrong: This policy is for SQL Server level, not Azure SQL Database.

Ensure secure transfer to storage accounts is enabled

Why wrong: This policy applies to storage accounts, not SQL Database.

Windows Autopilot deployment profile

Why wrong: Autopilot is for initial provisioning.

Configuration profile in Intune

Why wrong: Configuration profiles configure device settings, not compliance.

Trust all traffic originating from within the corporate network.

Why wrong: Zero Trust assumes no implicit trust, even inside the network.

Provide implicit trust to known users and devices.

Why wrong: Zero Trust requires continuous verification, not implicit trust.

Microsoft Sentinel deployment

Why wrong: Microsoft Sentinel is a SIEM tool; its deployment is an implementation detail, not a component of the strategy.

Policy and standards development

Why wrong: Policy development is part of governance, not the core security operations strategy components.

Apply a network security group (NSG) to the App Service subnet

Why wrong: Network security groups are for virtual networks, not for App Service access control. They do not handle authentication or MFA requirements.

Deploy Azure Firewall to filter inbound traffic

Why wrong: Azure Firewall is for network traffic filtering, not for user authentication or MFA enforcement.

Register the application in Microsoft Entra ID

Why wrong: Registering the application in Microsoft Entra ID is part of the setup but not a direct component for enforcing MFA and IP restrictions.

Manually remediate all high-severity recommendations each month.

Why wrong: Manual remediation is not efficient; automatic remediation should be used where possible.

Disable recommendations that are not applicable to the environment.

Why wrong: Disabling recommendations is not recommended; use exemptions instead.

Email protection against phishing and malware.

Why wrong: Email protection is from Defender for Office 365.

Endpoint detection and response (EDR) for devices.

Why wrong: EDR is from Defender for Endpoint.

File integrity changes on domain controllers

Why wrong: File integrity monitoring is not a primary Defender for Identity feature.

Network traffic to external IP addresses

Why wrong: Network traffic monitoring is outside Defender for Identity scope.

Configure a Microsoft Sentinel analytics rule that queries audit logs for external sharing of labeled documents and generates an incident.

Why wrong: A Microsoft Sentinel analytics rule can only alert on external sharing events that have already occurred and been written to audit logs; it is a reactive detection control, not a mechanism for applying sensitivity labels to documents. The rule would require an already-applied 'Confidential' label and an existing sharing event, so it fails to address the requirement to automatically classify content containing credit card numbers. Auto-labeling, by contrast, inspects content at creation or modification time and assigns the label proactively.

Create a Conditional Access policy in Microsoft Entra ID that requires device compliance when accessing documents labeled 'Confidential'.

Why wrong: A Conditional Access policy in Microsoft Entra ID enforces access conditions (such as device compliance) when users attempt to access a labeled document, but it does not apply labels to files nor does it alert on external sharing. Since the label must already be present on the document, this option is orthogonal to the stated requirement of automatic classification based on credit card numbers. Conditional Access governs authentication and access context, not content inspection or label assignment.

Configure a Microsoft Purview Data Loss Prevention (DLP) policy that blocks the sharing of documents containing credit card numbers.

Why wrong: A Microsoft Purview Data Loss Prevention (DLP) policy can block the sharing of content that matches a sensitive info type like credit card numbers, but it does not apply sensitivity labels to that content. DLP is a separate protection control that makes decisions based on content inspection and policies, whereas auto-labeling is specifically designed to assign classification metadata (labels) based on the same types of matching. These two features complement each other, but only auto-labeling fulfills the requirement to label the documents.

Azure AD Application Proxy

Why wrong: Application Proxy is for publishing on-premises apps, not device compliance.

Azure AD B2B collaboration

Why wrong: B2B is for external user identities, not device management.

Configure Microsoft Intune device compliance policies

Why wrong: Intune policies are for device management.

Deploy Azure Information Protection scanner

Why wrong: Scanner is for on-premises data classification.

Synchronize with Microsoft Entra ID

Why wrong: Synchronization is automatic; not a configuration.

Microsoft Defender for Cloud alerts

Why wrong: Alerts may indicate security incidents, but for detailed detection, raw logs are needed.

Azure AD sign-in logs

Why wrong: Show user login events, not database-specific activities.

Enable single sign-on for all applications

Why wrong: SSO is about convenience, not zero-trust.

Implement passwordless authentication for all users

Why wrong: Passwordless is good but not a required zero-trust action.

Synchronize all on-premises identities to the cloud

Why wrong: Synchronization is unrelated to zero-trust.

ExpressRoute circuit

Why wrong: An ExpressRoute circuit is incorrect because it provides a dedicated private connection to Azure via a service provider, not an internet-based IPsec VPN. It is an alternative hybrid connectivity option, not a component of a site-to-site VPN design. Including ExpressRoute would require a completely different set of resources (e.g., a virtual network gateway with ExpressRoute-type, circuits, and provider configurations), so it does not belong in this list of required VPN components.

VPN gateway (route-based)

Why wrong: A route-based VPN gateway is a type of virtual network gateway, not a separate Azure resource. The question already includes 'virtual network gateway' as a required component; adding 'VPN gateway (route-based)' would be redundant because the virtual network gateway is the actual resource that is configured as route-based (or policy-based). In practice, you deploy one virtual network gateway, and its type (route-based or policy-based) is a property, not an additional component, so this option is incorrect as a distinct requirement.

Data Loss Prevention (DLP) policies

Why wrong: Microsoft Purview Data Loss Prevention policies monitor and protect sensitive data from unauthorized exposure across Exchange, SharePoint, OneDrive, Teams, and supported endpoints through rules that block, restrict, or alert on content. These policies rely on existing classification results, and natively they do not scan Azure Blob Storage or assign new classification metadata to assets. Using DLP alone would miss the required data classification and inventory baseline.

Information Barriers

Why wrong: Information Barriers are designed to prevent communication and collaboration between defined user groups, such as restricting traders from sharing chats or documents with banking analysts. They operate as access-control and communication policies in Teams/SharePoint, not as content-inspection or data-classification mechanisms. Consequently, they cannot identify, label, or categorize sensitive data and would not satisfy a data classification strategy.

Azure Policy

Why wrong: Azure Policy enforces organizational governance by evaluating Azure resource configurations against rules, such as denying storage accounts without encryption or requiring specific tags. It operates at the control-plane and resource-property level and cannot inspect file or blob content for sensitive data. Therefore, Azure Policy supports compliance but is not a data-classification solution.

Require passcode

Why wrong: Requiring a passcode mandates that users authenticate with a PIN or password to unlock their device, but this check says nothing about the operating system version or whether the device has been jailbroken. A jailbroken device can still comply with a passcode requirement, so this setting does not address the security risks posed by root privilege escalation or outdated OS builds. In Intune, passcode policies are a baseline device configuration control, not a signal of device integrity or OS patch level.

Device encryption

Why wrong: Device encryption verifies that data stored on the device is unreadable without the correct key, typically using technologies like BitLocker, FileVault, or Android full-disk encryption. This check confirms that data-at-rest is protected, but it does not evaluate the OS version or identify unauthorized root or jailbreak modifications. A jailbroken device can still have encryption enabled, so this setting fails to block devices that have been compromised through privilege escalation.