1250 questions total · 17pages · All types, answers revealed
Match each security control type to its example.
Drag a concept onto its matching description — or click a concept then click the description.
Warning signs or security policies
Firewall rules blocking unauthorized access
Intrusion detection system alerts
Patching a vulnerability after discovery
Requiring strong passwords via policy
A company uses Microsoft 365 and wants to deploy a security solution that can automatically detect and remediate advanced attacks on endpoints (workstations and servers), such as ransomware and fileless attacks. They also want to provide incident response teams with detailed forensic data and the ability to isolate an infected machine from the network. Which Microsoft security solution should they use?
Microsoft Defender for Endpoint is a comprehensive enterprise endpoint security platform designed to protect devices from advanced threats. It offers Endpoint Detection and Response (EDR) capabilities, next-generation protection, attack surface reduction, and automated investigation and remediation. This solution actively monitors endpoints for malicious activity, isolates compromised devices, and provides a unified view of security incidents across an organization's device fleet, making it ideal for endpoint deployment.
Why this answer
Microsoft Defender for Endpoint (MDE) is the correct solution because it provides endpoint detection and response (EDR) capabilities, including automatic detection and remediation of advanced attacks like ransomware and fileless attacks. It also offers detailed forensic data for incident response and the ability to isolate an infected machine from the network, meeting all the specified requirements.
Exam trap
The trap here is that candidates confuse the endpoint-focused capabilities of Microsoft Defender for Endpoint with the email/identity/cloud-specific scopes of the other Defender products, failing to recognize that only MDE provides automated endpoint remediation and network isolation for workstations and servers.
How to eliminate wrong answers
Option A is wrong because Microsoft Defender for Office 365 focuses on protecting email, SharePoint, and Teams from threats like phishing and malware, not on endpoint-level attacks or machine isolation. Option C is wrong because Microsoft Defender for Identity monitors on-premises Active Directory and cloud identities for compromised credentials and lateral movement, but does not provide endpoint detection, forensic data, or network isolation for workstations and servers. Option D is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that governs and protects cloud applications, not endpoints; it cannot detect fileless attacks on workstations or isolate machines from the network.
Your organization wants to ensure that only users with a specific sensitivity label can access a SharePoint site. Which Microsoft Purview feature should you configure?
Microsoft Purview Information Protection (MPIP) enables organizations to classify and protect sensitive data using sensitivity labels. These labels can be applied to documents, emails, and, critically, to SharePoint sites and Microsoft 365 Groups. When a sensitivity label is applied to a SharePoint site, it can enforce specific access controls, such as external sharing settings, unmanaged device access restrictions, and integrate with Azure AD Conditional Access policies to ensure only authorized users, under specific conditions, can access the site. This directly addresses controlling access based on sensitivity labels.
Why this answer
Microsoft Purview Information Protection allows you to apply sensitivity labels to content, and these labels can be used to control access to SharePoint sites via conditional access policies. Option A is wrong because Insider Risk Management focuses on detecting risky activities, not on label-based access control. Option B is wrong because Communication Compliance monitors communications for policy violations.
Option C is wrong because Data Lifecycle Management focuses on retention and deletion, not access control.
Your company uses Microsoft Entra ID to manage user identities. You need to ensure that users can sign in using their existing social media accounts. Which Microsoft Entra feature should you configure?
Microsoft Entra External ID is the comprehensive solution for managing all external identities, including customers, partners, and citizens, across various applications. It specifically supports integrating social identity providers like Google, Facebook, and Microsoft accounts, as well as enterprise identity providers, allowing users to sign in to your applications using their existing credentials. This capability is crucial for consumer-facing applications that require flexible and convenient sign-up and sign-in experiences without creating new accounts.
Why this answer
Microsoft Entra External ID (formerly Azure AD B2C) is the correct feature because it is specifically designed to enable external identities, including social identity providers like Google, Facebook, and Microsoft accounts, for customer-facing applications. It supports standards such as OAuth 2.0 and OpenID Connect to allow users to sign in with their existing social media accounts without needing a separate Microsoft Entra ID account.
Exam trap
The trap here is that candidates often confuse Microsoft Entra B2B collaboration (for business partners) with Microsoft Entra External ID (for customers/consumers), mistakenly thinking B2B can also handle social identity providers, but B2B only supports organizational accounts (e.g., work/school) and not social logins.
How to eliminate wrong answers
Option B is wrong because Microsoft Entra B2B collaboration is designed for business-to-business scenarios, allowing external business partners to access your organization's resources using their own corporate identities, not for consumers signing in with social media accounts. Option C is wrong because Conditional Access policies are used to enforce access controls (e.g., MFA, location) after authentication, not to configure identity providers or enable social sign-in. Option D is wrong because Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles within Microsoft Entra ID, and has no role in configuring external or social identity providers.
Which THREE Microsoft Purview solutions help protect sensitive data in Microsoft 365? (Choose three.)
Microsoft Purview Data Loss Prevention (DLP) actively identifies, monitors, and protects sensitive information across endpoints, cloud applications, and on-premises repositories. It enforces policies to prevent the unauthorized sharing, transfer, or exfiltration of sensitive data, whether accidental or malicious, by detecting specific content and context and blocking or auditing the action. This proactive approach is fundamental to safeguarding an organization's critical information assets.
Why this answer
Data Loss Prevention (DLP) is correct because it identifies, monitors, and automatically protects sensitive data across Exchange Online, SharePoint, OneDrive, and Teams by applying policies that block or warn users when sensitive content (e.g., credit card numbers or PII) is shared inappropriately. It uses deep content analysis, including keyword matches, regex patterns, and machine learning classifiers, to enforce protection actions.
Exam trap
The trap here is that candidates confuse Audit and eDiscovery as protective solutions because they are part of the Microsoft Purview compliance portal, but they are detective and investigative tools, not preventive controls like DLP, Information Protection, or Insider Risk Management.
Your organization uses Microsoft Sentinel. You need to create an analytics rule that triggers an incident when more than 10 failed sign-ins occur from a single IP address within 5 minutes. Which rule type should you use?
Correct: Scheduled rules allow aggregation (e.g., count>10) over time windows.
Why this answer
A scheduled query rule is correct because it allows you to define a KQL query that counts failed sign-ins per IP address over a 5-minute window and triggers an incident when the count exceeds 10. This rule type supports custom aggregation and threshold-based alerting, which is exactly what the requirement specifies.
Exam trap
The trap here is that candidates confuse NRT rules with scheduled queries, assuming NRT means 'real-time thresholding,' but NRT rules cannot perform multi-minute aggregations and are limited to single-event or simple pattern matching.
How to eliminate wrong answers
Option A is wrong because Fusion rules use machine learning to correlate multiple alerts into a single incident, not to trigger on a simple threshold of failed sign-ins from a single IP. Option C is wrong because Near-real-time (NRT) rules run queries every minute with a 1-minute lookback, but they cannot aggregate over a 5-minute window; they are designed for low-latency, single-event detection. Option D is wrong because ML Behavior Analytics rules use machine learning to detect anomalous patterns over time, not a fixed numeric threshold like 10 failed sign-ins within 5 minutes.
Your organization uses Microsoft Entra ID for identity management. You need to implement a solution that allows external partners to access resources using their own identity provider. Which Microsoft Entra feature should you use?
External ID enables external collaboration with self-service sign-up and support for external identity providers.
Why this answer
Microsoft Entra External ID (formerly Azure AD B2B) allows external partners to access your organization's resources using their own identity providers, enabling secure collaboration without managing external identities. Option A is incorrect because Microsoft Entra Permissions Management is a cloud infrastructure entitlement management (CIEM) solution for multi-cloud permissions. Option B is incorrect because Microsoft Entra Verified ID is a verifiable credentials solution for decentralized identity verification.
Option C is incorrect because Entra ID Governance focuses on identity lifecycle management, access reviews, and entitlement management.
A company uses Microsoft Purview to classify and protect data. They need to ensure that when a user attempts to share a file containing a credit card number externally, the file is blocked and the user is prompted with a policy tip. Which type of Microsoft Purview policy should they configure?
A Data Loss Prevention (DLP) policy is specifically engineered to identify, monitor, and automatically protect sensitive information across various locations and sharing scenarios. It leverages sensitive information types (SITs) to detect specific content patterns, such as credit card numbers, within documents or emails. Upon detection, a DLP policy can be configured to block external sharing in real-time, notify administrators, and provide policy tips to users, directly addressing the need to prevent sensitive data from leaving the organization.
Why this answer
DLP policies can detect sensitive data like credit card numbers and enforce actions such as blocking sharing with a policy tip. Sensitivity labels require manual application or auto-labeling, but the block action is defined by DLP. Insider Risk Management focuses on risky user activities.
Refer to the exhibit. The Conditional Access policy shown is applied to all users accessing Office 365. A user with a compliant device but no MFA registered attempts to access Exchange Online. What will happen?
This policy explicitly requires both multi-factor authentication (MFA) and a compliant device as grant controls. For access to be permitted, all specified grant controls must be satisfied simultaneously. Since the user has not registered for MFA, this critical requirement is not met, leading to the conditional access policy blocking the access attempt.
Why this answer
The Conditional Access policy requires MFA registration for all users accessing Office 365 cloud apps. Since the user has not registered MFA, the policy's grant control (Require MFA registration) is not satisfied, and the policy blocks access. The device compliance status is irrelevant because the policy does not include device compliance as a grant control.
Exam trap
The trap here is that candidates assume a compliant device automatically satisfies Conditional Access policies, but the policy explicitly requires MFA registration, and device compliance is irrelevant unless included as a grant control.
How to eliminate wrong answers
Option B is wrong because Exchange Online is included under Office 365 in the Conditional Access policy's cloud apps assignment, so the policy applies to Exchange Online access. Option C is wrong because the policy does not grant access with an MFA registration prompt; it blocks access when the MFA registration requirement is not met. Option D is wrong because the policy does not have a 'Require compliant device' grant control, so device compliance alone does not satisfy the policy's requirements.
Your organization uses Microsoft Purview eDiscovery to manage legal holds. You need to place a hold on mailboxes and OneDrive accounts for a specific user who is involved in a litigation. Which eDiscovery solution should you use?
eDiscovery (Standard) can place holds on Exchange mailboxes and OneDrive accounts.
Why this answer
eDiscovery (Standard) is the correct solution because it is designed specifically for legal hold management, allowing you to place a hold on content locations such as mailboxes and OneDrive accounts for a specific user involved in litigation. This hold preserves all content in those locations, including deleted items and versions, until the hold is released. Audit, Communication Compliance, and Content search do not provide the legal hold functionality required for this scenario.
Exam trap
The trap here is that candidates often confuse Content search with eDiscovery (Standard) because both involve searching content, but Content search lacks the legal hold capability that is explicitly required for litigation holds.
How to eliminate wrong answers
Option A is wrong because Audit in Microsoft Purview is used for logging and reviewing user and admin activities, not for placing legal holds on content. Option B is wrong because Communication Compliance is designed to detect and manage inappropriate communications (e.g., harassment, sensitive info), not to place holds for litigation. Option C is wrong because Content search is used to search for content across Exchange, SharePoint, and OneDrive, but it does not have the capability to place a hold on content locations; it is a search-only tool.
A security administrator needs to block legacy authentication protocols across all applications in Microsoft Entra ID. Which conditional access policy setting should they configure?
Under 'Conditions', configuring 'Client apps' allows administrators to target specific client applications and authentication protocols. By selecting 'Other clients' (which includes clients using legacy authentication protocols like Exchange ActiveSync, POP, IMAP, and older Office clients), and then applying a 'Block' grant control, the policy effectively prevents sign-ins from these legacy methods. This precisely addresses the requirement to block legacy authentication without impacting modern authentication flows.
Why this answer
Legacy authentication protocols (such as POP3, IMAP4, SMTP, and older Office clients) do not support modern authentication methods like MFA or conditional access. By configuring the 'Client apps' condition in a Conditional Access policy to block legacy authentication, the administrator can prevent these insecure sign-in attempts across all applications in Microsoft Entra ID.
Exam trap
The trap here is that candidates may confuse 'Block access' under 'Grant' (which is a general block) with the specific condition needed to target legacy protocols, or they may think that location or sign-in frequency settings can address protocol-level restrictions.
How to eliminate wrong answers
Option A is wrong because 'Block access' under 'Grant' is a control that blocks all access after conditions are evaluated, but it does not specifically target legacy authentication protocols; it would block all users regardless of client type. Option B is wrong because configuring 'Locations' to block all locations would prevent sign-ins from any geographic location, which is unrelated to blocking legacy authentication protocols. Option C is wrong because setting 'Sign-in frequency' to 1 hour controls session lifetime and reauthentication prompts, not the type of authentication protocol used during sign-in.
A company uses Microsoft 365 and needs to comply with a regulatory requirement to retain all customer contracts for 5 years after the contract's end date, after which they must be automatically deleted. Additionally, the legal department needs the ability to preserve all documents related to an ongoing lawsuit, overriding any deletion timelines. Which Microsoft Purview solution should the company use?
Data Lifecycle Management (DLM) in Microsoft 365 utilizes retention labels to define how long content should be retained or deleted across various services, ensuring compliance with organizational policies and regulations. Concurrently, eDiscovery holds (also known as litigation holds) are specifically designed to preserve content indefinitely for legal proceedings, overriding any existing retention or deletion policies applied by retention labels. This combination effectively addresses both routine data retention and specific legal preservation requirements.
Why this answer
Data Lifecycle Management (DLM) with retention labels allows the company to apply a retention label to customer contracts that retains them for 5 years after the contract end date and then automatically deletes them. eDiscovery holds can be placed on all documents related to an ongoing lawsuit, which overrides any deletion timelines, ensuring that content is preserved until the hold is released. This combination directly meets both the regulatory retention and legal preservation requirements.
Exam trap
The trap here is that candidates may confuse eDiscovery holds with retention labels, thinking that retention labels alone can handle legal preservation, but they fail to recognize that eDiscovery holds are required to override deletion timelines for litigation purposes.
How to eliminate wrong answers
Option A is wrong because Information Barriers are used to prevent communication and collaboration between specific groups or users to avoid conflicts of interest, not to manage retention or legal holds. Option C is wrong because Communication Compliance is designed to detect and remediate inappropriate communications (e.g., harassment, insider trading) by analyzing messages, not to enforce retention schedules or preserve documents for litigation. Option D is wrong because Audit (Premium) provides detailed logging and investigation of user and admin activities, but it does not offer retention policies or the ability to override deletion with legal holds.
Which TWO Microsoft Entra features can be used together to enforce risk-based conditional access?
Microsoft Entra Conditional Access is a policy engine that evaluates conditions, including user and sign-in risk levels detected by Identity Protection, to enforce specific access controls. It allows administrators to define "if-then" statements, such as "if a user is signing in from a risky location, then block access or require multi-factor authentication." This direct integration makes it crucial for implementing risk-based access policies.
Why this answer
Conditional Access (B) is correct because it is the policy engine that enforces access decisions based on signals, including risk levels. Identity Protection (C) is correct because it detects and calculates user and sign-in risk in real time using machine learning. Together, Identity Protection provides the risk assessment, and Conditional Access enforces the policy (e.g., block or require MFA) based on that risk.
Exam trap
The trap here is that candidates often confuse Privileged Identity Management (PIM) with risk-based access, but PIM controls role activation, not risk evaluation, while Identity Protection is the dedicated risk detection service.
Fabrikam Inc. is a global manufacturing company that uses Microsoft Entra ID for identity management. They have recently experienced a security incident where an attacker compromised a user account and accessed sensitive intellectual property. The security team wants to implement identity protection measures to detect and respond to such attacks in the future. They need a solution that can automatically detect suspicious sign-in behavior, such as impossible travel and anomalous token issuance, and then take action to block the sign-in or require additional verification. Additionally, they want to integrate threat intelligence feeds to improve detection. Which Microsoft security solution should they use to meet these requirements?
Microsoft Entra ID Protection uses machine learning to detect risks like impossible travel and anomalous token issuance, and can automatically enforce policies such as requiring MFA or blocking sign-ins. It also integrates with threat intelligence feeds.
Why this answer
Microsoft Entra ID Protection uses machine learning to detect risks like impossible travel and anomalous token issuance, and can automatically enforce policies such as requiring MFA or blocking sign-ins. It also integrates with threat intelligence feeds. Option A is wrong because Microsoft Defender for Identity focuses on on-premises Active Directory, not cloud sign-ins.
Option C is wrong because Microsoft Sentinel is a SIEM, not an automated response tool for sign-in risks. Option D is wrong because Microsoft Defender for Cloud Apps is for cloud app discovery and control, not primarily for sign-in risk detection.
Which TWO of the following are Microsoft Entra ID editions that include Identity Protection? (Choose two.)
Microsoft Entra ID P2 is the premium edition that fully integrates Microsoft Entra Identity Protection, providing advanced capabilities for detecting, investigating, and remediating identity-based risks. This includes risk-based Conditional Access policies, automated remediation actions like requiring MFA or password resets, and comprehensive reporting on risky users and sign-ins. P2 also encompasses other advanced features such as Privileged Identity Management (PIM) and entitlement management.
Why this answer
Identity Protection is available in Azure AD Premium P2 and Microsoft Entra ID Governance (which includes P2 features). Free and P1 do not include Identity Protection.
A security analyst is explaining the core principles of information security to a new team member. Which principle ensures that data is not modified by unauthorized parties?
Integrity is the fundamental security principle that ensures data remains accurate, complete, and unaltered by unauthorized parties throughout its lifecycle. It guarantees that information has not been tampered with, either accidentally or maliciously, maintaining its trustworthiness and reliability. Mechanisms such as cryptographic hashing, digital signatures, and robust access controls are employed to detect or prevent unauthorized modifications, thereby preserving the validity and consistency of the data.
Why this answer
The principle of integrity ensures that data remains accurate and unaltered during storage, processing, or transmission, except by authorized entities. In the context of information security, integrity is specifically concerned with preventing unauthorized modification, deletion, or creation of data. This is often enforced through mechanisms such as hashing (e.g., SHA-256), digital signatures, and checksums (e.g., CRC32) that detect any tampering.
Exam trap
The trap here is that candidates often confuse integrity with confidentiality, mistakenly thinking that encryption (which protects confidentiality) also prevents modification, but encryption alone does not guarantee data has not been altered—integrity requires separate controls like hashing or digital signatures.
Why the other options are wrong
Confidentiality ensures data is accessible only to authorized users, but it does not prevent unauthorized modification; integrity is the principle that protects data from unauthorized alteration.
Availability ensures that data and systems are accessible when needed, but it does not protect against unauthorized modification. The principle that prevents data from being altered by unauthorized parties is integrity.
Non-repudiation ensures that a party cannot deny having performed an action (e.g., signing a document), not that data remains unmodified. The question asks about preventing unauthorized modification, which is integrity.
When would these options actually be correct?
A question asks: 'Which principle ensures that data is not disclosed to unauthorized individuals?' In that context, confidentiality is the correct answer.
In a scenario where a company experiences a DDoS attack that prevents users from accessing a critical application, the principle being compromised is availability. A question asking which principle ensures that systems are up and running when required would have availability as the correct answer.
A question asks: 'Which principle ensures that a sender cannot deny having sent a message?' In that context, non-repudiation is correct because it provides proof of origin or delivery.
Why candidates pick the wrong answer
Candidates may confuse confidentiality with integrity because both involve protecting data, but confidentiality focuses on secrecy, not on preventing changes.
Candidates may confuse availability with integrity because both are part of the CIA triad, and they might think that ensuring data is available also means it hasn't been tampered with, but availability focuses on access, not modification.
Candidates may confuse non-repudiation with integrity because both involve data authenticity, but non-repudiation focuses on accountability for actions, not data modification.
A company uses Microsoft Entra ID and Intune for device management. The security team wants to create a Conditional Access policy for a sensitive research application. They require that: 1) The user must use a device that is marked as compliant by Intune, and 2) The user must accept the company's terms of use before accessing the app. Which grant control combination should they configure in the policy?
This is the correct configuration because Microsoft Entra Conditional Access policies use 'Grant controls' to define the specific requirements for access. Selecting both 'Require device to be marked as compliant' (which leverages Intune's compliance policies) and 'Require terms of use' as grant controls, combined with the 'Require all the selected controls' operator, ensures that users must satisfy both prerequisites simultaneously to gain access to resources. This precisely fulfills the scenario's need for both device compliance and terms of use acceptance.
Why this answer
The policy requires both conditions—device compliance and terms of use—to be enforced simultaneously. In Microsoft Entra Conditional Access, when multiple grant controls are selected and set to 'Require all the selected controls', the user must satisfy every control to gain access. This matches the security team's requirement that the device must be compliant AND the terms of use must be accepted.
Exam trap
The trap here is that candidates often confuse 'Require one of the selected controls' with 'Require all the selected controls', mistakenly thinking that 'one of' is sufficient when the question explicitly states both conditions must be met.
Why the other options are wrong
The policy requires both device compliance and terms of use to be enforced simultaneously, so 'Require one of the selected controls' would allow access if only one condition is met, violating the requirement.
The policy requires both device compliance and terms of use, so 'Require all the selected controls' is needed. Option B incorrectly includes multi-factor authentication, which is not required, and uses 'Require one of the selected controls', which would allow bypassing one requirement.
Option D is wrong because it omits the 'Require device to be marked as compliant' grant control, which is explicitly required by the policy. Configuring device compliance as a condition only affects when the policy applies, not the grant requirements.
When would these options actually be correct?
In a scenario where the security team wants to allow access if the user either has a compliant device OR has accepted terms of use (e.g., for a less sensitive app where flexibility is acceptable), selecting 'Require one of the selected controls' would be correct.
In a scenario where the security team requires both multi-factor authentication and acceptance of terms of use, and both must be satisfied, selecting 'Require multi-factor authentication' and 'Require terms of use' with 'Require all the selected controls' would be correct.
Option D would be correct if the question asked for a policy that only requires terms of use acceptance, and device compliance is used as a condition to scope the policy (e.g., only apply to non-compliant devices) rather than as a grant control.
Why candidates pick the wrong answer
Candidates may confuse 'Require one of the selected controls' with 'Require all the selected controls', thinking it means at least one control is required, but it actually means only one of the selected controls needs to be satisfied.
Candidates may confuse multi-factor authentication with device compliance, or mistakenly think that 'Require one of the selected controls' is sufficient when multiple conditions are needed, due to misunderstanding of grant control logic.
Candidates may confuse the 'Conditions' section with 'Grant controls', thinking that setting device compliance as a condition satisfies the requirement, without realizing that grant controls enforce the actual access restrictions.
A company wants to securely grant external business partners access to internal SharePoint sites and Teams channels. The partners use various identity providers, including Google and Microsoft personal accounts. The company needs to manage these external identities in their Microsoft Entra ID directory and enforce access policies. Which Microsoft Entra capability should they use?
Microsoft Entra B2B collaboration is the correct solution for securely granting external business partners access to internal resources. This service enables organizations to invite external users, such as partners or vendors, to access specific applications and data within their Microsoft Entra tenant as guest users. It supports various identity providers, allowing partners to use their existing corporate or social credentials for authentication, thereby streamlining access while maintaining strong security controls over the shared resources.
Why this answer
Microsoft Entra B2B collaboration is designed to securely share applications and resources with external guest users from any identity provider, including Google and Microsoft personal accounts. It allows the company to manage these external identities in their Entra ID directory and enforce conditional access policies, meeting the requirement to grant partners access to SharePoint and Teams.
Exam trap
The trap here is confusing B2B collaboration (for business partners) with B2C (for customers), leading candidates to select B2C because it also supports external identities, but B2C is not designed for internal resource sharing like SharePoint or Teams.
How to eliminate wrong answers
Option B is wrong because Microsoft Entra B2C is a customer-facing identity management service for external customers, not for business partners, and it does not integrate with internal resources like SharePoint or Teams. Option C is wrong because Microsoft Entra Connect is used to synchronize on-premises Active Directory identities to the cloud, not to manage external partner identities. Option D is wrong because Microsoft Entra Identity Protection is a risk-detection and remediation tool for user accounts, not a solution for inviting or managing external identities.
Your company is adopting Microsoft Copilot for Microsoft 365 to improve productivity. The security team is concerned about data leakage, as Copilot can access emails, documents, and other content. You need to ensure that sensitive data, such as credit card numbers and social security numbers, is not inadvertently exposed by Copilot. The organization uses Microsoft Purview sensitivity labels and DLP. You need to configure a solution that automatically detects and prevents Copilot from accessing or generating content containing these sensitive data types. What should you do?
DLP can monitor and block Copilot interactions with sensitive data.
Why this answer
Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive data types (e.g., credit card numbers, social security numbers) and automatically block or warn when Copilot for Microsoft 365 attempts to access or generate content containing such data. Option A is incorrect because Microsoft Defender for Cloud Apps is designed to control cloud app usage, but it does not integrate directly with Copilot for content-level data loss prevention. Option B is incorrect because disabling Copilot for certain users is a blunt approach that impacts productivity and does not provide targeted protection against data leakage.
Option C is incorrect because while sensitivity labels help classify data, they alone do not prevent Copilot from accessing or generating sensitive content; DLP policies are required to enforce protection based on those labels.
Which Microsoft Entra ID feature allows an organization to provide external partners with access to its applications while maintaining control over authentication and governance?
Microsoft Entra External ID is the comprehensive solution specifically designed to manage identities for external users, enabling them to access your applications and resources securely. It supports Business-to-Business (B2B) collaboration for guest users and Business-to-Consumer (B2C) for customer-facing applications, offering features like self-service sign-up, custom branding, and integration with various social and enterprise identity providers.
Why this answer
Microsoft Entra External ID (including B2B collaboration) enables secure sharing of apps with external users. It allows the organization to manage identities and enforce policies like MFA for guests.
Your organization wants to enable passwordless authentication for users. Which Microsoft Entra ID feature should you use?
Passwordless authentication methods, including Windows Hello for Business, FIDO2 security keys, and the Microsoft Authenticator app, are the specific technologies that allow users to sign in without needing to type a password. These methods replace traditional passwords with more secure alternatives, significantly reducing the risk of phishing, credential stuffing, and brute-force attacks. Directly enabling and configuring these options within Microsoft Entra ID is the fundamental step to implement passwordless authentication for an organization's users.
Why this answer
Passwordless authentication methods is the correct feature because it is the specific Microsoft Entra ID capability that allows users to sign in without a password, using methods such as Windows Hello for Business, the Microsoft Authenticator app, FIDO2 security keys, or phone sign-in. This directly enables the organization's goal of passwordless authentication.
Exam trap
The trap here is that candidates may confuse Conditional Access (which can require passwordless methods as a grant control) with the actual feature that enables passwordless authentication, but Conditional Access only enforces policies, not the underlying authentication methods themselves.
How to eliminate wrong answers
Option A is wrong because Conditional Access is a policy engine that enforces access controls (e.g., requiring MFA or blocking sign-ins from untrusted locations) based on signals, but it does not itself provide or enable passwordless authentication methods. Option B is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role activation and access reviews for Azure AD roles and Azure resources, not passwordless sign-in capabilities. Option C is wrong because Identity Protection detects and remediates identity-based risks (e.g., leaked credentials, impossible travel) using risk policies, but it does not configure or offer passwordless authentication methods.
A financial services organization needs to automatically classify and protect sensitive documents containing credit card information in SharePoint Online and OneDrive for Business. They want a purple-colored label to be applied automatically when the document is saved, and the document should be encrypted with a predefined template that restricts editing to internal users only. Which Microsoft Purview solution should they configure?
Sensitivity labels, particularly when configured with auto-labeling policies, are specifically designed to automatically classify and apply protection to documents containing sensitive information types. These labels can enforce encryption, visual markings, and access restrictions directly on the content, ensuring data is protected both at rest and in transit, precisely meeting the requirement to automatically classify and encrypt documents.
Why this answer
Sensitivity labels with auto-labeling in Microsoft Purview can automatically apply a purple-colored label to documents containing credit card information when saved in SharePoint Online or OneDrive for Business. This label can be configured with encryption using a predefined template that restricts editing to internal users only, meeting the organization's classification and protection requirements.
Exam trap
The trap here is that candidates confuse DLP policies with sensitivity labels, but DLP policies only block or warn on sharing actions and do not apply persistent encryption or visual markings like labels.
How to eliminate wrong answers
Option B is wrong because Data Loss Prevention (DLP) policies detect and prevent accidental sharing of sensitive data but do not apply persistent labels or encryption to documents; they enforce rules at the point of sharing or use. Option C is wrong because Data Lifecycle Management (retention labels) manage retention and deletion of content, not classification or encryption based on sensitive data patterns. Option D is wrong because Audit (Unified Auditing) logs user and admin activities for compliance and investigation but does not classify, label, or encrypt documents automatically.
Your organization uses Microsoft Entra ID P1. You need to implement a solution that allows users to reset their own passwords without administrator intervention. The solution must also enforce a policy that requires users to verify their identity with two methods before resetting. What should you configure?
Enabling Microsoft Entra ID Self-Service Password Reset (SSPR) directly addresses the requirement for users to reset their forgotten passwords without administrator intervention. By configuring the number of authentication methods required to 2, the organization enhances the security of the reset process, ensuring that users provide multiple proofs of identity (e.g., mobile app notification and phone call) before gaining access. This feature is precisely designed for secure, user-initiated password recovery.
Why this answer
Self-service password reset (SSPR) in Microsoft Entra ID P1 allows users to reset their own passwords without administrator intervention. By configuring SSPR and setting the number of methods required to reset to 2, you enforce the policy that users must verify their identity with two authentication methods before resetting their password.
Exam trap
The trap here is that candidates often confuse Conditional Access MFA policies with SSPR's multi-method verification, not realizing that SSPR has its own separate configuration for the number of required verification methods, while Conditional Access policies apply to authentication events, not the password reset workflow.
How to eliminate wrong answers
Option A is wrong because Privileged Identity Management (PIM) is used for managing, controlling, and monitoring access to privileged roles, not for enabling self-service password reset or enforcing multi-method verification for password resets. Option B is wrong because Identity Protection user risk policies trigger automatic password resets based on detected user risk, but they do not allow users to initiate their own password resets without administrator intervention, nor do they enforce a specific number of verification methods for the reset process. Option C is wrong because a Conditional Access policy requiring MFA for password changes would force users to authenticate with MFA when changing their password, but it does not enable self-service password reset; it only secures the change action, not the reset flow, and does not configure the number of methods required for reset.
The exhibit shows a sign-in failure for John Doe. The admin wants to allow the sign-in while still enforcing MFA. What should the admin do?
This option correctly identifies that the sign-in failure for John Doe, an admin using Azure PowerShell, is likely due to a Conditional Access policy requiring Multi-Factor Authentication (MFA) that the client cannot satisfy. Azure PowerShell, especially older versions or specific cmdlets, may not fully support modern authentication flows required for MFA. Modifying the policy to either exclude this specific application from the MFA requirement or ensuring the client is updated and configured to properly handle MFA challenges would resolve the access issue while maintaining overall security for other access methods.
Why this answer
The sign-in failure is likely caused by a Conditional Access policy that blocks legacy authentication protocols like Azure PowerShell, which do not support MFA natively. Option A is correct because modifying the policy to exclude Azure PowerShell or to require MFA for that client app allows the sign-in while still enforcing MFA for other protocols. This ensures the user can authenticate using a modern authentication flow that supports MFA.
Exam trap
The trap here is that candidates may think resetting the password or disabling MFA is the quick fix, but the core issue is that the Conditional Access policy is blocking a client that cannot perform MFA, not that the user's credentials or license are invalid.
How to eliminate wrong answers
Option B is wrong because disabling MFA for the user removes the security requirement entirely, contradicting the admin's goal to still enforce MFA. Option C is wrong because assigning a Microsoft Entra ID P2 license provides advanced features like Identity Protection and Privileged Identity Management, but it does not directly resolve a sign-in failure caused by a Conditional Access policy blocking a non-MFA-capable client. Option D is wrong because resetting the user's password does not address the underlying policy that blocks the sign-in; the failure is due to the client app not supporting MFA, not due to incorrect credentials.
A company uses a third-party SaaS project management application. The security team wants to monitor and control user sessions when employees access the application from personal, unmanaged devices. Specifically, they want to block the download of files to local drives and display a warning message to the user if they attempt to download. Which Microsoft security solution should they deploy?
Correct. Defender for Cloud Apps with Conditional Access App Control provides session-level monitoring and control for SaaS apps, enabling actions like blocking downloads.
Why this answer
Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) is the correct solution because it provides session-level controls via Conditional Access App Control. This allows the security team to monitor and control user sessions in real-time, including blocking file downloads to unmanaged devices and displaying custom warning messages, by proxying the SaaS application traffic through Defender for Cloud Apps.
Exam trap
The trap here is that candidates often confuse Microsoft Defender for Cloud Apps with Microsoft Defender for Office 365, assuming all SaaS app protection falls under Office 365, but Defender for Cloud Apps is the cross-SaaS session control solution.
Why the other options are wrong
Microsoft Defender for Endpoint focuses on endpoint protection (antivirus, EDR) and does not provide session-level control or conditional access policies for SaaS applications like blocking downloads from unmanaged devices.
Microsoft Defender for Office 365 focuses on protecting email and collaboration tools like Exchange, SharePoint, and Teams, not on monitoring and controlling user sessions for third-party SaaS applications accessed from personal devices.
Microsoft Defender for Identity focuses on detecting and investigating advanced attacks on on-premises Active Directory, not on controlling user sessions or file downloads in third-party SaaS applications.
When would these options actually be correct?
An exam scenario where a company needs to detect, investigate, and respond to advanced threats on endpoints (e.g., malware, ransomware) and requires endpoint detection and response (EDR) capabilities would make Defender for Endpoint the correct answer.
A company wants to protect against malicious links and attachments in emails and block zero-day threats in Office 365 apps. Deploying Microsoft Defender for Office 365 would be correct.
An exam question describing a scenario where the security team needs to monitor and protect on-premises Active Directory user accounts and detect identity-based attacks (e.g., pass-the-hash, kerberoasting) would make Defender for Identity the correct answer.
Why candidates pick the wrong answer
Candidates may confuse endpoint security with cloud app security, assuming that controlling user sessions on personal devices falls under endpoint protection rather than cloud access security broker (CASB) functionality.
Candidates may confuse SaaS application security with Office 365 security, assuming that all cloud app protection falls under Office 365, or they may think the warning message feature is part of Office 365's data loss prevention capabilities.
Candidates may confuse identity protection with cloud app session control, assuming that monitoring user sessions implies an identity-focused solution, but Defender for Identity does not provide conditional access or session policies for SaaS apps.
According to the Zero Trust security model, which principle assumes that a breach has already occurred and therefore requires segmenting access and monitoring for lateral movement?
The 'Assume breach' principle is foundational to the Zero Trust security model, asserting that an organization's network and all its components should be treated as if they are already compromised, regardless of their location or previous security posture. This paradigm shift eliminates implicit trust and drives security strategies such as micro-segmentation, continuous monitoring, and robust incident response planning. It directly addresses the question by embodying the core idea that no user, device, or application can be inherently trusted, and therefore, defenses must be built with a breach in mind.
Why this answer
The 'Assume breach' principle of the Zero Trust security model explicitly operates under the mindset that a breach has already occurred or is inevitable. This drives the need for segmenting access (e.g., micro-segmentation using network policies or Azure Virtual Network security groups) and continuous monitoring for lateral movement (e.g., using Microsoft Defender for Identity to detect pass-the-hash or Kerberos ticket attacks).
Exam trap
Microsoft often tests the distinction between 'Assume breach' and 'Verify explicitly' by presenting a scenario where a candidate might confuse the proactive verification of every request with the reactive assumption that a breach has already occurred, leading them to incorrectly select 'Verify explicitly' when the question specifically asks about segmentation and lateral movement monitoring.
How to eliminate wrong answers
Option A is wrong because 'Verify explicitly' mandates that every access request must be authenticated and authorized based on all available data points (e.g., user identity, device health, location), but it does not inherently assume a breach has occurred or drive segmentation for lateral movement. Option B is wrong because 'Use least privilege' ensures users and services have only the minimum permissions needed to perform their tasks (e.g., via Azure RBAC or Privileged Identity Management), but it is a principle of access control, not a breach assumption that triggers segmentation and lateral movement monitoring. Option D is wrong because 'Trust but verify' is an outdated model that assumes internal network trust, which contradicts Zero Trust's core premise of never trusting any entity by default; it does not assume a breach has already happened.
Which THREE are features of Microsoft Purview Data Lifecycle Management (formerly Records Management)? (Choose three.)
Microsoft Purview retention policies are a core feature of Data Lifecycle Management, enabling organizations to proactively manage content across various locations like Exchange mailboxes, SharePoint sites, OneDrive accounts, and Microsoft 365 Groups. These policies apply retention settings at a broad, container level, ensuring that all content within a specified location is either retained for a minimum period or deleted after a certain time, or both, to meet compliance and regulatory requirements. They are crucial for enforcing consistent data governance across the enterprise.
Why this answer
Retention policies are a core feature of Microsoft Purview Data Lifecycle Management because they allow administrators to apply retention settings at the container level (e.g., entire SharePoint site, Exchange mailbox, or OneDrive account) to automatically retain or delete content based on a defined schedule. This ensures that organizational data is kept for the required period and then removed, supporting compliance and governance requirements without manual intervention.
Exam trap
The trap here is that candidates often confuse the features of Microsoft Purview Data Lifecycle Management (retention policies, retention labels, disposition review) with those of Information Protection (sensitivity labels) or Data Loss Prevention, leading them to incorrectly select DLP or sensitivity labels as lifecycle management features.
Your organization is using Microsoft Entra ID and has deployed Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with Intune policies can access corporate email via Microsoft Outlook for iOS and Android. Additionally, you need to prevent users from copying corporate data to personal apps on the same device. Which two Microsoft Entra features should you combine?
A Conditional Access policy requiring a compliant device ensures that only devices meeting specific security baselines, as defined and monitored by Microsoft Intune, can access corporate resources. This enforces device health and configuration, ensuring the device adheres to organizational security standards. Microsoft Intune App Protection Policies (MAM) provide a crucial layer of data protection within applications, preventing corporate data from being copied, pasted, or saved to unmanaged applications or personal storage locations, even on unmanaged devices. Together, these policies establish both device-level security posture and application-level data leakage prevention, directly addressing the need to protect data and enforce compliance.
Why this answer
It combines a Conditional Access policy that requires a compliant device (enforced by Intune) with an Intune app protection policy (MAM) that prevents copying corporate data to unmanaged apps. This meets both requirements. Option A is incorrect because Windows Autopilot is for provisioning, not compliance enforcement.
Option B is incorrect because MFA and Windows Hello for Business do not control device compliance or data leakage. Option C is incorrect because requiring an approved client app alone does not enforce device compliance, and Azure AD Application Proxy is for remote access to on-premises apps, not data protection.
Refer to the exhibit. A Microsoft Purview DLP policy is configured as shown. What will happen when a user tries to email an external recipient a document containing a credit card number?
The policy includes BlockAccess and NotifyUser actions.
Why this answer
The DLP policy is configured with the action 'Block' and the user notification is enabled. When a user attempts to email a document containing a credit card number to an external recipient, the policy blocks the email from being sent and displays a notification to the user explaining the policy violation. This is the default behavior for a 'Block' action with user notification in Microsoft Purview DLP.
Exam trap
The trap here is that candidates often confuse the 'Block' action with 'Block with override' or assume that DLP policies only log events without blocking, leading them to choose Option D or Option C.
How to eliminate wrong answers
Option A is wrong because the DLP policy action is set to 'Block', not 'Remove attachment'; removing the attachment would require a specific 'Remove' action, which is not configured here. Option C is wrong because the policy does not have an 'Admin alert' action configured; while admin alerts can be added as an optional action, they are not enabled in this exhibit, so the email will not be delivered. Option D is wrong because while the event may be logged for audit if auditing is enabled, the primary action is to block the email, not to allow it to be sent; the policy explicitly blocks the email, so it cannot be sent.
A company has deployed Microsoft Defender for Identity and wants to detect pass-the-hash attacks in real time. Which alert type should they monitor?
A Suspected Pass-the-Hash (PtH) attack involves an attacker authenticating to a remote system or service by directly using a user's NTLM hash, without ever needing to know the plaintext password. Microsoft Defender for Identity excels at detecting PtH by analyzing NTLM authentication traffic for anomalies, such as a user authenticating from a new source IP address or to a resource without a corresponding Kerberos pre-authentication. This technique bypasses traditional password-based authentication mechanisms, making it a critical threat for MDI to identify.
Why this answer
Microsoft Defender for Identity specifically detects pass-the-hash attacks by monitoring anomalous NTLM authentication patterns, such as the use of hashed credentials from one machine to authenticate to another. The 'Suspected Pass-the-Hash attack' alert is triggered when Defender for Identity identifies a hash being reused across multiple devices in a way that indicates lateral movement, which is the core behavior of a pass-the-hash attack.
Exam trap
The trap here is that candidates often confuse pass-the-hash with Kerberoasting or Golden Ticket attacks, but the key differentiator is that pass-the-hash relies on NTLM hash reuse in real time, while the others involve Kerberos ticket manipulation or offline cracking.
How to eliminate wrong answers
Option A is wrong because a suspected Kerberoasting attack involves requesting Kerberos service tickets (TGS) for service accounts to crack their passwords offline, not real-time hash reuse. Option B is wrong because a suspected Brute Force attack involves repeated failed login attempts against a single account or endpoint, not the reuse of captured password hashes. Option D is wrong because a suspected Golden Ticket attack involves forging a Kerberos Ticket Granting Ticket (TGT) using the KRBTGT account hash, not the real-time reuse of NTLM hashes.
Refer to the exhibit. A security analyst runs this Microsoft Graph PowerShell command. What is the most likely purpose of this command?
The filter filters users with userPrincipalName starting with 'j'.
Why this answer
The command uses the Get-MgUser cmdlet with a -Filter parameter to retrieve users whose userPrincipalName starts with 'j'. The -Select parameter limits the output to specific properties. Therefore, option A correctly identifies the purpose.
Option B is incorrect because no update operations (e.g., Update-MgUser) are used. Option C is incorrect because no removal operations (e.g., Remove-MgUser) are used. Option D is incorrect because the command filters by userPrincipalName and does not display group membership.
A company wants to automatically detect emails in Exchange Online that contain credit card numbers and apply encryption to those emails before they are sent. Which Microsoft Purview solution should the administrator configure?
Data Loss Prevention (DLP) policies are specifically engineered to inspect content in real-time for sensitive information types (SITs), such as credit card numbers or national ID numbers, across various locations including Exchange Online. When a policy match is detected in an outgoing email, DLP can automatically enforce protective actions like blocking the email, notifying administrators, or applying encryption to prevent unauthorized disclosure of sensitive data in transit. This makes DLP the direct solution for automatically detecting and encrypting emails containing sensitive information.
Why this answer
Data Loss Prevention (DLP) in Microsoft Purview is specifically designed to detect sensitive information such as credit card numbers in emails and automatically apply protective actions like encryption. DLP policies can scan Exchange Online messages in transit and enforce rules to encrypt the email before it is sent, which directly meets the requirement.
Exam trap
The trap here is that candidates often confuse sensitivity labels (which can also apply encryption) with DLP, but sensitivity labels require manual or automatic classification based on label policies, not real-time content scanning of specific sensitive data patterns like credit card numbers in transit.
How to eliminate wrong answers
Option A is wrong because Information Protection (sensitivity labels) is used to classify and protect documents and emails based on manual or automatic labeling, but it does not natively scan for specific sensitive data patterns like credit card numbers and automatically trigger encryption on outbound emails. Option C is wrong because Data Lifecycle Management focuses on retaining, deleting, or archiving data based on age or policy, not on detecting sensitive content in transit and applying encryption. Option D is wrong because eDiscovery is used for searching and exporting content for legal or investigative purposes, not for real-time detection and protection of sensitive data in email flow.
A compliance officer wants to automatically classify emails containing credit card numbers as 'Highly Confidential' and apply encryption. Which Microsoft Purview feature should be used?
Microsoft Purview Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and protect sensitive information across various locations, including email communications. DLP policies leverage sensitive information types (SITs) to detect specific content patterns, such as credit card numbers, and can then automatically apply actions like blocking the email, notifying users, or applying encryption (often via sensitivity labels) to ensure compliance and prevent unauthorized sharing.
Why this answer
Microsoft Purview Data Loss Prevention (DLP) policies are designed to detect sensitive information such as credit card numbers and automatically apply protective actions like encryption. Option A is incorrect because sensitivity labels are classification tools that can be applied manually or automatically via DLP, but the automation of encryption based on content is a DLP capability. Option B is incorrect because retention labels are used for data retention and deletion policies, not for encryption.
Option C is incorrect because eDiscovery is used for searching and exporting data for legal or investigative purposes, not for automatic classification and encryption.
Which TWO capabilities are part of Microsoft Entra ID Governance?
Microsoft Entra Entitlement Management is a robust identity governance feature that automates the lifecycle of access requests and approvals for internal and external users. It allows organizations to define access packages, which bundle resources and policies, enabling self-service access requests and ensuring users have appropriate permissions based on their role or project. This capability streamlines the process of granting and revoking access, reducing manual overhead and improving security posture.
Why this answer
Entitlement Management is a core capability of Microsoft Entra ID Governance because it enables organizations to manage the lifecycle of access for internal and external users through access packages, catalogs, and policies. It automates the request, approval, and assignment of access to groups, apps, and SharePoint sites, ensuring governance over who gets what and for how long. Access Reviews is also a key governance feature because it allows administrators to periodically review and certify user access, automatically removing stale or inappropriate permissions to maintain compliance.
Exam trap
The trap here is that candidates often confuse Identity Protection or Conditional Access with governance because they involve security controls, but Microsoft Entra ID Governance specifically focuses on the lifecycle management and periodic review of access rights, not on risk detection or policy enforcement at sign-in.
Your organization uses Microsoft Defender for Cloud Apps. A security analyst needs to receive an alert whenever a user accesses a cloud app from a new IP address that is not in the organization's trusted IP range. What should the analyst configure?
An anomaly detection policy in Microsoft Defender for Cloud Apps leverages machine learning and behavioral analytics to identify unusual and potentially suspicious activities across your cloud applications. These policies establish a baseline of normal user behavior and then flag deviations, such as impossible travel, sign-ins from unfamiliar locations or IP addresses, and unusual activity volumes. Therefore, it is the correct policy type for detecting and alerting on sign-ins originating from new or previously unseen IP addresses.
Why this answer
An anomaly detection policy in Microsoft Defender for Cloud Apps is designed to identify unusual user activities, such as access from a new IP address outside the organization's trusted IP range. This policy leverages machine learning to establish a baseline of normal behavior and triggers alerts when deviations occur, making it the correct choice for this scenario.
Exam trap
The trap here is that candidates often confuse anomaly detection policies with session policies, mistakenly thinking session policies can alert on new IP addresses, but session policies only enforce controls during active sessions and do not generate standalone alerts for access from untrusted IPs.
How to eliminate wrong answers
Option A is wrong because a file policy is used to monitor and control file sharing and data exfiltration based on content inspection or metadata, not to detect anomalous access patterns like new IP addresses. Option B is wrong because a session policy controls real-time user sessions (e.g., blocking downloads or requiring authentication) based on app or user attributes, but it does not generate alerts for new IP address access outside trusted ranges. Option C is wrong because an app permission policy governs which third-party apps can access organizational data via OAuth permissions, not user access from specific IP addresses.
A security analyst receives an alert about a suspicious process on a device. The security solution automatically investigates the device, gathers evidence, and determines that a known malware variant was detected. It then presents an action plan to the analyst for remediation. Which Microsoft security solution provides this automated investigation and response capability?
Microsoft Defender for Endpoint (MDE) is a unified endpoint security platform that utilizes behavioral analytics, machine learning, and cloud intelligence to detect, investigate, and respond to advanced threats on devices. When a security analyst receives an alert about a suspicious process, MDE's Endpoint Detection and Response (EDR) capabilities automatically collect telemetry, analyze process trees, and can initiate automated investigation playbooks to determine the scope and severity of the threat, isolating the device if necessary. This directly addresses the need to investigate a suspicious process on an endpoint.
Why this answer
Microsoft Defender for Endpoint provides automated investigation and response (AIR) capabilities that automatically investigate alerts, gather evidence, and determine remediation actions. When a suspicious process is detected, Defender for Endpoint's AIR engine analyzes the device, identifies known malware variants, and presents an action plan to the security analyst for approval or execution.
Exam trap
Microsoft often tests the distinction between endpoint-focused security (Defender for Endpoint) and cloud/identity/email-focused solutions, so candidates mistakenly choose Defender for Cloud Apps or Defender for Identity when the scenario clearly describes on-device process investigation and automated response.
Why the other options are wrong
Microsoft Defender for Cloud Apps focuses on cloud application security, not endpoint device investigation and automated remediation of malware on devices.
Microsoft Defender for Identity focuses on detecting and investigating advanced attacks on on-premises Active Directory, not on automated investigation and response for suspicious processes on devices.
Microsoft Defender for Office 365 focuses on protecting email and collaboration tools like Exchange Online, SharePoint, and Teams, not on automated investigation and response for endpoint devices.
When would these options actually be correct?
This option would be correct for a question about detecting and investigating suspicious user behavior or anomalous activities across cloud applications, such as identifying a compromised account using multiple cloud apps.
A question asks: 'Which Microsoft security solution monitors on-premises Active Directory for suspicious activities like pass-the-hash or DCSync attacks and provides identity-based threat detection?'
A question describing automated investigation and response for suspicious emails, phishing attempts, or malicious attachments in Exchange Online or SharePoint would make Defender for Office 365 the correct answer.
Why candidates pick the wrong answer
Candidates may confuse cloud app security with endpoint security because both involve threat detection and investigation, but Defender for Cloud Apps is specific to cloud services, not device-level processes.
Candidates may confuse identity-based security solutions with endpoint detection and response, or assume that any 'Defender' product includes automated investigation capabilities for all scenarios.
Candidates may confuse the automated investigation and response capabilities across different Defender products, assuming all have the same endpoint-focused features.
Refer to the exhibit. You are evaluating a custom Azure Policy definition. The policy is intended to audit whether users assigned to a management role have MFA enabled. However, the policy is not triggering alerts for non-compliant users. What is the most likely cause?
The 'mfaEnabledPrincipals' parameter is crucial for this policy's logic, as the 'existenceCondition' relies on it to identify principals who have MFA enabled. If this parameter is not populated with the correct list of MFA-enabled user principal IDs, the policy's 'where' clause cannot accurately determine which principals are compliant. Consequently, the policy will fail to correctly evaluate whether non-MFA-enabled users hold owner role assignments, rendering its compliance assessment ineffective.
Why this answer
The policy definition includes a parameter named 'mfaEnabledPrincipals' that must be populated with the list of user object IDs who have MFA enabled. If this parameter is empty or not provided, the 'auditIfNotExists' effect cannot evaluate any users against the expected MFA status, resulting in no non-compliant alerts being triggered. Azure Policy relies on explicit parameter values to define the baseline for compliance evaluation.
How to eliminate wrong answers
Option B is wrong because the policy mode 'All' is appropriate for auditing Azure Active Directory resources (such as users and role assignments) and is not the cause of the failure; 'Indexed' mode is used for resource provider modes like 'Microsoft.Kubernetes.Data' and is irrelevant here. Option C is wrong because the policy does evaluate role assignments of type 'Microsoft.Authorization/roleAssignments' to identify users in management roles, but the issue is that the MFA-enabled user list is missing, not that the scope is incorrect. Option D is wrong because the 'auditIfNotExists' effect is designed to log non-compliance without blocking actions, and changing it to 'deny' would not trigger alerts; alerts are generated by Azure Policy compliance states, not by the effect type.
Your organization uses Microsoft Sentinel. You need to create a custom analytics rule that triggers an incident when a user executes a specific command on Azure VMs. Which data source should you connect to capture the command execution logs?
This captures command execution logs from the guest OS.
Why this answer
Windows Security Events via Azure Monitor Agent. To capture command execution logs on Azure VMs, you need guest OS-level logs, which are provided by Windows Security Events (or Syslog) collected by the Azure Monitor Agent. Microsoft Sentinel can ingest these logs using the Windows Security Events connector.
Option A (Office Activity log) is incorrect; it captures Microsoft 365 user and admin activities, not VM commands. Option C (Azure AD audit logs) is incorrect; it logs Azure Active Directory sign-ins and changes, not OS-level events. Option D (Azure Activity log) is incorrect; it records resource management operations on Azure resources, not guest OS commands executed within a VM.
Your company uses Microsoft Purview Information Protection. They want to automatically apply a 'Confidential' sensitivity label to documents containing a credit card number. What should they create?
An auto-labeling policy is specifically designed within Microsoft Purview Information Protection to automatically scan content across various locations, such as SharePoint, OneDrive, and Exchange, for predefined conditions. When these conditions, which often include sensitive information types, keywords, or trainable classifiers, are met, the policy automatically applies a specified sensitivity label to the content. This ensures consistent and automated classification and protection without requiring manual user intervention.
Why this answer
An auto-labeling policy in Microsoft Purview Information Protection is designed to automatically apply sensitivity labels to documents and emails based on conditions such as the presence of sensitive information types (e.g., credit card numbers). This allows the 'Confidential' label to be applied without user intervention, meeting the requirement.
Exam trap
The trap here is confusing the function of a DLP policy (which blocks or alerts on sensitive data) with an auto-labeling policy (which applies a sensitivity label based on content), as both use sensitive information types but serve different purposes.
How to eliminate wrong answers
Option A is wrong because a sensitivity label defines the classification and protection settings (e.g., encryption, markings) but does not automatically apply itself; it must be assigned via a policy. Option B is wrong because a data loss prevention (DLP) policy enforces rules to prevent sharing of sensitive data (e.g., blocking email with credit card numbers), but it does not apply sensitivity labels. Option D is wrong because a retention label policy manages data retention and deletion rules, not sensitivity classification or automatic labeling based on content.
You are the identity architect for a global organization with 100,000 users across 50 countries. The company uses Microsoft Entra ID P2 and Microsoft Defender for Cloud Apps. Recently, the security team identified that several compromised user accounts were used to exfiltrate data from a cloud storage app. The CISO wants to implement a solution that detects anomalous behavior (e.g., impossible travel, mass download) and automatically blocks the user session when such behavior is detected. The solution must also provide the ability to investigate and remediate after the fact. Which Microsoft Entra feature should you use in conjunction with Defender for Cloud Apps to meet these requirements?
Microsoft Entra Conditional Access session controls, when integrated with Defender for Cloud Apps, provides granular, real-time control over user sessions *after* initial authentication. Conditional Access policies can route sessions through Defender for Cloud Apps (formerly MCAS) for continuous monitoring, allowing actions like blocking downloads, requiring re-authentication, or enforcing read-only access based on detected risky behavior *during* the session, not just at sign-in. This combination directly addresses the need for ongoing session control and behavioral enforcement.
Why this answer
Microsoft Entra Conditional Access session controls integrate directly with Defender for Cloud Apps to enable real-time session monitoring and blocking. When anomalous behaviors like impossible travel or mass downloads are detected by Defender for Cloud Apps, the session control can automatically block the user session, while also providing full investigation and remediation capabilities through the Defender for Cloud Apps portal. This meets the CISO's requirement for both automated blocking and post-incident analysis.
Exam trap
The trap here is that candidates often confuse Identity Protection's risk-based conditional access policies (which block sign-ins at the authentication level) with the session-level controls needed for real-time monitoring and blocking within an already-established cloud app session.
How to eliminate wrong answers
Option B (Microsoft Entra Identity Protection) is wrong because it focuses on risk-based detection and automated remediation of identities (e.g., requiring password reset or blocking sign-in), but it does not provide session-level controls or integration with Defender for Cloud Apps for real-time session blocking and investigation of cloud app activities. Option C (Microsoft Entra Privileged Identity Management) is wrong because it is designed for managing, controlling, and monitoring privileged role assignments and just-in-time access, not for detecting anomalous user behavior or blocking sessions in cloud apps. Option D (Microsoft Entra access reviews) is wrong because it is a governance tool for periodically reviewing group memberships, application access, and role assignments, not a real-time detection or session control mechanism.
A company uses Microsoft 365 and wants to automatically classify documents based on sensitive information types like Social Security numbers. Which Microsoft Purview feature should be used?
Microsoft Purview Data Classification provides the foundational capabilities for identifying, categorizing, and understanding the data within an organization's digital estate. It leverages a robust set of built-in sensitive information types (SITs), named entities, and trainable classifiers to automatically detect specific content patterns, such as credit card numbers, national ID numbers, or industry-specific data. This service is crucial for automatically tagging and labeling data based on its content, forming the basis for subsequent protection and governance actions.
Why this answer
Microsoft Purview Data Classification is the correct feature because it automatically scans and classifies documents based on sensitive information types (e.g., Social Security numbers) using built-in or custom classifiers. This enables organizations to identify and label content without manual intervention, directly addressing the requirement for automatic classification.
Exam trap
The trap here is that candidates often confuse the feature that performs the initial classification (Data Classification) with the downstream enforcement tools (DLP) or the labeling mechanism (Sensitivity Labels), leading them to select DLP or Sensitivity Labels instead of the correct classification service.
How to eliminate wrong answers
Option A is wrong because Microsoft Purview Communication Compliance is designed to monitor and detect policy violations in communications (e.g., emails, Teams messages), not to automatically classify documents based on sensitive data patterns. Option C is wrong because Microsoft Purview Data Loss Prevention (DLP) enforces policies to prevent unauthorized sharing of sensitive data after classification, but it does not perform the initial automatic classification itself. Option D is wrong because Microsoft Purview Sensitivity Labels are applied manually or via auto-labeling policies that rely on classifiers (like Data Classification), but the labels themselves are not the feature that scans and identifies sensitive information types.
You are analyzing sign-in logs in Microsoft Sentinel. Based on the KQL query in the exhibit, what is the purpose of this query?
This query correctly identifies users targeting disabled accounts by specifically filtering for `ResultType 50057`, which signifies an account is disabled. By then grouping these events by `UserPrincipalName`, counting the occurrences, and applying a `where count_ > 10` clause within a specified 7-day timeframe, it precisely pinpoints users exceeding the defined threshold of failed attempts against disabled accounts. This is a critical indicator of potential malicious activity or persistent user error.
Why this answer
The KQL query filters sign-in logs for events where the 'ResultType' is '50057', which specifically indicates a sign-in attempt from a disabled account. It then groups by user and counts occurrences, using a 'where' clause to filter for users with more than 10 such attempts. Finally, it limits the results to the last 7 days via the time range filter in the query or the workspace time filter.
This directly identifies users who have attempted to sign in with a disabled account more than 10 times in the last 7 days.
Exam trap
The trap here is that candidates may confuse the 'ResultType' value '50057' with a generic failed sign-in code (e.g., '50053' for locked accounts or '50126' for invalid credentials), leading them to incorrectly select option D (locations with highest failed sign-ins) instead of recognizing the specific disabled-account scenario.
How to eliminate wrong answers
Option B is wrong because the query does not filter by any IP address field (e.g., 'IPAddress', 'ClientIP'), so it cannot identify sign-in attempts from a specific IP address. Option C is wrong because the query does not compare timestamps or locations to detect impossible travel; it only counts disabled-account sign-in failures per user. Option D is wrong because the query focuses on a specific result type (50057) for disabled accounts, not all failed sign-ins, and it groups by user, not by location.
A company uses Microsoft Purview to map their data estate. They need to classify data stored in Azure SQL Database and Amazon S3. What should they use?
The Microsoft Purview Data Map is the foundational component of Microsoft Purview, designed to automatically discover, catalog, and classify data assets across an organization's entire data estate, including on-premises, multi-cloud, and SaaS sources. It creates a unified metadata repository, providing a holistic view of data locations, types, and relationships. This capability is essential for understanding data landscapes, enabling data governance, compliance, and risk management initiatives.
Why this answer
Microsoft Purview Data Map is the correct choice because it provides automated data discovery, classification, and lineage across hybrid and multi-cloud environments, including Azure SQL Database and Amazon S3. It uses built-in scanners and classifiers to scan structured and unstructured data sources, mapping sensitive data types such as PII or financial information. This directly fulfills the requirement to classify data across both Azure and AWS platforms.
Exam trap
The trap here is that candidates often confuse Microsoft Purview Data Map with Microsoft Defender for Cloud, mistakenly thinking that Defender for Cloud's 'data classification' feature (which only applies to Azure SQL and Azure Storage) can also scan Amazon S3, but it cannot—only Purview Data Map supports multi-cloud data sources like AWS S3.
How to eliminate wrong answers
Option A is wrong because Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) service, focused on managing endpoints and enforcing compliance policies, not on data classification or scanning data stores. Option B is wrong because Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration Automation and Response) solution that ingests logs and alerts for threat detection, not for scanning and classifying data at rest in databases or object stores. Option C is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides security recommendations and threat protection for cloud resources, but it does not perform data classification or map data estates across Azure SQL and S3.
Your organization uses Microsoft Purview to manage data classification. You need to ensure that sensitive data containing social security numbers is automatically labeled when stored in SharePoint Online. What should you configure?
Creating an auto-labeling policy for sensitivity labels is the direct and most effective method within Microsoft Purview to automatically classify data based on its content. These policies are specifically engineered to scan content in locations like SharePoint, OneDrive, and Exchange, then apply appropriate sensitivity labels when specific conditions, such as the presence of sensitive information types or trainable classifiers, are met. This automation ensures consistent data classification and the application of associated protective actions without requiring manual user intervention.
Why this answer
D is correct because auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels to files containing sensitive data, such as social security numbers, when stored in SharePoint Online. This uses pattern-based detection to classify and label content at rest without manual intervention.
Exam trap
The trap here is confusing data loss prevention (DLP) policies, which enforce protective actions like blocking or alerting, with auto-labeling policies that specifically apply sensitivity labels to content based on sensitive data detection.
How to eliminate wrong answers
Option A is wrong because the data classification dashboard is a monitoring and reporting tool that shows classified content, but it does not automatically apply labels to files. Option B is wrong because retention label policies manage data retention and deletion, not sensitivity classification or labeling of sensitive data. Option C is wrong because a DLP policy can detect and protect sensitive data by blocking or alerting, but it does not apply sensitivity labels to content.
A company runs workloads in Azure and Amazon Web Services (AWS). The security team wants a single, unified dashboard to assess the security posture of all cloud resources, get prioritized recommendations for misconfigurations, and enable just-in-time (JIT) virtual machine access across both cloud environments. Which Microsoft security solution should they use?
Microsoft Defender for Cloud offers unified security management and threat protection across hybrid and multi-cloud environments, including Azure and AWS. It provides Cloud Security Posture Management (CSPM) for continuous assessment of security configurations, offering recommendations to improve posture. Additionally, its Cloud Workload Protection (CWP) features include just-in-time (JIT) VM access, which significantly reduces the attack surface by only opening management ports when needed.
Why this answer
Microsoft Defender for Cloud is the correct solution because it provides a unified dashboard for assessing security posture across multi-cloud environments, including Azure and AWS. It delivers prioritized recommendations for misconfigurations using the Microsoft cloud security benchmark and supports just-in-time (JIT) VM access to reduce attack surfaces by controlling inbound traffic on demand.
Exam trap
The trap here is confusing Microsoft Defender for Cloud (a CSPM and workload protection platform) with Microsoft Sentinel (a SIEM), leading candidates to choose Sentinel because it also aggregates logs from multiple clouds, but it lacks the specific posture assessment dashboard and JIT VM access features described in the question.
Why the other options are wrong
Microsoft Sentinel is a SIEM/SOAR solution for threat detection and response, not a unified dashboard for assessing security posture across multi-cloud environments. It does not provide prioritized recommendations for misconfigurations or JIT VM access.
Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) focused on SaaS application usage and shadow IT, not a unified dashboard for assessing security posture across Azure and AWS with JIT VM access.
Azure Policy enforces and audits compliance rules across Azure resources but does not provide a unified dashboard for AWS, prioritized recommendations for misconfigurations, or JIT VM access across multi-cloud environments.
When would these options actually be correct?
A question asking for a cloud-native SIEM to collect security logs, detect threats, and orchestrate automated responses across Azure, AWS, and on-premises would make Microsoft Sentinel the correct answer.
A company wants to discover and control the use of third-party SaaS apps (e.g., Dropbox, Salesforce) across their cloud environments, enforce access policies, and detect anomalous user behavior in those apps.
An organization needs to enforce tagging standards, restrict resource types, or audit compliance with corporate policies across Azure subscriptions only, without requiring multi-cloud or security posture assessment features.
Why candidates pick the wrong answer
Candidates may confuse Sentinel's log aggregation and alerting capabilities with the posture management and recommendation features of Defender for Cloud, especially since both are part of the Microsoft security portfolio.
Candidates may confuse 'cloud apps' with 'cloud resources' and think Defender for Cloud Apps provides cross-cloud posture management, but it actually focuses on SaaS application governance, not infrastructure security.
Candidates may confuse Azure Policy's compliance enforcement with security posture management, or think it can be extended to AWS via Azure Arc, but it lacks the unified dashboard and JIT capabilities described.
A company wants to provide external consultants with access to a specific application using their LinkedIn or Google accounts. Which Microsoft Entra feature allows this?
Microsoft Entra External ID is the comprehensive solution for managing and securing identities for external users, including partners, customers, and consultants. It enables organizations to collaborate securely by allowing these external users to sign in with their own identities, such as those from other Microsoft Entra tenants, social identity providers like Google or Facebook, or even via email one-time passcodes. This service specifically facilitates the onboarding and management of external users for resource access without creating full internal accounts.
Why this answer
Microsoft Entra External ID (formerly Azure AD External Identities) is the correct feature because it enables external users—such as consultants—to sign in using their own identity providers (IdPs) like LinkedIn or Google via federation. This allows the company to grant access to a specific application without creating separate Microsoft Entra accounts for each consultant, leveraging social identity providers through OpenID Connect or OAuth 2.0 protocols.
Exam trap
The trap here is that candidates often confuse Conditional Access (which controls access after authentication) with the ability to authenticate external users, or they mistakenly think PIM or Identity Protection can directly enable social identity provider sign-in.
How to eliminate wrong answers
Option A is wrong because Microsoft Entra Conditional Access is a policy engine that enforces access controls (e.g., MFA, location) after authentication, but it does not enable external identity providers like LinkedIn or Google for sign-in. Option C is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time privileged role assignments and access reviews for internal users, not external authentication with social IdPs. Option D is wrong because Microsoft Entra Identity Protection detects and remediates identity-based risks (e.g., leaked credentials, anomalous sign-ins) but does not provide the federation capability to allow external consultants to authenticate via LinkedIn or Google.
Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate Microsoft 365 resources. You have configured a Conditional Access policy in Microsoft Entra ID that requires devices to be marked as compliant. However, some users report that they can still access email on their non-compliant Android devices. You need to troubleshoot and resolve the issue. What should you do?
This is correct: the policy must be enabled, target Exchange Online, and users must have Intune licenses for compliance enforcement.
Why this answer
The Conditional Access policy must be enabled and configured to include 'Office 365 Exchange Online' as a cloud app, and the affected users need to have Intune licenses assigned. If the policy is not enabled or does not target the correct app, non-compliant devices may still access email. Option A is incorrect because requiring compliance is the correct setting, not blocking; blocking is a separate action.
Option C is incorrect because even if devices are enrolled, the policy must include the correct cloud app and users. Option D is incorrect because while the policy must include users, the primary issue is typically the policy not covering Exchange Online or missing licenses.
A financial services company uses Microsoft 365 and must prevent employees from emailing credit card numbers in plain text. The compliance team wants to automatically detect credit card numbers in outgoing emails and block them before delivery. They also want to allow users to override the block with a business justification. Which Microsoft Purview solution should they configure?
Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across Microsoft 365 services, including Exchange Online emails. These policies use sensitive information types (SITs) to detect content like credit card numbers in real-time as emails are sent. Upon detection, DLP can block the email, notify administrators, and offer users the option to override the block with a business justification, directly preventing unauthorized data egress.
Why this answer
Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect sensitive data, such as credit card numbers, in transit (e.g., email) and enforce actions like blocking the message. DLP policies can be configured with user override options that require a business justification, meeting the compliance team's requirement for automatic detection and conditional blocking.
Exam trap
The trap here is that candidates often confuse Information Protection (labeling) with DLP (enforcement), thinking that applying a sensitivity label automatically blocks emails, but DLP is required for the blocking and override functionality described in the scenario.
Why the other options are wrong
Microsoft Purview Information Protection focuses on classifying and protecting documents and emails with sensitivity labels, not on blocking outbound emails containing sensitive data like credit card numbers. It does not provide the automatic blocking and override capability for emails in transit that DLP does.
Records Management focuses on managing retention and disposition of records, not on detecting and blocking sensitive data like credit card numbers in emails.
Insider Risk Management is designed to detect and investigate risky user activities (e.g., data theft, policy violations) but does not block emails based on content patterns like credit card numbers. It cannot enforce real-time email blocking with override capabilities.
When would these options actually be correct?
A company wants to automatically apply a 'Confidential' label to all emails containing credit card numbers and encrypt them before sending, but does not need to block the email. In that scenario, Information Protection would be the correct solution.
An organization needs to automatically retain emails containing financial data for 7 years and then delete them. Records Management would be the correct solution to apply retention labels and disposition reviews based on content.
A scenario where the compliance team needs to detect and investigate employees who are exfiltrating sensitive data via email, such as sending credit card numbers to personal accounts, and require alerts and case management for HR action. The question would specify 'detect and investigate risky behavior' rather than 'automatically block with override'.
Why candidates pick the wrong answer
Candidates may confuse the ability to detect sensitive data (which both DLP and Information Protection can do) with the enforcement action of blocking emails, assuming that labeling and protection also include blocking capabilities.
Candidates may confuse 'Records Management' with managing sensitive information, thinking it includes data classification and protection, but it is actually about lifecycle management.
Candidates may confuse 'insider risk' with data loss prevention because both deal with sensitive data misuse. They might think that blocking credit card emails is a risk management function, overlooking that DLP is the specific tool for content-based enforcement.
Which THREE components are part of Microsoft Defender XDR? (Choose three.)
Part of the XDR suite.
Why this answer
Microsoft Defender XDR is a unified security operations platform that integrates threat signals across endpoints, identities, and email/collaboration tools. Its core components include Microsoft Defender for Office 365 (email and collaboration protection), Microsoft Defender for Identity (identity security), and Microsoft Defender for Endpoint (endpoint detection and response). Option A (Microsoft Purview) is a data governance and compliance solution, not part of XDR.
Option C (Microsoft Sentinel) is a cloud-native SIEM that can ingest data from XDR but is not a built-in component of Defender XDR. Therefore, the correct answers are B, D, and E.
Exam trap
The trap here is that candidates confuse Microsoft Sentinel (a SIEM) as part of Defender XDR, but Sentinel is an external analytics layer that can ingest Defender XDR data, not a built-in component of the XDR suite.
A company uses Microsoft Purview to manage data compliance. They need to meet regulatory requirements that mandate retention of financial records for 7 years and deletion of personal data after 3 years. Which THREE capabilities should they configure?
Microsoft Purview Information Protection enables organizations to classify and label sensitive data using sensitivity labels, whether manually or automatically. These labels are crucial as they can be configured to automatically apply specific retention and deletion policies, ensuring data is retained for the required period or disposed of appropriately based on its content and classification. This capability is fundamental for enforcing data compliance requirements by governing data based on its sensitivity.
Why this answer
Microsoft Purview Information Protection (A) is correct because it enables classification and labeling of sensitive data, such as financial records and personal data, with retention and deletion policies. This ensures that data is retained for the required 7 years and deleted after 3 years, meeting regulatory mandates. It works by applying sensitivity labels that trigger retention or deletion actions based on the label's configured settings.
Exam trap
The trap here is that candidates often confuse Communication Compliance or eDiscovery with retention management, but neither provides the automated retention and deletion scheduling required for regulatory compliance.
A security architect is explaining the Zero Trust model to the board. The architect emphasizes that the network perimeter can no longer be considered a safe zone. Which statement best describes the modern primary security perimeter according to Zero Trust principles?
Identity is the fundamental building block of Zero Trust; it is used to verify every access request and enforce least privilege, forming the new perimeter.
Why this answer
In the Zero Trust model, the primary security perimeter is the identity of the user and device, not the network location. This is because Zero Trust assumes breach and requires explicit verification for every access request, regardless of whether it originates from inside or outside the corporate network. By treating identity as the new control plane, organizations enforce least-privilege access and continuous authentication, making the user and device identity the critical trust boundary.
How to eliminate wrong answers
Option A is wrong because the corporate network firewall and VPN represent a traditional perimeter-based security approach, which Zero Trust explicitly rejects as the primary security boundary; in Zero Trust, network location does not grant implicit trust. Option C is wrong because the physical on-premises data center is a legacy concept of a trusted internal zone, whereas Zero Trust assumes that threats can exist anywhere, including inside the data center. Option D is wrong because endpoint antivirus and anti-malware solutions are only one component of endpoint protection and do not serve as the primary security perimeter; Zero Trust focuses on identity and device health as the core trust decision point.
A user reports that they cannot sign in to Microsoft Entra ID because they forgot their password. Which Microsoft Entra ID feature allows them to reset their password without contacting IT support?
Self-Service Password Reset (SSPR) is a crucial Microsoft Entra ID feature that empowers users to reset their forgotten or locked-out passwords without requiring administrator assistance. Users authenticate their identity through pre-registered verification methods, such as a mobile app notification, phone call, or personal email, to prove they are legitimate. This capability directly addresses the scenario where a user cannot sign in because they have forgotten their password, allowing them to regain access independently.
Why this answer
Self-Service Password Reset (SSPR) is the Microsoft Entra ID feature that allows users to reset their own forgotten passwords without needing to contact IT support. It works by verifying the user's identity through pre-configured authentication methods (e.g., phone, email, security questions) before permitting the password change. This directly addresses the user's inability to sign in due to a forgotten password.
Exam trap
The trap here is that candidates may confuse Microsoft Entra ID Protection (which deals with risk detection) with SSPR, because both involve security and user authentication, but only SSPR enables the user to directly reset their own password without IT intervention.
How to eliminate wrong answers
Option A is wrong because Microsoft Entra ID Connect is a tool used to synchronize on-premises Active Directory identities to Microsoft Entra ID, not a password reset feature. Option B is wrong because Microsoft Entra ID Protection is a security service that detects and responds to identity risks (e.g., leaked credentials, sign-ins from anonymous IPs), but it does not provide a mechanism for users to reset their own passwords. Option C is wrong because Microsoft Entra ID Domain Services provides managed domain services (e.g., Kerberos, LDAP) for Azure VMs, not self-service password reset capabilities.
A financial services firm has a strict compliance requirement to prevent insider trading. The firm must ensure that employees in the Investment Banking division cannot communicate or share documents via Microsoft Teams and SharePoint Online with employees in the Equity Research division. The solution must automatically block all communication and collaboration between the two groups, and any attempts to share must be denied. Which Microsoft Purview solution should they implement?
Information Barriers in Microsoft 365 are specifically designed to prevent specific groups of users from communicating or collaborating with each other, fulfilling "ethical wall" requirements. Administrators define policies that segment users and restrict interactions in services like Microsoft Teams, SharePoint, and Exchange Online. This directly addresses the firm's need to proactively block communication to ensure compliance and prevent information leakage between sensitive departments.
Why this answer
Information Barriers (A) is the correct solution because it is specifically designed to prevent communication and collaboration between defined user groups within Microsoft Teams, SharePoint Online, and other Microsoft 365 services. It enforces policies that automatically block unauthorized communications and document sharing, which directly meets the firm's compliance requirement to segregate Investment Banking and Equity Research divisions to prevent insider trading.
Exam trap
The trap here is that candidates often confuse Information Barriers with Communication Compliance, mistakenly thinking that monitoring and reviewing communications (Option B) can prevent insider trading, but only Information Barriers provide the proactive, automatic blocking required by the scenario.
Why the other options are wrong
Communication Compliance is designed to detect and review communications for policy violations (e.g., insider trading), not to automatically block all communication and collaboration between groups. It relies on post-hoc detection and review, not real-time blocking.
Insider Risk Management is designed to detect, investigate, and act on potential insider threats after they occur, not to proactively block all communication and collaboration between groups as required by the compliance policy.
Sensitivity labels classify and protect data based on sensitivity, but they do not automatically block all communication and collaboration between specific groups. They require manual application or automated labeling policies, and cannot enforce communication restrictions between divisions.
When would these options actually be correct?
A company wants to monitor employee communications for potential insider trading or regulatory breaches, and requires a solution that captures, reviews, and escalates suspicious messages or documents. The goal is detection and investigation, not automatic blocking.
An organization wants to detect and investigate suspicious user activities that could lead to insider trading, such as unusual data access or exfiltration, and apply automated remediation actions like triggering alerts or initiating investigations.
A company needs to automatically apply encryption and access restrictions to documents containing financial data shared externally. Sensitivity labels with auto-labeling policies would be the correct solution to protect sensitive data based on content.
Why candidates pick the wrong answer
Candidates may confuse the goal of preventing insider trading with the tool that monitors for it, assuming that Communication Compliance can enforce restrictions rather than just detect violations.
Candidates may confuse the proactive blocking of communications (Information Barriers) with the detection and investigation of risky user behavior (Insider Risk Management), especially since both relate to insider trading scenarios.
Candidates may think sensitivity labels can restrict sharing between groups because labels can enforce encryption and permissions, but they lack the ability to block communications and are not designed for organizational segmentation.
A security analyst needs to detect and investigate compromised identities in on-premises Active Directory. They want to monitor for lateral movement, reconnaissance, and credential theft using behavioral analytics. Which Microsoft security solution is designed specifically for this purpose?
Microsoft Defender for Identity is the dedicated solution for detecting and investigating advanced threats and compromised identities within on-premises Active Directory environments. It deploys lightweight sensors directly on domain controllers to monitor network traffic and Windows events, leveraging behavioral analytics and machine learning to identify suspicious activities. This allows it to detect attack patterns such as lateral movement, credential theft, reconnaissance, and other indicators of compromise targeting on-premises user accounts and domain infrastructure.
Why this answer
Microsoft Defender for Identity (MDI) is a cloud-based security solution that leverages on-premises Active Directory signals to identify, detect, and investigate advanced threats like lateral movement, reconnaissance, and credential theft. It uses behavioral analytics and machine learning to profile user and entity behavior, alerting on suspicious activities such as Pass-the-Hash, DCSync, and Kerberoasting without requiring agents on domain controllers.
Exam trap
The trap here is that candidates often confuse Microsoft Defender for Identity with Microsoft Sentinel, assuming Sentinel's SIEM capabilities automatically cover identity-based behavioral analytics, but Sentinel lacks the native, agentless Active Directory behavioral profiling that MDI provides.
How to eliminate wrong answers
Option A is wrong because Microsoft Defender for Office 365 focuses on email and collaboration threats (phishing, malware in attachments, and malicious links) and does not monitor on-premises Active Directory or lateral movement. Option B is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and workload protection platform for Azure, AWS, and GCP resources, not for on-premises Active Directory identity threats. Option D is wrong because Microsoft Sentinel is a SIEM/SOAR solution that can ingest logs from various sources, but it is not purpose-built for detecting compromised identities via behavioral analytics on Active Directory; it requires additional configuration and data connectors to achieve similar functionality.
An organization uses Microsoft Purview Compliance Manager. They need to track their progress against a specific regulatory standard and assign improvement actions to different teams. Which component should they use?
Assessments in Compliance Manager allow tracking against standards and assigning improvement actions.
Why this answer
Compliance Manager assessments are the correct component because they allow you to track progress against a specific regulatory standard (e.g., ISO 27001, SOC 2) by creating an assessment that maps controls to that standard. Improvement actions are the granular tasks within an assessment that can be assigned to different teams for remediation, directly supporting the need to track progress and assign work.
Exam trap
The trap here is that candidates may confuse Compliance Manager assessments with general compliance features like DLP or eDiscovery, but the question specifically asks for a component that tracks progress against a regulatory standard and assigns improvement actions, which is unique to assessments within Compliance Manager.
How to eliminate wrong answers
Option B is wrong because eDiscovery is used for identifying, preserving, and exporting content relevant to legal or regulatory investigations, not for tracking compliance progress or assigning improvement actions. Option C is wrong because Data Loss Prevention (DLP) policies are designed to prevent unauthorized sharing or leakage of sensitive data, not to manage compliance assessments or assign tasks. Option D is wrong because Audit logs record user and admin activity for security and compliance auditing, but they do not provide a structured framework for tracking progress against a regulatory standard or assigning improvement actions.
Refer to the exhibit. An administrator created a retention label with the settings shown. What is the behavior of this label when applied to content?
This option accurately describes the retention label's behavior. The specified retention duration of 2555 days precisely equates to 7 years (2555 days / 365 days/year). Following this 7-year retention period, the 'DeleteAfterRetention' property, which is set to 'true', ensures that the content is automatically and permanently deleted without requiring any manual intervention or disposition review.
Why this answer
The retention label is configured with a retention period of 7 years and an action of 'Delete items automatically when the retention period ends.' Since no disposition review is enabled, the content will be automatically deleted after 7 years. This matches option C exactly.
Exam trap
The trap here is that candidates often confuse the retention period with the disposition review setting, assuming a disposition review is always required for deletion, or misread the 7-year period as 5 years due to the visual layout of the exhibit.
How to eliminate wrong answers
Option A is wrong because the label specifies a 7-year retention period, not 5 years, and no disposition review is configured. Option B is wrong because marking content as a regulatory record is a separate configuration that requires enabling 'Regulatory record' under 'Retention settings' and is not implied by the shown settings. Option D is wrong because the label has a finite retention period of 7 years, not indefinite retention.
A security analyst needs to investigate a potential malware outbreak that started on an on-premises Windows server several days ago. They want to trace the attack timeline, see which files were modified, and understand how the attacker moved laterally across the network. Which Microsoft solution provides advanced endpoint detection and response (EDR) for on-premises servers?
Microsoft Defender for Endpoint is the dedicated Endpoint Detection and Response (EDR) solution designed to protect, detect, investigate, and respond to advanced threats on endpoints, including on-premises servers. It provides comprehensive capabilities such as real-time monitoring, behavioral analytics, automated investigation and remediation, and advanced threat hunting tools. This platform is specifically engineered to identify and analyze malware, track its activities, and facilitate a security analyst's investigation into potential compromises directly on the affected machines.
Why this answer
Microsoft Defender for Endpoint (MDE) provides advanced endpoint detection and response (EDR) capabilities, including behavioral-based detection, automated investigation, and threat analytics. For on-premises Windows servers, MDE can be deployed via Microsoft Defender for Cloud (formerly Azure Security Center) or directly, enabling full attack timeline reconstruction, file modification tracking, and lateral movement path analysis through its rich telemetry and incident graph.
Exam trap
The trap here is that candidates confuse Microsoft Defender for Cloud's 'servers' workload protection with the actual EDR engine, not realizing that Defender for Cloud merely enables MDE on servers but does not replace its dedicated endpoint detection and response capabilities.
How to eliminate wrong answers
Option A is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and workload protection platform that can enable MDE on servers but does not itself provide the EDR functionality; it integrates with MDE for that purpose. Option C is wrong because Microsoft Defender for Office 365 protects email, SharePoint, OneDrive, and Teams from malicious content, not on-premises server endpoints or lateral movement analysis. Option D is wrong because Microsoft Defender for Identity is an identity-based threat detection solution that monitors Active Directory signals for attacks like pass-the-hash, not file-level or endpoint-level EDR on servers.
Which TWO Microsoft security solutions can be used to detect and respond to threats across email, endpoints, and identities? (Choose two.)
Sentinel provides SIEM and SOAR capabilities across multiple sources.
Why this answer
Microsoft Sentinel (option D) is correct because it is a cloud-native SIEM and SOAR platform that ingests logs from across the entire environment—including email, endpoints, and identity sources—to detect and respond to threats using analytics and automated playbooks. Microsoft Defender XDR (option E) is correct because it is a unified, pre- and post-breach detection and response solution that correlates signals across email (Exchange Online), endpoints (Microsoft Defender for Endpoint), and identities (Microsoft Defender for Identity).
Exam trap
The trap here is that candidates often confuse Microsoft Defender for Cloud Apps (a CASB focused on cloud app security) with a cross-domain detection and response solution, but it does not natively cover email or endpoint threat detection, making it an incorrect choice for this question.
Your organization uses Microsoft Entra ID. You need to grant external partners limited access to a SharePoint site for 30 days. After 30 days, access should automatically expire. Which Microsoft Entra feature should you use?
Microsoft Entra entitlement management is the correct solution as it allows organizations to manage identity and access lifecycle for both internal and external users at scale. It enables the creation of 'access packages' that bundle resources and define policies, including explicit expiration dates for assignments. When access is granted via an access package, it is automatically revoked upon the specified expiration, ensuring time-limited access.
Why this answer
Microsoft Entra entitlement management allows you to create access packages that grant external users time-limited access to resources like SharePoint sites. By configuring an access package with a 30-day expiration policy, access is automatically revoked when the policy expires, meeting the requirement exactly.
Exam trap
The trap here is that candidates confuse entitlement management (which handles time-bound resource access) with access reviews (which handle periodic recertification) or B2B guest accounts (which provide identity but not automatic expiration).
How to eliminate wrong answers
Option A is wrong because Microsoft Entra access reviews are used for periodic attestation of existing access, not for automatically expiring access after a fixed duration. Option B is wrong because Microsoft Entra B2B guest user accounts provide the identity for external users but do not include built-in time-limited access policies; expiration must be managed separately. Option D is wrong because Microsoft Entra Conditional Access enforces access controls based on conditions like location or device state, not for granting or expiring access to specific resources on a schedule.
Refer to the exhibit. You are reviewing an ARM template for an Azure resource. Assuming the resource is a Key Vault, what is the effect of the networkAcls configuration?
This statement is correct. The network access configuration includes an "ipRules" entry specifically allowing traffic from the "10.0.0.0/24" subnet. Since the "defaultAction" is set to "Deny," any network traffic originating from outside this explicitly permitted IP range will be blocked. This creates a precise security boundary, restricting access exclusively to the specified subnet.
Why this answer
The networkAcls configuration in the ARM template defines IP firewall rules for the Key Vault. By specifying a defaultAction of 'Deny' and a single ipRule with a value of '10.0.0.0/24', the Key Vault is configured to allow traffic only from the 10.0.0.0/24 subnet. All other traffic, including traffic from other networks and Azure services, is denied by default.
Exam trap
The trap here is that candidates may assume a single ipRule with a subnet means the Key Vault is accessible from all Azure services or from any network, but the defaultAction of 'Deny' explicitly blocks all traffic except the allowed IP range, and the absence of a bypass setting prevents Azure services from accessing the vault.
How to eliminate wrong answers
Option A is wrong because the defaultAction is set to 'Deny', which means the Key Vault is not accessible from any network by default; only explicitly allowed IP ranges can access it. Option C is wrong because allowing access from all Azure services would require setting the bypass parameter to 'AzureServices' and the defaultAction to 'Allow', or adding a specific rule for Azure services; the current configuration does not include that. Option D is wrong because the Key Vault is accessible from the 10.0.0.0/24 subnet as defined by the ipRule, so it is not completely inaccessible.
Your company uses Microsoft Entra ID. You need to enforce that all users accessing the HR application must have a device that is compliant with company security policies. The device compliance is managed by Microsoft Intune. Which feature should you use to enforce this requirement?
Microsoft Entra Conditional Access is the policy engine that evaluates various signals in real-time, such as user identity, location, application, and device state, to make granular access decisions. To enforce device compliance, a Conditional Access policy is configured to require that a device be marked as compliant by an MDM solution like Intune before granting access to protected resources. This directly controls access based on the device's adherence to organizational security standards.
Why this answer
Microsoft Entra Conditional Access is the correct feature because it allows you to create policies that evaluate conditions such as device compliance before granting access to applications. By integrating with Microsoft Intune, Conditional Access can check the device compliance status reported by Intune and block or allow access to the HR application accordingly. This enforces the requirement that only compliant devices can access the app, without requiring users to authenticate differently.
Exam trap
The trap here is that candidates confuse the creation of compliance policies (Intune) with the enforcement of those policies (Conditional Access), assuming that simply defining compliance rules automatically restricts access to applications.
How to eliminate wrong answers
Option A is wrong because Microsoft Intune device compliance policies define the compliance rules (e.g., encryption, OS version) but do not enforce access control to applications; they only mark devices as compliant or non-compliant. Option C is wrong because Microsoft Entra Multifactor Authentication adds an extra authentication factor but does not evaluate device compliance or enforce device-based access restrictions. Option D is wrong because Microsoft Entra device registration is the process of joining a device to the directory, which is a prerequisite for compliance but does not itself enforce access policies based on compliance status.
A security administrator receives an alert from Microsoft Sentinel about a possible brute-force attack against a virtual machine. The administrator wants to automatically block the attacker's IP address for 24 hours using a playbook. Which automation trigger should the playbook use?
Incident triggers run playbooks when an incident is created, enabling automated response.
Why this answer
An incident trigger allows the playbook to run automatically when a new incident is created in Microsoft Sentinel. In this scenario, the alert about the brute-force attack generates an incident, and the playbook can then block the attacker's IP address for 24 hours. Option B (Alert trigger) runs on alert generation, but the administrator wants to respond to the incident for a coordinated response.
Option C (Scheduled trigger) runs on a timer and is not event-driven. Option D (Action trigger) is not a valid trigger type in Microsoft Sentinel.
A company uses Microsoft Entra ID. They want to ensure that when users access the HR portal from an unmanaged personal device, they are prompted to sign a terms of use agreement and also required to perform multifactor authentication (MFA). Which Conditional Access control should they configure to enforce both requirements?
This option utilizes two distinct grant controls within a Conditional Access policy, directly addressing the requirements. "Require multifactor authentication" ensures users provide a second verification factor, significantly enhancing security at the point of access. Concurrently, "Require terms of use" mandates that users review and explicitly accept a specified document before they are permitted to access the protected resource, directly fulfilling both stated requirements for initial access.
Why this answer
The Grant control in Conditional Access allows you to require multiple conditions to be satisfied before granting access. By selecting both 'Require MFA' and 'Require terms of use' under Grant, the policy enforces that the user must complete both MFA and accept the terms of use when accessing the HR portal from an unmanaged device. This directly meets the requirement for both authentication and consent.
Exam trap
The trap here is that candidates often confuse Session controls (which manage behavior after access is granted) with Grant controls (which enforce requirements before access is granted), leading them to pick a session-based option like 'Sign-in frequency' instead of the correct Grant combination.
How to eliminate wrong answers
Option A is wrong because Session controls (like 'Use app enforced restrictions') only apply additional restrictions during an active session, such as blocking downloads, but they do not enforce pre-access requirements like MFA or terms of use acceptance. Option C is wrong because 'Require approved client app' restricts access to specific client applications (e.g., Microsoft apps) and does not enforce MFA or terms of use. Option D is wrong because 'Sign-in frequency' is a session control that re-prompts for authentication after a set time, but it does not enforce MFA or terms of use as a one-time requirement.
Your organization uses Microsoft 365 and wants to classify and protect documents based on their content, such as credit card numbers. Which Microsoft Purview feature automatically classifies content based on sensitive information types?
Auto-labeling policies for sensitivity labels are specifically engineered to automatically apply predefined labels to content, such as documents and emails, based on conditions like the presence of sensitive information types, keywords, or trainable classifiers. This automated process ensures consistent and scalable data classification across an organization without requiring manual user intervention. Once applied, these labels enable persistent protection and governance actions, regardless of where the data resides or travels.
Why this answer
Auto-labeling with sensitivity labels in Microsoft Purview can automatically classify and protect documents by detecting sensitive information types (e.g., credit card numbers) using built-in or custom data classifiers. This feature applies the appropriate sensitivity label based on content matches, enabling consistent protection across Microsoft 365 services.
Exam trap
The trap here is confusing Data Loss Prevention (DLP) policies with auto-labeling, as both use sensitive information types, but DLP focuses on preventing data loss through actions like blocking or alerting, while auto-labeling applies classification labels for ongoing protection.
How to eliminate wrong answers
Option A is wrong because a Data Loss Prevention (DLP) policy monitors and blocks risky activities (e.g., sharing credit card numbers externally) but does not automatically apply classification labels to documents. Option C is wrong because the Unified Labeling Client is a legacy tool for manual or client-side labeling, not an automatic content-based classification feature. Option D is wrong because eDiscovery is used for searching and exporting content for legal or investigative purposes, not for automatic classification or protection of documents.
A multinational corporation needs to restrict data sharing in Microsoft Teams to comply with regional regulations. Users must not be able to share files with external domains from specific departments. What should the administrator configure?
Sensitivity labels with container management in Microsoft Purview are specifically designed to classify and protect data by applying predefined policies to content and its containers. When a sensitivity label is applied to a Microsoft Teams, SharePoint site, or Microsoft 365 Group, it can automatically enforce specific sharing and access policies, including blocking external sharing for all content within that labeled container. This ensures that data belonging to a particular department or project, once labeled, adheres to predefined organizational sharing restrictions, providing granular control at the container level.
Why this answer
Sensitivity labels with container management in Microsoft Purview allow administrators to configure external sharing restrictions for Microsoft Teams, SharePoint, and Groups. By applying a sensitivity label to a team, you can block external sharing for specific departments, ensuring compliance with regional regulations. This is the correct solution because it directly controls sharing behavior at the container level based on the label's settings.
Exam trap
The trap here is that candidates often confuse DLP policies (which block sensitive content) with container-level sharing restrictions, not realizing that DLP cannot block all external sharing from a specific department—it only acts on content patterns.
How to eliminate wrong answers
Option A is wrong because Microsoft Intune device compliance policy enforces device-level security requirements (e.g., encryption, OS version) and does not control data sharing restrictions in Teams. Option B is wrong because Microsoft Defender for Cloud Apps session policy monitors and controls user sessions in real-time (e.g., blocking downloads) but cannot restrict external domain sharing at the Teams container level. Option C is wrong because Data Loss Prevention (DLP) policy in Microsoft Purview scans and prevents sharing of sensitive data (e.g., credit card numbers) but does not block all sharing with external domains from specific departments; it is content-based, not department-based.
An organization uses Microsoft Purview Data Loss Prevention (DLP) to prevent sensitive data from being shared externally. They need to block sharing of credit card numbers in emails and Teams messages. What should they create?
Microsoft Purview Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and protect sensitive information across various locations, including Microsoft 365 services, endpoints, and cloud apps. A DLP policy configured with a rule to detect credit card numbers (a sensitive information type) can automatically block sharing attempts, notify users, or encrypt content, thereby preventing unauthorized data exfiltration. This directly addresses the requirement to block sharing of sensitive data.
Why this answer
Microsoft Purview DLP policies are specifically designed to detect and automatically block the sharing of sensitive data, such as credit card numbers, across services like Exchange Online (email) and Microsoft Teams. By creating a DLP policy with a rule that includes a sensitive information type for credit card numbers and an action to block external sharing, the organization can enforce the required protection. Retention labels, audit policies, and sensitivity labels do not provide the real-time blocking capability needed for this scenario.
Exam trap
The trap here is that candidates often confuse sensitivity labels (which classify and protect data) with DLP policies (which enforce actions like blocking based on content detection), leading them to select a sensitivity label instead of the DLP policy that actually blocks the sharing.
How to eliminate wrong answers
Option A is wrong because a retention label is used to retain or delete data based on compliance requirements, not to block the sharing of sensitive information in real time. Option C is wrong because an audit policy only logs events for review after they occur, it does not prevent or block the sharing of credit card numbers. Option D is wrong because a sensitivity label applies classification and protection (like encryption or visual markings) but does not include a rule to automatically detect and block sharing of specific data patterns like credit card numbers.
A company must retain all customer service emails in Exchange Online for 7 years for regulatory purposes. After 7 years, the emails must be automatically deleted. Additionally, employees must not be able to permanently delete these emails before the retention period ends. Which Microsoft Purview solution should they configure?
Data Lifecycle Management, specifically through Microsoft 365 retention policies and retention labels, is the precise solution for enforcing long-term data retention requirements. Retention policies can be applied broadly to Exchange mailboxes to ensure all customer service emails are preserved for a specified duration, such as seven years, preventing both accidental and malicious deletion by users. These policies also manage the automatic deletion of content after its retention period expires, ensuring compliance with regulatory and organizational data lifecycle mandates.
Why this answer
Data Lifecycle Management (DLM) via retention policies and labels in Microsoft Purview is the correct solution because it allows you to define a retention period of 7 years for Exchange Online emails and then automatically delete them. Additionally, DLM retention policies prevent users from permanently deleting emails before the retention period ends by locking the items in a 'preservation hold' state, ensuring regulatory compliance.
Exam trap
The trap here is that candidates confuse retention policies (which enforce deletion after a period) with eDiscovery holds (which preserve content indefinitely for legal cases), leading them to select eDiscovery (Premium) instead of Data Lifecycle Management.
How to eliminate wrong answers
Option B is wrong because Communication Compliance is designed to detect and remediate inappropriate or policy-violating communications (e.g., harassment, insider trading), not to enforce retention or deletion schedules. Option C is wrong because eDiscovery (Premium) is used for legal discovery and holds content for litigation, not for automated lifecycle management or deletion after a fixed period. Option D is wrong because Data Loss Prevention (DLP) prevents unauthorized sharing of sensitive data (e.g., credit card numbers) but does not manage retention periods or enforce deletion.
Your organization uses Microsoft Sentinel as its SIEM. You need to create an analytics rule that detects when a user account is created in Azure AD and then, within 10 minutes, that same account is used to grant admin consent to an application. You have a KQL query that joins AuditLogs and SigninLogs. However, the rule is generating too many false positives. You need to refine the query to reduce false positives. What should you do?
This solution directly addresses the issue of excessive false positives by allowing legitimate administrative and service accounts to perform necessary admin consent grants without triggering alerts. By explicitly excluding these known, authorized entities, the rule focuses on detecting anomalous or unauthorized consent grants from potentially compromised user accounts or malicious actors. This targeted approach significantly reduces alert fatigue, enabling security analysts to concentrate on high-fidelity alerts that indicate actual threats.
Why this answer
Known admin or service accounts are often used for legitimate, automated admin consent grants, which can trigger false positives. By excluding these accounts from the detection logic, the rule focuses on anomalous behavior from non-privileged accounts, reducing noise while preserving the core detection of suspicious account creation followed by admin consent grant.
Exam trap
The trap here is that candidates may think widening the time window or simplifying the query will reduce false positives, but in reality, these changes either increase noise or break the correlation logic, whereas excluding known legitimate accounts directly addresses the root cause of false alerts.
How to eliminate wrong answers
Option A is wrong because alerting on every admin consent grant event would massively increase false positives, as many legitimate admin consent grants occur without a preceding account creation. Option B is wrong because removing the join with SigninLogs would eliminate the temporal correlation between account creation and the subsequent sign-in used for consent, breaking the detection logic entirely. Option D is wrong because increasing the time window from 10 to 30 minutes would allow more unrelated events to match, likely increasing false positives rather than reducing them.
A company's security team configures network firewall rules so that only a dedicated jump server's IP address can initiate RDP connections to production servers. This is an example of which security principle?
The principle of least privilege dictates that users and systems should only be granted the minimum necessary permissions to perform their legitimate functions. By configuring firewall rules to restrict Remote Desktop Protocol (RDP) access exclusively to a hardened jump server, the security team ensures that direct administrative access to sensitive internal resources is severely limited. This prevents unauthorized lateral movement and reduces the attack surface, aligning precisely with the goal of minimizing potential harm from compromised credentials or systems.
Why this answer
Restricting RDP access to only a dedicated jump server's IP address ensures that no other hosts or users can directly initiate remote desktop connections to production servers. This enforces the principle of least privilege by granting only the minimum necessary network access (the jump server) required for administrative tasks, reducing the attack surface and limiting lateral movement.
Exam trap
The trap here is that candidates confuse 'least privilege' (limiting access to what is necessary) with 'defense in depth' (multiple layers), because both involve restricting access, but least privilege focuses on the minimal permissions while defense in depth focuses on layered controls.
How to eliminate wrong answers
Option B (Defense in depth) is wrong because defense in depth involves multiple layers of security controls (e.g., firewalls, IDS, encryption) working together, not a single access restriction. Option C (Zero Trust) is wrong because Zero Trust assumes no implicit trust and requires continuous verification of every request, whereas this rule is a static IP-based allowlist that does not verify identity or session context. Option D (Separation of duties) is wrong because separation of duties divides critical tasks among different people to prevent fraud or error, not restrict network access to a specific source IP.
Which TWO capabilities are provided by Microsoft Entra ID?
Microsoft Entra ID natively provides robust multifactor authentication (MFA) capabilities, allowing organizations to enforce an additional layer of security beyond just a password. Users can verify their identity through various methods like authenticator apps, biometrics, or security keys, significantly reducing the risk of unauthorized access from compromised credentials. This capability is central to a strong identity and access management strategy within the Microsoft cloud ecosystem.
Why this answer
Options A and D are correct. Microsoft Entra ID provides multifactor authentication and single sign-on capabilities. Option B (Device management) is incorrect because device management is primarily handled by Microsoft Intune, part of Microsoft Endpoint Manager.
Option C (Security incident detection) is incorrect because security incident detection is provided by Microsoft Sentinel, a SIEM solution. Option E (Data classification) is incorrect because data classification is a feature of Microsoft Purview (formerly Azure Information Protection).
A company uses Microsoft Entra ID. The IT department needs to ensure that membership in the 'Global Administrator' role is regularly reviewed. Every quarter, the designated reviewers (e.g., senior managers) receive an email asking them to confirm whether each user in the role should keep their assignment. After the review deadline, any member not approved is automatically removed. Which Microsoft Entra ID feature should they configure?
Microsoft Entra ID Access Reviews enable organizations to efficiently manage group memberships, access to applications, and role assignments by creating recurring review campaigns. These campaigns empower designated reviewers, often resource owners, to periodically attest to the continued need for access for each member. Upon completion of the review period, Access Reviews can automatically remove users whose access was not approved, ensuring the principle of least privilege and reducing stale access. This directly addresses the need for periodic review and removal of access.
Why this answer
Access Reviews in Microsoft Entra ID are specifically designed for periodic attestation of group memberships, application access, and role assignments. The scenario describes a quarterly review where designated reviewers receive email notifications and unapproved members are automatically removed after the deadline, which is the exact workflow that Access Reviews automate. This feature ensures compliance by requiring explicit confirmation for each user in the Global Administrator role.
Exam trap
The trap here is that candidates confuse Privileged Identity Management (PIM) with Access Reviews because both deal with privileged roles, but PIM handles activation and approval, while Access Reviews handle periodic attestation and removal of stale assignments.
Why the other options are wrong
PIM provides just-in-time privileged access and activation workflows, but it does not include the recurring review and automatic removal process described. The question specifically requires periodic reviews with automatic removal, which is a core feature of Access Reviews, not PIM.
Identity Protection is designed to detect and remediate identity-based risks (e.g., compromised accounts, risky sign-ins), not to manage periodic review and removal of role assignments.
Conditional Access is used to enforce access controls based on conditions like location or device state, not for reviewing and attesting role memberships. The question specifically requires a review and attestation process, which is handled by Access Reviews.
When would these options actually be correct?
PIM would be correct if the question asked: 'The IT department needs to allow users to request temporary elevation to the Global Administrator role, with approval from senior managers and automatic expiration after a set time.'
An organization wants to automatically detect and block sign-ins from anonymous IP addresses or locations with atypical travel patterns, and require multi-factor authentication for high-risk users.
A company wants to require that all users accessing a sensitive application from outside the corporate network must use multi-factor authentication. They need a policy that evaluates conditions (e.g., location, device compliance) and grants or blocks access accordingly.
Why candidates pick the wrong answer
Candidates often confuse PIM with Access Reviews because both are part of Microsoft Entra ID Governance and involve privileged roles. PIM includes review capabilities, but the question's emphasis on recurring reviews and automatic removal points specifically to Access Reviews.
Candidates may confuse 'reviewing role membership' with 'protecting identities' because both involve security oversight, but Identity Protection focuses on risk detection, not role governance.
Candidates may confuse Conditional Access with access governance features, thinking it can be used to review role assignments, but it is actually a policy engine for enforcing access requirements.
A security team wants to detect when a user downloads an unusually large number of files from a third-party cloud storage app (e.g., Box) after logging in from an unfamiliar location. They also want to automatically suspend the user's account if such behavior is detected. Which Microsoft security solution should they use?
Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing comprehensive visibility, control, and protection across all cloud applications, both sanctioned and unsanctioned. It actively monitors user activities, including file downloads and uploads, across third-party SaaS applications, detecting anomalous behaviors like mass downloads that could indicate data exfiltration. This solution is specifically engineered to identify and respond to threats within the cloud app ecosystem, making it ideal for detecting when a user downloads a file from a cloud service.
Why this answer
Microsoft Defender for Cloud Apps (MDCA) is the correct solution because it provides Cloud Access Security Broker (CASB) capabilities, including anomaly detection for user behavior across third-party cloud apps like Box. It can detect activities such as an unusually large number of file downloads from an unfamiliar location using its built-in behavioral analytics and then automatically apply a governance action, such as suspending the user's account, via policy-driven automated responses.
Exam trap
The trap here is that candidates often confuse Microsoft Defender for Cloud Apps with Microsoft Defender for Office 365, assuming that 'cloud apps' only refers to Microsoft 365 services, but MDCA specifically covers third-party SaaS apps like Box, Salesforce, and AWS, while Defender for Office 365 is limited to Microsoft's own collaboration suite.
How to eliminate wrong answers
Option A is wrong because Microsoft Defender for Office 365 focuses on protecting email and collaboration tools within Exchange Online, SharePoint Online, and Teams, not on monitoring third-party cloud storage apps like Box for anomalous download behavior. Option C is wrong because Microsoft Defender for Identity is designed to detect on-premises Active Directory attacks (e.g., lateral movement, privilege escalation) using network traffic and event logs, not to monitor user activity in third-party SaaS applications. Option D is wrong because Microsoft Defender for Endpoint is an endpoint detection and response (EDR) solution that protects devices (Windows, macOS, Linux) from malware and advanced threats, not cloud app usage or user account suspension in SaaS platforms.
A multinational organization must comply with GDPR and local data residency requirements. The compliance team needs to ensure that personal data is not stored in regions outside the permitted locations. Which Microsoft Purview capability should they use to discover and map personal data across the organization's data estate?
Microsoft Purview Data Map provides a unified metadata store that automatically scans, classifies, and maps data across an organization's hybrid data estate, including on-premises, multi-cloud, and SaaS sources. This capability is fundamental for GDPR compliance as it enables organizations to discover where personal data resides, understand its lineage, and identify sensitive information types, which is crucial for fulfilling data subject access requests and demonstrating accountability.
Why this answer
Microsoft Purview Data Map is the correct capability because it provides automated data discovery, classification, and lineage across hybrid and multi-cloud data estates. It enables organizations to scan, map, and catalog personal data, including GDPR-sensitive attributes, and enforce data residency policies by identifying where data is stored. This directly supports the compliance team's need to discover and map personal data across permitted locations.
Exam trap
The trap here is that candidates often confuse Compliance Manager (which assesses compliance posture) with Data Map (which discovers and maps data), leading them to select Compliance Manager because it sounds like it 'manages compliance' for GDPR, but it does not perform data discovery.
How to eliminate wrong answers
Option A is wrong because Microsoft Purview Data Lifecycle Management focuses on retaining, deleting, and managing data based on policies (e.g., retention labels), not on discovering or mapping personal data across the data estate. Option B is wrong because Microsoft Purview Compliance Manager is a risk assessment and compliance score tool that evaluates controls against regulations like GDPR, but it does not perform data discovery or mapping of personal data. Option D is wrong because Microsoft Purview Audit provides logging and investigation of user and admin activities, not the discovery or mapping of personal data across storage locations.
A company wants to block all sign-ins using legacy authentication protocols because these protocols do not support multi-factor authentication (MFA). Which component of a Microsoft Entra ID Conditional Access policy should be configured to achieve this?
In Azure AD Conditional Access, the "Conditions" section allows administrators to define specific criteria for policy application. The "Client apps" condition specifically targets the type of client application attempting to access resources, including options to block "Other clients," which encompasses legacy authentication protocols like POP3, IMAP, SMTP, and older Office clients. By selecting this option, organizations can enforce the exclusive use of modern authentication clients, significantly enhancing security by eliminating vulnerabilities associated with less secure, basic authentication methods.
Why this answer
To block legacy authentication protocols, you configure the 'Client apps' condition in a Conditional Access policy. This setting allows you to target specific authentication clients, such as Exchange ActiveSync, POP3, IMAP, and SMTP, which do not support MFA. By selecting 'Exchange ActiveSync clients' and 'Other clients' under the Client apps condition, you can enforce a block on all sign-ins using these legacy protocols.
Exam trap
The trap here is that candidates often confuse 'Client apps' with 'Cloud apps or actions', thinking they need to select the specific legacy app (like Exchange Online) rather than the authentication client type, which is the correct way to block the protocol itself.
Why the other options are wrong
The 'Cloud apps or actions' component specifies which applications or user actions the policy applies to, not the authentication protocol. Blocking legacy authentication requires configuring the 'Client apps' condition under 'Conditions'.
The Grant control in a Conditional Access policy is used to enforce requirements like MFA or device compliance after conditions are met, not to block specific authentication protocols. Blocking legacy authentication is done by configuring the Client apps condition under Conditions.
The Session control in a Conditional Access policy manages session-level behaviors like app-enforced restrictions or sign-in frequency, not the blocking of authentication protocols. Blocking legacy authentication is done by configuring the Client apps condition under Conditions.
When would these options actually be correct?
A question asks: 'A company wants to require MFA for all access to its financial reporting app in Microsoft Entra ID. Which component should be configured?' Here, 'Cloud apps or actions' would be correct to select the specific app.
In a scenario where the goal is to require MFA for all cloud app access, the Grant control would be configured to require MFA. For example: 'A company wants to enforce MFA for all users accessing Microsoft 365. Which component should be configured?'
A company wants to enforce sign-in frequency for all cloud app sessions, requiring users to re-authenticate every hour. Configuring the Session control with sign-in frequency settings would be the correct approach.
Why candidates pick the wrong answer
Candidates may confuse the target of the policy (the app) with the condition that controls the authentication method, thinking that specifying the app is sufficient to block legacy protocols.
Candidates may confuse the Grant control with the mechanism to block access, as it includes a 'Block access' option. However, blocking legacy authentication is a condition-based action, not a grant control.
Candidates may confuse Session controls with authentication protocol controls, thinking that session settings can block legacy protocols, or they may not clearly distinguish between Conditions and Session in Conditional Access policies.
An organization wants to provide a secure way for external partners to access specific SharePoint sites without creating new user accounts. What Microsoft Entra B2B feature should they use?
Azure AD B2B collaboration allows organizations to securely invite external users, such as partners, vendors, or customers, to access their applications and resources while letting these users sign in with their own identities. This includes identities from other Azure AD tenants, social identity providers (like Google or Microsoft accounts), or even email one-time passcodes. It provides a streamlined and secure method for external users to access shared resources without creating new credentials in the inviting organization's directory, maintaining strong security controls and compliance.
Why this answer
B2B collaboration is the correct Microsoft Entra B2B feature because it allows external partners to access specific SharePoint sites using their own identities (e.g., work or social accounts) without requiring new user accounts or passwords to be created in the organization's tenant. This is achieved through invitation-based redemption, where the partner user is represented as a guest user object in the directory, enabling fine-grained access control via SharePoint site sharing policies.
Exam trap
The trap here is that candidates confuse B2B collaboration (for external partner access with existing identities) with Azure AD B2C (for customer-facing identity management), or mistakenly think Direct federation is required for partner access when B2B collaboration already handles the invitation and redemption process without creating new accounts.
How to eliminate wrong answers
Option A is wrong because Azure AD B2C (Business-to-Consumer) is designed for customer-facing applications with self-service sign-up, not for granting external partners access to internal SharePoint sites without creating accounts. Option B is wrong because Direct federation is an authentication method that establishes a trust relationship with an external IdP for inbound SAML/WS-Fed federation, but it does not provide the invitation-based guest access model needed for ad-hoc partner access to SharePoint. Option C is wrong because Azure AD Domain Services provides managed domain services (e.g., LDAP, Kerberos) for legacy applications, not for external partner identity management or SharePoint access.
Practice SC-900 by domain
Target a specific domain to shore up weak areas.