Microsoft Security, Compliance, and Identity Fundamentals SC-900 SC-900 Questions 826–900 | Page 12/17

826

MCQhard

Refer to the exhibit. You run a Kusto query in Microsoft Defender XDR Advanced Hunting. What does this query return?

A.Top 10 high-severity alert titles by number of distinct affected devices

B.Top 10 alert titles by number of distinct devices, including all severities

C.Top 10 devices with the most high-severity alerts

D.Top 10 high-severity alert titles by total number of alerts

AnswerA

This option accurately describes a Kusto query that would use `where AlertSeverity == 'High'` to filter, then `summarize DistinctDevices = dcount(DeviceName) by AlertTitle`, and finally `top 10 by DistinctDevices desc` to achieve the stated goal. The use of `dcount(DeviceName)` correctly calculates the number of unique devices affected by each alert title, directly matching the 'distinct affected devices' requirement. Grouping by `AlertTitle` ensures the ranking is based on alert types, providing the top 10 most impactful alert titles.

Why this answer

The query filters for high-severity alerts, then summarizes by AlertTitle and counts distinct DeviceName values. It orders by that count descending and takes the top 10, so it returns the top 10 high-severity alert titles ranked by the number of distinct affected devices.

Exam trap

The trap here is that candidates confuse 'distinct devices' with 'total alerts' or 'devices with the most alerts', and overlook the explicit severity filter, leading them to choose options that ignore the high-severity filter or misidentify the aggregation column.

How to eliminate wrong answers

Option B is wrong because the query explicitly filters for high-severity alerts (where Severity == 'High'), so it does not include all severities. Option C is wrong because the query summarizes by AlertTitle, not by DeviceName; it returns alert titles, not device names. Option D is wrong because the query uses dcount(DeviceName) to count distinct devices, not a count of total alerts (which would use count()).

Full explanation →

827

Multi-Selecteasy

Which TWO features are part of Microsoft Defender XDR?

Select 2 answers

A.Automated investigation and response

B.Cloud app discovery

C.Endpoint data loss prevention

D.Identity Protection

E.Incident management across workloads

AnswersA, E

XDR includes AIR capabilities.

Why this answer

Automated investigation and response (AIR) is a core capability of Microsoft Defender XDR, enabling automatic response to threats across workloads. Option E is correct because Incident management across workloads allows security teams to manage and correlate incidents from multiple sources in a unified console within Defender XDR. Option B is incorrect because Cloud app discovery is a feature of Microsoft Defender for Cloud Apps, not Defender XDR.

Option C is incorrect because Endpoint data loss prevention (Endpoint DLP) is part of Microsoft Purview compliance solutions. Option D is incorrect because Identity Protection is a feature of Microsoft Entra ID (formerly Azure AD), not Defender XDR.

Full explanation →

828

MCQhard

Your organization uses Microsoft Entra ID and Microsoft Intune. You need to ensure that only managed compliant devices can access corporate email via Outlook mobile app. What is the most efficient approach?

A.Create an app protection policy in Microsoft Intune for Outlook and assign it to all users

B.Enforce device compliance policies in Intune and create a Conditional Access policy that requires compliant device

C.Create a Conditional Access policy that requires MFA for the Outlook app

D.Create a Conditional Access policy that requires a compliant device and create an app protection policy for Outlook

AnswerD

This combination provides robust security by layering controls. A Conditional Access policy requiring a compliant device ensures that only devices meeting defined security standards can access Outlook, acting as the initial gatekeeper. Concurrently, an app protection policy for Outlook then secures corporate data *within* the application, preventing data leakage by restricting actions like copy/paste to personal apps or saving to unmanaged cloud storage, even on a compliant device. This dual approach protects both the access pathway and the data itself.

Why this answer

A Conditional Access policy requiring a compliant device ensures only managed devices can access corporate email, while an app protection policy (APP) adds data protection for the Outlook app, preventing data leakage. Option A is wrong because an app protection policy alone does not enforce device compliance; it only protects data within the app. Option B is wrong because device compliance plus Conditional Access without an app protection policy may allow data leakage from the app.

Option C is wrong because MFA only provides authentication, not device management or data protection.

Full explanation →

829

MCQhard

Your organization has a Microsoft Purview retention policy that retains SharePoint documents for 5 years. After 5 years, you want an administrator to review and approve deletion. Which configuration is required?

A.Configure a disposition review at the end of the retention period

B.Apply a retention label and enable disposition review

C.Use eDiscovery (Premium) to export and then delete

D.Set the retention policy to delete automatically after 5 years

AnswerA

Configuring a disposition review directly within a Microsoft Purview retention policy ensures that content reaching the end of its defined retention period is not automatically deleted. Instead, designated reviewers, typically compliance officers or administrators, receive notifications and can examine the content. This allows them to make an informed decision to either approve the final deletion, extend the retention period, or apply a different retention label, thereby providing essential human oversight before permanent data removal.

Why this answer

A disposition review allows an administrator to manually review and approve or reject deletion at the end of the retention period, meeting the requirement for admin approval.

Option B is incorrect: applying a retention label and enabling disposition review is not required; the configuration needed is to enable disposition review on the retention policy itself. Option C is incorrect: eDiscovery (Premium) is used for legal investigations and exports, not for managing disposition workflows. Option D is incorrect: automatic deletion would delete files without any admin review, which contradicts the requirement.

Full explanation →

830

MCQmedium

Your organization, Contoso Ltd., uses Microsoft 365 and Microsoft Defender XDR. You are a security administrator. Recently, a user named John Doe reported that his account is sending phishing emails internally. You suspect his account is compromised. You need to contain the threat immediately while preserving forensic data. The company has the following security solutions: Microsoft Entra ID P2, Microsoft Defender for Office 365, Microsoft Defender for Endpoint, Microsoft Sentinel, and Microsoft Purview. You need to prevent the compromised account from causing further damage. Which action should you take first?

A.Reset the user's password and require a password change

B.Revoke all refresh tokens for the user in Microsoft Entra ID

C.Disable the user account in Microsoft Entra ID

D.Create a mail flow rule in Exchange Online to block the user's emails

AnswerC

Disabling immediately blocks all authentication and access.

Why this answer

Disabling the user account in Microsoft Entra ID immediately prevents the compromised account from initiating any new actions, including sending phishing emails. This is the fastest containment step while preserving forensic data. Option A (reset password) is incorrect because it does not terminate active sessions; the attacker may still have a valid token.

Option B (revoke refresh tokens) is a useful step but is not as immediate as disabling the account, and it may not stop all sessions. Option D (create mail flow rule) is too slow and may not affect sessions already authenticated.

Full explanation →

831

MCQhard

Your organization uses Microsoft Sentinel for SIEM. You receive an alert that a user account was compromised. You need to automatically disable the user's access across all cloud apps (SaaS) and reset their password. What should you use?

A.Create a Microsoft Sentinel automated response playbook

B.Use Microsoft Intune to remote wipe the user's device

C.Manually disable the user in Microsoft Entra ID and reset password

D.Configure a Microsoft Defender for Cloud Apps session policy

AnswerA

Microsoft Sentinel automated response playbooks, built on Azure Logic Apps, are specifically designed for Security Orchestration, Automation, and Response (SOAR). They can be triggered by Sentinel incidents or alerts to execute predefined workflows, such as calling the Microsoft Graph API to disable a user account in Microsoft Entra ID and initiate a password reset. This provides an immediate, automated, and scalable response to detected threats, directly addressing the requirement for revoking user access and resetting passwords without human intervention.

Why this answer

Microsoft Sentinel's automated response playbooks, built on Azure Logic Apps, can trigger an incident-based workflow that disables the user in Microsoft Entra ID and resets their password via the Microsoft Graph API. This provides the necessary cross-cloud automation to remediate a compromised account across all SaaS apps without manual intervention.

Exam trap

The trap here is that candidates confuse the reactive, automated remediation capability of Sentinel playbooks with the proactive, policy-based controls of Defender for Cloud Apps or the device-focused actions of Intune, leading them to choose an option that addresses only a subset of the required actions.

How to eliminate wrong answers

Option B is wrong because remote wiping a user's device only removes corporate data from that specific endpoint and does not disable the user's account or reset their password across cloud apps. Option C is wrong because manual disabling and password reset in Microsoft Entra ID is a valid action but does not meet the requirement for automatic response triggered by a Sentinel alert. Option D is wrong because a Microsoft Defender for Cloud Apps session policy controls real-time access and data exfiltration prevention via reverse proxy, but it cannot directly disable a user account or reset a password.

Full explanation →

832

MCQhard

A company deploys a custom web application on Azure App Service (PaaS). The application stores data in Azure SQL Database. The security team needs to identify which security responsibilities fall under the customer according to the Microsoft shared responsibility model. Which of the following is primarily the customer's responsibility for this PaaS deployment?

A.Physical security of the datacenter hosting the App Service

B.Patching the operating system of the App Service host machines

C.Managing user identities and access to the application

D.Network security for the Azure backbone connecting datacenters

AnswerC

While Azure App Service provides the platform, the customer retains full responsibility for managing user identities and controlling access to their custom web application. This includes implementing authentication mechanisms (e.g., integrating with Azure AD, OAuth, or custom identity providers), defining authorization policies, and assigning appropriate roles to users. Microsoft provides the tools and services, but the customer configures and enforces who can access their specific application, which is a key aspect of 'security in the cloud'.

Why this answer

In a PaaS deployment like Azure App Service with Azure SQL Database, the customer is responsible for managing user identities and access to the application, including authentication, authorization, and role-based access control (RBAC). Microsoft manages the underlying infrastructure, including the host OS, physical datacenter security, and network backbone, but the customer must secure application-level access and data plane operations.

Exam trap

The trap here is that candidates often assume PaaS means Microsoft handles all security, but the customer still owns identity and access management for the application and data, which is a frequent exam distraction.

How to eliminate wrong answers

Option A is wrong because physical security of the datacenter is always Microsoft's responsibility under the shared responsibility model, regardless of service model. Option B is wrong because patching the operating system of the App Service host machines is managed by Microsoft as part of the PaaS abstraction; the customer only patches the application code and configuration. Option D is wrong because network security for the Azure backbone connecting datacenters is Microsoft's responsibility, as it is part of the core network infrastructure that the customer cannot control or configure.

Full explanation →

833

MCQeasy

A company is migrating its on-premises applications to Azure. The CIO states that the company is fully responsible for managing the security of its own applications and data, while Microsoft is responsible for the security of the underlying physical infrastructure, such as hardware and data centers. This division of security responsibilities is an example of which concept?

A.Defense in depth

B.Shared responsibility model

C.Zero Trust

D.Least privilege

AnswerB

The shared responsibility model clearly delineates security responsibilities between the cloud provider (Microsoft) and the customer. In IaaS, the customer manages more (applications, data) while the provider secures the physical layer; in PaaS/SaaS, the provider takes on more responsibility.

Why this answer

The scenario directly describes the shared responsibility model, which delineates security obligations between the cloud provider and the customer. Microsoft secures the physical infrastructure (hardware, data centers, networking), while the customer is responsible for securing their own applications, data, and identity management. This division is a foundational concept in cloud computing, explicitly defined in Microsoft's documentation for Azure.

Exam trap

The trap here is that candidates confuse the shared responsibility model with defense in depth, because both involve multiple security layers, but the question specifically asks about the division of responsibilities between provider and customer, not the layering of controls.

Why the other options are wrong

The question describes a division of security responsibilities between the customer and Microsoft, which is the definition of the shared responsibility model, not defense in depth. Defense in depth is a layered security approach, not a division of responsibilities.

Zero Trust is a security model based on the principle of 'never trust, always verify,' not a division of responsibilities between a cloud provider and a customer. The question specifically describes a shared responsibility for security, which is the shared responsibility model.

The question describes a division of security responsibilities between the customer and Microsoft, which is the definition of the shared responsibility model. Least privilege is a principle of granting only necessary access, not a model for dividing security responsibilities.

When would these options actually be correct?

Defense in depth would be correct if the question asked about a security strategy that uses multiple layers of controls (e.g., network, endpoint, application) to protect resources, such as 'An organization implements firewalls, antivirus, and encryption to protect data. This is an example of which concept?'

A question asking: 'A company implements a security strategy that requires authentication and authorization for every access request, regardless of the network location. This approach is an example of which concept?' would make Zero Trust the correct answer.

Least privilege would be correct in a question about access control, such as: 'A company wants to ensure that employees only have the minimum permissions needed to perform their job functions. Which security concept does this describe?'

Why candidates pick the wrong answer

Candidates may confuse defense in depth with shared responsibility because both involve multiple security layers, but defense in depth focuses on layered controls within a single entity's environment, not on dividing responsibilities between parties.

Candidates may confuse Zero Trust with the shared responsibility model because both involve security concepts in cloud environments, but Zero Trust focuses on access control rather than responsibility allocation.

Candidates may confuse least privilege with the shared responsibility model because both involve distributing security tasks, but least privilege focuses on user permissions, not provider-customer responsibility division.

Full explanation →

834

MCQeasy

An organization wants to allow users to classify documents as 'Public', 'Internal', 'Confidential', or 'Highly Confidential' with different levels of protection. Which Microsoft Purview solution should they use?

A.Sensitivity labels

B.Data Loss Prevention (DLP)

C.Communication compliance

D.Retention policies

AnswerA

Sensitivity labels allow organizations to classify and protect data at the document or email level directly by users. When applied, these labels enforce predefined protection actions such as encryption, visual markings (headers, footers, watermarks), and access restrictions, ensuring that sensitive information is handled appropriately throughout its lifecycle, even when shared externally.

Why this answer

Sensitivity labels in Microsoft Purview Information Protection allow organizations to classify and protect documents and emails by applying labels such as 'Public', 'Internal', 'Confidential', or 'Highly Confidential'. These labels can enforce encryption, visual markings (headers/footers/watermarks), and access restrictions based on the classification level, directly meeting the requirement for different levels of protection.

Exam trap

The trap here is confusing Data Loss Prevention (DLP) with classification labels, as DLP also protects data but does not provide the granular, user-selectable classification levels described in the question.

How to eliminate wrong answers

Option B (Data Loss Prevention) is wrong because DLP policies detect and prevent accidental sharing of sensitive information (e.g., credit card numbers) but do not classify documents with custom labels like 'Public' or 'Highly Confidential'. Option C (Communication compliance) is wrong because it focuses on monitoring communications (email, Teams) for policy violations like harassment or insider trading, not on document classification. Option D (Retention policies) is wrong because retention policies manage how long content is kept or deleted, not its classification or protection level.

Full explanation →

835

MCQmedium

A company stores critical financial reports in a SharePoint Online library. To ensure that the reports have not been tampered with, the security team compares a calculated hash of each file against a stored baseline. This verification process primarily protects which security goal?

A.Confidentiality

B.Integrity

C.Availability

D.Non-repudiation

AnswerB

Integrity ensures that data is authentic, accurate, and has not been modified or tampered with since it was last verified. Hashing generates a unique, fixed-size digital fingerprint of the financial reports. If even a single bit of the report is altered, the recomputed hash will be drastically different, immediately signaling unauthorized modification or corruption. Comparing the stored hash with a newly generated hash directly verifies that the file content remains unchanged and authentic.

Why this answer

The verification process uses hash comparison to detect unauthorized changes to files, which directly protects data integrity. Integrity ensures that data has not been altered or tampered with during storage or transit. In SharePoint Online, hashing (e.g., SHA-256) creates a unique fingerprint; if the calculated hash matches the stored baseline, the file is unchanged.

Exam trap

The trap here is confusing integrity with non-repudiation, as both involve cryptographic verification, but non-repudiation requires a digital signature (private key) to prove origin, whereas hash comparison alone only detects changes without identifying who made them.

How to eliminate wrong answers

Option A is wrong because confidentiality is about preventing unauthorized access (e.g., encryption), not detecting tampering. Option C is wrong because availability ensures data is accessible when needed (e.g., uptime, redundancy), not verifying file integrity. Option D is wrong because non-repudiation provides proof of origin or action (e.g., digital signatures, audit logs), not detection of unauthorized modification.

Full explanation →

836

MCQmedium

A company uses Microsoft Entra ID. They want to enforce a policy that requires members of the 'Finance' group to use multi-factor authentication and sign in from a compliant device when accessing the financial reporting application. However, they want to exclude members of the 'Finance Admins' group from these requirements. Which Microsoft Entra ID feature should they configure?

A.Identity Protection

B.Conditional Access

C.Privileged Identity Management (PIM)

D.Entitlement Management

AnswerB

Conditional Access policies in Microsoft Entra ID are the primary mechanism for enforcing granular access controls based on specific conditions. These policies evaluate various signals, such as user or group membership, application being accessed, device state (e.g., compliant or hybrid joined), and location, to determine whether to grant access, block access, or require additional authentication like multi-factor authentication (MFA) or a compliant device. This directly addresses the need to enforce a policy based on group membership and device compliance for application access.

Why this answer

Conditional Access is the correct feature because it allows administrators to define policies that enforce specific access requirements, such as multi-factor authentication and compliant device usage, based on conditions like group membership. In this scenario, the policy targets the 'Finance' group while excluding the 'Finance Admins' group, which is a core capability of Conditional Access policies in Microsoft Entra ID.

Exam trap

The trap here is that candidates often confuse Privileged Identity Management (PIM) with Conditional Access, thinking PIM can enforce MFA or device compliance, when in fact PIM only manages role activation and does not control sign-in conditions for specific applications.

Why the other options are wrong

Identity Protection is used to detect and respond to identity-based risks, such as compromised credentials or unusual sign-in behavior, but it does not enforce access policies like requiring MFA or compliant devices for specific groups or applications.

Privileged Identity Management (PIM) manages just-in-time privileged access and role activation, not device compliance or MFA enforcement for specific groups. The question requires a policy that applies to a group with exclusions, which is a Conditional Access scenario.

Entitlement Management is used for managing access packages and identity governance, not for enforcing sign-in conditions like MFA or device compliance. The scenario requires a policy that applies conditions based on group membership and application, which is the domain of Conditional Access.

When would these options actually be correct?

A company wants to automatically block sign-ins from anonymous IP addresses or require MFA when a sign-in risk is detected as high. In that scenario, Identity Protection would be the correct feature to configure risk-based policies.

A company wants to require approval for activating the 'Global Administrator' role and limit its activation to 4 hours. PIM would be the correct feature to configure for time-bound, approved role activation.

Entitlement Management would be correct if the question asked about automating access requests and approvals for the financial reporting application, such as creating an access package that requires manager approval and periodic access reviews for the Finance group.

Why candidates pick the wrong answer

Candidates may confuse Identity Protection with Conditional Access because both involve MFA and security policies, but Identity Protection focuses on risk detection rather than granular access control based on group membership and device compliance.

Candidates may confuse PIM with Conditional Access because both involve access control and security policies, but PIM focuses on privileged roles rather than user/device conditions.

Candidates may confuse Entitlement Management with Conditional Access because both involve controlling access to resources, but Entitlement Management focuses on governance and lifecycle, not real-time sign-in enforcement.

Full explanation →

837

MCQhard

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to receive alerts when a user attempts to share a file containing personally identifiable information (PII) via email. Which DLP rule component is used to define the notification action?

A.Actions

B.Conditions

C.Location

D.Exceptions

AnswerA

Actions are the core component of a Microsoft Purview DLP policy that dictates the response when content matches the defined conditions. These actions can include blocking access to the content, notifying users or administrators, encrypting the data, or applying retention labels. For instance, a DLP policy might be configured to block sharing of documents containing sensitive data externally and simultaneously send an alert to the security team. This directly addresses what happens when a DLP match occurs.

Why this answer

In Microsoft Purview DLP, the 'Actions' component defines what happens when a DLP rule is triggered, including sending notifications or alerts to administrators. For the scenario of receiving alerts when a user attempts to share PII via email, the notification action is configured within the rule's Actions section. Conditions define what data to match, Locations specify where to monitor, and Exceptions refine rule scope, but only Actions contain the notification settings.

Exam trap

The trap here is that candidates often confuse 'Conditions' with 'Actions', mistakenly thinking that defining what data to detect (Conditions) inherently includes the notification response, but in DLP rules, Conditions only specify the match criteria, while Actions separately define the enforcement and alerting behavior.

How to eliminate wrong answers

Option B is wrong because Conditions define the criteria for detecting sensitive data (e.g., PII content or context), not the response actions like notifications. Option C is wrong because Location specifies where the DLP policy is applied (e.g., Exchange Online, SharePoint), not the action taken when a match occurs. Option D is wrong because Exceptions allow you to exclude certain activities or users from triggering the rule, but they do not define notification actions.

Full explanation →

838

MCQhard

An organization uses Microsoft Entra ID Protection. A user's sign-in is flagged with a risk level of 'High' because of an anonymous IP address. The administrator wants to automatically block the sign-in while allowing the user to self-remediate. Which should be configured?

A.A Conditional Access policy requiring MFA for high-risk sign-ins

B.A user risk policy configured to require a password change

C.A sign-in risk policy configured to block access

D.An MFA registration policy for all users

AnswerC

Microsoft Entra ID Protection's sign-in risk policy directly evaluates the risk associated with a specific sign-in attempt in real-time. When configured to block access for a detected risk level, such as 'High,' it prevents the user from completing the sign-in immediately. This directly addresses the requirement to automatically block a high-risk sign-in, ensuring immediate protection against potentially compromised credentials and unauthorized access.

Why this answer

A sign-in risk policy in Microsoft Entra ID Protection can be configured to automatically block access when a sign-in is detected as high risk (e.g., from an anonymous IP address). This policy operates at the sign-in level, allowing the administrator to block the sign-in while still enabling the user to self-remediate (e.g., by signing in again after the risk is mitigated). Option C directly matches this requirement.

Exam trap

The trap here is confusing sign-in risk policies (which block or challenge at the sign-in event) with user risk policies (which require password changes after a compromise), leading candidates to choose a user risk policy when the scenario explicitly describes a sign-in-level risk from an anonymous IP.

Why the other options are wrong

This option requires MFA for high-risk sign-ins but does not block access, which contradicts the administrator's goal to automatically block the sign-in while allowing self-remediation.

The question specifies a sign-in risk (anonymous IP address), not user risk. A user risk policy targets user account compromise, not sign-in events, and would not block the sign-in based on sign-in risk.

An MFA registration policy requires users to register for MFA but does not block sign-ins or allow self-remediation for high-risk sign-ins. The question specifically asks to block access and allow self-remediation, which is achieved by a sign-in risk policy configured to block access.

When would these options actually be correct?

This would be correct if the question asked for a policy that requires additional verification (MFA) for high-risk sign-ins, without blocking access, and the user can self-remediate by completing MFA.

A user risk policy requiring a password change would be correct if the question described a user risk (e.g., leaked credentials) and the goal was to force the user to self-remediate by changing their password after the risk is detected.

This option would be correct if the question asked: 'An organization wants to ensure all users are registered for MFA before accessing cloud apps. Which policy should be configured?' In that case, an MFA registration policy would enforce registration.

Why candidates pick the wrong answer

Candidates may think requiring MFA is sufficient to mitigate risk, but they overlook the explicit requirement to block the sign-in, not just challenge it.

Candidates may confuse user risk with sign-in risk, or think that requiring a password change is a common remediation for high-risk events, not realizing that sign-in risk policies handle sign-in blocking directly.

Candidates may confuse MFA registration with risk-based policies, thinking that requiring MFA for all users addresses high-risk sign-ins, but it does not block access or provide self-remediation for specific risk events.

Full explanation →

839

MCQhard

You are reviewing a Conditional Access policy configuration in Microsoft Entra ID. Based on the exhibit, what is the effect of this policy?

A.Blocks sign-ins for users with high user risk

B.Blocks sign-ins that have a high sign-in risk level

C.Blocks all sign-ins for the assigned users

D.Requires multi-factor authentication for high-risk sign-ins

AnswerB

This statement accurately describes the policy's intended behavior. The conditional access policy is configured to evaluate the "sign-in risk level" condition, specifically targeting "High" risk as detected by Azure AD Identity Protection. When a sign-in attempt is classified as having a high sign-in risk, the policy's grant control, which is set to "Block access," will prevent the user from completing the authentication process.

Why this answer

The policy is configured to target 'All users' and 'All cloud apps' with a condition of 'Sign-in risk level: High' and an access control of 'Block access'. This means any sign-in attempt that Microsoft Entra ID detects as having a high sign-in risk (e.g., from a compromised token or anonymous IP) will be blocked. Option B correctly identifies this effect.

Exam trap

The trap here is confusing 'sign-in risk' with 'user risk'—candidates often pick Option A because they misread the condition, but the exhibit explicitly shows 'Sign-in risk' as the condition, not 'User risk'.

How to eliminate wrong answers

Option A is wrong because the policy targets 'Sign-in risk', not 'User risk'; user risk refers to the likelihood that a user's identity is compromised, which is a separate condition in Conditional Access. Option C is wrong because the policy does not block all sign-ins; it only blocks sign-ins that meet the specific condition of 'High' sign-in risk level, so normal sign-ins are unaffected. Option D is wrong because the access control is set to 'Block access', not 'Require multi-factor authentication'; requiring MFA would grant access after additional verification, not block it.

Full explanation →

840

MCQhard

You are deploying Microsoft Entra Verified ID to issue verifiable credentials for employee onboarding. Which component is required to issue credentials?

A.A public key infrastructure (PKI) certificate

B.A custom application registered in Microsoft Entra ID

C.A decentralized identifier (DID) for your organization

D.A blockchain node for the decentralized ledger

AnswerC

A Decentralized Identifier (DID) is the foundational element for an organization to act as an issuer in Microsoft Entra Verified ID. This globally unique, self-owned identifier is published to a decentralized ledger (e.g., ION) and contains the public keys and service endpoints necessary for cryptographic operations, such as signing verifiable credentials. The DID cryptographically anchors the organization's verifiable identity, enabling holders and verifiers to trust the authenticity and integrity of the credentials issued.

Why this answer

Microsoft Entra Verified ID requires a decentralized identifier (DID) for your organization to issue verifiable credentials. The DID serves as the cryptographic anchor that proves your organization's authority to issue credentials, as it is registered on a decentralized ledger (ION) and linked to your public keys. Without a DID, the verifiable credentials cannot be cryptographically signed and verified by relying parties.

Exam trap

The trap here is that candidates often confuse the need for a custom app registration (Option B) as the core requirement, but the DID is the mandatory cryptographic identity anchor without which no credentials can be issued.

How to eliminate wrong answers

Option A is wrong because a public key infrastructure (PKI) certificate is not required; Entra Verified ID uses decentralized public key infrastructure (DPKI) based on DIDs and Verifiable Credentials (VCs), not traditional X.509 PKI certificates. Option B is wrong because while a custom application registered in Microsoft Entra ID is used to interact with the Verified ID API, it is not the component required to issue credentials—the DID is the foundational identity anchor. Option D is wrong because a blockchain node is not required; Microsoft uses the ION (Identity Overlay Network) as a Sidetree-based decentralized ledger, but the organization does not need to run a node—the DID is resolved via the ION network without direct node management.

Full explanation →

841

MCQmedium

Your organization uses Microsoft Sentinel as a SIEM. You need to collect security events from on-premises servers. Which connector should you use?

A.Azure Monitor Agent (AMA)

B.Azure Security Center connector

C.Microsoft 365 Defender connector

D.Log Analytics workspace

AnswerA

The Azure Monitor Agent (AMA) is the primary agent for collecting logs and performance data from virtual machines and physical servers, including those located on-premises. It replaces the legacy Log Analytics agent (MMA) and offers enhanced security, cost management, and multi-homing capabilities. AMA sends this collected data directly to a Log Analytics workspace, which serves as Sentinel's data repository for analysis and threat detection.

Why this answer

The Azure Monitor Agent (AMA) is the correct connector because it is the primary agent for collecting security events from on-premises Windows and Linux servers into a Log Analytics workspace, which Microsoft Sentinel uses as its data source. AMA supports data collection rules (DCRs) to filter and route specific security event IDs, replacing the legacy Log Analytics agent. This enables Sentinel to ingest Windows Security Events (e.g., Event ID 4625 for failed logons) for threat detection and incident creation.

Exam trap

The trap here is that candidates confuse the Log Analytics workspace (a storage container) with a data connector, or assume the Azure Security Center connector can collect raw event logs, when in fact only the Azure Monitor Agent (AMA) provides the direct, agent-based collection of security events from on-premises servers.

How to eliminate wrong answers

Option B is wrong because the Azure Security Center connector is used to ingest security alerts and recommendations from Microsoft Defender for Cloud, not raw security events from on-premises servers. Option C is wrong because the Microsoft 365 Defender connector ingests alerts and incidents from Microsoft 365 Defender (e.g., Defender for Endpoint, Defender for Office 365), not from on-premises server event logs. Option D is wrong because a Log Analytics workspace is the destination storage and query environment, not a connector; it cannot collect data directly from servers without an agent like AMA.

Full explanation →

842

MCQmedium

A company runs critical applications on Azure virtual machines and on-premises SQL servers. The security team wants to reduce VM attack surface by allowing just-in-time (JIT) access to RDP and SSH ports only when needed. Additionally, they need to monitor changes to important registry keys and system files on the SQL servers. Which Microsoft security solution should they use?

A.Microsoft Defender for Cloud

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Identity

D.Microsoft Defender for Cloud Apps

AnswerA

Microsoft Defender for Cloud provides comprehensive security posture management and threat protection for Azure resources, including virtual machines. It offers Just-in-Time (JIT) VM access, which significantly reduces the attack surface by locking down inbound traffic to VMs and only opening necessary ports for a limited, controlled period. Furthermore, its File Integrity Monitoring (FIM) capability continuously monitors operating system files, application files, and registry keys for suspicious modifications, alerting administrators to unauthorized changes that could indicate a compromise or misconfiguration.

Why this answer

Microsoft Defender for Cloud provides just-in-time (JIT) VM access to reduce the attack surface by locking down inbound traffic to RDP (port 3389) and SSH (port 22) until a user requests access. It also includes adaptive application controls and file integrity monitoring (FIM) to track changes to registry keys and system files on both Azure VMs and on-premises SQL servers. This makes it the single solution that addresses both requirements.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Endpoint's broader device protection capabilities with the specific JIT and FIM features that are exclusive to Microsoft Defender for Cloud.

How to eliminate wrong answers

Option B (Microsoft Defender for Endpoint) is wrong because it focuses on endpoint detection and response (EDR) for devices, including antivirus and behavioral analysis, but does not natively provide JIT VM access or file integrity monitoring for registry keys and system files. Option C (Microsoft Defender for Identity) is wrong because it is designed to detect identity-based threats using on-premises Active Directory signals, not to manage VM network access or monitor file/registry changes. Option D (Microsoft Defender for Cloud Apps) is wrong because it is a cloud access security broker (CASB) that controls and monitors cloud app usage, not VM access or on-premises SQL server file integrity.

Full explanation →

843

MCQmedium

Your company, Fabrikam, uses Microsoft 365 and has Microsoft Purview Information Protection deployed. You need to protect sensitive documents labeled as 'Confidential' so that they cannot be printed or copied when opened in Microsoft Word. You have created a sensitivity label with the appropriate encryption settings. However, users report that they can still print and copy content from these documents. You verify that the label is published and assigned to the correct users. What should you configure to enforce the protection?

A.Configure the sensitivity label to apply an Azure Rights Management template that restricts printing and copying

B.Implement conditional access policies to block access from unmanaged devices

C.Configure auto-labeling policies to apply the label automatically

D.Create a data loss prevention policy that blocks printing and copying

AnswerA

RMS templates define user permissions for protected content.

Why this answer

The sensitivity label must be configured with an Azure Rights Management (RMS) template that specifies user rights, such as denying printing and copying. The label's encryption settings allow applying an RMS template that restricts these actions. Option B is incorrect because conditional access policies control access to resources, not usage rights within documents.

Option C is incorrect because auto-labeling policies only automatically apply labels but do not enforce rights. Option D is incorrect because data loss prevention (DLP) policies can detect and block certain actions, but to prevent printing and copying within the document, rights management via RMS is required.

Full explanation →

844

MCQeasy

A company uses Microsoft Purview Information Protection to classify and label sensitive documents. The compliance team wants to automatically apply a 'Confidential' label to documents containing an employee's passport number. Which method should they use?

A.Manual labeling by users

B.Trainable classifiers

C.Auto-labeling policy

D.DLP policy

AnswerC

An auto-labeling policy in Microsoft Purview Information Protection is specifically designed to automatically detect sensitive information types, such as passport numbers, within content stored in SharePoint, OneDrive, or Exchange. Upon detection, the policy can then apply a pre-configured sensitivity label to the document or email, ensuring consistent classification and protection without requiring any user intervention. This capability directly addresses the need for automatic application of labels based on specific data patterns.

Why this answer

An auto-labeling policy in Microsoft Purview Information Protection automatically applies sensitivity labels to documents and emails based on sensitive information types (e.g., passport numbers) without user intervention. This method uses content scanning to detect patterns and enforce labeling rules, making it the correct choice for the compliance team's requirement.

Exam trap

The trap here is that candidates confuse DLP policies with auto-labeling, but DLP focuses on preventing data loss through actions like blocking or encryption, not on automatically applying sensitivity labels to content.

How to eliminate wrong answers

Option A is wrong because manual labeling relies on users to apply labels themselves, which is inconsistent and does not meet the requirement for automatic application. Option B is wrong because trainable classifiers use machine learning to identify content based on patterns or context, not specific sensitive information types like passport numbers; they are designed for more complex or ambiguous content. Option D is wrong because a DLP policy detects and prevents unauthorized sharing of sensitive data but does not apply sensitivity labels; it enforces actions like blocking or alerting, not labeling.

Full explanation →

845

MCQmedium

An organization wants to detect and respond to threats across their cloud infrastructure, including Azure, AWS, and GCP. Which Microsoft security solution should they centralize their security monitoring in?

A.Microsoft Purview

B.Microsoft Sentinel

C.Microsoft Defender for Cloud

D.Microsoft Defender for Cloud Apps

AnswerB

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It ingests security data from virtually any source, including users, devices, applications, and infrastructure, across multi-cloud and on-premises environments. Sentinel then uses AI and machine learning to detect advanced threats, investigate incidents, and automate responses, providing comprehensive threat detection and response capabilities.

Why this answer

Microsoft Sentinel is the correct choice because it is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration Automated Response (SOAR) solution designed to ingest logs and alerts from multiple cloud providers, including Azure, AWS, and GCP, via native connectors and industry-standard protocols like Syslog and CEF. It centralizes threat detection and response across heterogeneous cloud environments, whereas the other options focus on specific security domains or single-cloud protection.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM/CWPP tool) with a SIEM, but Defender for Cloud does not provide the centralized log ingestion, correlation, and incident response across multiple cloud providers that Sentinel offers.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview is a data governance and compliance solution focused on data classification, labeling, and risk management, not on detecting and responding to threats across cloud infrastructure. Option C is wrong because Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) that primarily secures Azure resources and can extend to AWS and GCP via connectors, but it lacks the centralized SIEM/SOAR capabilities for multi-cloud threat detection and response that Sentinel provides. Option D is wrong because Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that focuses on shadow IT discovery and SaaS application security, not on ingesting and correlating security logs from IaaS and PaaS workloads across Azure, AWS, and GCP.

Full explanation →

846

Multi-Selecthard

Which THREE of the following are capabilities of Microsoft Purview Information Protection? (Select three.)

Select 3 answers

A.Rights management

B.eDiscovery

C.Data classification

D.Sensitivity labels

E.Data loss prevention policies

AnswersA, C, D

Protect data with encryption and usage restrictions.

Why this answer

Options A, C, and D are correct. Microsoft Purview Information Protection includes rights management (A), data classification (C), and sensitivity labels (D) as core capabilities. Option B (eDiscovery) is a separate solution in Microsoft Purview, not part of Information Protection.

Option E (data loss prevention policies) is also a different solution, although it works together with Information Protection.

Full explanation →

847

MCQmedium

A user reports that they are repeatedly prompted for multifactor authentication when accessing Microsoft 365 apps from the same trusted device. What should you do to reduce the number of prompts?

A.Disable MFA for the user

B.Change the user's MFA method to text message

C.Configure 'Remember MFA' settings in Conditional Access

D.Reset the user's MFA registration

AnswerC

Configuring 'Remember MFA' settings, typically through the 'Sign-in frequency' control within a Conditional Access policy, allows administrators to specify how often users are prompted for MFA. By setting a longer duration, such as 90 days, users on trusted devices can remain authenticated without repeated MFA challenges for that period. This balances security with user experience by reducing prompt fatigue while maintaining strong authentication.

Why this answer

The 'Remember MFA' setting in Conditional Access allows administrators to configure the session lifetime for MFA prompts on trusted devices. By extending the 'MFA reauthentication frequency' or enabling 'Remember Multifactor Authentication' for a longer period (e.g., 30 days), users will not be repeatedly challenged on the same device, reducing friction while maintaining security.

Exam trap

The trap here is that candidates often confuse 'changing the MFA method' (Option B) with reducing prompt frequency, not realizing that the method type has no impact on how often the prompt appears—only the session persistence settings control that.

How to eliminate wrong answers

Option A is wrong because disabling MFA entirely removes the security control, which violates the principle of least privilege and exposes the account to credential theft. Option B is wrong because changing the MFA method to text message does not affect the frequency of prompts; it only changes the delivery mechanism, and the user would still be prompted repeatedly on the same device. Option D is wrong because resetting the user's MFA registration would force them to re-register all authentication methods, which does not address the prompt frequency issue and could actually increase prompts until the new methods are verified.

Full explanation →

848

MCQeasy

A financial institution uses digital signatures to sign all transaction records. This ensures that the records have not been altered after signing. Which security goal does this primarily protect?

A.Confidentiality

B.Non-repudiation

C.Integrity

D.Availability

AnswerC

Integrity ensures that data remains accurate, complete, and has not been modified or tampered with by unauthorized parties. Digital signatures achieve this by generating a unique cryptographic hash of the document's content, which is then encrypted with the signer's private key. Any subsequent alteration to the document, even a single character, will cause a mismatch between the recomputed hash and the decrypted hash from the signature, thereby immediately indicating that the record's integrity has been compromised.

Why this answer

Digital signatures use asymmetric cryptography (e.g., RSA or ECDSA) to create a hash of the transaction record, which is then encrypted with the signer's private key. Any alteration to the record after signing would cause the hash verification to fail, directly protecting the integrity of the data. While digital signatures also support non-repudiation, the question specifically asks which goal is primarily protected by ensuring records have not been altered, which is integrity.

Exam trap

The trap here is that candidates confuse the secondary property of non-repudiation with the primary property of integrity, because digital signatures provide both, but the question's wording 'have not been altered after signing' directly points to integrity, not the ability to prove the signer's identity.

How to eliminate wrong answers

Option A is wrong because confidentiality is about preventing unauthorized access to data, typically achieved through encryption (e.g., AES), not through digital signatures which do not hide the content. Option B is wrong because non-repudiation ensures the signer cannot deny having signed the document, which is a secondary benefit of digital signatures, but the question explicitly focuses on preventing alteration after signing, which is integrity. Option D is wrong because availability ensures systems and data are accessible when needed, often via redundancy or disaster recovery, and digital signatures do not address uptime or access.

Full explanation →

849

MCQmedium

A company is involved in litigation and needs to preserve all Exchange Online mailboxes and SharePoint sites related to the case. The legal team also requires the ability to search, review, and export relevant content. Which Microsoft Purview solution should they use?

A.Microsoft Purview eDiscovery (Premium)

B.Microsoft Purview Communication Compliance

C.Microsoft Purview Data Lifecycle Management

D.Microsoft Purview Audit (Premium)

AnswerA

Microsoft Purview eDiscovery (Premium) is the comprehensive solution designed for managing legal, regulatory, and internal investigations. It provides an end-to-end workflow that includes placing legal holds on content, such as all Exchange Online mailboxes, to prevent alteration or deletion. This capability ensures that all relevant data is preserved, collected, reviewed, and exported in a defensible manner for litigation purposes, directly addressing the need to preserve content.

Why this answer

Microsoft Purview eDiscovery (Premium) is the correct solution because it provides end-to-end workflow for preserving, searching, reviewing, and exporting content from Exchange Online mailboxes and SharePoint sites. It supports legal hold placement on custodians and data sources, advanced search with keyword and proximity queries, review sets with analytics, and export in a format suitable for litigation. This directly matches the requirement to preserve all relevant mailboxes and sites while enabling the legal team to search, review, and export content.

Exam trap

The trap here is that candidates confuse eDiscovery (Premium) with Audit (Premium) because both involve searching, but Audit only searches activity logs, not the actual content of mailboxes and sites, and cannot place legal hold or export content.

How to eliminate wrong answers

Option B (Microsoft Purview Communication Compliance) is wrong because it is designed to detect and remediate inappropriate communications (e.g., harassment, insider trading) by analyzing messages and patterns, not for preserving and exporting content for litigation. Option C (Microsoft Purview Data Lifecycle Management) is wrong because it focuses on retention and deletion policies based on data lifecycle, not on preserving content for legal hold or providing search/review/export capabilities. Option D (Microsoft Purview Audit (Premium)) is wrong because it provides detailed audit log search and investigation of user and admin activities, but does not offer legal hold, content preservation, or export of mailbox and site content.

Full explanation →

850

MCQmedium

A company must retain all HR documents stored in SharePoint Online for exactly 7 years. After 7 years, the documents must be automatically deleted. Additionally, employees must not be able to permanently delete these documents before the retention period ends. Which Microsoft Purview solution should they configure?

A.Data Lifecycle Management

B.Records Management

C.Data Loss Prevention

D.Audit

AnswerA

Data Lifecycle Management (DLM) in Microsoft Purview is the correct solution for managing HR documents. It allows the creation of retention labels and policies that automatically retain content for a specified period, preventing premature deletion or modification by users. Once the retention period expires, these policies can then automatically initiate the deletion of the content, ensuring compliance with data retention schedules and organizational policies.

Why this answer

Data Lifecycle Management (DLM) in Microsoft Purview is designed to retain content for a specified period and then automatically delete it. By applying a retention policy with a 7-year retention period and a deletion action at the end, DLM ensures HR documents are kept exactly as required. Additionally, DLM prevents users from permanently deleting documents during the retention period by locking the retention settings, which overrides user delete permissions.

Exam trap

The trap here is that candidates often confuse Records Management with Data Lifecycle Management, assuming that 'records' automatically implies retention and deletion, but Records Management focuses on declaring records and managing disposition reviews, not automatic time-based deletion without user intervention.

How to eliminate wrong answers

Option B (Records Management) is wrong because Records Management is focused on declaring content as records for legal or regulatory compliance, often with immutability and disposition reviews, but it does not inherently enforce automatic deletion after a fixed period without additional configuration; it is more about managing records throughout their lifecycle with manual or review-based disposition. Option C (Data Loss Prevention) is wrong because DLP is designed to prevent sensitive information from being shared or leaked, not to manage retention or deletion schedules. Option D (Audit) is wrong because Audit provides logging and monitoring of user activities, but it does not enforce retention or deletion policies.

Full explanation →

851

MCQeasy

Your organization wants to allow employees to use their personal mobile devices to access corporate resources, but you need to ensure that corporate data is protected if the device is lost or stolen. You also need to enforce a PIN policy on the device. Which combination of Microsoft Entra and Microsoft Intune features should you use?

A.Use Windows Autopilot to configure devices and then apply a device restriction policy.

B.Implement a Conditional Access policy requiring multi-factor authentication and trusted locations.

C.Enroll devices in Microsoft Intune MDM, create a device compliance policy requiring PIN, and configure a Conditional Access policy to allow only compliant devices.

D.Use Microsoft Intune app protection policies (MAM) without device enrollment, requiring PIN for managed apps.

AnswerC

Correct: MDM enrollment enables compliance policies and remote wipe of corporate data.

Why this answer

Enrolling devices in Microsoft Intune MDM allows the organization to apply device compliance policies (such as requiring a PIN) and then use Conditional Access to grant access only to compliant devices. If a device is lost or stolen, the organization can perform a selective wipe to remove corporate data while leaving personal data intact. Option A (Windows Autopilot) is a device provisioning tool, not a security or protection solution.

Option B (Conditional Access with MFA and trusted locations) does not enforce device-level policies like PIN. Option D (MAM without enrollment) can enforce a PIN for managed apps but cannot manage the device itself or perform selective wipe of all corporate data; it is less comprehensive than MDM.

Full explanation →

852

MCQhard

A security analyst is using Microsoft 365 Defender to investigate a sophisticated multi-stage attack. The analyst needs to query data across endpoints, email, and identity logs to identify the attacker's behavior patterns and correlate events. Which Microsoft 365 Defender capability should the analyst use?

A.Automated investigation and response

B.Threat analytics

C.Advanced hunting

D.Action center

AnswerC

Advanced hunting is a powerful, proactive threat hunting tool within Microsoft 365 Defender that allows security analysts to explore raw organizational data using Kusto Query Language (KQL). It aggregates data from endpoints, email, identity, and cloud apps, enabling custom queries to uncover sophisticated threats, identify anomalous behaviors, and correlate events across diverse security domains that automated systems might miss. This capability is crucial for deep investigations and creating custom detection rules.

Why this answer

Advanced hunting is the correct capability because it provides a Kusto Query Language (KQL)-based query interface that allows the security analyst to perform custom, cross-domain searches across data from endpoints (Microsoft Defender for Endpoint), email (Microsoft Defender for Office 365), and identity logs (Microsoft Defender for Identity). This enables the correlation of events and identification of attacker behavior patterns across a multi-stage attack, which is not possible with the other options.

Exam trap

The trap here is that candidates often confuse 'Advanced hunting' with 'Threat analytics' because both involve investigating threats, but Threat analytics is a passive reading tool for pre-built reports, while Advanced hunting is an active, custom query engine for raw data correlation.

Why the other options are wrong

Automated investigation and response (AIR) automates incident response actions, but the question requires querying and correlating data across endpoints, email, and identity logs, which is the purpose of Advanced hunting, not AIR.

Threat analytics provides threat intelligence reports and insights about known threats, but it does not allow the analyst to query raw data across endpoints, email, and identity logs for custom correlation and pattern identification.

The Action center is used to view and manage remediation actions taken by automated investigations, not for querying raw data across endpoints, email, and identity logs to correlate events.

When would these options actually be correct?

A security analyst needs to automatically contain a confirmed malware outbreak across multiple endpoints. In that scenario, Automated investigation and response would be the correct answer because it triggers automated remediation actions based on alerts.

A security analyst wants to understand the latest threat landscape and review detailed reports on active threat actors, including their techniques and recommended mitigations. Threat analytics would be the correct capability to use.

An exam question asks: 'After an automated investigation in Microsoft 365 Defender has completed, where should an analyst go to review and approve pending remediation actions such as deleting malicious files or blocking IP addresses?'

Why candidates pick the wrong answer

Candidates may confuse automated investigation with manual hunting, thinking that 'investigation' includes querying logs, but AIR is about automated response, not ad-hoc data exploration.

Candidates may confuse threat analytics with advanced hunting because both involve investigating threats, but threat analytics focuses on pre-built intelligence rather than custom queries.

Candidates may confuse the Action center with a central place for all security operations, including data querying, because it aggregates actions from multiple Microsoft 365 Defender components.

Full explanation →

853

MCQmedium

A company uses Microsoft 365. The security team wants to protect users from clicking malicious URLs in email messages. The solution should rewrite all links in incoming emails so that when a user clicks them, the URL is checked in real time against a dynamic list of known malicious sites. Which Microsoft Defender for Office 365 feature should they enable?

A.Anti-phishing policies

B.Safe Attachments

C.Safe Links

D.Anti-spam policies

AnswerC

Safe Links is a critical component of Microsoft Defender for Office 365 that provides time-of-click protection against malicious URLs. It dynamically rewrites URLs in emails and Office documents, then scans them in real-time when a user clicks, blocking access to known malicious sites or warning the user if the link's destination has changed to become malicious since initial delivery. This proactive scanning helps prevent users from accessing compromised websites, even if the link was initially benign.

Why this answer

Safe Links is the correct feature because it is specifically designed to protect users from malicious URLs in email messages and Office documents. It rewrites all links in incoming emails so that when a user clicks them, the URL is checked in real time against a dynamic list of known malicious sites, providing time-of-click protection.

Exam trap

The trap here is that candidates often confuse Safe Links with Anti-phishing policies, but Anti-phishing policies handle impersonation and spoofing detection, not URL rewriting and real-time click verification.

Why the other options are wrong

Anti-phishing policies protect against phishing attempts by analyzing email content and sender reputation, but they do not rewrite URLs or perform real-time link checking against a dynamic list of malicious sites.

Safe Attachments protects against malicious attachments by detonating them in a sandbox, not by rewriting and checking URLs in real time. The question specifically requires URL rewriting and real-time link checking, which is the function of Safe Links.

When would these options actually be correct?

An exam question asks: 'Which Microsoft Defender for Office 365 feature should be configured to block users from entering credentials on a fake login page that mimics a trusted site?' In that scenario, anti-phishing policies with impersonation protection would be correct.

Safe Attachments would be correct if the question asked for a feature that scans email attachments for malware by opening them in a virtual environment before delivery, or if the requirement was to block malicious files in email and SharePoint.

Why candidates pick the wrong answer

Candidates may confuse anti-phishing policies with Safe Links because both deal with malicious URLs, but anti-phishing focuses on the email content and sender, not on rewriting and real-time URL scanning.

Candidates may confuse Safe Attachments with Safe Links because both are part of Microsoft Defender for Office 365 and deal with malicious content, but they target different threat vectors: attachments vs. links.

Full explanation →

854

Multi-Selecthard

Which THREE of the following are capabilities of Microsoft Purview Compliance Manager? (Choose three.)

Select 3 answers

A.Automated testing of controls

B.Manage user identities

C.Improvement actions

D.Create data loss prevention policies

E.Compliance score

AnswersA, C, E

Controls can be tested automatically.

Why this answer

Correct answers are A, C, and E: Compliance Manager provides a compliance score, automated testing of controls, and improvement actions. Option B is incorrect because managing user identities is a capability of Microsoft Entra ID, not Compliance Manager. Option D is incorrect because creating data loss prevention policies is a feature of Microsoft Purview Data Loss Prevention, not Compliance Manager.

Full explanation →

855

MCQhard

An organization has deployed Microsoft Entra ID Governance and wants to automate the process of revoking access to a critical application when an employee leaves the company. Which feature should they configure?

A.Microsoft Entra ID Governance Lifecycle Workflows

B.Microsoft Entra Privileged Identity Management

C.Microsoft Entra Access Reviews

D.Microsoft Entra Terms of Use

AnswerA

Microsoft Entra ID Governance Lifecycle Workflows provide automated identity lifecycle management, enabling organizations to define and execute tasks based on HR-driven events like joining, moving, or leaving. This feature can automatically provision or deprovision access to applications and resources, ensuring that when an employee departs, their access is systematically revoked without manual intervention, aligning directly with the requirement to remove access based on HR events.

Why this answer

Microsoft Entra ID Governance Lifecycle Workflows enable automated workflows triggered by HR events like employee termination. When an employee leaves, a lifecycle workflow can be configured to automatically remove the user from the application's access group or disable their account, ensuring immediate revocation of access without manual intervention.

Exam trap

The trap here is confusing automated offboarding (Lifecycle Workflows) with periodic access review (Access Reviews) or privileged role management (PIM), as candidates often think any governance feature can handle termination-based revocation.

How to eliminate wrong answers

Option B is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role activation and approval, not automated offboarding workflows for standard application access. Option C is wrong because Access Reviews are periodic attestation processes that require manual or scheduled review decisions, not automated revocation triggered by a lifecycle event like termination. Option D is wrong because Terms of Use present acceptance policies to users but do not enforce any automated access revocation actions.

Full explanation →

856

MCQhard

A company uses Microsoft Defender for Cloud to secure its hybrid cloud environment. They need to continuously assess compliance with regulatory standards like ISO 27001 and receive recommendations for remediation. Which feature should they enable?

A.Defender for Cloud’s regulatory compliance dashboard

B.Microsoft Defender for Cloud Apps

C.Microsoft Defender for Identity

D.Defender for Cloud’s Secure Score

AnswerA

Microsoft Defender for Cloud's regulatory compliance dashboard is specifically designed to help organizations meet various industry and regulatory standards. It continuously assesses the compliance posture of resources against built-in and custom compliance standards, such as Azure Security Benchmark, PCI DSS, ISO 27001, and HIPAA. The dashboard provides a centralized view of compliance status, offering actionable recommendations and remediation steps to address non-compliant controls and improve overall adherence to regulatory requirements. This direct alignment with compliance frameworks makes it the ideal tool for assessing regulatory posture.

Why this answer

Microsoft Defender for Cloud's regulatory compliance dashboard provides continuous assessments against standards like ISO 27001 and offers recommendations. Secure Score is a security posture metric. Defender plans are for workload protection.

Workload protections are specific to resources.

Full explanation →

857

MCQmedium

Your organization uses Microsoft Sentinel. You need to create an automation rule that automatically closes a low-severity incident after 24 hours of inactivity. Which action should you include in the rule?

A.Run playbook

B.Create incident

C.Add comment

D.Change status to Closed

AnswerD

The 'Change status to Closed' action is the direct and appropriate method within Microsoft Sentinel to formally conclude an incident investigation. This action explicitly updates the incident's lifecycle state, marking it as resolved and no longer requiring active attention from analysts. It is commonly utilized within automation rules or playbooks to automatically close incidents that meet specific criteria, such as after a period of inactivity, successful remediation, or identification as a false positive.

Why this answer

Changing the status to 'Closed' is the direct action needed to automatically resolve a low-severity incident after a period of inactivity in Microsoft Sentinel. Automation rules can trigger status changes based on conditions like time elapsed, and closing the incident removes it from the active queue without manual intervention.

Exam trap

The trap here is that candidates confuse 'automation rule actions' with 'playbook capabilities', assuming a playbook is required to close an incident, when in fact a simple status change action suffices and is more efficient.

How to eliminate wrong answers

Option A is wrong because running a playbook is an action that executes a set of automated tasks (e.g., sending emails or enriching data), but it does not directly close the incident; you would still need a separate status change action. Option B is wrong because creating an incident would generate a new alert or incident, which is the opposite of closing an existing one. Option C is wrong because adding a comment only appends a note to the incident timeline and does not alter its status or lifecycle.

Full explanation →

858

MCQmedium

A company uses Microsoft Entra ID and wants to ensure that guest users who are inactive for 90 days have their access to internal resources automatically revoked. Additionally, a manager must review all guest accounts annually. Which Microsoft Entra feature should be used to implement these requirements?

A.Microsoft Entra Identity Governance Access Reviews

B.Conditional Access policies

C.Privileged Identity Management (PIM)

D.Self-Service Password Reset (SSPR)

AnswerA

Microsoft Entra Identity Governance Access Reviews enable organizations to manage the lifecycle of user access, particularly for guest accounts. They facilitate periodic reviews by resource owners or managers to certify continued access, ensuring compliance and security. These reviews can be automated to remove access for users who are not re-approved or have shown no activity for a defined period, directly addressing the need for guest account management and cleanup. This capability is crucial for maintaining a clean and secure identity posture by preventing stale accounts.

Why this answer

Microsoft Entra Identity Governance Access Reviews enables administrators to create recurring reviews of guest user access and automatically remove access for inactive users. By configuring an access review with a duration of 90 days and enabling automatic revocation, guest users who have not signed in for that period will have their access removed. Additionally, the annual manager review requirement is met by scheduling a recurring review for all guest accounts, ensuring compliance with governance policies.

Exam trap

The trap here is that candidates often confuse Conditional Access policies with identity governance features, mistakenly thinking that Conditional Access can enforce inactivity-based revocation, when in fact it only controls access at sign-in time and cannot perform periodic reviews or automatic removal of stale accounts.

How to eliminate wrong answers

Option B is wrong because Conditional Access policies enforce real-time access controls based on conditions like location or device state, but they cannot automatically revoke access based on inactivity duration or schedule periodic manager reviews. Option C is wrong because Privileged Identity Management (PIM) manages just-in-time activation and approval for privileged roles, not guest user access reviews or inactivity-based revocation. Option D is wrong because Self-Service Password Reset (SSPR) allows users to reset their own passwords and does not provide any mechanism for reviewing or revoking guest access based on inactivity.

Full explanation →

859

Multi-Selectmedium

Which TWO Microsoft Purview features can be used to automatically classify and protect sensitive data in documents?

Select 2 answers

A.Data loss prevention policies

B.eDiscovery (Premium)

C.Trainable classifiers

D.Retention labels

E.Sensitive information types

AnswersC, E

Trainable classifiers use machine learning to classify content based on examples.

Why this answer

Trainable classifiers (C) use machine learning to intelligently identify sensitive content based on context and patterns, enabling automatic classification. Sensitive information types (E) are predefined or custom patterns (e.g., credit card numbers, SSNs) that detect specific data types, which can then trigger protection actions like encryption or access restrictions. Both features work together to automatically classify and protect sensitive data in documents.

Exam trap

Microsoft often tests the misconception that Data loss prevention policies (A) perform automatic classification, when in fact they enforce actions based on pre-existing classifications or sensitive information types, not the classification itself.

Full explanation →

860

MCQhard

A legal team is preparing for an internal investigation related to a potential policy violation. They need to identify all relevant documents stored in Exchange Online and SharePoint Online, but there are millions of items across the organization. The team wants to use a machine learning model that learns from a set of manually reviewed relevant and non-relevant documents to predict relevance and prioritize review. Which Microsoft Purview solution provides this capability?

A.Microsoft Purview Data Loss Prevention (DLP)

B.Microsoft Purview Audit (Premium)

C.Microsoft Purview eDiscovery (Advanced)

D.Microsoft Purview Insider Risk Management

AnswerC

Microsoft Purview eDiscovery (Advanced) is the correct solution for internal investigations requiring efficient document review. It incorporates advanced machine learning capabilities, such as predictive coding (also known as Technology Assisted Review or TAR), to intelligently identify and prioritize relevant documents from vast, unstructured data sets. This significantly accelerates the review process by reducing the volume of data human reviewers must examine, ensuring legal teams can focus on the most pertinent information for their case.

Why this answer

Microsoft Purview eDiscovery (Advanced) provides predictive coding capabilities that use machine learning to analyze a seed set of manually reviewed relevant and non-relevant documents. The model learns from this training to predict the relevance of millions of items across Exchange Online and SharePoint Online, prioritizing review for internal investigations. This directly matches the need for a machine learning model to identify and prioritize relevant documents.

Exam trap

The trap here is that candidates often confuse Insider Risk Management (which also uses machine learning for risk detection) with eDiscovery's predictive coding, but Insider Risk Management targets behavioral patterns and alerts, not document relevance prediction for legal hold and review.

Why the other options are wrong

Microsoft Purview Data Loss Prevention (DLP) is designed to prevent accidental or unauthorized sharing of sensitive data, not to identify and prioritize relevant documents for legal investigations using machine learning.

Microsoft Purview Audit (Premium) provides detailed auditing and investigation of user and admin activities, but it does not include machine learning models to predict document relevance for eDiscovery. The question specifically requires a solution that learns from manually reviewed documents to prioritize review, which is a feature of Advanced eDiscovery, not Audit.

Insider Risk Management is designed to detect, investigate, and act on risky user activities (e.g., data theft, policy violations) using analytics, but it does not provide a machine learning model to predict document relevance for eDiscovery review based on manually labeled samples.

When would these options actually be correct?

A question asking which Microsoft Purview solution helps prevent sensitive information from being shared via email or SharePoint by applying policies to detect and block unauthorized transfers would make DLP the correct answer.

An organization needs to investigate a security incident and must identify all user activities (e.g., file access, email sends) within a specific time frame across Exchange Online and SharePoint Online. The team requires long-term retention of audit logs and high-bandwidth APIs to export audit data for analysis. In this scenario, Microsoft Purview Audit (Premium) would be the correct answer.

A scenario where an organization needs to identify and investigate users who may be engaging in risky activities (e.g., unauthorized data exfiltration, policy violations) by correlating signals from various sources (e.g., DLP alerts, user behavior) would make Insider Risk Management the correct answer.

Why candidates pick the wrong answer

Candidates may confuse DLP's content analysis capabilities with eDiscovery's relevance prediction, assuming that any tool analyzing content can perform document relevance ranking for legal review.

Candidates may confuse Audit (Premium) with eDiscovery because both involve investigation and compliance. The term 'Audit' suggests reviewing records, which seems related to identifying relevant documents, but it lacks the predictive coding and machine learning capabilities required by the question.

Candidates may confuse the 'investigation' aspect of Insider Risk Management with the legal investigation described in the question, or they may think that machine learning for risk detection is the same as machine learning for relevance prediction in eDiscovery.

Full explanation →

861

MCQmedium

A company uses Microsoft Entra ID. They want to require multi-factor authentication (MFA) for users who sign in from locations with a high risk score, as determined by Microsoft's analysis of the sign-in's IP address and other behavioral signals. Which Microsoft Entra ID feature should they configure?

A.Identity Protection

B.Conditional Access

C.Privileged Identity Management

D.Entitlement Management

AnswerA

Microsoft Entra ID Protection is the dedicated service for detecting identity-based risks, including both sign-in risk and user risk, using adaptive machine learning and heuristics. It continuously monitors sign-in attempts and user behavior for anomalies like impossible travel, unfamiliar sign-in properties, or leaked credentials. Based on these detections, Identity Protection can automatically trigger responses such as requiring multi-factor authentication, enforcing a password change, or blocking access, thereby directly addressing the need for risk-based MFA.

Why this answer

Identity Protection is the correct feature because it provides risk-based detection and remediation, including the ability to automatically enforce MFA when a sign-in is flagged with a high risk score. It uses machine learning models to analyze signals such as anonymized IP addresses, atypical travel, and leaked credentials to assign a risk level. This directly matches the requirement to require MFA based on Microsoft's analysis of the sign-in's IP address and behavioral signals.

Exam trap

The trap here is that candidates often confuse Conditional Access as the feature that evaluates risk, when in fact Conditional Access is the policy engine that enforces controls, but Identity Protection is the service that generates the risk scores used as conditions.

Why the other options are wrong

Conditional Access is the policy engine that enforces MFA, but it relies on a risk assessment from Identity Protection. The question asks for the feature that determines the risk score, which is Identity Protection, not Conditional Access.

Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles in Azure AD, not risk-based MFA policies. The question asks for a feature that enforces MFA based on sign-in risk scores, which is handled by Identity Protection, not PIM.

Entitlement Management is used for managing access packages and identity governance, not for enforcing MFA based on risk signals from sign-in behavior.

When would these options actually be correct?

A company wants to enforce MFA for all users accessing a sensitive app from outside the corporate network. They should configure a Conditional Access policy to require MFA based on location or network conditions.

A company needs to provide just-in-time privileged access to Azure AD roles, requiring approval and time-bound activation for administrators. In this scenario, Privileged Identity Management would be the correct feature to configure.

An exam scenario where the question asks: 'Which Microsoft Entra ID feature should be used to create and manage access packages for internal and external users to govern access to resources?'

Why candidates pick the wrong answer

Candidates often confuse Conditional Access as the feature that provides risk detection, when in fact it only consumes risk signals from Identity Protection to enforce policies.

Candidates may confuse PIM's role in securing privileged accounts with risk-based MFA, thinking that managing privileged roles inherently includes risk-based authentication controls.

Candidates may confuse Entitlement Management with broader identity protection features, thinking it includes risk-based policies, or they may misassociate 'entitlements' with access controls like MFA.

Full explanation →

862

Multi-Selectmedium

Which TWO conditions can be used in a Microsoft Entra Conditional Access policy? (Choose two.)

Select 2 answers

A.MFA registration status

B.Password complexity

C.Device platform

D.User risk level

E.Login frequency

AnswersC, D

Device platform is a fundamental condition in Microsoft Entra Conditional Access, enabling administrators to specify which operating systems a policy applies to. This condition allows for highly granular control, such as requiring compliant devices only for specific platforms like iOS and Android, while potentially blocking access from less secure or unsupported platforms like Linux or macOS unless they meet additional criteria. It directly evaluates the OS of the device initiating the access request.

Why this answer

Device platform is a standard condition in Microsoft Entra Conditional Access policies, allowing administrators to target policies based on the operating system (e.g., Windows, iOS, Android). Option D is correct because User risk level is a condition derived from Microsoft Entra ID Protection, reflecting the probability that a user's identity has been compromised, and can be used to trigger step-up authentication or block access.

Exam trap

The trap here is that candidates confuse conditions (e.g., device platform, user risk) with grant controls (e.g., require MFA, sign-in frequency) or configuration settings (e.g., password complexity), leading them to select options that are not valid conditions in the Conditional Access policy editor.

Full explanation →

863

MCQhard

A compliance officer needs to identify and monitor potentially risky user activities, such as users copying large amounts of data to external devices or sharing sensitive files with unauthorized recipients. They want to create a policy that detects these activities and automatically escalates them for investigation. Which Microsoft Purview solution should they use?

A.Microsoft Purview Insider Risk Management

B.Microsoft Purview Audit

C.Microsoft Purview Communication Compliance

D.Microsoft Purview Compliance Manager

AnswerA

Microsoft Purview Insider Risk Management is the correct solution as it proactively identifies, analyzes, and acts on risky activities within an organization. It leverages machine learning and adaptive analytics to detect potential data exfiltration, intellectual property theft, and policy violations by employees, assigning risk scores and automatically generating cases for investigation by security teams. This capability directly addresses the need to identify and monitor potentially risky insider activities.

Why this answer

Microsoft Purview Insider Risk Management is specifically designed to detect and investigate malicious or inadvertent insider risks based on activities like data exfiltration, unusual file sharing, or violations of corporate policies. It uses indicators and adaptive policies to assign risk scores and trigger alerts for review. Audit (option B) only provides logging and does not have built-in risk analysis.

Communication Compliance (option C) focuses on inappropriate communications, not data-related risks. Compliance Manager (option D) assesses compliance posture but does not detect risky user activities. Therefore, Insider Risk Management is the correct solution.

Full explanation →

864

MCQhard

A manufacturing company experiences repeated ransomware attacks targeting their on-premises file servers. They have Microsoft 365 E5 and want to implement a solution to detect and automatically respond to such threats across hybrid environments. What should they deploy?

A.Microsoft Defender for Identity

B.Microsoft Purview Communication Compliance

C.Microsoft Defender for Office 365

D.Microsoft Defender for Cloud Apps

AnswerA

Microsoft Defender for Identity is specifically designed to monitor on-premises Active Directory (AD) environments for suspicious activities and advanced threats. Ransomware attacks frequently involve compromising AD credentials for lateral movement and privilege escalation. Defender for Identity detects these attacker behaviors, such as Pass-the-Hash, Golden Ticket attacks, or unusual account access patterns, by analyzing network traffic and AD logs, providing crucial early detection against sophisticated ransomware campaigns targeting an organization's core identity infrastructure.

Why this answer

Microsoft Defender for Identity is the correct solution because it uses on-premises Active Directory signals to detect, investigate, and respond to advanced threats like ransomware targeting hybrid environments. It integrates with Microsoft 365 Defender to automatically initiate response actions (e.g., disabling compromised accounts) when suspicious lateral movement or credential theft is detected, directly addressing the scenario of repeated ransomware attacks on on-premises file servers.

Exam trap

The trap here is that candidates often confuse Defender for Identity (on-premises AD protection) with Defender for Office 365 (email protection) or Defender for Cloud Apps (SaaS shadow IT), failing to recognize that the question explicitly mentions on-premises file servers and hybrid environments, which require identity-based detection and response.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview Communication Compliance is designed to detect policy violations in communications (e.g., insider trading, harassment), not to detect or respond to ransomware attacks on file servers. Option C is wrong because Microsoft Defender for Office 365 protects email and collaboration tools (e.g., Exchange Online, SharePoint Online) from phishing and malware, but does not monitor on-premises file servers or Active Directory for ransomware activity. Option D is wrong because Microsoft Defender for Cloud Apps focuses on shadow IT and data protection in cloud applications (e.g., SaaS apps), not on-premises file servers or hybrid identity threats.

Full explanation →

865

MCQhard

An organization wants to implement a zero-trust security model. They plan to require multi-factor authentication (MFA) for all users accessing sensitive applications, but only when the sign-in risk is medium or higher. Which Microsoft Entra ID capability should they use?

A.Microsoft Entra ID Privileged Identity Management (PIM)

B.Microsoft Entra ID Conditional Access policy with risk condition

C.Microsoft Defender for Cloud Apps access policy

D.Microsoft Entra ID Protection risk detection policy

AnswerB

Microsoft Entra ID Conditional Access policies are the core enforcement engine for Zero Trust principles, allowing organizations to define precise conditions under which users can access resources. By incorporating a "sign-in risk" condition, these policies leverage real-time risk assessments from Microsoft Entra ID Protection. If the sign-in risk meets a predefined threshold, the policy can dynamically enforce specific controls, such as requiring multi-factor authentication (MFA) or blocking access, directly aligning with a risk-based Zero Trust model.

Why this answer

B is correct because Microsoft Entra ID Conditional Access policies allow administrators to enforce MFA based on sign-in risk level, which is evaluated by Microsoft Entra ID Protection. By configuring a policy with a risk condition (e.g., medium or higher), the organization can require MFA only when the sign-in risk meets that threshold, aligning with a zero-trust model that grants access based on real-time risk assessment rather than a static rule.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID Protection (which detects risk) with the actual policy engine (Conditional Access) that enforces actions like MFA, leading them to select option D instead of B.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Privileged Identity Management (PIM) is designed for just-in-time privileged role activation and access reviews, not for evaluating sign-in risk or enforcing MFA based on risk level. Option C is wrong because Microsoft Defender for Cloud Apps access policies control session-level actions (e.g., blocking downloads) based on app context or user behavior, but they do not natively evaluate Microsoft Entra ID sign-in risk to trigger MFA. Option D is wrong because Microsoft Entra ID Protection risk detection policy is a misnomer; Entra ID Protection provides risk detections and risk scores, but the actual enforcement (e.g., requiring MFA) must be configured through a Conditional Access policy that uses those risk conditions.

Full explanation →

866

MCQhard

A tenant administrator runs the PowerShell cmdlet shown in the exhibit. The output shows that some compliance policies have IsAssigned = $false. What does this indicate?

A.The compliance policy is scheduled to be assigned in the future

B.The compliance policy is not assigned to any user or device group

C.The compliance policy has been evaluated and found non-compliant

D.The compliance policy is a built-in policy that cannot be assigned

AnswerB

When the IsAssigned property for an Intune compliance policy returns False, it directly and unambiguously indicates that the policy has not been targeted or deployed to any user groups, device groups, or the entire tenant. For a compliance policy to become active, enforce settings, and report on device or user compliance, it must be explicitly assigned to the relevant scope within Microsoft Intune.

Why this answer

The `IsAssigned` property in the output of a compliance policy PowerShell cmdlet (such as `Get-DeviceCompliancePolicy`) directly indicates whether the policy has been assigned to any user or device group. When `IsAssigned = $false`, it means the policy exists in the tenant but has not been linked to any group via an assignment, so it is not being enforced on any devices. This is a core concept in Microsoft Intune and Microsoft 365 compliance: a policy must be assigned to a group to take effect.

Exam trap

The trap here is that candidates confuse `IsAssigned` with compliance evaluation status or policy type, mistakenly thinking it indicates future scheduling, non-compliance, or built-in restrictions, rather than understanding it simply reflects whether the policy has been assigned to a group.

How to eliminate wrong answers

Option A is wrong because a future scheduled assignment would still show `IsAssigned = $true` once the assignment is configured; the property reflects the existence of an assignment, not its activation time. Option C is wrong because `IsAssigned` has nothing to do with compliance evaluation results—non-compliant devices are tracked via the `ComplianceStatus` property, not `IsAssigned`. Option D is wrong because built-in policies (like default compliance policies) can still be assigned and would show `IsAssigned = $true` if they are; the property does not indicate whether a policy is built-in or custom.

Full explanation →

867

MCQeasy

An organization wants to automatically retain all financial documents for seven years and then delete them. Which Microsoft Purview solution should be used to create the retention policy?

A.Microsoft Purview Information Protection

B.Microsoft Purview Audit

C.Microsoft Purview Data Lifecycle Management

D.Microsoft Purview Communication Compliance

AnswerC

Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct service for automatically retaining and deleting content based on an organization's policies and regulatory requirements. It allows administrators to create retention labels and policies that can be applied to content across various locations, ensuring that financial data, for example, is kept for a specific duration and then disposed of appropriately. This directly addresses the need for automated retention scheduling to meet compliance obligations.

Why this answer

Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it provides retention and deletion policies that can automatically retain data for a specified period (e.g., seven years) and then permanently delete it. This solution is designed specifically for managing the lifecycle of content across Exchange, SharePoint, OneDrive, and Teams, making it ideal for regulatory compliance requirements like financial document retention.

Exam trap

The trap here is that candidates often confuse 'retention policies' with 'information protection' (labeling) or 'audit' (logging), but the SC-900 exam specifically tests that Data Lifecycle Management is the sole solution for automated retention and deletion based on time-based rules.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Information Protection focuses on classifying, labeling, and protecting sensitive data (e.g., encryption, rights management) rather than automating retention and deletion schedules. Option B is wrong because Microsoft Purview Audit is used for logging and investigating user and admin activities, not for creating retention policies that enforce data lifecycle rules. Option D is wrong because Microsoft Purview Communication Compliance is designed to detect and remediate inappropriate communications (e.g., harassment, insider trading) and does not provide retention or deletion capabilities.

Full explanation →

868

MCQhard

A healthcare organization stores patient records in SharePoint Online. The compliance officer needs to ensure that records containing Protected Health Information (PHI) are retained for 7 years per regulatory requirements. Which Microsoft Purview solution should they implement?

A.Microsoft Purview Audit

B.Microsoft Purview eDiscovery

C.Microsoft Purview Records Management

D.Microsoft Purview Data Lifecycle Management

AnswerC

Microsoft Purview Records Management is precisely engineered to help organizations meet their legal, business, and regulatory obligations for records retention and disposition, particularly for highly sensitive data like patient records. This solution enables the classification of content as a formal record, applying immutable retention labels that prevent modification or deletion, even by administrators, and managing the entire lifecycle from creation to final disposition. It ensures that critical information is preserved according to specific healthcare regulations, providing the necessary legal defensibility and compliance.

Why this answer

Microsoft Purview Records Management is the correct solution because it enables organizations to apply retention labels and policies that enforce mandatory retention periods for regulatory compliance. For patient records containing PHI, a retention label can be configured to retain the data for exactly 7 years and then trigger a disposition review or automatic deletion, ensuring the organization meets healthcare regulatory requirements.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management (which handles non-record content like temporary files) with Records Management (which handles declarative records with immutable retention), leading them to choose D instead of C.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Audit provides logging and investigation of user and admin activities, not the ability to enforce retention periods on content. Option B is wrong because Microsoft Purview eDiscovery is used for searching, holding, and exporting content for legal or investigative purposes, not for setting retention schedules. Option D is wrong because Microsoft Purview Data Lifecycle Management (now part of Records Management) focuses on managing data lifecycle for non-records content (e.g., temporary files) and does not provide the declarative record declaration and immutable retention required for regulatory compliance with PHI.

Full explanation →

869

MCQhard

Your organization is subject to GDPR and must respond to data subject deletion requests within 30 days. You have identified all personal data in Microsoft 365. Which Microsoft Purview solution should you use to permanently delete the data?

A.Retention policies to preserve the data

B.Data Lifecycle Management (disposition review)

C.Data Loss Prevention to block the data

D.eDiscovery (Premium) to export the data

AnswerB

Disposition review allows administrators to permanently delete content after review.

Why this answer

Data Lifecycle Management (disposition review) is the correct solution because it allows you to permanently delete personal data after a specified retention period. In this scenario, you have already identified the personal data and need to respond to a deletion request within 30 days. Disposition review provides a workflow to review and then permanently delete the data, meeting GDPR requirements.

Exam trap

The trap here is that candidates often confuse retention policies (which preserve data) with lifecycle management (which can delete data), or they mistakenly think DLP or eDiscovery can perform permanent deletion, when in fact they are designed for blocking or exporting data, respectively.

How to eliminate wrong answers

Option A is wrong because Retention policies are designed to preserve data for a specified period, not to delete it; using them would prevent the deletion required by GDPR. Option C is wrong because Data Loss Prevention (DLP) is used to detect and block sensitive data from being shared or leaked, not to delete data that already exists. Option D is wrong because eDiscovery (Premium) is used to search, hold, and export data for legal or investigative purposes, not to permanently delete data in response to a deletion request.

Full explanation →

870

MCQmedium

A company's security team discovers that several recent account compromises originated from attackers using legacy mail protocols (POP3, IMAP) which do not support multi-factor authentication. The team wants to immediately prevent any sign-in attempts using these protocols. Which Microsoft Entra ID feature should they configure to enforce this restriction?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management (PIM)

D.Microsoft Entra Password Protection

AnswerA

Conditional Access policies provide the precise control needed to block legacy authentication by evaluating various conditions, including the client application used for access. Administrators can configure a policy to specifically target and block client apps that utilize legacy authentication protocols, such as Exchange ActiveSync or 'Other clients' (which often encompasses protocols like POP3, IMAP, and SMTP AUTH). This ensures that only modern authentication methods, which support features like multi-factor authentication, are permitted for accessing corporate resources.

Why this answer

Conditional Access in Microsoft Entra ID allows administrators to create policies that control access based on conditions such as client apps. By configuring a policy to block authentication requests from legacy authentication protocols (POP3, IMAP, SMTP, etc.), the security team can immediately prevent sign-in attempts that do not support multi-factor authentication, effectively mitigating the risk of account compromise via these outdated protocols.

Exam trap

The trap here is that candidates often confuse Identity Protection's risk-based policies with the ability to block legacy protocols, but Identity Protection only triggers MFA or block based on risk scores, not on the protocol type itself.

Why the other options are wrong

Identity Protection detects and remediates risks but does not block legacy authentication protocols directly; it requires Conditional Access policies to enforce such blocks.

Privileged Identity Management (PIM) manages just-in-time privileged access and role activation, not authentication protocol restrictions. It cannot block legacy mail protocols like POP3/IMAP.

When would these options actually be correct?

When the question asks for a feature that automatically detects and responds to compromised accounts or risky sign-ins (e.g., requiring MFA or password reset based on risk level), Identity Protection is the correct answer.

A question asks: 'The security team needs to reduce standing administrative access and require approval for role activation in Microsoft Entra ID. Which feature should they use?' — PIM would be the correct answer.

Why candidates pick the wrong answer

Candidates may confuse Identity Protection's risk-based policies with the ability to block specific authentication methods, not realizing that Conditional Access is needed to enforce protocol-level restrictions.

Candidates may confuse PIM's role-based access controls with broader security policies, assuming it can enforce authentication restrictions because it manages privileged accounts.

Full explanation →

871

Matchingmedium

Match each Microsoft Defender product to its focus area.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Protect on-premises Active Directory

Secure email and collaboration tools

Protect cloud workloads and resources

Secure Internet of Things devices

SaaS application security

Why these pairings

Microsoft Defender for Cloud secures cloud workloads; Defender for Endpoint secures endpoints; Defender for Identity secures identities; Defender for Office 365 secures email and collaboration; Defender for Cloud Apps secures shadow IT and app permissions.

Full explanation →

872

MCQmedium

An organization wants to enable passwordless authentication for its users by using a mobile app. Which Microsoft Entra ID authentication method should they implement?

A.Temporary Access Pass

B.Windows Hello for Business

C.FIDO2 security keys

D.Microsoft Authenticator (passwordless sign-in)

AnswerD

Microsoft Authenticator's passwordless sign-in feature allows users to authenticate to Azure AD-connected services by simply approving a notification on their registered mobile device, eliminating the need to type a password. This method leverages public-key cryptography, where the user's mobile phone acts as a secure authenticator, providing a convenient and phishing-resistant multi-factor authentication experience. It is a primary example of a passwordless method delivered through a dedicated mobile application.

Why this answer

Microsoft Authenticator supports passwordless phone sign-in, allowing users to authenticate via app notification. FIDO2 security keys are hardware tokens. Windows Hello for Business uses biometrics.

Temporary Access Pass is for initial setup.

Full explanation →

873

MCQmedium

A company uses Microsoft 365 and needs to automatically detect documents in SharePoint Online that contain personally identifiable information (PII) such as social security numbers. When such documents are detected, they want to apply a sensitivity label that encrypts the document and restricts access to only the compliance team. Which Microsoft Purview solution should they use?

A.Data Lifecycle Management

B.Records Management

C.Data Loss Prevention (DLP)

D.Communication Compliance

AnswerC

Data Loss Prevention (DLP) is the correct solution as it proactively identifies, monitors, and protects sensitive information across Microsoft 365 services, including SharePoint. DLP policies leverage sensitive information types, trainable classifiers, and exact data match to automatically detect specific content (e.g., PII, credit card numbers). Upon detection, DLP can enforce various actions, such as blocking sharing, encrypting files, or notifying administrators, thereby preventing unauthorized disclosure and protecting sensitive data.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it can automatically scan documents in SharePoint Online for sensitive information types (e.g., social security numbers) using built-in or custom sensitive info types. When a match is found, DLP policies can trigger an action to apply a sensitivity label that encrypts the document and restricts access, such as limiting it to the compliance team. This combines content detection with automated protection, which is exactly the scenario described.

Exam trap

The trap here is that candidates often confuse DLP with Data Lifecycle Management or Records Management, thinking those solutions handle content classification, but DLP is the only one that combines real-time content inspection with automated label application for protection.

How to eliminate wrong answers

Option A is wrong because Data Lifecycle Management focuses on retaining or deleting content based on age or policy, not on detecting PII or applying sensitivity labels. Option B is wrong because Records Management is designed to mark content as records for legal or regulatory retention, not to scan for PII or enforce encryption via labels. Option D is wrong because Communication Compliance monitors internal and external communications (e.g., email, Teams) for policy violations like harassment or insider trading, not for scanning SharePoint documents for PII.

Full explanation →

874

MCQmedium

An organization wants to allow users to reset their own passwords without help desk intervention. They also need to enforce multifactor authentication during the reset process. Which Microsoft Entra feature should they configure?

A.Microsoft Entra Self-Service Password Reset

B.Microsoft Entra Identity Protection

C.Microsoft Entra Privileged Identity Management

D.Microsoft Entra Multifactor Authentication

AnswerA

Microsoft Entra Self-Service Password Reset (SSPR) is the correct solution because it directly addresses the need for users to reset their own passwords without requiring administrator intervention. This feature allows users to verify their identity using pre-registered authentication methods, such as mobile app notifications, phone calls, or email verification, to securely regain access to their accounts. SSPR significantly reduces helpdesk call volumes related to password resets and improves user productivity by providing immediate self-service access restoration.

Why this answer

Microsoft Entra Self-Service Password Reset (SSPR) allows users to reset their own passwords without help desk intervention. By integrating with Microsoft Entra Multifactor Authentication, SSPR can enforce MFA during the reset process, satisfying both requirements.

Exam trap

The trap here is that candidates often confuse Microsoft Entra Multifactor Authentication as a standalone solution for password reset, when in fact it is only a component that must be integrated with SSPR to achieve both self-service reset and MFA enforcement.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra Identity Protection is a risk-based detection and remediation tool that can trigger automated responses like requiring MFA or blocking sign-ins, but it does not directly provide self-service password reset capabilities. Option C is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time privileged access and role activation, not general user password reset workflows. Option D is wrong because Microsoft Entra Multifactor Authentication is an authentication method that can be used as part of SSPR, but by itself it does not provide the self-service password reset functionality; it must be combined with SSPR to meet both requirements.

Full explanation →

875

MCQmedium

A company uses Microsoft Entra ID. The IT team wants to provide remote employees with secure, single sign-on (SSO) access to a critical on-premises web application that uses password-based authentication, without requiring a VPN connection. Which Microsoft Entra ID feature should they use?

A.Microsoft Entra Application Proxy

B.Microsoft Entra Connect

C.Microsoft Entra Domain Services

D.Microsoft Entra ID P2 license

AnswerA

Microsoft Entra Application Proxy enables secure remote access to on-premises web applications from any device, without requiring a VPN or opening inbound firewall ports. It works by deploying a lightweight connector within the private network that establishes an outbound connection to the Microsoft Entra service. This allows users to access internal applications using their Microsoft Entra ID credentials, benefiting from single sign-on and Microsoft Entra's robust security features like Conditional Access.

Why this answer

Microsoft Entra Application Proxy enables secure remote access to on-premises web applications by publishing them through an external endpoint, without requiring a VPN. It supports password-based SSO by securely storing and replaying credentials to the legacy application, allowing users to authenticate once via Entra ID. This makes it the correct choice for providing SSO to a password-based on-premises app without a VPN.

Exam trap

The trap here is that candidates often confuse Microsoft Entra Connect (a sync tool) with Application Proxy, mistakenly thinking that syncing identities alone provides remote access and SSO to on-premises apps.

Why the other options are wrong

Microsoft Entra Connect is used for synchronizing on-premises directories with Entra ID, not for proxying access to on-premises web applications. It does not provide SSO or eliminate the need for a VPN.

Microsoft Entra Domain Services provides managed domain services like domain join and LDAP, not secure remote access to on-premises web apps without VPN. The question requires a reverse proxy solution for password-based SSO, which is Application Proxy's role.

The question asks for a specific feature to provide SSO access to an on-premises web app without VPN. A Microsoft Entra ID P2 license is a licensing tier, not a feature; it does not directly enable SSO or remote access to on-premises apps.

When would these options actually be correct?

A company wants to synchronize user accounts and passwords from an on-premises Active Directory to Microsoft Entra ID to enable cloud-based authentication and management. The question would ask: 'Which tool should they use to sync on-premises identities to the cloud?'

A company needs to lift-and-shift on-premises applications to Azure without re-architecting, and requires domain-joined VMs with managed domain services like Group Policy. Entra Domain Services would be correct for providing AD DS compatibility in Azure.

A question that asks which license is required to use Microsoft Entra ID Protection, Identity Governance (e.g., Privileged Identity Management), or Conditional Access policies with risk-based conditions. For example: 'Which license is needed to implement risk-based Conditional Access policies?'

Why candidates pick the wrong answer

Candidates may confuse Entra Connect with Application Proxy because both involve on-premises integration, and 'Connect' sounds like it provides connectivity for remote access.

Candidates may confuse 'Domain Services' with providing access to on-premises resources, or think that domain services are needed for authentication to on-premises apps, not realizing Application Proxy handles this without domain join.

Candidates may think that a higher license tier (P2) is necessary for any advanced security feature, including Application Proxy, or they confuse licensing requirements with functional capabilities.

Full explanation →

876

MCQeasy

A security architect is designing a system where user access rights are reviewed and certified on a regular basis by data owners. The goal is to ensure that users continue to have only the permissions necessary to perform their job functions and that no excessive permissions exist. Which security principle is primarily being implemented through these regular reviews?

A.Defense in depth

B.Zero trust

C.Least privilege

D.Separation of duties

AnswerC

Least privilege means granting users the minimum level of access required. Regular access reviews are a key governance practice to uphold least privilege by detecting and removing excessive permissions.

Why this answer

Regular access reviews directly enforce the principle of least privilege by ensuring users retain only the permissions necessary for their current job functions. This process identifies and removes excessive permissions that may have accumulated over time, aligning with the core goal of minimizing the attack surface. In Microsoft 365, this is often implemented through Azure AD access reviews, where data owners certify or revoke user access.

Exam trap

The trap here is that candidates may confuse the periodic review of permissions with the zero trust model, but zero trust focuses on continuous verification at each access request rather than periodic certification of existing rights.

Why the other options are wrong

Defense in depth is a layered security strategy using multiple controls (e.g., firewalls, antivirus, encryption) to protect assets, not specifically about reviewing and certifying user permissions to enforce minimal access.

Zero trust is a security model that assumes no implicit trust and continuously verifies every access request, but the question specifically focuses on regular reviews and certifications to enforce minimal permissions, which is the principle of least privilege.

Separation of duties prevents fraud by requiring multiple people to complete a sensitive task, but it does not directly address the regular review and certification of user permissions to remove excessive access, which is the core of least privilege.

When would these options actually be correct?

A question asks: 'An organization implements multiple security controls at different layers (network, endpoint, application) to protect against threats. Which principle is being applied?' Then defense in depth would be correct.

A question describing a network architecture where every access request is authenticated and authorized regardless of origin, such as 'An organization implements micro-segmentation and continuous verification for all network traffic. Which security principle is being applied?'

An exam question asks: 'Which security principle ensures that no single individual has the authority to both approve and process a financial transaction, thereby reducing the risk of fraud?' In that context, separation of duties is the correct answer.

Why candidates pick the wrong answer

Candidates may confuse 'regular reviews' as part of a comprehensive security posture, mistakenly associating the layered approach of defense in depth with the periodic review process.

Candidates may confuse zero trust with least privilege because both involve restricting access, but zero trust is broader and includes continuous verification, while least privilege specifically limits permissions to the minimum necessary.

Candidates may confuse separation of duties with least privilege because both involve controlling access, but separation of duties focuses on dividing tasks among multiple users, not on minimizing permissions per user.

Full explanation →

877

Multi-Selecteasy

A company wants to enforce multifactor authentication for all users. Which TWO Microsoft Entra ID features can be used together to achieve this?

Select 2 answers

A.Conditional Access

B.Identity Protection

C.Security defaults

D.Authentication methods (Settings)

E.Password protection

AnswersA, D

Conditional Access policies are the primary method in Microsoft Entra ID to enforce specific access requirements, such as multifactor authentication (MFA), based on various conditions like user location, device state, or application being accessed. These policies evaluate conditions in real-time and grant or block access, or require additional steps like MFA, ensuring robust security tailored to risk.

Why this answer

Conditional Access policies allow you to enforce multifactor authentication (MFA) based on specific conditions such as user, location, or device state. Authentication methods define the MFA verification options (e.g., Microsoft Authenticator, SMS, OATH tokens) that users can register and use. Together, Conditional Access triggers the MFA requirement, while Authentication methods control which verification methods are available.

Exam trap

The trap here is that candidates often confuse Identity Protection (which can trigger MFA based on risk) as a direct MFA enforcement feature, when in fact it only provides risk signals that must be used with Conditional Access to enforce MFA.

Full explanation →

878

MCQmedium

A company wants to offer a secure sign-in experience for external customers who may use personal accounts from Facebook, Google, or any OpenID Connect provider. They also need to customize the sign-in pages with their company logo and colors. Which Microsoft Entra capability should they use?

A.Microsoft Entra ID (formerly Microsoft Entra ID) — free edition

B.Microsoft Entra External ID (formerly Microsoft Entra ID B2C)

C.Microsoft Entra Domain Services

D.Microsoft Entra Permissions Management

AnswerB

Microsoft Entra External ID is purpose-built as a robust Customer Identity and Access Management (CIAM) solution, specifically engineered to manage identities for millions of external customers accessing applications and services. It natively supports a wide array of identity providers, including popular social accounts (e.g., Google, Facebook), enterprise accounts, and local accounts. Furthermore, it offers extensive customization capabilities for sign-up, sign-in, and profile management pages, ensuring a fully branded and user-friendly experience tailored for external customers.

Why this answer

Microsoft Entra External ID (formerly Azure AD B2C) is the correct choice because it is specifically designed for customer-facing identity scenarios, supporting social identity providers (Facebook, Google) and any OpenID Connect provider. It also provides full customization of sign-in pages, including company branding like logos and colors, which is not available in the free edition of Microsoft Entra ID.

Exam trap

The trap here is that candidates often confuse Microsoft Entra External ID with the free edition of Microsoft Entra ID, assuming that 'free' includes external identity support, but the free edition is strictly for internal users and lacks social identity federation and UI customization capabilities.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID (free edition) is intended for internal organizational users and does not support external customer identities with social or OpenID Connect providers, nor does it allow customization of sign-in pages for external users. Option C is wrong because Microsoft Entra Domain Services provides managed domain services (e.g., Kerberos, NTLM) for legacy applications, not identity federation or customer sign-in customization. Option D is wrong because Microsoft Entra Permissions Management is a cloud infrastructure entitlement management (CIEM) tool for managing permissions across multi-cloud environments, unrelated to customer authentication or branding.

Full explanation →

879

MCQhard

A company deploys Microsoft Entra ID Protection. The security team wants to automatically block sign-ins from anonymous IP addresses. They configure a Conditional Access policy. Which assignment condition should they use?

A.User risk level condition with 'Medium'

B.Device condition with 'Compliant'

C.Sign-in risk level condition with 'High'

D.Location condition with 'Any IP'

AnswerC

The 'Sign-in risk level' condition directly assesses the risk associated with a specific authentication attempt in real-time, leveraging detections from Microsoft Entra ID Protection. An 'Anonymous IP address' is a prominent detection that contributes to a 'High' sign-in risk level, as it often indicates an attempt to obscure the user's true location, which is frequently associated with malicious activity. This condition is precisely designed to respond to such real-time anomalies.

Why this answer

C is correct because the sign-in risk level condition in Conditional Access allows you to target sign-ins that have been assessed by Microsoft Entra ID Protection as risky. Anonymous IP addresses are a specific sign-in risk detection, and configuring the policy to block sign-ins with a 'High' sign-in risk level will automatically block those sign-ins. This directly addresses the security team's requirement to block sign-ins from anonymous IP addresses.

Exam trap

The trap here is that candidates often confuse 'user risk' with 'sign-in risk', mistakenly selecting the user risk level condition when the scenario specifically describes blocking a sign-in event based on the IP address's anonymity.

How to eliminate wrong answers

Option A is wrong because user risk level condition targets the likelihood that a user's identity has been compromised, not the risk of a specific sign-in session from an anonymous IP address. Option B is wrong because the device condition with 'Compliant' is used to require that the device meets compliance policies, which does not block sign-ins based on the IP address's anonymity. Option D is wrong because 'Any IP' in the location condition includes all IP addresses, including trusted ones, and does not specifically target anonymous IP addresses; it would block or allow all sign-ins regardless of IP anonymity.

Full explanation →

880

MCQmedium

Your organization is implementing Microsoft Purview to manage data compliance. They need to automatically detect and protect credit card numbers in emails and documents. Which Microsoft Purview feature should they configure?

A.Data Lifecycle Management

B.Data Loss Prevention (DLP)

C.Insider Risk Management

D.Information Protection

AnswerB

Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various locations, including Microsoft 365 services, endpoints, and non-Microsoft cloud apps. These policies leverage sensitive information types (SITs) to automatically detect patterns like credit card numbers, social security numbers, or health records. Upon detection, DLP enforces protective actions such as blocking sharing, notifying users, or encrypting content to prevent data exfiltration and ensure compliance.

Why this answer

Data Loss Prevention (DLP) policies in Microsoft Purview can automatically detect sensitive information like credit card numbers and apply protective actions, such as blocking or encrypting the content. Information Protection refers to sensitivity labels and encryption, but DLP is the feature that uses policies to detect and protect data in transit and at rest. Data Lifecycle Management handles retention and deletion.

Insider Risk Management focuses on user behavior.

Full explanation →

881

MCQmedium

You are a security analyst using Microsoft Sentinel. You run the following Kusto query: SecurityAlert | where TimeGenerated > ago(7d) | where AlertName contains "MFA" | summarize Count = count() by bin(TimeGenerated, 1d) | render timechart What does this query do?

A.Counts security alerts containing 'MFA' per day for the last 7 days

B.Lists all identities that triggered MFA alerts

C.Counts distinct users with MFA alerts per day

D.Counts alerts by severity over the last week

AnswerA

Summarize count() by AlertName and time creates a daily count.

Why this answer

The Kusto query filters security alerts containing 'MFA' in the alert name over the last 7 days, counts the number of alerts per day, and renders a timechart. Option B is incorrect because the query counts alerts, not identities. Option C is incorrect because it counts alerts, not distinct users.

Option D is incorrect because the query does not filter by severity.

Full explanation →

882

MCQmedium

Your organization is implementing a new policy to ensure that only authorized users can access sensitive financial data stored in Microsoft SharePoint Online. The security team wants to enforce multi-factor authentication (MFA) for all users accessing this data, but only when accessing from outside the corporate network. Which Microsoft Entra ID conditional access policy setting should you configure to meet this requirement?

A.Use app-enforced restrictions for SharePoint

B.Grant access requiring device to be marked as compliant when location is not trusted

C.Grant access requiring multi-factor authentication when the location is not trusted

D.Block access when the location is not trusted

AnswerC

This enforces MFA for external access while allowing internal access without MFA.

Why this answer

A conditional access policy can be configured to require multi-factor authentication only when the location is not trusted, which meets the requirement of enforcing MFA for remote access while allowing trusted network access without MFA. Option A is incorrect because app-enforced restrictions are session controls that do not enforce MFA at sign-in. Option B is incorrect because requiring a compliant device does not directly enforce MFA.

Option D is incorrect because blocking access from untrusted locations would prevent remote access entirely, which is not the requirement.

Full explanation →

883

MCQmedium

A company uses Microsoft 365 and sanctioned cloud apps like Salesforce and Box. The security team wants to prevent users from downloading sensitive documents from these apps when accessing from unmanaged personal devices, while still allowing read-only access. They need real-time session monitoring and control. Which Microsoft security solution should they use?

A.Microsoft Defender for Office 365

B.Microsoft Defender for Cloud Apps

C.Microsoft Defender for Identity

D.Microsoft Defender for Endpoint

AnswerB

Defender for Cloud Apps can enforce session policies via Conditional Access App Control, allowing granular control over actions like download, upload, and copy based on user, device, and data sensitivity.

Why this answer

Microsoft Defender for Cloud Apps provides real-time session monitoring and control via its Conditional Access App Control feature. This allows administrators to enforce policies that block downloads or restrict access to sensitive data based on device compliance, such as blocking downloads from unmanaged personal devices while permitting read-only access. The solution integrates with sanctioned cloud apps like Salesforce and Box to apply these controls at the session level.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud Apps with Microsoft Defender for Office 365, assuming that Office 365 covers all cloud app security, but Defender for Office 365 is limited to Microsoft 365 services and cannot enforce session policies on third-party SaaS apps like Salesforce or Box.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Office 365 focuses on email and collaboration security (e.g., anti-phishing, anti-malware) and does not provide session-level control over third-party cloud apps like Salesforce or Box. Option C is wrong because Microsoft Defender for Identity is designed to detect identity-based threats (e.g., compromised accounts, lateral movement) using on-premises Active Directory signals, not to monitor or control user sessions in cloud apps. Option D is wrong because Microsoft Defender for Endpoint is an endpoint detection and response (EDR) solution that protects devices from malware and attacks, but it does not offer real-time session monitoring or conditional access controls for cloud app sessions.

Full explanation →

884

Multi-Selectmedium

A company wants to automatically apply a 'Confidential' sensitivity label to any document that contains a credit card number, and also encrypt the document as part of the label. Which two components must be configured to achieve this? (Choose two.)

Select 2 answers

A.A sensitivity label with encryption settings

B.A DLP policy that detects sensitive info

C.An auto-labeling policy

D.A data classification dashboard

AnswersA, C

Correct. The sensitivity label must define the protection (encryption) that will be applied to documents containing credit card numbers.

Why this answer

A sensitivity label must include encryption settings to automatically encrypt documents when the label is applied. The encryption is configured within the label's protection settings, which defines how content is protected (e.g., with a predefined template or user-defined permissions). Without encryption configured in the label, the automatic application would only assign the label without encrypting the document.

Exam trap

The trap here is that candidates often confuse DLP policies with auto-labeling policies, thinking DLP can apply labels and encryption, but DLP only detects and acts on content (e.g., block or notify) and does not apply sensitivity labels.

Why the other options are wrong

A DLP policy detects sensitive info but does not automatically apply sensitivity labels or encryption; it only triggers alerts or blocks actions. The question requires automatic labeling and encryption, which is handled by auto-labeling policies and sensitivity labels, not DLP.

When would these options actually be correct?

A company wants to block emails containing credit card numbers from being sent externally. Which component should be configured? (A DLP policy that detects sensitive info and enforces action.)

Why candidates pick the wrong answer

Candidates may confuse DLP's detection of sensitive data with the ability to automatically apply labels, as both involve sensitive info types and can be triggered by content matching.

Full explanation →

885

MCQhard

Refer to the exhibit. You are reviewing a Microsoft Purview DLP policy JSON snippet. The policy is enabled and contains one rule. What is the effect of this rule?

A.Applies only to SharePoint, not Exchange.

B.Only audits the activity, does not block.

C.Blocks access and sends a policy tip to users.

D.Blocks access to content containing a credit card number in Exchange and SharePoint, without user notification.

AnswerD

The rule has 'BlockAccess' action and no notification settings.

Why this answer

The JSON snippet shows a DLP rule with an action of 'BlockAccess' and 'NotifyUser' set to 'False', meaning the rule blocks access to content containing a credit card number in both Exchange and SharePoint (the locations are not restricted to a single workload). Since 'NotifyUser' is false, no policy tip or email notification is sent to the user. Therefore, the correct effect is that access is blocked without user notification, matching option D.

Exam trap

The trap here is that candidates assume 'BlockAccess' always includes a policy tip or notification, but the 'NotifyUser' parameter independently controls whether users are informed, and when set to 'False', no notification is sent.

How to eliminate wrong answers

Option A is wrong because the rule applies to both Exchange and SharePoint (the 'Location' parameter in the JSON includes both workloads, not just SharePoint). Option B is wrong because the rule includes a 'BlockAccess' action, not just an audit action (audit-only rules use 'AuditOnly' or no block action). Option C is wrong because 'NotifyUser' is set to 'False', so no policy tip is sent to users; the rule blocks access but does not notify.

Full explanation →

886

MCQeasy

Refer to the exhibit. An administrator runs the PowerShell command shown. What is the purpose of this command?

A.Delete all files modified by a user in the last 90 days

B.Modify permissions on files uploaded by a user

C.Search audit logs for file activities performed by a specific user

D.Block a user from uploading files

AnswerC

The command specifies operations and user IDs to search.

Why this answer

The command searches the unified audit log for file-related operations by a specific user in the last 90 days. Option C is correct. It does not delete files, modify permissions, or block the user.

Full explanation →

887

MCQhard

Refer to the exhibit. A Microsoft Purview retention policy is configured as shown. Which statement about this policy is accurate?

A.The policy will delete items after 7 years from the date they were created.

B.The policy will retain items for 7 years from the last modification date.

C.The policy will delete items 7 years after they were last modified.

D.The policy will keep items for 7 years and then delete them.

AnswerC

This statement accurately describes the policy's behavior. The 'RetentionDurationType' is 'ModificationAgeInDays', meaning the the 2557-day (approximately 7 years) period begins from the item's last modification date. Upon reaching this duration, the policy's 'Action' of 'Delete' will be enforced, resulting in the permanent removal of the item.

Why this answer

The exhibit shows a retention policy configured with the action 'Delete items' and a period of '7 years' based on 'When items were last modified.' This means the policy will delete items 7 years after their last modification date, not from creation. Option C correctly states this behavior.

Exam trap

The trap here is that candidates often confuse 'retain items for 7 years then delete' with 'delete items 7 years after last modified,' assuming a retention period exists when the policy is purely deletion-based.

How to eliminate wrong answers

Option A is wrong because the policy is based on the last modification date, not the creation date; items are deleted 7 years after they were last modified, not created. Option B is wrong because the policy deletes items after 7 years from the last modification date, it does not retain them indefinitely; retention implies keeping, but this policy is set to delete. Option D is wrong because it implies a retention period followed by deletion, but the policy is configured to delete based on last modification date, not to retain for a fixed period then delete; the action is 'Delete items' with no retention phase.

Full explanation →

888

MCQmedium

A company uses Microsoft 365 and wants to automatically detect when employees attempt to share credit card numbers in emails or Microsoft Teams messages. The company also wants to block the message if it contains such sensitive data, and notify the sender with a policy tip. Which Microsoft Purview solution should the administrator configure?

A.Data Lifecycle Management

B.Data Loss Prevention (DLP)

C.Information Protection (Sensitivity labels)

D.Insider Risk Management

AnswerB

DLP policies detect sensitive information (e.g., credit card numbers) and enforce actions such as blocking, encrypting, or notifying users. This matches the scenario requirements.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect, block, and notify users when sensitive data—such as credit card numbers—is shared in emails or Teams messages. DLP policies can be configured with built-in sensitive information types (e.g., credit card number) and actions like blocking the message and sending a policy tip to the sender.

Exam trap

The trap here is that candidates often confuse Information Protection (sensitivity labels) with DLP, not realizing that sensitivity labels classify and protect data at rest, while DLP actively monitors and controls data in motion (email and chat).

How to eliminate wrong answers

Option A is wrong because Data Lifecycle Management focuses on retaining, deleting, and managing data based on age or compliance requirements, not on real-time detection and blocking of sensitive data sharing. Option C is wrong because Information Protection (Sensitivity labels) is used to classify and protect data at rest (e.g., documents) with encryption or markings, but it does not natively inspect and block messages in transit in email or Teams. Option D is wrong because Insider Risk Management is designed to detect risky user activities (e.g., data theft, policy violations) based on analytics and alerts, not to automatically block messages containing sensitive data in real time.

Full explanation →

889

MCQhard

A company stores HR documents in SharePoint Online. The compliance team wants to automatically apply a sensitivity label that encrypts the document whenever it contains a passport number. They do not want users to be able to override this classification. Which Microsoft Purview solution should they configure?

A.Data Loss Prevention (DLP) policy

B.Auto-labeling policy for sensitivity labels

C.Retention policy

D.Communication compliance policy

AnswerB

An auto-labeling policy for sensitivity labels automatically applies a pre-defined label to content, such as HR documents in SharePoint Online, when specific conditions are met. These conditions often include the detection of sensitive information types like passport numbers or national ID numbers. The applied label can enforce protection actions, including encryption, and can be configured to prevent users from changing or removing the label, ensuring consistent data protection.

Why this answer

An auto-labeling policy for sensitivity labels can automatically apply a sensitivity label (e.g., 'Highly Confidential') that encrypts documents when they contain sensitive data like passport numbers. This policy can be configured to enforce mandatory labeling without allowing user override, meeting the compliance team's requirement. In contrast, a DLP policy can detect and block sharing of sensitive data but does not apply encryption labels automatically.

Exam trap

The trap here is that candidates often confuse DLP policies with auto-labeling, assuming DLP can also apply encryption labels, but DLP only detects and blocks actions—it does not automatically classify or encrypt content.

Why the other options are wrong

A DLP policy can detect passport numbers and block sharing, but it cannot automatically apply sensitivity labels that encrypt documents. The requirement is to apply a sensitivity label with encryption, which is a feature of auto-labeling policies, not DLP.

A retention policy is used to retain or delete content based on time, not to classify or encrypt documents based on content. It cannot automatically apply sensitivity labels or enforce encryption.

Communication compliance policies detect and remediate inappropriate messages (e.g., harassment, sensitive info sharing) in communications like email and Teams, not automatically classify or encrypt documents in SharePoint based on content.

When would these options actually be correct?

A DLP policy would be correct if the question asked for a solution to prevent users from sharing documents containing passport numbers via email or external sharing, without requiring encryption or label application.

A retention policy would be correct if the question asked: 'The compliance team wants to ensure that HR documents are kept for 7 years and then permanently deleted. Which solution should they configure?'

A company wants to detect and prevent employees from sharing passport numbers in email or Teams messages, and automatically flag or quarantine such communications for review by a compliance officer.

Why candidates pick the wrong answer

Candidates often confuse DLP with auto-labeling because both can detect sensitive content; they may assume DLP can also apply labels, but DLP focuses on preventing data loss, not on classification and protection via labels.

Candidates may confuse retention policies with labeling policies because both involve managing document lifecycle and compliance, but retention policies focus on time-based actions, not content-based classification.

Candidates may confuse communication compliance with auto-labeling because both involve detecting sensitive information, but communication compliance focuses on communications rather than document classification and encryption.

Full explanation →

890

MCQeasy

Your organization wants to use Microsoft Entra Verified ID to issue digital credentials to employees. Which Microsoft Entra service provides the ability to issue and verify verifiable credentials?

A.Microsoft Entra Entitlement Management

B.Microsoft Entra Verified ID

C.Microsoft Entra Identity Protection

D.Microsoft Entra Privileged Identity Management

AnswerB

Microsoft Entra Verified ID is the dedicated service for implementing decentralized identity and managing verifiable credentials (VCs). It enables organizations to issue digital attestations, such as proof of employment or qualifications, to individuals, who then hold these VCs in a digital wallet. This service facilitates a trust framework where issuers can attest to facts about a user, and verifiers can cryptographically confirm the authenticity of these credentials without relying on a central authority, directly addressing the need for verifiable identity proofs.

Why this answer

Microsoft Entra Verified ID is the specific service designed to issue and verify verifiable credentials based on decentralized identity standards such as W3C Verifiable Credentials and Decentralized Identifiers (DIDs). It enables organizations to create, issue, and cryptographically verify digital credentials without relying on a central authority, aligning with the scenario described.

Exam trap

The trap here is that candidates may confuse 'Verified ID' with other identity governance or security services like Entitlement Management or Identity Protection, but only Verified ID directly handles the issuance and verification of verifiable credentials using decentralized identity standards.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Entitlement Management focuses on automating access reviews, access packages, and lifecycle management for applications and groups, not on issuing or verifying verifiable credentials. Option C is wrong because Microsoft Entra Identity Protection is a security tool that detects identity-based risks like compromised accounts and sign-in anomalies, not a credential issuance or verification service. Option D is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time privileged role assignments and access approvals, not the creation or verification of digital credentials.

Full explanation →

891

MCQmedium

A security team manages a hybrid environment with on-premises Windows servers and Azure VMs. They need a solution that can detect lateral movement attacks, pass-the-hash attempts, and anomalous service account behavior on the on-premises Active Directory environment. They also want these alerts to be integrated into Microsoft Defender for Cloud for centralized monitoring. Which Microsoft security solution should they deploy on their on-premises domain controllers?

A.Microsoft Defender for Office 365

B.Microsoft Defender for Identity

C.Microsoft Defender for Endpoint

D.Microsoft Intune

AnswerB

Microsoft Defender for Identity is a cloud-based security solution specifically engineered to protect hybrid identity environments, integrating deeply with on-premises Active Directory. It leverages network traffic from domain controllers and Windows events to detect suspicious user and entity behavior, identifying advanced threats like reconnaissance, lateral movement, Golden Ticket attacks, and other identity-based attacks. This service provides crucial visibility and detection capabilities for attacks targeting the core authentication system in a hybrid setup.

Why this answer

Microsoft Defender for Identity (MDI) is the correct solution because it is specifically designed to monitor on-premises Active Directory traffic and detect advanced threats like lateral movement, pass-the-hash, and anomalous service account behavior. It integrates directly with Microsoft Defender for Cloud to provide centralized alerting and investigation across hybrid environments.

Exam trap

The trap here is that candidates may confuse Microsoft Defender for Identity with Microsoft Defender for Endpoint, assuming endpoint protection covers identity threats, but MDI is the only solution that directly monitors on-premises Active Directory for lateral movement and pass-the-hash attacks.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Office 365 protects against email-based threats (phishing, malware in attachments/links) and does not monitor on-premises Active Directory or detect lateral movement or pass-the-hash attacks. Option C is wrong because Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for devices (Windows, Linux, macOS) and does not natively analyze on-premises AD domain controller traffic for identity-based attacks. Option D is wrong because Microsoft Intune is a cloud-based mobile device management (MDM) and mobile application management (MAM) solution; it does not provide security monitoring or threat detection for on-premises Active Directory.

Full explanation →

892

MCQmedium

A security operations team investigates a multi-stage attack that began with a phishing email, then moved to credential compromise, and finally to lateral movement on endpoints. They need a single pane of glass to view the entire attack story, including the initial email, the compromised user's sign-in activities, and processes on affected devices. Which Microsoft security solution provides this unified investigation experience?

A.Microsoft Sentinel

B.Microsoft Defender for Cloud

C.Microsoft 365 Defender

D.Microsoft Defender for Identity

AnswerC

Microsoft 365 Defender is the unified XDR (Extended Detection and Response) solution designed to protect an organization's entire digital estate across endpoints, email, identity, and cloud applications. It automatically correlates alerts and incidents from its constituent services (Defender for Endpoint, Office 365, Identity, and Cloud Apps) into a single, comprehensive incident view. This unified perspective is crucial for investigating multi-stage attacks, as it provides a holistic timeline and context across various attack vectors, enabling security operations teams to understand the full scope and impact of sophisticated threats.

Why this answer

Microsoft 365 Defender (now Microsoft Defender XDR) provides a unified investigation experience by correlating signals across email, identity, and endpoint domains into a single incident view. This allows the security team to see the full attack story—from the initial phishing email in Defender for Office 365, to the compromised user's sign-in activities via Defender for Identity, and the lateral movement processes on endpoints through Defender for Endpoint—all within one console.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel (a SIEM) with Microsoft 365 Defender (an XDR), assuming that any cross-domain investigation requires a SIEM, when in fact Microsoft 365 Defender provides the native, pre-correlated attack story across email, identity, and endpoints without needing custom log ingestion.

Why the other options are wrong

Microsoft Sentinel is a SIEM/SOAR solution that aggregates logs from multiple sources, but it does not natively provide a unified investigation experience across email, identity, and endpoints in a single attack story. The question specifically asks for a single pane of glass for the entire attack chain, which is a core capability of Microsoft 365 Defender.

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP), not a unified investigation experience for multi-stage attacks spanning email, identity, and endpoints.

Microsoft Defender for Identity focuses on detecting and investigating identity-based threats using on-premises Active Directory signals, but it does not provide a unified view across email, cloud app sign-ins, and endpoint processes as required by this multi-stage attack scenario.

When would these options actually be correct?

A question that asks: 'Which Microsoft solution provides a cloud-native SIEM and SOAR platform for security analytics and threat intelligence across the enterprise?' In that context, Microsoft Sentinel would be the correct answer because it ingests data from various sources and enables custom detection and response.

A question asking: 'Which Microsoft solution provides security posture management and threat protection for hybrid cloud workloads across Azure, AWS, and GCP?' would make Microsoft Defender for Cloud the correct answer.

A question that asks: 'Which Microsoft solution provides advanced threat analytics and alerts for on-premises Active Directory attacks, such as pass-the-hash or golden ticket attacks?' would have Microsoft Defender for Identity as the correct answer.

Why candidates pick the wrong answer

Candidates may think Sentinel is the central security tool for all investigations because it can collect data from many sources, but they overlook that Microsoft 365 Defender offers a built-in, unified incident view specifically for the Microsoft 365 ecosystem.

Candidates may confuse 'Defender for Cloud' with the broader Microsoft 365 Defender suite, assuming it covers all security scenarios, or they may think it provides a unified investigation pane due to its name containing 'Defender'.

Candidates may associate Defender for Identity with identity compromise and lateral movement, but overlook that the question requires a single pane of glass covering email, sign-ins, and endpoints, which is the domain of Microsoft 365 Defender.

Full explanation →

893

MCQmedium

A company uses Microsoft 365 and needs to automatically apply a retention label to documents that contain personally identifiable information (PII) in SharePoint Online. The label should retain the documents for 5 years and then delete them. Which Microsoft Purview solution should they use?

A.Microsoft Purview Information Protection

B.Microsoft Purview Data Loss Prevention (DLP)

C.Microsoft Purview Data Lifecycle Management

D.Microsoft Purview eDiscovery

AnswerC

Microsoft Purview Data Lifecycle Management (DLM) is specifically engineered to manage the lifecycle of information, including its retention and eventual disposition. DLM utilizes retention labels that can be manually applied or automatically assigned to content based on specific conditions, such as sensitive information types, keywords, or content properties. These labels then enforce retention periods, ensuring data is kept for the required duration and automatically deleted when no longer needed, directly addressing the need for automated retention and deletion policies.

Why this answer

Microsoft Purview Data Lifecycle Management (formerly known as Microsoft 365 Records Management) is the solution specifically designed to apply retention labels and policies that automatically retain content for a specified period and then delete it. In this scenario, the requirement to automatically apply a retention label to documents containing PII in SharePoint Online and then retain them for 5 years before deletion is a core capability of Data Lifecycle Management, which uses auto-labeling policies based on sensitive information types.

Exam trap

The trap here is that candidates often confuse the purpose of Data Lifecycle Management (retention and deletion) with Information Protection (sensitivity labels and encryption), especially since both use labels and can be auto-applied based on sensitive content.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Information Protection focuses on classifying and protecting data through sensitivity labels (e.g., encryption, marking), not on retention and deletion schedules. Option B is wrong because Microsoft Purview Data Loss Prevention (DLP) is designed to prevent accidental sharing of sensitive data by enforcing policies (e.g., blocking or warning), not to manage retention or deletion. Option D is wrong because Microsoft Purview eDiscovery is used for searching, holding, and exporting content for legal or investigative purposes, not for applying retention labels or managing lifecycle policies.

Full explanation →

894

MCQmedium

A company uses Microsoft Defender for Office 365 and wants to protect users from malicious attachments in email. They need a feature that scans email attachments in a sandbox environment before they are delivered to recipients. Which Defender for Office 365 feature should they use?

A.Safe Links

B.Safe Attachments

C.Anti-phishing policies

D.Anti-spam policies

AnswerB

Safe Attachments is a critical component of Microsoft Defender for Office 365 that provides advanced, zero-day protection against unknown malware and viruses in email attachments. It employs a detonation chamber, or sandboxing technology, to open and analyze attachments in a secure, isolated virtual environment. This process determines if an attachment is malicious before it is delivered to the user's inbox, making it the precise solution for scanning email attachments for threats.

Why this answer

Safe Attachments is the correct feature because it specifically detonates email attachments in a sandbox environment before delivery, analyzing them for malicious behavior. This protects users from zero-day threats and advanced malware that signature-based detection might miss.

Exam trap

The trap here is confusing Safe Attachments (which scans attachments in a sandbox) with Safe Links (which scans URLs), as both are part of Microsoft Defender for Office 365 but serve different protection purposes.

How to eliminate wrong answers

Option A is wrong because Safe Links protects users from malicious URLs in email and Office documents, not attachments. Option C is wrong because Anti-phishing policies protect against phishing attempts by analyzing sender reputation and impersonation patterns, not by scanning attachments in a sandbox. Option D is wrong because Anti-spam policies filter unwanted bulk email based on content and sender reputation, not by detonating attachments in a sandbox.

Full explanation →

895

MCQhard

Your organization, Contoso, uses Microsoft Entra ID P2. You have a Microsoft Entra tenant with several privileged roles including Global Administrator, Exchange Administrator, and SharePoint Administrator. The security team wants to enforce just-in-time (JIT) access for these roles, requiring users to request activation and get approval before they can use the role. Additionally, all activations must be logged and reviewed monthly. What should you configure?

A.Configure Microsoft Entra Privileged Identity Management (PIM) to require approval for role activation and enable access reviews.

B.Configure Conditional Access policies to require MFA for privileged roles.

C.Use Microsoft Entra Entitlement Management to create access packages for roles.

D.Create an Identity Protection risk policy to block risky sign-ins for privileged users.

AnswerA

Microsoft Entra Privileged Identity Management (PIM) is the dedicated service for managing, controlling, and monitoring access to important resources. It enables just-in-time (JIT) access, meaning users are assigned privileged roles only when needed and for a limited duration. Requiring approval for role activation ensures an additional layer of control, while access reviews provide periodic verification that users still require their assigned privileges, enforcing the principle of least privilege.

Why this answer

Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by requiring users to activate their role assignments with approval from designated approvers. It also includes access reviews that can be scheduled to audit and confirm active role assignments, meeting the logging and monthly review requirements. This directly addresses the need for activation approval and periodic review of privileged role usage.

Exam trap

The trap here is confusing Conditional Access policies (which control sign-in conditions) with PIM (which controls role activation and approval workflows), leading candidates to select MFA enforcement instead of the JIT and review capabilities unique to PIM.

How to eliminate wrong answers

Option B is wrong because Conditional Access policies enforce authentication requirements (like MFA) during sign-in but do not provide JIT activation workflows, approval processes, or scheduled access reviews for privileged roles. Option C is wrong because Entitlement Management manages access packages for resource access (e.g., groups, apps, sites) but does not handle role activation approval or time-bound JIT elevation for Entra ID administrative roles. Option D is wrong because Identity Protection risk policies block or require MFA for risky sign-ins, but they do not control role activation, require approval, or log/review privileged role usage.

Full explanation →

896

Multi-Selecteasy

Your organization is implementing Microsoft Purview to govern data across Microsoft 365 and Azure. Which TWO capabilities should you use to discover and classify sensitive data?

Select 2 answers

A.Microsoft Purview Information Protection

B.Microsoft Purview Data Map

C.Microsoft Purview eDiscovery

D.Microsoft Purview Audit

E.Microsoft Purview Data Lifecycle Management

AnswersA, B

Microsoft Purview Information Protection (MPIP) is a core component for classifying and protecting sensitive data throughout its lifecycle. It enables organizations to define and apply sensitivity labels, which can automatically detect sensitive information types and then apply visual markings, encryption, or access restrictions. This capability directly addresses the need to classify data based on its sensitivity and apply appropriate protective measures.

Why this answer

Microsoft Purview Information Protection (A) enables you to discover, classify, and protect sensitive data by applying sensitivity labels and analyzing content via data loss prevention (DLP) policies. Microsoft Purview Data Map (B) provides automated scanning and classification of data assets across Azure and Microsoft 365, building a unified map of sensitive data locations. Together, they fulfill the discovery and classification requirements.

Exam trap

The trap here is that candidates often confuse eDiscovery or Audit with classification capabilities, but eDiscovery is for legal holds and search, and Audit is for activity logging—neither discovers or classifies sensitive data.

Full explanation →

897

MCQhard

You are troubleshooting a Windows device that is reporting as non-compliant in Microsoft Intune. The exhibit shows the output of a PowerShell command run on the device. Based on the output, which component is likely misconfigured?

A.Microsoft Defender for Endpoint sensor onboarding

B.Antivirus protection

C.Antispyware protection

D.Microsoft Defender Antivirus real-time protection

AnswerA

The PowerShell output displays the 'OnboardingState' property with a value of 0, which indicates the device is not onboarded to Microsoft Defender for Endpoint. This is the likely cause of the non-compliant status.

Why this answer

The PowerShell output shows the 'OnboardingState' value is 0, which indicates the device is not onboarded to Microsoft Defender for Endpoint. Intune uses the Defender for Endpoint sensor as a compliance signal; if the sensor is not properly onboarded, the device will report as non-compliant regardless of other security settings.

Exam trap

The trap here is that candidates often confuse 'onboarding state' with 'real-time protection' or 'antivirus status', but the PowerShell output explicitly shows the 'OnboardingState' property, which is unique to Microsoft Defender for Endpoint sensor configuration, not to Microsoft Defender Antivirus settings.

How to eliminate wrong answers

Option B is wrong because antivirus protection status is not indicated by the 'OnboardingState' value; it is a separate compliance policy setting. Option C is wrong because antispyware protection is a subset of antivirus protection and is not directly tied to the sensor onboarding state shown in the output. Option D is wrong because real-time protection is a feature of Microsoft Defender Antivirus, not the Defender for Endpoint sensor onboarding process; the output specifically shows the sensor onboarding state, not real-time protection status.

Full explanation →

898

MCQmedium

You are a compliance administrator for a multinational corporation that uses Microsoft Purview. The company must comply with the General Data Protection Regulation (GDPR). You need to implement a solution that allows data subjects to request access to their personal data stored in Exchange Online, SharePoint Online, and OneDrive for Business. The solution must provide a centralized portal for data subjects to submit requests and for privacy officers to manage the entire process, including searching for data, reviewing results, and exporting or redacting data. You also need to ensure that requests are automatically routed to the appropriate privacy officer based on the data subject's region. Microsoft Purview has been licensed for the entire organization. What should you configure?

A.Use Microsoft Purview Information Protection to manually classify and search for personal data.

B.Configure Microsoft Purview eDiscovery (Premium) cases with workflow automation and role-based access for privacy officers.

C.Configure Microsoft Purview eDiscovery (Standard) cases to manage each request manually.

D.Create retention labels and policies to retain personal data for GDPR compliance.

AnswerB

Microsoft Purview eDiscovery (Premium) is the optimal solution for managing complex legal and regulatory requests, including Data Subject Rights (DSRs). It offers advanced capabilities such as intelligent data identification, robust workflow automation, and granular role-based access controls, enabling privacy officers to efficiently search, review, redact, and export personal data across diverse data sources. This comprehensive solution streamlines the entire DSR fulfillment process, ensuring compliance and operational efficiency for multinational organizations.

Why this answer

Microsoft Purview eDiscovery (Standard) allows for content searches across Exchange, SharePoint, and OneDrive, and can be used to manage GDPR data subject requests. However, the centralized portal and automated routing are features of Microsoft Purview eDiscovery (Premium), which includes case management, review sets, and advanced workflows. Therefore, the best option is to configure eDiscovery (Premium) cases with workflow automation.

Option A is too basic. Option C is for data retention, not subject access requests. Option D is for classification, not access requests.

Full explanation →

899

MCQmedium

A financial institution is deploying Microsoft Sentinel to monitor security events across its hybrid cloud environment. They want to correlate alerts from multiple sources and automate incident response. Which Microsoft Sentinel feature should they use to create automated workflows?

A.Workbooks

B.Analytics rules

C.Playbooks

D.Hunting queries

AnswerC

Playbooks in Microsoft Sentinel, powered by Azure Logic Apps, are automated, scalable, and customizable workflows designed to orchestrate and automate incident response tasks. They can be triggered by analytics rules, incidents, or manual actions, performing predefined actions such as enriching incident data, blocking malicious IP addresses, isolating compromised hosts, or notifying security teams via various communication channels. This automation significantly reduces manual effort and accelerates response times.

Why this answer

Playbooks in Microsoft Sentinel are built on Azure Logic Apps and allow you to automate incident response by defining a series of actions triggered by alerts. They can orchestrate tasks such as blocking IPs, opening tickets, or notifying teams, making them the correct choice for creating automated workflows.

Exam trap

The trap here is confusing the purpose of Analytics rules (alert generation) with Playbooks (automated response), as both are part of the detection and response pipeline but serve distinct roles.

How to eliminate wrong answers

Option A is wrong because Workbooks are used for visualizing and analyzing data through dashboards, not for automating workflows. Option B is wrong because Analytics rules define conditions for generating alerts from data sources, but they do not execute automated response actions. Option D is wrong because Hunting queries are ad-hoc searches for potential threats in raw log data, not for creating automated incident response workflows.

Full explanation →

900

MCQhard

Refer to the exhibit. You are evaluating a Microsoft Purview retention policy. The policy is applied to Exchange Online, SharePoint Online, and OneDrive for Business. What is the behavior of this policy?

A.Items are retained indefinitely and cannot be deleted

B.Items are deleted 365 days after last modification

C.Items are preserved with a lock and cannot be deleted by users

D.Items are automatically deleted 365 days after creation

AnswerD

RetentionDuration is 365, trigger is WhenCreated, action is Delete.

Why this answer

The retention policy shown in the exhibit specifies 'Delete items automatically after 365 days from creation date.' This means that once an item reaches 365 days from its creation date (not last modification), it will be permanently deleted from Exchange Online, SharePoint Online, and OneDrive for Business. The policy does not include a retention period to preserve items; it only deletes them after the specified age.

Exam trap

The trap here is that candidates often confuse the 'last modification' trigger with the 'creation date' trigger, or assume a retention policy always preserves items before deletion, when in fact a delete-only policy immediately purges items after the specified age without any retention period.

How to eliminate wrong answers

Option A is wrong because the policy does not retain items indefinitely; it explicitly deletes them after 365 days from creation. Option B is wrong because the policy triggers deletion based on the creation date, not the last modification date; 'last modification' is a different trigger used in other retention scenarios. Option C is wrong because a preservation lock (which prevents deletion and modification by users) is a separate feature that must be explicitly enabled; this policy only deletes items and does not include any lock or preservation action.

Full explanation →

Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 826–900