Microsoft Security, Compliance, and Identity Fundamentals SC-900 SC-900 Questions 976–1050 | Page 14/17

976

Multi-Selecteasy

Which TWO of the following are capabilities of Microsoft Entra ID?

Select 2 answers

A.Email filtering and anti-malware protection.

B.Identity and access management for cloud applications.

C.Single sign-on to SaaS applications.

D.Encryption of data at rest in Azure Storage.

E.Network firewall management.

AnswersB, C

Microsoft Entra ID is a comprehensive identity and access management (IAM) solution designed to manage user identities and control their access to various cloud-based applications. It enables organizations to provision users, enforce authentication policies like multi-factor authentication, and authorize access based on roles and groups. This capability is central to securing access to a vast ecosystem of SaaS and custom-developed cloud applications.

Why this answer

Microsoft Entra ID (formerly Azure Active Directory) is a cloud-based identity and access management (IAM) service. It provides authentication and authorization for cloud applications, including support for single sign-on (SSO) to thousands of pre-integrated SaaS applications like Salesforce, Office 365, and Workday. These are core IAM capabilities, not security functions like email filtering or network firewall management.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID's identity management role with broader security services like email protection or network security, leading them to select options that belong to other Azure or Microsoft 365 security products.

Full explanation →

977

MCQmedium

An organization uses Microsoft Defender for Cloud to secure its Azure workloads. They want to receive recommendations for improving the security posture of their virtual machines. What should they enable?

A.Microsoft Defender for Cloud Apps

B.Microsoft Sentinel

C.Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM)

D.Azure Policy

AnswerC

Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) continuously assesses cloud resources for misconfigurations and vulnerabilities across multi-cloud environments. It provides actionable security recommendations, prioritized by potential impact, to improve the organization's overall security posture. CSPM also includes compliance monitoring against regulatory standards and industry benchmarks, offering a unified view of security health.

Why this answer

Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) provides continuous assessment of Azure workloads, including virtual machines, against security baselines and best practices. It generates actionable recommendations to improve the security posture, such as applying missing system updates or enabling encryption. This is the correct feature for receiving VM-specific security recommendations.

Exam trap

The trap here is that candidates confuse Azure Policy (which enforces rules) with CSPM (which assesses and recommends), or they think Microsoft Sentinel (a SIEM) is needed for security recommendations, when CSPM is the dedicated posture management service.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) focused on shadow IT discovery and data protection across SaaS applications, not on providing security recommendations for Azure VMs. Option B is wrong because Microsoft Sentinel is a Security Information and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR) solution for threat detection and incident response, not a posture management tool that generates VM security recommendations. Option D is wrong because Azure Policy enforces organizational rules and compliance by applying policies (e.g., requiring a specific VM SKU), but it does not generate security posture recommendations; CSPM is the service that provides those recommendations.

Full explanation →

978

MCQmedium

An organization wants to protect against business email compromise (BEC) attacks where attackers impersonate the CEO to trick employees into transferring funds. Which Microsoft Defender for Office 365 capability should they configure to detect such impersonation?

A.Safe Attachments

B.Safe Links

C.Impersonation protection

D.Spoof intelligence

AnswerC

Impersonation protection is a critical feature within anti-phishing policies in Microsoft Defender for Office 365 specifically designed to combat Business Email Compromise (BEC) attacks. It allows administrators to define specific high-value users (e.g., executives, financial personnel) and trusted domains to monitor for impersonation attempts. The system analyzes various email headers and content attributes, such as display name, reply-to address, and sender address, to detect subtle variations that indicate an attempt to spoof a protected identity. When an impersonation is detected, the email can be quarantined, moved to junk, or have a safety tip added, directly mitigating BEC threats.

Why this answer

Impersonation protection in Defender for Office 365 is specifically designed to detect and block business email compromise (BEC) attacks where an attacker spoofs a trusted sender, such as a CEO or CFO. It uses machine learning and sender intelligence to analyze email patterns and flag messages that impersonate internal or external high-value targets, making it the correct capability for this scenario.

Exam trap

The trap here is that candidates often confuse impersonation protection (user-level) with spoof intelligence (domain-level), assuming both handle the same type of attack, but impersonation protection is the only one that detects CEO fraud by analyzing sender identity rather than just domain authentication.

How to eliminate wrong answers

Option A is wrong because Safe Attachments protects against malware by detonating attachments in a sandbox, not against impersonation-based BEC attacks. Option B is wrong because Safe Links protects users from malicious URLs in emails and Office documents by checking links at click-time, not from sender impersonation. Option D is wrong because Spoof intelligence handles domain-level spoofing (e.g., forged From addresses using similar domains) but does not cover user-level impersonation of specific individuals like a CEO.

Full explanation →

979

MCQhard

Your company uses Microsoft Purview Information Protection to classify sensitive data. A user reports that when they try to share a document containing a credit card number via email, the email is blocked. Which Purview feature is most likely causing this behavior?

A.Data Loss Prevention (DLP) policy

B.Audit log

C.Sensitivity label

D.Retention label

AnswerA

Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and automatically protect sensitive information across various locations, including email. They utilize sensitive information types (SITs) to detect specific data patterns, such as credit card numbers, and can enforce actions like blocking email transmission, notifying users, or encrypting content to prevent unauthorized sharing. This capability directly addresses the requirement to detect sensitive data and block its sharing via email.

Why this answer

A Data Loss Prevention (DLP) policy in Microsoft Purview is specifically designed to detect and block sensitive data—such as credit card numbers—from being shared via email. When a user attempts to send a document containing a credit card number, the DLP policy scans the email content and attachments, matches the credit card pattern (e.g., using the predefined Sensitive Info Type for credit card numbers), and enforces an action like blocking the message. This is the most likely cause of the email being blocked.

Exam trap

The trap here is that candidates often confuse Sensitivity labels with DLP policies, thinking labels alone can block emails, but labels only apply classification and protection—they require a DLP policy to enforce blocking actions based on content detection.

How to eliminate wrong answers

Option B is wrong because the Audit log records user and admin activities for compliance and forensic analysis but does not actively block or prevent data sharing—it is a passive logging feature. Option C is wrong because Sensitivity labels apply classification and protection (e.g., encryption or visual markings) to documents and emails, but they do not inherently block email transmission based on content patterns like credit card numbers; they require a DLP policy to enforce actions on labeled content. Option D is wrong because Retention labels manage how long data is kept or when it should be deleted, and they do not scan or block email content for sensitive data like credit card numbers.

Full explanation →

980

MCQeasy

A company uses Microsoft Entra ID and wants to enable employees to reset their own passwords without needing to contact the help desk. They want to enforce multifactor authentication when the employee performs the reset. Which Microsoft Entra feature should they enable?

A.Microsoft Entra Self-Service Password Reset (SSPR)

B.Microsoft Entra ID Federation

C.Microsoft Entra Identity Protection

D.Microsoft Entra Privileged Identity Management (PIM)

AnswerA

Microsoft Entra Self-Service Password Reset (SSPR) is a Microsoft Entra ID feature that empowers users to reset their forgotten or locked passwords without requiring administrator assistance. It significantly reduces helpdesk calls by allowing users to verify their identity through pre-registered authentication methods, such as a mobile app notification, text message, or email to an alternate address. This self-service capability enhances user productivity and can be configured to enforce multi-factor authentication during the reset process for heightened security.

Why this answer

Microsoft Entra Self-Service Password Reset (SSPR) is the correct feature because it allows users to reset their own passwords without help desk intervention, and it can be configured to require multifactor authentication (MFA) during the reset process. This aligns directly with the scenario of enabling self-service password changes while enforcing MFA for security.

Exam trap

The trap here is that candidates often confuse Identity Protection (which detects risky password changes) with SSPR (which enables the actual password reset), leading them to select Option C instead of A.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra ID Federation is used to establish trust between an on-premises identity provider (e.g., AD FS) and Entra ID for single sign-on, not for self-service password reset with MFA enforcement. Option C is wrong because Microsoft Entra Identity Protection is a risk-based security tool that detects and responds to identity threats (e.g., risky sign-ins or leaked credentials), but it does not provide a self-service password reset capability. Option D is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time privileged role activation and access reviews, not end-user password reset functionality.

Full explanation →

981

Multi-Selectmedium

Which TWO of the following are benefits of using Microsoft Entra ID for identity management?

Select 2 answers

A.Single sign-on (SSO) to cloud applications

B.Password hash synchronization

C.Multi-factor authentication (MFA)

D.Automated security incident detection

E.Replacement of on-premises Active Directory

AnswersA, C

Single sign-on (SSO) to cloud applications is a core benefit of Microsoft Entra ID, enabling users to authenticate once with their Entra ID credentials and gain seamless access to thousands of integrated Software-as-a-Service (SaaS) applications. This capability significantly enhances user productivity by eliminating the need to remember multiple passwords and repeatedly log in, while also improving security by centralizing identity management. Entra ID acts as the central identity provider, issuing secure tokens after initial authentication.

Why this answer

Single sign-on (SSO) and multi-factor authentication (MFA) are key benefits of Entra ID. Password hash synchronization is a feature of Entra Connect, not a direct benefit. On-premises Active Directory is a separate service.

Security incident detection is more aligned with Microsoft Sentinel or Defender.

Full explanation →

982

MCQhard

A company wants to allow external customers to sign in to their custom web application using their own social identities, such as Google or Facebook. They also need to support self-service registration and custom branding for the sign-in pages. Which Microsoft Entra External ID solution should they use?

A.Microsoft Entra ID B2B collaboration

B.Microsoft Entra ID B2C

C.Microsoft Entra ID guest accounts

D.Managed identities

AnswerB

Microsoft Entra ID B2C is specifically engineered for customer identity and access management (CIAM), enabling external customers to sign up and sign in to your custom web and mobile applications. It supports a wide array of identity providers, including social accounts like Google and Facebook, as well as local accounts. B2C provides a highly customizable, branded experience for customer registration, sign-in, and profile management, making it ideal for this scenario.

Why this answer

Microsoft Entra ID B2C (Business-to-Consumer) is the correct solution because it is specifically designed for external customer identity and access management, supporting social identity providers (Google, Facebook, etc.) via OAuth 2.0 and OpenID Connect, self-service registration, and full customization of sign-in pages (branding, HTML, CSS). This aligns exactly with the requirements for a customer-facing web application with social sign-in and custom branding.

Exam trap

The trap here is that candidates often confuse B2B collaboration (for external partners) with B2C (for external customers), mistakenly thinking B2B can handle social identities and self-service registration, but B2B lacks those capabilities and is designed for federated business accounts.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID B2B collaboration is intended for business-to-business scenarios, allowing external partners to sign in with their own work or school accounts, not social identities like Google or Facebook, and it does not support self-service registration or custom branding for sign-in pages. Option C is wrong because Microsoft Entra ID guest accounts are a feature of B2B collaboration, used for inviting external users (typically with work/school accounts) to access resources in the tenant, lacking social identity provider support and self-service registration. Option D is wrong because managed identities are an Azure resource authentication mechanism for Azure services to authenticate to other Azure services without storing credentials, not a solution for external customer sign-in or identity management.

Full explanation →

983

MCQhard

A company runs containerized applications on Azure Kubernetes Service (AKS) and stores container images in Azure Container Registry. The security team wants to automatically scan container images for vulnerabilities every time a new image is pushed to the registry and receive recommendations for remediation. Which Microsoft security solution should they enable?

A.A. Microsoft Defender for Endpoint

B.B. Microsoft Defender for Identity

C.C. Microsoft Defender for Cloud

D.D. Microsoft Defender for Office 365

AnswerC

Microsoft Defender for Cloud is the correct solution as it provides comprehensive cloud security posture management (CSPM) and cloud workload protection (CWP). Specifically, its Defender for Containers plan integrates with Azure Container Registry (ACR) and Azure Kubernetes Service (AKS) to automatically scan container images for known vulnerabilities upon push, during import, or on a recurring basis. It identifies security misconfigurations and provides actionable remediation recommendations, crucial for securing containerized applications running on Azure Kubernetes.

Why this answer

Microsoft Defender for Cloud provides integrated vulnerability assessment for container images stored in Azure Container Registry. When enabled, it automatically scans each new image pushed to the registry, identifies known vulnerabilities (using the Qualys scanner or Microsoft's own threat intelligence), and generates actionable remediation recommendations. This directly meets the security team's requirement for automated scanning and remediation guidance.

Exam trap

The trap here is that candidates confuse 'Defender for Cloud' (which covers workload protection including containers) with 'Defender for Endpoint' (which is device-focused), leading them to incorrectly select A because they think container scanning is an endpoint function.

Why the other options are wrong

Microsoft Defender for Endpoint focuses on endpoint devices (workstations, servers, mobile devices) and does not scan container images in Azure Container Registry for vulnerabilities.

Microsoft Defender for Identity focuses on detecting identity-based threats in on-premises Active Directory, not on scanning container images for vulnerabilities in Azure Container Registry.

Microsoft Defender for Office 365 protects against threats in email, Office apps, and collaboration tools, not container image vulnerability scanning in Azure Container Registry.

When would these options actually be correct?

If the question asked for a solution to protect endpoints (e.g., detect and respond to threats on servers or client devices) and included scenarios like malware detection or attack surface reduction, Defender for Endpoint would be correct.

A question asks: 'Which Microsoft security solution monitors and alerts on suspicious user activities and potential identity compromise in an on-premises Active Directory environment?'

An exam question asking which Microsoft security solution protects against malicious links and attachments in email messages or SharePoint files, or provides anti-phishing policies for Exchange Online.

Why candidates pick the wrong answer

Candidates may confuse 'container security' with 'endpoint security' because containers run on hosts, and Defender for Endpoint can protect the underlying host OS, but it does not scan container images in a registry.

Candidates may confuse 'Defender for Identity' with a general security solution for Azure, or mistakenly think it covers container security due to the broad 'Defender' branding.

Candidates may confuse the 'Defender' branding and assume all Defender products offer similar vulnerability scanning capabilities, overlooking that Defender for Office 365 focuses on productivity suite security.

Full explanation →

984

MCQeasy

A security administrator is using Microsoft Defender for Cloud to improve the security posture of Azure resources. The administrator wants to view a consolidated assessment of compliance with industry standards such as CIS and NIST. Which feature should be used?

A.Regulatory compliance dashboard

B.Secure Score

C.Azure Policy

D.Microsoft Sentinel

AnswerA

The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a centralized view of an organization's compliance posture against various industry standards and regulatory benchmarks, such as CIS, NIST, and PCI DSS. It continuously assesses the environment, mapping security controls to specific requirements within these frameworks and clearly indicating which controls pass or fail. This dashboard is specifically designed to help organizations understand and improve their adherence to external regulations by offering actionable recommendations and detailed compliance reports.

Why this answer

The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a consolidated view of compliance with industry standards like CIS and NIST. It continuously assesses Azure resources against built-in compliance frameworks and displays the results in a dashboard, showing which controls are passing or failing. This directly meets the administrator's need to view a consolidated assessment of compliance with those specific standards.

Exam trap

The trap here is that candidates often confuse Secure Score (which shows overall security posture) with the Regulatory compliance dashboard (which specifically maps to industry standards), leading them to pick Secure Score when the question explicitly asks for compliance with CIS and NIST.

Why the other options are wrong

Secure Score provides a numerical rating of security posture based on security controls, but it does not offer a consolidated assessment of compliance with specific industry standards like CIS or NIST.

Azure Policy is used to enforce organizational standards and assess compliance at a resource level, but it does not provide a consolidated view of compliance with industry standards like CIS and NIST. The Regulatory compliance dashboard in Defender for Cloud is specifically designed for that purpose.

Microsoft Sentinel is a SIEM/SOAR solution for threat detection and response, not for viewing compliance assessments against industry standards like CIS and NIST.

When would these options actually be correct?

A security administrator wants to quickly assess the overall security posture of Azure resources and identify recommendations to improve it, without needing compliance details for specific standards.

An administrator needs to enforce specific security configurations (e.g., require encryption on storage accounts) across all Azure resources. In this scenario, Azure Policy would be the correct answer because it allows creating and assigning policies to audit or enforce compliance rules.

A security team needs to centralize security logs and alerts from multiple sources, detect threats, and automate incident response across the enterprise environment.

Why candidates pick the wrong answer

Candidates may confuse Secure Score with compliance assessment because both are security posture features in Defender for Cloud, and Secure Score is prominently displayed.

Candidates may confuse Azure Policy's compliance assessment capabilities with the broader compliance dashboard, thinking that policy definitions can aggregate industry standard compliance, but they lack the pre-built mappings and consolidated view.

Candidates may confuse Sentinel's security monitoring capabilities with compliance assessment features, as both involve security posture management.

Full explanation →

985

MCQmedium

An organization needs to detect and address potential policy violations in Microsoft Teams chat messages and channel conversations. They want to configure a policy that automatically scans for keywords related to confidential information and for sensitive data patterns like credit card numbers. When a violation is found, the policy should notify the user and their manager, and optionally escalate to a designated reviewer. Which Microsoft Purview solution should they configure?

A.Communication Compliance

B.Data Lifecycle Management

C.eDiscovery

D.Audit

AnswerA

Communication Compliance is the correct solution as it proactively identifies and addresses potential policy violations within an organization's communications, such as Microsoft Teams chats, Exchange emails, and Yammer posts. It leverages machine learning and predefined or custom policies to detect issues like harassment, threats, or the sharing of sensitive information. When a policy is triggered, it generates alerts for designated reviewers, enabling them to investigate, remediate, and escalate findings through a structured workflow.

Why this answer

Communication Compliance is the correct solution because it is specifically designed to detect policy violations in Microsoft Teams messages and other communication channels by scanning for keywords and sensitive data patterns (e.g., credit card numbers). It can automatically notify the user and their manager, and optionally escalate violations to a designated reviewer for remediation, directly matching the organization's requirements.

Exam trap

The trap here is that candidates may confuse Communication Compliance with Data Loss Prevention (DLP) or eDiscovery, but DLP focuses on preventing data leaks (e.g., blocking sharing) rather than detecting and escalating policy violations with user/manager notifications, while eDiscovery is reactive and not designed for automated detection and notification workflows.

Why the other options are wrong

Data Lifecycle Management focuses on retaining or deleting data based on policies, not on scanning messages for policy violations or notifying users and managers.

eDiscovery is used for searching and exporting content for legal or investigative purposes, not for real-time policy violation detection and user notification in Teams messages.

Audit logs user and admin activity but does not scan Teams messages for policy violations or sensitive data patterns like credit card numbers.

When would these options actually be correct?

An organization needs to automatically retain Teams chat messages for 7 years to meet regulatory requirements and then delete them. Data Lifecycle Management would be the correct solution to configure retention and deletion policies.

An organization needs to search for and export specific Teams chat messages and channel conversations as part of a legal investigation or litigation hold. They want to place a hold on relevant data to preserve it for eDiscovery purposes.

An organization needs to investigate a specific incident by reviewing historical user activity logs, such as who accessed a sensitive file or changed a retention policy. Audit would be the correct solution for tracking such events.

Why candidates pick the wrong answer

Candidates may confuse data management policies (retention/deletion) with compliance policies that monitor content, as both involve managing data in Microsoft 365.

Candidates may confuse eDiscovery's ability to search and analyze content with the proactive detection and remediation features of Communication Compliance, especially since both involve scanning communications.

Candidates may confuse auditing (reviewing past actions) with proactive monitoring of communications, or think that detecting policy violations requires enabling audit logging first.

Full explanation →

986

MCQhard

A company wants to prevent users from sharing files containing personally identifiable information (PII) with external recipients. They also need to notify users if they attempt to share such files. Which Microsoft Purview solution should be configured?

A.Microsoft Purview Sensitivity Labels

B.Microsoft Purview Communication Compliance

C.Microsoft Purview eDiscovery

D.Microsoft Purview Data Loss Prevention

AnswerD

DLP policies can block sharing of sensitive data and notify users.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect, prevent, and notify users about the sharing of sensitive data, such as personally identifiable information (PII), with external recipients. DLP policies can be configured to automatically block the sharing of files containing PII and display a policy tip notification to the user when they attempt to share such content.

Exam trap

The trap here is that candidates often confuse Sensitivity Labels with DLP, but Sensitivity Labels only classify and protect data without enforcing sharing restrictions or user notifications, whereas DLP is the solution that actively monitors and blocks the external sharing of sensitive data.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Sensitivity Labels are used to classify and protect data by applying encryption or visual markings, but they do not inherently block sharing or provide user notifications when a user attempts to share PII externally. Option B is wrong because Microsoft Purview Communication Compliance is designed to detect and remediate inappropriate communications (e.g., harassment, insider trading) within an organization, not to prevent the sharing of files containing PII with external recipients. Option C is wrong because Microsoft Purview eDiscovery is used for searching, preserving, and exporting content for legal or investigative purposes, not for real-time prevention or notification of data sharing violations.

Full explanation →

987

MCQmedium

A company uses Microsoft 365 and wants to protect users from malicious attachments in email. The security team wants a solution that detonates attachments in a sandbox environment before delivery, and only allows the email through if the attachment is deemed safe. Which Microsoft security solution should they use?

A.Microsoft Defender for Office 365

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Cloud Apps

D.Azure Firewall

AnswerA

Microsoft Defender for Office 365 is the correct solution as it provides advanced threat protection specifically for email and collaboration services within Microsoft 365. Its Safe Attachments feature proactively detonates email attachments in a secure, isolated sandbox environment before they reach user inboxes, effectively identifying and blocking malicious content, including zero-day malware. Additionally, Safe Links rewrites URLs to scan them at the time of click, further protecting users from phishing and malicious websites.

Why this answer

Microsoft Defender for Office 365 includes Safe Attachments, a feature that detonates email attachments in a virtual sandbox environment before delivery. It analyzes the attachment's behavior for malicious activity and only releases the email to the recipient's mailbox if the attachment is deemed safe, directly meeting the requirement for pre-delivery sandboxing.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Office 365 (which handles email security) with Microsoft Defender for Endpoint (which handles device security), leading them to select the wrong solution for email-specific threats.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for devices, not email attachment sandboxing. Option C is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) for controlling shadow IT and data protection across SaaS apps, not for email attachment detonation. Option D is wrong because Azure Firewall is a network-layer firewall that filters traffic based on IP/port rules, not capable of detonating email attachments in a sandbox.

Full explanation →

988

MCQhard

Your organization is using Microsoft Entra Permissions Management (CIEM). You need to identify overprivileged identities in AWS. Which capability should you use?

A.Audit trail

B.Permissions Analytics Report

C.Identity governance

D.Activity trail

AnswerB

The Permissions Analytics Report within Microsoft Entra Permissions Management is specifically designed to identify overprivileged identities by analyzing granted permissions against actual usage data over a defined period. This report leverages machine learning to compare an identity's assigned permissions with the specific actions they have performed, highlighting unused, high-risk, or excessive permissions. It provides actionable insights to right-size permissions and enforce the principle of least privilege effectively.

Why this answer

Permissions Analytics Report is the correct capability because it specifically analyzes permissions across AWS, Azure, and GCP to identify overprivileged identities, unused permissions, and risky actions. It generates a detailed report that highlights identities with excessive permissions, enabling remediation to enforce least privilege. This aligns directly with the CIEM (Cloud Infrastructure Entitlement Management) goal of reducing privilege risks.

Exam trap

The trap here is that candidates confuse 'Permissions Analytics Report' with generic auditing features like Audit trail or Activity trail, assuming any logging tool can identify overprivileged identities, but only the report performs the specific analysis of permissions versus usage.

How to eliminate wrong answers

Option A is wrong because Audit trail in Microsoft Entra Permissions Management records historical changes to permissions and configurations, but it does not analyze or identify overprivileged identities; it is a logging feature. Option C is wrong because Identity governance in Microsoft Entra ID focuses on access reviews, entitlement management, and lifecycle workflows for users and groups, not on analyzing cloud infrastructure permissions across AWS. Option D is wrong because Activity trail tracks user actions and API calls in real-time or historically, but it does not assess permission levels or detect overprivileged identities; it is an auditing feature.

Full explanation →

989

MCQmedium

A company uses Microsoft Defender for Cloud to secure its Azure resources. The security team wants to receive a single recommendation for all resources that are missing just-in-time (JIT) VM access. Which Microsoft Defender for Cloud feature should they use?

A.Regulatory compliance dashboard

B.Security recommendations

C.Inventory

D.Security alerts

AnswerB

Microsoft Defender for Cloud's security recommendations are actionable suggestions generated by continuously analyzing the security state of your Azure resources against Microsoft's security benchmarks and best practices. These recommendations, such as enabling Just-In-Time (JIT) VM access or applying adaptive application controls, directly guide users on specific steps to mitigate vulnerabilities and enhance their overall security posture. They are designed to improve the secure score and provide a prioritized list of tasks for remediation.

Why this answer

Microsoft Defender for Cloud's security recommendations feature provides a centralized list of actionable steps to improve your security posture, including a specific recommendation to enable just-in-time (JIT) VM access on all eligible virtual machines. This recommendation aggregates all resources missing JIT configuration into a single entry, allowing the security team to remediate them collectively. The other options do not aggregate missing JIT configurations into a single recommendation.

Exam trap

The trap here is that candidates confuse 'security recommendations' (proactive posture improvements) with 'security alerts' (reactive threat detections), leading them to select D because they think missing JIT is a security incident rather than a configuration gap.

How to eliminate wrong answers

Option A is wrong because the Regulatory compliance dashboard maps your Azure environment to compliance standards (e.g., SOC 2, ISO 27001) and does not provide operational recommendations like enabling JIT VM access. Option C is wrong because Inventory is a resource browser that lists all your Azure resources but does not generate or aggregate security recommendations for missing configurations. Option D is wrong because Security alerts are triggered by active threats or suspicious activities, not by the absence of a security control like JIT VM access.

Full explanation →

990

MCQhard

A company uses Microsoft Entra ID with a custom line-of-business application that only supports SAML 2.0. They want to enable single sign-on for users. What should they configure in Microsoft Entra ID?

A.Kerberos delegation

B.OpenID Connect authentication

C.SCIM-based user provisioning

D.SAML-based single sign-on

AnswerD

SAML (Security Assertion Markup Language) 2.0 is an XML-based open standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). Microsoft Entra ID acts as a robust IdP, enabling users to sign in once and gain access to multiple enterprise applications (SPs) without re-entering credentials. This protocol is widely adopted for federated single sign-on with custom line-of-business applications and many SaaS applications, making it a secure, mature, and common solution for integrating enterprise applications with Microsoft Entra ID.

Why this answer

D is correct because the custom line-of-business application explicitly supports SAML 2.0, and Microsoft Entra ID can be configured as an identity provider (IdP) to enable SAML-based single sign-on. This allows users to authenticate once in Entra ID and then access the application without re-entering credentials, using SAML assertions to pass authentication and authorization data.

Exam trap

The trap here is that candidates may confuse SCIM provisioning (Option C) with SSO, or assume OpenID Connect (Option B) is universally compatible, but the question explicitly states the application only supports SAML 2.0, making SAML-based SSO the only correct choice.

How to eliminate wrong answers

Option A is wrong because Kerberos delegation is used for Windows-integrated authentication (e.g., on-premises Active Directory) and requires Kerberos protocol support, which is not compatible with a SAML 2.0-only application. Option B is wrong because OpenID Connect (OIDC) is built on OAuth 2.0 and uses JSON Web Tokens (JWTs), not SAML 2.0; the application only supports SAML 2.0, so OIDC cannot be used. Option C is wrong because SCIM (System for Cross-domain Identity Management) is a provisioning protocol for automating user and group lifecycle management, not an authentication or SSO protocol; it does not enable single sign-on.

Full explanation →

991

MCQhard

A company uses Azure SQL Database for a critical line-of-business application. The security team wants to enable threat protection that specifically detects and alerts on SQL injection attempts and anomalous database access patterns. Which workload protection plan should they enable within Microsoft Defender for Cloud?

A.Azure Defender for Servers

B.Azure Defender for SQL

C.Azure Defender for App Service

D.Azure Defender for Storage

AnswerB

Azure Defender for SQL is the dedicated security solution tailored for Azure SQL Database, Azure SQL Managed Instance, and SQL servers on Azure VMs or hybrid environments. It offers comprehensive vulnerability assessments to identify misconfigurations and provides advanced threat protection to detect anomalous activities, including SQL injection attacks, brute-force attempts, and suspicious access patterns. This specialized plan ensures robust security for the database layer, safeguarding sensitive data.

Why this answer

Azure Defender for SQL is the correct workload protection plan because it is specifically designed to detect and alert on SQL injection attempts and anomalous database access patterns for Azure SQL Database. It uses Microsoft's threat intelligence and machine learning to monitor database activity, providing targeted alerts for SQL-specific threats, unlike other Defender plans that focus on different resource types.

Exam trap

The trap here is that candidates may confuse Azure Defender for SQL with Azure Defender for App Service, mistakenly thinking SQL injection is a web application attack, but SQL injection targets the database layer, which is protected by the SQL-specific plan, not the App Service plan.

How to eliminate wrong answers

Option A is wrong because Azure Defender for Servers protects virtual machines and their operating systems, not Azure SQL Database, and it does not specialize in SQL injection detection. Option C is wrong because Azure Defender for App Service secures web applications and APIs, focusing on threats like DDoS or web app vulnerabilities, not database-level SQL injection. Option D is wrong because Azure Defender for Storage monitors storage accounts for anomalies like unusual access patterns or malware uploads, but it does not cover SQL databases or SQL injection attempts.

Full explanation →

992

MCQeasy

Your organization uses Microsoft Purview to classify documents containing health information. You need to ensure that only users with explicit permission can access these documents. Which Microsoft Purview capability should you use?

A.Audit logs

B.Retention policies

C.Data Loss Prevention

D.Sensitivity labels with encryption

AnswerD

Sensitivity labels in Microsoft Purview allow organizations to classify and protect their sensitive data throughout its lifecycle, regardless of where it's stored or shared. When configured with encryption, these labels apply persistent, rights-management protection directly to the document content. This ensures that only authorized users, as defined by the label's policy, can open, view, or modify the document, even if it leaves the organization's controlled environment, thereby enforcing access controls.

Why this answer

Sensitivity labels with encryption are the correct choice because they allow you to classify documents containing health information and apply encryption to restrict access to only users with explicit permissions. This ensures that even if the document is shared or moved, only authorized users can decrypt and read it, meeting the requirement for access control.

Exam trap

The trap here is that candidates often confuse Data Loss Prevention (DLP) with access control, but DLP only monitors and blocks data exfiltration, not who can view or edit documents after they are stored.

How to eliminate wrong answers

Option A is wrong because Audit logs record user activities and access events but do not enforce access restrictions; they are for monitoring, not controlling access. Option B is wrong because Retention policies manage how long data is kept or when it is deleted, not who can access it; they do not provide permission-based access control. Option C is wrong because Data Loss Prevention (DLP) policies detect and prevent unauthorized sharing of sensitive data but do not enforce encryption or granular user permissions; DLP can trigger actions like blocking sharing but cannot restrict access to documents already stored.

Full explanation →

993

MCQeasy

Which Microsoft cloud service provides a unified data governance solution that helps you manage and protect data across your entire data estate, including multi-cloud and on-premises?

A.Microsoft Defender for Cloud

B.Microsoft Intune

C.Microsoft Sentinel

D.Microsoft Purview

AnswerD

Purview provides data governance, classification, and lineage.

Why this answer

Microsoft Purview is the correct answer because it is a unified data governance service that provides visibility into data assets across on-premises, multi-cloud, and SaaS environments. It enables data classification, sensitive data discovery, and policy-based access control to manage and protect the entire data estate, aligning with the question's requirement for a comprehensive governance solution.

Exam trap

The trap here is that candidates often confuse Microsoft Purview with Microsoft Defender for Cloud or Microsoft Sentinel, because all three involve 'protection' or 'security,' but Purview is specifically a data governance and compliance solution, not a security monitoring or posture management tool.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and workload protection platform, not a data governance solution; it focuses on securing cloud infrastructure and detecting threats, not on managing and protecting data across the data estate. Option B is wrong because Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) service for endpoint management and compliance, not a unified data governance tool for multi-cloud and on-premises data. Option C is wrong because Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution for security analytics and threat detection, not a data governance service for managing and protecting data assets.

Full explanation →

994

MCQhard

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to ensure that when a user's on-premises account is disabled, their cloud account is automatically disabled within 5 minutes. Which configuration should you use?

A.Microsoft Entra Privileged Identity Management

B.Microsoft Entra Conditional Access with session controls

C.Microsoft Entra Connect with directory sync configured for 5-minute sync interval

D.Microsoft Entra Connect Health

AnswerC

Microsoft Entra Connect is the foundational tool for synchronizing identities between an on-premises Active Directory and Microsoft Entra ID, including critical user account attributes like 'disabled' status. By default, the synchronization cycle runs every 30 minutes, but administrators can configure the Microsoft Entra Connect sync scheduler to run more frequently. This allows for a minimum 5-minute interval, ensuring that time-sensitive changes, such as account disablement, are reflected in the cloud promptly.

Why this answer

Microsoft Entra Connect with directory synchronization configured for a 5-minute sync interval ensures that changes made to on-premises Active Directory (such as disabling a user account) are replicated to Microsoft Entra ID within that interval. This meets the requirement of automatically disabling the cloud account within 5 minutes of the on-premises change.

Exam trap

The trap here is confusing identity synchronization (Entra Connect) with identity governance or access control tools like PIM or Conditional Access, which do not handle the propagation of on-premises account status changes to the cloud.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time access and role activation, not the synchronization of user account status changes. Option B is wrong because Microsoft Entra Conditional Access with session controls enforces access policies based on conditions like location or device state, but it does not synchronize account disabled status from on-premises to the cloud. Option D is wrong because Microsoft Entra Connect Health monitors the health and performance of the sync infrastructure but does not control the sync interval or propagate account status changes.

Full explanation →

995

Multi-Selecthard

A healthcare organization subject to HIPAA regulations stores patient health information (PHI) in SharePoint Online and OneDrive. The compliance team needs to automatically detect and classify medical record numbers and other PHI when documents are uploaded. Detected sensitive content must be protected by encryption and restricted to authorized users only. Additionally, the team wants to prevent users from sharing such documents externally. Which TWO Microsoft Purview solutions should they combine to achieve these requirements? (Choose two.)

Select 2 answers

A.Microsoft Purview Data Loss Prevention (DLP)

B.Microsoft Purview Information Protection

C.Microsoft Purview Communication Compliance

D.Microsoft Purview Data Lifecycle Management

AnswersA, B

Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various locations within Microsoft 365, including Exchange Online, SharePoint Online, OneDrive, and Teams. It leverages sensitive information types, trainable classifiers, and exact data match to detect HIPAA-regulated data, such as Protected Health Information (PHI). Upon detection, DLP can enforce actions like blocking sharing, notifying users and administrators, or automatically applying sensitivity labels to prevent unauthorized disclosure, directly addressing detection and prevention requirements.

Why this answer

Microsoft Purview Information Protection (B) enables automatic classification and labeling of sensitive data like medical record numbers and PHI based on sensitive info types or trainable classifiers. Microsoft Purview Data Loss Prevention (A) then enforces policies to apply encryption, restrict access to authorized users, and block external sharing of labeled documents. Together, they meet the requirements for detection, protection, and sharing prevention.

Exam trap

The trap here is that candidates may confuse Communication Compliance (which monitors communications) with DLP or Information Protection, or assume Data Lifecycle Management handles classification, but it only manages retention and deletion.

Why the other options are wrong

Communication Compliance focuses on detecting policy violations in communications (e.g., inappropriate language, insider trading) rather than automatically detecting and protecting PHI in documents. It does not provide encryption or access restrictions for sensitive content.

Data Lifecycle Management manages retention and deletion of data based on policies, but does not detect, classify, or protect sensitive content like PHI, nor does it prevent external sharing.

When would these options actually be correct?

An organization needs to monitor employee communications (e.g., email, Teams) for policy violations such as harassment, confidential information leaks, or regulatory compliance breaches (e.g., FINRA). In that scenario, Communication Compliance would be the correct solution.

A question requiring automatic retention or deletion of documents after a specified period (e.g., retaining medical records for 6 years per HIPAA) would make Data Lifecycle Management the correct answer.

Why candidates pick the wrong answer

Candidates may confuse 'compliance' with data protection, assuming Communication Compliance handles all compliance-related tasks, including detecting sensitive data in documents, due to its name and general compliance focus.

Candidates may confuse data lifecycle management with data protection, assuming that managing data over time includes security controls, but DLM focuses on retention and disposal, not classification or encryption.

Full explanation →

996

MCQhard

A security operations center (SOC) wants to enrich their detection capabilities by automatically correlating internal network logs with external threat intelligence feeds containing known malicious IP addresses and domains. They need to ingest, normalize, and prioritize these indicators and generate alerts when matches are found. Which Microsoft security solution provides built-in capabilities for this purpose?

A.Microsoft Sentinel

B.Microsoft Defender for Cloud

C.Microsoft Defender for Endpoint

D.Microsoft 365 Defender

AnswerA

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution specifically engineered for comprehensive security operations. It offers robust capabilities for ingesting vast amounts of log data from diverse sources and natively supports integrating various external threat intelligence feeds through dedicated data connectors (e.g., TAXII, STIX, custom APIs). SOCs leverage Sentinel's analytics rules to automatically correlate these incoming threat indicators with collected log data, thereby enriching detections and enabling proactive threat hunting and response.

Why this answer

Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) solution that provides built-in capabilities to ingest logs from internal network sources, normalize them using common data models, and automatically correlate them with external threat intelligence feeds (e.g., STIX/TAXII). It can prioritize indicators based on severity and generate real-time alerts when matches are found, making it the correct choice for this SOC requirement.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel (a SIEM) with Microsoft 365 Defender (an XDR), assuming that XDR covers all security operations needs, but XDR lacks the broad log ingestion and custom threat intelligence feed integration that a SIEM provides.

How to eliminate wrong answers

Option B (Microsoft Defender for Cloud) is wrong because it is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) focused on securing cloud resources, not a SIEM for ingesting and correlating internal network logs with external threat intelligence feeds. Option C (Microsoft Defender for Endpoint) is wrong because it is an endpoint detection and response (EDR) solution that protects individual devices, not a centralized platform for ingesting diverse network logs and threat intelligence. Option D (Microsoft 365 Defender) is wrong because it is an extended detection and response (XDR) solution that correlates signals across Microsoft 365 products (e.g., email, endpoints, identities), but it lacks the broad log ingestion and custom threat intelligence feed integration capabilities of a dedicated SIEM like Sentinel.

Full explanation →

997

MCQeasy

Your company is deploying Microsoft Defender for Office 365. The security team wants to automatically remove malicious attachments from emails before they reach user inboxes. Which protection feature should be configured?

A.Anti-spam policies

B.Safe Attachments policies

C.Anti-phishing policies

D.Safe Links policies

AnswerB

Safe Attachments policies are specifically designed to protect against zero-day malware and advanced threats embedded in email attachments. This feature utilizes a cloud-based sandbox environment to detonate and analyze attachments in real-time, isolating them from the user's environment. If an attachment is deemed malicious, it is either blocked or quarantined before it can reach the recipient's inbox, preventing the execution of harmful code.

Why this answer

Safe Attachments policies in Microsoft Defender for Office 365 are specifically designed to detect and neutralize malicious attachments in email messages before they reach user inboxes. This feature uses a detonation environment to open attachments in a sandbox, analyzing their behavior for threats, and then automatically removes or replaces the attachment if it is found to be malicious.

Exam trap

The trap here is that candidates often confuse Safe Attachments with Safe Links, thinking both handle attachments, but Safe Links only protects against malicious URLs, not file attachments, while Safe Attachments is the dedicated feature for attachment-based malware protection.

How to eliminate wrong answers

Option A is wrong because anti-spam policies focus on filtering unsolicited bulk email (spam) based on sender reputation, content filters, and bulk mail thresholds, not on scanning attachments for malware. Option C is wrong because anti-phishing policies protect against deceptive messages that attempt to steal credentials or personal information, using impersonation detection and spoof intelligence, but they do not perform attachment-level malware analysis. Option D is wrong because Safe Links policies protect users from clicking on malicious URLs within emails or Office documents by checking links at time of click, not by scanning or removing attachments.

Full explanation →

998

MCQhard

A data analyst is planning to leave the company in two weeks and has access to a large volume of sensitive customer data. The compliance team wants to detect if the analyst starts downloading large amounts of files to a personal USB drive or sending sensitive content to an external email address. They need to set up a policy that alerts on such anomalous data exfiltration activities without blocking operations until a thorough investigation is completed. Which Microsoft Purview solution should they configure?

A.Microsoft Purview Insider Risk Management

B.Microsoft Purview Data Lifecycle Management

C.Microsoft Purview Communication Compliance

D.Microsoft Purview eDiscovery (Standard)

AnswerA

Microsoft Purview Insider Risk Management is the correct solution as it proactively identifies and mitigates potential data exfiltration risks from within the organization. It leverages machine learning to detect anomalous user behaviors, such as unusual download volumes, email forwarding, or cloud uploads, especially when correlated with HR signals like an employee's impending departure. The service provides configurable policies, alerts security teams to suspicious activities, and offers case management tools for investigation and remediation, directly addressing the scenario of a departing data analyst.

Why this answer

Microsoft Purview Insider Risk Management is designed to detect, investigate, and act on risky user activities, including data exfiltration by departing employees. It uses predefined indicators such as downloading files to USB drives or sending emails to external addresses, and can generate alerts without automatically blocking operations, allowing for a thorough investigation first.

Exam trap

The trap here is that candidates often confuse Insider Risk Management with Communication Compliance, but Communication Compliance focuses on communication content (e.g., offensive language) rather than behavioral data exfiltration patterns like USB downloads or bulk external emails.

Why the other options are wrong

Microsoft Purview Data Lifecycle Management focuses on retaining and deleting data based on policies, not on detecting anomalous user behavior like data exfiltration to USB drives or external emails.

Microsoft Purview Communication Compliance monitors communications for policy violations like inappropriate language or sharing sensitive info, but it does not detect anomalous data exfiltration activities such as bulk file downloads to USB drives.

Microsoft Purview eDiscovery (Standard) is used for searching and exporting content for legal or investigative purposes, not for real-time detection and alerting on anomalous data exfiltration activities. It does not provide proactive alerts on user behavior like downloading files to USB drives or sending sensitive emails.

When would these options actually be correct?

An organization needs to automatically retain customer data for 7 years to meet regulatory requirements and then securely delete it. They should configure Microsoft Purview Data Lifecycle Management to apply retention labels and deletion policies.

An organization wants to detect and prevent employees from sharing confidential information via email or Microsoft Teams messages, such as sending customer data to external recipients. They need a policy that scans communications for sensitive content and can enforce actions like blocking the message.

A legal team needs to identify and preserve all emails and documents related to a specific litigation case from a departing employee's mailbox and OneDrive. They require a solution to search, hold, and export relevant data for eDiscovery purposes.

Why candidates pick the wrong answer

Candidates may confuse data lifecycle management with data security controls, thinking that managing data retention also covers monitoring data movement, but it does not include behavioral detection.

Candidates may confuse Communication Compliance with Insider Risk Management because both deal with insider threats and data leakage, but Communication Compliance focuses on communications rather than behavioral patterns like file downloads.

Candidates may confuse eDiscovery's ability to search and export data with the detection of data exfiltration, assuming that monitoring for large downloads falls under the same umbrella of data investigation.

Full explanation →

999

Multi-Selecteasy

Which TWO Microsoft security solutions can be used to centrally manage security policies across hybrid environments including on-premises and cloud? (Choose TWO.)

Select 2 answers

A.Microsoft Sentinel

B.Microsoft Defender for Cloud

C.Microsoft Defender for Office 365

D.Microsoft Intune

E.Microsoft Defender for Cloud Apps

AnswersA, B

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It ingests security data from diverse sources, including Azure, other cloud providers, and on-premises infrastructure, enabling centralized threat detection, investigation, and automated response. This comprehensive capability makes it a primary tool for centralized security management across hybrid and multicloud environments.

Why this answer

Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) solution that provides centralized security analytics and threat intelligence across the entire enterprise, including on-premises and multi-cloud environments. It collects data from various sources via connectors (e.g., Azure Monitor Agent, Syslog, Windows Security Events) and allows security teams to manage policies, detect threats, and respond from a single pane of glass. This makes it a correct answer for centrally managing security policies across hybrid environments.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM/CWPP solution) with Microsoft Defender for Cloud Apps (a CASB), or mistakenly think Microsoft Defender for Office 365 covers hybrid infrastructure policies, when it only protects Microsoft 365 workloads.

Full explanation →

1000

MCQeasy

A company uses a cloud-based email service. The service provider ensures that the physical data centers are secure and that the email platform is patched and available. The company is responsible for managing user accounts and ensuring that employees use strong passwords. This division of responsibilities is an example of which concept?

A.Defense in depth

B.Shared responsibility model

C.Zero Trust

D.Principle of least privilege

AnswerB

The Shared Responsibility Model is a fundamental framework in cloud computing that explicitly delineates security obligations between the cloud service provider (CSP) and the customer. The CSP is responsible for the security *of* the cloud, encompassing the underlying infrastructure, physical facilities, and host operating systems. Conversely, the customer is accountable for security *in* the cloud, which includes their data, applications, network configurations, and identity and access management. This model ensures clarity on who manages what aspects of security, varying based on the service model adopted.

Why this answer

The scenario describes a clear division of security responsibilities between the cloud service provider (securing physical data centers, patching the platform) and the customer (managing user accounts, enforcing strong passwords). This is the core definition of the shared responsibility model, which is a foundational concept in cloud computing (as defined by NIST SP 800-145 and adopted by major providers like Microsoft 365). The model explicitly delineates that the provider is responsible for 'security of the cloud' (physical hosts, network, hypervisor) while the customer is responsible for 'security in the cloud' (user identities, data, client endpoints).

Exam trap

The trap here is that candidates confuse the shared responsibility model with defense in depth because both involve multiple security layers, but the question specifically tests the contractual and operational division of security tasks between cloud provider and customer, not the stacking of controls.

How to eliminate wrong answers

Option A is wrong because defense in depth is a layered security strategy using multiple controls (e.g., firewalls, antivirus, encryption) to protect assets, not a division of responsibilities between two parties. Option C is wrong because Zero Trust is a security model based on 'never trust, always verify'—it assumes no implicit trust and requires continuous authentication for every access request, not a contractual split of duties. Option D is wrong because the principle of least privilege is an access control concept that grants users only the minimum permissions needed to perform their tasks, not a framework for dividing security obligations between a provider and a customer.

Full explanation →

1001

MCQhard

Your company uses Microsoft 365 Copilot to assist employees with drafting emails and documents. The security team needs to ensure that when Copilot accesses sensitive data, it respects the organization's sensitivity labels and does not expose highly confidential information to unauthorized users. What should the security team configure?

A.Configure Microsoft Defender for Cloud Apps session policies

B.Apply Microsoft Purview sensitivity labels to data and enable Copilot data protection

C.Disable Copilot for all users

D.Create a data loss prevention policy that blocks Copilot

AnswerB

Applying Microsoft Purview sensitivity labels to data is the foundational step for classifying and protecting sensitive information across Microsoft 365 applications and services. When combined with enabling Copilot data protection, this configuration ensures that Copilot respects these labels, preventing it from accessing or generating content based on data it shouldn't, or from exposing sensitive information to unauthorized users. This integration allows Copilot to operate securely within established data governance policies, leveraging AI responsibly.

Why this answer

Microsoft Purview sensitivity labels are integrated with Microsoft 365 Copilot to enforce data protection. When sensitivity labels are applied to data, Copilot respects those labels and restricts access to authorized users only. Option A is incorrect because Microsoft Defender for Cloud Apps session policies govern access to cloud apps, not Copilot's handling of labeled data.

Option C is incorrect because disabling Copilot for all users would prevent any use, not just sensitive data access. Option D is incorrect because data loss prevention policies block sharing of sensitive data but do not control Copilot's internal access to labeled content.

Full explanation →

1002

MCQmedium

You are a security administrator for Contoso Ltd. The company uses Microsoft Defender XDR, Microsoft Sentinel, and Microsoft Entra ID. Recently, several users reported receiving phishing emails that bypassed the existing anti-phishing policies. The security team suspects that attackers are using sophisticated techniques to evade detection. You need to enhance the email security posture by implementing a solution that uses AI and machine learning to detect advanced phishing attempts, including those using social engineering and impersonation. Which Microsoft solution should you use?

A.Microsoft Sentinel

B.Microsoft Defender for Office 365

C.Microsoft Defender for Cloud Apps

D.Microsoft Defender for Identity

AnswerB

Microsoft Defender for Office 365 is specifically designed to protect email, collaboration, and productivity services from advanced threats like phishing, business email compromise (BEC), and malware. It employs machine learning models and detonation chambers to analyze email content, attachments, and links in real-time, identifying and blocking sophisticated phishing attempts, impersonation attacks, and zero-day exploits before they reach user inboxes. This comprehensive suite includes anti-phishing policies, Safe Attachments, and Safe Links to proactively safeguard users.

Why this answer

Microsoft Defender for Office 365 includes advanced anti-phishing capabilities with AI and machine learning, such as impersonation protection and spoof intelligence. Microsoft Sentinel is a SIEM/SOAR, not an email security solution. Defender for Cloud Apps is a CASB.

Defender for Identity identifies threats via on-premises AD signals. Microsoft Purview focuses on compliance and data governance.

Full explanation →

1003

MCQmedium

A company uses Microsoft Entra ID. The compliance team requires that membership in highly privileged roles, such as Global Administrator, is reviewed quarterly. The review must be automated: role owners are sent an email notification with a list of current members to approve or deny. If a member does not respond within 30 days, their access should be automatically revoked. Which Microsoft Entra ID feature should the team use to set up this periodic review and automatic removal?

A.Access Reviews

B.Privileged Identity Management (PIM)

C.Conditional Access

D.Identity Protection

AnswerA

Microsoft Entra Access Reviews are specifically designed to manage and automate the periodic review of user access to resources, applications, and roles within Microsoft Entra ID. This feature allows organizations to schedule recurring campaigns where designated reviewers, such as resource owners or managers, certify whether users still require their current permissions. Crucially, Access Reviews can automatically revoke access for users whose permissions are not approved or who fail to respond, directly addressing the compliance requirement for regular access validation and removal of stale assignments.

Why this answer

Access Reviews in Microsoft Entra ID is the correct feature because it is specifically designed for periodic, automated attestation of group or role memberships. It sends email notifications to designated reviewers, tracks responses, and can automatically remove users who do not respond within a defined period (e.g., 30 days). This directly meets the compliance requirement for quarterly reviews of Global Administrator membership with automatic revocation.

Exam trap

The trap here is confusing Privileged Identity Management (PIM) with Access Reviews, as both involve role management, but PIM handles activation and approval while Access Reviews handle periodic attestation and automatic removal.

Why the other options are wrong

PIM provides just-in-time role activation and time-bound assignments, but it does not include built-in automated periodic review workflows with email notifications and automatic removal after 30 days of non-response. That functionality is specific to Access Reviews.

Identity Protection is designed to detect and respond to identity-based risks (e.g., compromised accounts, sign-in anomalies), not to manage periodic access reviews or automatic removal of role members.

When would these options actually be correct?

A question asks: 'The security team needs to grant temporary, time-limited access to the Global Administrator role for specific tasks, with approval required before activation.' In that scenario, PIM is the correct answer because it enables just-in-time privileged role activation with approval workflows.

A company wants to automatically detect and block sign-ins from risky IP addresses or users with leaked credentials, and require multi-factor authentication for high-risk sessions. Identity Protection would be the correct feature to configure risk-based Conditional Access policies.

Why candidates pick the wrong answer

Candidates confuse PIM's role management capabilities with Access Reviews, assuming PIM includes review workflows because both deal with privileged roles. They overlook that Access Reviews is the dedicated feature for periodic attestation and automated removal.

Candidates may confuse Identity Protection's automated risk remediation (e.g., blocking access) with the automated removal of role members, or assume it handles all identity-related automation including reviews.

Full explanation →

1004

MCQmedium

A user receives a sensitivity label that automatically marks the email as 'Confidential' and prevents forwarding. The label was applied without user intervention. Which mechanism most likely applied the label?

A.Azure Information Protection file policy

B.Auto-classification via DLP policy

C.Default label configured in Microsoft 365

D.Manual labeling by the user

AnswerB

Auto-classification via a Data Loss Prevention (DLP) policy is the correct mechanism for this scenario. Microsoft Purview DLP policies can be configured to detect specific sensitive information types (SITs) or trainable classifiers within content, such as emails, documents, or Teams messages. Upon detection, the DLP policy can automatically apply a pre-defined sensitivity label to the item, ensuring consistent protection based on the content's sensitivity without requiring any manual user action.

Why this answer

Auto-classification via DLP policy can automatically apply sensitivity labels based on sensitive content, such as credit card numbers, enabling the label to be applied without user intervention. Option A is incorrect because the Azure Information Protection file policy applies to files in Windows File Explorer, not emails. Option C is incorrect because a default label applies to all unlabeled emails but does not use content detection.

Option D is incorrect because manual labeling requires the user to select the label.

Full explanation →

1005

Multi-Selectmedium

Which THREE are capabilities of Microsoft Purview Data Loss Prevention (DLP)? (Choose three.)

Select 3 answers

A.Automatically classify and label data

B.Detect sensitive information in documents and emails

C.Block sharing of sensitive data with external users

D.Manage encryption keys for data at rest

E.Provide policy tips to users when they attempt to share sensitive data

AnswersB, C, E

Detecting sensitive information in documents and emails is a fundamental capability of Microsoft Purview Data Loss Prevention. DLP policies are meticulously configured to identify specific sensitive information types (SITs), such as credit card numbers, national ID numbers, or custom patterns, within content across various locations like Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. This precise detection mechanism forms the essential prerequisite for any subsequent enforcement actions, ensuring that policies target the correct data.

Why this answer

Microsoft Purview DLP is designed to detect sensitive information (e.g., credit card numbers, PII) in documents and emails by using built-in or custom sensitive information types. When a match is found, DLP can enforce policies to block sharing with external users and display policy tips to inform users of the violation, making options B, C, and E correct capabilities.

Exam trap

The trap here is that candidates confuse the automatic classification and labeling capabilities of Microsoft Purview Information Protection with the detection and enforcement actions of DLP, leading them to incorrectly select Option A as a DLP capability.

Full explanation →

1006

MCQhard

A security operations center (SOC) team needs to ingest security logs from on-premises servers, Azure virtual machines, and SaaS applications like Salesforce. They want a cloud-native solution that uses machine learning to detect threats, provides a unified query language for hunting, and supports automated incident response through playbooks. Which Microsoft solution should they deploy?

A.Microsoft Defender for Cloud

B.Microsoft Sentinel

C.Microsoft 365 Defender

D.Microsoft Defender for Endpoint

AnswerB

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It is specifically designed for a Security Operations Center (SOC) team to ingest security logs from a vast array of sources, including Microsoft services, third-party applications, on-premises infrastructure, and other cloud providers. Sentinel centralizes this data for advanced threat detection using machine learning, behavioral analytics, and threat intelligence, enabling comprehensive security monitoring, hunting, and automated response playbooks.

Why this answer

Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) solution that ingests logs from on-premises servers, Azure VMs, and SaaS applications like Salesforce. It uses built-in machine learning to detect threats, offers the Kusto Query Language (KQL) for unified hunting, and supports automated incident response via playbooks built on Azure Logic Apps.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM tool) with a SIEM, or assume Microsoft 365 Defender can ingest third-party SaaS logs, but only Microsoft Sentinel provides a cloud-native SIEM with unified log ingestion, ML threat detection, and automated playbook response.

Why the other options are wrong

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and workload protection platform, not a SIEM/SOAR solution. It lacks a unified query language (KQL) for hunting across diverse data sources and does not natively support automated incident response playbooks like Sentinel.

Microsoft 365 Defender is designed to protect Microsoft 365 workloads (e.g., email, endpoints, identities) and does not natively ingest logs from on-premises servers, Azure VMs, or third-party SaaS like Salesforce, nor does it provide a unified query language (KQL) or playbook-based automated incident response.

Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for devices, not on ingesting logs from diverse sources like on-premises servers, Azure VMs, and SaaS apps, nor does it provide a unified query language (KQL) for hunting across those sources or support automated incident response playbooks.

When would these options actually be correct?

A question asking for a solution to assess and improve the security posture of Azure and hybrid workloads, detect misconfigurations, and provide just-in-time VM access. For example: 'Which Microsoft service provides continuous assessment of security configurations and recommendations for Azure resources?'

A question asking for a solution to detect, investigate, and respond to threats across Microsoft 365 services (Exchange, SharePoint, Teams) and endpoints, with integrated threat signals from Microsoft Defender products, and requiring automated response capabilities within the Microsoft 365 ecosystem.

A question that asks for a solution to protect endpoints (e.g., Windows, macOS, Linux devices) from advanced threats, with capabilities for endpoint detection and response, automated investigation, and threat hunting specifically on devices, and where the environment does not require multi-source log ingestion or SIEM functionality.

Why candidates pick the wrong answer

Candidates may confuse Defender for Cloud's threat detection capabilities (e.g., Azure Defender) with a full SIEM, or assume its integration with Azure covers all log sources, overlooking the need for a unified query language and playbook automation.

Candidates may confuse Microsoft 365 Defender as a comprehensive security solution for all environments, overlooking its focus on Microsoft 365 workloads and lack of support for third-party SaaS and on-premises log ingestion.

Candidates may confuse Defender for Endpoint's threat detection and automated response features with Sentinel's broader SIEM capabilities, or assume that 'Defender' products all provide similar log ingestion and hunting across multiple sources.

Full explanation →

1007

MCQmedium

A company uses Microsoft Entra ID. They frequently collaborate with an external partner organization. The IT team wants to allow the partner's users to access the company's internal SharePoint site using their existing corporate credentials from their own Microsoft Entra tenant. The partner users should not have to create separate guest accounts or remember another password. Which Microsoft Entra feature should the IT team configure?

A.Microsoft Entra B2C

B.Microsoft Entra B2B collaboration

C.Microsoft Entra Domain Services

D.Microsoft Entra Application Proxy

AnswerB

Microsoft Entra B2B collaboration is the correct solution for enabling secure and seamless collaboration with external partners. It allows organizations to invite guest users from other Microsoft Entra tenants, social identity providers, or email-verified accounts to access applications and resources within their own Microsoft Entra ID. This feature facilitates cross-organizational projects by letting external users utilize their existing credentials without creating new accounts in the host directory, ensuring efficient and governed access.

Why this answer

Microsoft Entra B2B collaboration is the correct feature because it enables external users from a partner organization to access the company's internal SharePoint site using their own corporate credentials from their Microsoft Entra tenant. B2B collaboration creates a guest user object in the resource tenant without requiring separate guest accounts or additional passwords, leveraging cross-tenant trust and SAML/WS-Federation for authentication.

Exam trap

The trap here is that candidates often confuse B2B collaboration with B2C, thinking both are for external users, but B2C is for consumers with self-service sign-up, while B2B is for business partners using their existing corporate identities.

Why the other options are wrong

Microsoft Entra B2C is designed for customer-facing applications where external users sign up and manage their own identities, not for enabling existing corporate credentials from another Entra tenant to access internal resources like SharePoint.

Microsoft Entra Domain Services provides managed domain services like domain join and group policy, not external user access to SharePoint. It does not enable cross-tenant collaboration or federated authentication for partner users.

Microsoft Entra Application Proxy is used to publish on-premises web applications externally, not to enable cross-tenant collaboration with external partners using their existing credentials.

When would these options actually be correct?

A company wants to allow external customers to sign up and log in to a consumer-facing web application using their own social accounts (e.g., Google, Facebook) or email/password, without requiring an existing corporate identity. The IT team would configure Microsoft Entra B2C to manage customer identities and authentication.

A company needs to lift-and-shift on-premises applications that require LDAP, Kerberos, or NTLM authentication to Azure without managing domain controllers. Entra Domain Services would be the correct feature to provide managed domain services for those legacy apps.

A company needs to provide remote access to an internal web application hosted on-premises for external users without requiring a VPN. The IT team wants to secure access with pre-authentication and conditional access policies.

Why candidates pick the wrong answer

The 'B2C' label suggests business-to-consumer, which might be confused with business-to-business (B2B). Candidates may think any external user scenario falls under B2C, overlooking that B2C is for consumer identity management, not for partner collaboration with existing corporate credentials.

Candidates may confuse 'Domain Services' with identity management for external access, or think it provides a broader identity solution that includes collaboration features, not realizing its focus is on legacy authentication and domain join scenarios.

Candidates may confuse Application Proxy with a solution for external access, thinking it can handle partner authentication, but it is designed for publishing on-prem apps, not for B2B collaboration scenarios.

Full explanation →

1008

MCQmedium

Your organization wants to use Microsoft Entra ID to provide single sign-on (SSO) for a third-party SaaS application. What must you configure in Microsoft Entra ID?

A.Identity Protection policy

B.Conditional Access policy

C.Enterprise application registration

D.Self-service password reset

AnswerC

You register the SaaS app as an enterprise application and configure SSO.

Why this answer

Enterprise application registration. To enable SSO for a third-party SaaS application in Microsoft Entra ID, you must register the application as an enterprise application and configure SSO settings. Option A is incorrect because Identity Protection policies are for detecting and responding to identity risks, not for SSO configuration.

Option B is incorrect because Conditional Access policies enforce access controls based on conditions, but the prerequisite for SSO is the application registration. Option D is incorrect because self-service password reset is unrelated to SSO setup.

Full explanation →

1009

MCQmedium

A multinational corporation must retain all financial records for 7 years and then permanently delete them. The compliance officer wants to ensure that even a global administrator cannot modify or delete the retention policy. Which Microsoft Purview solution and configuration should they use?

A.eDiscovery (Standard)

B.Compliance Manager

C.Data Lifecycle Management with a preservation lock

D.Information Protection with sensitivity labels

AnswerC

Data Lifecycle Management (DLM), specifically through Microsoft 365 retention policies, allows organizations to define how long content is retained or deleted. For financial records requiring mandatory retention, a retention policy can be configured to preserve content for a specified period. Applying a preservation lock to this policy makes it immutable, preventing anyone, including administrators, from turning off the policy, deleting it, or making it less restrictive, thus ensuring compliance with stringent regulatory requirements for long-term record retention.

Why this answer

C is correct because Data Lifecycle Management with a preservation lock allows an organization to apply a retention policy that cannot be modified, deleted, or turned off by any administrator, including a global administrator. This ensures financial records are retained for exactly 7 years and then permanently deleted, meeting the compliance officer's requirement for immutable retention.

Exam trap

The trap here is that candidates often confuse retention policies with sensitivity labels or eDiscovery, not realizing that only a preservation lock provides the immutable, administrator-proof retention enforcement required for regulatory compliance.

Why the other options are wrong

eDiscovery (Standard) is used for searching and exporting content for legal or investigative purposes, not for enforcing immutable retention policies. It cannot prevent administrators from modifying or deleting retention settings.

Compliance Manager is a risk assessment and compliance score tool, not a data retention solution. It cannot enforce retention policies or prevent modification/deletion of retention settings.

When would these options actually be correct?

A legal team needs to place a hold on all email communications related to an ongoing lawsuit to prevent deletion or alteration. eDiscovery (Standard) would be the correct solution to create a litigation hold and search for relevant content.

An organization needs to assess its compliance posture against regulatory standards (e.g., GDPR, ISO 27001) and track improvement actions. The compliance officer wants a dashboard showing compliance score and recommended actions.

Why candidates pick the wrong answer

Candidates may confuse eDiscovery's hold capabilities with retention policies, assuming it can enforce long-term retention and deletion, but eDiscovery holds are temporary and not designed for compliance-based lifecycle management.

Candidates may confuse 'compliance' in the name with the ability to enforce retention policies, or think Compliance Manager handles data lifecycle requirements.

Full explanation →

1010

MCQeasy

Your organization uses Microsoft Entra ID to manage identities for employees and external partners. You need to ensure that external partners can access only specific applications and that their access expires automatically after 60 days. Which Microsoft Entra feature should you use?

A.Microsoft Entra B2B collaboration.

B.Conditional Access policies.

C.Microsoft Entra Identity Protection.

D.Microsoft Entra entitlement management.

AnswerD

Microsoft Entra entitlement management is a robust identity governance feature specifically designed to manage the identity and access lifecycle for both internal and external users. It enables organizations to create access packages, which bundle resources like groups, applications, and SharePoint sites, and define policies that include mandatory access reviews and automatic expiration dates for assigned access. This capability directly addresses the requirement for assigning access and enforcing its automatic expiration.

Why this answer

Microsoft Entra entitlement management allows you to create access packages that govern external partner access to specific applications, groups, and sites, with built-in time-limited access that automatically expires after a defined period (e.g., 60 days). This feature directly addresses the requirement to scope access to only specific applications and enforce automatic expiration, which is not natively handled by other Entra ID features.

Exam trap

The trap here is that candidates often confuse the invitation and authentication capabilities of B2B collaboration (Option A) with the full lifecycle and access governance provided by entitlement management, assuming B2B alone can enforce time-bound application access.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra B2B collaboration enables external user invitation and authentication but does not provide granular control over which specific applications they can access or enforce automatic time-bound expiration policies on its own. Option B is wrong because Conditional Access policies enforce access controls based on conditions (e.g., location, device state) but cannot automatically expire access after a fixed duration like 60 days; they are real-time evaluation rules, not time-limited access management. Option C is wrong because Microsoft Entra Identity Protection focuses on detecting and remediating identity-based risks (e.g., leaked credentials, suspicious sign-ins) and does not manage application-specific access or automatic expiration schedules.

Full explanation →

1011

MCQeasy

You are the compliance administrator for a retail company that uses Microsoft 365 Business Premium. The company needs to: - Block customers' credit card numbers from being sent via email. - Retain all sales invoices for 3 years as per financial regulations. - Allow managers to search and export employee emails for HR investigations. - Ensure that only HR can access employee salary information. Which Microsoft Purview solutions should you use?

A.DLP, Information Barriers, eDiscovery, and sensitivity labels

B.DLP, Data Lifecycle Management, eDiscovery, and sensitivity labels

C.Insider Risk Management, Data Lifecycle Management, eDiscovery, and sensitivity labels

D.Communication Compliance, Data Lifecycle Management, eDiscovery, and sensitivity labels

AnswerB

This combination correctly addresses all implied compliance requirements. Data Loss Prevention (DLP) is essential for blocking the sharing of sensitive information like credit card numbers. Data Lifecycle Management (DLM) provides the necessary capabilities for defining and enforcing retention and disposition policies, ensuring data is kept for the required duration and then appropriately deleted. eDiscovery enables the organization to efficiently search, preserve, and produce electronic information for legal or investigative purposes, while sensitivity labels allow for data classification and protection, applying encryption or access restrictions based on content.

Why this answer

DLP (Data Loss Prevention) blocks credit card numbers from being sent via email, Data Lifecycle Management retains sales invoices for 3 years, eDiscovery allows managers to search and export employee emails for HR investigations, and sensitivity labels restrict access to salary information to HR only. Each requirement maps directly to a specific Purview solution: DLP for sensitive data protection, retention policies for compliance, eDiscovery for legal/HR investigations, and sensitivity labels for access control.

Exam trap

The trap here is that candidates confuse Information Barriers (which restrict communication between groups) with DLP (which blocks sensitive data patterns), or assume Insider Risk Management or Communication Compliance can replace DLP for proactive blocking of credit card numbers in email.

How to eliminate wrong answers

Option A is wrong because Information Barriers are designed to prevent communication between specific groups (e.g., to avoid conflicts of interest), not to block sensitive data like credit card numbers or to retain data for a fixed period; DLP handles the blocking, and retention requires Data Lifecycle Management, not Information Barriers. Option C is wrong because Insider Risk Management focuses on detecting risky user activities (e.g., data exfiltration) rather than proactively blocking credit card numbers via email; DLP is the correct solution for that requirement. Option D is wrong because Communication Compliance is used to monitor communications for policy violations (e.g., harassment), not to block specific sensitive data patterns like credit card numbers; DLP is required for that blocking action.

Full explanation →

1012

MCQeasy

Refer to the exhibit. You are configuring a Microsoft Entra ID group. What does the exhibit represent?

A.A dynamic security group based on department attribute.

B.A Microsoft 365 group with dynamic membership.

C.A dynamic group based on user location.

D.A static security group with assigned members.

AnswerA

The JSON clearly indicates a dynamic security group through `groupTypes` containing "Security" and "DynamicMembership". The `membershipRule` property, specifically `(user.department -eq "Sales")`, defines the criteria for automatic membership based on the user's 'department' attribute. This configuration ensures that any user whose department is "Sales" is automatically added to or removed from the group, providing efficient and attribute-driven management.

Why this answer

The exhibit shows a rule syntax of `(user.department -eq "Sales")`, which is the expression used to dynamically add or remove members based on the department attribute. This is the defining characteristic of a dynamic security group in Microsoft Entra ID, where membership is evaluated automatically when user attributes change.

Exam trap

The trap here is that candidates confuse dynamic security groups with Microsoft 365 groups, but the key differentiator is the group type (Security vs. Microsoft 365) shown in the exhibit, not the rule syntax itself.

How to eliminate wrong answers

Option B is wrong because a Microsoft 365 group with dynamic membership uses the same rule syntax but the group type is 'Microsoft 365', not 'Security'. Option C is wrong because the rule explicitly checks the `department` attribute, not `user.location` or any location-related attribute. Option D is wrong because a static security group requires manual assignment of members and does not use a membership rule expression.

Full explanation →

1013

MCQmedium

Refer to the exhibit. A company has configured the above Conditional Access policy in Microsoft Entra ID. A user attempts to access Exchange Online from an untrusted location. What happens?

A.The user is granted access without MFA because the policy does not apply.

B.Access is blocked because the condition is not met.

C.The user is prompted for MFA because the policy applies to all users.

D.The user is blocked because the grant requires MFA.

AnswerA

The Conditional Access policy is specifically configured to apply *only* when a user is accessing from a "trusted location." Since the user is accessing from an *untrusted* location, the conditions of this particular policy are not met. Consequently, the policy is not enforced, and its grant controls, including the MFA requirement, are not triggered. The user is thus granted access based on default security settings or other applicable policies, without being prompted for MFA by *this* specific policy.

Why this answer

The Conditional Access policy shown in the exhibit is configured with 'Include: All users' and 'Exclude: All users'. When both include and exclude are set to 'All users', the exclusion takes precedence, effectively making the policy apply to no users. Therefore, when a user attempts to access Exchange Online from an untrusted location, the policy does not apply, and the user is granted access without MFA.

Exam trap

The trap here is that candidates assume 'Include: All users' means the policy applies to everyone, overlooking that 'Exclude: All users' negates the inclusion, making the policy effectively inactive.

How to eliminate wrong answers

Option B is wrong because the condition (untrusted location) is met, but the policy does not apply due to the exclusion overriding the inclusion, so access is not blocked. Option C is wrong because the policy does not apply to all users; the 'Exclude: All users' setting removes all users from policy enforcement, so no MFA prompt occurs. Option D is wrong because the grant control requiring MFA is never evaluated, as the policy does not apply to the user.

Full explanation →

1014

MCQmedium

Your organization uses Microsoft Purview to manage compliance. You need to ensure that financial documents are automatically labeled as 'Financial' and retained for 7 years. Additionally, if a user tries to share a financial document externally, they must see a policy tip warning them and be blocked if they proceed. You also need to audit all access to financial documents. Which configuration should you implement?

A.Create a DLP policy to detect financial data and block external sharing; use default audit logging

B.Create a manual labeling policy for users to apply 'Financial' label; create a retention label for 7 years; create a DLP policy to warn on external sharing

C.Create a retention label 'Financial' with auto-apply based on sensitive info type; create a DLP policy to block external sharing

D.Create an auto-labeling policy to apply a sensitivity label 'Financial' with encryption; create a retention policy to retain all labeled content for 7 years; create a DLP policy to block external sharing of 'Financial' labeled content with a policy tip; enable audit logging

AnswerD

Auto-labeling applies label automatically; retention policy retains; DLP blocks sharing; audit logging tracks access.

Why this answer

It combines auto-labeling to automatically apply the 'Financial' sensitivity label with encryption, a retention policy to retain labeled content for 7 years, a DLP policy to block external sharing with a policy tip, and audit logging (enabled by default) to track access. Option A lacks labeling and retention. Option B uses manual labeling, which is not automatic, and the DLP only warns, not blocks.

Option C uses a retention label instead of a sensitivity label, so it does not provide encryption or protection, and the DLP policy does not include a policy tip.

Full explanation →

1015

MCQmedium

Your organization uses Microsoft 365 and needs to identify internal users who are sending confidential data to external domains repeatedly. Which Microsoft Purview solution should you use?

A.Data Loss Prevention

B.Insider Risk Management

C.Audit (Premium)

D.Communication Compliance

AnswerB

Microsoft Purview Insider Risk Management is specifically engineered to identify, analyze, and act on potential insider risks by correlating diverse signals from Microsoft 365 and other sources. It leverages machine learning and advanced analytics to detect subtle, cumulative patterns of user activity, such as unusual data exfiltration, unauthorized access attempts, or policy violations, that collectively indicate malicious or inadvertent insider threats over time. This capability directly addresses the need to identify evolving patterns of risky behavior.

Why this answer

Insider Risk Management (IRM) is the correct solution because it is specifically designed to detect, investigate, and act on risky user activities that violate organizational policies, such as repeatedly sending confidential data to external domains. IRM uses predefined or custom policies to correlate signals from Microsoft 365 logs (e.g., email, SharePoint, Teams) and user behavior analytics to identify patterns of data exfiltration by internal users. Unlike other solutions, IRM focuses on user-centric risk scenarios and can trigger automated responses like escalation or case creation.

Exam trap

The trap here is that candidates often confuse Data Loss Prevention (DLP) with user behavior analysis, assuming DLP's alerting on individual sensitive data sends is sufficient to identify repeat offenders, but DLP lacks the cross-event correlation and user-centric risk scoring that Insider Risk Management provides.

How to eliminate wrong answers

Option A (Data Loss Prevention) is wrong because DLP is primarily a content-aware policy engine that blocks or alerts on sensitive data in transit or at rest based on rules (e.g., credit card numbers), but it does not natively analyze repeated user behavior patterns over time or correlate multiple incidents to identify a user as a repeat offender. Option C (Audit (Premium)) is wrong because Audit (Premium) provides detailed logging and forensic investigation capabilities but is a passive recording tool; it does not proactively detect or alert on repeated data exfiltration patterns without additional custom queries or manual analysis. Option D (Communication Compliance) is wrong because Communication Compliance is designed to monitor and review communications (e.g., email, Teams) for offensive language, harassment, or regulatory compliance (e.g., FINRA), not for detecting repeated data exfiltration of confidential data to external domains.

Full explanation →

1016

MCQmedium

A financial services organization needs to prevent communication between its research analysts and investment bankers to comply with regulatory requirements. Which Microsoft Purview solution should the compliance team implement?

A.Data Loss Prevention (DLP)

B.Information Barriers

C.Data Lifecycle Management

D.Microsoft Purview eDiscovery

AnswerB

Information Barriers, a feature within Microsoft Purview, are designed to prevent specific groups of users from communicating or collaborating with each other. This is crucial for organizations like financial services firms to establish 'ethical walls' between departments, such as analysts and bankers, ensuring regulatory compliance and preventing conflicts of interest. These policies restrict communication channels like Microsoft Teams chats, calls, and SharePoint site access, directly addressing the need to prevent communication.

Why this answer

Information Barriers (IB) in Microsoft Purview is specifically designed to prevent communication and collaboration between certain user groups to comply with regulatory requirements, such as those in financial services that require separation between research analysts and investment bankers. IB policies enforce restrictions on Microsoft Teams, SharePoint, and OneDrive to block unauthorized communication and file sharing, directly addressing the need to avoid conflicts of interest.

Exam trap

Microsoft often tests the distinction between DLP and Information Barriers, where candidates mistakenly choose DLP because they think preventing communication is about protecting data, but DLP does not restrict person-to-person communication—it only restricts data sharing based on content classification.

Why the other options are wrong

Data Loss Prevention (DLP) is designed to prevent unauthorized sharing of sensitive data, not to block communication between specific groups of users. The requirement is to prevent communication between research analysts and investment bankers, which is a classic information barrier scenario, not a data protection issue.

Data Lifecycle Management governs retention and deletion of data based on policies, but it does not restrict communication between users or groups. The question requires preventing communication between analysts and bankers, which is a real-time access control need, not a data retention policy.

eDiscovery is used for identifying, preserving, and exporting electronic content for legal or investigative purposes, not for preventing communication between groups. It does not enforce real-time communication restrictions.

When would these options actually be correct?

DLP would be correct if the question asked about preventing sensitive financial data (e.g., insider trading tips) from being shared via email or chat between these groups. For example: 'The compliance team needs to block emails containing confidential client data from being sent between departments.'

A question asks: 'A healthcare organization needs to automatically delete patient records after 7 years to comply with HIPAA retention requirements. Which Microsoft Purview solution should they use?' In that scenario, Data Lifecycle Management would be correct.

A law firm needs to search for and export all emails related to a specific client matter for a legal hold. The compliance team should implement Microsoft Purview eDiscovery to identify and preserve relevant data across Exchange, SharePoint, and Teams.

Why candidates pick the wrong answer

Candidates may confuse preventing communication with preventing data leaks, assuming DLP can block all forms of information flow between groups. They might think DLP policies can restrict communication channels, but DLP focuses on content inspection, not user-to-user communication blocking.

Candidates may confuse 'managing data over its lifecycle' with 'controlling data access or flow,' assuming that lifecycle policies can also restrict communication, or they may think DLM includes broader security controls.

Candidates may confuse eDiscovery with compliance solutions that restrict communication, or assume that any regulatory compliance need involves legal discovery processes.

Full explanation →

1017

MCQmedium

A company uses Microsoft Entra ID and wants to automate the lifecycle of guest users. When a contractor's project ends, the guest account should be automatically blocked and then removed after 30 days. Which Microsoft Entra capability should they configure to manage this process?

A.Conditional Access

B.Entitlement Management

C.Privileged Identity Management

D.Identity Governance

AnswerB

Entitlement Management, a core component of Microsoft Entra Identity Governance, is specifically designed to automate the lifecycle of access for both internal and external users. It allows organizations to define access packages that bundle resources and specify access policies, including start and end dates. When an access package expires, Entitlement Management automatically revokes access and can remove guest accounts from the directory, directly addressing the requirement for automated guest account creation and removal tied to project timelines.

Why this answer

Entitlement Management in Microsoft Entra ID Governance allows organizations to automate the lifecycle of external identities, including guest users. By configuring an access package with a specific expiration policy (e.g., 30 days after project end), the system can automatically block and then remove the guest account when the entitlement expires, without manual intervention.

Exam trap

The trap here is that candidates confuse the broad category 'Identity Governance' (Option D) with the specific feature 'Entitlement Management' (Option B), but the question asks for the capability that directly configures the automated lifecycle, which is Entitlement Management.

How to eliminate wrong answers

Option A is wrong because Conditional Access enforces access controls based on signals like location or device compliance, but it does not automate the lifecycle or removal of guest accounts. Option C is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role assignments and approvals, not the lifecycle of guest users or their automatic removal. Option D is wrong because Identity Governance is the overarching category that includes Entitlement Management, but it is not the specific capability that directly configures automated guest lifecycle policies; Entitlement Management is the precise tool within Identity Governance for this task.

Full explanation →

1018

MCQhard

A security operations center (SOC) receives a high volume of low-fidelity alerts from various security tools. They need a solution that can automatically correlate alerts into incidents, use built-in machine learning to reduce false positives, and provide a unified console for investigation and response across Azure, on-premises, and Microsoft 365. Which Microsoft security solution should they use?

A.Microsoft Defender for Cloud

B.Microsoft Sentinel

C.Microsoft Defender for Endpoint

D.Microsoft Defender for Cloud Apps

AnswerB

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It is specifically designed to ingest security data from virtually any source, including users, devices, applications, and infrastructure, across on-premises and multi-cloud environments. Sentinel leverages machine learning and AI to correlate high volumes of low-fidelity alerts into actionable incidents, significantly reducing noise and enabling efficient investigation and automated response within a unified platform.

Why this answer

Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) solution that ingests high-volume, low-fidelity alerts from multiple sources, correlates them into incidents using built-in analytics and machine learning, and provides a unified console for investigation and response across Azure, on-premises, and Microsoft 365. Its fusion and anomaly detection rules specifically reduce false positives by learning normal behavior patterns, making it the correct choice for this scenario.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud (a CSPM/CWPP) with a SIEM, or assume Defender for Endpoint can handle cross-environment correlation, when only Microsoft Sentinel provides the SIEM capabilities of alert aggregation, ML-based false-positive reduction, and a unified investigation console across Azure, on-premises, and Microsoft 365.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) focused on securing cloud resources and workloads, not a SIEM that correlates alerts into incidents or provides a unified SOC console across hybrid environments. Option C is wrong because Microsoft Defender for Endpoint is an endpoint detection and response (EDR) solution that protects devices and investigates endpoint-specific threats, but it does not aggregate alerts from multiple security tools or provide cross-domain incident correlation for Azure, on-premises, and Microsoft 365. Option D is wrong because Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that focuses on shadow IT discovery and data protection for SaaS applications, not a SIEM that performs high-volume alert correlation and false-positive reduction via built-in machine learning.

Full explanation →

1019

MCQmedium

A company uses Azure resources, on-premises servers, and third-party cloud apps. The security team wants a single solution to collect security logs from all these sources, detect threats using advanced analytics, and automate responses to incidents. Which Microsoft security solution should they use?

A.A

B.B

C.C

D.D

AnswerC

Correct. Microsoft Sentinel is designed to ingest logs from multiple sources, provide threat detection via analytics, and automate responses.

Why this answer

A cloud-native SIEM and SOAR solution that can ingest logs from Azure resources, on-premises servers, and third-party cloud apps. It uses advanced analytics with built-in machine learning to detect threats and supports automated incident response. The other options represent different Microsoft security tools that lack the full SIEM/SOAR capabilities required for this scenario.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM tool) with a SIEM solution, failing to recognize that Sentinel is the only Microsoft service designed specifically for cross-source log aggregation, advanced threat detection, and automated incident response in a hybrid multi-cloud environment.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and workload protection platform, not a SIEM; it does not natively collect logs from on-premises servers or third-party cloud apps for unified threat detection and automated response. Option B is wrong because Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) solution focused on endpoint compliance and app policies, not on collecting security logs or performing threat detection across hybrid environments. Option D is wrong because Microsoft Purview Compliance Manager is a compliance management tool that helps assess and manage regulatory compliance, not a security log collection or threat detection solution.

Full explanation →

1020

MCQhard

Your organization uses Microsoft Purview Insider Risk Management. You need to create a policy that detects users exfiltrating sensitive data via email to external recipients. Which policy type should you configure?

A.Offensive language

B.Data leaks

C.Data theft

D.Security policy violations

AnswerB

Microsoft Purview Insider Risk Management is specifically engineered to identify and mitigate risks related to the unauthorized disclosure or exfiltration of sensitive organizational data, whether intentional or accidental. Policies configured within this solution directly target behaviors indicative of data leaving the organization, such as emailing sensitive files to personal accounts, uploading to unsanctioned cloud storage, or copying to removable media, making "data leaks" the most accurate description of its core function.

Why this answer

Data leaks policy type in Microsoft Purview Insider Risk Management is specifically designed to detect and alert on the unauthorized transmission of sensitive data to external recipients, including via email. This policy type analyzes email headers, attachments, and body content against defined sensitive information types (e.g., credit card numbers, PII) and triggers when data is sent outside the organization, matching the scenario described.

Exam trap

The trap here is that candidates often confuse 'Data theft' (which implies physical or logical removal of data) with 'Data leaks' (which specifically covers unauthorized external sharing via communication channels like email), leading them to select Option C incorrectly.

How to eliminate wrong answers

Option A is wrong because Offensive language policy type is designed to detect and manage workplace harassment or inappropriate communication patterns (e.g., bullying, threats), not the exfiltration of sensitive data via email. Option C is wrong because Data theft policy type focuses on unauthorized removal or copying of data by users (e.g., downloading to USB, printing), but it does not specifically target email-based exfiltration to external recipients; it covers broader theft scenarios. Option D is wrong because Security policy violations policy type is intended to detect users bypassing security controls (e.g., disabling antivirus, tampering with logs), not the direct exfiltration of sensitive data via email.

Full explanation →

1021

MCQeasy

A company wants to classify and label data in Microsoft SharePoint Online automatically based on content containing passport numbers. Which Microsoft Purview feature should they use?

A.Audit log

B.Data classification dashboard

C.Data loss prevention (DLP) policy

D.Auto-labeling policy

AnswerD

Auto-labeling policies, configured within Microsoft Purview, automatically apply sensitivity labels to content at rest (e.g., in SharePoint, OneDrive) or in transit (e.g., Exchange email) based on specific conditions. These conditions often include the presence of sensitive information types (SITs), keywords, or trainable classifiers, ensuring consistent and scalable data classification without requiring manual user intervention. This directly addresses the need to classify and label data automatically.

Why this answer

Auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels to documents in SharePoint Online based on sensitive information types, such as passport numbers. This enables automatic classification and labeling without manual intervention, meeting the requirement to label data based on content.

Exam trap

The trap here is that candidates often confuse DLP policies with auto-labeling, but DLP policies focus on protecting data through actions like blocking or alerting, not on automatically applying classification labels.

How to eliminate wrong answers

Option A is wrong because Audit log records user and admin activities but does not classify or label data based on content. Option B is wrong because the Data classification dashboard provides visibility into classified data but does not automatically apply labels. Option C is wrong because Data loss prevention (DLP) policies detect and protect sensitive data but do not automatically apply labels; they enforce actions like blocking or alerting.

Full explanation →

1022

MCQmedium

A company's security team has adopted a strategy that assumes a breach has already occurred. They implement network segmentation, apply strict least privilege access, continuously verify all access requests, and never trust users or devices solely because they are inside the network perimeter. This approach best describes which security model?

A.Zero Trust

B.Shared responsibility model

C.Defense in depth

D.Identity and Access Management (IAM)

AnswerA

Zero Trust is a strategic security model predicated on the principle of "never trust, always verify." It fundamentally assumes that a breach is inevitable or has already occurred, requiring explicit verification for every access request, regardless of origin or prior authorization. This model mandates continuous validation of identity, device health, and service context, while enforcing least privilege access to minimize potential damage from successful intrusions.

Why this answer

The scenario explicitly describes the core tenets of the Zero Trust model: assume breach, enforce least privilege, segment networks, and never trust any user or device based solely on network location. Zero Trust, as defined by NIST SP 800-207, mandates continuous verification of every access request, treating every request as if it originates from an untrusted network, which directly matches the company's strategy.

Exam trap

The trap here is that candidates confuse 'Defense in depth' with Zero Trust because both involve multiple security controls, but Defense in depth does not require the 'assume breach' mindset or the elimination of implicit trust based on network perimeter, which is the defining characteristic of Zero Trust.

How to eliminate wrong answers

Option B (Shared responsibility model) is wrong because it describes the division of security responsibilities between a cloud provider and a customer (e.g., AWS or Azure), not a security architecture that assumes breach and verifies every request. Option C (Defense in depth) is wrong because it relies on multiple layers of security controls (e.g., firewalls, IDS/IPS) but does not inherently require the 'never trust, always verify' principle or the assumption of an existing breach; it is a layered approach, not a trust model. Option D (Identity and Access Management - IAM) is wrong because IAM is a subset of security controls focused on managing identities and access policies (e.g., Azure AD, RBAC), not a comprehensive security model that dictates network segmentation and continuous verification of all access requests.

Full explanation →

1023

MCQmedium

An organization has Microsoft Sentinel and Microsoft Defender XDR. They want to automatically block a user's sign-in if a high-risk alert is triggered. Which Microsoft Entra feature integrates with these products to enforce access controls?

A.Conditional Access with Identity Protection integration

B.Microsoft Entra Access Reviews

C.Microsoft Entra Identity Protection

D.Microsoft Entra Privileged Identity Management

AnswerA

Conditional Access policies, when integrated with Microsoft Entra Identity Protection, can evaluate real-time sign-in risk levels detected by Identity Protection. These policies can then enforce automated actions, such as blocking access, requiring multifactor authentication, or forcing a password change, based on the configured risk thresholds. This provides a robust, automated mechanism to prevent unauthorized access attempts from risky sign-ins.

Why this answer

Conditional Access with Identity Protection integration allows organizations to create policies that automatically block sign-ins when Microsoft Sentinel or Microsoft Defender XDR triggers a high-risk alert. This integration leverages risk signals from Identity Protection to enforce real-time access controls, such as blocking authentication, without manual intervention.

Exam trap

The trap here is that candidates confuse Microsoft Entra Identity Protection (which only detects and reports risk) with Conditional Access (which enforces the actual block), leading them to select Identity Protection alone instead of the integrated Conditional Access solution.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra Access Reviews are used for periodic attestation of group memberships, application access, and role assignments, not for real-time automated blocking based on risk alerts. Option C is wrong because Microsoft Entra Identity Protection alone detects and reports risk signals (e.g., leaked credentials, anonymous IP addresses) but does not enforce access controls; it requires integration with Conditional Access to take blocking actions. Option D is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time privileged role activation and approval workflows, not automated sign-in blocking based on security alerts.

Full explanation →

1024

MCQmedium

A healthcare organization must comply with HIPAA regulations. They use Microsoft Purview to classify and label patient data. Which Microsoft Purview capability helps them enforce data protection policies automatically?

A.eDiscovery

B.Audit logs

C.Sensitivity labels

D.Data loss prevention (DLP) policies

AnswerD

Data loss prevention (DLP) policies in Microsoft Purview can automatically detect and protect sensitive data like health information.

Why this answer

Data loss prevention (DLP) policies in Microsoft Purview can automatically detect and protect sensitive data like health information. Option A is wrong because eDiscovery focuses on searching content for legal purposes, not automatic enforcement. Option B is wrong because audit logs record events but don't enforce policies.

Option C is wrong because sensitivity labels apply classification but not automatic protection actions.

Full explanation →

1025

MCQhard

Your organization is planning to deploy Microsoft Defender for Cloud Apps to discover shadow IT. You need to ensure that logs from your network proxy servers are ingested. Which method should you use to connect the logs?

A.Log collector

B.Conditional Access App Control

C.Microsoft Sentinel data connector

D.App connector API

AnswerA

For Microsoft Defender for Cloud Apps to perform Shadow IT discovery, it requires network traffic logs from an organization's firewalls and proxies. A log collector is a lightweight agent deployed on-premises, typically on a dedicated server, that securely ingests these logs, parses them, and then forwards them to Defender for Cloud Apps. This process enables the service to analyze user activity, identify sanctioned and unsanctioned cloud applications, and assess their risk.

Why this answer

Microsoft Defender for Cloud Apps uses log collectors to ingest traffic logs from network proxy servers for shadow IT discovery. The log collector is a dedicated component that parses and uploads proxy logs (e.g., from Squid, Blue Coat, or Zscaler) to Defender for Cloud Apps for analysis. This method is specifically designed for log-based discovery of unsanctioned cloud app usage.

Exam trap

A common mistake on the SC-900 exam is confusing the App connector API (which connects to sanctioned cloud apps via their APIs for activity monitoring) with the Log collector (which ingests proxy logs for shadow IT discovery). Remember: Log collector is for log-based discovery of unsanctioned apps; App connector is for API-based monitoring of already-sanctioned apps.

How to eliminate wrong answers

Option B is wrong because Conditional Access App Control is a session-level policy enforcement feature that controls access to cloud apps in real time, not a method for ingesting proxy logs. Option C is wrong because the Microsoft Sentinel data connector is used to bring Defender for Cloud Apps alerts into Sentinel for SIEM correlation, not to ingest raw proxy logs for shadow IT discovery. Option D is wrong because the App connector API connects directly to cloud app APIs (e.g., Office 365, Salesforce) to pull activity logs, not to ingest network proxy traffic logs.

Full explanation →

1026

MCQmedium

Your organization uses Microsoft Entra ID for identity management. You need to allow external partners to access a specific SharePoint Online site without requiring them to have a Microsoft Entra ID account in your tenant. Which feature should you use?

A.Use Microsoft Entra B2B collaboration to invite partners as guest users.

B.Set up identity protection to allow external access.

C.Configure Microsoft Entra B2C for the partners.

D.Create guest user accounts for each partner.

AnswerA

Microsoft Entra B2B collaboration is the specific feature designed for securely sharing applications and resources with external users from other organizations. It enables partners to use their own corporate or social identities (e.g., Microsoft accounts, Google IDs) to authenticate, rather than requiring them to create new credentials in your tenant. Upon invitation, these partners are represented as guest user objects in your Microsoft Entra ID, allowing for granular access control to specified resources.

Why this answer

Microsoft Entra B2B collaboration is the correct feature because it allows you to invite external partners as guest users who can access resources like SharePoint Online using their own identity (e.g., a Microsoft account or a corporate account from another identity provider) without requiring a separate Microsoft Entra ID account in your tenant. This leverages the B2B collaboration protocol, which uses SAML/WS-Federation or OIDC for federation, enabling seamless access while maintaining centralized access control.

Exam trap

The trap here is that candidates often confuse Microsoft Entra B2B collaboration with Microsoft Entra B2C, assuming both are for external users, but B2C is for customer-facing apps with self-service sign-up, while B2B is for granting access to business partners with existing identities.

How to eliminate wrong answers

Option B is wrong because Identity Protection is a security tool for detecting and responding to identity-based risks (e.g., compromised credentials, anomalous sign-ins) and does not provide a mechanism to grant external users access to resources. Option C is wrong because Microsoft Entra B2C is designed for customer-facing applications where users sign up and sign in with social or local accounts, not for granting external business partners access to internal resources like SharePoint Online. Option D is wrong because creating guest user accounts manually for each partner is inefficient and not a feature name; the correct feature is Microsoft Entra B2B collaboration, which automates the invitation and lifecycle management of guest users.

Full explanation →

1027

MCQeasy

A user is unable to access a cloud app and receives a message that their sign-in was blocked by a Conditional Access policy. The admin wants to allow the user to self-remediate by meeting policy requirements. What should the admin enable?

A.Self-Service Password Reset

B.Multifactor Authentication registration

C.Identity Protection risk policies

D.Conditional Access policy feedback

AnswerD

Conditional Access policies evaluate various signals, including user, device, location, application, and real-time risk, to make granular access decisions. When a user is blocked from accessing a cloud application due to a Conditional Access policy, the system is designed to provide direct, actionable feedback. This feedback explicitly informs the user *why* access was denied (e.g., 'Your device is not compliant') and often includes clear steps or links to remediate the issue, enabling them to meet the policy requirements and gain access.

Why this answer

Enabling Conditional Access policy feedback allows users to receive guidance on why their sign-in was blocked and how to meet the policy requirements, such as using a compliant device or accessing from a trusted location. This feature provides actionable messages that enable self-remediation without admin intervention, directly addressing the scenario where the user needs to unblock themselves by satisfying the policy conditions.

Exam trap

The trap here is that candidates often confuse 'Conditional Access policy feedback' with other self-service features like SSPR or MFA registration, but the question specifically asks for the mechanism that provides users with actionable guidance on why they were blocked and how to meet the policy requirements, which is unique to policy feedback.

How to eliminate wrong answers

Option A is wrong because Self-Service Password Reset (SSPR) allows users to reset their own passwords, but it does not address Conditional Access policy blocks that are unrelated to password issues, such as device compliance or location requirements. Option B is wrong because Multifactor Authentication (MFA) registration enables users to set up MFA, but the sign-in was blocked by a Conditional Access policy that may require additional conditions (e.g., compliant device, trusted IP) beyond MFA; enabling MFA registration alone does not guarantee the user can meet all policy requirements. Option C is wrong because Identity Protection risk policies are a separate feature that detects and responds to risky sign-ins (e.g., leaked credentials), but they do not provide the user with specific feedback on why a Conditional Access policy blocked them or how to self-remediate; risk policies automatically block or require MFA based on risk level, not user-driven feedback.

Full explanation →

1028

MCQmedium

Refer to the exhibit. A security administrator is reviewing an Azure Resource Manager template for a virtual machine. What is the purpose of the 'identity' section shown?

A.It enables system-assigned managed identity for the VM.

B.It configures multi-factor authentication for the VM.

C.It creates a new managed identity named 'id1' in the resource group.

D.It assigns a user-assigned managed identity to the VM so it can access other Azure resources securely.

AnswerD

The identity section with 'type': 'UserAssigned' and a reference to an existing managed identity enables the VM to use that user-assigned managed identity to access Azure resources securely.

Why this answer

The 'identity' section in this Azure Resource Manager template assigns a user-assigned managed identity to the virtual machine. The 'type' is set to 'UserAssigned' and the 'userAssignedIdentities' property references an existing managed identity by its resource ID. This allows the VM to authenticate to Azure services without storing credentials, using the specified identity.

Option D is correct because it accurately describes this behavior.

Full explanation →

1029

Multi-Selectmedium

Your company uses Microsoft Defender for Endpoint. You need to configure attack surface reduction (ASR) rules. Which TWO of the following are ASR rules?

Select 2 answers

A.Block executable content from email client and webmail

B.Allow only signed executables

C.Block inbound connections from the internet

D.Block untrusted fonts

E.Block Office applications from creating child processes

AnswersA, E

This is a correct answer because "Block executable content from email client and webmail" is a specific Attack Surface Reduction (ASR) rule designed to prevent malware from being launched directly from email applications or webmail services. This rule targets common infection vectors by blocking the execution of files like .exe, .dll, or .js that originate from email clients (e.g., Outlook) or popular web browsers when accessing webmail. It helps mitigate phishing and drive-by download attacks by restricting the initial execution phase.

Why this answer

ASR rules are designed to block common attack vectors by controlling specific behaviors. 'Block executable content from email client and webmail' prevents malicious scripts or executables from running when delivered via email, which is a primary infection vector. Option E is correct because 'Block Office applications from creating child processes' stops attackers from using Office apps (like Word or Excel) to spawn malicious processes (e.g., PowerShell or cmd.exe), a classic technique for code execution.

Exam trap

The trap here is that candidates confuse ASR rules with other Windows security features like AppLocker, Windows Firewall, or Exploit Guard, leading them to select options that are valid security controls but not specifically ASR rules.

Full explanation →

1030

MCQmedium

Your company is using Microsoft Entra ID to manage identities. You want to allow users to reset their own passwords without help desk intervention, but only if they have registered for self-service password reset (SSPR). What should you configure?

A.Require all users to register for Microsoft Entra MFA.

B.Configure Microsoft Entra password protection.

C.Implement Privileged Identity Management (PIM).

D.Enable Self-Service Password Reset (SSPR) in Microsoft Entra ID.

AnswerD

Enabling Self-Service Password Reset (SSPR) in Microsoft Entra ID is the direct and correct solution for allowing users to reset their own forgotten passwords without requiring administrator assistance. Once SSPR is configured and users have successfully registered their chosen authentication methods (e.g., mobile app, phone, email), they can independently verify their identity and set a new password, significantly improving user experience and reducing help desk workload.

Why this answer

Enabling Self-Service Password Reset (SSPR) in Microsoft Entra ID allows users to reset their own passwords without help desk intervention, provided they have registered for the feature. This directly meets the requirement of allowing password resets only for registered users, as SSPR requires prior registration to verify identity before a reset is permitted.

Exam trap

The trap here is that candidates often confuse enabling SSPR with requiring MFA registration, but MFA registration alone does not grant password reset capabilities—SSPR must be explicitly enabled and configured.

How to eliminate wrong answers

Option A is wrong because requiring all users to register for Microsoft Entra MFA is a separate security feature that adds multi-factor authentication but does not enable password reset functionality; MFA can be used as part of SSPR registration but is not sufficient alone. Option B is wrong because Microsoft Entra password protection is a feature that blocks weak passwords and common password attacks, but it does not provide self-service password reset capabilities. Option C is wrong because Privileged Identity Management (PIM) is designed for managing, controlling, and monitoring access to privileged roles, not for enabling end-user password self-service.

Full explanation →

1031

MCQeasy

You are reviewing a conditional access policy in Microsoft Entra ID. The policy is enabled, applies to all cloud apps, and is configured to include users assigned to the Global Administrator or Exchange Administrator roles. Which users are affected by this policy?

A.All users who are members of any Azure AD administrative role

B.All users who are members of the Global Administrator role only

C.All users who are members of the Global Administrator or Exchange Administrator role

D.All users in the organization

AnswerC

Correct. The policy includes these two roles specifically.

Why this answer

The conditional access policy specifies 'includeRoles' with the Global Administrator and Exchange Administrator roles, meaning only users assigned to either of those roles are affected. Option A is incorrect because the policy does not apply to all administrative roles, only the two specified. Option B is incorrect because it applies to both Global Administrator and Exchange Administrator, not just Global Administrator.

Option D is incorrect because the policy does not apply to all users in the organization.

Full explanation →

1032

MCQmedium

You are an identity consultant for a mid-sized company with 5,000 employees. They use Microsoft Entra ID P1 and Microsoft Intune for device management. The company wants to implement passwordless authentication for all employees to improve security and user experience. Currently, users sign in with username and password plus MFA via the Microsoft Authenticator app. The company has a mix of Windows 10/11 devices (both domain-joined and Microsoft Entra joined) and iOS/Android mobile devices. They want to support passwordless sign-in on all platforms. The CTO is concerned about cost and wants to minimize additional licensing. Which passwordless method should you recommend?

A.Enable Windows Hello for Business for all devices

B.Deploy FIDO2 security keys to all employees

C.Implement SMS-based one-time passcodes

D.Use the Microsoft Authenticator app for passwordless sign-in

AnswerD

The Microsoft Authenticator app offers a highly effective and cost-efficient solution for passwordless sign-in across a wide range of devices, including iOS, Android, and Windows. It leverages existing smartphone hardware to provide a secure, push-notification-based or number-matching authentication method, eliminating the need for users to type a password. This approach minimizes additional hardware costs, simplifies deployment, and enhances user convenience and security by removing the weakest link in traditional authentication.

Why this answer

The Microsoft Authenticator app supports passwordless sign-in using phone-based authentication, which works on both iOS and Android devices and can be used to sign into Windows 10/11 devices via the 'Sign in with phone' feature. This method leverages existing Microsoft Entra ID P1 licensing without requiring additional costs, as it is included with the current P1 license. It provides a seamless user experience by eliminating the need for hardware tokens or additional infrastructure, aligning with the CTO's cost-minimization goal.

Exam trap

The trap here is that candidates often assume Windows Hello for Business is the only Microsoft passwordless solution for Windows devices, overlooking that the Microsoft Authenticator app can provide passwordless sign-in across all platforms (Windows, iOS, Android) without additional licensing or hardware costs.

How to eliminate wrong answers

Option A is wrong because Windows Hello for Business requires either a domain-joined device with on-premises Active Directory or a Microsoft Entra joined device, and it does not support iOS/Android mobile devices, so it cannot cover all platforms as required. Option B is wrong because deploying FIDO2 security keys to 5,000 employees would incur significant hardware procurement and management costs, contradicting the CTO's directive to minimize additional licensing and expenses. Option C is wrong because SMS-based one-time passcodes are not a passwordless method; they still require a password as the primary authentication factor and are considered a form of MFA, not passwordless authentication.

Full explanation →

1033

MCQeasy

A healthcare organization uses digital signatures on electronic medical records to ensure that the records have not been tampered with during transmission. Which security goal is primarily being addressed by this practice?

A.Confidentiality

B.Integrity

C.Availability

D.Non-repudiation

AnswerB

Integrity ensures data has not been altered by unauthorized parties. Digital signatures provide a mechanism to detect any changes, thus preserving integrity.

Why this answer

Digital signatures use asymmetric cryptography (e.g., RSA or ECDSA) to create a hash of the electronic medical record, which is then encrypted with the signer's private key. Any tampering with the record during transmission will cause the hash verification to fail, directly ensuring data integrity. This practice does not primarily address confidentiality (which requires encryption) or availability (which focuses on uptime).

Exam trap

The trap here is that candidates often confuse integrity with non-repudiation, but the question's focus on 'tampered with during transmission' directly points to integrity, not the ability to prove who signed it.

How to eliminate wrong answers

Option A is wrong because confidentiality is about preventing unauthorized access to data, typically achieved through encryption (e.g., AES or TLS), not through digital signatures which do not hide the content. Option C is wrong because availability ensures that systems and data are accessible when needed, often via redundancy or disaster recovery, and digital signatures do not contribute to uptime. Option D is wrong because non-repudiation prevents the signer from denying their action, which is a secondary benefit of digital signatures, but the question specifically asks about tamper detection during transmission, which is the core integrity goal.

Full explanation →

1034

Multi-Selectmedium

Which TWO components are part of the 'Zero Trust' security model? (Choose two.)

Select 2 answers

A.Least privilege

B.VPN access

C.Password complexity

D.Verify explicitly

E.Perimeter-based security

AnswersA, D

Limit access to only what is needed.

Why this answer

Correct answers are A and D: Least privilege ensures users have only the minimum access needed, and Verify explicitly assumes every access request is a potential threat. Option B (VPN access) is a network access method, not a Zero Trust principle. Option C (password complexity) is a security control but not a core component of the Zero Trust model.

Option E (perimeter-based security) is the traditional model that Zero Trust replaces.

Full explanation →

1035

MCQmedium

A company uses Microsoft Defender for Cloud to secure their multi-cloud environment, which includes Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). They want a unified view of security posture, continuous assessment of resources, and recommendations to improve security across all clouds. Which feature of Defender for Cloud provides this capability?

A.Cloud Security Posture Management (CSPM)

B.Cloud Workload Protection (CWP)

C.Microsoft Secure Score

D.Regulatory Compliance Dashboard

AnswerA

CSPM provides posture management, secure score, and recommendations across multi-cloud environments, meeting all requirements.

Why this answer

Cloud Security Posture Management (CSPM) is the correct feature because it provides a unified, multi-cloud view of security posture, continuously assesses resources against security benchmarks (e.g., CIS, NIST), and generates actionable recommendations to harden configurations across Azure, AWS, and GCP. This directly matches the scenario's requirement for a single pane of glass for posture management and improvement across all three clouds.

Exam trap

The trap here is that candidates confuse Cloud Security Posture Management (CSPM) with Cloud Workload Protection (CWP), mistakenly thinking that workload protection includes posture assessment, when in fact CSPM is the dedicated feature for multi-cloud posture visibility and recommendations.

How to eliminate wrong answers

Option B (Cloud Workload Protection, CWP) is wrong because CWP focuses on threat detection and advanced defenses for workloads (e.g., just-in-time VM access, file integrity monitoring), not on providing a unified posture view or continuous assessment of resource configurations. Option C (Microsoft Secure Score) is wrong because Secure Score is a metric that quantifies an organization's security posture based on Defender for Cloud recommendations, but it is not the feature that performs the continuous assessment or generates the recommendations itself. Option D (Regulatory Compliance Dashboard) is wrong because this dashboard tracks compliance against specific standards (e.g., SOC 2, PCI DSS) using built-in assessments, but it does not provide the general, unified posture view and continuous assessment of all resources across multi-cloud environments.

Full explanation →

1036

MCQmedium

A company is migrating its on-premises workloads to Azure. The CISO wants to understand the division of security responsibilities between Microsoft and the customer across cloud service models. For which cloud service model does the customer have the most security responsibility?

A.Software as a Service (SaaS)

B.Platform as a Service (PaaS)

C.Infrastructure as a Service (IaaS)

D.On-premises

AnswerC

Infrastructure as a Service (IaaS) is the correct choice for migrating existing on-premises workloads to Azure because it provides the most control over the underlying operating systems, applications, and data, closely mirroring an on-premises environment. In IaaS, the customer is responsible for securing the operating system, applications, network configuration, and data, while Azure manages the physical infrastructure, virtualization, and networking fabric. This model facilitates a "lift-and-shift" approach, allowing the CISO to maintain significant security responsibility and control over their familiar stack within the cloud.

Why this answer

In the Infrastructure as a Service (IaaS) model, the customer is responsible for securing the operating system, applications, data, and network configurations, while Microsoft only secures the physical datacenter, host servers, and hypervisor. This gives the customer the most security responsibility compared to PaaS or SaaS, where Microsoft manages more of the stack.

Exam trap

The trap here is that candidates often confuse 'most responsibility' with 'most control' and incorrectly pick on-premises (Option D), forgetting that the question explicitly asks about cloud service models, where IaaS gives the customer the greatest security responsibility among the cloud options.

Why the other options are wrong

In SaaS, the customer has the least security responsibility because Microsoft manages the entire stack, including applications, data, and infrastructure. The question asks for the model with the most customer responsibility, which is IaaS.

In PaaS, the customer manages applications and data, while Microsoft handles the runtime, middleware, OS, and infrastructure. This gives the customer less security responsibility than IaaS, where they manage everything from the OS upward.

When would these options actually be correct?

A question asks: 'For which cloud service model does the customer have the least security responsibility?' or 'Which model shifts the most security responsibility to the cloud provider?'

A question asks: 'For which cloud service model does the customer have the most control over the application runtime environment without managing the underlying OS?' In that context, PaaS would be correct because it provides a platform for deploying apps while abstracting OS and infrastructure management.

Why candidates pick the wrong answer

Candidates may mistakenly think SaaS requires significant customer security effort due to data protection and access control, overlooking that the provider secures the underlying platform and application.

Candidates may confuse 'most responsibility' with 'most control over applications,' thinking PaaS gives them more security duties than IaaS because they still manage the app layer, but they overlook that IaaS requires managing the OS, network, and storage as well.

Full explanation →

1037

MCQhard

A security analyst runs the above KQL query in Microsoft Sentinel. What is the primary purpose of this query?

A.Correlate MFA failures with other security events

B.Identify all users who had an MFA failure anomaly in the last 7 days

C.Identify users who have been blocked due to MFA failures

D.Identify users with more than 5 MFA failure anomalies in the last 7 days

AnswerD

The query correctly filters `SecurityAlert` records generated within the last 7 days for MFA failure anomalies. It then groups these anomalies by user and calculates the total count for each user. The subsequent `where AlertCount > 5` clause precisely isolates and presents only those users whose aggregated count of MFA failure anomalies exceeds five, directly matching the objective described in this option.

Why this answer

The KQL query uses `summarize` with `count()` on MFA failure anomalies, then filters with `where count_ > 5` and `where TimeGenerated > ago(7d)`. This explicitly returns only users whose anomaly count exceeds 5 in the last 7 days, making option D correct. The query does not correlate with other events, list all users with any anomaly, or check block status.

Exam trap

The trap here is that candidates see 'MFA failure anomalies' and 'last 7 days' and assume the query returns all users with any anomaly (option B), missing the critical `where count_ > 5` threshold filter that narrows the result to only high-frequency failures.

How to eliminate wrong answers

Option A is wrong because the query only filters on a single table (presumably `SigninLogs` with MFA failure anomalies) and does not use `join` or `union` to correlate with other security event tables. Option B is wrong because the query includes a `where count_ > 5` filter, so it does not identify all users with any MFA failure anomaly—only those exceeding the threshold. Option C is wrong because the query does not reference any column indicating a blocked status (e.g., `Status` or `Blocked`), nor does it use `where ResultType` values like `500121` (MFA blocked); it only counts anomaly occurrences.

Full explanation →

1038

MCQhard

Your organization implements a Microsoft Entra ID tenant with a custom domain (contoso.com). You need to ensure that all users are assigned a unique user principal name (UPN) based on their email address. What should you do?

A.Configure the user naming attribute to use the email address as the UPN

B.Verify the custom domain in Microsoft Entra ID

C.Enable Microsoft Entra ID Domain Services

D.Use Microsoft Entra ID Connect to sync UPNs from on-premises

AnswerA

Setting the UPN to email ensures each user has a unique UPN based on email.

Why this answer

To ensure users are assigned a UPN based on their email address in Microsoft Entra ID, administrators must manually set the UPN during user creation or modification. For new users, this involves entering the desired email address (or its prefix) as the 'User name' and selecting the appropriate custom domain suffix. For existing users, their UPNs can be updated in bulk using PowerShell or the Microsoft Entra admin center's bulk operations feature to match their email addresses.

While there isn't a single 'user naming attribute' setting that automates this process globally, the action of configuring the UPN for each user to match their email address is the necessary step.

Exam trap

The trap here is that candidates often confuse verifying a custom domain (Option B) with automatically assigning UPNs based on email addresses, but verification alone does not change how UPNs are generated; it only enables the domain to be used as a suffix.

How to eliminate wrong answers

Option B is wrong because verifying the custom domain in Microsoft Entra ID is a prerequisite for using that domain in UPNs, but it does not automatically assign UPNs based on email addresses; it only confirms domain ownership. Option C is wrong because enabling Microsoft Entra ID Domain Services provides managed domain services (e.g., LDAP, Kerberos) for legacy applications, but it does not affect UPN assignment for users. Option D is wrong because using Microsoft Entra ID Connect to sync UPNs from on-premises would only work if the on-premises UPNs already match email addresses; it does not configure the cloud tenant to automatically assign UPNs based on email addresses for cloud-only users.

Full explanation →

1039

MCQmedium

A security operations center (SOC) team needs a centralized platform to collect logs from firewalls, servers, and cloud applications. They want to analyze these logs to detect threats, create custom alerts, and automate response actions using playbooks. The solution should also provide threat intelligence feeds and allow for advanced hunting with Kusto Query Language (KQL). Which Microsoft security solution should the team implement?

A.Microsoft Defender for Cloud

B.Microsoft Sentinel

C.Microsoft Defender for Endpoint

D.Microsoft Purview Compliance Manager

AnswerB

Correct. Sentinel is the intended SIEM/SOAR solution for centralized log collection, threat detection, automation, and hunting with KQL.

Why this answer

Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution. It provides a centralized platform for collecting logs from diverse sources (firewalls, servers, cloud apps), enables custom alert creation, automates response via playbooks (Azure Logic Apps), integrates threat intelligence feeds, and supports advanced hunting using Kusto Query Language (KQL).

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM/CWPP tool) with a full SIEM/SOAR solution, overlooking that Sentinel is the dedicated platform for centralized log collection, custom alerts, playbook automation, and KQL-based hunting.

Why the other options are wrong

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP), not a centralized SIEM/SOAR solution. It does not provide native log collection from diverse sources, custom alert creation, playbook automation, or KQL-based advanced hunting.

Microsoft Defender for Endpoint focuses on endpoint protection and detection, not centralized log collection from firewalls, servers, and cloud apps, nor does it provide playbook automation or KQL-based advanced hunting across multiple data sources.

Microsoft Purview Compliance Manager focuses on compliance posture management and assessment, not on centralized log collection, threat detection, custom alerts, or automated response playbooks.

When would these options actually be correct?

A team needs to assess and improve the security posture of their Azure, hybrid, and multi-cloud workloads, with recommendations for hardening and threat protection. They require a unified view of security configurations and compliance across cloud environments.

A question asking for a solution to protect endpoints (e.g., detect malware on laptops and servers) with EDR capabilities, and optionally integrate with Microsoft 365 Defender, would make Defender for Endpoint correct.

A question asking for a solution to assess compliance against regulatory standards (e.g., ISO 27001, NIST) and manage compliance scores across cloud and on-premises environments would make Purview Compliance Manager the correct answer.

Why candidates pick the wrong answer

Candidates may confuse Defender for Cloud's security monitoring and alerting capabilities with a full SIEM, or assume it can centralize logs from various sources because it integrates with Azure services.

Candidates may confuse Microsoft Sentinel's SIEM capabilities with Defender for Endpoint's security features, or think 'Defender' products all cover centralized log analysis and automation.

Candidates may confuse compliance and security monitoring, thinking a compliance tool can also handle threat detection and response, or they may misremember Purview's capabilities as broader than they are.

Full explanation →

1040

MCQmedium

Your organization uses Microsoft Copilot for Security. You want to use natural language to generate a KQL query for threat hunting. What should you do?

A.Manually write the KQL query in the advanced hunting page.

B.Use the Copilot prompt bar in the Microsoft Defender portal.

C.Install the Copilot add-in for Sentinel.

D.Subscribe to Microsoft 365 Copilot.

AnswerB

Utilizing the Copilot prompt bar within the Microsoft Defender portal is the correct and intended method for leveraging Microsoft Copilot for Security to generate KQL queries. This integrated interface allows security analysts to input natural language descriptions of their threat hunting or investigation needs. Copilot then processes these prompts, translating them into accurate KQL queries that can be immediately executed in Advanced Hunting, significantly streamlining security operations and enhancing analyst productivity.

Why this answer

Microsoft Copilot for Security is integrated directly into the Microsoft Defender portal, allowing security analysts to use natural language prompts to generate KQL queries for threat hunting. The Copilot prompt bar interprets the natural language input and converts it into the appropriate KQL syntax, eliminating the need for manual query writing.

Exam trap

The trap here is that candidates may confuse Microsoft Copilot for Security with Microsoft 365 Copilot, assuming any 'Copilot' subscription will generate KQL queries, when in fact only the security-specific Copilot integrated into the Defender portal provides this capability.

How to eliminate wrong answers

Option A is wrong because manually writing KQL queries in the advanced hunting page does not leverage Copilot's natural language capabilities; it requires the user to already know KQL syntax. Option C is wrong because there is no 'Copilot add-in for Sentinel' — Microsoft Copilot for Security is a standalone service or integrated into the Defender portal, not an add-in for Azure Sentinel. Option D is wrong because subscribing to Microsoft 365 Copilot provides AI assistance for productivity apps like Word and Excel, not for security-specific tasks like generating KQL queries for threat hunting.

Full explanation →

1041

MCQmedium

You work for a law firm that uses Microsoft 365 E5. The firm handles highly confidential client information and must comply with attorney-client privilege. You need to implement a compliance solution that: - Prevents unauthorized sharing of privileged documents via email. - Enables lawyers to easily classify documents as 'Privileged' and automatically encrypt them. - Allows the compliance team to monitor for accidental exposure of privileged information in Teams chats. - Ensures that privileged documents are retained for 7 years after case closure, then automatically deleted. - Provides the ability to search for privileged documents in case of a legal hold. What should you configure?

A.Sensitivity labels with encryption, DLP, Communication Compliance, Data Lifecycle Management, and eDiscovery

B.DLP, Communication Compliance, Data Lifecycle Management, and Audit (Standard)

C.Insider Risk Management, DLP, Data Lifecycle Management, and eDiscovery

D.Sensitivity labels, Information Barriers, Data Lifecycle Management, and eDiscovery

AnswerA

All requirements are covered: classification, encryption, DLP, monitoring, retention, and eDiscovery.

Why this answer

It combines all required capabilities: Sensitivity labels with encryption allow lawyers to classify documents as 'Privileged' and automatically encrypt them; DLP prevents unauthorized sharing of privileged documents via email; Communication Compliance monitors Teams chats for accidental exposure; Data Lifecycle Management retains privileged documents for 7 years after case closure and then automatically deletes them; eDiscovery provides the ability to search for privileged documents in case of a legal hold. Option B is incorrect because it lacks Sensitivity labels (needed for classification and encryption) and includes Audit (Standard) which does not provide the retention or search capabilities of Data Lifecycle Management and eDiscovery. Option C is incorrect because Insider Risk Management focuses on detecting risky user activities but does not enable lawyers to classify or encrypt documents, and it is not designed for monitoring Teams chats for privilege exposure; Communication Compliance is needed for that.

Option D is incorrect because Information Barriers restrict communication between specific groups to prevent information sharing, but does not monitor for accidental exposure in Teams; Communication Compliance is required for that monitoring.

Full explanation →

1042

MCQmedium

A company uses Microsoft Entra ID. The IT department wants to automatically assign a Microsoft 365 E5 license to all users in the Sales department based on their department attribute. Which Microsoft Entra ID feature should they use?

A.Dynamic Groups

B.Administrative Units

C.Identity Protection

D.Access Reviews

AnswerA

Microsoft Entra ID dynamic groups automatically manage membership based on defined attribute-based rules, such as a user's department or job title. When a user's attributes change, they are automatically added to or removed from the group, ensuring accurate membership. This capability is crucial for automating license assignment through group-based licensing, as licenses are then automatically provisioned or de-provisioned as users join or leave these dynamic groups.

Why this answer

Dynamic Groups in Microsoft Entra ID allow automatic user membership based on user attributes, such as the department attribute. By creating a dynamic group rule like `user.department -eq "Sales"`, the system automatically assigns the group membership and can then apply a Microsoft 365 E5 license via group-based licensing.

Exam trap

The trap here is that candidates may confuse Administrative Units with Dynamic Groups, thinking that delegating admin control over a department also handles license assignment, but Administrative Units only manage administrative boundaries, not automated provisioning.

Why the other options are wrong

Administrative Units are used to delegate administrative permissions over subsets of users, groups, or devices, not to automatically assign licenses based on attributes like department.

Identity Protection is a feature for detecting and responding to identity-based risks, not for automating license assignments based on user attributes.

Access Reviews are used to review and certify user access rights periodically, not to automatically assign licenses based on attributes.

When would these options actually be correct?

A question asks: 'You need to delegate management of users in the Sales department to a junior admin, without giving them access to other departments. Which feature should you use?'

An organization wants to automatically detect and block sign-ins from anonymous IP addresses or compromised credentials. Identity Protection would be the correct feature to configure risk-based conditional access policies.

A company needs to periodically verify that only Sales department users have access to a sensitive application. Access Reviews would be the correct feature to create a review campaign for that group.

Why candidates pick the wrong answer

Candidates may confuse Administrative Units with groups, thinking they can be used for license assignment or attribute-based membership, but they are solely for administrative scoping.

Candidates may confuse Identity Protection with identity governance features, assuming it can manage user attributes or group memberships, due to the broad term 'identity' in its name.

Candidates may confuse the concept of managing access (Access Reviews) with assigning licenses, as both involve user permissions and Entra ID features.

Full explanation →

1043

MCQmedium

A company uses Microsoft Defender for Cloud to secure their Azure environment. The security team needs to check whether their resources comply with the CIS (Center for Internet Security) benchmark. How can they view their compliance status against CIS in Defender for Cloud?

A.Use the secure score recommendations and look for CIS-related controls

B.Use the Regulatory Compliance dashboard and add the CIS standard as a compliance initiative

C.Use Azure Policy initiative assignments directly from the Policy service

D.Use the vulnerability assessment solution for machines to check CIS settings

AnswerB

The Regulatory Compliance dashboard in Microsoft Defender for Cloud is specifically designed to assess and report on your organization's adherence to various industry standards and regulatory benchmarks. By adding the CIS standard as a compliance initiative, Defender for Cloud automatically maps relevant security recommendations and assessments to the specific controls within that standard, providing a consolidated view of your compliance posture. This direct integration enables comprehensive tracking and reporting against the chosen benchmark.

Why this answer

The Regulatory Compliance dashboard in Microsoft Defender for Cloud allows you to add built-in compliance standards like CIS as an initiative. Once added, the dashboard continuously assesses your Azure resources against the CIS benchmark controls and displays pass/fail status. This is the correct method because Defender for Cloud integrates with Azure Policy to evaluate compliance against regulatory standards.

Exam trap

The trap here is that candidates confuse secure score recommendations with regulatory compliance assessments, assuming that secure score covers all compliance standards, when in fact secure score is a separate metric based on security controls, not specific regulatory frameworks like CIS.

How to eliminate wrong answers

Option A is wrong because secure score recommendations are based on security best practices and built-in controls, not specific regulatory standards like CIS; they do not directly map to CIS benchmarks. Option C is wrong because Azure Policy initiative assignments from the Policy service can define compliance rules, but viewing the compliance status against CIS specifically requires the Regulatory Compliance dashboard in Defender for Cloud, which provides a pre-built view with continuous assessment and reporting. Option D is wrong because the vulnerability assessment solution for machines (e.g., Qualys or Microsoft Defender Vulnerability Management) checks for OS-level vulnerabilities and missing patches, not compliance with CIS benchmark settings across all resource types.

Full explanation →

1044

MCQmedium

Your organization is deploying Microsoft Defender XDR to detect and respond to advanced threats. You need to ensure that security alerts from Microsoft Defender for Endpoint are automatically correlated with alerts from Microsoft Defender for Office 365. What should you configure?

A.Ensure that all Microsoft Defender services are onboarded to the same tenant and that the incidents feature is enabled

B.Configure a custom detection rule in Microsoft 365 Defender

C.Create an advanced hunting query to join alerts from different data sources

D.Enable Microsoft Sentinel and configure incident creation rules

AnswerA

Microsoft Defender XDR's core strength lies in its ability to automatically correlate alerts from various Defender services into unified incidents. This powerful cross-domain correlation engine requires all constituent Defender services (e.g., Defender for Endpoint, Office 365, Identity) to be onboarded within the *same* Azure Active Directory tenant. The incidents feature, which drives this correlation, is enabled by default, ensuring a holistic view of attacks and significantly reducing alert fatigue for security operations teams.

Why this answer

Microsoft Defender XDR automatically correlates alerts from different Microsoft Defender services (e.g., Defender for Endpoint and Defender for Office 365) when they are onboarded to the same tenant and the incidents feature is enabled. This built-in correlation uses the Microsoft 365 Defender backend to fuse related alerts into a single incident, providing a unified view of the attack chain without additional configuration.

Exam trap

The trap here is that candidates may think additional tools like Sentinel or custom rules are needed for correlation, but Microsoft Defender XDR provides automatic cross-service correlation by default when all services are in the same tenant and incidents are enabled.

How to eliminate wrong answers

Option B is wrong because custom detection rules in Microsoft 365 Defender are used to create custom alerts based on advanced hunting queries, not to automatically correlate existing alerts from different services. Option C is wrong because advanced hunting queries are for manually searching and analyzing raw data across tables, not for enabling automatic correlation of alerts into incidents. Option D is wrong because Microsoft Sentinel is a separate SIEM solution that requires additional licensing and configuration; it is not required for native correlation within Microsoft Defender XDR, which handles this automatically when services are in the same tenant.

Full explanation →

1045

MCQeasy

A company wants to allow employees to use their corporate Microsoft Entra ID credentials to sign in to third-party SaaS applications like Salesforce and ServiceNow. Which feature provides this capability?

A.Microsoft Entra federation with SaaS applications

B.Microsoft Entra B2B collaboration

C.Microsoft Entra Identity Protection

D.Microsoft Entra Privileged Identity Management

AnswerA

Microsoft Entra federation with SaaS applications is the correct solution because it enables employees to use their existing corporate Microsoft Entra ID credentials for single sign-on (SSO) to third-party Software as a Service (SaaS) applications. This process involves configuring Microsoft Entra ID as the identity provider, allowing it to authenticate users and securely pass identity assertions (e.g., via SAML or OIDC) to the SaaS application, eliminating the need for separate usernames and passwords. This enhances user experience, improves security posture, and centralizes identity management.

Why this answer

Microsoft Entra federation with SaaS applications (Option A) enables single sign-on (SSO) by establishing a trust relationship between Microsoft Entra ID and third-party SaaS apps like Salesforce and ServiceNow. This allows users to authenticate using their corporate Entra ID credentials via federation protocols such as SAML 2.0 or OpenID Connect, eliminating the need for separate credentials.

Exam trap

The trap here is that candidates often confuse B2B collaboration (external user access) with federation (corporate user SSO to external apps), leading them to select Option B instead of A.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra B2B collaboration is designed for inviting external users (e.g., partners or vendors) to access your organization's resources, not for enabling corporate users to sign in to third-party SaaS apps. Option C is wrong because Microsoft Entra Identity Protection is a security tool that detects and responds to identity-based risks (e.g., leaked credentials or anomalous sign-ins), not a feature for federated authentication. Option D is wrong because Microsoft Entra Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles within Azure AD and Azure resources, not for federating with external SaaS applications.

Full explanation →

1046

Multi-Selecthard

Which THREE capabilities are included in Microsoft Purview Audit (Premium)?

Select 3 answers

A.Trainable classifiers

B.Access to high-value critical events

C.Custom alert policies

D.Higher bandwidth for API access

E.Longer retention of audit logs (up to 1 year)

AnswersB, D, E

Audit (Premium) logs high-value events like admin actions.

Why this answer

Microsoft Purview Audit (Premium) provides access to high-value critical events, such as when mailbox items are accessed or when administrative actions are performed on sensitive data. These events are not logged in Audit (Standard) and require Premium licensing to capture, enabling deeper forensic investigation.

Exam trap

The trap here is that candidates confuse trainable classifiers or custom alert policies as audit-specific features, when in fact they belong to other compliance solutions like Information Protection or Defender, not Audit (Premium).

Full explanation →

1047

MCQeasy

Your organization uses Microsoft Purview eDiscovery to manage legal holds. A legal hold has been placed on a user’s mailbox, but the user has left the company and their mailbox has been converted to a shared mailbox. You need to ensure that the legal hold remains effective. What should you do?

A.Convert the shared mailbox back to a user mailbox to keep the hold.

B.Create a new legal hold for the shared mailbox.

C.Verify that the legal hold is still listed in the eDiscovery case for the mailbox.

D.Remove the legal hold and reapply it to the shared mailbox.

AnswerC

The hold persists after conversion.

Why this answer

When a mailbox is converted to a shared mailbox, the legal hold applied via eDiscovery remains in effect and does not need to be recreated. It is important to verify that the hold is still listed in the eDiscovery case. Option A is incorrect because converting back is unnecessary and may lose shared mailbox features.

Option B is incorrect because the hold is still active; creating a new hold is redundant. Option D is incorrect because removing and reapplying the hold is not required.

Full explanation →

1048

MCQhard

Refer to the exhibit. A security analyst is reviewing a Microsoft Defender XDR alert. Which two tactics identified are most relevant? (This is a multiple-choice question asking which two tactics are shown, but the format is single answer. We need to adjust: The question asks: 'Which two tactics are identified?' The correct answer is the option listing both 'InitialAccess and LateralMovement'.)

A.LateralMovement and PrivilegeEscalation

B.LateralMovement and Exfiltration

C.InitialAccess and Persistence

D.InitialAccess and LateralMovement

AnswerD

This option is correct because the security alert explicitly details activities consistent with both the Initial Access and Lateral Movement tactics. Initial Access refers to the methods adversaries use to gain their first foothold in a network, such as through phishing or exploiting a public-facing application. Lateral Movement then describes the techniques used to navigate and expand control within the compromised environment, often involving remote services or internal spearphishing, directly aligning with the observed alert indicators.

Why this answer

The exhibit shows a Microsoft Defender XDR alert indicating that an attacker gained initial access (e.g., via a phishing link or compromised credential) and then moved laterally within the network (e.g., using remote desktop or SMB). These two stages correspond directly to the InitialAccess and LateralMovement tactics in the MITRE ATT&CK framework, which are the most relevant based on the alert details.

Exam trap

The trap here is that candidates may confuse LateralMovement with PrivilegeEscalation or Exfiltration, but the alert's focus on moving between systems (not escalating privileges or stealing data) clearly points to InitialAccess and LateralMovement as the two most relevant tactics.

How to eliminate wrong answers

Option A is wrong because PrivilegeEscalation is not indicated in the alert; the focus is on initial entry and lateral spread, not gaining higher permissions. Option B is wrong because Exfiltration involves data theft, which is not shown in the alert; the described activity is about moving between hosts, not sending data out. Option C is wrong because Persistence involves maintaining access (e.g., via scheduled tasks or registry modifications), which is not the primary tactic shown; the alert highlights the initial breach and subsequent lateral movement.

Full explanation →

1049

MCQeasy

You run the PowerShell command shown in the exhibit. What is the purpose of this command?

A.Applies a sensitivity label to a document

B.Encrypts a document using Azure Information Protection

C.Removes a sensitivity label from a document

D.Exports audit logs for labeled documents

AnswerA

Correct. The PowerShell command assigns a sensitivity label to the document.

Why this answer

The command assigns a sensitivity label to a document. Option B is wrong because the command does not encrypt the document; labeling may include encryption, but the cmdlet itself only assigns the label. Option C is wrong because it does not remove a label; the command applies a label.

Option D is wrong because it does not export audit logs.

Exam trap

Candidates often confuse applying a sensitivity label with encryption. The Set-AIPFileLabel cmdlet applies a label, which may or may not include encryption depending on the label configuration.

Full explanation →

1050

MCQmedium

Your organization uses Microsoft Defender for Office 365. A user reports receiving a suspicious email that appears to be from their CEO asking for a wire transfer. The email passed through the spam filter. What additional protection should be enabled to detect such attacks?

A.Safe Attachments policy

B.Anti-spam policy

C.Safe Links policy

D.Impersonation protection in anti-phishing policy

AnswerD

Impersonation protection within an anti-phishing policy is specifically engineered to identify and mitigate attacks where attackers spoof a known user's display name or email address, or a trusted domain. It analyzes various email attributes, including sender display name, sender address, and domain similarity, against configured protected users and domains to detect and act upon these highly targeted phishing attempts. This direct focus on identity spoofing makes it the correct control for preventing impersonation.

Why this answer

The attack described is a business email compromise (BEC) or CEO fraud, which relies on impersonation rather than malicious links or attachments. Microsoft Defender for Office 365's anti-phishing policy includes impersonation protection that specifically detects and mitigates attempts where a sender spoofs a high-profile user (like the CEO) or domain. Enabling impersonation protection in the anti-phishing policy is the correct additional safeguard because the email passed the spam filter, indicating it was not a bulk or malware-based threat.

Exam trap

The trap here is that candidates confuse the general anti-phishing policy (which includes spoof intelligence) with the specific impersonation protection setting, or they mistakenly think Safe Links or Safe Attachments can detect social engineering attacks that contain no malicious payload.

How to eliminate wrong answers

Option A is wrong because Safe Attachments policy protects against malicious attachments by detonating them in a sandbox, but the reported email does not contain an attachment—it is a social engineering request for a wire transfer. Option B is wrong because Anti-spam policy handles bulk email and spam classification, and the email already passed the spam filter, so adjusting anti-spam settings would not address the impersonation tactic. Option C is wrong because Safe Links policy provides time-of-click protection against malicious URLs, but the email contains no link—it is a direct request for action via reply.

Full explanation →

Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 976–1050