Microsoft Security, Compliance, and Identity Fundamentals SC-900 SC-900 Questions 1126–1200 | Page 16/17

1126

MCQeasy

A company wants to provide secure external access to a partner application without creating user accounts manually. They need to allow partners to authenticate using their existing corporate identities (e.g., from other organizations) and configure policies for access. Which Microsoft Entra feature should they use?

A.Microsoft Entra Identity Protection

B.Microsoft Entra External ID (B2B collaboration)

C.Microsoft Entra Privileged Identity Management

D.Microsoft Entra Domain Services

AnswerB

Microsoft Entra External ID (B2B collaboration) is the correct solution as it specifically enables organizations to invite external users, such as partners, to access their applications and resources using their own existing identities. This feature integrates partner users into the inviting organization's Microsoft Entra tenant as guest users, allowing for the application of robust access policies and secure management of their access to partner applications.

Why this answer

Microsoft Entra External ID (B2B collaboration) allows organizations to securely share applications and resources with external partners by letting them authenticate using their own corporate identities (e.g., from other Azure AD tenants, Microsoft accounts, or social identity providers). It eliminates the need to manually create and manage user accounts for partners, while enabling you to apply conditional access policies for granular control over external access.

Exam trap

The trap here is that candidates often confuse B2B collaboration (External ID) with B2C (External Identities for customer-facing apps) or think that Privileged Identity Management is needed for external access, but the question specifically asks about allowing partners to use their existing corporate identities without manual account creation, which is the core purpose of B2B collaboration.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Identity Protection is a risk-based security tool that detects and responds to identity threats (e.g., leaked credentials, sign-in anomalies) for users within your tenant, not a feature for inviting external partners or federating with their existing identities. Option C is wrong because Microsoft Entra Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles within your own directory (e.g., just-in-time admin access), not for enabling external partner authentication or collaboration. Option D is wrong because Microsoft Entra Domain Services provides managed domain services (e.g., LDAP, Kerberos, NTLM) for legacy on-premises applications in the cloud, not for external identity federation or B2B guest access.

Full explanation →

1127

MCQmedium

Your company uses Microsoft Entra ID. Security policy requires that all external guest users must be reviewed and their access approved by their sponsor every 90 days. If not approved, access should be automatically removed. Which feature should you use?

A.Microsoft Entra Conditional Access

B.Microsoft Entra B2B collaboration settings

C.Microsoft Entra entitlement management

D.Microsoft Entra access reviews

AnswerD

Microsoft Entra access reviews are specifically designed to enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments by scheduling periodic reviews. These reviews allow designated reviewers to confirm continued access necessity, and critically, they can be configured to automatically remove access for users who are not approved or whose review is not completed, directly addressing the requirement for periodic validation and automated revocation.

Why this answer

Microsoft Entra access reviews (Option D) allow you to configure recurring reviews of guest users' access, with automatic removal of access if not approved. This directly meets the requirement for a 90-day review cycle with automatic enforcement, as access reviews can be scoped to guest users and integrated with entitlement management or groups.

Exam trap

The trap here is that candidates confuse entitlement management (which creates access packages) with the actual review and removal mechanism, but access reviews are the specific feature that enforces periodic attestation and automatic cleanup.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Conditional Access controls access based on conditions like location or device state, but it does not provide periodic review or automatic removal of access based on approval. Option B is wrong because Microsoft Entra B2B collaboration settings manage invitation policies and external user properties, but they lack the recurring review and auto-removal workflow. Option C is wrong because Microsoft Entra entitlement management manages access packages and catalogs, but the actual review and removal process is implemented through access reviews, not entitlement management alone.

Full explanation →

1128

MCQhard

A company runs critical Windows virtual machines on Azure. To reduce the attack surface, the security team wants to block all inbound RDP (port 3389) traffic from the internet by default. When a security engineer needs to connect via RDP for troubleshooting, they must request access through a portal, and the RDP port will be opened for a limited time (e.g., 4 hours) only to their source IP address. Which Microsoft security solution should they use to implement this control?

A.Microsoft Defender for Cloud's Just-in-time (JIT) VM access

B.Microsoft Defender for Cloud Apps

C.Microsoft Defender for Endpoint

D.Azure Network Security Groups (NSGs) with application security groups

AnswerA

Microsoft Defender for Cloud's Just-in-time (JIT) VM access is a crucial security feature designed to reduce the attack surface of Azure virtual machines. It achieves this by locking down inbound management ports, only opening them for specific, approved source IP addresses for a limited duration. This temporary, on-demand access significantly minimizes exposure to potential threats, aligning with zero-trust principles and enhancing overall VM security posture.

Why this answer

Microsoft Defender for Cloud's Just-in-time (JIT) VM access is the correct solution because it specifically provides time-limited, request-based opening of inbound ports (such as RDP port 3389) to approved source IP addresses, reducing the attack surface by keeping ports closed by default. This aligns directly with the requirement to block all inbound RDP from the internet by default and allow temporary access only through a portal request.

Exam trap

The trap here is that candidates may confuse network-level controls (NSGs) with a managed security service that automates temporary access, leading them to choose Option D without realizing NSGs lack the time-limited, request-based workflow that JIT provides.

How to eliminate wrong answers

Option B (Microsoft Defender for Cloud Apps) is wrong because it is a cloud access security broker (CASB) focused on controlling and monitoring user access to SaaS applications, not on managing inbound network ports to Azure VMs. Option C (Microsoft Defender for Endpoint) is wrong because it is an endpoint detection and response (EDR) solution for securing devices against malware and threats, not a network-level port management tool. Option D (Azure Network Security Groups with application security groups) is wrong because while NSGs can block or allow traffic, they do not provide time-limited, request-based just-in-time access; they require manual rule changes and do not integrate with a portal-based approval workflow.

Full explanation →

1129

MCQmedium

A company uses Microsoft Entra ID and wants to enforce multifactor authentication (MFA) for all users accessing a sensitive customer relationship management (CRM) application, but only when the access request originates from outside the corporate network. Which component of a Conditional Access policy should the administrator configure to specify this location-based requirement?

A.Assignments

B.Conditions

C.Grant controls

D.Session controls

AnswerB

Conditions are the "if" part of a Conditional Access policy, evaluating specific attributes of a sign-in attempt to determine if the policy applies. This includes critical contextual factors such as the user's sign-in risk level, the device platform being used, the client application, and crucially, the network location from which the access request originates. The location condition specifically allows administrators to define trusted or untrusted IP ranges, enabling enforcement based on geographic or network-specific access points.

Why this answer

The 'Conditions' section of a Conditional Access policy allows administrators to define the circumstances under which the policy is applied, including the location from which an access request originates. By configuring a location condition, you can specify that MFA is enforced only when users access the CRM application from outside the corporate network, using named locations or IP ranges. This is the correct component to enforce the location-based requirement.

Exam trap

The trap here is that candidates often confuse 'Assignments' (who/what) with 'Conditions' (when/where), mistakenly selecting Assignments because they think location is part of the user or app assignment, whereas Conditions specifically handle environmental factors like location, device state, and risk.

How to eliminate wrong answers

Option A is wrong because 'Assignments' define which users, groups, or applications the policy applies to, not the conditions under which it is triggered. Option C is wrong because 'Grant controls' specify what actions to take (e.g., require MFA, require compliant device) after the policy conditions are met, not the location condition itself. Option D is wrong because 'Session controls' manage session-level behaviors like app-enforced restrictions or sign-in frequency, not the location-based trigger for MFA enforcement.

Full explanation →

1130

MCQeasy

A compliance administrator creates the above custom sensitive information type for detecting social security numbers (SSNs). What is required for a document to be classified as containing an SSN?

A.The document must contain either the SSN regex or a keyword

B.The document must contain the SSN regex with high confidence level

C.The document must contain a pattern matching the SSN regex and at least two keywords

D.The document must contain a pattern matching the SSN regex and at least one keyword

AnswerD

This option accurately describes the conditions for a match. The custom sensitive information type (SIT) rule is configured with a logical AND operator, requiring both the detection of a pattern matching the Social Security Number (SSN) regular expression and the presence of associated keywords. Specifically, the `minMatches=1` setting for the keyword component means that at least one keyword must be found in proximity to the SSN pattern to trigger a successful detection.

Why this answer

A custom sensitive information type in Microsoft Purview uses a primary element (the SSN regex pattern) and requires at least one supporting element (a keyword) to trigger a match. This ensures that the document is not falsely classified by the regex alone, which could match random number sequences. The compliance administrator configured the type with a minimum count of one keyword as a proximity requirement, so the document must contain both the regex pattern and at least one keyword.

Exam trap

The trap here is that candidates confuse the confidence level (which is a calculated percentage) with the required matching criteria (regex plus keywords), leading them to select Option B, which incorrectly implies that high confidence alone is sufficient without the keyword requirement.

How to eliminate wrong answers

Option A is wrong because requiring either the SSN regex or a keyword would allow classification based solely on a keyword without any number pattern, which defeats the purpose of detecting SSNs. Option B is wrong because 'high confidence level' is a separate confidence setting (e.g., 85% or higher) that can be configured, but the question asks what is required for classification—not the confidence threshold; the requirement is the regex plus keywords, not just the regex with high confidence. Option C is wrong because the custom sensitive information type was created with a minimum count of one keyword, not two; requiring at least two keywords would be an incorrect interpretation of the proximity and count settings.

Full explanation →

1131

MCQhard

A multinational corporation wants to implement a Zero Trust security model. They plan to verify every access request explicitly, use least privilege access, and assume breach. Which Microsoft security solution should they use to enforce conditional access policies based on user, device, location, and risk?

A.Microsoft Sentinel

B.Microsoft Intune

C.Microsoft Entra Conditional Access

D.Microsoft Defender for Cloud Apps

AnswerC

Microsoft Entra Conditional Access is the service that enforces access policies based on signals like user, device, location, and risk.

Why this answer

Microsoft Entra Conditional Access is the correct solution for enforcing conditional access policies based on signals like user, device, location, and risk. Option A (Microsoft Sentinel) is a SIEM/SOAR solution for security analytics, not access control. Option B (Microsoft Intune) manages devices but does not enforce access policies on its own.

Option D (Microsoft Defender for Cloud Apps) provides cloud app security but is not the primary conditional access engine.

Full explanation →

1132

MCQeasy

You are a security administrator for a company that uses Microsoft 365. The compliance team needs to automatically classify and protect sensitive data such as credit card numbers in emails and documents. Which Microsoft Purview solution should you recommend?

A.Microsoft Purview Information Protection

B.Microsoft Purview Records Management

C.Microsoft Purview Insider Risk Management

D.Microsoft Purview Data Loss Prevention

AnswerA

Correct. Microsoft Purview Information Protection automatically classifies sensitive data (e.g., credit card numbers) by applying sensitivity labels and can protect data with encryption or access controls, meeting both requirements.

Why this answer

A is correct because Microsoft Purview Information Protection (formerly Azure Information Protection) provides automatic classification of sensitive data, such as credit card numbers, by applying sensitivity labels based on rules and patterns. It also offers protection through encryption or access restrictions. This solution directly addresses the compliance team's requirement for both automatic classification and protection.

Data Loss Prevention (DLP) enforces protective actions after classification but does not perform the classification itself.

Exam trap

The trap is that candidates may confuse Microsoft Purview Data Loss Prevention (DLP) with Information Protection. DLP enforces policies to prevent data loss but does not automatically classify data; Information Protection handles the actual labeling and classification. The question explicitly requires both classification and protection, making Information Protection the correct choice.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Information Protection focuses on manually or automatically applying sensitivity labels to classify and protect data, but it does not natively enforce real-time data loss prevention actions like blocking emails containing credit card numbers; DLP handles that enforcement. Option B is wrong because Microsoft Purview Records Management is designed for managing retention and disposition of records based on regulatory requirements, not for real-time detection and protection of sensitive data in transit or at rest. Option C is wrong because Microsoft Purview Insider Risk Management identifies and investigates risky user activities (e.g., data theft by insiders), but it does not automatically classify or protect sensitive data like credit card numbers in emails and documents; it focuses on user behavior analytics, not content-based protection.

Full explanation →

1133

MCQeasy

Your company wants to use Microsoft Security Copilot to help analysts investigate security incidents. Which data source can Security Copilot ingest to provide contextual insights?

A.Alerts from Microsoft Defender XDR

B.Custom IoT device logs

C.Third-party threat intelligence feeds

D.On-premises firewall syslog

AnswerA

Microsoft Security Copilot is fundamentally designed to integrate natively and deeply with Microsoft's security product suite, including Microsoft Defender XDR. It directly ingests alerts, incidents, and underlying telemetry from Defender XDR across endpoints, identities, email, and cloud apps. This direct data access allows Copilot to provide real-time incident summarization, contextual analysis, and guided response actions based on high-fidelity threat detections.

Why this answer

Microsoft Security Copilot can directly ingest alerts from Microsoft Defender XDR to provide contextual insights for analysts investigating security incidents. Option B is incorrect because custom IoT device logs are not natively ingested by Security Copilot; they would typically require a SIEM or data connector. Option C is incorrect because while Security Copilot can use threat intelligence, third-party feeds are not a primary direct ingestion source.

Option D is incorrect because on-premises firewall syslog is not directly ingested; Security Copilot primarily ingests data from Microsoft security products and Azure services.

Full explanation →

1134

MCQeasy

A company uses Microsoft Entra ID. Employees often forget their passwords and contact the IT helpdesk to reset them. The company wants to reduce helpdesk costs by allowing users to reset their own passwords using a verified mobile phone number or email address. Which Microsoft Entra ID feature should the administrator enable?

A.Microsoft Entra ID Identity Protection

B.Self-Service Password Reset (SSPR)

C.Privileged Identity Management (PIM)

D.Conditional Access

AnswerB

Self-Service Password Reset (SSPR) is a crucial Microsoft Entra ID feature that empowers users to reset their forgotten passwords without requiring assistance from IT helpdesk staff. Users must pre-register at least two authentication methods, such as a mobile phone number or an alternate email address, which are then used to verify their identity during the reset process. This capability significantly reduces helpdesk call volumes and improves user productivity by enabling immediate password recovery.

Why this answer

Self-Service Password Reset (SSPR) is the correct feature because it allows users to reset their own passwords without helpdesk intervention, using a verified mobile phone number or email address as authentication methods. This directly reduces helpdesk costs by shifting password reset responsibility to the user, while maintaining security through verification of registered contact methods.

Exam trap

The trap here is that candidates often confuse Privileged Identity Management (PIM) with self-service password reset, because both involve 'management' of identities, but PIM is strictly for privileged role activation, not end-user password changes.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Identity Protection is a risk-based security tool that detects potential identity vulnerabilities and automated remediation, but it does not provide self-service password reset capabilities. Option C is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role activation and access reviews, not end-user password resets. Option D is wrong because Conditional Access enforces access policies based on signals like user location or device state, but it does not enable users to reset their own passwords.

Full explanation →

1135

MCQhard

Your organization uses Microsoft Purview for data governance. You need to ensure that when a user marks an email as 'Confidential' using a sensitivity label, the email is automatically encrypted and cannot be forwarded. What configuration is required?

A.Configure the sensitivity label with encryption and a rights management template that prohibits forwarding

B.Create a DLP policy that detects the 'Confidential' label and applies encryption

C.Use the Azure Information Protection unified labeling scanner

D.Apply a retention label that triggers encryption

AnswerA

Sensitivity labels are designed to classify and protect data directly at the point of creation or modification. By configuring a sensitivity label with encryption, it applies Azure Rights Management (Azure RMS) protection to the content. This protection can include specific usage rights, such as "Do Not Forward," which prevents recipients from forwarding, printing, or copying the protected email or document, ensuring the data remains within its intended scope. This method directly embeds the protection into the content, making it persistent wherever the data travels.

Why this answer

Microsoft Purview sensitivity labels can be configured with encryption settings that use Azure Rights Management (Azure RMS) to enforce usage restrictions. By selecting the 'Do Not Forward' template, the email is automatically encrypted and the recipient cannot forward, copy, or print the message, meeting the requirement.

Exam trap

The trap here is that candidates often confuse the role of DLP policies with sensitivity labels, assuming DLP can enforce encryption, when in fact encryption is a native capability of sensitivity labels using Azure RMS templates.

How to eliminate wrong answers

Option B is wrong because a Data Loss Prevention (DLP) policy can detect sensitivity labels and trigger actions like blocking or warning, but it cannot directly apply encryption to emails; encryption is a property of the sensitivity label itself, not a DLP action. Option C is wrong because the Azure Information Protection unified labeling scanner is used for discovering, classifying, and labeling files on-premises, not for configuring encryption on emails sent from Exchange Online. Option D is wrong because retention labels are designed to manage data lifecycle and retention, not to apply encryption or rights protection; they do not enforce 'Do Not Forward' restrictions.

Full explanation →

1136

MCQhard

A company's security team needs to detect and investigate potential data theft by employees who have legitimate access to sensitive data. They want a solution that uses heuristics and behavioral analytics to identify risky user actions such as data exfiltration to personal cloud storage. Which Microsoft Purview solution should they use?

A.Microsoft Purview Data Loss Prevention (DLP)

B.Microsoft Purview Insider Risk Management

C.Microsoft Purview Audit (Standard)

D.Microsoft Purview Information Barriers

AnswerB

Microsoft Purview Insider Risk Management is the correct solution as it specifically leverages built-in risk indicators, machine learning, and behavioral analytics to identify and investigate potential insider risks, including data theft. It correlates various user activities across Microsoft 365 services to detect unusual patterns, enabling security teams to proactively identify, analyze, and respond to incidents.

Why this answer

Microsoft Purview Insider Risk Management is the correct solution because it is specifically designed to detect, investigate, and act on risky user activities that may lead to data theft, using heuristics and behavioral analytics. It correlates signals from Microsoft 365 and Azure services to identify patterns like data exfiltration to personal cloud storage, which aligns directly with the scenario's requirements.

Exam trap

The trap here is that candidates often confuse the reactive, policy-based enforcement of Data Loss Prevention (DLP) with the proactive, behavioral detection of Insider Risk Management, assuming DLP can detect risky user actions when it actually only blocks or alerts on content matching static rules.

Why the other options are wrong

Microsoft Purview Data Loss Prevention (DLP) is designed to prevent accidental or unauthorized sharing of sensitive data by enforcing policies, but it does not use heuristics and behavioral analytics to detect risky user actions like data exfiltration by insiders.

Information Barriers are designed to prevent communication and collaboration between specific groups to avoid conflicts of interest, not to detect or investigate data theft by employees with legitimate access.

When would these options actually be correct?

A company wants to automatically block employees from emailing credit card numbers to external recipients or uploading them to a public SharePoint site. DLP would be the correct solution to enforce policies that prevent data loss.

A company needs to restrict communication between two departments (e.g., traders and analysts) to prevent insider trading. Which Microsoft Purview solution should they use?

Why candidates pick the wrong answer

Candidates may confuse DLP's data protection capabilities with insider risk detection, assuming that any solution involving sensitive data and prevention also covers behavioral analytics.

Candidates may confuse 'barriers' with 'preventing data theft' and think Information Barriers can block data exfiltration, but they focus on communication restrictions, not behavioral analytics.

Full explanation →

1137

MCQmedium

A security team wants to discover all cloud apps being used by employees, including unsanctioned personal apps like unauthorized file-sharing services. They plan to analyze firewall logs to identify traffic patterns and assess each app's risk score. Which feature of Microsoft Defender for Cloud Apps should they enable?

A.Cloud Discovery

B.App Governance

C.Information Protection

D.Conditional Access App Control

AnswerA

Cloud Discovery, a core capability within Microsoft Defender for Cloud Apps, is precisely designed to identify all cloud applications accessed by users within an organization. It achieves this by analyzing traffic logs from firewalls and proxies, providing comprehensive visibility into both sanctioned and unsanctioned "shadow IT" applications. This process generates detailed risk assessments for each discovered app, enabling security teams to understand potential vulnerabilities, compliance gaps, and usage patterns. Its primary function is comprehensive app discovery and risk assessment.

Why this answer

Cloud Discovery is the correct feature because it analyzes traffic logs (e.g., from firewalls or proxies) to identify all cloud apps in use, including unsanctioned personal apps like unauthorized file-sharing services. It then assesses each app's risk score based on over 80 risk factors, such as encryption standards and data residency, enabling the security team to discover and evaluate shadow IT.

Exam trap

The trap here is that candidates often confuse Cloud Discovery with Conditional Access App Control, mistakenly thinking that real-time session policies can also discover unsanctioned apps, but discovery requires log analysis, not policy enforcement.

How to eliminate wrong answers

Option B (App Governance) is wrong because it focuses on monitoring and managing OAuth-enabled apps that have been granted access to Microsoft 365 data, not on discovering unsanctioned cloud apps from firewall logs. Option C (Information Protection) is wrong because it deals with classifying, labeling, and protecting sensitive data (e.g., via sensitivity labels and DLP), not with discovering cloud app usage or analyzing traffic patterns. Option D (Conditional Access App Control) is wrong because it enforces real-time access policies (e.g., session controls) on sanctioned apps, but it does not perform discovery or risk assessment of unsanctioned apps from firewall logs.

Full explanation →

1138

MCQmedium

A company requires all employees to provide a one-time passcode generated by an authenticator app in addition to their password when accessing the corporate VPN. This practice is an example of which security concept?

A.A. Authorization

B.B. Auditing

C.C. Authentication

D.D. Accounting

AnswerC

Authentication is the foundational security process of verifying an entity's identity, confirming they are who they claim to be. In this scenario, requiring a one-time passcode (OTP) alongside another factor, like a password, establishes multi-factor authentication (MFA). This robust method significantly enhances security by requiring multiple proofs of identity before granting access to a system or resource, directly addressing the company's need to confirm employee identity.

Why this answer

The requirement for a one-time passcode (OTP) from an authenticator app in addition to a password is a classic implementation of multi-factor authentication (MFA). Authentication is the process of verifying the identity of a user, device, or service, and this scenario uses two distinct factors: something you know (password) and something you have (the OTP generated by the app). This directly aligns with the security concept of authentication, not authorization, auditing, or accounting.

Exam trap

The trap here is that candidates often confuse authentication (proving identity) with authorization (granting permissions), especially when the question describes a 'gate' like VPN access, leading them to incorrectly select authorization.

Why the other options are wrong

Authorization determines what resources a user can access after authentication, but the scenario describes verifying identity via a one-time passcode, which is an authentication process, not authorization.

Auditing refers to the process of reviewing and analyzing logs or records to ensure compliance or detect anomalies, not to verifying identity. The question describes verifying identity via password and passcode, which is authentication, not auditing.

When would these options actually be correct?

A question that asks: 'After a user authenticates, the system checks if they have permission to access a specific file. This is an example of which security concept?' — then authorization would be correct.

A company requires all VPN access attempts to be logged and reviewed monthly for unauthorized access attempts. This practice is an example of auditing.

Why candidates pick the wrong answer

Candidates may confuse the terms 'authentication' and 'authorization' because both involve access control, and the use of a passcode might be mistakenly thought to grant access rights rather than verify identity.

Candidates may confuse auditing with authentication because both involve security controls, and auditing often includes reviewing authentication logs, leading them to think the passcode step is part of an audit process.

Full explanation →

1139

MCQmedium

Your company uses Microsoft Purview Data Lifecycle Management. You need to ensure that emails in users' mailboxes are retained for 7 years for compliance, but users should be able to delete emails they no longer need before that period. Which configuration achieves this?

A.Configure a Data Loss Prevention policy

B.Place a litigation hold on the mailboxes

C.Apply a retention label with record locking

D.Apply a retention policy without a preservation lock

AnswerD

Applying a retention policy without a preservation lock allows users to delete items from their primary view within applications like Outlook or SharePoint. However, the retention policy ensures that a copy of the deleted item is moved to a secure, hidden location (e.g., the Recoverable Items folder for Exchange, or the Preservation Hold library for SharePoint/OneDrive) and retained for the policy's duration. This mechanism precisely meets the requirement of allowing user deletion while guaranteeing the item remains discoverable and recoverable by administrators.

Why this answer

A retention policy without a preservation lock (Option D) allows you to define a retention period (7 years) for emails while still permitting users to delete items before that period ends. When a user deletes an email, it is moved to the Recoverable Items folder and retained for the remainder of the 7-year period, after which it is permanently deleted. This meets the compliance requirement without preventing user deletion.

Exam trap

The trap here is that candidates often confuse retention policies with holds or labels, assuming that any retention mechanism must block user deletion, but a retention policy without a preservation lock allows deletion while still retaining the data in the background.

How to eliminate wrong answers

Option A is wrong because a Data Loss Prevention (DLP) policy is designed to prevent sensitive data from being shared or leaked, not to retain emails for a fixed period. Option B is wrong because a litigation hold preserves all mailbox content indefinitely (or until the hold is removed) and does not allow users to delete emails before the retention period expires. Option C is wrong because a retention label with record locking marks items as records, preventing users from deleting or modifying them, which contradicts the requirement that users should be able to delete emails they no longer need.

Full explanation →

1140

MCQeasy

A company wants to enforce conditional access policies that require multifactor authentication (MFA) for all users accessing financial apps from outside the corporate network. Which Microsoft Entra ID license is minimally required to create conditional access policies?

A.Microsoft 365 Business Basic

B.Microsoft Entra ID P2

C.Microsoft Entra ID Free

D.Microsoft Entra ID P1

AnswerD

Microsoft Entra ID P1 is the correct and minimal license required to enforce Conditional Access policies. This license tier enables organizations to define and apply robust access controls, such as requiring multi-factor authentication (MFA) for specific applications, blocking access from untrusted locations, or enforcing device compliance. It provides the essential framework for implementing a strong, adaptive access management strategy.

Why this answer

Microsoft Entra ID P1 (formerly Azure AD Premium P1) is the minimum license required to create and enforce conditional access policies. Conditional access is a premium feature that is not available in Free or Microsoft 365 Business Basic tiers, and while P2 includes additional capabilities like Identity Protection, it is not necessary for basic MFA enforcement based on location.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID P2 as the minimum because they associate it with advanced security features, but the exam specifically tests that P1 is sufficient for creating conditional access policies without the need for P2's Identity Protection or PIM capabilities.

How to eliminate wrong answers

Option A is wrong because Microsoft 365 Business Basic does not include Microsoft Entra ID P1; it only provides the Free tier of Entra ID, which lacks conditional access policy creation. Option B is wrong because Microsoft Entra ID P2 includes all P1 features plus Identity Protection and Privileged Identity Management, but it is not the minimum required for basic conditional access policies. Option C is wrong because Microsoft Entra ID Free does not support conditional access policies; it only supports basic security defaults, not customizable policies.

Full explanation →

1141

MCQmedium

A company uses Microsoft Defender for Cloud Apps to protect its SaaS apps. The security team needs to detect when a user downloads more than 100 files from SharePoint Online within 10 minutes. Which policy type should they create?

A.Anomaly detection policy

B.Activity policy

C.Threat detection policy

D.Compliance policy

AnswerA

Anomaly detection policies in Microsoft Defender for Cloud Apps leverage advanced machine learning algorithms to establish a baseline of normal user and entity behavior within your cloud environment. These policies continuously monitor for significant deviations from this established baseline, such as impossible travel, unusual administrative activities, or mass downloads to an unmanaged device. By identifying these statistical anomalies, they proactively detect potential threats like compromised accounts, insider threats, or data exfiltration attempts that might otherwise go unnoticed.

Why this answer

Anomaly detection policies in Microsoft Defender for Cloud Apps use machine learning to establish a baseline of normal user behavior and then trigger alerts when deviations occur, such as a user downloading over 100 files from SharePoint Online within 10 minutes. This specific scenario—unusually high download volume in a short time—is a classic example of a behavioral anomaly that an anomaly detection policy is designed to catch, as it may indicate a data exfiltration attempt.

Exam trap

The trap here is that candidates often confuse 'activity policy' with 'anomaly detection policy,' assuming any user action-based alert is an activity policy, but activity policies require explicit, static conditions (e.g., 'download from SharePoint') and cannot dynamically detect unusual volume or frequency without additional logic.

How to eliminate wrong answers

Option B (Activity policy) is wrong because activity policies are rule-based and match specific, predefined activities (e.g., 'download file from SharePoint') but cannot natively detect anomalous volume thresholds like 'more than 100 files in 10 minutes' without custom scripting or repeated log aggregation. Option C (Threat detection policy) is wrong because threat detection policies in Defender for Cloud Apps focus on identifying known threat actors, malware, or compromised accounts using threat intelligence feeds, not on behavioral anomalies based on volume or frequency. Option D (Compliance policy) is wrong because compliance policies are used to enforce data handling standards (e.g., DLP, data classification) and do not monitor user activity patterns for anomalous behavior.

Full explanation →

1142

MCQmedium

A company uses Microsoft Entra ID to manage identities. They want to enforce access policies based on user location, device compliance, and application sensitivity. Which Microsoft Entra ID capability should they use?

A.Microsoft Entra ID Protection

B.Conditional Access

C.Privileged Identity Management (PIM)

D.Microsoft Entra Connect Sync

AnswerB

Conditional Access is the precise solution for defining and enforcing granular access policies based on a wide array of conditions. Administrators can configure policies that evaluate user attributes, device state (e.g., compliant vs. non-compliant), location, application being accessed, and sign-in risk. This allows for dynamic access control, enabling actions like requiring multi-factor authentication, blocking access, or allowing access only from managed devices, directly addressing the need for policy enforcement based on specific criteria.

Why this answer

Conditional Access is the correct capability because it allows administrators to create policies that enforce access controls based on conditions such as user location, device compliance, and application sensitivity. These policies evaluate signals at sign-in time and can require multi-factor authentication, block access, or grant limited access based on the defined conditions.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID Protection (which deals with risk detection) with Conditional Access (which enforces policies based on conditions like location and device compliance), but ID Protection does not directly enforce location- or device-based access rules.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Protection focuses on detecting and remediating identity-based risks (e.g., leaked credentials, anonymous IP addresses) and does not directly enforce policies based on device compliance or application sensitivity. Option C is wrong because Privileged Identity Management (PIM) provides just-in-time privileged access and role activation workflows, not location- or device-based access policies. Option D is wrong because Microsoft Entra Connect Sync is a tool for synchronizing on-premises directory objects to Entra ID and has no role in enforcing access policies.

Full explanation →

1143

MCQeasy

Refer to the exhibit. You have a Data Loss Prevention (DLP) policy in Microsoft Purview. What will happen when a user tries to share a document containing a credit card number via email?

A.The email is blocked only if the recipient is external

B.The email is sent with a warning to the recipient

C.The email is sent but the user is not notified

D.The email is blocked and the user receives a notification

AnswerD

This option accurately describes the combined effect of a typical DLP policy configured for strict enforcement. When sensitive information is detected within the email, the policy's 'Block access' action prevents the email from being delivered to its intended recipients, ensuring data protection. Concurrently, the policy's notification setting ensures that the sender is immediately informed about the policy violation and the reason for the email's blocking, allowing them to understand and rectify the issue.

Why this answer

The DLP policy is configured to block the email and send a notification to the user when a credit card number is detected. Option A is incorrect because the policy applies to both internal and external recipients. Option B is incorrect because the email is blocked, not sent with a warning.

Option C is incorrect because the user is notified when the email is blocked.

Full explanation →

1144

MCQhard

A multinational company uses a hybrid infrastructure with on-premises Active Directory and Azure resources. They have deployed Microsoft Defender for Cloud to protect their Azure workloads. They now want to extend threat detection to their on-premises Active Directory by collecting security events from domain controllers to detect attacks like Golden Ticket, DCSync, and malicious Kerberos activity. The solution should integrate with Microsoft Sentinel for automated response. Which security solution should they deploy on the on-premises domain controllers?

A.Microsoft Defender for Cloud

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Identity

D.Microsoft Sentinel

AnswerC

Microsoft Defender for Identity is purpose-built to detect advanced threats targeting on-premises Active Directory environments by analyzing network traffic and Windows events from domain controllers. It deploys lightweight sensors directly on domain controllers or uses port mirroring to gain deep visibility into authentication protocols like Kerberos and NTLM. This specialized analysis allows it to identify suspicious user behavior, privilege escalation attempts, and specific attack patterns, such as Golden Ticket, Pass-the-Hash, and DCShadow, providing crucial security alerts for AD compromise. Its focus is precisely on the unique attack surface presented by Active Directory.

Why this answer

Microsoft Defender for Identity (MDI) is the correct solution because it is specifically designed to monitor on-premises Active Directory signals, including security events from domain controllers, to detect advanced identity-based attacks such as Golden Ticket, DCSync, and malicious Kerberos activity. MDI integrates natively with Microsoft Sentinel to enable automated response workflows, fulfilling the requirement for extending threat detection to on-premises AD.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM/CWPP tool) with Microsoft Defender for Identity (an AD-focused identity threat detection tool), because both names include 'Defender' and both can integrate with Sentinel, but only MDI monitors on-premises Active Directory authentication events.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud is a cloud workload protection platform (CWPP) focused on securing Azure, hybrid, and multi-cloud resources, not on-premises Active Directory domain controllers. Option B is wrong because Microsoft Defender for Endpoint is an endpoint detection and response (EDR) solution for devices like servers and workstations, not for monitoring Active Directory authentication protocols or Kerberos attacks. Option D is wrong because Microsoft Sentinel is a cloud-native SIEM/SOAR platform that ingests logs and triggers responses, but it does not deploy agents on domain controllers to collect security events; it relies on data connectors from other sources like MDI.

Full explanation →

1145

MCQmedium

A financial organization implements a security control that logs every access attempt to sensitive financial records, including who accessed the data, when it was accessed, and from which device. The logs are regularly reviewed by the security team. This control primarily addresses which security concept?

A.Confidentiality

B.Integrity

C.Availability

D.Accountability

AnswerD

Accountability is the ability to trace actions and events back to a specific entity, whether a user, process, or system. By meticulously recording access, modifications, and system events, logging creates an indispensable audit trail. This trail enables forensic analysis, compliance verification, and the attribution of responsibility, making it a foundational component for holding individuals and systems accountable for their actions within an organization.

Why this answer

Accountability ensures that actions affecting sensitive data can be traced uniquely to an individual. By logging who accessed the data, when, and from which device, the organization creates an audit trail that holds users responsible for their actions. This directly supports non-repudiation and forensic analysis, which are the core goals of accountability.

Exam trap

The trap here is that candidates confuse logging with confidentiality, thinking that tracking access prevents unauthorized viewing, when in fact logging only records the event and does not block the access itself.

How to eliminate wrong answers

Option A is wrong because confidentiality focuses on preventing unauthorized access to data (e.g., through encryption or access controls), not on logging who accessed it. Option B is wrong because integrity ensures data has not been altered or tampered with (e.g., via hashing or checksums), whereas logging does not protect against modification. Option C is wrong because availability ensures systems and data are accessible when needed (e.g., through redundancy or failover), and logging does not directly contribute to uptime or resilience.

Full explanation →

1146

MCQmedium

A company is involved in a legal dispute and must preserve all emails and documents related to the case. The legal team needs to identify specific custodians (employees) and place a hold on their Exchange Online mailboxes and SharePoint sites to prevent any deletion or alteration of relevant content. Additionally, they need to collect the preserved data for review and analysis. Which Microsoft Purview solution should they use?

A.Microsoft Purview eDiscovery (Premium)

B.Microsoft Purview Audit

C.Microsoft Purview Data Lifecycle Management

D.Microsoft Purview Communication Compliance

AnswerA

eDiscovery (Premium) provides end-to-end workflow for identifying, preserving, collecting, and reviewing data relevant to legal cases, including placing holds on custodians' data.

Why this answer

Microsoft Purview eDiscovery (Premium) is the correct solution because it provides end-to-end workflow for legal investigations: identifying and placing custodians on hold (via litigation hold on Exchange Online mailboxes and SharePoint sites), preserving content from deletion or alteration, and then collecting, reviewing, and analyzing the preserved data. This directly matches the scenario's requirements for legal hold and data collection for review.

Exam trap

The trap here is confusing the logging/auditing capability (Audit) with the preservation and collection workflow (eDiscovery), or assuming that retention policies (Data Lifecycle Management) can serve as a legal hold, when in fact they are designed for lifecycle management and do not support custodian-based holds or case-specific collection.

How to eliminate wrong answers

Option B (Microsoft Purview Audit) is wrong because it only logs and records user and admin activities (e.g., who accessed or deleted content) but does not place holds on data or allow collection for review. Option C (Microsoft Purview Data Lifecycle Management) is wrong because it focuses on retention and deletion policies based on data lifecycle (e.g., automatically deleting old emails), not on preserving data for a specific legal case or identifying custodians. Option D (Microsoft Purview Communication Compliance) is wrong because it is designed to detect and remediate inappropriate communications (e.g., harassment, insider trading) by analyzing messages, not for legal hold or eDiscovery collection.

Full explanation →

1147

MCQeasy

A company wants to grant temporary, time-limited access to a critical Azure resource for an external consultant. Which Microsoft Entra feature should they use?

A.Entra Verified ID

B.Privileged Identity Management (PIM)

C.Identity Protection

D.Conditional Access

AnswerB

Microsoft Entra Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources by providing just-in-time (JIT) and just-enough-access (JEA) capabilities. It allows administrators to grant temporary, time-limited access to privileged roles, which can be activated on demand for a specified duration. This ensures that users only have elevated permissions when absolutely necessary, significantly reducing the attack surface.

Why this answer

Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure resources, allowing administrators to grant time-bound, temporary access that automatically expires. This aligns directly with the requirement for temporary, time-limited access for an external consultant, as PIM supports activation windows, approval workflows, and audit logging for such scenarios.

Exam trap

The trap here is that candidates often confuse Privileged Identity Management (PIM) with Conditional Access, thinking that Conditional Access can enforce time-limited access, but Conditional Access only controls sign-in conditions, not the duration of privileged role assignments.

How to eliminate wrong answers

Option A is wrong because Entra Verified ID is a decentralized identity verification solution using verifiable credentials (based on W3C standards) and does not provide time-limited access management to Azure resources. Option C is wrong because Identity Protection is a risk-detection and remediation service that identifies compromised identities or risky sign-ins, not a tool for granting or managing temporary access. Option D is wrong because Conditional Access enforces policies based on conditions like location or device state at sign-in time, but it does not grant or schedule time-limited privileged access to specific resources.

Full explanation →

1148

MCQeasy

A user receives an encrypted email from their bank. They use their private key to decrypt the message. After reading it, they verify that the message content has not been altered during transit. Which security principle is primarily demonstrated by the verification that the content was not altered?

A.Confidentiality

B.Integrity

C.Availability

D.Non-repudiation

AnswerB

Integrity ensures that data remains unaltered and complete during transmission or storage. When a user verifies that the content of an encrypted email from their bank has not been changed, they are confirming its integrity. This is typically achieved through cryptographic mechanisms like hashing or digital signatures, which detect any unauthorized modification, ensuring the message received is exactly what was sent.

Why this answer

The verification that the message content has not been altered during transit directly demonstrates the principle of integrity. Integrity ensures that data remains unchanged from its source to its destination, typically enforced through cryptographic hashing or digital signatures. In this scenario, the user's ability to confirm that the email content was not tampered with relies on a hash or signature verification mechanism, which is the core function of integrity protection.

Exam trap

The trap here is that candidates often confuse integrity with non-repudiation, but non-repudiation proves the origin of the message (who sent it), whereas integrity proves the message was not altered—two distinct security goals.

Why the other options are wrong

The question asks about verifying that content was not altered, which is integrity. Confidentiality protects data from unauthorized access, not from modification.

The question asks about verifying that message content was not altered, which is the definition of integrity. Availability concerns ensuring data is accessible when needed, not verifying content integrity.

Non-repudiation ensures that the sender cannot deny having sent the message, but the question focuses on verifying that the content was not altered, which is integrity.

When would these options actually be correct?

A question: 'Which security principle ensures that an encrypted email cannot be read by unauthorized parties?' would make confidentiality correct.

A scenario where a user cannot access their encrypted email due to a server outage or denial-of-service attack would test availability. The question would ask: 'Which security principle is compromised when users cannot retrieve their emails?'

A user receives a digitally signed email from their bank. After verifying the signature, they can prove to a third party that the bank indeed sent the email. Which security principle does this proof demonstrate?

Why candidates pick the wrong answer

Candidates may confuse encryption (which provides confidentiality) with integrity verification, thinking that because the email was encrypted, the verification step also relates to confidentiality.

Candidates may confuse availability with integrity because both are part of the CIA triad, and they might think that verifying content is about ensuring the message is 'available' in its original form.

Candidates may confuse integrity (content unchanged) with non-repudiation (undeniable origin), as both involve cryptographic verification and are often discussed together in security contexts.

Full explanation →

1149

Multi-Selectmedium

Which TWO Microsoft Purview solutions can help protect sensitive data in Microsoft Teams?

Select 2 answers

A.Microsoft Purview Insider Risk Management

B.Microsoft Purview Audit

C.Microsoft Purview eDiscovery

D.Microsoft Purview Data Loss Prevention

E.Microsoft Purview Communication Compliance

AnswersD, E

Microsoft Purview Data Loss Prevention (DLP) is a direct data protection solution that identifies, monitors, and automatically protects sensitive information across various locations, including endpoints, cloud apps, and services like Microsoft Teams. By defining policies based on sensitive information types, DLP can prevent the unauthorized sharing, transfer, or use of sensitive data, such as credit card numbers or health records, ensuring it remains within organizational boundaries and complies with regulations. It actively blocks or alerts on policy violations in real-time.

Why this answer

DLP can protect sensitive data shared in Teams, and Communication Compliance can detect inappropriate content. eDiscovery is for searching, not protection. Insider Risk Management is for risky behavior. Audit is for logging.

Full explanation →

1150

Multi-Selectmedium

A user logs into a company's financial application using their Microsoft Entra ID credentials. After successful sign-in, the application displays a dashboard with data for only the regions the user is authorized to manage. Which two security concepts are demonstrated in this scenario? (Select all that apply.)

Select 2 answers

A.Authentication

B.Authorization

C.Accounting

D.Non-repudiation

AnswersA, B

When a user enters credentials to access a financial application, the system performs authentication. This crucial initial step verifies the user's claimed identity by comparing the provided username and password against stored records. Successful authentication confirms 'who' the user is, granting them entry to the system.

Why this answer

Authentication is demonstrated because the user proves their identity by logging in with Microsoft Entra ID credentials, confirming they are who they claim to be. Authorization is demonstrated because after authentication, the application restricts the dashboard to show only data for regions the user is permitted to manage, enforcing access control based on assigned permissions.

Exam trap

The trap here is that candidates confuse authentication (verifying identity) with authorization (granting permissions), and may incorrectly select accounting or non-repudiation because they associate logging in with tracking or non-denial, but the scenario explicitly describes identity verification and access restriction, not logging or signature-based proof.

Why the other options are wrong

Accounting refers to tracking user activities for auditing or billing purposes, but the scenario only describes logging in and viewing authorized data, not recording or reviewing actions.

Non-repudiation ensures that a user cannot deny having performed an action, typically through digital signatures or audit logs. This scenario only involves logging in and viewing data, with no action that requires proof of origin or integrity.

When would these options actually be correct?

A question that asks: 'An organization needs to track which users accessed sensitive data and when. Which security concept ensures this tracking?' would make Accounting correct.

A user submits a purchase order using a digital signature. Later, the user claims they never submitted it. Non-repudiation would be the correct answer if the question asked which security concept prevents the user from denying the submission.

Why candidates pick the wrong answer

Candidates may confuse 'accounting' with 'account' (as in user account) or think that logging in implies some form of activity tracking, but accounting specifically involves logging and reviewing actions, not just authentication or authorization.

Candidates may confuse non-repudiation with authentication or authorization because all involve identity and access, but non-repudiation specifically deals with undeniable proof of actions, not just verifying identity or permissions.

Full explanation →

1151

MCQmedium

A security team needs to continuously assess the security posture of Azure resources, including virtual machines, storage accounts, and SQL databases. They also want to identify vulnerabilities in both Windows and Linux servers running in Azure and on-premises, and receive prioritized recommendations for remediation. Which Microsoft security solution should they use?

A.Microsoft Defender for Cloud

B.Microsoft Defender for Endpoint

C.Microsoft Sentinel

D.Microsoft Purview

AnswerA

Microsoft Defender for Cloud is the correct choice because it provides comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities. It continuously assesses the security posture of Azure, on-premises, and multi-cloud environments by identifying misconfigurations, vulnerabilities, and compliance deviations. This service offers actionable security recommendations and a secure score to proactively enhance an organization's overall security.

Why this answer

Microsoft Defender for Cloud is the correct solution because it provides continuous assessment of Azure resources (VMs, storage accounts, SQL databases) and hybrid workloads, including vulnerability scanning for Windows and Linux servers both in Azure and on-premises. It delivers prioritized remediation recommendations based on the secure score and integrated vulnerability assessment tools like Qualys or Microsoft Defender Vulnerability Management.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM and workload protection solution) with Microsoft Defender for Endpoint (an EDR solution), but the question's focus on assessing security posture of Azure resources and hybrid servers points specifically to Defender for Cloud's CSPM capabilities.

Why the other options are wrong

Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for devices, not on assessing the security posture of Azure resources like VMs, storage accounts, and SQL databases, nor does it provide prioritized remediation recommendations for cloud infrastructure.

Microsoft Sentinel is a SIEM/SOAR solution for threat detection and response across the enterprise, not a tool for continuously assessing security posture and identifying vulnerabilities in Azure resources and servers.

Microsoft Purview focuses on data governance, classification, and compliance (e.g., data loss prevention, information protection), not on assessing security posture or identifying vulnerabilities in Azure resources and servers.

When would these options actually be correct?

A question asking for a solution to protect endpoints (Windows/Linux servers, workstations) from advanced threats, with capabilities for antivirus, EDR, and vulnerability management on those devices, would make Defender for Endpoint the correct answer.

A question asking for a cloud-native SIEM that ingests security data from multiple sources (e.g., Azure, on-premises, other clouds) to detect, investigate, and respond to threats, and that provides advanced analytics and automation for incident response.

A question asks: 'Which Microsoft solution should an organization use to classify sensitive data across Azure, on-premises, and multi-cloud environments, and enforce data protection policies?'

Why candidates pick the wrong answer

Candidates may confuse Defender for Endpoint's vulnerability management features for servers with the broader cloud security posture management (CSPM) capabilities of Defender for Cloud, especially since both can assess server vulnerabilities.

Candidates may confuse Sentinel's security monitoring capabilities with the posture assessment and vulnerability management features of Defender for Cloud, especially since both involve security analysis.

Candidates may confuse Purview's data security capabilities (like data classification and labeling) with general security posture assessment, or they might think 'Purview' covers all security due to its broad name.

Full explanation →

1152

MCQmedium

Your company is deploying Microsoft Defender for Cloud Apps. You need to detect and block the use of unsanctioned cloud apps that exhibit risky behavior. Which feature should you configure?

A.Azure Information Protection labels

B.Conditional Access policies

C.Cloud Discovery

D.Data Loss Prevention (DLP) policies

AnswerC

Cloud Discovery, a core feature of Microsoft Defender for Cloud Apps, analyzes traffic logs from firewalls and proxy servers to identify all cloud applications accessed by users within an organization. It provides crucial visibility into 'shadow IT' by assessing the risk of discovered apps and can integrate with network security appliances to block access to unsanctioned or high-risk applications. This capability is fundamental for enforcing cloud app governance and reducing organizational risk.

Why this answer

Cloud Discovery is the correct feature because it analyzes traffic logs to identify unsanctioned cloud apps and assess their risk based on behavioral factors such as data upload volume, user count, and security posture. Once identified, Defender for Cloud Apps can automatically block these apps using the built-in app governance controls, enforcing policies to prevent risky app usage.

Exam trap

The trap here is that candidates often confuse Conditional Access policies (which control access to known apps) with Cloud Discovery (which identifies and blocks unknown or unsanctioned apps), missing the core requirement of detecting risky behavior in previously unrecognized cloud services.

How to eliminate wrong answers

Option A is wrong because Azure Information Protection labels classify and protect documents and emails based on sensitivity, not detect or block unsanctioned cloud apps. Option B is wrong because Conditional Access policies control access to sanctioned apps based on user, device, or location conditions, but they do not discover or block unsanctioned cloud apps. Option D is wrong because Data Loss Prevention (DLP) policies monitor and prevent unauthorized sharing of sensitive data within sanctioned apps, not detect or block unsanctioned cloud apps.

Full explanation →

1153

MCQhard

Your organization uses Microsoft Entra ID Governance. You need to ensure that access to a critical application is reviewed every 90 days by the application owner. If the review is not completed, access should be revoked automatically. Which feature should you configure?

A.Terms of use

B.Access reviews

C.Privileged Identity Management

D.Entitlement management

AnswerB

Microsoft Entra ID Access Reviews are specifically designed to manage the lifecycle of access to resources, groups, and applications by enabling regular, scheduled reviews. Administrators can configure these reviews to recur periodically, assign reviewers, and set up automatic actions, such as revoking access for users who are not approved or whose review is not completed within a specified timeframe. This functionality directly addresses the requirement for recurring access validation and automated revocation.

Why this answer

Access reviews in Microsoft Entra ID Governance allow you to create recurring reviews of group memberships or application assignments, with automatic revocation of access if the review is not completed. By configuring a review every 90 days and setting the 'Auto apply' action to 'Remove access', you ensure that the application owner must certify access or it is automatically revoked.

Exam trap

The trap here is that candidates confuse Entitlement management (which handles access packages and lifecycle) with Access reviews (which specifically handle recurring attestation and automatic revocation), leading them to pick D instead of B.

How to eliminate wrong answers

Option A is wrong because Terms of use are used to present legal or policy documents that users must accept before accessing applications, not to schedule recurring access reviews with automatic revocation. Option C is wrong because Privileged Identity Management (PIM) is designed for just-in-time privileged role activation and approval workflows, not for recurring attestation of access to a critical application. Option D is wrong because Entitlement management handles access packages and automated provisioning/deprovisioning based on policies, but it does not provide the recurring review cycle with automatic revocation if the review is not completed; that is the specific function of Access reviews.

Full explanation →

1154

MCQmedium

Refer to the exhibit. You run the Azure PowerShell command for a storage account. What is the current network access configuration?

A.The storage account is accessible only from specific virtual networks.

B.The storage account is accessible from all networks.

C.The storage account is not accessible from any network.

D.The storage account is accessible only from specific IP addresses.

AnswerC

With the DefaultAction set to Deny and both the IpRules and VirtualNetworkRules arrays being empty, there are no explicit rules configured to override the default denial. This combination ensures that all incoming network traffic, regardless of its origin (public internet or Azure virtual networks), is blocked. Therefore, the storage account is effectively inaccessible from any network.

Why this answer

The Azure PowerShell command `Update-AzStorageAccountNetworkRuleSet -ResourceGroupName 'RG1' -StorageAccountName 'stgacc1' -DefaultAction Deny` sets the default network access rule to Deny. When the default action is Deny, no traffic is allowed unless explicitly permitted by a network rule (e.g., from a specific virtual network or IP address). Since no such rules are shown in the exhibit, the storage account is effectively not accessible from any network.

Exam trap

Students often mistakenly think that setting `DefaultAction Deny` alone makes the storage account accessible from specific networks or IPs, but they must remember that explicit rules must also be configured for any access to be allowed.

How to eliminate wrong answers

Option A is wrong because while a default action of Deny can be overridden by virtual network rules, the exhibit does not show any virtual network rules being configured, so the storage account is not accessible from specific virtual networks. Option B is wrong because the command explicitly sets `-DefaultAction Deny`, which blocks all network traffic by default, making the storage account inaccessible from all networks. Option D is wrong because although IP rules could permit access from specific IP addresses, no IP rules are shown in the exhibit, so the storage account is not accessible from specific IP addresses.

Full explanation →

1155

MCQhard

A multinational company uses Microsoft Entra ID. They want to ensure that users from a specific country only access a sensitive application from compliant devices. Additionally, they want to block access if the sign-in risk is medium or high. Which combination of policies should they create?

A.A Conditional Access session policy to enforce sign-in frequency

B.A device compliance policy in Microsoft Intune

C.A Conditional Access policy requiring MFA from that country

D.A Conditional Access policy with conditions for location, device compliance, and sign-in risk

AnswerD

This Conditional Access policy effectively combines multiple critical signals to provide robust, risk-adaptive access control. By including conditions for location, device compliance, and sign-in risk (from Microsoft Entra ID Protection), it allows the system to evaluate the user's context comprehensively. This enables granular decisions, such as blocking access or requiring stronger authentication, specifically when a sign-in attempt is identified as risky based on these combined factors, directly addressing the company's security requirements.

Why this answer

A single Conditional Access policy can combine multiple conditions—such as location (country), device compliance (via integration with Intune), and sign-in risk—to enforce granular access controls. This allows the company to require compliant devices and block access when sign-in risk is medium or high, all within one policy.

Exam trap

The trap here is that candidates think they need separate policies for each condition (location, device compliance, risk), but Microsoft Entra ID allows combining all three conditions into a single Conditional Access policy, which is more efficient and aligns with the scenario's requirements.

How to eliminate wrong answers

Option A is wrong because sign-in frequency is a session control that re-prompts for authentication after a set time, not a condition to restrict access by location, device compliance, or risk. Option B is wrong because a device compliance policy in Intune defines compliance rules (e.g., encryption, OS version) but does not enforce access decisions or block based on sign-in risk; it only marks devices as compliant or non-compliant. Option C is wrong because requiring MFA from that country does not address device compliance or sign-in risk; it only adds an authentication step, not a block for medium/high risk or non-compliant devices.

Full explanation →

1156

MCQeasy

A small business wants to enable single sign-on (SSO) for its employees using their existing on-premises Active Directory. They plan to migrate to cloud-based identity management. Which Microsoft service should they use to connect their on-premises directory to Microsoft Entra ID?

A.Microsoft Entra Connect

B.Microsoft Intune

C.Active Directory Federation Services (AD FS)

D.Microsoft Entra Cloud Sync

AnswerA

This is correct because Microsoft Entra Connect synchronizes on-premises Active Directory with Microsoft Entra ID, enabling SSO through password hash sync or pass-through authentication.

Why this answer

Microsoft Entra Connect is the correct tool for synchronizing on-premises Active Directory with Microsoft Entra ID, enabling single sign-on (SSO). Option A is correct because it provides the primary and most comprehensive synchronization service for hybrid identity. Option C (AD FS) is for federation, not the primary synchronization service for connecting on-premises AD to Entra ID.

Option B (Microsoft Intune) is for device management, not identity synchronization. Option D (Microsoft Entra Cloud Sync) is a lightweight synchronization service that can connect on-premises AD and enable SSO via Password Hash Synchronization; however, Microsoft Entra Connect offers a broader range of SSO methods (including Pass-through Authentication and Seamless SSO) and comprehensive hybrid identity features (like device writeback and custom sync rules), making it the more complete and standard solution for connecting on-premises AD and enabling full SSO as implied by a general migration scenario.

Exam trap

The primary trap is confusing Microsoft Entra Cloud Sync (a lightweight sync agent) with Microsoft Entra Connect (the full hybrid identity tool). Cloud Sync can sync passwords and enable SSO, but it is designed for simple scenarios; for full SSO with features like seamless SSO, pass-through authentication, or writeback, Microsoft Entra Connect is the recommended service.

Full explanation →

1157

MCQhard

Refer to the exhibit. You are creating a custom analytics rule in Microsoft Sentinel. What does this rule detect?

A.Sign-ins with high sign-in risk from any location

B.Sign-ins with medium or high risk from the US

C.Sign-ins from users with high user risk outside the US

D.Sign-ins with medium or high risk from outside the US

AnswerD

This option accurately describes the criteria for the custom analytics rule. The rule targets sign-in attempts that Azure AD Identity Protection has classified with either a medium or high sign-in risk level. Additionally, it specifically filters these risky sign-ins to only include those originating from locations outside the United States, indicating a focus on external or geographically unusual threats.

Why this answer

The rule is configured with 'Risk level: Medium, High' and 'Location: Outside US'. This means it triggers only when both conditions are met: the sign-in risk is medium or high, and the location is outside the US. Option D correctly matches this combination, detecting sign-ins with medium or high risk from outside the US.

Exam trap

The trap here is confusing 'User risk' with 'Sign-in risk' — the rule explicitly uses sign-in risk, and candidates often misread the risk type or overlook the location filter, leading them to choose options that mix up these conditions.

How to eliminate wrong answers

Option A is wrong because the rule includes a location filter ('Outside US'), so it does not detect sign-ins from any location. Option B is wrong because the rule specifies 'Outside US' as the location, not 'from the US'. Option C is wrong because the rule uses 'Sign-in risk' (not 'User risk') as the risk type, and the location filter is 'Outside US', not 'outside the US' for user risk.

Full explanation →

1158

MCQmedium

A company wants to gain visibility into which cloud applications are being used by employees (shadow IT) and assess the risk level of each app. They use Microsoft Defender for Cloud Apps. Which feature should they enable to discover and analyze these apps?

A.App Governance

B.Cloud Discovery

C.Conditional Access App Control

D.OAuth app policies

AnswerB

Cloud Discovery, a core feature of Microsoft Defender for Cloud Apps, analyzes traffic logs from firewalls and proxy servers to identify all cloud applications accessed by users within an organization. It provides comprehensive visibility into both sanctioned and unsanctioned cloud services, often referred to as "shadow IT." This process helps security teams assess the risk associated with each discovered application and gain a complete understanding of cloud usage patterns.

Why this answer

Cloud Discovery is the correct feature because it analyzes traffic logs against the Microsoft Defender for Cloud Apps catalog of over 31,000 cloud apps to identify shadow IT usage. It provides risk scores based on factors like security certifications, data encryption, and compliance standards, enabling the company to assess each app's risk level.

Exam trap

The trap here is that candidates confuse Cloud Discovery (which finds unknown apps via traffic analysis) with Conditional Access App Control (which controls access to known apps), leading them to pick Option C for a discovery question.

How to eliminate wrong answers

Option A is wrong because App Governance is a policy and monitoring feature for managing OAuth-enabled apps (e.g., permissions and consent), not for discovering unknown cloud apps via traffic analysis. Option C is wrong because Conditional Access App Control is a reverse-proxy feature that enforces session policies on known apps in real time, not a discovery mechanism for shadow IT. Option D is wrong because OAuth app policies are used to control permissions for third-party OAuth apps connected to Microsoft 365, not to discover or analyze cloud applications in use.

Full explanation →

1159

Multi-Selecteasy

Which TWO of the following are features of Microsoft Sentinel? (Choose two.)

Select 2 answers

A.Identity governance and administration

B.Security information and event management (SIEM)

C.Security orchestration, automation, and response (SOAR)

D.Endpoint detection and response (EDR)

E.Data classification and labeling

AnswersB, C

Microsoft Sentinel's SIEM capabilities involve collecting security data at scale from diverse sources across an organization's entire digital estate. It then uses built-in analytics, machine learning, and threat intelligence to detect, investigate, and prioritize security threats. This centralized log management and threat detection are fundamental to its role as a modern cloud-native SIEM.

Why this answer

Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) solution that collects security data from across an organization, providing threat detection, investigation, and response. It also includes SOAR (Security Orchestration, Automation, and Response) capabilities through playbooks and automation rules, enabling automated incident response. These two features are core to Sentinel's functionality.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel's SIEM and SOAR capabilities with other Microsoft security products like Microsoft Defender for Endpoint (EDR) or Microsoft Purview (data classification), leading them to select options D or E instead of the correct SIEM and SOAR features.

Full explanation →

1160

Multi-Selectmedium

Which THREE of the following are features of Microsoft Entra ID Protection?

Select 3 answers

A.Automatically notify users when their password is about to expire.

B.Ability to define risk-based Conditional Access policies.

C.Automated remediation of risky users by blocking sign-in.

D.Just-in-time privileged role activation.

E.Detection of sign-in risks from anonymous IP addresses.

AnswersB, C, E

This is a core security feature of Microsoft Entra ID Protection, which integrates seamlessly with Conditional Access. Entra ID Protection continuously assesses sign-in and user risks in real-time, allowing administrators to define Conditional Access policies that dynamically enforce controls like multi-factor authentication, password change, or access blocking based on the perceived risk level of an authentication attempt.

Why this answer

Microsoft Entra ID Protection provides risk detection signals that can be integrated into Conditional Access policies, enabling administrators to automatically enforce controls such as requiring multi-factor authentication or blocking access based on user or sign-in risk levels. This allows organizations to respond dynamically to detected threats without manual intervention.

Exam trap

The trap here is that candidates confuse the distinct Microsoft Entra services—Entra ID Protection (risk detection and remediation), Privileged Identity Management (PIM) for just-in-time access, and general password policy settings—leading them to select options that belong to other services.

Full explanation →

1161

MCQeasy

A company uses Microsoft 365 and Microsoft Azure. The security team wants a single portal that provides a unified view of alerts and incidents from their endpoints, email, and cloud applications to accelerate threat investigation and response. Which Microsoft security solution should they use?

A.Microsoft 365 Defender portal

B.Microsoft Defender for Cloud

C.Microsoft Sentinel

D.Microsoft Purview Compliance Manager

AnswerA

The Microsoft 365 Defender portal is the unified security operations center for Microsoft 365 services. It consolidates alerts, incidents, and automated investigation and response capabilities from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Microsoft Defender for Cloud Apps. This centralized experience provides a comprehensive view of threats across the entire Microsoft 365 ecosystem, enabling security teams to efficiently investigate and remediate multi-stage attacks.

Why this answer

Microsoft 365 Defender portal (now part of the Microsoft 365 Defender unified security operations platform) is designed to aggregate alerts and incidents from endpoints (Microsoft Defender for Endpoint), email (Microsoft Defender for Office 365), and cloud applications (Microsoft Defender for Cloud Apps) into a single queue. This unified view enables security teams to triage and investigate threats across these domains without switching between separate consoles, directly accelerating response times.

Exam trap

The trap here is that candidates often confuse Microsoft 365 Defender portal (a unified incident view for Microsoft 365 security products) with Microsoft Sentinel (a SIEM), not realizing that Sentinel requires additional setup and is not the out-of-the-box single portal for Microsoft's own security alerts.

How to eliminate wrong answers

Option B (Microsoft Defender for Cloud) is wrong because it focuses on securing cloud infrastructure (VMs, containers, PaaS) and provides alerts for those resources, not for endpoints, email, or cloud apps in a unified incident view. Option C (Microsoft Sentinel) is wrong because it is a cloud-native SIEM/SOAR that ingests logs from many sources, but it requires custom configuration and data connectors to unify alerts; it is not a pre-built single portal for Microsoft 365-native alerts and incidents. Option D (Microsoft Purview Compliance Manager) is wrong because it is a compliance management solution for assessing and managing regulatory compliance, not a security incident and alert aggregation tool.

Full explanation →

1162

MCQmedium

A security operations team uses Microsoft Defender for Cloud and has connected their AWS and GCP accounts. They want to continuously assess the security posture of AWS EC2 instances against the CIS AWS Foundations Benchmark and receive prioritized recommendations. Which feature of Defender for Cloud should they use?

A.Cloud Security Posture Management (CSPM)

B.Microsoft Defender for Servers

C.Security Alerts

D.Workload protections

AnswerA

Cloud Security Posture Management (CSPM) is the core capability within Microsoft Defender for Cloud that continuously assesses cloud resources against security benchmarks and regulatory standards. It provides a secure score, identifies misconfigurations, and offers actionable recommendations to improve an organization's security posture across multi-cloud environments like Azure, AWS, and GCP. This proactive approach is essential for a security operations team focused on maintaining compliance and reducing attack surface.

Why this answer

Cloud Security Posture Management (CSPM) in Microsoft Defender for Cloud is specifically designed to continuously assess the security posture of multi-cloud resources (including AWS EC2 instances) against industry benchmarks like the CIS AWS Foundations Benchmark. CSPM provides a compliance dashboard, prioritized recommendations, and automated remediation guidance, directly addressing the team's need for ongoing assessment and prioritized recommendations.

Exam trap

The trap here is that candidates often confuse CSPM with workload protections (Option D) or Microsoft Defender for Servers (Option B), mistakenly thinking that threat detection or server-specific plans automatically include compliance assessment, when in fact CSPM is the dedicated feature for multi-cloud posture management and benchmark compliance.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Servers is a workload protection plan that provides advanced threat detection, just-in-time VM access, and file integrity monitoring for servers, but it does not natively assess compliance against the CIS AWS Foundations Benchmark or provide continuous posture assessment for AWS EC2 instances. Option C is wrong because Security Alerts are generated from threat detection signals (e.g., suspicious activities or attacks) and are not designed to continuously assess security posture against a compliance benchmark like CIS AWS Foundations. Option D is wrong because Workload protections refer to the suite of threat detection and prevention capabilities (e.g., for servers, databases, containers) within Defender for Cloud, but they do not include the compliance assessment and posture scoring features that CSPM provides.

Full explanation →

1163

MCQeasy

Your company uses Microsoft Defender for Cloud Apps. You want to discover which cloud apps are being used in your organization and assess their risk levels. What should you use?

A.Cloud App Security Catalog

B.Cloud Discovery

C.Microsoft Purview Data Map

D.Microsoft Intune app inventory

AnswerB

Cloud Discovery is the precise capability within Microsoft Defender for Cloud Apps designed to identify and analyze all cloud applications accessed by users across an organization's network. It functions by ingesting and analyzing traffic logs from various sources, including firewalls, proxies, and endpoint agents, to detect accessed URLs, IP addresses, and user agents. This process effectively uncovers shadow IT, assesses the inherent risk of discovered applications, and provides comprehensive insights into their usage patterns.

Why this answer

Cloud Discovery is the feature within Microsoft Defender for Cloud Apps that analyzes traffic logs to identify which cloud apps are being used in your organization and assesses their risk based on the Cloud App Security Catalog. It provides visibility into Shadow IT by discovering unsanctioned app usage and assigning a risk score to each app.

Exam trap

The trap here is confusing the Cloud App Security Catalog (a static risk database) with Cloud Discovery (the active monitoring and log analysis feature), leading candidates to pick A when they need the tool that actually discovers in-use apps.

How to eliminate wrong answers

Option A is wrong because the Cloud App Security Catalog is a database of over 31,000 cloud apps with risk scores, but it does not discover which apps are actually being used in your organization—it only provides risk assessment for known apps. Option C is wrong because Microsoft Purview Data Map is used for data governance, classification, and lineage tracking across on-premises and cloud data sources, not for discovering cloud app usage. Option D is wrong because Microsoft Intune app inventory focuses on managing and reporting on apps deployed through mobile device management (MDM) or mobile application management (MAM), not on discovering unsanctioned cloud apps via traffic analysis.

Full explanation →

1164

MCQeasy

A compliance officer needs to search for emails containing trade secrets across all mailboxes in the organization. Which Microsoft Purview solution should they use?

A.eDiscovery (Premium)

B.Communication Compliance

C.Data Loss Prevention

D.Audit (Standard)

AnswerA

eDiscovery (Premium) is the appropriate solution for a compliance officer who needs to search for specific email content across an organization's data. This service in Microsoft Purview enables robust content searches, legal holds, and the collection of electronically stored information (ESI) from various sources like Exchange mailboxes, SharePoint sites, and OneDrive accounts. It is specifically designed for investigative purposes, allowing for advanced querying, review, and export of relevant content.

Why this answer

eDiscovery (Premium) is the correct solution because it is specifically designed for legal and investigative searches across all mailboxes, including the ability to search for specific content like trade secrets using keyword queries and advanced features like predictive coding and review sets. It supports searching across Exchange Online mailboxes, SharePoint sites, and OneDrive for Business, making it ideal for a compliance officer conducting a broad, targeted search for sensitive information.

Exam trap

The trap here is that candidates often confuse Communication Compliance (which monitors for policy violations) with eDiscovery (which performs content searches), leading them to choose B because they think 'compliance' implies searching for trade secrets, but Communication Compliance is reactive and policy-based, not a search tool.

How to eliminate wrong answers

Option B (Communication Compliance) is wrong because it focuses on monitoring and detecting policy violations in communications (e.g., harassment, insider trading) based on configurable policies, not on performing ad-hoc searches for specific content like trade secrets across all mailboxes. Option C (Data Loss Prevention) is wrong because it is designed to prevent accidental or unauthorized sharing of sensitive data through policies that block or warn users in real-time, not to retrospectively search for existing emails containing specific content. Option D (Audit (Standard)) is wrong because it provides logging of user and admin activities (e.g., who accessed a mailbox or deleted an email) but does not allow searching the actual content of emails for specific keywords or phrases.

Full explanation →

1165

MCQhard

You are investigating an alert in Microsoft Sentinel. The exhibit shows the JSON output of an alert that was generated from a sign-in log. The alert is linked to an active incident. Which action should you take to prioritize the incident for investigation?

A.Change the incident severity to critical

B.Close the incident as a false positive

C.Delete the alert from the incident

D.Reassign the incident to another analyst

AnswerA

In Microsoft Sentinel, changing an incident's severity to "Critical" directly impacts its prioritization within the security operations center (SOC) workflow. This action signals to analysts that the incident requires immediate attention and resources, often triggering specific escalation procedures or service level agreements (SLAs) to ensure rapid investigation and remediation. It effectively moves the incident to the top of the queue, ensuring it receives the necessary focus.

Why this answer

Changing the incident severity to critical in Microsoft Sentinel directly influences the prioritization and triage workflow. By elevating the severity, the incident is flagged for immediate attention, ensuring it appears at the top of the queue for investigation. This action aligns with the incident management best practice of using severity levels to indicate business impact and urgency.

Exam trap

The trap here is that candidates may confuse 'reassigning' with 'prioritizing,' but reassignment only changes the owner, not the incident's severity or position in the queue, while severity directly controls triage order in Sentinel.

How to eliminate wrong answers

Option B is wrong because closing the incident as a false positive would dismiss the alert without investigation, which is inappropriate since the alert is linked to an active incident and requires analysis. Option C is wrong because deleting the alert from the incident would remove evidence and break the linkage, potentially losing context needed for investigation; alerts are meant to be retained for forensic purposes. Option D is wrong because reassigning the incident to another analyst does not prioritize it; it merely changes ownership without affecting its urgency or visibility in the queue.

Full explanation →

1166

MCQeasy

Your company uses Microsoft Defender for Cloud to secure Azure resources. You need to assess compliance with the CIS benchmark. What should you enable?

A.Azure Policy

B.Regulatory compliance standards in Microsoft Defender for Cloud

C.Microsoft Sentinel

D.Azure Firewall

AnswerB

Microsoft Defender for Cloud's regulatory compliance dashboard is specifically designed to provide a centralized view of an organization's compliance posture against various industry standards and regulatory benchmarks, including the CIS Benchmarks. It continuously assesses Azure resources, identifies security misconfigurations, and maps these findings to specific controls within selected standards. This feature directly enables organizations to track, manage, and improve their compliance with frameworks like CIS by offering actionable recommendations.

Why this answer

To assess compliance with the CIS benchmark in Microsoft Defender for Cloud, you must enable the appropriate regulatory compliance standard. Defender for Cloud includes built-in support for industry standards like CIS, and by adding the CIS benchmark as a regulatory compliance standard, the service continuously assesses your Azure resources against the CIS controls and displays compliance status in the dashboard.

Exam trap

The trap here is that candidates confuse Azure Policy (the mechanism) with the regulatory compliance standards feature (the pre-built benchmark mapping), leading them to select Azure Policy instead of the correct option that activates the CIS benchmark assessment in Defender for Cloud.

How to eliminate wrong answers

Option A is wrong because Azure Policy is the underlying engine that enforces rules and evaluates resources, but it does not itself provide the CIS benchmark assessment; you must enable the specific regulatory compliance standard within Defender for Cloud to map CIS controls to Azure Policy initiatives. Option C is wrong because Microsoft Sentinel is a SIEM/SOAR solution for threat detection and incident response, not a compliance assessment tool for benchmarks like CIS. Option D is wrong because Azure Firewall is a network security service that filters traffic, and it has no role in evaluating resource configurations against the CIS benchmark.

Full explanation →

1167

MCQeasy

A user logs into a company's application using their username and password. After logging in, the application checks whether the user belongs to the 'Admin' role before granting access to the user management page. Which security concept is primarily illustrated by the role check?

A.Authentication

B.Authorization

C.Accounting

D.Non-repudiation

AnswerB

Authorization is the process of granting or denying access to resources based on the authenticated user's permissions. The role check determines if the user is authorized to access the user management page, making this the correct answer.

Why this answer

The role check after login determines what actions the authenticated user is allowed to perform, specifically whether they can access the user management page. This is the essence of authorization, which controls access to resources based on identity and assigned permissions. In Microsoft identity and access management, authorization is enforced via role-based access control (RBAC), where the application verifies the user's role claim (e.g., 'Admin') in the access token.

Exam trap

Microsoft often tests the distinction between authentication and authorization by presenting a scenario where a user is already logged in and then a permission check occurs, leading candidates to mistakenly select 'authentication' because they focus on the login step rather than the subsequent access control decision.

Why the other options are wrong

The role check occurs after the user has already logged in, meaning authentication (verifying identity via username/password) is complete. The check determines what the user is allowed to do, which is authorization, not authentication.

Accounting refers to tracking user activities and resource usage (auditing), not to checking permissions after authentication. The role check determines access rights, which is authorization.

Non-repudiation ensures that a user cannot deny having performed an action, typically through digital signatures or audit logs. The role check in this question determines access rights based on identity, not proof of action.

When would these options actually be correct?

A question that asks: 'A user provides their username and password to access a system. Which security concept does this step represent?' In that context, the correct answer would be authentication, as it verifies the user's identity.

A question asks: 'An organization needs to track which users accessed sensitive data and when. Which security concept is primarily involved?' Here, accounting (auditing) would be correct as it logs user actions for review.

A question that asks: 'After a user performs a financial transaction, the system logs the transaction with a digital signature to prevent the user from denying they made it. Which security concept is this?' would have non-repudiation as the correct answer.

Why candidates pick the wrong answer

Candidates often confuse authentication and authorization because both involve user identity and access control, and the role check happens after login, making it seem like part of the authentication process.

Candidates may confuse 'accounting' with 'authorization' because both involve user identity and access, but accounting is about logging and monitoring, not permission checks.

Candidates may confuse non-repudiation with authorization because both involve verifying user identity, but non-repudiation focuses on accountability for actions rather than access control.

Full explanation →

1168

MCQmedium

Your company uses Microsoft Intune for device management. You need to ensure that all company data on a user's personally owned device is removed when the user is offboarded, but the user's personal data should remain. Which wipe action should you use?

A.Delete

B.Selective wipe

C.Full wipe

D.Retire

AnswerB

Selective wipe removes only company data from managed apps.

Why this answer

Selective wipe removes only company data from Intune-managed apps, leaving personal data intact. Full wipe resets the device and deletes all data. Delete removes the device from Intune management but does not wipe data.

Retire removes the device from management and removes company data; however, the action that specifically performs a selective wipe of company data is Selective wipe.

Full explanation →

1169

MCQmedium

A company wants to detect and respond to advanced attacks targeting their on-premises Active Directory infrastructure, such as Kerberos Golden Ticket attacks, pass-the-hash, and brute-force attempts. The solution should integrate with Microsoft Sentinel and Microsoft 365 Defender for cross-domain investigations. Which Microsoft security solution should they deploy?

A.Microsoft Defender for Endpoint

B.Microsoft Defender for Identity

C.Microsoft Defender for Office 365

D.Microsoft Defender for Cloud Apps

AnswerB

Microsoft Defender for Identity is purpose-built to monitor on-premises Active Directory (AD) and hybrid environments for advanced threats. It deploys sensors directly on domain controllers and AD FS servers to analyze network traffic and Windows events, detecting suspicious user and entity behavior, reconnaissance activities, lateral movement paths, and privilege escalation techniques like Pass-the-Hash or Golden Ticket attacks. This specialized focus on identity-based threats within the AD infrastructure makes it the ideal solution for protecting against attacks targeting an organization's core directory services.

Why this answer

Microsoft Defender for Identity (MDI) is specifically designed to protect on-premises Active Directory by monitoring for advanced attacks like Kerberos Golden Ticket, pass-the-hash, and brute-force attempts. It integrates natively with Microsoft Sentinel and Microsoft 365 Defender to enable cross-domain investigations, correlating identity signals with endpoint and cloud data.

Exam trap

The trap here is that candidates often confuse Defender for Identity with Defender for Endpoint, assuming endpoint protection covers identity attacks, but MDI is the only solution that directly monitors Active Directory authentication protocols and domain controller traffic for advanced on-premises identity threats.

Why the other options are wrong

Microsoft Defender for Endpoint focuses on endpoint devices (e.g., workstations, servers) and does not specifically monitor or protect on-premises Active Directory infrastructure against attacks like Kerberos Golden Ticket or pass-the-hash.

Microsoft Defender for Office 365 protects email and collaboration tools, not on-premises Active Directory. It cannot detect Kerberos Golden Ticket attacks or pass-the-hash targeting AD.

Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that protects cloud applications, not on-premises Active Directory. It cannot detect Kerberos Golden Ticket attacks or pass-the-hash on on-premises AD.

When would these options actually be correct?

A company wants to detect and respond to advanced attacks on endpoints, such as fileless malware, ransomware, or post-breach activities on workstations and servers, and needs integration with Microsoft Sentinel and Microsoft 365 Defender for cross-domain investigations.

A question asking for a solution to protect against phishing, malware, and advanced threats in email and Office 365 apps, with integration into Microsoft Sentinel and Microsoft 365 Defender for cross-domain investigations.

A company wants to discover and control the use of shadow IT cloud apps, enforce data loss prevention policies for SaaS applications, and detect anomalous behavior in cloud app usage. The solution must integrate with Microsoft Sentinel for investigation.

Why candidates pick the wrong answer

Candidates may assume that Defender for Endpoint covers all security needs, including Active Directory, because it is a comprehensive endpoint protection solution, but it lacks the specific AD security capabilities of Defender for Identity.

Candidates may confuse the 'Defender' branding and assume all Defender products cover similar threats, or they may think Office 365 includes AD protection due to Azure AD Connect.

Candidates may think Defender for Cloud Apps covers all security aspects including on-premises, or they confuse its identity protection capabilities with those of Defender for Identity.

Full explanation →

1170

Multi-Selecthard

Which TWO Microsoft Entra ID capabilities help detect and remediate identity risks? (Select two.)

Select 2 answers

A.Identity Protection

B.Identity Governance

C.Password protection

D.Privileged Identity Management

E.Conditional Access

AnswersA, E

Identity Protection detects risk detections.

Why this answer

Identity Protection (A) is correct because it uses machine learning and heuristics to detect identity-based risks such as leaked credentials, impossible travel, and anomalous sign-in behavior. It provides automated remediation actions like requiring password reset or blocking sign-in, directly addressing risk detection and remediation.

Exam trap

The trap here is that candidates often confuse Privileged Identity Management (PIM) with risk remediation, but PIM only manages privileged role activation and does not detect or automatically remediate identity risks.

Full explanation →

1171

Multi-Selecteasy

Which TWO Microsoft Purview solutions can be used to identify and protect sensitive data in Microsoft 365?

Select 2 answers

A.Data Loss Prevention (DLP)

B.Communication compliance

C.Insider risk management

D.Sensitivity labels

E.eDiscovery

AnswersA, D

Microsoft Purview Data Loss Prevention (DLP) policies are designed to identify, monitor, and automatically protect sensitive information across various locations, including Microsoft 365 services, endpoints, and non-Microsoft cloud apps. DLP utilizes sensitive information types, keywords, and content matching to detect sensitive data, such as credit card numbers or national ID numbers, both at rest and in transit. Upon detection, DLP can block sharing, notify users, or encrypt the content, effectively identifying and protecting the data.

Why this answer

Data Loss Prevention (DLP) is correct because it uses content analysis (e.g., keyword matching, regex patterns, and machine learning classifiers) to detect and automatically protect sensitive data like credit card numbers or PII across Exchange, SharePoint, OneDrive, and Teams. Sensitivity labels are correct because they classify and protect data at rest and in transit by applying encryption, visual markings, and access restrictions based on label policies, enabling persistent protection even when data leaves Microsoft 365.

Exam trap

The trap here is that candidates confuse 'identifying and protecting sensitive data' with broader compliance solutions like Communication compliance or Insider risk management, which address behavioral monitoring rather than data classification and protection.

Full explanation →

1172

MCQmedium

Your company uses Microsoft Entra ID. You need to enable users to sign in to third-party SaaS applications using their corporate credentials without storing passwords in those apps. Which Microsoft Entra feature should you configure?

A.Configure single sign-on (SSO) using federation

B.Deploy Microsoft Entra Self-Service Password Reset

C.Configure conditional access policies with MFA

D.Enable Microsoft Entra Identity Protection

AnswerA

Configuring single sign-on (SSO) using federation establishes a trust relationship where Microsoft Entra ID acts as the identity provider. When users access an application, they are redirected to Entra ID for authentication. Upon successful verification, Entra ID issues a security token to the application, granting access without the application ever storing or directly handling the user's password, thereby centralizing authentication and eliminating application-specific credential storage.

Why this answer

Configuring single sign-on (SSO) using federation allows users to authenticate against Microsoft Entra ID (their corporate identity provider) and then pass a security token to third-party SaaS applications. This eliminates the need for the SaaS app to store or manage user passwords, as authentication happens via standards like SAML 2.0 or WS-Federation, and the app trusts the token issued by Entra ID.

Exam trap

The trap here is that candidates often confuse Conditional Access or Identity Protection with the core mechanism for passwordless federation, not realizing that SSO via federation is the specific feature that removes password storage in the third-party app.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra Self-Service Password Reset (SSPR) enables users to reset their own passwords, but it does not provide a mechanism to sign in to third-party SaaS apps without storing passwords in those apps. Option C is wrong because Conditional Access policies with MFA enforce additional security controls (like requiring multi-factor authentication) during sign-in, but they do not eliminate the need for password storage in the SaaS app itself. Option D is wrong because Microsoft Entra Identity Protection detects and responds to identity-based risks (e.g., leaked credentials, anomalous sign-ins), but it does not enable passwordless or federated authentication to third-party applications.

Full explanation →

1173

Multi-Selecteasy

Which TWO are capabilities of Microsoft Entra ID Protection?

Select 2 answers

A.Risk-based conditional access policies

B.Device enrollment policies

C.Self-service password reset

D.Privileged role activation

E.Detection of leaked credentials

AnswersA, E

Microsoft Entra ID Protection continuously monitors user and sign-in behavior to detect various types of risks, such as impossible travel or anomalous IP addresses. It then feeds these real-time risk detections into Microsoft Entra Conditional Access policies. These policies can be configured to automatically enforce specific access controls, like blocking access, requiring multifactor authentication (MFA), or forcing a password change, based on the calculated user or sign-in risk level. This capability is central to adaptive access control.

Why this answer

Microsoft Entra ID Protection uses risk-based conditional access policies to automatically respond to detected risks, such as blocking access or requiring multi-factor authentication, based on real-time risk levels. Option E is correct because Entra ID Protection continuously monitors for leaked credentials by analyzing known credential breaches and flagging accounts whose credentials have been exposed, enabling proactive remediation.

Exam trap

The trap here is that candidates confuse Entra ID Protection with other Entra ID features like SSPR or PIM, but Entra ID Protection is specifically about risk detection and automated remediation, not password management or privileged access control.

Full explanation →

1174

MCQeasy

A company wants to protect against ransomware by detecting and blocking malicious files in email attachments. Which Microsoft security solution should be used?

A.Microsoft Defender for Identity

B.Microsoft Defender for Cloud Apps

C.Microsoft Defender for Office 365

D.Microsoft Defender for Endpoint

AnswerC

Microsoft Defender for Office 365 is the dedicated security service engineered to protect an organization's email, collaboration, and productivity tools within Microsoft 365 from advanced threats. It employs robust capabilities like Safe Attachments, which detonates suspicious attachments in a sandbox environment, and Safe Links, which rewrites and scans URLs at the time of click. This comprehensive protection specifically targets ransomware, phishing, business email compromise, and other sophisticated malware delivered via email or Microsoft Teams, making it the correct solution for detecting email-borne ransomware.

Why this answer

Microsoft Defender for Office 365 includes Safe Attachments and Safe Links features that scan email attachments in real-time using detonation chambers and machine learning to detect and block ransomware and other malicious files. This solution is specifically designed to protect Exchange Online and SharePoint Online from threats delivered via email, making it the correct choice for blocking malicious attachments.

Exam trap

The trap here is that candidates often confuse endpoint protection (Defender for Endpoint) with email security, forgetting that Defender for Office 365 is the dedicated solution for email-borne threats like malicious attachments in ransomware attacks.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Identity focuses on detecting identity-based threats like Kerberos attacks, pass-the-hash, and lateral movement using Active Directory signals, not on scanning email attachments. Option B is wrong because Microsoft Defender for Cloud Apps is a CASB that provides visibility and control over cloud app usage, including shadow IT and data exfiltration, but does not perform inline email attachment scanning for ransomware. Option D is wrong because Microsoft Defender for Endpoint protects endpoints (workstations, servers) from malware and ransomware via behavioral sensors and antivirus, but it does not scan email attachments within Exchange Online or SharePoint.

Full explanation →

1175

MCQeasy

A company has a hybrid identity environment with Active Directory synchronizing to Microsoft Entra ID. They want users to be able to reset their own on-premises passwords via the cloud SSPR portal. What is the minimum license required for this capability?

A.Microsoft Entra ID Free

B.Microsoft Entra ID P1

C.Microsoft Entra ID P2

D.Microsoft 365 Business Basic

AnswerB

Microsoft Entra ID P1 is the minimum required license tier to enable Self-Service Password Reset (SSPR) with password writeback in a hybrid identity environment. This tier provides the necessary functionality to allow users to reset their passwords in the cloud, and then have those changes securely synchronized back to their corresponding accounts in the on-premises Active Directory. This ensures a consistent password across both environments and fulfills the requirements of the question.

Why this answer

Microsoft Entra ID P1 is the minimum license required for password writeback, which enables users to reset their on-premises Active Directory passwords via the cloud SSPR portal. This feature requires Microsoft Entra ID P1 or higher because it involves synchronizing password changes back to on-premises AD using Microsoft Entra Connect.

Exam trap

The trap here is that candidates often assume Microsoft Entra ID Free or a basic Microsoft 365 license is sufficient for SSPR, forgetting that password writeback to on-premises AD is a premium feature requiring at least P1.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Free does not include password writeback; it only supports cloud-only SSPR without on-premises writeback. Option C is wrong because Microsoft Entra ID P2 includes P1 features plus Identity Protection and Privileged Identity Management, but P1 already provides password writeback, so P2 is not the minimum. Option D is wrong because Microsoft 365 Business Basic includes Microsoft Entra ID Free, not P1, and thus lacks password writeback capability.

Full explanation →

1176

MCQeasy

A company has enabled Microsoft Defender for Cloud. They want to assess their Azure resources for compliance with security benchmarks like CIS and Azure Security Benchmark, and view a secure score. Which feature of Defender for Cloud provides this capability?

A.Cloud Security Posture Management (CSPM)

B.Microsoft Defender for Servers

C.Microsoft Defender for App Service

D.Just-in-time (JIT) VM access

AnswerA

Cloud Security Posture Management (CSPM) is the foundational capability within Microsoft Defender for Cloud that provides continuous, real-time assessment of an organization's security posture across its cloud environments. It automatically identifies misconfigurations, vulnerabilities, and compliance deviations against industry benchmarks like CIS and regulatory standards. CSPM generates a secure score, offering actionable recommendations to improve security and maintain compliance, making it the direct answer for assessing posture.

Why this answer

Cloud Security Posture Management (CSPM) is the Defender for Cloud feature specifically designed to assess Azure resources against industry security benchmarks such as CIS and the Azure Security Benchmark. It continuously evaluates your environment, provides a secure score based on compliance findings, and offers actionable recommendations to improve your security posture. This directly matches the scenario's requirement for benchmark compliance assessment and secure score visibility.

Exam trap

The trap here is that candidates often confuse workload protection plans (like Defender for Servers) with posture management features, assuming any 'Defender' plan includes compliance assessment, whereas CSPM is the dedicated feature for benchmarks and secure score.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Servers is a workload protection plan that provides advanced threat detection and just-in-time access for virtual machines, not a posture management or compliance benchmarking service. Option C is wrong because Microsoft Defender for App Service is a threat detection service focused on attacks targeting App Service applications, such as DDoS or injection attacks, and does not assess compliance with CIS or Azure Security Benchmark. Option D is wrong because Just-in-time (JIT) VM access is a feature that reduces the attack surface by controlling network access to VMs, but it does not perform compliance assessments or generate a secure score.

Full explanation →

1177

MCQeasy

Your organization needs to automatically detect and prevent accidental sharing of sensitive data in Microsoft Teams messages. Which Microsoft Purview solution should you use?

A.Retention policies

B.Data Loss Prevention (DLP)

C.eDiscovery

D.Sensitivity labels

AnswerB

DLP policies can detect sensitive data in transit and block sharing in Teams messages.

Why this answer

Data Loss Prevention (DLP) is the correct solution because it is specifically designed to automatically detect and prevent accidental sharing of sensitive data, such as credit card numbers or personally identifiable information (PII), in Microsoft Teams messages. DLP policies can scan messages in real time, apply actions like blocking the message or sending a policy tip to the user, and integrate with Microsoft Teams' chat and channel infrastructure. This directly addresses the requirement for automatic detection and prevention of accidental data sharing.

Exam trap

The trap here is that candidates confuse sensitivity labels with DLP because both deal with data protection, but sensitivity labels are for classification and encryption, not real-time detection and prevention of accidental sharing in messages.

How to eliminate wrong answers

Option A is wrong because retention policies are used to preserve or delete content for compliance or legal reasons, not to detect or prevent data sharing in real time. Option C is wrong because eDiscovery is a search and export tool for legal investigations, not a preventive control that blocks sensitive data from being shared. Option D is wrong because sensitivity labels classify and protect data with encryption or visual markings but do not automatically detect and prevent sharing of sensitive data in Teams messages; they require manual application or automatic labeling based on content, not real-time message scanning.

Full explanation →

1178

MCQhard

A compliance officer is tasked with continuously assessing the organization's compliance posture against GDPR and ISO 27001. The solution should generate a compliance score based on implemented controls, provide recommended improvement actions, and track remediation progress over time. Which Microsoft Purview solution should they use?

A.Audit (Premium)

B.Communication Compliance

C.Compliance Manager

D.Data Lifecycle Management

AnswerC

Compliance Manager provides built-in assessments, a compliance score, recommended actions, and supports ongoing tracking of improvement activities for standards like GDPR and ISO 27001.

Why this answer

Compliance Manager is the correct solution because it provides a continuous compliance score based on implemented controls, offers recommended improvement actions, and tracks remediation progress over time. It supports frameworks like GDPR and ISO 27001 by mapping controls to assessments and generating a dynamic score that reflects the organization's compliance posture.

Exam trap

The trap here is that candidates confuse Compliance Manager with Audit (Premium) because both involve compliance, but Audit is for log investigation, not for scoring or tracking control implementation against a framework.

Why the other options are wrong

Audit (Premium) provides advanced auditing capabilities for forensic and security investigations, but it does not generate compliance scores, recommend improvement actions, or track remediation progress against frameworks like GDPR or ISO 27001.

Communication Compliance is designed to detect and remediate inappropriate communications (e.g., harassment, insider trading), not to assess compliance posture against regulations like GDPR or ISO 27001 or generate compliance scores.

Data Lifecycle Management focuses on governing data retention and deletion policies, not on assessing compliance posture, generating scores, or tracking remediation against frameworks like GDPR and ISO 27001.

When would these options actually be correct?

An organization needs to enable long-term retention of audit logs, customize audit log retention policies, and gain high-bandwidth access to the Office 365 Management Activity API for security and compliance investigations.

An organization needs to detect and prevent policy violations in communications, such as offensive language or sharing confidential information, and enforce communication policies. The question would ask for a solution to monitor employee communications for regulatory compliance (e.g., SEC rules).

A question asking for a solution to automatically retain or delete data based on regulatory requirements (e.g., GDPR right to erasure) or to manage data expiration and archiving would make Data Lifecycle Management the correct answer.

Why candidates pick the wrong answer

Candidates may confuse 'Audit' with 'Compliance Manager' because both are under Microsoft Purview and relate to compliance, but Audit focuses on logging and investigation, not continuous assessment and scoring.

The term 'compliance' in the name leads candidates to assume it covers all compliance scenarios, but it specifically addresses communication risks, not overall compliance management.

Candidates may confuse data lifecycle management with compliance management because both involve regulatory requirements, but Data Lifecycle Management does not provide compliance scoring or remediation tracking.

Full explanation →

1179

MCQhard

Your company uses Microsoft Entra ID and is implementing a zero-trust security model. You need to ensure that all access requests to sensitive applications are verified continuously, not just at the initial sign-in. Which Microsoft Entra ID capability should you use?

A.Conditional Access with session controls

B.Access reviews

C.Microsoft Entra Identity Protection

D.Privileged Identity Management

AnswerA

Conditional Access policies, specifically when configured with session controls and leveraging Continuous Access Evaluation (CAE), are designed to provide real-time verification during an active user session. CAE allows Microsoft Entra ID to revoke access tokens almost instantly in response to critical security events, such as a user's account being disabled, a password change, or a change in MFA location. This ensures that access is continuously evaluated against policy requirements throughout the session, not just at initial sign-in, making it the correct solution for continuous verification.

Why this answer

Conditional Access with session controls enforces continuous access evaluation (CAE) by intercepting real-time signals—such as user risk, device compliance, or location changes—after the initial authentication. This ensures that access to sensitive applications is verified throughout the session, not just at sign-in, aligning with the zero-trust principle of 'verify explicitly and continuously.'

Exam trap

The trap here is that candidates often confuse periodic reviews (Access reviews) or risk detection (Identity Protection) with real-time enforcement, but only session controls under Conditional Access provide the continuous, event-driven verification required by zero-trust.

How to eliminate wrong answers

Option B is wrong because Access reviews are periodic attestation workflows that require manual or scheduled re-certification of group memberships or application access; they do not provide real-time, continuous verification of each access request. Option C is wrong because Microsoft Entra Identity Protection focuses on detecting and responding to identity-based risks (e.g., leaked credentials, anomalous sign-ins) but does not enforce session-level controls or continuous verification of access to specific applications. Option D is wrong because Privileged Identity Management (PIM) manages just-in-time activation and approval workflows for privileged roles, not continuous verification of all access requests to sensitive applications.

Full explanation →

1180

MCQhard

Your organization uses Microsoft Defender for Cloud Apps. You need to discover shadow IT usage. Which feature should you enable?

A.File policies

B.Conditional Access App Control

C.Cloud Discovery

D.App catalog

AnswerC

Cloud Discovery analyzes traffic logs to identify shadow IT.

Why this answer

Cloud Discovery analyzes traffic logs to identify shadow IT. Option A is incorrect because file policies are used for data protection and monitoring, not for discovering shadow IT. Option B is incorrect because Conditional Access App Control enforces policies on sanctioned apps, not for discovery.

Option D is incorrect because the app catalog lists known cloud apps, not for discovering unknown usage.

Full explanation →

1181

MCQmedium

Your organization requires that all external guest users must sign in using Microsoft Authenticator for MFA. What should you configure?

A.Conditional Access policy

B.Microsoft Entra B2B collaboration settings

C.Access reviews

D.ID Protection policies

AnswerA

A Conditional Access policy is the definitive control plane in Microsoft Entra ID for enforcing specific access requirements, such as multi-factor authentication (MFA), based on various conditions. By targeting 'All guest and external users' and requiring MFA, organizations can ensure that all external collaborators must satisfy this strong authentication method before accessing resources, regardless of their home tenant's policies. This provides a robust security posture for external access by integrating MFA directly into the sign-in flow.

Why this answer

A Conditional Access policy is the correct choice because it allows you to enforce MFA requirements for specific users, including external guest users, based on conditions such as sign-in risk, location, or device state. By targeting the 'Guest or external users' directory role in a Conditional Access policy, you can require Microsoft Authenticator as the MFA method, overriding default settings. This provides granular control over authentication behavior for B2B collaboration guests.

Exam trap

The trap here is that candidates confuse the high-level B2B collaboration settings (which only control trust of MFA from the home tenant) with the ability to enforce a specific MFA method directly on guest users, which requires a Conditional Access policy.

How to eliminate wrong answers

Option B (Microsoft Entra B2B collaboration settings) is wrong because these settings control invitation, redemption, and cross-tenant access policies, but they do not directly enforce MFA methods like Microsoft Authenticator; they only set trust settings for MFA from the guest's home tenant. Option C (Access reviews) is wrong because access reviews are used to periodically review and recertify user access, not to enforce authentication methods or MFA requirements. Option D (ID Protection policies) is wrong because ID Protection policies focus on risk-based conditional access (e.g., sign-in risk, user risk) and can trigger MFA, but they do not allow you to specify a particular MFA method like Microsoft Authenticator; that is done via Conditional Access grant controls.

Full explanation →

1182

Multi-Selecthard

Which THREE of the following are capabilities of Microsoft Purview Data Loss Prevention (DLP)? (Choose three.)

Select 3 answers

A.Detect credit card numbers in Exchange Online emails

B.Block network traffic from suspicious IP addresses

C.Detect sensitive information in Microsoft Teams messages

D.Detect malware in email attachments

E.Detect passport numbers in SharePoint Online documents

AnswersA, C, E

DLP can scan email content for sensitive info.

Why this answer

Options A, C, and E are correct. Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive information such as credit card numbers in Exchange Online emails (A), detect sensitive information in Microsoft Teams messages (C), and detect passport numbers in SharePoint Online documents (E). Option B is incorrect because blocking network traffic from suspicious IP addresses is a network security feature, not a DLP capability.

Option D is incorrect because detecting malware in email attachments is the function of Microsoft Defender for Office 365, not DLP.

Full explanation →

1183

MCQmedium

A company uses Microsoft Entra ID. The security team needs to block all sign-in attempts from a list of known malicious IP addresses. They also want to block sign-ins that originate from anonymous proxy services. Which Microsoft Entra capability should they configure to meet these requirements?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management

D.Access Reviews

AnswerA

Microsoft Entra Conditional Access is the primary policy engine within Microsoft Entra ID for enforcing access decisions based on various conditions, including user location. By configuring "named locations," administrators can define specific trusted or untrusted IP address ranges. A Conditional Access policy can then be created to explicitly block sign-in attempts originating from these designated malicious IP ranges or from anonymous IP addresses, directly addressing the requirement to prevent access from specific unwanted network origins.

Why this answer

Conditional Access policies in Microsoft Entra ID allow administrators to define conditions under which sign-ins are blocked or allowed. By configuring a policy that includes 'Locations' as a condition, you can specify a list of known malicious IP addresses and also enable the 'Anonymous IP address' risk detection to block sign-ins from anonymous proxy services. This directly meets the requirement to block sign-ins from both specific IPs and anonymous proxies.

Exam trap

The trap here is that candidates often confuse Identity Protection’s risk detection capabilities with the enforcement mechanism, mistakenly thinking Identity Protection alone can block sign-ins, when in fact it only identifies risks and requires Conditional Access to enforce the block.

How to eliminate wrong answers

Option B (Identity Protection) is wrong because Identity Protection is a risk-based detection and remediation service that identifies suspicious sign-ins (e.g., from anonymous IPs) but does not itself enforce blocking; it relies on Conditional Access policies to take action. Option C (Privileged Identity Management) is wrong because PIM focuses on just-in-time privileged role activation and access governance, not on blocking sign-ins based on IP address or proxy services. Option D (Access Reviews) is wrong because Access Reviews are used to periodically audit and certify user access to resources, not to block sign-ins in real time based on location or network characteristics.

Full explanation →

1184

MCQmedium

Your company is implementing a zero-trust security model. Which principle requires verifying every access request as though it originates from an untrusted network, even if the request comes from within the corporate network?

A.Least privilege

B.Trust but verify

C.Explicit verification

D.Assume breach

AnswerC

Explicit verification is the zero-trust principle that requires verifying every access request as if originating from an untrusted network.

Why this answer

'Explicit verification' is the zero-trust principle that requires verifying every access request as though it originates from an untrusted network, regardless of the source. Option A is incorrect because 'Least privilege' limits access rights but does not inherently treat all requests as untrusted. Option B is incorrect because 'Trust but verify' is a traditional security model that trusts internal networks, contradicting zero-trust.

Option D is incorrect because 'Assume breach' focuses on minimizing the impact of a breach, not on verifying every access request.

Full explanation →

1185

MCQmedium

Your organization uses Microsoft Defender for Cloud Apps. Security team wants to be alerted when a user accesses a cloud app from a risky IP address. Which solution should you use to create a policy that triggers an alert based on this activity?

A.Create an activity policy.

B.Create a session policy.

C.Create an app discovery policy.

D.Create an access policy.

AnswerA

Activity policies in Microsoft Defender for Cloud Apps are designed to monitor user and admin activities across connected cloud applications. They allow organizations to define specific conditions, such as access from a risky IP address or unusual download volumes, and then trigger alerts or automated governance actions when these conditions are met. This makes them ideal for detecting and responding to suspicious behavior or policy violations after an activity has occurred, providing crucial visibility into potential threats.

Why this answer

Activity policies in Microsoft Defender for Cloud Apps monitor specific user activities (such as logins or file downloads) and can trigger alerts based on risk factors like the user's IP address. To be alerted when a user accesses a cloud app from a risky IP, an activity policy is appropriate. Session policies (Option B) control real-time session access and can block or allow actions but are not designed for alerting based on IP alone.

App discovery policies (Option C) identify shadow IT and unsanctioned apps, not user activity alerts. Access policies (Option D) enforce conditional access requirements but do not primarily generate IP-based alerts.

Full explanation →

1186

MCQeasy

A company wants to monitor employee communications for potential harassment or policy violations. Which Microsoft Purview solution should they use?

A.Data Loss Prevention (DLP)

B.eDiscovery

C.Communication compliance

D.Insider risk management

AnswerC

Microsoft Purview Communication Compliance is purpose-built to help organizations detect, investigate, and act on inappropriate messages within their Microsoft 365 environment. It leverages machine learning and customizable policies to identify potential policy violations, such as harassment, threats, or regulatory non-compliance, across various communication channels. This solution provides a structured workflow for reviewers to examine flagged communications and take appropriate remedial action.

Why this answer

Communication compliance is the correct solution because it is specifically designed to detect and remediate inappropriate communications, such as harassment, threats, or policy violations, by analyzing email, Microsoft Teams, and third-party messages. It uses customizable policies to scan for sensitive content, keywords, or patterns, and provides alerts for review by designated investigators.

Exam trap

The trap here is that candidates often confuse Communication compliance with Insider risk management, but the former focuses on communication content (e.g., harassment) while the latter focuses on user behavior patterns (e.g., data exfiltration).

How to eliminate wrong answers

Option A is wrong because Data Loss Prevention (DLP) focuses on preventing the unauthorized sharing of sensitive data (e.g., credit card numbers or PII) rather than monitoring communications for harassment or policy violations. Option B is wrong because eDiscovery is used for legal discovery and litigation support, such as searching and exporting content for court cases, not for proactive monitoring of employee communications. Option D is wrong because Insider risk management is designed to detect risky user activities like data theft or sabotage, not to monitor communications for harassment or policy violations.

Full explanation →

1187

MCQmedium

A financial company processes stock trades. To ensure that a trader cannot later deny having submitted a specific trade order, the system captures a digital signature from the trader for each order. Which security goal is being addressed by this practice?

A.Confidentiality

B.Integrity

C.Availability

D.Non-repudiation

AnswerD

Non-repudiation is the assurance that a party cannot legitimately deny having performed a specific action or sent a particular message. In the context of financial stock trades, a digital signature cryptographically binds the unique identity of the trader (via their private key) to the specific trade instruction. This creates undeniable, legally admissible proof that the trader authorized and executed that particular transaction, preventing them from later disavowing their actions.

Why this answer

Non-repudiation ensures that a party cannot deny having performed a specific action. By capturing a digital signature from the trader for each trade order, the system creates cryptographic proof that the trader indeed submitted that order. This prevents the trader from later claiming they did not authorize the trade, directly addressing the non-repudiation goal.

Exam trap

The trap here is that candidates often confuse integrity with non-repudiation, but integrity only ensures data hasn't been tampered with, while non-repudiation specifically provides cryptographic proof of origin and action.

How to eliminate wrong answers

Option A is wrong because confidentiality focuses on preventing unauthorized access to data, not on proving who performed an action. Option B is wrong because integrity ensures data has not been altered, but does not provide proof of origin or prevent denial of action. Option C is wrong because availability ensures systems and data are accessible when needed, which is unrelated to proving the authenticity of a submitted order.

Full explanation →

1188

MCQeasy

A company secures its network by deploying a firewall at the perimeter, an intrusion prevention system on internal segments, endpoint antivirus on all workstations, and encrypting sensitive data at rest and in transit. This layered approach ensures that if one control fails, others still provide protection. Which security concept does this strategy best represent?

A.Least privilege

B.Defense in depth

C.Zero Trust

D.Separation of duties

AnswerB

Defense in depth is a comprehensive cybersecurity strategy that employs multiple, overlapping security controls to protect assets and data. By deploying a firewall, the company is establishing a perimeter defense, which constitutes one critical layer in a multi-layered security architecture. This approach ensures that if one security control fails or is bypassed, other controls are already in place to prevent or detect an intrusion, significantly enhancing overall resilience against various threats.

Why this answer

The strategy described uses multiple independent security controls—firewall, IPS, endpoint antivirus, and encryption—so that if one layer fails, others continue to protect the asset. This is the core definition of defense in depth, which creates overlapping layers of protection rather than relying on a single point of failure.

Exam trap

The trap here is that candidates confuse Zero Trust with defense in depth because both involve multiple controls, but Zero Trust specifically requires identity-based verification and micro-segmentation rather than relying on layered perimeter defenses.

Why the other options are wrong

The question describes multiple overlapping security controls (firewall, IPS, antivirus, encryption), which is the essence of defense in depth, not least privilege. Least privilege focuses on limiting user access rights, not layering defenses.

The question describes a layered security approach with multiple controls, which is defense in depth, not separation of duties. Separation of duties is about dividing tasks among multiple people to prevent fraud or error, not about overlapping security controls.

When would these options actually be correct?

A question that asks: 'A company configures user accounts so that employees can only access files necessary for their job roles. Which security concept does this represent?' would make least privilege the correct answer.

A question that asks: 'A company requires that no single employee can approve a payment and also initiate it; two different employees must perform these tasks. Which security concept does this represent?' Then separation of duties would be correct.

Why candidates pick the wrong answer

Candidates may confuse least privilege with defense in depth because both are fundamental security principles, but least privilege is about access control, not layered defenses.

Candidates may confuse 'separation of duties' with 'defense in depth' because both involve multiple layers or divisions, but separation of duties is about dividing responsibilities among people, not about overlapping technical controls.

Full explanation →

1189

MCQeasy

A hospital stores patient medical records electronically. An attacker gains access to the system and modifies patient diagnoses. Which principle of the CIA triad has been violated?

A.Confidentiality

B.Integrity

C.Availability

D.Non-repudiation

AnswerB

Data integrity ensures that information remains accurate, complete, and unaltered throughout its lifecycle, protecting against unauthorized modification or destruction. In this scenario, an attacker directly modified patient diagnoses, which fundamentally compromises the trustworthiness and reliability of the medical records. This unauthorized alteration is a clear violation of the integrity principle, as the data no longer reflects its original, correct state.

Why this answer

The CIA triad's Integrity principle ensures that data is not modified by unauthorized parties. In this scenario, the attacker altered patient diagnoses, which directly violates data integrity. Confidentiality (unauthorized disclosure) and Availability (denial of service) are not the primary concerns here.

Exam trap

The trap here is that candidates may confuse 'access' with 'confidentiality' and choose A, but the key is the modification of data, which is a clear integrity violation, not just unauthorized viewing.

How to eliminate wrong answers

Option A is wrong because confidentiality focuses on preventing unauthorized access to data, not unauthorized modification; the attacker did access the system, but the core violation is the alteration of records. Option C is wrong because availability ensures systems and data are accessible when needed; the attacker did not disrupt access to the records. Option D is wrong because non-repudiation is a security concept that prevents a party from denying an action (e.g., using digital signatures or audit logs), not a core principle of the CIA triad; it is not directly violated by data modification.

Full explanation →

1190

MCQmedium

Your organization uses Microsoft Sentinel. You need to create a custom analytics rule that triggers an incident when a user fails to sign in more than five times within an hour. Which rule type should you use?

A.Scheduled query rule

B.Fusion rule

C.Near-real-time (NRT) analytics rule

D.Machine learning (ML) behavioral analytics rule

AnswerA

This rule type is fundamental for proactive threat detection in Microsoft Sentinel, enabling security analysts to define and execute custom KQL queries against ingested log data on a recurring schedule. It allows for specifying a precise query interval and a lookback period, triggering an alert only when the query results meet a predefined numerical threshold. This makes it ideal for identifying specific patterns, event counts, or conditions over a chosen time window.

Why this answer

A scheduled query rule is the correct choice because it allows you to define a KQL query that counts sign-in failures per user over a specified time window (e.g., 1 hour) and triggers an incident when the count exceeds a threshold (e.g., 5). This rule type runs on a schedule you define, making it ideal for detecting patterns like brute-force attempts that require aggregation over time.

Exam trap

The trap here is that candidates confuse 'near-real-time' with 'real-time aggregation over a window,' but NRT rules cannot perform time-based aggregation like counting events over an hour, which is a key differentiator from scheduled query rules.

How to eliminate wrong answers

Option B (Fusion rule) is wrong because Fusion rules use advanced machine learning to correlate multiple alerts into a single incident based on kill-chain analysis, not a simple threshold-based count of a single event type. Option C (Near-real-time (NRT) analytics rule) is wrong because NRT rules process events with minimal latency (under 2 minutes) but cannot perform aggregation over a 1-hour window; they are designed for single-event or near-instant detection. Option D (Machine learning (ML) behavioral analytics rule) is wrong because ML rules rely on baseline learning and anomaly detection over time, not a fixed threshold like 'more than five times within an hour'.

Full explanation →

1191

MCQmedium

A security team wants to monitor and proactively defend against cyber threats across their entire infrastructure, including Azure virtual machines, on-premises servers, and AWS workloads. They need a unified solution that provides endpoint detection and response (EDR), vulnerability management, and threat hunting capabilities. Which Microsoft security solution should they use?

A.Microsoft Defender for Cloud

B.Microsoft Defender for Endpoint

C.Microsoft Sentinel

D.Microsoft Defender for Cloud Apps

AnswerB

Microsoft Defender for Endpoint is specifically designed to provide comprehensive Endpoint Detection and Response (EDR), next-generation protection, automated investigation and remediation, and vulnerability management across endpoints. It offers advanced capabilities like threat hunting, attack surface reduction, and deep visibility into endpoint activities. This makes it the ideal solution for monitoring and proactively defending against advanced threats on servers, workstations, and cloud virtual machines.

Why this answer

Microsoft Defender for Endpoint (B) is the correct answer because it provides unified endpoint detection and response (EDR), vulnerability management, and threat hunting across heterogeneous environments, including Azure VMs, on-premises servers, and AWS workloads. It extends beyond Windows to support Linux and macOS endpoints, and can be onboarded via Microsoft Defender for Cloud for multi-cloud visibility, making it the single solution that meets all the stated requirements.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM/CWPP) with Microsoft Defender for Endpoint (an EDR), mistakenly thinking that Defender for Cloud alone provides endpoint-level detection and response, when in fact it relies on Defender for Endpoint for those capabilities.

How to eliminate wrong answers

Option A (Microsoft Defender for Cloud) is wrong because it is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that focuses on securing cloud resources and workloads, but it does not provide native endpoint detection and response (EDR) or vulnerability management for endpoints; it relies on Defender for Endpoint for those capabilities. Option C (Microsoft Sentinel) is wrong because it is a cloud-native SIEM and SOAR solution that ingests logs and alerts for security information and event management, but it does not perform endpoint-level EDR, vulnerability scanning, or threat hunting directly on endpoints. Option D (Microsoft Defender for Cloud Apps) is wrong because it is a cloud access security broker (CASB) that focuses on shadow IT discovery, data loss prevention, and threat protection for SaaS applications, not endpoint detection and response or vulnerability management for servers and VMs.

Full explanation →

1192

MCQmedium

Your organization is using Microsoft Defender for Cloud to secure a multi-cloud environment including Azure and AWS. You need to identify misconfigurations that could lead to security breaches. Which feature should you use?

A.Cloud Security Posture Management (CSPM)

B.Cloud Workload Protection (CWP)

C.Regulatory compliance dashboard

D.Security score

AnswerA

Cloud Security Posture Management (CSPM) continuously monitors cloud environments (IaaS, PaaS, SaaS) for misconfigurations, policy violations, and deviations from security best practices. It provides actionable recommendations to remediate identified issues, thereby proactively improving the overall security posture and reducing the attack surface. Microsoft Defender for Cloud's core CSPM capabilities include Secure Score, asset inventory, and security recommendations.

Why this answer

Cloud Security Posture Management (CSPM) is the correct feature because it continuously assesses your multi-cloud environment (Azure and AWS) against security best practices and compliance frameworks, identifying misconfigurations that could lead to security breaches. In Microsoft Defender for Cloud, CSPM provides a unified view of security posture across clouds, detecting issues like open ports, weak encryption, or excessive permissions without requiring agents. This directly addresses the need to find misconfigurations that attackers could exploit.

Exam trap

The trap here is that candidates confuse the output (Security score) or a related feature (Regulatory compliance dashboard) with the core scanning mechanism (CSPM), or they mistakenly think CWP's runtime protection covers configuration auditing, when in fact CSPM is the dedicated feature for identifying misconfigurations.

How to eliminate wrong answers

Option B is wrong because Cloud Workload Protection (CWP) focuses on detecting and responding to threats (e.g., malware, suspicious processes) at runtime within workloads, not on identifying static misconfigurations in cloud resources. Option C is wrong because the Regulatory compliance dashboard tracks adherence to specific standards (e.g., ISO 27001, SOC 2) and provides compliance scores, but it does not proactively scan for all misconfigurations that could lead to breaches—it is a subset of CSPM reporting. Option D is wrong because Security score is a metric that summarizes your overall security posture based on control implementation, but it is an output of CSPM assessments, not a feature that directly identifies specific misconfigurations; it aggregates findings rather than listing them.

Full explanation →

1193

MCQmedium

A financial services firm must monitor employee communications (email and Microsoft Teams) for potential insider trading. The compliance team wants to automatically detect messages containing specific financial keywords (e.g., 'non-public material information') and flag them for review. They also need to be able to remove violating messages from recipients' inboxes. Which Microsoft Purview solution should they configure?

A.Data Lifecycle Management

B.Communication Compliance

C.Insider Risk Management

D.Audit

AnswerB

Communication Compliance detects policy violations in messages and allows actions like removal.

Why this answer

Communication Compliance is the correct solution because it is specifically designed to detect and remediate inappropriate communications, including insider trading signals. It can automatically scan emails and Microsoft Teams messages for configurable sensitive information types (e.g., 'non-public material information') and enforce actions like removing violating messages from recipients' inboxes.

Exam trap

The trap here is confusing Communication Compliance (which detects and remediates message content) with Insider Risk Management (which focuses on behavioral analytics and risk scoring), leading candidates to choose the latter despite its inability to perform keyword-based message removal.

How to eliminate wrong answers

Option A is wrong because Data Lifecycle Management focuses on retaining and deleting data based on policies (e.g., legal hold, expiration), not on real-time detection or remediation of message content. Option C is wrong because Insider Risk Management analyzes user behavior patterns (e.g., unusual data exfiltration) to identify potential insider threats, but it does not directly scan communications for specific keywords or remove messages from inboxes. Option D is wrong because Audit provides logging and investigation of past activities (e.g., who accessed what), not proactive detection or automatic removal of violating messages.

Full explanation →

1194

MCQeasy

Your organization wants to protect sensitive documents from being copied to unauthorized cloud services. Which Microsoft Purview capability should you use?

A.Audit log

B.Data Loss Prevention (DLP) policy

C.Retention policy

D.Sensitivity label

AnswerB

A Data Loss Prevention (DLP) policy is purpose-built to identify, monitor, and protect sensitive information from being inappropriately shared, transferred, or used. These policies leverage predefined or custom rules to detect specific sensitive content, such as financial data or intellectual property, within documents across various locations and then enforce actions like blocking sharing, encrypting the data, or alerting administrators. DLP policies are highly effective in preventing unauthorized sharing of sensitive documents to external parties or unapproved cloud services, directly addressing the organization's protection requirement.

Why this answer

Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and automatically protect sensitive information—such as credit card numbers or health records—when users attempt to copy or share it with unauthorized cloud services like personal OneDrive or third-party storage apps. By scanning content in transit and applying actions like blocking the action or encrypting the data, DLP directly addresses the requirement to prevent data exfiltration to unauthorized cloud destinations.

Exam trap

The trap here is that candidates often confuse Sensitivity labels with DLP because both deal with data protection, but labels are for classification and persistent protection, whereas DLP is the active enforcement mechanism that monitors and blocks unauthorized data movement to cloud services.

How to eliminate wrong answers

Option A is wrong because Audit log records user and admin activities for compliance and forensic investigation but does not actively block or prevent data from being copied to unauthorized cloud services. Option C is wrong because Retention policy governs how long data is kept or deleted, not how it is protected from unauthorized sharing or exfiltration. Option D is wrong because Sensitivity labels classify and protect data by applying encryption or visual markings, but they do not by themselves monitor or block data transfer to unauthorized cloud services; they require integration with DLP or other controls to enforce such actions.

Full explanation →

1195

MCQmedium

A security team needs to detect and investigate advanced attacks targeting on-premises Active Directory accounts, such as Pass-the-Hash (PtH) and Golden Ticket attacks. Which Microsoft security solution should they deploy?

A.Microsoft Defender for Cloud Apps

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Identity

D.Microsoft Sentinel

AnswerC

Microsoft Defender for Identity (MDI) is purpose-built to detect advanced threats targeting on-premises Active Directory and hybrid identity environments. It monitors domain controllers and network traffic for suspicious activities, leveraging behavioral analytics to identify credential theft, lateral movement, and sophisticated attacks like Pass-the-Hash or Golden Ticket. MDI provides specialized insights into identity-based threats, enabling rapid investigation and response to protect critical authentication infrastructure.

Why this answer

Microsoft Defender for Identity (MDI) is specifically designed to detect advanced attacks targeting on-premises Active Directory, such as Pass-the-Hash (PtH) and Golden Ticket attacks. It uses behavioral analytics and machine learning to monitor AD traffic, Kerberos authentication, and NTLM protocol anomalies, identifying lateral movement and privilege escalation attempts that characterize these attacks.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Identity with Microsoft Sentinel or Defender for Endpoint, not realizing that only Defender for Identity provides dedicated, protocol-level detection for on-premises Active Directory attacks like PtH and Golden Ticket.

Why the other options are wrong

Microsoft Defender for Cloud Apps is a CASB focused on cloud application security, not on-premises Active Directory attack detection like PtH or Golden Ticket.

Microsoft Defender for Endpoint focuses on endpoint devices (e.g., workstations, servers) and does not specialize in monitoring on-premises Active Directory for identity-based attacks like Pass-the-Hash or Golden Ticket.

Microsoft Sentinel is a SIEM/SOAR solution that aggregates logs and generates alerts, but it does not natively detect advanced on-premises Active Directory attacks like Pass-the-Hash or Golden Ticket. It relies on data sources such as Defender for Identity to provide that detection capability.

When would these options actually be correct?

A question asks: 'Which Microsoft solution should be used to discover and control the use of shadow IT cloud apps and protect cloud app data from threats?'

A question asking for a solution to detect and investigate advanced attacks on endpoints, such as fileless malware or ransomware on Windows devices, would make Microsoft Defender for Endpoint the correct answer.

A security team needs to centralize security event monitoring, correlate alerts from multiple sources (e.g., firewalls, endpoints, cloud apps), and orchestrate automated incident response across the enterprise. In that scenario, Microsoft Sentinel would be the correct choice.

Why candidates pick the wrong answer

Candidates may confuse cloud app security with identity security, assuming all advanced attacks are covered under a broad 'cloud security' umbrella.

Candidates may confuse endpoint protection with identity protection, assuming that Defender for Endpoint covers all attack vectors including Active Directory, due to its broad 'Defender' branding.

Candidates may confuse Sentinel's broad security analytics and threat detection capabilities with the specialized identity-focused detection needed for on-premises AD attacks, assuming a SIEM can directly detect such attacks without dedicated identity sensors.

Full explanation →

1196

MCQeasy

A healthcare organization must comply with HIPAA regulations regarding the protection of patient health information (PHI). Which cloud compliance concept ensures that the organization has controls in place to meet regulatory requirements?

A.Privacy management

B.Identity management

C.Security management

D.Compliance management

AnswerD

Compliance management is the overarching discipline that ensures an organization adheres to external laws, regulations, and internal policies, such as HIPAA. It involves establishing frameworks, implementing controls, conducting risk assessments, monitoring adherence, and maintaining documentation to systematically meet all regulatory requirements and demonstrate due diligence to auditors and regulators.

Why this answer

Compliance management is the discipline of ensuring that an organization adheres to regulations like HIPAA by implementing controls. Security management focuses on protecting assets from threats. Identity management deals with authentication and authorization.

Privacy management addresses personal data protection. The question specifically asks about meeting regulatory requirements.

Full explanation →

1197

Multi-Selecthard

A company uses Microsoft Purview Data Lifecycle Management. To comply with regulatory requirements, the company must retain financial records for 7 years and then delete them. Which THREE actions should the company configure? (Select THREE.)

Select 3 answers

A.Create a data loss prevention policy

B.Create a retention policy for the entire SharePoint site

C.Create a retention label with a retention period of 7 years

D.Configure a disposition review to confirm deletion

E.Create an auto-labeling policy to apply the retention label to financial records

AnswersC, D, E

Retention labels in Microsoft Purview Data Lifecycle Management are specifically designed to apply precise retention settings, such as a 7-year retention period, to individual items like documents or emails. This allows for granular control over the lifecycle of specific content types, ensuring that financial records, for instance, are retained for the exact required duration based on regulatory or business needs. Labels can also trigger actions like disposition reviews at the end of the retention period.

Why this answer

A retention label with a 7-year retention period allows you to apply specific retention and deletion rules to individual documents, such as financial records, rather than to an entire site. This granularity is necessary when only a subset of content within a SharePoint site must be retained for compliance.

Exam trap

The trap here is that candidates often confuse retention policies (which apply to all content in a location) with retention labels (which can be scoped to specific content), and they forget that a disposition review is a separate configuration needed to confirm deletion rather than assuming automatic deletion occurs.

Full explanation →

1198

MCQhard

A security team needs to collect and analyze security logs from a hybrid environment consisting of on-premises Windows servers, Azure virtual machines, and AWS workloads. They want to correlate events, detect anomalous behavior, and create custom security alerts with automated response playbooks. Which Microsoft security solution should they use?

A.Microsoft Defender for Cloud

B.Microsoft Sentinel

C.Microsoft Defender for Office 365

D.Microsoft Defender for Identity

AnswerB

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It excels at collecting security data from virtually any source, including Azure services, on-premises infrastructure, other cloud providers (AWS, GCP), and third-party applications. Sentinel leverages AI and machine learning for intelligent threat detection, provides advanced analytics for correlating events, and enables automated responses through integrated SOAR playbooks, making it ideal for comprehensive security log analysis and incident management.

Why this answer

Microsoft Sentinel is the correct solution because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution designed to ingest logs from hybrid and multi-cloud environments, including on-premises Windows servers, Azure VMs, and AWS workloads. It provides advanced correlation of events across these sources, built-in anomaly detection using machine learning, and the ability to create custom security alerts and automated response playbooks via Azure Logic Apps. This directly matches the requirement for collecting, analyzing, correlating, detecting anomalies, and automating responses.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM/CWPP tool) with a full SIEM solution, but Defender for Cloud lacks the log correlation, custom alert creation, and SOAR playbook capabilities that are exclusive to Microsoft Sentinel.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) that focuses on assessing and hardening security configurations across Azure, AWS, and GCP, but it does not provide native SIEM capabilities for log correlation, custom alert creation, or automated response playbooks. Option C is wrong because Microsoft Defender for Office 365 is specifically designed to protect email, SharePoint, OneDrive, and Teams from threats like phishing and malware, and it cannot ingest or analyze logs from on-premises Windows servers, Azure VMs, or AWS workloads. Option D is wrong because Microsoft Defender for Identity is an on-premises Active Directory security solution that uses signals from domain controllers to detect identity-based attacks, but it lacks the multi-source log ingestion, correlation, and SOAR capabilities required for a hybrid environment with AWS workloads.

Full explanation →

1199

MCQmedium

A user reports that they cannot access the corporate portal after a password reset. The user can access other cloud apps. You verify that the user account is enabled and not locked. What should you check next?

A.Disable and re-enable the user account

B.Verify the user's registered authentication methods

C.Reinstall the corporate portal application

D.Check if the user is assigned a Microsoft Entra ID P2 license

AnswerB

A common reason for portal access issues, especially after a password reset or if the user has new devices, is an outdated or missing multi-factor authentication (MFA) registration. If conditional access policies require MFA for portal access, and the user's registered methods (e.g., Microsoft Authenticator, phone number) are incorrect or not configured, they will be blocked from signing in. Verifying and potentially resetting these methods in Microsoft Entra ID is a critical troubleshooting step to restore access.

Why this answer

The user can access other cloud apps, which rules out a global authentication or network issue. Since the account is enabled and not locked, the most likely cause is that the user's registered authentication methods (e.g., phone, authenticator app, or email) are missing, outdated, or not configured for the password reset flow. Microsoft Entra ID requires verified authentication methods to complete a password reset and subsequent sign-in, especially when the user is prompted for multifactor authentication or self-service password reset (SSPR) verification.

Exam trap

The trap here is that candidates often assume a password reset always works seamlessly, but the SC-900 exam tests the understanding that authentication methods must be registered and up-to-date for the reset to succeed, especially when the user is prompted for additional verification.

How to eliminate wrong answers

Option A is wrong because disabling and re-enabling the account would not resolve a missing or misconfigured authentication method; it only toggles the account status, which is already enabled. Option C is wrong because reinstalling the corporate portal application addresses client-side corruption, not an identity or authentication method issue that prevents access after a password reset. Option D is wrong because a Microsoft Entra ID P2 license is not required for basic password reset or authentication method registration; P2 adds advanced features like Identity Protection and Privileged Identity Management, but the core SSPR and MFA registration work with P1 or even free tier licenses.

Full explanation →

1200

MCQhard

Your organization uses Microsoft Purview Information Protection to classify and protect documents. You have created a sensitivity label that applies encryption to documents marked as 'Confidential'. Users are able to apply the label manually. However, you need to ensure that all documents containing personally identifiable information (PII) are automatically labeled as 'Confidential' when they are saved to SharePoint Online. What should you configure?

A.Create an auto-labeling policy in Microsoft Purview that scans for PII sensitive info types and applies the 'Confidential' label.

B.Configure a default label for SharePoint libraries so that all documents are labeled 'Confidential'.

C.Create a Data Loss Prevention (DLP) policy that blocks sharing of PII.

D.Train users to apply the 'Confidential' label manually when they create documents with PII.

AnswerA

Auto-labeling policies can scan and apply labels automatically.

Why this answer

Auto-labeling policies in Microsoft Purview can scan documents for sensitive info types (such as PII) and automatically apply the 'Confidential' label when they are saved to SharePoint Online. Option B is incorrect because configuring a default label for SharePoint libraries would apply to all documents, not just those containing PII, and it would not scan for specific content. Option C is incorrect because a DLP policy blocks sharing or other actions but does not apply sensitivity labels.

Option D is incorrect because manual labeling does not meet the requirement for automatic labeling.

Full explanation →

Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 1126–1200