Microsoft Security, Compliance, and Identity Fundamentals SC-900 SC-900 Questions 1201–1250 | Page 17/17

1201

MCQeasy

A company uses Microsoft Defender for Cloud to improve their cloud security posture. They want to see an aggregated score that reflects how well their resources are protected against threats. Which feature in Defender for Cloud provides this?

A.Compliance dashboard

B.Security Score

C.Cloud Security Posture Management (CSPM)

D.Workload protections

AnswerB

The Security Score is a crucial feature within Microsoft Defender for Cloud that provides a quantifiable, aggregated metric reflecting an organization's overall security posture across its hybrid and multi-cloud environments. It is calculated based on the implementation status of security recommendations derived from continuous assessments against security benchmarks. This score helps prioritize security efforts by showing the potential impact of implementing specific recommendations on the overall security posture, enabling clear tracking of improvements over time.

Why this answer

The Security Score in Microsoft Defender for Cloud aggregates findings from security assessments and controls into a single percentage score, reflecting how well resources are protected against threats. It is based on the Secure Score algorithm, which calculates the ratio of passed controls to total controls, weighted by the potential impact of each control. This provides a unified, quantitative measure of cloud security posture.

Exam trap

The trap here is that candidates confuse the broader Cloud Security Posture Management (CSPM) capability with the specific Security Score feature, but CSPM is the umbrella term for posture management, while Security Score is the concrete metric that provides the aggregated score.

How to eliminate wrong answers

Option A is wrong because the Compliance dashboard maps security controls to regulatory standards (e.g., SOC 2, ISO 27001) and shows compliance status, not an aggregated threat protection score. Option C is wrong because Cloud Security Posture Management (CSPM) is the overarching capability that includes security assessments, hardening recommendations, and the Security Score; the question asks for the specific feature that provides the aggregated score, not the broader capability. Option D is wrong because Workload protections focus on advanced threat detection and response for specific workloads (e.g., servers, databases) using tools like Just-In-Time VM access and adaptive application controls, not an aggregated security score.

Full explanation →

1202

MCQeasy

Your organization uses Microsoft Entra ID for identity management. You need to require multi-factor authentication (MFA) for all users when accessing the Azure portal. Which feature should you use?

A.Privileged Identity Management

B.Identity Protection user risk policy

C.Entra ID P1 license

D.Conditional Access policy

AnswerD

A Conditional Access policy is the precise tool within Microsoft Entra ID that allows administrators to enforce specific access requirements based on various conditions. By configuring a policy to target desired cloud applications and setting the grant control to "Require multi-factor authentication," the organization can mandate MFA for all users attempting to access those applications, thereby directly addressing the requirement to enforce MFA for cloud apps.

Why this answer

Conditional Access policy (Option D) is correct because it allows you to create policies that enforce MFA for specific applications like the Azure portal. Option A, Privileged Identity Management, is used for managing and auditing privileged roles, not for enforcing MFA. Option B, Identity Protection user risk policy, can trigger MFA based on risk but cannot enforce MFA for all users unconditionally.

Option C, an Entra ID P1 license, is a prerequisite for using Conditional Access but is not a feature itself.

Full explanation →

1203

MCQhard

A security team needs to detect and automatically respond to ransomware attacks on Windows servers and desktops. They require the solution to automatically isolate affected devices from the network and, if necessary, roll back files that have been modified by ransomware using a built-in recovery feature. Which Microsoft security solution provides these specific capabilities?

A.Microsoft Defender for Cloud Apps

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Office 365

D.Microsoft Defender for Identity

AnswerB

Microsoft Defender for Endpoint is a comprehensive Endpoint Detection and Response (EDR) solution designed to protect devices from advanced threats. It offers robust capabilities for automated investigation and remediation, including isolating compromised endpoints from the network to contain threats. Furthermore, it provides advanced features like file rollback, crucial for recovering from ransomware attacks by restoring files to their pre-attack state using cloud-delivered protection.

Why this answer

Microsoft Defender for Endpoint (MDE) provides automated investigation and remediation capabilities that include network containment (isolating a device from the network) and rollback of files modified by ransomware using its built-in recovery feature. This is achieved through MDE's endpoint detection and response (EDR) and automated investigation capabilities, which can trigger device isolation and file restoration from Volume Shadow Copy or MDE's own rollback mechanism.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud Apps (a CASB) with endpoint protection, or assume that Defender for Office 365 covers all ransomware scenarios, when in fact only Defender for Endpoint provides the specific combination of device isolation and file rollback on Windows endpoints.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) focused on securing cloud applications and data, not on endpoint-level ransomware detection, device isolation, or file rollback on Windows servers and desktops. Option C is wrong because Microsoft Defender for Office 365 protects email, SharePoint, OneDrive, and Teams from threats like phishing and malware, but it does not provide endpoint isolation or file rollback on Windows servers and desktops. Option D is wrong because Microsoft Defender for Identity monitors on-premises Active Directory for identity-based attacks (e.g., lateral movement, privilege escalation) and does not include endpoint device isolation or ransomware file recovery capabilities.

Full explanation →

1204

MCQmedium

A company uses Microsoft Entra ID. They want to require users to perform multifactor authentication (MFA) every 90 days on trusted devices, but force MFA for every sign-in on untrusted devices. Which Conditional Access session control must they configure to meet this requirement?

A.Sign-in frequency

B.Application enforced restrictions

C.Use app enforced restrictions

D.Persistent browser session

AnswerA

Sign-in frequency is a session control that determines how often a user must provide authentication credentials again, such as after a set number of days or hours. It can be configured differently for trusted and untrusted devices.

Why this answer

Sign-in frequency is the Conditional Access session control that allows administrators to define the time interval after which a user must re-authenticate, even on a trusted device. By setting the sign-in frequency to 90 days for trusted devices and requiring re-authentication for every sign-in on untrusted devices (by setting the frequency to 0 or 1), the requirement is met. This control directly manages the re-prompt interval for MFA, independent of the session token lifetime.

Exam trap

The trap here is that candidates confuse 'Persistent browser session' (which controls session persistence across browser closes) with 'Sign-in frequency' (which controls the re-authentication interval), leading them to choose the wrong option for MFA frequency requirements.

How to eliminate wrong answers

Option B is wrong because 'Application enforced restrictions' is not a valid Conditional Access session control; it is a generic term that does not exist in the Microsoft Entra Conditional Access policy settings. Option C is wrong because 'Use app enforced restrictions' is also not a valid session control; it is a misnomer and does not correspond to any configurable setting in Conditional Access. Option D is wrong because 'Persistent browser session' controls whether the browser session cookie persists after the browser is closed, not the frequency of MFA prompts; it affects session lifetime but not the re-authentication interval for MFA.

Full explanation →

1205

Multi-Selectmedium

Which THREE of the following are capabilities of Microsoft Purview Information Protection?

Select 3 answers

A.Auto-labeling for sensitive data

B.Communication monitoring

C.Sensitivity labels

D.Encryption and rights protection

E.Retention policies

AnswersA, C, D

Auto-labeling is a feature of Information Protection.

Why this answer

A, C, D are correct. Sensitivity labels, auto-labeling, and encryption are key capabilities of Microsoft Purview Information Protection. B (Communication monitoring) is a Communication Compliance capability.

E (Retention policies) is Data Lifecycle Management.

Full explanation →

1206

MCQmedium

A company's IT department implements a policy for server administrators: they must submit an access request to perform privileged tasks on critical servers. Each request is approved by a manager, and the granted elevated permissions automatically expire after four hours. This approach reduces the risk of standing privileges being exploited. Which security concept is primarily being applied?

A.Just-in-time access

B.Least privilege

C.Defense in depth

D.Zero Trust

AnswerA

Just-in-time (JIT) access grants temporary, time-limited elevated permissions to users or systems only when explicitly requested and strictly for the duration required to complete a specific task. This approach minimizes the window of opportunity for misuse or compromise by ensuring that administrative privileges are not persistently held. The scenario directly describes this mechanism of on-demand, temporary access for server administration.

Why this answer

Just-in-time (JIT) access is a security concept that grants elevated permissions only when needed, for a limited duration, and requires approval. In this scenario, the policy requires an access request, manager approval, and automatic expiration after four hours, which directly aligns with JIT access to reduce the risk of standing privileges being exploited.

Exam trap

The trap here is that candidates confuse 'least privilege' (a static principle of minimal permissions) with 'just-in-time access' (a dynamic, time-bound activation mechanism), but the question's emphasis on 'request, approval, and automatic expiration' specifically points to JIT, not just the principle of least privilege.

How to eliminate wrong answers

Option B is wrong because least privilege is a principle that ensures users have only the minimum permissions necessary to perform their tasks, but it does not inherently include time-bound or approval-based elevation; the scenario specifically describes temporary, approved access, which is JIT, not just least privilege. Option C is wrong because defense in depth is a layered security strategy using multiple controls (e.g., firewalls, antivirus, encryption), not a single policy for temporary privileged access. Option D is wrong because Zero Trust is a security model that assumes no implicit trust and continuously verifies every request, but the scenario focuses on time-limited, approved elevation, not the broader Zero Trust principles of micro-segmentation or continuous verification.

Full explanation →

1207

MCQeasy

Your organization needs to control which users can access Microsoft Purview compliance portal. Which method should you use to grant access?

A.Add users to an Azure RBAC role

B.Configure Intune policy to allow access

C.Assign users to the Compliance Administrator role group in Microsoft Purview

D.Assign Microsoft 365 E5 licenses to users

AnswerC

Role groups in Purview grant access to the compliance portal.

Why this answer

Access to the Microsoft Purview compliance portal is granted by assigning users to the appropriate role group within Purview itself, such as the Compliance Administrator role group. Option A is incorrect because Azure RBAC roles manage access to Azure resources, not to Purview. Option B is incorrect because Intune policies control device management and compliance, not user access to Purview.

Option D is incorrect while Microsoft 365 E5 licenses are required to use Purview features, they do not by themselves grant access; explicit role assignment is necessary.

Full explanation →

1208

MCQeasy

A company's security policy requires that all data transferred between the corporate data center and the cloud must be protected from unauthorized access during transmission. They use encryption protocols such as TLS to achieve this. Which security goal is primarily being addressed?

A.Confidentiality

B.Integrity

C.Availability

D.Non-repudiation

AnswerA

Encrypting data during transmission directly ensures that only authorized entities with the correct decryption key can access or read the information. This process transforms plaintext into ciphertext, making it unintelligible to any unauthorized interceptors who might intercept the data in transit. Therefore, the primary objective of such a security policy requirement is to prevent unauthorized disclosure of sensitive data while it traverses networks, directly upholding confidentiality.

Why this answer

Confidentiality is the security goal that ensures data is not disclosed to unauthorized entities. By using encryption protocols such as TLS, the data in transit is rendered unreadable to any party that intercepts the traffic, directly protecting against unauthorized access during transmission.

Exam trap

The trap here is that candidates may confuse encryption with integrity, thinking that encryption alone prevents tampering, but encryption only provides confidentiality; integrity requires separate mechanisms like MACs or digital signatures, which TLS also includes but are not the primary goal stated in the question.

How to eliminate wrong answers

Option B (Integrity) is wrong because integrity focuses on ensuring data has not been altered or tampered with during transit, which is typically achieved through hashing or message authentication codes (e.g., HMAC), not solely by encryption. Option C (Availability) is wrong because availability concerns ensuring systems and data are accessible when needed, often addressed by redundancy and disaster recovery, not by encrypting data in transit. Option D (Non-repudiation) is wrong because non-repudiation provides proof of the origin or delivery of data, usually via digital signatures or audit logs, and is not the primary goal of encryption protocols like TLS.

Full explanation →

1209

MCQeasy

A company implements a security strategy that includes multiple layers of controls: a perimeter firewall, an intrusion detection system, endpoint antivirus software, and multi-factor authentication for user access. The goal is that if one layer fails, another layer is in place to prevent or mitigate an attack. Which security principle does this approach best represent?

A.Defense in depth

B.Zero Trust

C.Least privilege

D.CIA triad

AnswerA

Defense in depth is a comprehensive security strategy that layers multiple, independent security controls to protect assets across various domains. This approach ensures that if one security control fails or is bypassed, other controls are still in place to detect, prevent, or mitigate an attack, significantly increasing resilience against diverse threat vectors. It encompasses physical, technical, and administrative safeguards, creating a robust and redundant barrier.

Why this answer

Defense in depth is a security strategy that layers independent defensive mechanisms so that if one layer fails, another layer is already in place to prevent or mitigate an attack. The scenario explicitly describes multiple layers (firewall, IDS, endpoint antivirus, MFA) working together, which is the core definition of defense in depth. This approach ensures no single point of failure can compromise the entire security posture.

Exam trap

The trap here is that candidates often confuse 'Defense in depth' with 'Zero Trust' because both involve multiple security controls, but Zero Trust is specifically about eliminating implicit trust and verifying every access request, not about layering defenses as a fail-safe mechanism.

Why the other options are wrong

The question describes multiple layers of controls (firewall, IDS, antivirus, MFA) that work together to provide redundancy, which is the core of defense in depth. Zero Trust is a security model that assumes no implicit trust and requires continuous verification, not specifically about layered defenses.

The question describes multiple layers of security controls, which is the essence of defense in depth, not least privilege. Least privilege focuses on granting only necessary permissions, not on layered defenses.

The CIA triad (Confidentiality, Integrity, Availability) is a model for information security policy, not a strategy for layered controls. The question describes multiple defensive layers, which is defense in depth, not the CIA triad.

When would these options actually be correct?

Zero Trust would be correct in a question describing a strategy where no user or device is trusted by default, even if inside the network, and every access request is verified, authenticated, and authorized before granting access.

A question that asks: 'A company restricts user accounts to only the permissions required to perform their job functions. Which security principle does this represent?' would make least privilege the correct answer.

A question asks: 'Which security principle ensures that data is not disclosed to unauthorized parties, remains accurate, and is accessible when needed?' The CIA triad would be the correct answer.

Why candidates pick the wrong answer

Candidates may confuse Zero Trust with defense in depth because both involve multiple security controls, but Zero Trust focuses on identity and access verification rather than layered physical/technical controls.

Candidates may confuse least privilege with defense in depth because both are fundamental security principles, but least privilege is about access control, not layered defenses.

Candidates may confuse the CIA triad as a broad security principle and think it encompasses layered defenses, but it is actually a set of goals, not a strategy for implementing controls.

Full explanation →

1210

Drag & Dropmedium

Arrange the steps to investigate a user compromise using Azure AD Identity Protection.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Identity Protection investigation involves accessing the portal, reviewing risks, selecting a user, analyzing events, and taking action.

Full explanation →

1211

MCQeasy

Your organization is implementing Microsoft Purview to manage sensitive data. You need to ensure that documents containing credit card numbers are automatically detected and protected. Which Microsoft Purview solution should you configure?

A.eDiscovery (Premium)

B.Data Loss Prevention (DLP)

C.Audit (Standard)

D.Information Barriers

AnswerB

Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and automatically protect sensitive information across various locations, including Microsoft 365 services, endpoints, and on-premises repositories. These policies leverage sensitive information types, trainable classifiers, and exact data match to detect content containing, for example, credit card numbers or health records. Upon detection, DLP can enforce actions such as blocking sharing, encrypting files, or notifying administrators to prevent unauthorized disclosure or exfiltration.

Why this answer

Data Loss Prevention (DLP) is the correct solution because it is specifically designed to automatically detect sensitive data, such as credit card numbers, using built-in sensitive information types (e.g., Credit Card Number) and apply protective actions like blocking sharing or encrypting the document. Microsoft Purview DLP policies can scan content at rest, in transit, and in use across Exchange, SharePoint, OneDrive, Teams, and endpoints, ensuring credit card numbers are identified and protected in real time.

Exam trap

The trap here is that candidates may confuse eDiscovery (Premium) with DLP because both involve content scanning, but eDiscovery focuses on search and hold for legal cases, not automated real-time protection of sensitive data.

How to eliminate wrong answers

Option A is wrong because eDiscovery (Premium) is used for legal discovery and investigation workflows, not for automated detection and protection of sensitive data like credit card numbers. Option C is wrong because Audit (Standard) provides logging and auditing of user and admin activities, but it does not detect or protect sensitive data in documents. Option D is wrong because Information Barriers are designed to restrict communication and collaboration between specific groups to prevent conflicts of interest, not to scan for or protect sensitive data patterns like credit card numbers.

Full explanation →

1212

MCQmedium

A company has deployed Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. The security operations team wants a single, unified portal where they can view alerts from all these products, perform cross-domain investigations, and orchestrate automated response actions. Which Microsoft security solution should they use?

A.Microsoft Sentinel

B.Microsoft 365 Defender

C.Microsoft Defender for Cloud

D.Microsoft Defender for Endpoint

AnswerB

Microsoft 365 Defender serves as the unified Extended Detection and Response (XDR) solution, integrating signals from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Microsoft Defender for Cloud Apps. This comprehensive platform correlates alerts and incidents across these domains, enabling security operations teams to conduct cross-domain investigations and leverage automated response capabilities for a holistic security posture.

Why this answer

Microsoft 365 Defender is the correct answer because it is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and cloud applications. It provides a single portal (security.microsoft.com) where alerts from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps are correlated into incidents, enabling cross-domain investigation and automated response via playbooks and the Microsoft 365 Defender API.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel (a SIEM) with the unified Microsoft 365 Defender portal, not realizing that Sentinel is an aggregator for multiple data sources, while Microsoft 365 Defender is the native unified console for the Defender product family itself.

Why the other options are wrong

Microsoft Sentinel is a cloud-native SIEM/SOAR for ingesting logs from multiple sources, but it is not the unified portal for Microsoft 365 Defender products; the question specifies a single portal for alerts from Defender products, which is Microsoft 365 Defender.

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) for multicloud environments, not a unified portal for cross-domain investigation and automated response across Defender products.

Microsoft Defender for Endpoint is a single-product security solution focused on endpoint protection, not a unified portal for cross-domain alerts from multiple Defender products. The question asks for a single portal integrating alerts from Defender for Endpoint, Office 365, Identity, and Cloud Apps, which is the role of Microsoft 365 Defender.

When would these options actually be correct?

Microsoft Sentinel would be correct if the question asked for a SIEM solution to aggregate security data from multiple sources (including non-Microsoft), perform advanced threat hunting with KQL, and orchestrate automated response across hybrid environments, rather than a unified portal for Microsoft Defender products.

This option would be correct if the question asked for a solution to assess and improve the security posture of Azure, AWS, and GCP resources, or to protect cloud workloads with integrated vulnerability management and threat detection.

This option would be correct if the question asked: 'Which Microsoft security solution should be used to protect endpoints (devices) from advanced threats, including antivirus, endpoint detection and response (EDR), and automated investigation and remediation?'

Why candidates pick the wrong answer

Candidates may confuse Sentinel as the central portal because it can ingest alerts from Defender products and provide cross-domain investigation, but the question specifically asks for the unified portal for those Defender products, which is Microsoft 365 Defender.

Candidates may confuse 'Defender for Cloud' with a central security portal because its name suggests cloud-wide protection, and they may not distinguish between cloud workload protection and unified incident response across endpoints, identities, and apps.

Candidates may confuse Microsoft Defender for Endpoint with the broader Microsoft 365 Defender suite because the names are similar, or they may think the endpoint solution is the central console for all security alerts.

Full explanation →

1213

Multi-Selecthard

Which TWO of the following are capabilities of Microsoft Sentinel? (Choose two.)

Select 2 answers

A.Security information and event management (SIEM)

B.Security orchestration, automation, and response (SOAR)

C.Endpoint detection and response (EDR)

D.Vulnerability scanning

E.Data classification and labeling

AnswersA, B

Microsoft Sentinel is fundamentally a cloud-native Security Information and Event Management (SIEM) solution. It provides centralized security data collection from various sources, including Microsoft 365, Azure, on-premises systems, and other cloud providers, ingesting logs and alerts at scale. Sentinel then uses analytics, machine learning, and threat intelligence to detect, investigate, and respond to threats across an organization's digital estate, offering a comprehensive view of security posture.

Why this answer

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) solution that aggregates log data from across an organization to detect, investigate, and respond to threats. It also provides Security Orchestration, Automation, and Response (SOAR) capabilities through built-in playbooks and automation rules, enabling automated incident response workflows.

Exam trap

The trap here is that candidates confuse Microsoft Sentinel's ability to ingest and correlate EDR alerts with actually performing EDR functions, leading them to select 'Endpoint detection and response' as a Sentinel capability.

Full explanation →

1214

MCQmedium

A company wants to improve password security across its Microsoft Entra ID tenant. The security team wants to prevent users from setting passwords that appear on Microsoft's global banned password list, which includes commonly compromised passwords. Additionally, they need to add a custom banned password containing the company name so that users cannot use variations of it. Which Microsoft Entra ID feature should they configure to enforce these password policies?

A.Conditional Access

B.Identity Protection

C.Password Protection

D.Multi-factor authentication (MFA)

AnswerC

Microsoft Entra ID Password Protection directly addresses the goal of improving password security by enforcing policies that prevent users from creating weak, easily guessable, or commonly compromised passwords. It utilizes both a global banned password list, maintained by Microsoft, and allows administrators to configure a custom banned password list specific to their organization. This feature actively checks new or reset passwords against these lists, rejecting those that fail to meet the defined security standards and thereby reducing the risk of password-based attacks.

Why this answer

Password Protection in Microsoft Entra ID is the feature specifically designed to enforce both global and custom banned password lists. It prevents users from using commonly compromised passwords from Microsoft's global list and allows administrators to add custom terms, such as the company name, to block variations. This directly addresses the requirement to improve password security by blocking weak and organization-specific passwords.

Exam trap

The trap here is that candidates may confuse Identity Protection's 'leaked credentials' detection with the ability to block password creation, but Identity Protection only detects credentials that have already been compromised, not prevents users from setting weak passwords in the first place.

Why the other options are wrong

Conditional Access enforces access controls based on signals like user, location, or device state, but it does not manage password content policies such as banned password lists.

Identity Protection is designed to detect and respond to identity-based risks, such as leaked credentials or suspicious sign-ins, but it does not enforce password policies like banning specific passwords.

Multi-factor authentication (MFA) adds a second verification step during sign-in, but it does not enforce password content policies like banning specific passwords. The question specifically asks about preventing users from setting banned passwords, which is handled by Password Protection, not MFA.

When would these options actually be correct?

A company wants to block access from untrusted locations unless users complete MFA. Conditional Access policies can require MFA for specific conditions like location or device compliance.

An exam question might ask: 'A company wants to automatically detect and block users whose credentials have been leaked in a public data breach. Which Microsoft Entra ID feature should they configure?' In that scenario, Identity Protection would be correct.

An exam question might ask: 'A company wants to require users to provide a second form of verification, such as a phone call or app notification, when signing in from untrusted locations. Which feature should they configure?' In that scenario, MFA would be the correct answer.

Why candidates pick the wrong answer

Candidates may confuse Conditional Access with general security policy enforcement, thinking it can be used to set password rules, but it is focused on access conditions, not password content.

Candidates may confuse Identity Protection's ability to detect compromised passwords with the ability to enforce password policies, as both relate to password security.

Candidates may confuse MFA with password security because both are commonly associated with improving authentication security. They might think that requiring MFA indirectly prevents weak passwords, but MFA does not control password creation policies.

Full explanation →

1215

MCQhard

A company deploys Microsoft Defender for Cloud Apps. They want to detect when a user downloads more than 100 files from SharePoint in 10 minutes. Which policy type should they create?

A.File policy

B.Anomaly detection policy

C.App permission policy

D.Session policy

AnswerB

Anomaly detection policies use machine learning to detect unusual user behavior like mass downloads.

Why this answer

An anomaly detection policy in Defender for Cloud Apps can identify unusual file download activities based on predefined thresholds. Option A is wrong because a file policy monitors files based on metadata or content, not behavioral patterns. Option C is wrong because an app permission policy governs permissions granted to third-party apps.

Option D is wrong because a session policy enforces real-time controls on user sessions.

Full explanation →

1216

Multi-Selectmedium

Which THREE are features of Microsoft Defender for Cloud?

Select 3 answers

A.Just-in-time VM access

B.Secure Score

C.Data classification

D.Regulatory compliance dashboard

E.Incident investigation

AnswersA, B, D

JIT access reduces exposure by controlling VM access.

Why this answer

Just-in-time (JIT) VM access is a feature of Microsoft Defender for Cloud that reduces exposure to brute-force attacks by locking down inbound traffic to VMs. It allows you to control when specific ports (e.g., RDP port 3389 or SSH port 22) are opened on demand, based on role-based access control (RBAC) and approved requests, and automatically closes them after a configured time window.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud's security alerts and recommendations with the full incident investigation and hunting capabilities of Microsoft Sentinel, or they mistakenly associate data classification (a Purview feature) with Defender for Cloud's workload protection.

Full explanation →

1217

MCQeasy

A security administrator is explaining the concept of defense in depth to a new team member. Which statement best describes this approach?

A.Using a single, strong firewall to block all external traffic

B.Layering multiple security controls across different areas of the IT environment

C.Relying solely on encryption to protect all data at rest and in transit

D.Implementing only physical security measures to protect the data center

AnswerB

Defense in depth fundamentally involves deploying a comprehensive array of security controls across various layers and domains within an IT environment. This layered strategy ensures that if one security control is compromised or bypassed, other independent controls are still in place to detect, prevent, or mitigate the attack. It encompasses physical, technical, and administrative safeguards, creating a resilient security posture that significantly increases the effort and resources required for an attacker to succeed.

Why this answer

Defense in depth is a cybersecurity strategy that employs multiple layers of security controls across different areas of the IT environment (network, endpoint, application, data, and physical). This approach ensures that if one control fails, another is already in place to mitigate the threat, providing redundancy and reducing the risk of a single point of failure. Microsoft's security framework, including tools like Microsoft Defender for Cloud and Azure Firewall, operationalizes this concept by integrating protections at each layer.

Exam trap

The trap here is that candidates often confuse defense in depth with a single strong control (like a firewall or encryption), failing to recognize that the core principle is layering multiple independent controls to provide redundancy and depth.

Why the other options are wrong

Defense in depth requires multiple layers of security, not a single firewall. A single firewall can be bypassed or fail, leaving the environment unprotected.

Defense in depth requires multiple layers of security, not a single control. Relying solely on encryption ignores other critical layers like network segmentation, access controls, and monitoring.

Defense in depth requires multiple layers of security, not just physical measures. Relying solely on physical security ignores network, application, and data security, leaving many attack vectors unprotected.

When would these options actually be correct?

If the question asked for a simple, cost-effective security approach for a small network with minimal threats, a single strong firewall might be considered sufficient.

In a question asking 'Which control best protects data confidentiality during transmission?', encryption (e.g., TLS) would be the correct answer, as it specifically secures data in transit.

A question asking for the primary security control for a data center's perimeter, such as 'Which measure best prevents unauthorized physical access to a server room?' would make physical security the correct answer.

Why candidates pick the wrong answer

Candidates may think a strong firewall is a comprehensive solution, overlooking the need for layered defenses against diverse attack vectors.

Candidates may overvalue encryption as a comprehensive security measure, mistakenly believing it alone can address all threats, rather than understanding it is just one layer in a defense-in-depth strategy.

Candidates may think physical security is the foundation of all security and overlook the need for layered controls, especially if they focus on the data center aspect of the scenario.

Full explanation →

1218

Multi-Selecthard

Which THREE actions can be performed by Microsoft Purview Data Loss Prevention (DLP) policies?

Select 3 answers

A.Create audit reports of policy matches

B.Send notification to users

C.Block sharing of sensitive data

D.Automatically delete files containing sensitive data

E.Apply encryption via sensitivity labels

AnswersB, C, E

DLP can show policy tips and send email notifications.

Why this answer

Microsoft Purview DLP policies can send email notifications to users when a policy match occurs, alerting them to potential policy violations and providing guidance on proper data handling. This is a core end-user notification feature that helps educate users and reduce accidental data leaks.

Exam trap

The trap here is that candidates may confuse DLP's ability to generate alerts or logs with the separate audit log functionality, or assume DLP can delete files when it only blocks or encrypts data.

Full explanation →

1219

MCQhard

Refer to the exhibit. You run the cmdlet and get a list of risk detections. What does this cmdlet retrieve?

A.Users who have been flagged for risky sign-ins

B.All risk detections in the tenant

C.All sign-in logs with unfamiliar properties

D.Risk detections for the unfamiliar sign-in properties risk event type

AnswerD

This option is correct because the `Get-MSRiskDetection` cmdlet is used to retrieve risk detections from Azure AD Identity Protection. The `-Filter "riskEventType eq 'unfamiliarSignInProperties'"` parameter precisely targets and returns only those risk detection objects where the `riskEventType` property matches 'unfamiliarSignInProperties'. This accurately identifies sign-ins exhibiting characteristics outside a user's typical patterns, as indicated by the specified risk event type.

Why this answer

The cmdlet `Get-MgRiskDetection` retrieves all risk detections in the tenant, but when combined with the `-Filter` parameter for `riskEventType eq 'unfamiliarSigninProperties'`, it specifically returns only those risk detections that match the unfamiliar sign-in properties risk event type. This is because the cmdlet supports filtering by the `riskEventType` property, which corresponds to the type of risk detection as defined by Microsoft Entra ID Protection.

Exam trap

The trap here is that candidates confuse retrieving risk detections (which are events) with retrieving risky users or sign-in logs, and they overlook the `-Filter` parameter that narrows the scope to a specific risk event type, leading them to choose the overly broad 'All risk detections' option.

How to eliminate wrong answers

Option A is wrong because `Get-MgRiskDetection` retrieves risk detection objects, not user objects; users flagged for risky sign-ins are retrieved using `Get-MgRiskyUser` or `Get-MgRiskDetection` with a different filter. Option B is wrong because the cmdlet in the exhibit includes a `-Filter` parameter that limits the results to a specific risk event type, not all risk detections in the tenant. Option C is wrong because sign-in logs with unfamiliar properties are a subset of risk detections, but the cmdlet retrieves risk detection objects (which include metadata like risk level, risk state, and detection timing), not raw sign-in logs; sign-in logs are retrieved via `Get-MgAuditLogSignIn`.

Full explanation →

1220

MCQmedium

An organization uses Microsoft Entra ID. The security team wants to require multi-factor authentication (MFA) for users who sign in from sessions that Microsoft Entra ID Protection determines to have medium or high sign-in risk. Users signing in from low-risk sessions should not be prompted for MFA. Which feature should the security team configure?

A.Configure a Conditional Access policy with Sign-in risk as a condition and MFA as a grant control

B.Configure a user risk policy in Microsoft Entra ID Protection

C.Assign the Global Administrator role with Privileged Identity Management (PIM) activation requiring MFA

D.Create an access review in Microsoft Entra ID Governance

AnswerA

Configuring a Conditional Access policy with 'Sign-in risk' as a condition and 'Require multi-factor authentication' as a grant control is the correct solution. This policy leverages real-time risk detections from Microsoft Entra ID Protection, dynamically enforcing MFA only when a user's sign-in attempt is deemed risky. This approach provides adaptive security, ensuring that users are prompted for additional verification specifically when their access attempt presents a potential threat, aligning with a Zero Trust model.

Why this answer

A Conditional Access policy can use Sign-in risk (a condition from Microsoft Entra ID Protection) to require MFA as a grant control. This allows the security team to enforce MFA only for sessions with medium or high sign-in risk, while low-risk sessions are not prompted, exactly matching the requirement.

Exam trap

The trap here is confusing sign-in risk (session-level) with user risk (user-level), leading candidates to choose the user risk policy (Option B) instead of the Conditional Access policy with sign-in risk condition.

Why the other options are wrong

The question requires MFA based on sign-in risk (session risk), not user risk. A user risk policy in ID Protection addresses user-level risk (e.g., compromised account), not sign-in risk from a specific session.

This option addresses privileged role activation requiring MFA, not sign-in risk-based MFA for all users. The question specifically requires MFA based on sign-in risk level (medium/high), which is a Conditional Access policy condition, not a PIM activation setting.

Access reviews are used to verify and manage user access rights periodically, not to enforce MFA based on sign-in risk. The question specifically requires MFA enforcement for medium/high risk sessions, which is done via Conditional Access policies with sign-in risk condition.

When would these options actually be correct?

A user risk policy would be correct if the question asked to require MFA when a user account is determined to be compromised (high user risk), such as after leaked credentials are detected, regardless of individual sign-in risk.

This would be correct if the question asked: 'An organization wants to ensure that when a user activates the Global Administrator role via Privileged Identity Management, they must pass MFA. Which feature should they configure?'

An organization needs to periodically review and confirm that users still require access to critical applications, and remove stale accounts or excessive permissions. In that scenario, creating an access review in Microsoft Entra ID Governance would be the correct feature to configure.

Why candidates pick the wrong answer

Candidates confuse 'user risk' with 'sign-in risk' because both are risk-based policies in ID Protection, but they apply to different risk types and conditions.

Candidates may confuse risk-based MFA with privileged access MFA requirements, or think that PIM activation policies can enforce MFA based on sign-in risk, which they cannot.

Candidates may confuse access reviews with risk-based policies because both are part of Microsoft Entra ID Protection and Governance, and both involve security oversight. They might think an access review can trigger MFA, but it does not enforce real-time authentication requirements.

Full explanation →

1221

MCQhard

Refer to the exhibit. A Microsoft Purview administrator imported this JSON policy for automatic sensitivity labeling. After deployment, users report that emails containing German social security numbers are not being automatically labeled. What is the most likely cause?

A.The sensitive info type 'EU_Deutschland_SocialSecurityNumber' is not defined in the tenant.

B.Auto-labeling for emails requires 'applyWithOverride' behavior, not 'apply'.

C.The encryption setting prevents auto-labeling on emails.

D.The label is not published to users.

AnswerB

For automatic sensitivity labeling of content in Exchange Online (emails), the `behavior` parameter in the auto-labeling policy must be set to `applyWithOverride`. The `apply` behavior is typically used for SharePoint and OneDrive content, where it applies the label without allowing users to change it. However, Exchange requires `applyWithOverride` to ensure the label is applied while still permitting users to manually modify or remove it if necessary, aligning with email workflow flexibility.

Why this answer

Microsoft Purview auto-labeling for emails requires the 'applyWithOverride' action to allow users to override the label, whereas 'apply' is used for static labeling in other scenarios like SharePoint. The JSON policy uses 'apply' without override, which prevents automatic labeling on emails, as email auto-labeling policies specifically need the 'applyWithOverride' behavior to function correctly.

Exam trap

The trap here is that candidates confuse the 'apply' action (used for static labeling in SharePoint/OneDrive) with the 'applyWithOverride' action required for email auto-labeling, assuming all auto-labeling uses the same action.

How to eliminate wrong answers

Option A is wrong because the sensitive info type 'EU_Deutschland_SocialSecurityNumber' is a built-in Microsoft Purview sensitive information type that is defined by default in all tenants, so its absence is not the issue. Option C is wrong because encryption settings do not prevent auto-labeling; they are applied after labeling and are configured separately in the label policy. Option D is wrong because label publishing affects user visibility in apps like Office, but auto-labeling policies apply labels automatically regardless of whether the label is published to users.

Full explanation →

1222

MCQmedium

A company uses Microsoft Entra ID. The security team wants to enforce a policy that prevents users from choosing commonly used weak passwords like 'Winter2024!' or 'Password@123', and also blocks customized variants based on organizational context (e.g., company name). Users must create passwords that meet standard complexity requirements. Which Microsoft Entra ID feature should they enable?

A.Password hash synchronization

B.Microsoft Entra ID Password Protection

C.Self-Service Password Reset

D.Conditional Access

AnswerB

Correct. Microsoft Entra ID Password Protection blocks weak passwords and their common variants, including custom banned lists. It is the appropriate feature for enforcing strong password choices beyond default complexity.

Why this answer

Microsoft Entra ID Password Protection (B) is the correct feature because it specifically enforces custom banned password lists that block weak passwords like 'Winter2024!' and organizational variants such as the company name. It works alongside standard password complexity requirements to prevent users from choosing passwords that appear on a global banned list or a tenant-specific custom list. This directly addresses the security team's need to block commonly used weak passwords and context-based variants.

Exam trap

The trap here is that candidates often confuse Self-Service Password Reset (SSPR) with password policy enforcement, but SSPR only facilitates password changes and does not block weak passwords; the actual blocking is done by Password Protection, which is a separate feature.

Why the other options are wrong

Password hash synchronization is a feature for syncing password hashes from on-premises AD to Entra ID for authentication, not for enforcing password policies like blocking weak or context-specific passwords.

Self-Service Password Reset (SSPR) allows users to reset their own passwords but does not enforce password policies that block weak or context-specific passwords. The question asks for a feature to prevent weak passwords, which is handled by Password Protection, not SSPR.

Conditional Access is used to enforce access controls based on signals like user location or device state, not to enforce password complexity or block weak passwords.

When would these options actually be correct?

In a hybrid identity scenario where the organization wants to enable cloud authentication for users synced from on-premises AD, enabling password hash synchronization would be the correct answer.

A company wants to enable users to reset their forgotten passwords without IT helpdesk intervention, while still requiring multi-factor authentication for the reset process. The correct answer would be Self-Service Password Reset (SSPR) with appropriate authentication methods.

A company wants to require multi-factor authentication when users sign in from untrusted locations or devices. Which Microsoft Entra ID feature should they use?

Why candidates pick the wrong answer

Candidates may confuse password policy enforcement with password synchronization, thinking that syncing hashes also applies policy checks, or they may misremember the name of the password protection feature.

Candidates may confuse SSPR with password policy enforcement because both relate to password management, or they might think SSPR includes policy checks when it only facilitates password changes.

Candidates may confuse policy enforcement for password strength with broader access control policies, assuming Conditional Access can handle password rules.

Full explanation →

1223

MCQmedium

A healthcare organization must automatically detect documents containing patient health information (PHI) in SharePoint Online and apply a retention label that retains the documents for 10 years. Additionally, they want to prevent users from permanently deleting these documents during the retention period. Which Microsoft Purview solution should they use to achieve this?

A.Data Lifecycle Management

B.Records Management

C.Data Loss Prevention (DLP)

D.Communication Compliance

AnswerB

Correct. Records Management uses retention labels that can be configured to mark items as records. When an item is a record, it cannot be deleted, edited, or modified by users during the retention period. This satisfies the requirement to prevent permanent deletion.

Why this answer

Records Management (option B) is correct because it enables organizations to declare documents as records, which locks them against deletion or modification for a specified retention period. In this scenario, automatically detecting PHI in SharePoint Online and applying a retention label that both retains documents for 10 years and prevents permanent deletion is a core Records Management capability, as it uses retention labels configured to mark items as records (or regulatory records) to enforce immutability.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management (which handles retention and deletion but not immutability) with Records Management (which adds the critical 'lock as a record' capability to prevent deletion), leading them to incorrectly select option A.

How to eliminate wrong answers

Option A is wrong because Data Lifecycle Management (DLP lifecycle) focuses on managing retention and deletion of content based on policies but does not inherently prevent users from permanently deleting documents during the retention period; it lacks the 'lock as a record' functionality that enforces immutability. Option C is wrong because Data Loss Prevention (DLP) is designed to detect and prevent unauthorized sharing or leakage of sensitive information (e.g., PHI), not to enforce retention or prevent deletion of documents. Option D is wrong because Communication Compliance is used to monitor and analyze communications (e.g., email, Teams) for policy violations, such as insider trading or harassment, and does not provide retention labeling or deletion prevention for documents.

Full explanation →

1224

MCQmedium

A company uses Microsoft 365 and wants to protect against sophisticated phishing attacks that use malicious links in email. They also want real-time analysis of URLs at the time of click. Which Microsoft Defender for Office 365 feature provides this?

A.Safe Links

B.Safe Attachments

C.Anti-spam

D.Anti-malware

AnswerA

Safe Links is a critical feature of Microsoft Defender for Office 365 that provides real-time, time-of-click protection against malicious URLs. When a user clicks a link in an email, Microsoft Teams, or supported Office apps, Safe Links rewrites the URL and scans it to determine if it leads to a malicious site. If the link is deemed harmful, the user is blocked from accessing the site, even if the original link was benign at the time of email delivery but later became malicious. This proactive defense is essential for protecting against evolving phishing and targeted attacks.

Why this answer

Safe Links is the correct answer because it provides URL scanning and real-time click-time verification of links in email messages and Office documents. When a user clicks a link, Defender for Office 365 checks the URL against a dynamic list of known malicious sites and performs a real-time analysis to determine if the link is safe at that moment, protecting against sophisticated phishing attacks that use malicious links.

Exam trap

The trap here is that candidates often confuse Safe Links with Safe Attachments, but Safe Attachments focuses on file-based malware detonation, not on real-time URL analysis at the moment of click.

How to eliminate wrong answers

Option B (Safe Attachments) is wrong because it scans email attachments for malware by detonating them in a sandbox environment, not by analyzing URLs at the time of click. Option C (Anti-spam) is wrong because it filters incoming email based on spam criteria (e.g., bulk mail, spoofing) and does not perform real-time URL analysis at click time. Option D (Anti-malware) is wrong because it detects and removes known malware signatures from email and files, but it does not provide dynamic, click-time URL verification against phishing links.

Full explanation →

1225

MCQeasy

A financial institution uses digital signatures to ensure that a transaction record has not been altered after it was processed. Which security principle is primarily addressed?

A.A. Confidentiality

B.B. Integrity

C.C. Availability

D.D. Non-repudiation

AnswerB

Integrity ensures that data has not been tampered with or altered from its original state. Digital signatures achieve this by creating a unique cryptographic hash of the document, which is then encrypted with the sender's private key. Any subsequent modification to the document would result in a different hash value, immediately revealing that the data's integrity has been compromised upon verification.

Why this answer

Digital signatures use asymmetric cryptography (e.g., RSA or ECDSA) to create a hash of the transaction record, which is then encrypted with the sender's private key. Any alteration to the record after signing would cause the hash verification to fail, directly ensuring data integrity. This is why option B is correct.

Exam trap

The trap here is that candidates often confuse non-repudiation (which focuses on proving the origin of the signature) with integrity (which focuses on proving the data has not been altered), but the question's wording 'has not been altered' points directly to integrity.

Why the other options are wrong

Digital signatures ensure data has not been altered, which addresses integrity, not confidentiality. Confidentiality is about preventing unauthorized access to data, not detecting changes.

The question focuses on ensuring a transaction record has not been altered, which is the definition of integrity. Availability is about ensuring systems and data are accessible when needed, not about preventing unauthorized modification.

Non-repudiation ensures that a party cannot deny having performed an action, such as signing a transaction. The question focuses on preventing alteration after processing, which is integrity, not on denying the action itself.

When would these options actually be correct?

A question asking which principle is primarily addressed by encrypting data at rest or in transit, or by using access controls to restrict data access, would have confidentiality as the correct answer.

A question asking which security principle is addressed by implementing redundant servers and backup power supplies to ensure a system remains operational during a power outage would have availability as the correct answer.

A question asking which security principle ensures that a sender cannot deny having sent a digitally signed message, or that a recipient cannot deny receipt, would have non-repudiation as the correct answer.

Why candidates pick the wrong answer

Candidates may confuse digital signatures with encryption, thinking they both protect data from unauthorized viewing, but signatures focus on integrity, not secrecy.

Candidates may confuse availability with integrity because both are part of the CIA triad, and they might think that preventing alteration also ensures the data remains available in its correct form, but availability specifically refers to uptime and accessibility, not data correctness.

Candidates often associate digital signatures with non-repudiation because signatures provide proof of origin, but they overlook that the question specifically addresses alteration (integrity) rather than denial of action.

Full explanation →

1226

MCQmedium

An organization uses Microsoft Entra ID for identity management and wants to allow external partners to access their resources using their own corporate credentials. Which feature should they enable?

A.Entra External ID

B.Identity Protection

C.Conditional Access

D.Privileged Identity Management

AnswerA

Microsoft Entra External ID is the comprehensive solution designed for managing all external identities, including partners, customers, and other collaborators. It facilitates secure business-to-business (B2B) collaboration by allowing organizations to invite guest users from other Microsoft Entra tenants, social identity providers, or via email one-time passcodes. This enables external users to access internal applications and resources while maintaining their original identity provider.

Why this answer

Entra External ID (formerly Azure AD B2B) enables organizations to invite external partners to access resources using their own corporate credentials. This feature leverages federation protocols such as SAML, WS-Fed, or OpenID Connect to authenticate the partner's identity in their home tenant, eliminating the need for separate local accounts.

Exam trap

The trap here is that candidates often confuse Conditional Access (a policy engine) with the ability to invite external identities, mistakenly thinking policies alone can grant external access without a federation mechanism.

How to eliminate wrong answers

Option B is wrong because Identity Protection is a risk-detection service that monitors sign-in anomalies and user risk, not a feature for inviting external users with their own credentials. Option C is wrong because Conditional Access enforces policy-based access controls (e.g., MFA, location) after authentication, but does not itself enable external identity federation. Option D is wrong because Privileged Identity Management manages just-in-time privileged role activation and access reviews for internal users, not external partner authentication.

Full explanation →

1227

Multi-Selecteasy

Which TWO Microsoft Purview solutions help organizations respond to data subject requests under GDPR?

Select 2 answers

A.eDiscovery

B.Information barriers

C.Data Lifecycle Management

D.Data Loss Prevention (DLP)

E.Communication compliance

AnswersA, C

eDiscovery in Microsoft Purview is specifically designed to identify, preserve, collect, process, review, and export electronically stored information (ESI). This functionality is crucial for responding to legal requests, regulatory investigations, and data subject access requests (DSARs) by allowing organizations to efficiently locate and retrieve relevant data across various Microsoft 365 services. It centralizes the search and collection process for compliance needs.

Why this answer

eDiscovery (A) is correct because it enables organizations to search for and export personal data across Microsoft 365 workloads (Exchange, SharePoint, OneDrive, Teams) to fulfill data subject access and export requests under GDPR Article 15. Data Lifecycle Management (C) is correct because it allows organizations to retain personal data for the minimum necessary period and permanently delete it when no longer needed, supporting the right to erasure under GDPR Article 17.

Exam trap

Candidates often mistakenly think that Data Loss Prevention (DLP) can directly respond to data subject requests, but DLP only prevents data leaks and does not provide the search, export, or deletion workflows required for GDPR rights.

Full explanation →

1228

MCQmedium

A company uses Microsoft 365 and stores many business documents in SharePoint Online and OneDrive. The security team wants to automatically detect and block malicious files (e.g., those containing ransomware or other malware) that are uploaded to these document libraries. Files should be scanned and held until proven safe. Which Microsoft security solution should they enable to provide this protection?

A.Microsoft Defender for Endpoint

B.Microsoft Defender for Identity

C.Microsoft Defender for Office 365

D.Microsoft Defender for Cloud

AnswerC

Microsoft Defender for Office 365 (MDO) is specifically designed to protect against threats originating from email and collaboration tools within Microsoft 365. Its Safe Attachments feature extends protection to files stored in SharePoint Online, OneDrive for Business, and Microsoft Teams, proactively scanning documents for malware and blocking access to malicious content. This ensures that business documents stored in these cloud locations are secured against advanced threats like zero-day malware. Furthermore, MDO provides Safe Links and anti-phishing capabilities to safeguard users from malicious URLs and impersonation attempts.

Why this answer

Microsoft Defender for Office 365 includes Safe Attachments for SharePoint, OneDrive, and Microsoft Teams, which automatically scans files uploaded to these document libraries. If a file is detected as malicious (e.g., ransomware or malware), it is blocked and held in quarantine until it is proven safe, providing the exact protection described in the scenario.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Office 365 with Microsoft Defender for Endpoint, assuming endpoint protection covers cloud storage scanning, but Safe Attachments is a specific feature of Defender for Office 365 that protects SharePoint and OneDrive at the file level.

Why the other options are wrong

Microsoft Defender for Endpoint protects devices (endpoints) from malware, but does not scan files uploaded to SharePoint Online or OneDrive. The question specifically asks for a solution that scans files in document libraries, which is a workload protected by Defender for Office 365.

Microsoft Defender for Identity focuses on detecting and investigating advanced threats, compromised identities, and malicious insider actions using Active Directory signals, not on scanning files in SharePoint or OneDrive for malware.

Microsoft Defender for Cloud is designed to protect cloud workloads (e.g., VMs, containers, PaaS services) across Azure and hybrid environments, not to scan and block malicious files in SharePoint Online or OneDrive document libraries.

When would these options actually be correct?

A company wants to protect its Windows and macOS devices from malware and detect advanced threats on endpoints. The question asks: 'Which solution should they deploy to provide antivirus, endpoint detection and response (EDR), and automated investigation on corporate laptops?'

A question asking which Microsoft solution detects and alerts on suspicious user behavior, such as anomalous logins or privilege escalation attempts, using on-premises Active Directory and cloud identity signals would make Defender for Identity the correct answer.

A company runs Azure VMs and wants to detect and respond to threats on those virtual machines, including fileless malware and suspicious process behaviors. Enabling Microsoft Defender for Cloud would be the correct answer.

Why candidates pick the wrong answer

Candidates may think that since Defender for Endpoint detects malware on devices, it would also scan files in cloud storage. They overlook that SharePoint and OneDrive are cloud services protected by Defender for Office 365, not endpoint-level solutions.

Candidates may confuse 'Identity' with 'Office 365' because both involve Microsoft 365 security, or they might think identity protection includes file scanning, not realizing the specific focus on user accounts and authentication.

Candidates may confuse 'cloud' with Microsoft 365 cloud services, assuming Defender for Cloud covers all cloud-based threats including SharePoint and OneDrive, when it actually focuses on infrastructure security.

Full explanation →

1229

MCQmedium

Your organization uses Microsoft Purview eDiscovery (Premium) to manage a legal case. You need to place a hold on custodians' mailboxes and SharePoint sites to preserve relevant data. Which step must you first take in the eDiscovery workflow?

A.Export results

B.Create a case

C.Create a review set

D.Search for content

AnswerB

You must create a case first to manage the legal matter.

Why this answer

In Microsoft Purview eDiscovery (Premium), the workflow begins with creating a case, which serves as the container for all subsequent actions, including holds, searches, and review sets. Without a case, you cannot place holds on custodians' mailboxes or SharePoint sites because the hold is scoped to the case. Therefore, creating a case is the mandatory first step before any preservation or search activities.

Exam trap

The trap here is that candidates often confuse the eDiscovery workflow with a simple search-and-export process, skipping the case creation step because they assume you can directly search or place holds without a container.

How to eliminate wrong answers

Option A is wrong because exporting results is a final step in the eDiscovery workflow, performed after searches and reviews are complete, not before placing holds. Option C is wrong because a review set is created after content is collected and processed, not as the first step; holds are placed before or during the search phase. Option D is wrong because searching for content typically occurs after the case is created and holds are defined, as the hold itself preserves data for the search scope.

Full explanation →

1230

MCQhard

A financial services company needs to comply with GDPR and requires that personal data be automatically classified and protected when stored in Microsoft SharePoint and OneDrive. They also need to retain certain records for a minimum of 7 years. Which combination of Microsoft Purview capabilities should they use?

A.Sensitivity labels and data loss prevention (DLP) policies

B.Sensitivity labels and retention labels

C.Data loss prevention (DLP) policies and retention labels

D.eDiscovery and sensitivity labels

AnswerB

Sensitivity labels classify and protect data; retention labels enforce retention periods.

Why this answer

Sensitivity labels classify and protect personal data (e.g., encrypt, apply markings), while retention labels enforce the required 7-year retention period. Option A is incorrect because DLP policies detect and prevent data loss but do not enforce retention. Option C is incorrect because DLP policies do not classify data.

Option D is incorrect because eDiscovery is for searching and exporting data, not for classification or retention.

Full explanation →

1231

MCQeasy

Which Microsoft Purview solution should you use to automatically retain or delete content based on regulations?

A.Records Management

B.Communication Compliance

C.Data Loss Prevention (DLP)

D.eDiscovery

AnswerA

Records Management in Microsoft Purview is specifically designed to help organizations meet their legal, regulatory, and business obligations for retaining and disposing of information. It enables the declaration of content as a record, applying immutable retention labels and policies to automatically retain items for a specified period or delete them defensibly when no longer required. This ensures that critical business information is preserved and disposed of according to a defined lifecycle, preventing accidental deletion and supporting compliance audits.

Why this answer

Records Management in Microsoft Purview provides policy-based retention and deletion labels that automatically enforce regulatory compliance requirements, such as GDPR or SOX. It uses retention labels and label policies to mark content for a specified duration, after which it is either retained, deleted, or reviewed via disposition review. This directly addresses the need to automatically retain or delete content based on regulations.

Exam trap

The trap here is that candidates confuse Communication Compliance (which monitors for policy violations) with Records Management (which enforces retention and deletion schedules), because both involve 'compliance' but serve fundamentally different purposes.

How to eliminate wrong answers

Option B (Communication Compliance) is wrong because it focuses on detecting and remediating inappropriate communications (e.g., harassment, insider trading) rather than automatically retaining or deleting content based on regulatory schedules. Option C (Data Loss Prevention) is wrong because it is designed to prevent unauthorized sharing or leakage of sensitive data through policy enforcement, not to manage retention or deletion lifecycles. Option D (eDiscovery) is wrong because it is used for searching, holding, and exporting content for legal or investigative purposes, not for automated retention or deletion based on time-based regulations.

Full explanation →

1232

MCQmedium

A company uses Microsoft Entra ID. The security team wants to enforce multifactor authentication (MFA) only when users sign in from devices that are not compliant with company security policies. They also want to block sign-ins from unknown geographic locations. Which Microsoft Entra feature should they configure?

A.Identity Protection

B.Privileged Identity Management (PIM)

C.Conditional Access

D.Self-Service Password Reset (SSPR)

AnswerC

Microsoft Entra Conditional Access is a policy engine that evaluates various signals, including user identity, device state, sign-in location, and application, to make real-time access decisions. It directly enables the creation of granular policies to enforce requirements like multi-factor authentication (MFA) or compliant devices, or to block access entirely, based on specific conditions such as device compliance or trusted network locations, precisely meeting the stated requirements.

Why this answer

Conditional Access is the correct feature because it allows administrators to create policies that evaluate signals such as device compliance and geographic location before granting access. By configuring a policy that requires MFA for non-compliant devices and blocks sign-ins from unknown locations, the security team can enforce these specific conditions. This granular control is unique to Conditional Access, which integrates with Microsoft Entra ID to enforce access decisions based on real-time risk and context.

Exam trap

The trap here is that candidates often confuse Identity Protection's risk-based conditional access with the broader Conditional Access feature, not realizing that Identity Protection only provides risk signals and requires Conditional Access to enforce the actual MFA or block action.

How to eliminate wrong answers

Option A is wrong because Identity Protection focuses on detecting and responding to identity-based risks (e.g., leaked credentials, anonymous IP addresses) but does not natively enforce MFA based on device compliance or block sign-ins from unknown geographic locations; it can trigger Conditional Access policies but is not the feature to configure the rules themselves. Option B is wrong because Privileged Identity Management (PIM) is designed for just-in-time privileged role activation and access reviews, not for enforcing MFA or location-based blocking for regular user sign-ins. Option D is wrong because Self-Service Password Reset (SSPR) allows users to reset their own passwords and does not provide any mechanism to enforce MFA or block sign-ins based on device compliance or geographic location.

Full explanation →

1233

Multi-Selectmedium

Which two capabilities are provided by Microsoft Entra ID? (Choose two.)

Select 2 answers

A.Mobile device management (MDM)

B.Conditional Access policies

C.Identity protection with risk-based conditional access

D.Data loss prevention (DLP) for sensitive information

E.Cloud access security broker (CASB)

AnswersB, C

Conditional Access policies are a core security feature within Microsoft Entra ID, allowing organizations to enforce specific access controls based on various signals. These policies evaluate conditions such as user identity, device state, location, and application to determine whether to grant access, block access, or require additional authentication methods like multi-factor authentication. This capability is fundamental for implementing Zero Trust principles in Entra ID by ensuring only authorized users on compliant devices can access resources.

Why this answer

Conditional Access policies (B) are a core capability of Microsoft Entra ID, enabling administrators to enforce access controls based on signals like user location, device state, and application sensitivity. Identity Protection with risk-based conditional access (C) leverages machine learning to detect sign-in and user risks, automatically applying policies to block or require multi-factor authentication. Both are native to Microsoft Entra ID and integral to its identity and access management (IAM) framework.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID's identity-focused capabilities (Conditional Access, Identity Protection) with adjacent security services like Intune (MDM), Microsoft Purview (DLP), and Defender for Cloud Apps (CASB), which are separate products in the Microsoft security stack.

Full explanation →

1234

MCQmedium

Your organization is deploying Microsoft Entra ID Governance. You need to automate the process of removing user access to a critical application when the user leaves the company. Which feature should you configure?

A.Privileged Identity Management

B.Entitlement Management

C.Access Reviews

D.Lifecycle Workflows

AnswerB

Entitlement Management is a robust capability within Microsoft Entra ID Governance that enables organizations to manage identity and access lifecycle at scale through access packages. It allows for automatic access removal based on various lifecycle events, such as a user's employment status change or removal from a connected organization. This makes it ideal for ensuring access to groups, applications, and SharePoint sites is revoked promptly and automatically when no longer needed, aligning perfectly with the need for automated access removal.

Why this answer

Entitlement Management in Microsoft Entra ID Governance allows you to create access packages that govern access to resources like critical applications. By configuring an access package with a 'Remove access when user leaves' policy, you can automatically revoke the user's assignments when their lifecycle state changes to 'leaving', ensuring access is removed without manual intervention.

Exam trap

The trap here is that candidates confuse Lifecycle Workflows (which handle user lifecycle tasks like account disablement) with Entitlement Management (which governs resource-specific access removal), leading them to pick D instead of B.

How to eliminate wrong answers

Option A is wrong because Privileged Identity Management (PIM) is designed for just-in-time privileged role activation and oversight, not for automating removal of standard user access upon departure. Option C is wrong because Access Reviews provide periodic attestation of access (e.g., quarterly reviews) but do not automatically remove access when a user leaves; they require a reviewer to act. Option D is wrong because Lifecycle Workflows automate pre-hire and post-departure tasks (like sending emails or disabling accounts) but do not directly manage application-level access removal; Entitlement Management handles the resource-specific assignment revocation.

Full explanation →

1235

Multi-Selecthard

Which THREE Microsoft Purview solutions support data classification and labeling? (Choose THREE.)

Select 3 answers

A.Information Protection

B.Insider Risk Management

C.Data Lifecycle Management

D.Communication Compliance

E.Data Loss Prevention

AnswersA, C, E

Microsoft Purview Information Protection (MPIP) is a core solution for data classification, enabling organizations to define, apply, and manage sensitivity labels across various data types and locations. These labels classify data based on its sensitivity level, which then dictates subsequent protection actions such as encryption, access restrictions, and visual markings. MPIP provides the essential framework for identifying and categorizing sensitive information, making it fundamental to any data classification strategy.

Why this answer

Microsoft Purview Information Protection handles classification and labeling of data. Data Loss Prevention uses labels to enforce policies. Data Lifecycle Management uses labels for retention and deletion.

Communication Compliance monitors communications but does not directly classify or label data. Insider Risk Management identifies risky activities but does not classify data.

Full explanation →

1236

MCQmedium

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their existing Facebook accounts without creating a separate Microsoft Entra ID account. What should you configure?

A.Configure Microsoft Entra ID Protection

B.Create a Microsoft Entra External ID tenant and add Facebook as an identity provider

C.Enable Microsoft Entra ID Domain Services

D.Configure Microsoft Entra ID Governance

AnswerB

Microsoft Entra External ID (formerly Azure AD B2C) is a customer identity and access management (CIAM) solution specifically designed for managing consumer identities for customer-facing applications. By creating an External ID tenant, organizations can integrate various social identity providers, including Facebook, Google, and Microsoft accounts, allowing users to sign up and sign in using their existing social credentials. This capability directly addresses the requirement for enabling social login functionality for external users.

Why this answer

Microsoft Entra External ID (formerly Azure AD B2C) is designed to allow external identities, such as social identity providers like Facebook, to authenticate users without requiring a separate Microsoft Entra ID account. By creating an External ID tenant and adding Facebook as an identity provider, you enable users to sign in using their existing Facebook credentials via OAuth 2.0 or OpenID Connect protocols.

Exam trap

The trap here is that candidates often confuse Microsoft Entra External ID (B2C) with Microsoft Entra ID (Azure AD) itself, assuming social identity providers can be added directly to a standard tenant, but only an External ID tenant supports social identity federation without requiring a separate Microsoft Entra ID account.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Protection is a security feature that detects and responds to identity risks (e.g., leaked credentials, sign-ins from anonymous IPs), not a mechanism for adding external identity providers like Facebook. Option C is wrong because Microsoft Entra ID Domain Services provides managed domain services (e.g., LDAP, Kerberos, NTLM) for legacy on-premises applications, not social identity federation. Option D is wrong because Microsoft Entra ID Governance focuses on managing identity lifecycle, access reviews, and entitlement management, not on configuring external authentication sources.

Full explanation →

1237

MCQmedium

A company uses Microsoft Entra ID. The security team wants to grant temporary, time-bound administrative access to the Microsoft 365 user management role for IT support staff. The access should require an approval from a senior administrator, and all actions should be audited. Which Microsoft Entra ID feature should they configure?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management (PIM)

D.Identity Governance

AnswerC

Microsoft Entra Privileged Identity Management (PIM) is the specific service designed to manage, control, and monitor access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. It provides just-in-time (JIT) privileged access, allowing users to activate roles for a limited duration, often requiring multi-factor authentication and an approval workflow. This capability directly addresses the need for time-bound privilege elevation with comprehensive auditing and accountability, significantly reducing the attack surface.

Why this answer

Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access with time-bound role activation, approval workflows, and full auditing. This directly matches the requirement for temporary, approved administrative access to the Microsoft 365 user management role with audit trails.

Exam trap

The trap here is confusing Identity Governance (which handles access reviews and entitlement management for regular users) with Privileged Identity Management (which specifically handles just-in-time privileged role activation and approval).

Why the other options are wrong

Conditional Access controls access based on conditions like location or device state, but it does not provide time-bound, approval-based role activation or auditing for administrative roles.

Identity Protection is designed to detect and respond to identity-based risks, such as compromised credentials or suspicious sign-ins, not to manage temporary, time-bound administrative access with approval workflows.

Identity Governance focuses on managing user identity lifecycles, access certifications, and entitlement management, but does not provide time-bound, approval-based privileged role activation with auditing. PIM is required for just-in-time administrative access.

When would these options actually be correct?

A company wants to require multi-factor authentication or block access from specific locations when users access a sensitive cloud application. Conditional Access would be configured to enforce those policies at sign-in.

A company wants to automatically detect and block risky sign-in attempts (e.g., from anonymous IP addresses or atypical locations) and require multi-factor authentication for high-risk users. Identity Protection would be the correct feature to configure.

A company needs to automate access reviews for all users with access to sensitive HR applications, ensuring that managers periodically certify continued access. Identity Governance's access reviews would be the correct feature to configure.

Why candidates pick the wrong answer

Candidates may confuse Conditional Access with access control for privileged roles, not realizing it applies to user sign-in conditions rather than role activation workflows.

Candidates may confuse Identity Protection with access management features because its name suggests controlling access, but it focuses on risk detection rather than privileged access governance.

Candidates may confuse the broad term 'Identity Governance' with the specific PIM feature, thinking governance includes all access management, but PIM is a separate component for privileged roles.

Full explanation →

1238

MCQeasy

A company is migrating its on-premises virtual machines to Azure Infrastructure-as-a-Service (IaaS). Which security responsibility primarily shifts from the customer to Microsoft during this migration?

A.Physical security of the data center

B.Patching the guest operating system

C.Managing user access to the virtual machines

D.Configuring the firewall rules for the virtual network

AnswerA

In the Shared Responsibility Model for Infrastructure as a Service (IaaS), Microsoft is solely responsible for the physical security of the underlying data centers. This encompasses safeguarding the physical infrastructure, implementing robust access controls, deploying surveillance systems, and managing environmental factors like power, cooling, and fire suppression. Customers are relieved of these foundational infrastructure concerns, allowing them to focus on their virtualized workloads.

Why this answer

When migrating on-premises virtual machines to Azure IaaS, Microsoft takes over responsibility for the physical security of the data centers, including environmental controls, hardware maintenance, and physical access controls. This is a fundamental shift from the customer's responsibility under the shared responsibility model, where the customer previously managed the physical infrastructure on-premises.

Exam trap

The trap here is that candidates often confuse the shared responsibility model for IaaS with PaaS or SaaS, mistakenly thinking Microsoft handles guest OS patching or network configuration, when in fact those remain customer responsibilities in IaaS.

How to eliminate wrong answers

Option B is wrong because patching the guest operating system remains the customer's responsibility in an IaaS model, as Microsoft only manages the hypervisor and host OS. Option C is wrong because managing user access to the virtual machines (e.g., via Azure RBAC or local accounts) is always the customer's responsibility, as Microsoft has no knowledge of or control over who should access the VMs. Option D is wrong because configuring firewall rules for the virtual network (e.g., Network Security Groups or Azure Firewall policies) is a customer-managed task, as Microsoft only provides the networking infrastructure but does not define traffic rules.

Full explanation →

1239

MCQeasy

A company deploys full disk encryption on all employee laptops to protect data in case a device is lost or stolen. Which security goal does this measure primarily address?

A.Confidentiality

B.Integrity

C.Availability

D.Non-repudiation

AnswerA

Full disk encryption (FDE) directly addresses confidentiality by rendering all data on a laptop unreadable to unauthorized individuals. If the device is lost or stolen, the encrypted data remains protected, preventing its disclosure without the correct decryption key. This ensures that only authorized users or processes can access and interpret the sensitive information stored on the drive.

Why this answer

Full disk encryption (FDE) ensures that data stored on the laptop's hard drive is unreadable without the correct decryption key. This directly protects the confidentiality of the data by preventing unauthorized access if the device is lost or stolen, as the encrypted data cannot be deciphered without the key.

Exam trap

The trap here is that candidates often confuse encryption with integrity or availability, mistakenly thinking encryption also prevents data tampering or ensures data is always accessible, but encryption only addresses unauthorized reading (confidentiality).

How to eliminate wrong answers

Option B (Integrity) is wrong because full disk encryption does not protect against unauthorized modification of data; it only prevents unauthorized reading. Option C (Availability) is wrong because encryption does not ensure data is accessible when needed; in fact, a lost key can reduce availability. Option D (Non-repudiation) is wrong because encryption does not provide proof of origin or action; non-repudiation is typically achieved through digital signatures or audit logs.

Full explanation →

1240

MCQhard

AdventureWorks, a multinational manufacturing company, uses Microsoft Purview and Microsoft Communication Compliance to monitor and manage internal communications. They need to: (1) detect and review emails containing offensive language or harassment; (2) allow employees to report inappropriate messages; (3) retain reviewed messages for 5 years; (4) ensure that only designated reviewers can access the communication compliance data; (5) integrate with Microsoft Teams and Exchange Online. The company has 10,000 users and Microsoft 365 E5 licenses. The compliance team wants a solution that automates detection and provides secure review. What should they configure?

A.Create a Communication Compliance policy with conditions for offensive language, enable user reporting, and configure a retention policy for 5 years on the original content locations (e.g., Exchange Online mailboxes, Teams chats, SharePoint sites).

B.Enable mailbox auditing and create a custom script to search for offensive language.

C.Create a Data Loss Prevention (DLP) policy to block offensive language and enable eDiscovery for review.

D.Configure information barriers between departments and use audit logs for review.

AnswerA

Communication Compliance meets all requirements for detection, reporting, retention, and access control.

Why this answer

Communication Compliance policies detect offensive language and harassment, allow user reporting, and support secure review by designated reviewers. A Microsoft 365 retention policy must be applied to the original content locations where the messages reside to retain them for 5 years. Option A is correct.

Full explanation →

1241

MCQeasy

A company uses Microsoft 365 and needs to prevent employees in the Mergers & Acquisitions (M&A) department from communicating with employees in the Trading department via Microsoft Teams chat, email, and SharePoint sharing. They must ensure that these restrictions are automatically enforced by Microsoft 365. Which Microsoft Purview solution should the administrator configure?

A.Microsoft Purview Information Barriers

B.Microsoft Purview Communication Compliance

C.Microsoft Purview Data Lifecycle Management

D.Microsoft Purview eDiscovery (Premium)

AnswerA

Microsoft Purview Information Barriers enable organizations to segment users into distinct groups and define policies that prevent or allow communication between them. This is crucial for managing conflicts of interest or adhering to regulatory requirements within specific departments like finance or legal. It effectively restricts collaboration in Microsoft Teams, SharePoint, and Exchange Online, ensuring sensitive information remains within designated boundaries and preventing unwanted interactions.

Why this answer

Information Barriers in Microsoft Purview are designed to prevent communication and collaboration between specified groups, helping organizations avoid conflicts of interest and comply with regulations.

Full explanation →

1242

MCQmedium

A company is moving its on-premises database to Azure SQL Database. According to the shared responsibility model, which security tasks remain the responsibility of the customer?

A.Patching the physical servers hosting the database

B.Managing access controls and authentication for database users

C.Securing the hypervisor running the virtual machines

D.Hardening the network firewalls at the datacenter perimeter

AnswerB

The customer retains responsibility for managing user identities, permissions, and authentication to the database.

Why this answer

In the shared responsibility model for Azure SQL Database, Microsoft manages the physical infrastructure, including servers, storage, and network, while the customer is responsible for data and access management. Option B is correct because managing access controls and authentication for database users, such as configuring logins, users, and permissions via T-SQL or Azure Active Directory, falls squarely on the customer. Microsoft ensures the platform is patched and secure, but the customer must control who can access the database and what they can do.

Exam trap

The trap here is that candidates often confuse PaaS with IaaS and assume the customer is responsible for patching or hypervisor security, but in Azure SQL Database (PaaS), Microsoft handles all infrastructure layers, leaving the customer only with data and access control responsibilities.

Why the other options are wrong

In Azure SQL Database, patching physical servers is the responsibility of Microsoft as the cloud provider, not the customer, because it is a Platform as a Service (PaaS) offering.

In Azure SQL Database, the hypervisor is managed by Microsoft as part of the infrastructure layer, not the customer. The shared responsibility model assigns physical and hypervisor security to the cloud provider.

When would these options actually be correct?

This would be correct in an on-premises scenario or an Infrastructure as a Service (IaaS) model where the customer manages the underlying infrastructure, such as patching physical servers hosting a SQL Server on a virtual machine.

In a question about an on-premises or IaaS scenario where the customer manages the virtual machines, such as 'A company deploys SQL Server on a self-managed Azure VM. According to the shared responsibility model, which security task remains the customer's responsibility?'

Why candidates pick the wrong answer

Candidates may confuse PaaS with IaaS or on-premises responsibilities, assuming that all patching tasks remain with the customer regardless of the service model.

Candidates may confuse PaaS (Azure SQL Database) with IaaS, where the customer is responsible for securing the guest OS and hypervisor-related configurations, or they may overestimate customer responsibility for virtualization security.

Full explanation →

1243

MCQmedium

A security administrator needs to enforce that all Microsoft 365 documents containing credit card numbers are automatically encrypted before being shared externally. Which Microsoft Purview solution should they use?

A.Microsoft Purview Audit

B.Microsoft Purview Communication Compliance

C.Microsoft Purview Data Loss Prevention

D.Microsoft Purview Information Protection

AnswerC

Microsoft Purview Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and protect sensitive information across endpoints, cloud apps, and services. When a DLP policy detects sensitive data in a document, it can be configured to automatically apply protective actions, including the application of sensitivity labels that enforce encryption, thereby preventing unauthorized sharing or exfiltration and ensuring data protection.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it can automatically detect sensitive data types, such as credit card numbers, in Microsoft 365 documents and enforce protective actions like encryption before external sharing. DLP policies use sensitive information types (e.g., Credit Card Number) and conditions to trigger encryption via Azure Information Protection, ensuring data is protected at rest and in transit.

Exam trap

The trap here is that candidates often confuse Information Protection (which handles labeling and classification) with DLP (which enforces protective actions like encryption), but Microsoft Purview DLP is the engine that actually triggers automatic encryption based on content detection.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Audit provides logging and investigation of user and admin activities, not proactive enforcement of encryption on documents. Option B is wrong because Microsoft Purview Communication Compliance focuses on detecting and remediating inappropriate communications (e.g., harassment, insider trading), not on encrypting documents containing sensitive data. Option D is wrong because Microsoft Purview Information Protection provides classification and labeling capabilities but does not natively enforce automatic encryption based on content detection; it requires integration with DLP policies to trigger encryption actions.

Full explanation →

1244

MCQmedium

A healthcare organization uses Microsoft 365 and must comply with HIPAA regulations. They need to assess their current compliance posture, identify gaps, and implement improvement actions. They want a tool that provides a compliance score based on best practices and regulatory frameworks, and offers recommended actions to improve the score. Which Microsoft Purview solution should they use?

A.Compliance Manager

B.Insider Risk Management

C.Communication Compliance

D.Audit

AnswerA

Microsoft Purview Compliance Manager is specifically engineered to help organizations manage their compliance posture against various regulatory standards and industry certifications. It provides a dashboard to assess current compliance status, offers actionable recommendations to improve the compliance score, and tracks progress over time. This tool simplifies the complex task of understanding and implementing necessary controls to meet regulatory obligations, such as those relevant to healthcare.

Why this answer

Compliance Manager is a Microsoft Purview solution that helps organizations assess their compliance posture against various regulations (including HIPAA) by providing a compliance score and actionable improvement recommendations. Insider Risk Management detects risky user activities. Communication Compliance monitors communications for policy violations.

Audit provides logging capabilities but does not assess compliance posture or provide a score.

Full explanation →

1245

MCQhard

During a security incident, a SOC analyst needs to investigate a compromised user account that accessed multiple cloud apps. Which Microsoft Defender XDR feature provides a unified view of the attack timeline across endpoints, identities, and cloud apps?

A.Incident response

B.Microsoft Secure Score

C.Advanced hunting

D.Action center

AnswerA

In Microsoft security platforms, "Incident response" provides a unified view that aggregates related alerts from various security workloads, such as endpoints, identities, and cloud applications. This centralized incident queue allows SOC analysts to efficiently investigate the full scope of a security breach, understand the attack story, and coordinate remediation actions, making it the primary starting point for comprehensive incident investigation.

Why this answer

Incident response in Microsoft Defender XDR aggregates alerts and activities from endpoints, identities, and cloud apps into a single incident view, providing a unified attack timeline. This allows the SOC analyst to see the full scope of the compromised user account's actions across all integrated workloads without switching between consoles.

Exam trap

The trap here is that candidates confuse 'Advanced hunting' (a powerful but manual query tool) with the automated, unified incident timeline that Incident Response provides, leading them to select the wrong option when the question explicitly asks for a 'unified view'.

How to eliminate wrong answers

Option B (Microsoft Secure Score) is wrong because it measures an organization's security posture based on configuration recommendations, not real-time incident investigation or attack timelines. Option C (Advanced hunting) is wrong because it is a query-based tool for proactively searching raw data across workloads, not a pre-built unified timeline view of a specific incident. Option D (Action center) is wrong because it lists pending and completed remediation actions (e.g., quarantine, block) but does not provide the chronological attack timeline across endpoints, identities, and cloud apps.

Full explanation →

1246

MCQmedium

A company runs Azure SQL databases containing customer transaction data. The security team needs to detect and alert on suspicious database access patterns, such as SQL injection attempts or access from unusual locations. Which Microsoft security solution should they enable?

A.Microsoft Defender for Cloud

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Office 365

D.Microsoft Sentinel

AnswerA

Microsoft Defender for Cloud provides comprehensive cloud security posture management (CSPM) and cloud workload protection (CWP) for Azure resources, including Azure SQL databases. Its advanced threat protection capabilities specifically monitor Azure SQL for suspicious activities such as SQL injection attempts, brute-force attacks, and unusual data access patterns. By leveraging built-in intelligence and behavioral analytics, Defender for Cloud proactively identifies and alerts on potential threats targeting the database layer, ensuring the security of customer data. This makes it the primary solution for native Azure SQL database threat detection.

Why this answer

Microsoft Defender for Cloud provides advanced threat protection for Azure SQL databases, including anomaly detection for suspicious activities like SQL injection and unusual access patterns. It uses machine learning to baseline normal database behavior and triggers alerts when deviations occur, such as access from atypical geographic locations or malicious query patterns.

Exam trap

The trap here is that candidates may confuse Microsoft Defender for Cloud's database-specific threat detection with Microsoft Sentinel's broader SIEM capabilities, but the question explicitly asks for a solution that detects and alerts on suspicious database access patterns, which is a built-in feature of Defender for Cloud, not Sentinel.

Why the other options are wrong

Microsoft Defender for Endpoint is designed to protect endpoints (devices) from threats, not to detect suspicious database access patterns like SQL injection or unusual location access on Azure SQL databases.

Microsoft Defender for Office 365 protects email and collaboration tools like Exchange Online and SharePoint, not Azure SQL databases. It cannot detect SQL injection or database access patterns.

Microsoft Sentinel is a SIEM/SOAR solution for aggregating and analyzing security data from multiple sources, but it does not natively detect SQL injection or unusual database access patterns without additional configuration. The question asks for a solution that directly protects Azure SQL databases, which is a core capability of Defender for Cloud's database-specific threat detection.

When would these options actually be correct?

A question asking for a solution to detect and respond to advanced threats on endpoints, such as malware, ransomware, or suspicious process behavior on Windows or Linux servers, would make Defender for Endpoint the correct answer.

A company wants to protect against phishing, malware, and malicious links in email attachments and Office documents. Enabling Microsoft Defender for Office 365 would be correct for securing email and collaboration workloads.

A company needs a centralized security information and event management (SIEM) solution to collect logs from multiple cloud and on-premises sources, correlate threats across the environment, and automate incident response. In that scenario, Microsoft Sentinel would be the correct answer.

Why candidates pick the wrong answer

Candidates may confuse 'Defender for Endpoint' with a general security solution, assuming it covers all Microsoft assets including databases, due to the broad 'Defender' branding.

Candidates may confuse 'Office 365' with cloud services in general, or assume that database alerts are part of Office 365 security due to the 'cloud' aspect.

Candidates may confuse Sentinel's advanced analytics and threat detection capabilities with the database-specific protections offered by Defender for Cloud, assuming that any security alerting must come from a SIEM.

Full explanation →

1247

MCQhard

Refer to the exhibit. A security analyst runs the KQL query in Microsoft Defender for Endpoint. The query returns no results. What is the most likely cause?

A.The device has a risk score of zero

B.The device runs macOS

C.The analyst lacks permissions to view the device

D.The device is not onboarded to Defender for Endpoint

AnswerD

The DeviceInfo table in Microsoft Defender for Endpoint exclusively stores records for devices that have been successfully onboarded and are actively reporting sensor data. If a device has not completed the onboarding process, or if its Defender for Endpoint sensor is not functioning or reporting, no corresponding entry will exist within the DeviceInfo table. Therefore, a KQL query attempting to retrieve information for such a device would correctly return an empty result set, indicating the absence of that device's data in the platform.

Why this answer

The KQL query in Microsoft Defender for Endpoint returns no results because the device is not onboarded. Defender for Endpoint can only report on devices that have been enrolled and are actively sending telemetry. If a device is not onboarded, no data exists for it in the security portal, so any query targeting that device will return empty results.

Exam trap

The trap here is that candidates may think a missing result is due to permissions or OS incompatibility, but the core prerequisite for any Defender for Endpoint query is that the device must be onboarded and actively reporting telemetry.

How to eliminate wrong answers

Option A is wrong because a risk score of zero does not prevent a query from returning results; it simply indicates no detected threats, but the device would still appear in query results. Option B is wrong because Microsoft Defender for Endpoint supports macOS devices, and a macOS device can be onboarded and queried successfully. Option C is wrong because if the analyst lacked permissions, the query would typically return an access denied error or no results at all, but the most common and direct cause for no results when a device is known to exist is that it has never been onboarded.

Full explanation →

1248

MCQeasy

Refer to the exhibit. The JSON shows a Conditional Access policy. What is the primary purpose of this policy?

A.Block legacy authentication protocols

B.Require MFA for all applications

C.Disable the policy for emergency access

D.Allow only iOS devices

AnswerA

The policy's "Client apps" condition is configured to target "Other clients," which is the category encompassing applications that utilize legacy authentication protocols such as POP, IMAP, SMTP, and older versions of Office clients that do not support modern authentication. By combining this specific client app condition with a "Block access" grant control, the policy effectively prevents users from authenticating via these less secure, legacy protocols. This significantly enhances security by forcing the use of modern authentication methods.

Why this answer

The policy targets 'Block legacy authentication' by applying a condition that blocks authentication attempts using legacy protocols (e.g., POP3, IMAP4, SMTP, ActiveSync) which do not support modern authentication methods like MFA. This is a common security measure to prevent credential-stuffing and password-spray attacks that exploit the lack of MFA enforcement in legacy protocols.

Exam trap

The trap here is that candidates often confuse 'blocking legacy authentication' with 'requiring MFA' — the policy blocks the protocol entirely rather than prompting for an additional factor, which is a distinct control in Conditional Access.

How to eliminate wrong answers

Option B is wrong because the policy does not require MFA; it explicitly blocks authentication entirely, not just requiring an additional factor. Option C is wrong because the policy does not include any exclusion for emergency access accounts (e.g., break-glass accounts) — it applies to all users unless a separate exclusion is configured. Option D is wrong because the policy does not filter by device platform (iOS) — it targets authentication protocol, not device type.

Full explanation →

1249

MCQmedium

A global company uses Microsoft Teams and SharePoint Online. They need to automatically detect and prevent sharing of intellectual property files containing 'Project X' with external users. What should they configure?

A.Microsoft Entra ID Access Reviews

B.Microsoft Purview Sensitivity Labels

C.Microsoft Purview Data Loss Prevention policy for SharePoint and OneDrive

D.Microsoft Defender for Cloud Apps Session Policy

AnswerC

Microsoft Purview Data Loss Prevention (DLP) policies for SharePoint and OneDrive are specifically engineered to identify, monitor, and protect sensitive information across these services. These policies utilize sensitive information types (SITs), keywords, and trainable classifiers to detect specific data patterns, such as credit card numbers or national IDs, and can then automatically block sharing, notify administrators, or apply encryption to prevent unauthorized data exfiltration.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) policies for SharePoint and OneDrive can be configured to automatically detect files containing sensitive content (e.g., 'Project X') and block sharing with external users. DLP policies inspect content at rest and during sharing actions, applying rules to prevent unauthorized external access.

Exam trap

The trap here is that candidates often confuse Sensitivity Labels (which classify and protect data) with DLP policies (which enforce actions like blocking sharing), but DLP is the correct tool for automatic detection and prevention of specific content sharing with external users.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Access Reviews are used for periodic review of user access rights, not for real-time detection and prevention of content sharing. Option B is wrong because Microsoft Purview Sensitivity Labels classify and protect data with encryption or markings but do not automatically detect and block sharing of specific content like 'Project X' with external users; they require manual or automated labeling but lack the policy-driven blocking of DLP. Option D is wrong because Microsoft Defender for Cloud Apps Session Policy controls user sessions in real-time (e.g., read-only access) but does not natively detect and block sharing of intellectual property files based on content inspection; it focuses on app-level access controls rather than content-based DLP.

Full explanation →

1250

MCQmedium

Your company is implementing a hybrid identity solution with Microsoft Entra ID. Users report that they can sign in to Microsoft 365 but cannot access on-premises applications that are configured for integrated Windows authentication. You need to ensure seamless single sign-on (SSO) for both cloud and on-premises resources. What should you implement?

A.Implement Passthrough Authentication.

B.Deploy Active Directory Federation Services (AD FS).

C.Enable Microsoft Entra seamless SSO.

D.Configure password hash synchronization.

AnswerC

Enabling Microsoft Entra seamless SSO is the correct solution as it provides automatic sign-in for users on corporate domain-joined devices connected to the corporate network. It achieves this by leveraging Kerberos, allowing users to silently authenticate to both cloud-based Microsoft Entra ID applications and on-premises applications configured for Integrated Windows Authentication (IWA) without re-entering their credentials. This mechanism ensures a true single sign-on experience across the hybrid environment.

Why this answer

Microsoft Entra seamless SSO (Seamless SSO) is the correct choice because it automatically signs users in when they are on corporate devices connected to the corporate network, using Kerberos delegation to provide single sign-on for both cloud resources (like Microsoft 365) and on-premises applications configured for Integrated Windows Authentication (IWA). This eliminates the need for users to re-enter credentials when accessing on-premises apps after authenticating to the cloud.

Exam trap

The trap here is that candidates often confuse Passthrough Authentication or password hash synchronization with providing SSO for on-premises applications, but neither includes the Kerberos delegation required for Integrated Windows Authentication, which is the specific need in this scenario.

How to eliminate wrong answers

Option A is wrong because Passthrough Authentication validates passwords against on-premises Active Directory but does not provide the Kerberos-based SSO needed for Integrated Windows Authentication to on-premises applications; it only handles cloud authentication. Option B is wrong because Active Directory Federation Services (AD FS) is a more complex, on-premises federation solution that can provide SSO, but it is overkill for this scenario and not the simplest or recommended approach when Seamless SSO can achieve the same goal with less infrastructure. Option D is wrong because password hash synchronization only synchronizes password hashes to the cloud for cloud authentication and does not enable Kerberos-based SSO for on-premises IWA applications.

Full explanation →

Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 1201–1250