Microsoft Security, Compliance, and Identity Fundamentals SC-900 SC-900 Questions 76–150 | Page 2/17

MCQhard

Refer to the exhibit. The exhibit shows an alert from Microsoft Defender XDR. The security team needs to determine if the file 'invoice.docm' is known malware and if other devices in the organization have this file. What should they do next?

A.Isolate the device DESKTOP-01 immediately

B.Trigger the automated investigation for this alert

C.Review the user jdoe's recent activities

D.Search in Advanced Hunting for the file's SHA256 hash across all devices

AnswerD

Searching for the file's SHA256 hash in Advanced Hunting is the most effective immediate next step because it allows security analysts to quickly determine the prevalence of the malicious file across the entire organizational environment. Using this unique cryptographic identifier ensures an accurate and comprehensive search, revealing if other endpoints have encountered or executed the same file. This crucial information is essential for understanding the scope of the compromise and prioritizing subsequent containment and eradication efforts.

Why this answer

Searching for the file's SHA256 hash in Advanced Hunting allows the security team to query across all devices in the organization to determine if the file is known malware (by cross-referencing with threat intelligence) and to identify which other devices have the same file. Advanced Hunting in Microsoft Defender XDR supports Kusto Query Language (KQL) queries against the DeviceFileEvents table, enabling hash-based file discovery and reputation checks.

Exam trap

The trap here is that candidates may choose 'Trigger the automated investigation' thinking it will automatically determine malware status and scope, but automated investigation focuses on response actions rather than providing the specific hash-based query results needed to answer both questions.

How to eliminate wrong answers

Option A is wrong because isolating the device prematurely could disrupt business operations and does not answer whether the file is known malware or if other devices have it. Option B is wrong because triggering an automated investigation would start response actions based on the alert, but it does not directly provide the specific information about the file's malware status or its presence on other devices. Option C is wrong because reviewing user jdoe's recent activities focuses on user behavior rather than the file's hash-based identification and propagation across devices.

Full explanation →

Multi-Selecthard

Which THREE capabilities are provided by Microsoft Purview? (Choose three.)

Select 3 answers

A.Data classification and labeling

B.Data lifecycle management and retention

C.Data loss prevention (DLP)

D.Identity protection and risk detection

E.Threat and vulnerability management

AnswersA, B, C

Purview classifies and labels sensitive data.

Why this answer

Microsoft Purview provides data classification and labeling capabilities, enabling organizations to identify, categorize, and protect sensitive data across their digital estate. This includes automatic and manual labeling of documents and emails based on content inspection and machine learning classifiers, which is a core function of the Microsoft Purview Information Protection solution.

Exam trap

The trap here is that candidates often confuse Microsoft Purview's data security capabilities (classification, DLP, retention) with identity or threat management features that belong to Microsoft Entra ID or Microsoft Defender solutions.

Full explanation →

MCQeasy

A company uses Microsoft Entra ID. The security manager wants to provide temporary, time-bound elevated access to the Global Administrator role only when needed, and require approval from a designated approver. Which Microsoft Entra ID capability should they use?

A.Microsoft Entra Conditional Access

B.Microsoft Entra Privileged Identity Management (PIM)

C.Microsoft Entra Identity Protection

D.Microsoft Entra Identity Governance (Access Reviews)

AnswerB

Microsoft Entra Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources within Microsoft Entra ID, Azure, and other Microsoft services. It enables just-in-time (JIT) access, allowing users to activate privileged roles only when needed and for a limited duration. PIM enforces time-bound assignments, multi-factor authentication, and approval workflows for role activation, significantly reducing the attack surface associated with standing privileged access.

Why this answer

Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by allowing users to activate the Global Administrator role for a limited, time-bound duration only when needed, and it enforces approval workflows from designated approvers. This directly matches the security manager's requirement for temporary, approval-based elevation.

Exam trap

The trap here is that candidates confuse Conditional Access (which controls sign-in conditions) with PIM (which controls role activation), leading them to pick A because they think 'time-bound' refers to session timeout policies rather than role activation duration.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Conditional Access controls access based on conditions like location or device compliance, but it does not provide time-bound role activation or approval workflows for privileged roles. Option C is wrong because Microsoft Entra Identity Protection detects and responds to identity risks (e.g., leaked credentials, sign-in anomalies) but does not manage privileged role activation or approval. Option D is wrong because Microsoft Entra Identity Governance (Access Reviews) is used for periodic certification of group memberships or role assignments, not for on-demand, time-bound elevation with approval.

Full explanation →

Multi-Selectmedium

Which THREE of the following are capabilities of Microsoft Defender for Office 365?

Select 3 answers

A.Safe Links protection in email and Office documents

B.Anti-phishing policies to protect against impersonation

C.Cloud discovery of unsanctioned SaaS apps

D.Device compliance policies for mobile devices

E.Safe Attachments scanning in email

AnswersA, B, E

Safe Links protects users from malicious URLs.

Why this answer

Safe Links is a core capability of Microsoft Defender for Office 365 that proactively scans URLs in email messages and Office documents (like Word, Excel, and PowerPoint) at the time of click. Safe Attachments scans email attachments in a detonation chamber before delivery to detect malicious content. Anti-phishing policies protect users from impersonation attacks by analyzing sender identity and email patterns.

Together, these three features provide multi-layered protection against email-borne threats.

Exam trap

The trap here is that candidates confuse the scope of Microsoft Defender for Office 365 with other Microsoft 365 security products, mistakenly attributing cloud discovery (Defender for Cloud Apps) or device compliance (Intune) to Defender for Office 365, which is strictly focused on email and Office document protection.

Full explanation →

MCQmedium

A company uses Microsoft Entra ID. The security team wants to configure a policy so that when a user signs in from an unfamiliar location (not on the company's trusted IP ranges) or from an unfamiliar device, they are prompted for additional verification (e.g., MFA). However, if the sign-in is from a trusted location (e.g., office IP range) and a known device, no additional verification is required. Which Microsoft Entra ID feature should they configure?

A.Microsoft Entra ID Protection

B.Microsoft Entra Conditional Access

C.Microsoft Entra Privileged Identity Management (PIM)

D.Microsoft Entra Access Reviews

AnswerB

Microsoft Entra Conditional Access is the correct solution as it enables granular policy enforcement based on real-time sign-in signals. It allows administrators to define conditions such as user/group, location (via named locations), and device state (e.g., compliant, hybrid Azure AD joined) to determine access. This capability directly supports requiring multi-factor authentication (MFA) for untrusted contexts while explicitly allowing trusted locations and known devices to bypass MFA, aligning perfectly with the scenario's need for conditional authentication.

Why this answer

Microsoft Entra Conditional Access is the correct feature because it allows administrators to define policies that evaluate sign-in context—such as user location (via named locations with trusted IP ranges) and device state (compliant or hybrid Azure AD joined)—and then enforce actions like requiring MFA only when conditions are not met. This directly matches the requirement to prompt for additional verification from unfamiliar locations or devices while skipping it for trusted ones.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID Protection with Conditional Access, but ID Protection provides risk signals (e.g., unfamiliar sign-in properties) that can be used by Conditional Access policies, not the policy engine itself that enforces location- and device-based MFA prompts.

Why the other options are wrong

Microsoft Entra ID Protection identifies risks like unfamiliar sign-in properties but does not enforce access policies; it only provides risk signals. Conditional Access is needed to actually require MFA based on those signals.

Privileged Identity Management (PIM) manages just-in-time privileged role activation and oversight, not sign-in risk policies based on location or device trust. The described policy requires Conditional Access to evaluate conditions like location and device state before prompting for MFA.

Access Reviews are used to review and certify user access rights periodically, not to enforce real-time sign-in policies based on location or device trust.

When would these options actually be correct?

A question asking which feature detects and reports risky sign-ins (e.g., from anonymous IP addresses or leaked credentials) without requiring policy enforcement would make ID Protection correct.

A question asks: 'The security team needs to require approval for activating the Global Administrator role and limit its usage to a specific time window.' In that scenario, PIM is the correct feature to configure role activation policies.

An exam question might ask: 'The compliance team needs to verify that all users with access to a sensitive application still require that access. Which feature should they use?' In that case, Access Reviews would be correct.

Why candidates pick the wrong answer

Candidates confuse risk detection (ID Protection) with risk-based policy enforcement (Conditional Access), assuming the feature that identifies risks also automatically applies controls.

Candidates may confuse PIM's role-based access controls with general access policies, or assume 'identity protection' features like risk-based policies are part of PIM, leading them to select it for any security policy involving identities.

Candidates may confuse Access Reviews with security policies because both involve access control, but Access Reviews focus on attestation and certification, not on conditional enforcement during sign-in.

Full explanation →

MCQmedium

Refer to the exhibit. You are reviewing a Conditional Access policy JSON in Microsoft Entra ID. What will this policy do?

A.Block access when user risk is medium or high

B.Block sign-ins when sign-in risk is high

C.Require MFA when user risk is high

D.Block access when user risk is high

AnswerD

This statement is correct because the Conditional Access policy is configured with 'User risk level' set to 'High' as a specific condition. Furthermore, the 'Grant' control for this policy is explicitly set to 'Block access.' This combination precisely dictates that if a user's risk level is assessed as high by Azure AD Identity Protection, their attempt to access resources will be blocked.

Why this answer

The policy JSON specifies `"userRiskLevels": ["high"]` and `"builtInControls": ["block"]`, meaning it blocks access when the user risk level is high. User risk reflects the likelihood that the user's identity is compromised, based on Microsoft's risk detection signals. Option D correctly identifies this behavior.

Exam trap

The trap here is confusing user risk with sign-in risk; candidates often pick 'block sign-ins when sign-in risk is high' because they overlook the `userRiskLevels` field in the JSON and assume the policy targets sign-in risk instead.

How to eliminate wrong answers

Option A is wrong because the policy only targets user risk level 'high', not 'medium or high'; Conditional Access policies require explicit risk level values. Option B is wrong because the policy evaluates user risk, not sign-in risk (which would use `signInRiskLevels` in the JSON). Option C is wrong because the policy's control is 'block', not 'require MFA'; requiring MFA would use `"mfa"` in the `builtInControls` array.

Full explanation →

MCQeasy

Your organization is implementing a Zero Trust security model. Which Microsoft Entra ID capability helps verify the identity of users before granting access to resources?

A.Microsoft Entra ID Connect

B.Microsoft Entra ID Domain Services

C.Microsoft Entra ID Governance

D.Microsoft Entra ID Protection

AnswerD

Microsoft Entra ID Protection is a key component for implementing Zero Trust principles by continuously evaluating user and sign-in risks. It detects potential vulnerabilities affecting identities, such as leaked credentials, and identifies suspicious sign-in activities, like impossible travel or sign-ins from infected devices. By integrating with Conditional Access policies, Entra ID Protection can then enforce adaptive controls, such as requiring multi-factor authentication or blocking access, based on the real-time risk level, thereby ensuring continuous verification before granting access.

Why this answer

Microsoft Entra ID Protection (D) is the correct answer because it directly addresses the Zero Trust principle of 'verify explicitly' by using real-time risk detection and conditional access policies to verify user identity before granting access. It evaluates sign-in risk, user risk, and enforces policies like multi-factor authentication (MFA) or blocking access when suspicious activity is detected, ensuring that only legitimate users can access resources.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID Protection with Microsoft Entra ID Governance, mistakenly thinking that governance policies (like access reviews) verify identity, when in fact governance manages permissions after access is granted, not the real-time verification required by Zero Trust.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Connect is a tool for synchronizing on-premises Active Directory objects to Microsoft Entra ID, not for verifying user identity at access time. Option B is wrong because Microsoft Entra ID Domain Services provides managed domain services like Kerberos and LDAP for legacy applications, but it does not perform identity verification or risk-based access control. Option C is wrong because Microsoft Entra ID Governance focuses on managing identity lifecycle, access reviews, and entitlement management, not on real-time identity verification or risk assessment during authentication.

Full explanation →

MCQmedium

A security architect is designing a Zero Trust strategy. Which principle ensures that network location alone does not grant trust, and all access requests must be verified?

A.Verify explicitly

B.Least privilege

C.Assume breach

D.Segregation of duties

AnswerA

Correct. Verify Explicitly is the Zero Trust principle that requires continuous verification of every access request regardless of network location. It ensures that no implicit trust is granted based on being inside the corporate network.

Why this answer

The 'Verify explicitly' principle is the core of Zero Trust, stating that every access request must be authenticated and authorized based on all available data points—including user identity, device health, location, and data sensitivity—regardless of network location. This ensures that being on a corporate network does not automatically grant trust, as all requests are verified in real time.

Exam trap

The trap here is that candidates often confuse 'Least privilege' with 'Verify explicitly' because both involve access control, but 'Least privilege' is about limiting permissions after trust is established, not about verifying trust based on network location.

How to eliminate wrong answers

Option B (Least privilege) is wrong because it focuses on limiting access rights to the minimum necessary for a user to perform their job, not on verifying every request regardless of network location. Option C (Assume breach) is wrong because it is a design mindset that assumes an attacker is already present, guiding segmentation and monitoring, but it does not directly address the verification of access requests based on network location. Option D (Segregation of duties) is wrong because it is a compliance and risk management principle that prevents conflicts of interest by dividing responsibilities among multiple people, not a Zero Trust verification principle.

Full explanation →

MCQhard

A company uses Salesforce and Box as cloud apps. The security team discovers that a third-party OAuth app with excessive permissions was granted access to Salesforce data by a user. They want a solution that can detect such risky OAuth apps and automatically revoke their permissions based on policy. Which Microsoft security solution provides this capability?

A.Microsoft Defender for Cloud Apps

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Office 365

D.Microsoft Sentinel

AnswerA

Microsoft Defender for Cloud Apps (MDCAS) is the correct solution because it provides comprehensive visibility and control over cloud applications, including the discovery and assessment of OAuth-connected apps. It can identify risky OAuth apps that users have authorized to access data in connected cloud services like Salesforce and Box. Through its robust policy engine, MDCAS enables organizations to define and enforce granular policies, automatically revoking permissions for high-risk or non-compliant OAuth applications, thereby mitigating potential data exfiltration or unauthorized access risks.

Why this answer

Microsoft Defender for Cloud Apps (MDCA) is a Cloud Access Security Broker (CASB) that provides visibility into third-party OAuth apps connected to cloud services like Salesforce and Box. It can detect OAuth apps with excessive permissions and automatically revoke them based on conditional access or app governance policies, making it the correct solution for this scenario.

Exam trap

The trap here is that candidates may confuse Microsoft Defender for Cloud Apps with Microsoft Defender for Office 365, assuming the latter covers all cloud app security, when in reality MDCA is the dedicated CASB for multi-SaaS environments like Salesforce and Box.

How to eliminate wrong answers

Option B (Microsoft Defender for Endpoint) is wrong because it focuses on endpoint detection and response (EDR) for devices, not on monitoring or controlling OAuth permissions in SaaS applications. Option C (Microsoft Defender for Office 365) is wrong because it protects Exchange Online, SharePoint, and Teams from threats like phishing and malware, but does not manage OAuth app permissions in third-party SaaS apps like Salesforce. Option D (Microsoft Sentinel) is wrong because it is a Security Information and Event Management (SIEM) solution that ingests logs and generates alerts, but it lacks native capabilities to automatically revoke OAuth app permissions; it would require custom playbooks or integration with MDCA for such actions.

Full explanation →

MCQeasy

You are the security administrator for a small business that uses Microsoft 365 Business Premium. The company wants to enable multi-factor authentication (MFA) for all users. You need to ensure that users are prompted for MFA when they sign in from unfamiliar locations or devices. The solution should be easy to deploy without additional licensing. Which of the following should you configure?

A.Create a conditional access policy in Microsoft Entra ID that requires MFA for all cloud apps

B.Enable security defaults in Microsoft Entra ID

C.Deploy the Microsoft Authenticator app and instruct users to enable it

D.Configure identity protection to enable risk-based MFA

AnswerB

Security defaults provide a pre-configured set of security policies that include MFA and are included with Microsoft 365 Business Premium without additional licensing.

Why this answer

Security defaults are a pre-configured set of security policies that include MFA based on risk, specifically prompting for MFA when users sign in from unfamiliar locations or devices, and are available without additional licensing. Option A is incorrect because while Conditional Access policies are available with Microsoft 365 Business Premium (which includes Microsoft Entra ID P1), a simple policy requiring MFA for *all* cloud apps would prompt for MFA every time, not specifically when signing in from unfamiliar locations or devices. To achieve risk-based MFA with Conditional Access that specifically targets unfamiliar locations/devices, more advanced configurations or potentially Microsoft Entra ID P2 features (for advanced sign-in risk detection) might be needed, which would go against the 'easy to deploy' and 'no additional licensing' constraints if P2 is implied.

Security defaults provide this risk-based MFA out-of-the-box without complex configuration or P2 licensing. Option C is incorrect because deploying the Microsoft Authenticator app alone does not enforce MFA; a policy such as security defaults or conditional access is needed to prompt for MFA based on location or device. Option D is incorrect because identity protection risk-based MFA requires Azure AD Premium P2 licensing, which is not included in Business Premium.

Full explanation →

MCQhard

Your organization plans to migrate from on-premises Active Directory to Microsoft Entra ID. You need to design the identity synchronization strategy to support password hash synchronization and password writeback. Which tool should you use?

A.Microsoft Identity Manager

B.Active Directory Federation Services

C.Microsoft Entra Cloud Sync

D.Microsoft Entra Connect

AnswerD

Microsoft Entra Connect is the comprehensive on-premises agent for synchronizing identities from Active Directory to Microsoft Entra ID, providing robust hybrid identity capabilities. It fully supports password hash synchronization, securely replicating a hash of the on-premises password to the cloud, and crucially, it enables password writeback, allowing self-service password reset (SSPR) changes in Microsoft Entra ID to update the user's password in on-premises Active Directory.

Why this answer

Microsoft Entra Connect is the correct tool because it supports both password hash synchronization and password writeback, which are required for the migration scenario. Password hash sync synchronizes a hash of the on-premises AD password to Entra ID, while password writeback enables password changes in the cloud to be written back to on-premises AD. Entra Connect is the primary hybrid identity tool that integrates on-premises directories with Microsoft Entra ID, offering these features natively.

Exam trap

The trap here is that candidates often confuse Microsoft Entra Cloud Sync with Entra Connect, assuming Cloud Sync supports all the same features, but Cloud Sync lacks password writeback support, making it unsuitable for this requirement.

How to eliminate wrong answers

Option A is wrong because Microsoft Identity Manager (MIM) is an on-premises identity management solution for managing users and groups across multiple directories, but it does not directly support password hash synchronization or password writeback to Entra ID; those features are specific to Entra Connect. Option B is wrong because Active Directory Federation Services (AD FS) is a federation service that provides single sign-on (SSO) and claims-based authentication, but it does not perform password hash synchronization or password writeback; it relies on federation trust rather than password sync. Option C is wrong because Microsoft Entra Cloud Sync is a lightweight agent designed for syncing users from on-premises AD to Entra ID, but it does not support password writeback; password writeback requires the full Entra Connect installation.

Full explanation →

Matchingmedium

Match each Microsoft 365 compliance feature to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Prevent accidental sharing of sensitive info

Record user and admin activity

Keep or delete data for a specified time

Classify and protect content

Track compliance posture and recommendations

Why these pairings

The correct matches are: eDiscovery for searching and exporting content, Retention policies for managing retention and deletion, and Sensitivity labels for classifying and protecting data. Common confusions include mixing DLP with Sensitivity labels, and Communication Compliance with DLP.

Full explanation →

MCQeasy

A user logs into the company's network using their username and password. After successful login, the user attempts to open a financial report but receives an access denied message because they are not a member of the 'Finance' security group. Which security concept is best illustrated by the access denial?

A.Authentication

B.Authorization

C.Accounting

D.Non-repudiation

AnswerB

Authorization is the critical security process that determines what an authenticated user or system is permitted to do or access within a network or application. Following successful authentication, authorization mechanisms evaluate a user's assigned roles, group memberships, and specific permissions against the requested resource or action. If the user lacks the necessary privileges, access is explicitly denied, directly explaining why a logged-in user might be unable to access certain resources.

Why this answer

The access denial occurs because the user lacks the necessary permissions to open the financial report, even though their identity was verified. This is the core function of authorization, which determines what resources an authenticated user can access. In this scenario, the user is authenticated but not authorized to access the report due to missing group membership.

Exam trap

The trap here is confusing authentication (verifying identity) with authorization (granting permissions), leading candidates to select 'Authentication' because they focus on the successful login rather than the subsequent access denial.

Why the other options are wrong

Authentication verifies identity (who you are), but the access denial occurred after successful login, meaning identity was already confirmed. The denial is due to insufficient permissions, which is authorization.

Accounting tracks user actions for auditing, not access control. The access denial is due to lack of permissions, which is authorization.

Non-repudiation ensures that a user cannot deny having performed an action, typically through digital signatures or audit logs. The access denial here is about permissions, not about proving or denying actions.

When would these options actually be correct?

A question that asks: 'A user enters their username and password to log into a system. Which security concept is being applied?' would make authentication the correct answer.

A scenario where a user performs an action (e.g., modifies a file) and the system logs the user's identity and action to ensure accountability. The question would ask which concept ensures actions can be traced back to a specific user.

A user submits a purchase order using their digital certificate, but later claims they never submitted it. The system provides a signed audit trail proving the submission. This illustrates non-repudiation.

Why candidates pick the wrong answer

Candidates often confuse authentication and authorization because both involve access control and occur sequentially during login, leading them to mistakenly associate the access denial with the authentication step.

Candidates may confuse accounting (auditing) with authorization because both involve permissions and access logs, but accounting focuses on recording events, not enforcing access.

Candidates may confuse authorization (permissions) with non-repudiation because both involve security controls, but non-repudiation focuses on accountability and proof of actions, not access rights.

Full explanation →

MCQmedium

A company wants to prevent users from setting weak passwords that are commonly found in leaked databases. They use Microsoft Entra ID (Microsoft Entra ID). Which feature should they enable?

A.Microsoft Entra ID Protection

B.Microsoft Entra ID Password Protection

C.Microsoft Entra ID Privileged Identity Management

D.Microsoft Entra ID Conditional Access

AnswerB

Microsoft Entra ID Password Protection directly addresses the challenge of weak passwords by preventing users from creating or changing to commonly used, easily guessable, or compromised passwords. It achieves this by maintaining both a globally banned password list, which Microsoft curates based on breach data, and allowing organizations to define their own custom banned password lists. This proactive enforcement occurs at the point of password creation or reset, significantly reducing the risk of password-based attacks.

Why this answer

Microsoft Entra ID Password Protection is the correct feature because it specifically blocks weak passwords by comparing them against a global list of commonly compromised passwords (e.g., from leaked databases) and an optional custom banned password list. This feature enforces password strength at the time of creation or reset, preventing users from setting passwords that appear in known breaches.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID Protection (which alerts on leaked credentials after they are used) with Password Protection (which proactively blocks weak passwords at creation), leading them to choose the risk-detection feature instead of the prevention feature.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Protection focuses on detecting and responding to identity-based risks (e.g., leaked credentials, anomalous sign-ins) but does not enforce password policies or block weak passwords at creation. Option C is wrong because Privileged Identity Management (PIM) manages just-in-time access and approval workflows for privileged roles, not password strength enforcement. Option D is wrong because Conditional Access evaluates sign-in conditions (e.g., location, device compliance) to grant or block access, but it does not validate or block weak passwords during password setting.

Full explanation →

MCQeasy

A company uses a hashing algorithm to verify that a downloaded software file has not been tampered with during transmission. This practice primarily protects which security principle?

A.Confidentiality

B.Integrity

C.Availability

D.Non-repudiation

AnswerB

Integrity guarantees that data remains accurate, complete, and authentic throughout its lifecycle, preventing unauthorized or accidental modification. When a company uses a hashing algorithm to verify a downloaded file, it generates a unique fixed-size string (hash value) from the file's content. Comparing this hash value with a known, trusted hash confirms that the file has not been tampered with or corrupted during transmission or storage, directly addressing data integrity by ensuring its unaltered state.

Why this answer

Hashing algorithms, such as SHA-256, produce a fixed-size hash value that acts as a digital fingerprint of the file. By comparing the hash of the downloaded file with the hash provided by the publisher, any change to the file—even a single bit—results in a completely different hash, immediately detecting tampering. This directly protects the integrity of the data by ensuring it has not been altered during transmission.

Exam trap

The trap here is that candidates often confuse hashing with encryption and select 'Confidentiality' (Option A), not realizing that hashing is a one-way function that detects changes but does not hide the data.

How to eliminate wrong answers

Option A is wrong because confidentiality is about preventing unauthorized access to data, typically achieved through encryption (e.g., AES, TLS), not hashing. Option C is wrong because availability ensures systems and data are accessible when needed, which is protected by redundancy, backups, and DDoS mitigation, not by verifying file integrity. Option D is wrong because non-repudiation provides proof of origin or delivery, often using digital signatures (e.g., RSA, ECDSA) that combine hashing with asymmetric encryption, whereas hashing alone cannot prove who created the hash.

Full explanation →

MCQmedium

You run the Microsoft Graph PowerShell command in the exhibit. What information does this command retrieve about the user?

A.The user's license assignments

B.The user's last sign-in dates

C.The user's assigned roles

D.The user's group memberships

AnswerB

The SignInActivity property, when retrieved for a user object via Microsoft Graph PowerShell, provides critical details about a user's authentication history. Specifically, it contains the 'lastSignInDateTime' for interactive sign-ins and 'lastNonInteractiveSignInDateTime' for non-interactive sign-ins. Therefore, executing a command that selects SignInActivity will accurately return the timestamps indicating the user's most recent successful authentication events.

Why this answer

The command `Get-MgUser -UserId user@contoso.com -Property SignInActivity | Select-Object -Property SignInActivity` retrieves the `SignInActivity` property of the specified user, which contains the `lastSignInDateTime` and `lastNonInteractiveSignInDateTime` fields. This data directly provides the user's last sign-in dates, making option B correct.

Exam trap

The trap here is that candidates confuse the `SignInActivity` property with license or role information, because the `Get-MgUser` command can retrieve many user properties, but only `SignInActivity` specifically returns sign-in timestamps.

How to eliminate wrong answers

Option A is wrong because license assignments are retrieved using `Get-MgUserLicenseDetail` or the `AssignedLicenses` property, not the `SignInActivity` property. Option C is wrong because assigned roles are retrieved using `Get-MgUserMemberOf` or the `DirectoryRole` cmdlets, not sign-in activity data. Option D is wrong because group memberships are retrieved using `Get-MgUserMemberOf` or `Get-MgGroupMember`, not the `SignInActivity` property.

Full explanation →

MCQeasy

A security analyst needs to investigate a potential data exfiltration incident involving sensitive files being sent via email. Which Microsoft Purview solution provides the necessary monitoring?

A.Microsoft Purview Compliance Manager

B.Microsoft Purview Insider Risk Management

C.Microsoft Purview Data Loss Prevention

D.Microsoft Purview Audit

AnswerC

Microsoft Purview Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and protect sensitive information across various locations, including email, SharePoint, OneDrive, and Teams. When configured, DLP can detect sensitive data types (e.g., credit card numbers, PII) within email content or attachments and then block, warn, or encrypt the message to prevent unauthorized exfiltration. This direct content inspection and enforcement capability makes it the ideal tool for investigating and preventing data loss via email.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it provides real-time monitoring and policy-based enforcement to detect and block sensitive files (e.g., credit card numbers, PII) from being sent via email. DLP policies can inspect email content and attachments in transit, triggering alerts or blocking the message to prevent data exfiltration.

Exam trap

The trap here is that candidates often confuse Insider Risk Management (which analyzes user behavior patterns) with DLP (which enforces content-based policies), leading them to choose Option B because they think 'insider threat' implies data exfiltration, but DLP is the actual monitoring and enforcement tool for email-based incidents.

How to eliminate wrong answers

Option A is wrong because Compliance Manager is a risk assessment and compliance scoring tool, not a monitoring solution for data exfiltration incidents. Option B is wrong because Insider Risk Management focuses on identifying risky user behaviors (e.g., unusual file access) through analytics and correlation, but it does not directly monitor or block email-based data exfiltration in real time. Option D is wrong because Audit provides logging and forensic search of past activities (e.g., who sent an email), but it lacks proactive monitoring or blocking capabilities to stop data exfiltration as it happens.

Full explanation →

MCQeasy

Your organization uses Microsoft Entra ID and wants to automatically block sign-ins from users located in countries that are not approved for business operations. Which Microsoft Entra ID feature should you configure?

A.Privileged Identity Management

B.Terms of Use

C.Conditional Access with Named Locations

D.Identity Protection user risk policy

AnswerC

Microsoft Entra Conditional Access policies are the primary tool for implementing granular access controls based on various signals, including user, device, application, and crucially, location. By configuring "Named Locations" to define specific IP address ranges or countries, an organization can create a Conditional Access policy to explicitly block or allow sign-ins from those defined geographic areas. This directly addresses the requirement to prevent access from specific countries by denying authentication attempts originating from those regions.

Why this answer

Conditional Access with Named Locations allows you to define geographic locations (e.g., countries) and then create a policy that blocks sign-ins from locations that are not approved for business operations. This is the correct feature because it directly enforces access controls based on the user's physical location at the time of authentication, using IP address ranges or country/region mapping.

Exam trap

The trap here is that candidates often confuse Identity Protection's risk-based policies with location-based blocking, but Identity Protection focuses on user and sign-in risk (e.g., impossible travel, anonymous IP) rather than static geographic restrictions.

How to eliminate wrong answers

Option A is wrong because Privileged Identity Management (PIM) manages just-in-time access and role activation for privileged roles, not location-based sign-in blocking. Option B is wrong because Terms of Use presents legal agreements that users must accept before accessing resources, but it does not enforce geographic restrictions. Option D is wrong because Identity Protection user risk policy responds to user risk levels (e.g., leaked credentials, anomalous behavior) and can block sign-ins based on risk, but it does not block sign-ins based on geographic location.

Full explanation →

MCQeasy

A company regularly performs automated backups of its critical databases and has a disaster recovery plan to restore operations quickly after a system failure. Which security principle is primarily being addressed by these measures?

A.Confidentiality

B.Integrity

C.Availability

D.Non-repudiation

AnswerC

Availability ensures systems and data are accessible when needed. Backups and disaster recovery plans directly support availability by enabling recovery from failures.

Why this answer

Automated backups and a disaster recovery plan directly support the Availability principle of the CIA triad by ensuring that critical databases can be restored and operations resumed quickly after a system failure. Availability guarantees that systems and data are accessible to authorized users when needed, and these measures minimize downtime and data loss.

Exam trap

The trap here is that candidates confuse 'backups and disaster recovery' with 'data protection' broadly, incorrectly selecting Confidentiality or Integrity, when the primary goal is to restore access and uptime, which is the essence of Availability.

Why the other options are wrong

Automated backups and disaster recovery plans are designed to ensure systems and data can be restored after a failure, directly supporting availability. Confidentiality is about preventing unauthorized access, not about recovery from failures.

Automated backups and disaster recovery plans are designed to ensure systems and data are recoverable after failures, directly supporting availability. Integrity focuses on preventing unauthorized modification, which is not the primary goal of these measures.

Non-repudiation ensures that actions cannot be denied by the parties involved, typically through digital signatures or audit logs. Automated backups and disaster recovery plans do not address non-repudiation; they focus on restoring data and systems after a failure, which supports availability.

When would these options actually be correct?

A question asking which principle is addressed by encrypting backup data at rest and in transit, or by implementing access controls on backup storage, would make confidentiality the correct answer.

A question asking which principle is addressed by implementing checksums, hashing, or digital signatures to detect data tampering during transmission or storage would make integrity the correct answer.

Non-repudiation would be the correct answer in a scenario where the question asks about measures to prove that a specific user performed an action, such as implementing digital signatures or audit trails to prevent denial of transactions or data modifications.

Why candidates pick the wrong answer

Candidates may confuse the protection of backup data (which involves confidentiality) with the purpose of having backups (which is availability), leading them to select confidentiality incorrectly.

Candidates may confuse backups with data protection against corruption, mistakenly thinking backups ensure data integrity rather than availability.

Candidates might confuse disaster recovery with maintaining a record of actions, thinking that backups provide proof of past states. However, non-repudiation is about accountability and irrefutable evidence, not about restoring operations.

Full explanation →

MCQhard

Your organization uses Microsoft Sentinel to detect threats. A security analyst needs to create a custom analytics rule that triggers an incident when a user accesses more than 1000 files from an external IP address within 5 minutes. Which rule type should the analyst configure?

A.Fusion rule

B.ML Behavior Analytics rule

C.Scheduled query rule

D.Near-real-time (NRT) query rule

AnswerC

Scheduled query rules are the foundational and most flexible type of analytics rule in Microsoft Sentinel for custom threat detection. They allow security analysts to define precise Kusto Query Language (KQL) queries that run at specified intervals, look back over a defined time range (e.g., 5 minutes), and perform complex aggregations and filtering to identify threats based on custom thresholds and logic.

Why this answer

A scheduled query rule is the correct choice because it allows the analyst to define a custom KQL query that counts file access events from external IPs and triggers an incident when the threshold of 1000 files within 5 minutes is exceeded. This rule type supports aggregation, time windows, and custom thresholds, making it ideal for detecting specific behavioral patterns like high-volume access from external sources.

Exam trap

The trap here is that candidates confuse near-real-time (NRT) rules with scheduled rules, assuming NRT can handle any time window, but NRT rules are limited to a 1-minute lookback and cannot aggregate over longer periods like 5 minutes.

How to eliminate wrong answers

Option A is wrong because Fusion rules use pre-built machine learning models to correlate multiple alerts into a single incident, not custom user-defined thresholds or queries. Option B is wrong because ML Behavior Analytics rules rely on built-in machine learning models to detect anomalies based on baseline behavior, not custom KQL queries with explicit thresholds like 1000 files in 5 minutes. Option D is wrong because Near-real-time (NRT) query rules run queries every minute with a 1-minute lookback, but they cannot support a 5-minute time window or aggregation over that period; they are designed for low-latency detection of simple patterns, not complex threshold-based conditions.

Full explanation →

MCQmedium

A user reports that they cannot access a critical application, receiving an error that their session has expired. The sign-in logs show the user was prompted for multifactor authentication (MFA) multiple times during the same session. What should an administrator review to reduce these interruptions?

A.Microsoft Entra tenant-wide MFA settings

B.Microsoft Entra Conditional Access session controls

C.Microsoft Entra Identity Protection policies

D.Microsoft Entra Privileged Identity Management settings

AnswerB

Microsoft Entra Conditional Access session controls are specifically designed to manage user sessions after initial authentication, including the frequency of re-authentication and the persistence of browser sessions. By configuring sign-in frequency, administrators can reduce the number of MFA prompts users receive within a defined period, enhancing productivity while maintaining security. These controls provide the granular capability to balance security posture with user experience for specific applications or conditions.

Why this answer

Session controls in Conditional Access policies can be configured to reduce repeated MFA prompts within the same session, such as by adjusting the sign-in frequency or persistent browser session settings. Option A is wrong because tenant-wide MFA settings enforce MFA globally but do not control session-specific behavior. Option C is wrong because Identity Protection focuses on risk-based policies, not directly on session lifetime.

Option D is wrong because Privileged Identity Management manages role activation and assignment, not session controls.

Full explanation →

Multi-Selecteasy

A company wants to use Microsoft Defender for Cloud to secure their hybrid cloud environment. Which FOUR resource types can be assessed by Defender for Cloud?

Select 4 answers

A.Azure Virtual Machines

B.AWS EC2 instances

C.On-premises servers connected via Azure Arc

D.Kubernetes clusters

E.On-premises SQL Server

AnswersA, B, C, D

Azure Virtual Machines are native resources and are automatically assessed by Defender for Cloud.

Why this answer

Microsoft Defender for Cloud can assess Azure Virtual Machines (native), AWS EC2 instances via multi-cloud connector, on-premises servers connected via Azure Arc, and Kubernetes clusters (Azure or multi-cloud) via Defender for Containers. On-premises SQL Server without Azure Arc is not directly assessed.

Full explanation →

MCQeasy

A small consulting company, Northwind Traders, uses Microsoft 365 Business Premium and wants to implement basic compliance solutions. They have 50 users and need to: (1) prevent employees from sharing customer credit card information via email; (2) retain all deleted emails for 1 year; (3) allow users to classify documents as 'Confidential' manually; (4) generate reports on policy violations. The company has limited IT staff and wants a quick, out-of-the-box solution. What should they configure?

A.Use Microsoft Intune to set data loss prevention policies and configure document classification.

B.Use Microsoft Purview to create a DLP policy for credit card info, a retention policy for deleted emails, and publish a sensitivity label for 'Confidential'.

C.Use Microsoft 365 Defender to block sharing of credit card data and configure email retention.

D.Use Microsoft Entra ID to create conditional access policies and enable retention.

AnswerB

Purview provides all required compliance capabilities.

Why this answer

Microsoft Purview (formerly Microsoft 365 Compliance) provides out-of-the-box solutions for all three requirements: DLP policies to prevent sharing of credit card info, retention policies to retain deleted emails for 1 year, and sensitivity labels for manual document classification. Option A is wrong because Microsoft Intune focuses on device management, not compliance. Option C is wrong because Microsoft 365 Defender is primarily for security detection and response, not compliance features like retention labels.

Option D is wrong because Microsoft Entra ID is for identity and access management, not compliance policies.

Full explanation →

MCQeasy

Your company is subject to GDPR and must be able to respond to data subject requests (DSRs) by finding all personal data of a specific user across Microsoft 365. Which Microsoft Purview solution should you use?

A.Communication Compliance

B.eDiscovery (Standard or Premium)

C.Privileged Access Management

D.Audit (Standard or Premium)

AnswerB

eDiscovery allows searches across all Microsoft 365 data for specific users.

Why this answer

eDiscovery (Standard or Premium) is the correct solution because it is specifically designed to search for and export content across Microsoft 365 workloads (Exchange, SharePoint, OneDrive, Teams) to fulfill data subject requests (DSRs) under GDPR. It allows you to create a case, define a search query for a specific user's personal data, and export the results for review and action, directly supporting the right to access and erasure.

Exam trap

The trap here is that candidates often confuse Audit logs (which show who did what) with the actual content search needed for DSRs, mistakenly thinking Audit can retrieve personal data when it only provides metadata about actions.

How to eliminate wrong answers

Option A is wrong because Communication Compliance is used to detect and review policy violations (e.g., offensive language, insider trading) in communications, not to search for all personal data of a specific user across Microsoft 365 for DSR fulfillment. Option C is wrong because Privileged Access Management provides just-in-time access controls for elevated administrative tasks, not the ability to search and export user data for GDPR compliance. Option D is wrong because Audit (Standard or Premium) logs user and admin activities for security and compliance investigations, but it does not allow you to search for and export the actual personal data content of a specific user.

Full explanation →

100

MCQhard

A company uses Microsoft Sentinel as its SIEM. They need to create a custom analytics rule that runs every hour and queries for failed logins from a specific IP address. Which rule scheduling option should they configure?

A.Run every 5 minutes with a 5-minute query period

B.Run every 24 hours with a 24-hour query period

C.Run every 1 hour with a 5-minute query period

D.Run every 1 hour with a 1-hour query period

AnswerD

This configuration is optimal for ensuring comprehensive hourly threat detection in Microsoft Sentinel. By running the analytics rule every hour and simultaneously querying the preceding 1-hour period, it guarantees that all relevant data generated within that timeframe is processed, preventing any data gaps. This balance between detection timeliness and resource utilization provides consistent and complete visibility into security events without excessive query frequency or unnecessary cost implications, aligning perfectly with a requirement for hourly monitoring.

Why this answer

To ensure the analytics rule captures all failed logins from the specified IP address that occur within the hour, the rule should be scheduled to run every 1 hour with a query period of 1 hour. This means each time the rule runs, it will query logs from the previous hour, covering the time since the last run. Options A and C have mismatched frequencies and query periods, and Option B runs too infrequently for hourly monitoring.

Full explanation →

101

Multi-Selecthard

Your organization uses Microsoft Entra ID. Which THREE authentication methods can be used for passwordless sign-in?

Select 3 answers

A.Microsoft Authenticator (phone sign-in)

B.SMS-based verification

C.FIDO2 security keys

D.Windows Hello for Business

E.Time-based one-time password (TOTP)

AnswersA, C, D

Microsoft Authenticator enables passwordless phone sign-in by leveraging push notifications sent directly to the user's registered mobile device. Users approve the sign-in request on their phone, often secured by a biometric (fingerprint, face ID) or a device PIN. This method eliminates the need to type a password, providing a seamless and highly secure authentication experience by tying identity to a trusted device.

Why this answer

Microsoft Authenticator (phone sign-in) enables passwordless authentication by using a cryptographic key pair tied to the user's device. When signing in, the user approves a notification on their phone, and the Authenticator app signs the challenge with the private key, eliminating the need for a password.

Exam trap

The trap here is that candidates confuse second-factor methods like TOTP or SMS codes with passwordless authentication, but passwordless requires the primary authentication factor to be something you have (device or key) without needing a password at all.

Full explanation →

102

MCQmedium

Refer to the exhibit. A legal team needs to preserve all documents in SharePoint and OneDrive for 5 years. The current policy retains for 1 year. What should the administrator do to meet the requirement?

A.Add Exchange Online to the locations.

B.Change the retention type to Delete.

C.Change the retention duration to 1825 days.

D.Change the retention action to KeepAndDelete.

AnswerC

The legal team requires documents to be preserved for five years. To meet this specific duration, the retention policy's duration setting must be adjusted. Calculating five years into days (5 years * 365 days/year) yields 1825 days. Therefore, setting the retention duration to 1825 days precisely aligns the policy with the legal preservation requirement, ensuring the content remains immutable and discoverable for the mandated period.

Why this answer

The policy retains for 365 days (1 year), but the requirement is 5 years. Changing the retention duration to 1825 days (5 years) meets the requirement. Option A is wrong because the policy already includes both locations.

Option B is wrong because changing to Delete would delete content. Option D is wrong because changing to KeepAndDelete would still delete after retention, but the duration is the issue.

Full explanation →

103

MCQhard

A company is implementing Microsoft Purview Information Protection. They want to automatically apply a 'Confidential' sensitivity label to emails containing credit card numbers. Which policy should they configure?

A.Auto-labeling policy

B.Retention policy

C.Sensitivity label policy

D.Data loss prevention (DLP) policy

AnswerA

Auto-labeling policies apply labels automatically based on sensitive information types.

Why this answer

Auto-labeling policies in Microsoft Purview are specifically designed to automatically apply sensitivity labels based on conditions, including the detection of sensitive information types like credit card numbers. Option B is incorrect because retention policies manage the lifecycle of data (how long it's kept or deleted), not the automatic application of sensitivity labels. Option C is incorrect because sensitivity label policies are used to publish sensitivity labels, making them available for manual application by users or for use by other policies, but they do not automatically apply labels based on content detection.

Option D is incorrect because DLP policies are primarily used to detect sensitive information and enforce actions to prevent its unauthorized sharing or use, rather than automatically applying sensitivity labels as their primary function.

Full explanation →

104

MCQmedium

A security operations center (SOC) team needs to collect security logs from Azure services, on-premises servers, and third-party firewalls. They want a cloud-native solution that provides advanced threat detection through analytics, machine learning, and the ability to hunt for threats across all data sources. Which Microsoft solution should they deploy?

A.Microsoft Defender for Cloud

B.Microsoft 365 Defender

C.Microsoft Sentinel

D.Microsoft Defender for Identity

AnswerC

Microsoft Sentinel is the correct choice because it is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It is specifically designed to collect security data from virtually any source, including Azure services, other cloud providers, on-premises infrastructure, and third-party security solutions. Its powerful analytics, machine learning, and threat intelligence capabilities enable SOC teams to detect, investigate, and respond to threats across their entire enterprise environment effectively.

Why this answer

Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) solution that ingests logs from Azure services, on-premises servers, and third-party firewalls. It provides advanced threat detection via built-in analytics, machine learning models, and a powerful query language (Kusto Query Language) for threat hunting across all data sources.

Exam trap

The trap here is confusing Microsoft Defender for Cloud (a CSPM/CWPP tool) with Microsoft Sentinel (a cloud-native SIEM), as both appear in the Azure portal and deal with security logs, but only Sentinel provides centralized log ingestion, analytics, and threat hunting across heterogeneous sources.

Why the other options are wrong

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that focuses on securing Azure, hybrid, and multi-cloud environments, but it does not provide the advanced threat hunting, analytics, and machine learning capabilities across diverse log sources (on-premises, third-party) that Microsoft Sentinel offers as a SIEM/SOAR solution.

Microsoft 365 Defender is designed to protect Microsoft 365 environments (email, endpoints, identities) and does not natively ingest logs from third-party firewalls or on-premises servers outside the Microsoft ecosystem, nor does it provide the centralized SIEM/SOAR capabilities required for multi-source log collection and advanced threat hunting.

Microsoft Defender for Identity focuses on protecting on-premises Active Directory identities and detecting identity-based attacks, not on collecting and analyzing security logs from diverse sources like Azure services, on-premises servers, and third-party firewalls with advanced threat hunting.

When would these options actually be correct?

This option would be correct if the question asked for a solution to assess and improve the security posture of Azure resources, detect misconfigurations, and protect cloud workloads with integrated Microsoft Defender plans, without requiring SIEM capabilities for log collection from on-premises and third-party sources.

A question asking for a unified security solution to protect an organization's Microsoft 365 suite—including email, Teams, SharePoint, and endpoints—against advanced attacks, with automated investigation and response across these workloads, would make Microsoft 365 Defender the correct answer.

A question asking for a solution to detect and investigate identity threats in an on-premises Active Directory environment, such as compromised credentials or lateral movement, would make Microsoft Defender for Identity the correct answer.

Why candidates pick the wrong answer

Candidates may confuse Defender for Cloud's threat detection and security alerts with a full SIEM solution, or they may think its integration with Azure services covers all log collection needs, overlooking the requirement for a cloud-native SIEM like Sentinel.

Candidates may confuse Microsoft 365 Defender's advanced threat detection and automation with a SIEM solution, or assume it can aggregate logs from any source because it integrates with Microsoft Defender for Cloud and other Microsoft security products.

Candidates may confuse Defender for Identity with a broader security analytics tool because its name includes 'Defender' and 'Identity,' leading them to think it covers all security log collection and threat detection.

Full explanation →

105

MCQhard

Your company uses Microsoft Defender for Cloud Apps. You notice that a user is downloading large volumes of data from a sanctioned cloud app that exceeds the normal pattern. Which action should you take to automatically block this activity?

A.Create a session policy to monitor and control downloads

B.Configure a cloud discovery policy

C.Create a Microsoft Purview DLP policy

D.Block the app in Defender for Cloud Apps

AnswerA

Session policies can block downloads based on activity policy.

Why this answer

You can create a session policy in Microsoft Defender for Cloud Apps that monitors user behavior and can block or restrict downloads that exceed a predefined threshold. Option B is wrong because a cloud discovery policy is used to discover shadow IT, not to block downloads. Option C is wrong because Microsoft Purview DLP policies are for data loss prevention based on content classification, not for blocking based on volume of downloads.

Option D is wrong because blocking the entire app is too restrictive; a session policy allows targeted action on specific risky activities.

Full explanation →

106

MCQhard

Your organization needs to ensure that emails containing personally identifiable information (PII) like passport numbers are automatically encrypted before being sent externally. What should you configure in Microsoft Purview?

A.A retention label that encrypts the email

B.A DLP policy with the 'Encrypt' action

C.A communication compliance policy

D.An information barrier policy

AnswerB

DLP policies can automatically apply encryption to emails containing sensitive information.

Why this answer

Data Loss Prevention (DLP) policies in Microsoft Purview can automatically detect emails containing sensitive information types (e.g., passport numbers) and apply the 'Encrypt' action to enforce encryption before the email is sent externally. This leverages Microsoft 365 Message Encryption (OME) to protect the data in transit.

Exam trap

The trap here is that candidates often confuse retention labels (which manage lifecycle) with sensitivity labels (which can apply encryption), but the question specifically requires automatic encryption triggered by content detection, which is a DLP action, not a label-based action.

How to eliminate wrong answers

Option A is wrong because retention labels are designed for retention and deletion of content, not for automatic encryption of emails; they can mark items for retention but do not trigger encryption on outbound messages. Option C is wrong because communication compliance policies are used to detect and review inappropriate or policy-violating communications (e.g., harassment, insider trading), not to automatically encrypt sensitive data. Option D is wrong because information barrier policies restrict communication and collaboration between specific groups to prevent conflicts of interest, but they do not perform content-based encryption of emails.

Full explanation →

107

MCQmedium

A company has a SharePoint Online library containing legal contracts. They must satisfy a regulatory requirement that contracts cannot be modified or deleted after they are signed. Additionally, they need to retain the contracts for 10 years after the contract end date, after which they can be disposed of manually. Which Microsoft Purview solution should they implement?

A.Sensitivity labels

B.Records Management

C.Data Loss Prevention (DLP) policy

D.Data Lifecycle Management

AnswerB

Records Management allows you to mark items as records to prevent editing/deletion and assign retention labels with specific schedules and disposition actions.

Why this answer

Records Management in Microsoft Purview allows you to declare items as records, which locks them against modification or deletion (meeting the 'cannot be modified or deleted' requirement). It also supports event-based retention, enabling you to start a 10-year retention period from the contract end date and then allow manual disposal after that period expires.

Exam trap

The trap here is that candidates confuse Data Lifecycle Management (which handles retention and deletion) with Records Management (which adds immutability and legal hold capabilities), leading them to pick D when the question explicitly requires preventing modification and deletion, not just retention.

How to eliminate wrong answers

Option A is wrong because sensitivity labels classify and protect data based on sensitivity (e.g., confidentiality), but they do not prevent modification or deletion of content; they apply encryption, markings, or access controls, not immutable retention. Option C is wrong because Data Loss Prevention (DLP) policies detect and prevent accidental sharing of sensitive information via rules and actions (e.g., blocking email), but they do not enforce retention or lock items against edits/deletion. Option D is wrong because Data Lifecycle Management (now part of Microsoft Purview Data Lifecycle Management) automates retention and deletion based on policies, but it does not provide the 'locked as a record' capability that prevents modification or deletion; it can retain and delete but not make items immutable.

Full explanation →

108

MCQmedium

A company uses Exchange Online. The security team wants to protect users from malware hidden in email attachments by detonating them in a secure sandbox environment before delivery. Which Microsoft Defender for Office 365 feature should they enable?

A.Safe Links

B.Safe Attachments

C.Anti-Phishing

D.Anti-Spoofing

AnswerB

Safe Attachments is a core component of Microsoft Defender for Office 365 that specifically addresses malicious file attachments. It employs dynamic analysis within a secure sandbox environment to "detonate" attachments, observing their behavior for suspicious activities or malicious payloads. This process occurs before the email reaches the recipient's inbox, effectively blocking or quarantining threatening files, including zero-day malware, based on their actual execution characteristics.

Why this answer

Safe Attachments is the correct feature because it specifically detonates email attachments in a secure, isolated sandbox environment to detect and block malware before the message reaches the user's inbox. This feature uses dynamic analysis to observe attachment behavior in real time, ensuring zero-day threats are identified and neutralized.

Exam trap

The trap here is that candidates often confuse Safe Links with Safe Attachments because both are part of Microsoft Defender for Office 365, but Safe Links deals with URLs while Safe Attachments deals with file payloads; the question explicitly mentions 'malware hidden in email attachments' which directly points to Safe Attachments.

Why the other options are wrong

Safe Links protects users from malicious URLs in emails and Office documents, not from malware hidden in email attachments. The question specifically asks about detonating attachments in a sandbox, which is the function of Safe Attachments.

Anti-Phishing protects against phishing attacks by analyzing email content and impersonation attempts, but it does not detonate attachments in a sandbox environment. The feature that performs sandbox detonation of attachments is Safe Attachments.

Anti-Spoofing is designed to prevent email spoofing by verifying sender identity, not to detonate malware in a sandbox. The question specifically asks for a feature that detonates attachments in a secure sandbox, which is Safe Attachments.

When would these options actually be correct?

Safe Links would be correct if the question asked: 'Which Microsoft Defender for Office 365 feature protects users from clicking malicious URLs in email messages or Office documents?'

Anti-Phishing would be correct if the question asked: 'Which Microsoft Defender for Office 365 feature protects users from malicious links in email that lead to credential harvesting sites?'

Anti-Spoofing would be the correct answer for a question like: 'A company wants to prevent attackers from forging the From address in emails to impersonate executives. Which Defender for Office 365 feature should they enable?'

Why candidates pick the wrong answer

Candidates may confuse the two features because both are part of Defender for Office 365 and involve protection against malicious content, but Safe Links focuses on links, not attachments.

Candidates may confuse anti-phishing with malware protection because both deal with email threats, and phishing emails often carry malware attachments, leading them to select Anti-Phishing without understanding the specific sandbox detonation requirement.

Candidates may confuse anti-spoofing with malware protection because both deal with email threats, but anti-spoofing focuses on identity deception, not attachment analysis.

Full explanation →

109

MCQeasy

Your organization is deploying Microsoft Entra ID. You need to ensure that users can sign in using their existing on-premises Active Directory credentials without creating new cloud passwords. Which feature should you configure?

A.Microsoft Entra Connect

B.Microsoft Entra Multifactor Authentication

C.Microsoft Entra Self-Service Password Reset

D.Microsoft Entra Privileged Identity Management (PIM)

AnswerA

Microsoft Entra Connect is the essential tool for establishing and maintaining hybrid identity, synchronizing on-premises Active Directory users, groups, and contacts into Microsoft Entra ID. It facilitates seamless sign-in experiences by enabling features like Password Hash Synchronization (PHS), Pass-through Authentication (PTA), or federation with ADFS, allowing users to authenticate to cloud services using their existing on-premises credentials. This ensures a consistent identity and access management across both environments.

Why this answer

Microsoft Entra Connect is the correct feature because it synchronizes on-premises Active Directory identities to Microsoft Entra ID and enables password hash synchronization or pass-through authentication, allowing users to sign in with their existing on-premises credentials without creating new cloud passwords. This ensures a seamless hybrid identity experience where the same username and password work for both on-premises and cloud resources.

Exam trap

The trap here is that candidates often confuse Microsoft Entra Connect with Microsoft Entra Multifactor Authentication, thinking that MFA alone can authenticate against on-premises credentials, but MFA only provides an additional verification step and does not handle primary authentication against on-premises Active Directory.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra Multifactor Authentication adds a second layer of security but does not synchronize or authenticate on-premises credentials; it requires an existing identity in the cloud. Option C is wrong because Microsoft Entra Self-Service Password Reset allows users to reset their own passwords but does not enable sign-in with existing on-premises credentials; it relies on an already synchronized or cloud-only identity. Option D is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time access and role assignments, not credential synchronization or authentication against on-premises Active Directory.

Full explanation →

110

Multi-Selectmedium

A company uses Microsoft Entra ID. They need to implement a Conditional Access policy for the finance application that requires multifactor authentication (MFA) when a user accesses the app from an unmanaged device. Additionally, they want to block access if the sign-in risk level is high. Which two grant controls should they configure in the policy? (Select two.)

Select 2 answers

A.Require multi-factor authentication

B.Block access

C.Require device to be marked as compliant

D.Require approved client app

AnswersA, B

This grant control mandates that users successfully complete an additional verification step, such as a phone call, text message, or authenticator app notification, before gaining access to the resource. When applied as a Conditional Access policy, it effectively elevates the authentication strength for specific conditions, like sign-ins from unmanaged devices or high-risk locations. This ensures that even if a primary credential is compromised, unauthorized access is prevented by requiring a second, distinct factor.

Why this answer

The scenario explicitly requires multifactor authentication (MFA) when a user accesses the finance application from an unmanaged device. In Microsoft Entra ID Conditional Access, the 'Require multi-factor authentication' grant control enforces MFA as part of the policy, directly meeting this requirement. Option B is correct because the scenario also requires blocking access if the sign-in risk level is high.

The 'Block access' grant control is the appropriate control to deny authentication when a high-risk sign-in is detected, as it overrides any other grant controls.

Exam trap

The trap here is that candidates often confuse 'Require device to be marked as compliant' with 'unmanaged device' conditions, but unmanaged devices are not necessarily non-compliant; the policy specifically targets unmanaged devices for MFA, not compliance enforcement.

Full explanation →

111

MCQmedium

An organization wants to ensure that its security team can quickly identify and respond to threats across all workloads, including identities, endpoints, email, and cloud apps. Which Microsoft security solution provides a unified incident management experience?

A.Microsoft Sentinel

B.Microsoft Defender for Cloud

C.Microsoft Defender XDR

D.Microsoft Defender for Identity

AnswerC

Defender XDR unifies incidents from identities, endpoints, email, and cloud apps.

Why this answer

Microsoft Defender XDR (formerly Microsoft 365 Defender) provides a unified incident management experience across identities, endpoints, email, and cloud apps. Option A is wrong because Microsoft Sentinel is a SIEM that can ingest data from multiple sources but is not the native XDR solution. Option B is wrong because Microsoft Defender for Cloud protects cloud workloads only.

Option D is wrong because Microsoft Defender for Identity focuses on identity threats only.

Full explanation →

112

Multi-Selecthard

Which THREE capabilities are provided by Microsoft Purview Compliance Manager?

Select 3 answers

A.Pre-built compliance assessments for regulations like GDPR

B.Scoring to track compliance progress over time

C.Audit log search for user access events

D.Improvement actions to remediate compliance gaps

E.Automated data discovery across cloud sources

AnswersA, B, D

Microsoft Purview Compliance Manager provides a comprehensive library of pre-built assessment templates for various international, governmental, and industry-specific regulations and standards, such as GDPR, ISO 27001, and NIST. These templates help organizations efficiently understand their current compliance posture against specific requirements by mapping them to Microsoft 365 services and controls. This capability streamlines the process of evaluating and reporting compliance.

Why this answer

Compliance Manager provides assessments, actions, and score tracking. It does not discover data (Data Map) or log access (Audit).

Full explanation →

113

MCQmedium

Your company uses Microsoft Purview Information Protection to classify and protect sensitive data. You need to ensure that when a user sends an email containing a credit card number, the email is automatically encrypted and a custom footer is added. Which two components should you configure?

A.Data Loss Prevention (DLP) policy for credit card numbers

B.Sensitivity label with auto-classification for credit card numbers

C.Auto-labeling policy that applies the sensitivity label to emails

D.Retention label and policy for credit card data

AnswerB, C

The label can detect credit card numbers and apply encryption.

Why this answer

Sensitivity labels with auto-classification for credit card numbers (Option B) allow automatic detection and classification of sensitive data types like credit card numbers. An auto-labeling policy (Option C) then applies the sensitivity label to emails, which can enforce encryption and add a custom footer. Together, these components ensure that emails containing credit card numbers are automatically encrypted and footers are added.

Exam trap

The trap here is that candidates often confuse DLP policies with sensitivity labels, thinking DLP can enforce encryption and footers, but DLP only detects and blocks, while sensitivity labels with auto-labeling policies handle classification, encryption, and footers.

How to eliminate wrong answers

Option A is wrong because a Data Loss Prevention (DLP) policy can detect credit card numbers and block or warn, but it does not natively apply encryption or custom footers; DLP policies are for preventing data loss, not for applying sensitivity labels or encryption. Option D is wrong because retention labels and policies are used for data lifecycle management (retention and deletion), not for real-time encryption or footer addition when sending emails.

Full explanation →

114

Matchingmedium

Match each compliance term to its correct definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Where data is stored geographically

Data subject to laws of the country where it is stored

Process of identifying and delivering electronic information for legal cases

Preserve data for litigation purposes

Categorizing data based on sensitivity

Why these pairings

Compliance terms in Microsoft 365 cover data protection, communication restrictions, data governance, and legal discovery. DLP prevents data leaks, Information Barriers control internal communication, Records Management handles retention, and eDiscovery supports legal processes.

Full explanation →

115

MCQhard

A company has Microsoft Entra ID with Conditional Access policies. Users report being prompted for MFA every time they access the company's CRM app from their corporate laptops. However, the policy is configured to require MFA only for untrusted locations. What is the most likely cause?

A.Users are authenticating via device code flow.

B.The Conditional Access policy has the 'Persistent browser session' setting enabled.

C.The policy is blocking legacy authentication.

D.The corporate laptops are not marked as compliant devices.

AnswerD

If corporate laptops are not marked as compliant devices, Conditional Access policies can be configured to require device compliance as a grant control. When a device fails to meet the defined compliance standards (e.g., missing security updates, unencrypted), the Conditional Access policy will enforce re-authentication, including MFA, or even block access until the device's compliance status is remediated.

Why this answer

The most likely cause is that the corporate laptops are not marked as compliant devices. Conditional Access policies can use device compliance as a condition; if the laptops are not compliant, they may be treated as untrusted, triggering MFA even if the location is trusted. Device compliance is determined by Microsoft Intune or another MDM, and without it, the policy's location condition may not override the device state.

Exam trap

The trap here is that candidates assume location is the only condition evaluated, but Conditional Access policies can combine multiple conditions, and device compliance often overrides location when devices are not trusted.

How to eliminate wrong answers

Option A is wrong because device code flow is an authentication method for devices without browsers (e.g., CLI tools) and does not inherently bypass location-based MFA conditions. Option B is wrong because the 'Persistent browser session' setting controls session lifetime, not the frequency of MFA prompts based on location; it would not cause repeated MFA on every access. Option C is wrong because blocking legacy authentication would prevent access entirely for non-modern auth clients, not cause repeated MFA prompts for users already using modern authentication.

Full explanation →

116

MCQeasy

A user reports that they cannot access Microsoft 365 apps from a public Wi-Fi network. The admin sees a Conditional Access policy requiring a compliant device and a trusted location. Which component enforces this policy?

A.Microsoft Entra ID

B.Microsoft Defender for Cloud Apps

C.Microsoft Entra Conditional Access

D.Microsoft Intune

AnswerA

Correct. Microsoft Entra ID performs enforcement of Conditional Access policies during authentication.

Why this answer

Microsoft Entra ID enforces Conditional Access policies during the authentication process. While Conditional Access is where policies are defined, the actual enforcement—checking conditions like location and device compliance—occurs within the Microsoft Entra ID service when a token is issued.

Exam trap

Candidates often think Conditional Access is the enforcer, but it is the policy engine that defines rules. The enforcement happens within Microsoft Entra ID during authentication.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID is the identity and authentication service that processes the Conditional Access policy, but it is not the component that 'enforces' the policy; the policy is defined in the Conditional Access feature of Microsoft Entra ID. Option B is wrong because Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility and control over cloud app usage, but it does not enforce Conditional Access policies for initial sign-in to Microsoft 365 apps. Option D is wrong because Microsoft Intune is a Mobile Device Management (MDM) and Mobile Application Management (MAM) service that manages device compliance, but it does not enforce Conditional Access policies; it provides the compliance status that Conditional Access policies can use as a condition.

Full explanation →

117

MCQhard

A company is planning to migrate from on-premises Active Directory to Microsoft Entra ID. They have a custom line-of-business application that uses Windows Integrated Authentication and requires Kerberos. Which approach should they use to enable hybrid identity?

A.Deploy Microsoft Entra Kerberos authentication and register the app

B.Use password hash synchronization (PHS) and configure the app for OAuth

C.Use pass-through authentication (PTA) and configure the app for SAML

D.Federate with Active Directory Federation Services (ADFS)

AnswerA

Deploying Microsoft Entra Kerberos authentication is the correct approach because it enables Microsoft Entra ID to issue Kerberos tickets for on-premises applications. This feature allows users authenticated by Entra ID to access legacy applications that rely on Kerberos for authentication, without requiring a direct line of sight to a traditional Active Directory domain controller from the client. It effectively bridges the gap between cloud-managed identities and on-premises Kerberos-dependent resources, often in conjunction with the Microsoft Entra application proxy for remote access.

Why this answer

Microsoft Entra Kerberos authentication enables hybrid identity for legacy on-premises applications that require Kerberos and Windows Integrated Authentication. By deploying this feature, the app can authenticate users against Microsoft Entra ID while still receiving Kerberos tickets, allowing a seamless migration without modifying the application's authentication code.

Exam trap

The trap here is that candidates often assume that any hybrid identity scenario requires federation (ADFS) or that modern protocols like OAuth/SAML can always replace Kerberos, but Microsoft Entra Kerberos authentication is specifically designed to support legacy Kerberos-dependent apps without federation.

How to eliminate wrong answers

Option B is wrong because password hash synchronization (PHS) does not provide Kerberos tickets; it only synchronizes password hashes for cloud authentication, and configuring the app for OAuth would require the app to support OAuth, which it does not (it uses Windows Integrated Authentication). Option C is wrong because pass-through authentication (PTA) validates passwords on-premises but does not issue Kerberos tickets; SAML is a different protocol that the app does not support. Option D is wrong because federating with Active Directory Federation Services (ADFS) would add unnecessary complexity and is not the recommended modern approach for enabling Kerberos-based hybrid identity; Microsoft Entra Kerberos authentication is the simpler, cloud-native solution.

Full explanation →

118

MCQmedium

Your company is implementing records management for legal retention requirements. Documents must be locked and cannot be modified or deleted after a specific event. Which Microsoft Purview capability should you use?

A.Retention label configured as a regulatory record

B.Retention policy applied to a SharePoint site

C.Sensitivity label with encryption

D.Data Loss Prevention policy

AnswerA

A retention label configured as a regulatory record is the most stringent option for records management, specifically designed for legal or regulatory compliance. Once applied to an item, it renders the content immutable, preventing any modification, deletion, or even label removal by any user or administrator, including those with elevated permissions. This ensures the absolute integrity and immutability of the record, which is critical for legal discovery and regulatory obligations.

Why this answer

A retention label configured as a regulatory record is the correct choice because it enforces immutable, locked records that cannot be modified, deleted, or have their retention period shortened by any user, including administrators. This capability is specifically designed for legal retention requirements where documents must be preserved after a triggering event, using a policy that prohibits any changes or deletions.

Exam trap

The trap here is that candidates often confuse retention policies (which are flexible and can be modified) with regulatory record labels (which are immutable and locked), leading them to choose Option B thinking any retention mechanism will suffice for legal requirements.

How to eliminate wrong answers

Option B is wrong because a retention policy applied to a SharePoint site can be modified or deleted by administrators, and it does not provide the immutable lock required for legal retention; it only applies retention settings at the container level without record-level restrictions. Option C is wrong because a sensitivity label with encryption protects data through access controls and encryption but does not prevent modification or deletion of the document itself; it focuses on confidentiality, not immutability. Option D is wrong because a Data Loss Prevention (DLP) policy monitors and prevents unauthorized sharing or exfiltration of sensitive data, but it does not enforce retention or lock documents against modification or deletion.

Full explanation →

119

MCQeasy

An organization uses Microsoft Sentinel for security information and event management (SIEM) and security orchestration automated response (SOAR). They want to automatically respond to a specific incident by running a playbook. What should they configure?

A.Automation rule

B.Workbook

C.Hunting query

D.Analytics rule

AnswerA

Automation rules in Microsoft Sentinel are designed to orchestrate and automate incident response workflows. They allow security operations teams to define conditions based on incident properties (e.g., severity, specific entities) and then automatically perform actions, such as running a playbook, assigning an incident, or changing its status. This capability is crucial for reducing manual effort and accelerating response times to security threats.

Why this answer

Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including running playbooks. When an incident is created or updated, an automation rule can trigger a playbook (a collection of automated workflows based on Azure Logic Apps) to perform actions such as blocking a user or isolating a machine, directly addressing the requirement to automatically respond to a specific incident.

Exam trap

The trap here is that candidates often confuse analytics rules with automation rules, thinking that analytics rules can directly run playbooks, but in Sentinel, analytics rules only generate alerts, and automation rules are the mechanism to attach playbooks to incidents.

How to eliminate wrong answers

Option B (Workbook) is wrong because workbooks are interactive dashboards for visualizing and analyzing data, not for triggering automated responses. Option C (Hunting query) is wrong because hunting queries are used to proactively search for threats in raw data, not to automate incident response. Option D (Analytics rule) is wrong because analytics rules generate alerts based on scheduled queries or Microsoft security alerts, but they do not directly run playbooks; automation rules are needed to attach playbooks to incidents created from those alerts.

Full explanation →

120

Multi-Selectmedium

An organization is migrating its on-premises applications to Azure Infrastructure-as-a-Service (IaaS). According to the shared responsibility model, which of the following security responsibilities remain with Microsoft? (Select two.)

Select 2 answers

A.Physical security of the datacenters

B.Network controls at the hypervisor layer

C.Patching the guest operating system on the VM

D.Configuring network security group (NSG) firewall rules

AnswersA, B

Microsoft, as the cloud provider, assumes full responsibility for the physical security of its global datacenters. This encompasses robust perimeter defenses, such as fencing and surveillance, along with strict access controls like biometric authentication for personnel. Furthermore, Microsoft manages environmental controls, including power, cooling, and fire suppression systems, ensuring the foundational infrastructure hosting customer VMs remains physically secure and operational.

Why this answer

In the shared responsibility model for IaaS, Microsoft retains responsibility for the physical security of its datacenters, including access controls, surveillance, and environmental protections. Additionally, Microsoft manages security at the hypervisor layer, which includes network controls that isolate virtual machines from each other and from the underlying host. These responsibilities are inherent to the infrastructure provider and cannot be delegated to the customer.

Exam trap

The trap here is that candidates often confuse patching responsibilities, assuming Microsoft patches the guest OS in IaaS, or mistakenly think NSG configuration is a Microsoft responsibility because it is a built-in Azure feature.

Full explanation →

121

MCQmedium

A company runs workloads in Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). The security team needs a single, unified dashboard to continuously assess the security posture of all cloud resources, identify misconfigurations, and receive prioritized recommendations for remediation. Which Microsoft security solution should they use?

A.Microsoft Defender for Cloud

B.Microsoft Defender for Cloud Apps

C.Microsoft Sentinel

D.Microsoft Defender for Endpoint

AnswerA

Microsoft Defender for Cloud is the correct solution because it provides comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWP) across multi-cloud environments, including Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). It centralizes security posture assessment, identifies misconfigurations, and offers prioritized recommendations for resources in both Azure and AWS from a single pane of glass, ensuring consistent security across the company's diverse infrastructure.

Why this answer

Microsoft Defender for Cloud is the correct solution because it provides a unified cloud security posture management (CSPM) dashboard that continuously assesses resources across Azure, AWS, and GCP. It identifies misconfigurations against industry benchmarks (e.g., CIS, NIST) and delivers prioritized, actionable recommendations to remediate risks, directly meeting the requirement for a single dashboard across multi-cloud environments.

Exam trap

The trap here is confusing a cloud security posture management (CSPM) tool (Defender for Cloud) with a cloud access security broker (CASB) or a SIEM/SOAR solution, leading candidates to pick Defender for Cloud Apps or Sentinel because they also provide security visibility, but for different use cases.

Why the other options are wrong

Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) focused on SaaS application usage and shadow IT discovery, not on assessing the security posture of IaaS/PaaS resources across multiple clouds like AWS and GCP.

Microsoft Sentinel is a SIEM/SOAR solution for security analytics and threat detection across the enterprise, not a unified dashboard for continuous cloud security posture assessment and misconfiguration identification across multi-cloud environments.

Microsoft Defender for Endpoint focuses on endpoint devices (e.g., workstations, servers) and does not provide a unified dashboard for assessing security posture across multi-cloud environments (Azure, AWS, GCP).

When would these options actually be correct?

A company wants to discover and control the use of third-party SaaS applications (e.g., Dropbox, Salesforce) accessed by employees, enforce access policies, and detect anomalous behavior in cloud app usage. In that scenario, Microsoft Defender for Cloud Apps would be the correct solution.

A company needs a cloud-native SIEM to collect security data from all cloud environments, detect threats, and orchestrate automated responses across Azure, AWS, and GCP. The question emphasizes threat detection and incident response rather than posture management.

A question asking for a solution to protect endpoints (e.g., laptops, servers) from threats like malware, with capabilities for endpoint detection and response (EDR), and integration with Microsoft 365 Defender.

Why candidates pick the wrong answer

The name 'Defender for Cloud Apps' suggests it covers cloud security broadly, and candidates may confuse it with a multi-cloud posture management tool, not realizing its focus is on SaaS application governance rather than infrastructure security.

Candidates may confuse Sentinel's ability to ingest data from multiple clouds with the specific function of assessing security posture and providing remediation recommendations, which is Defender for Cloud's role.

Candidates may confuse 'Defender for Endpoint' with 'Defender for Cloud' due to similar naming, or assume it covers cloud resources because it can protect cloud-hosted VMs, but it lacks multi-cloud posture management.

Full explanation →

122

Multi-Selecthard

Which THREE are capabilities of Microsoft Defender XDR?

Select 3 answers

A.Device compliance policy management

B.Automated investigation and remediation

C.Incident management across email, endpoints, and identities

D.Cross-domain threat hunting

E.Data classification and labeling

AnswersB, C, D

Defender XDR can automatically investigate and remediate threats.

Why this answer

Options B, C, and D are correct. Microsoft Defender XDR provides automated investigation and remediation (B), incident management across email, endpoints, and identities (C), and cross-domain threat hunting (D). Option A (Device compliance policy management) is a capability of Microsoft Intune, not Defender XDR.

Option E (Data classification and labeling) is a capability of Microsoft Purview, not Defender XDR.

Full explanation →

123

MCQmedium

A university wants to provide its students with a verifiable digital transcript that the students can share with potential employers. The university uses Microsoft Entra Verified ID to issue credentials. When an employer wants to verify a student's transcript, they scan a QR code or receive a link. Which Microsoft Entra ID feature allows the university to issue these tamper-proof credentials and allows employers to verify them without contacting the university directly?

A.Microsoft Entra ID Protection

B.Microsoft Entra Domain Services

C.Microsoft Entra Verified ID

D.Microsoft Entra Permissions Management

AnswerC

Microsoft Entra Verified ID enables organizations, like a university, to issue tamper-proof, self-owned digital credentials to individuals. These decentralized identifiers (DIDs) allow students to prove attributes, such as enrollment status or degree completion, to relying parties without sharing underlying personal data directly. It leverages open standards for verifiable credentials, ensuring interoperability and user control over their identity data. This directly addresses the need for a verifiable credential system.

Why this answer

Microsoft Entra Verified ID (option C) is the correct answer because it is the decentralized identity solution built on open standards (W3C Decentralized Identifiers and Verifiable Credentials) that allows the university to issue tamper-proof digital credentials. Employers can verify these credentials independently by scanning a QR code or following a link, without needing to contact the university, because the verification is done cryptographically against the issuer's public DID on a distributed ledger.

Exam trap

The trap here is that candidates may confuse 'Verified ID' with general identity protection or access management features, but the key differentiator is the decentralized, tamper-proof credential issuance and independent verification capability that only Verified ID provides.

Why the other options are wrong

Microsoft Entra ID Protection is a security tool for detecting identity risks and vulnerabilities, not for issuing or verifying verifiable credentials.

Microsoft Entra Domain Services provides managed domain services like domain join, group policy, and LDAP, but it does not issue or verify verifiable credentials. The scenario requires a decentralized identity solution for tamper-proof credentials, which is not a feature of Domain Services.

Microsoft Entra Permissions Management is a cloud infrastructure entitlement management (CIEM) tool for managing permissions across multi-cloud environments, not for issuing or verifying verifiable credentials like digital transcripts.

When would these options actually be correct?

A question asks: 'Which Microsoft Entra feature helps detect and respond to identity-based risks such as leaked credentials or suspicious sign-ins?'

A question asking: 'Which Microsoft Entra service provides managed domain services such as domain join, group policy, and LDAP for legacy applications that cannot use modern authentication methods?'

A question asking which Microsoft Entra feature helps an organization discover, remediate, and monitor overly permissive identities and resources across AWS, Azure, and GCP would have Permissions Management as the correct answer.

Why candidates pick the wrong answer

Candidates may confuse 'protection' with 'verification' or think that identity protection includes credential verification.

Candidates may confuse 'Domain Services' with identity verification or credential management, assuming it handles digital credentials because of the word 'domain' and its role in identity infrastructure.

Candidates may confuse 'Permissions Management' with managing access to credentials or think it handles verification of permissions, but it is unrelated to decentralized identity or verifiable credentials.

Full explanation →

124

MCQhard

A healthcare organization must comply with HIPAA regulations. They store patient health information (PHI) in SharePoint Online documents. The compliance team needs to automatically detect PHI (e.g., medical record numbers) in documents, apply a sensitivity label that encrypts the document, and prevent users from removing that label. Which Microsoft Purview solution should they configure?

A.Microsoft Purview Data Lifecycle Management

B.Microsoft Purview Information Protection

C.Microsoft Purview Communication Compliance

D.Microsoft Purview Audit

AnswerB

Microsoft Purview Information Protection is the correct choice because it directly addresses the need to classify, label, and protect sensitive data like Protected Health Information (PHI) required by HIPAA. It enables the creation and automatic application of sensitivity labels based on identified sensitive information types, such as medical record numbers or health insurance information. These labels can enforce encryption, visual markings, and access restrictions, ensuring PHI remains secure and preventing unauthorized disclosure or removal, thereby meeting HIPAA's confidentiality and integrity requirements.

Why this answer

Microsoft Purview Information Protection (option B) is correct because it provides the ability to automatically detect sensitive data types (such as PHI) using trainable classifiers or sensitive information types, apply a sensitivity label that enforces encryption, and configure label protection settings to prevent users from removing the label. This directly meets the HIPAA compliance requirement for automated detection, encryption, and label persistence on SharePoint Online documents.

Exam trap

The trap here is that candidates often confuse Microsoft Purview Information Protection (which handles labeling and encryption) with Microsoft Purview Data Lifecycle Management (which handles retention and deletion), because both involve document policies, but only Information Protection can detect PHI and enforce encryption labels.

Why the other options are wrong

Data Lifecycle Management manages retention and deletion of data, not automatic detection of PHI or application of encryption labels.

Microsoft Purview Communication Compliance is designed to detect policy violations in communications like email and Teams, not to automatically detect PHI in documents and apply sensitivity labels. It lacks the ability to classify and protect content in SharePoint Online documents.

When would these options actually be correct?

An organization needs to automatically retain SharePoint documents containing PHI for 6 years and then delete them to comply with HIPAA data retention policies.

A question where an organization needs to monitor employee communications for inappropriate sharing of sensitive information (e.g., PHI sent via email) and enforce compliance policies on those communications would make Communication Compliance the correct answer.

Why candidates pick the wrong answer

Candidates may confuse lifecycle management with the broader set of compliance controls needed for HIPAA, assuming it covers all data governance tasks.

Candidates may confuse 'compliance' with data protection and think Communication Compliance can handle document classification, or they may mistakenly believe it includes automated labeling capabilities for content in SharePoint.

Full explanation →

125

Multi-Selecteasy

Which THREE features are part of Microsoft Entra ID? (Select three.)

Select 3 answers

A.Privileged Identity Management

B.Microsoft Sentinel

C.Conditional Access

D.Identity Protection

E.Microsoft Intune

AnswersA, C, D

Privileged Identity Management (PIM) is indeed a feature of Microsoft Entra ID, but it is not one of the two correct answers for this question. The intended correct options are Conditional Access and Identity Protection.

Why this answer

Conditional Access is a core feature of Microsoft Entra ID that allows administrators to enforce policies based on conditions such as user location, device state, or sign-in risk, enabling granular access control. Identity Protection is also part of Microsoft Entra ID, using machine learning to detect and respond to identity-based risks like leaked credentials or anomalous sign-in patterns. Privileged Identity Management (PIM) is a key capability of Microsoft Entra ID Governance, which is a set of features within Microsoft Entra ID for managing, controlling, and monitoring access to important resources, and is explicitly covered as a Microsoft Entra ID capability in the SC-900 exam objectives.

Exam trap

The trap here is that candidates may confuse features that integrate with Microsoft Entra ID (like Intune or Sentinel) as being part of Entra ID itself, when they are separate Azure services that only use Entra ID for authentication or data sources.

Full explanation →

126

MCQhard

Contoso has a hybrid identity with AD DS synced to Microsoft Entra ID. They want to block legacy authentication protocols that bypass MFA. Which security solution should they use?

A.Microsoft Entra Password Protection

B.Microsoft Entra ID Protection

C.Microsoft Entra Connect Health

D.Conditional Access policy

AnswerD

A Conditional Access policy is the correct solution because it allows administrators to define conditions under which users can access cloud applications. By configuring a policy to target "Client apps" and specifically selecting "Other clients" or "Exchange ActiveSync clients," organizations can effectively block authentication attempts originating from applications using legacy protocols such as POP3, IMAP4, or older Office clients that do not support modern authentication. This directly addresses the requirement to block legacy authentication.

Why this answer

Conditional Access policies in Microsoft Entra ID can be configured to block legacy authentication protocols (such as POP3, IMAP, SMTP, and basic authentication) by targeting client apps that do not support modern authentication. This directly prevents bypass of MFA because legacy protocols do not support MFA challenges, making them a common attack vector. By creating a policy that blocks all access from legacy authentication clients, Contoso enforces MFA for all sign-ins that use modern authentication.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID Protection (which detects risky sign-ins) with the actual enforcement mechanism (Conditional Access) that can block legacy authentication, or they mistakenly think Password Protection or Connect Health can control authentication protocols.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Password Protection is designed to detect and block weak passwords and common password attacks, not to control authentication protocols or enforce MFA. Option B is wrong because Microsoft Entra ID Protection focuses on detecting and responding to identity-based risks (e.g., leaked credentials, anomalous sign-ins) but does not itself block legacy authentication protocols; it can feed risk signals into Conditional Access but is not the direct control. Option C is wrong because Microsoft Entra Connect Health monitors the health of the on-premises AD DS sync infrastructure and provides alerts for sync errors or performance issues, but it has no capability to block authentication protocols or enforce MFA.

Full explanation →

127

MCQhard

A company uses an on-premises Active Directory (AD) and wants to enable single sign-on (SSO) for users to access Microsoft 365 and a third-party SaaS application. They plan to use an external identity provider (IdP) that supports Security Assertion Markup Language (SAML) 2.0. Which identity concept does this implementation primarily rely on?

A.Federation

B.Provisioning

C.Synchronization

D.Directory extension

AnswerA

Federation establishes a trust relationship between an on-premises Active Directory and an external identity provider, such as Microsoft Entra ID, allowing users to authenticate once and gain access to multiple applications across different security domains. This process leverages industry standards like Security Assertion Markup Language (SAML) or OpenID Connect (OIDC) to exchange authentication and authorization data, enabling seamless Single Sign-On (SSO) without replicating user credentials. It specifically addresses the need for an on-premises AD to trust identities from another system for SSO.

Why this answer

Federation is the correct answer because it establishes a trust relationship between the on-premises Active Directory and the external identity provider (IdP) using SAML 2.0, enabling users to authenticate once and gain access to both Microsoft 365 and the third-party SaaS application without re-entering credentials. This relies on the IdP issuing SAML assertions that are trusted by the relying parties (Microsoft 365 and the SaaS app), which is the core mechanism of federated identity.

Exam trap

The trap here is that candidates often confuse synchronization (e.g., Azure AD Connect) with federation, thinking that syncing user accounts alone enables SSO, but synchronization only copies identities without establishing the SAML trust required for federated authentication.

How to eliminate wrong answers

Option B (Provisioning) is wrong because provisioning refers to the automated creation, management, and deletion of user accounts and attributes in target systems (e.g., Microsoft 365), not to the authentication trust that enables SSO. Option C (Synchronization) is wrong because synchronization (e.g., Azure AD Connect) copies user objects and hashes from on-premises AD to Azure AD, but it does not establish a SAML-based trust with an external IdP for SSO; it is a prerequisite for some federation scenarios but not the primary concept. Option D (Directory extension) is wrong because directory extension involves adding custom attributes to the directory schema (e.g., via Microsoft Graph or Azure AD schema extensions), which is unrelated to authentication or SSO protocols like SAML.

Full explanation →

128

MCQeasy

A company uses Azure SQL Database, which is a Platform as a Service (PaaS) offering. The security team is reviewing the shared responsibility model and wants to know who is responsible for applying operating system patches to the underlying infrastructure that hosts the database. Who is responsible for this task?

A.The customer is responsible for patching the OS on virtual machines but not for PaaS; however, the customer must patch the OS for Azure SQL Database.

B.Microsoft is responsible for managing and patching the operating system of the underlying infrastructure for PaaS services.

C.Both the customer and Microsoft share equal responsibility for patching the OS in a PaaS model.

D.The cloud service provider partner (e.g., a managed service provider) is responsible for OS patches in PaaS.

AnswerB

This statement is correct and accurately reflects the shared responsibility model for Platform as a Service (PaaS) offerings like Azure SQL Database. In PaaS, Microsoft manages the entire underlying infrastructure, including the operating system, network controls, and physical hardware. This allows customers to focus their efforts on their applications, data, and configurations, without the operational overhead of OS patching and maintenance.

Why this answer

Azure SQL Database is a Platform as a Service (PaaS) offering where Microsoft manages the underlying infrastructure, including the operating system. In the shared responsibility model for PaaS, Microsoft is responsible for applying OS patches to the host servers, while the customer manages the database configuration and data. Therefore, option B correctly identifies Microsoft as responsible for OS patching in this context.

Exam trap

The trap here is that candidates often confuse the shared responsibility model for PaaS with IaaS, mistakenly believing that because Azure SQL Database runs on VMs, the customer must patch the OS, when in fact Microsoft abstracts and manages the entire host OS layer in PaaS.

How to eliminate wrong answers

Option A is wrong because it incorrectly states that the customer must patch the OS for Azure SQL Database; in PaaS, Microsoft handles all infrastructure patching, and the customer has no access to the underlying OS. Option C is wrong because it claims equal shared responsibility for OS patching in PaaS, but the model assigns full responsibility to Microsoft for the host OS, with the customer responsible only for data and access management. Option D is wrong because it introduces a third-party partner as responsible, but in Azure PaaS, Microsoft directly manages the infrastructure, and no external partner is involved unless explicitly contracted for additional services.

Full explanation →

129

MCQhard

Your organization has multiple on-premises directories and wants to synchronize them to Microsoft Entra ID. However, you must avoid duplicate user objects. Which feature should you configure?

A.Password Hash Sync

B.Pass-through Authentication

C.Active Directory Federation Services

D.Source anchor attribute

AnswerD

The source anchor attribute, also known as `immutableId` in Azure AD, is a critical attribute used by Azure AD Connect to uniquely identify an object across both the on-premises Active Directory and Azure AD. When synchronizing from multiple on-premises directories, Azure AD Connect uses this attribute to establish a persistent, unique link for each object. This ensures that each on-premises object maps to a single, unique object in Azure AD, effectively preventing the creation of duplicate identities for the same user or group.

Why this answer

The source anchor attribute (often the objectGUID in on-premises directories) is used during synchronization to uniquely identify each object and prevent duplicates. By mapping each on-premises object to a single, immutable source anchor, Microsoft Entra Connect ensures that even if multiple directories contain the same user, only one corresponding object is created in Entra ID.

Exam trap

The trap here is that candidates often confuse features that handle authentication (Password Hash Sync, Pass-through Authentication, AD FS) with the identity-mapping mechanism (source anchor) that prevents duplicate objects during synchronization.

How to eliminate wrong answers

Option A is wrong because Password Hash Sync is a method for synchronizing user password hashes for authentication, not for preventing duplicate user objects. Option B is wrong because Pass-through Authentication validates passwords directly against on-premises Active Directory without synchronizing hashes, but does not address object deduplication. Option C is wrong because Active Directory Federation Services (AD FS) provides federated authentication using claims and does not handle object identity mapping or duplicate prevention during directory synchronization.

Full explanation →

130

MCQmedium

An organization uses Microsoft Sentinel for SIEM. The security operations center (SOC) wants to automatically create an incident when a user account is compromised and suspicious activity is detected. Which Microsoft Sentinel feature should be used?

A.Analytics rules

B.Watchlists

C.Automation playbooks

D.Workbooks

AnswerA

Analytics rules create incidents from detections.

Why this answer

Analytics rules in Microsoft Sentinel are the correct feature because they define conditions for generating alerts and can automatically create incidents when those conditions are met. In this scenario, an analytics rule can be configured to detect a compromised user account and suspicious activity, then automatically create an incident for the SOC to investigate.

Exam trap

The trap here is that candidates often confuse automation playbooks (which respond to incidents) with analytics rules (which create incidents), leading them to select playbooks for incident creation instead of detection logic.

How to eliminate wrong answers

Option B is wrong because watchlists are collections of data (e.g., IP addresses, user names) used for correlation and enrichment within analytics rules or queries, but they do not automatically create incidents on their own. Option C is wrong because automation playbooks are triggered by alerts or incidents to perform automated response actions (e.g., blocking a user), but they do not generate incidents; they respond to them. Option D is wrong because workbooks are visualization and reporting tools that provide dashboards and insights from data, but they do not create incidents or automate detection.

Full explanation →

131

MCQhard

A user accidentally shared a confidential document with an external vendor. You need to revoke access immediately for all copies, even if the file has been downloaded. Which Microsoft Purview feature should you use?

A.Microsoft Purview Information Protection

B.Retention policy

C.Data loss prevention (DLP) policy

D.Audit log search

AnswerA

Microsoft Purview Information Protection (MPIP) provides persistent data protection by allowing organizations to classify, label, and encrypt sensitive documents. Crucially, even after a document protected with MPIP is shared, the data owner or administrator retains the ability to revoke access at any time, regardless of the document's location. This capability directly addresses the scenario of accidental oversharing by enabling immediate remediation.

Why this answer

Microsoft Purview Information Protection (formerly Azure Information Protection) allows you to classify, label, and protect documents and emails. When a confidential document is shared accidentally, you can use the 'Revoke Access' action on the protected file via the Microsoft Purview compliance portal or PowerShell. This revokes access for all copies, even if the file has been downloaded, because the protection travels with the file through persistent rights management.

Exam trap

The trap here is that candidates often confuse Data Loss Prevention (DLP) policies with Information Protection, assuming DLP can retroactively block access to already-exposed data, when in fact DLP only prevents future sharing and does not revoke access to files already in the wild.

How to eliminate wrong answers

Option B is wrong because a retention policy is designed to preserve or delete data after a specified period, not to dynamically revoke access to already-shared files. Option C is wrong because a Data Loss Prevention (DLP) policy detects and prevents sharing of sensitive information but does not retroactively revoke access to files that have already been shared or downloaded. Option D is wrong because audit log search allows you to review past activities for investigation but does not provide any mechanism to revoke access to a file.

Full explanation →

132

MCQmedium

Your organization uses Microsoft Intune for mobile device management. You need to ensure that users cannot copy corporate data from managed apps to personal apps. Which policy should you configure?

A.App Configuration Policy

B.App Protection Policy

C.Device Compliance Policy

D.Conditional Access Policy

AnswerB

App Protection Policies (APP), also known as Mobile Application Management (MAM) policies, are specifically designed to protect organizational data within applications, irrespective of whether the device is enrolled in MDM. These policies enforce granular data loss prevention (DLP) controls, such as restricting copy/paste, preventing "save as" to personal storage locations, or blocking "open in" functionality to unmanaged applications. By creating a secure container around corporate data within compliant apps, APP ensures sensitive information remains within the organization's control, preventing its transfer to personal or unapproved applications.

Why this answer

App Protection Policies (APP) in Microsoft Intune are designed to manage how data is handled within applications, regardless of device enrollment. By configuring a 'Save as' or 'Copy/paste' restriction between managed and unmanaged apps, you can prevent corporate data from being transferred to personal apps. This policy operates at the app layer, not the device layer, making it the correct choice for this data leakage scenario.

Exam trap

The trap here is that candidates often confuse App Protection Policies with Device Compliance Policies, thinking that device-level controls can prevent app data leakage, but APP is the only policy that operates at the application layer to enforce data transfer restrictions.

How to eliminate wrong answers

Option A is wrong because App Configuration Policies are used to supply custom settings or configurations to apps (e.g., server URLs or theme colors), not to restrict data movement between apps. Option C is wrong because Device Compliance Policies evaluate device-level settings (e.g., jailbreak detection, minimum OS version) and do not control app-to-app data transfer. Option D is wrong because Conditional Access Policies enforce access controls at sign-in (e.g., require MFA or compliant device) but do not govern data behavior within apps after access is granted.

Full explanation →

133

Multi-Selecthard

Which TWO of the following are capabilities of Microsoft Purview Insider Risk Management? (Select TWO.)

Select 2 answers

A.Identify anomalous user activities such as mass file downloads

B.Review communications for policy violations

C.Detect data exfiltration by departing employees

D.Conduct eDiscovery searches for legal cases

E.Block sharing of sensitive data via email

AnswersA, C

Microsoft Purview's Insider Risk Management solution is specifically designed to identify unusual or risky user behaviors. It leverages machine learning to analyze activity signals across Microsoft 365 services, detecting deviations from normal patterns, such as an employee suddenly downloading a large volume of files from SharePoint or OneDrive. This capability helps organizations proactively identify potential data exfiltration or policy violations before significant damage occurs.

Why this answer

Microsoft Purview Insider Risk Management uses predefined risk indicators to detect anomalous user activities, such as mass file downloads, which may signal data theft or policy violations. These indicators are based on user behavior analytics and can be customized to align with organizational risk tolerance.

Exam trap

The trap here is that candidates often confuse Insider Risk Management with other compliance solutions like Communication Compliance or DLP, leading them to select options that describe those separate services instead of the specific capabilities of Insider Risk Management.

Full explanation →

134

Multi-Selecthard

Which TWO of the following are features of Microsoft Purview Audit?

Select 2 answers

A.Manages sensitivity labels for documents

B.Provides real-time threat detection

C.Automatically blocks malicious activities

D.Records user and admin activities in the unified audit log

E.Allows searching and investigating audit log entries

AnswersD, E

Microsoft Purview's Audit solution is responsible for capturing and retaining a comprehensive record of user and administrator activities across various Microsoft 365 services, Azure, and other integrated platforms. This unified audit log provides a forensic trail of actions, including file access, mailbox operations, and configuration changes, which is crucial for security investigations, compliance adherence, and internal audits. It centralizes logging for easier management and analysis.

Why this answer

Microsoft Purview Audit provides detailed logging of user and admin activities, and allows searching the audit log for security investigations. It does not automatically block malicious activities (that's DLP or Defender), and it does not manage sensitivity labels (that's Information Protection). It does not provide real-time threat detection (that's Sentinel or Defender).

Full explanation →

135

MCQhard

Refer to the exhibit. You are a compliance administrator running PowerShell to update a sensitivity label in Microsoft Purview. The command fails with an error that the label is not found. What is the most likely cause?

A.The -Settings parameter is deprecated.

B.The cmdlet Get-MgInformationProtectionPolicy does not return labels.

C.The user does not have permissions to view labels.

D.The label name is misspelled.

AnswerB

The Get-MgInformationProtectionPolicy cmdlet is specifically designed to retrieve information protection policy objects, which define the overall framework for data protection within an organization. It does not enumerate or return individual sensitivity labels. To retrieve sensitivity labels, the correct cmdlet to use is Get-MgInformationProtectionSensitivityLabel, which is dedicated to managing and listing these specific classification objects.

Why this answer

The cmdlet Get-MgInformationProtectionPolicy retrieves the policy configuration but does not return individual sensitivity labels. To update a specific label, you must use Get-MgInformationProtectionSensitivityLabel to first retrieve the label object, then pipe it to Set-MgInformationProtectionSensitivityLabel. The error 'label not found' occurs because the cmdlet used does not expose labels, not because the label is missing or misspelled.

Exam trap

The trap here is that candidates assume any 'InformationProtection' cmdlet returns labels, but Microsoft deliberately separates policy-level and label-level cmdlets, so using the wrong one yields a 'not found' error even when the label exists.

How to eliminate wrong answers

Option A is wrong because the -Settings parameter is not deprecated; it is still valid for Set-MgInformationProtectionSensitivityLabel. Option C is wrong because the error message specifically states 'label is not found', not 'access denied', indicating a retrieval issue rather than a permission issue. Option D is wrong because even if the label name were misspelled, the cmdlet Get-MgInformationProtectionPolicy would not return labels at all, so the error would still occur regardless of spelling.

Full explanation →

136

MCQeasy

Refer to the exhibit. An administrator creates a Conditional Access policy in Microsoft Entra ID. What will this policy do?

A.Block access for Global Administrators unless they use MFA

B.Require MFA for all users

C.Require MFA for Global Administrators accessing any application

D.Require MFA for users accessing the Microsoft Entra admin center only

AnswerC

This statement accurately describes the conditional access policy's intended behavior and configuration. The policy's "Users and groups" condition is configured to target the "Global Administrator" directory role, ensuring only these privileged accounts are affected. Concurrently, the "Cloud apps or actions" condition is set to "All cloud apps," meaning it applies universally to any application accessed by these administrators. Finally, the "Grant" control enforces "Require multifactor authentication" for these specific users across all applications.

Why this answer

The policy targets 'Global Administrators' and the 'All cloud apps' condition, then requires 'Require multi-factor authentication' as the access control. This means any Global Administrator attempting to access any application (not just the Entra admin center) must satisfy MFA. Option C correctly captures this scope.

Exam trap

The trap here is that candidates often assume a policy targeting 'Global Administrators' with MFA only applies to the Azure portal, but the 'All cloud apps' condition extends the requirement to every cloud application the admin accesses.

How to eliminate wrong answers

Option A is wrong because the policy does not block access; it requires MFA, not a block, and it applies to all apps, not just when MFA is absent. Option B is wrong because the policy is scoped to the 'Global Administrators' group, not all users. Option D is wrong because the policy targets 'All cloud apps', not only the Microsoft Entra admin center.

Full explanation →

137

MCQhard

A company wants to detect potentially malicious insider activities, such as employees copying large volumes of files to external drives or sending sensitive emails to personal accounts. The security team needs to investigate these activities with visual timelines and assign cases for review. Which Microsoft Purview solution should they use?

A.Insider Risk Management

B.Communication Compliance

C.eDiscovery (Premium)

D.Data Loss Prevention

AnswerA

Insider Risk Management is the correct solution because it is specifically designed to identify, investigate, and act on potentially malicious or inadvertent insider activities. It leverages machine learning to correlate diverse signals across Microsoft 365 services, such as file access, downloads, emails, and SharePoint activities, to detect patterns indicative of data exfiltration, intellectual property theft, or policy violations. The solution provides rich investigative tools, including visual timelines of user activity and integrated case management, enabling security teams to understand context and respond effectively to complex insider threats.

Why this answer

Microsoft Purview Insider Risk Management is designed to help detect, investigate, and act on malicious and inadvertent insider risks. It provides risk scoring, visual timelines of user activities, and case management workflows. Communication Compliance focuses on communication surveillance for regulatory compliance, eDiscovery is for legal discovery, and DLP prevents data loss but does not provide investigative timelines.

Full explanation →

138

Multi-Selecteasy

Which THREE are features of Microsoft Entra ID? (Choose three.)

Select 3 answers

A.Firewall management

B.Multifactor authentication

C.Self-service password reset

D.Single sign-on

E.Anti-malware protection

AnswersB, C, D

MFA is a feature of Entra ID.

Why this answer

Microsoft Entra ID provides multifactor authentication (MFA) as a core identity security feature, requiring users to verify their identity using two or more methods such as a password plus a phone call or mobile app notification. This significantly reduces the risk of credential theft and unauthorized access.

Exam trap

The trap here is that candidates confuse Microsoft Entra ID with broader Azure security services, incorrectly assuming it includes network or endpoint protection features like firewall management or anti-malware, when in reality it is strictly an identity and access management solution.

Full explanation →

139

MCQeasy

Your organization wants to use Microsoft Entra ID to authenticate users from a partner company that uses its own identity provider. Which federation standard should you use?

A.OAuth 2.0

B.SCIM

C.OpenID Connect

D.SAML 2.0

AnswerD

Security Assertion Markup Language (SAML) 2.0 is an XML-based open standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). It enables web-based single sign-on (SSO) across different security domains by allowing an IdP to assert a user's identity to an SP securely. This protocol is specifically designed for establishing trust and federating identities between distinct organizations or systems, making it ideal for enterprise federation scenarios.

Why this answer

SAML 2.0 is the correct federation standard because it enables cross-organization authentication by allowing Microsoft Entra ID to trust assertions from a partner company's own identity provider. SAML 2.0 is specifically designed for enterprise federation scenarios where an external IdP authenticates users and sends a SAML assertion to Entra ID for access.

Exam trap

The trap here is that candidates confuse OpenID Connect (which is for modern app authentication) with SAML 2.0 (which is the standard for enterprise federation between separate identity providers), especially when the question mentions 'federation' and 'partner company using its own identity provider'.

How to eliminate wrong answers

Option A is wrong because OAuth 2.0 is an authorization framework, not an authentication protocol; it issues access tokens for delegated access but does not provide user identity assertions. Option B is wrong because SCIM (System for Cross-domain Identity Management) is a provisioning standard for automating user identity lifecycle management, not for authentication or federation. Option C is wrong because OpenID Connect is an authentication layer built on OAuth 2.0, but it is optimized for modern applications and social logins, not for the enterprise federation scenario where a partner company uses its own identity provider with SAML 2.0 assertions.

Full explanation →

140

MCQhard

You are the security administrator for a large healthcare organization that uses Microsoft 365 E5. The organization must comply with HIPAA and GDPR regulations. You have implemented Microsoft Purview Information Protection with sensitivity labels to classify and protect patient data. Recently, the compliance team identified that some documents containing Protected Health Information (PHI) are being shared externally without protection. You need to prevent users from sharing documents classified as 'Highly Confidential' with external users unless the document is encrypted and labeled. Additionally, you must ensure that any external sharing of such documents is automatically blocked. You have the following options available. Which action should you take?

A.Configure auto-labeling for SharePoint to automatically apply the 'Highly Confidential' label to all documents containing PHI

B.Create a data loss prevention (DLP) policy in Microsoft Purview that detects the 'Highly Confidential' label and blocks sharing with external users

C.Configure a conditional access policy in Microsoft Entra ID to block external access to SharePoint sites containing PHI

D.Create a retention policy for SharePoint that prevents deletion of documents with the 'Highly Confidential' label

AnswerB

A DLP policy can detect the 'Highly Confidential' label and automatically block external sharing, meeting the requirement.

Why this answer

The correct action is to create a DLP policy in Microsoft Purview that detects the 'Highly Confidential' label and blocks sharing with external users. DLP policies are designed to inspect content and labels on documents, then take protective actions such as blocking external sharing, sending notifications, or applying restrictions. Auto-labeling (option A) applies labels automatically but does not enforce sharing restrictions.

Conditional access policies (option C) control access at the authentication level, not based on document labels. Retention policies (option D) manage data lifecycle, not sharing permissions.

Full explanation →

141

MCQhard

An organization is deploying Microsoft Intune for mobile device management. They need to ensure that all iOS devices must have a passcode of at least 6 characters and the device must be encrypted. What should they configure?

A.A Conditional Access policy

B.A device configuration profile

C.An app protection policy

D.A device compliance policy

AnswerD

A device compliance policy explicitly defines the security baselines and health requirements that a device must meet to be considered compliant with organizational standards. These policies specify settings like minimum OS versions, encryption status, password requirements, or the presence of antivirus software. Intune continuously evaluates devices against these defined rules, marking them as compliant or non-compliant, and can then report this status for Conditional Access enforcement.

Why this answer

Device compliance policies in Intune define the rules that devices must meet to be considered compliant, such as requiring a passcode of at least 6 characters and device encryption. Option A is incorrect because Conditional Access policies use compliance status to enforce access controls, but do not define the compliance rules themselves. Option B is incorrect because device configuration profiles push settings to devices but do not enforce compliance; they are used for configuring device settings.

Option C is incorrect because app protection policies manage how apps access and handle data, not device-level requirements like passcode and encryption.

Full explanation →

142

MCQeasy

Your company uses Microsoft Defender for Endpoint. A report shows that several devices are missing critical security updates. What feature should you use to deploy the missing updates?

A.Microsoft Intune update rings for Windows

B.Microsoft Defender for Endpoint's threat and vulnerability management (TVM)

C.Microsoft Configuration Manager

D.Microsoft Update

AnswerA

Microsoft Intune update rings for Windows provide a cloud-based solution for managing and deploying Windows updates to organizational endpoints. These rings allow administrators to define a phased rollout strategy, ensuring that devices receive updates in a controlled manner, which is crucial for maintaining security and operational stability. When a report indicates a need for updates, Intune is the primary cloud-native tool to enforce and monitor their deployment across managed devices.

Why this answer

Microsoft Intune update rings for Windows allow you to configure and deploy Windows quality and feature updates to managed devices. Since the question specifies deploying missing security updates, update rings provide the policy-based mechanism to schedule and enforce installation of those updates across devices enrolled in Intune.

Exam trap

The trap here is that candidates confuse TVM's vulnerability discovery capability with the actual deployment mechanism, assuming TVM can both find and install updates, when in fact it relies on Intune or Configuration Manager for remediation.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Endpoint's threat and vulnerability management (TVM) is a discovery and assessment tool that identifies missing updates and vulnerabilities, but it does not deploy updates; it integrates with Intune or Configuration Manager for remediation. Option C is wrong because Microsoft Configuration Manager is an on-premises management tool that can deploy updates, but the question does not specify an on-premises environment or co-management; Intune update rings are the correct cloud-native solution for deploying updates to devices managed via Microsoft Defender for Endpoint. Option D is wrong because Microsoft Update is the underlying service that hosts and distributes update content, not a management tool for deploying updates to specific devices; it lacks the policy and scheduling capabilities needed to target missing updates.

Full explanation →

143

Multi-Selectmedium

Which TWO Microsoft Purview solutions can be used to discover and classify sensitive data in Microsoft 365? (Select two.)

Select 2 answers

A.Data Loss Prevention

B.Information Protection

C.Sensitivity labels

D.Audit

E.Data Classification

AnswersB, E

Microsoft Purview Information Protection (MPIP) is a comprehensive solution designed to discover, classify, label, and protect sensitive data throughout an organization's digital estate. It leverages sensitivity labels, sensitive information types, and trainable classifiers to identify and categorize data based on its sensitivity, applying visual markings, encryption, and access restrictions to ensure proper handling and compliance.

Why this answer

Information Protection (option B) provides the ability to discover, classify, and protect sensitive data across Microsoft 365 by using trainable classifiers and content scanning. Data Classification (option E) offers a unified view of sensitive data across the tenant, including classification results from sensitivity labels and retention labels, enabling administrators to identify and monitor sensitive information at scale.

Exam trap

The SC-900 exam often tests the distinction between the tool that performs discovery (Data Classification) and the solution that enables classification (Information Protection), causing candidates to mistakenly select Sensitivity labels as a discovery solution instead of recognizing it as a labeling mechanism.

Full explanation →

144

MCQeasy

A company assigns permissions to users based strictly on their job title (e.g., Sales Manager can edit documents, Sales User can only read). Which identity and access management concept is being implemented?

A.Least privilege

B.Role-Based Access Control (RBAC)

C.Defense in depth

D.Zero Trust

AnswerB

Role-Based Access Control (RBAC) is an access management model where permissions are aggregated into specific roles, which are then assigned to users based on their job functions or responsibilities. This method ensures that users receive a consistent set of permissions directly relevant to their defined duties, streamlining administration and enhancing security by aligning access with organizational structure. The scenario directly describes this systematic assignment of permissions according to job title.

Why this answer

Role-Based Access Control (RBAC) is the correct concept because it assigns permissions to users based on their job title or role within the organization. In this scenario, the Sales Manager role is granted edit permissions, while the Sales User role is restricted to read-only, which is a direct implementation of RBAC where access rights are tied to roles rather than individual users.

Exam trap

The trap here is that candidates often confuse least privilege with RBAC, thinking that assigning minimal permissions per role is the same as the principle of least privilege, but RBAC is specifically about organizing permissions by role, while least privilege is a broader security goal that can be achieved through RBAC or other methods.

Why the other options are wrong

Least privilege grants users only the minimum permissions needed to perform their job, not based on job title. The question describes permissions assigned by job title, which is RBAC, not least privilege.

Zero Trust is a security model that assumes no implicit trust and requires continuous verification, not a method for assigning permissions based on job titles. The question describes role-based permission assignment, which is RBAC.

When would these options actually be correct?

A question stating: 'A company ensures users have only the permissions necessary to perform their specific tasks, nothing more. Which concept is this?' would make least privilege the correct answer.

A question asks: 'A company implements a security model where no user or device is trusted by default, and every access request is verified regardless of location. Which concept is this?' Zero Trust would be the correct answer.

Why candidates pick the wrong answer

Candidates may confuse least privilege with RBAC because both involve limiting permissions, but they focus on different aspects: RBAC assigns by role, while least privilege minimizes permissions regardless of role.

Candidates may confuse Zero Trust with access control because it involves verifying permissions, but Zero Trust is a broader security framework, not a specific access control model like RBAC.

Full explanation →

145

MCQmedium

A company wants to allow external business partners to access its internal applications using their own corporate credentials (e.g., their Microsoft Entra ID or Google account), without creating separate user accounts in the company's directory. Which Microsoft Entra ID feature should they use?

A.Azure AD B2C (Business-to-Consumer)

B.B2B collaboration

C.Microsoft Entra Domain Services

D.Conditional Access

AnswerB

Microsoft Entra B2B collaboration enables organizations to securely share applications and resources with external business partners, allowing them to sign in using their own existing work, school, or social identities. This process creates a guest user object in the inviting organization's directory, which can then be granted access to specific resources, streamlining external access while maintaining control and minimizing administrative overhead.

Why this answer

B2B collaboration allows the company to grant external business partners access to its internal applications using their own corporate identities (such as Microsoft Entra ID or Google accounts) without creating separate user accounts in the company's directory. It leverages federation trust and cross-tenant authentication, enabling partners to authenticate with their home organizations while accessing resources in the host tenant.

Exam trap

The trap here is confusing B2B collaboration (for business partners with existing corporate identities) with Azure AD B2C (for customers using social or local accounts), as both involve external users but serve fundamentally different scenarios.

Why the other options are wrong

Azure AD B2C is designed for customer-facing identity management, allowing external users to sign up and log in with social or local accounts, but it requires creating user profiles in the B2C directory, not using their existing corporate credentials from other identity providers like Microsoft Entra ID or Google without separate accounts.

Microsoft Entra Domain Services provides managed domain services like domain join, group policy, and LDAP for legacy applications, not external identity federation for business partners.

Conditional Access is a policy engine that enforces access controls (e.g., MFA, device compliance) after authentication, but it does not enable external users to authenticate with their own corporate credentials. The question specifically asks for a feature that allows external partners to use their own identities, which is B2B collaboration, not Conditional Access.

When would these options actually be correct?

A company wants to allow customers to sign up and log in to a consumer-facing web application using their own social accounts (e.g., Facebook, Google) or email/password, without any existing corporate directory. The question specifies 'external business partners' and 'their own corporate credentials', which points to B2B, not B2C.

A company needs to lift-and-shift on-premises applications that require domain-joined authentication to Azure VMs without managing domain controllers. Entra Domain Services would provide the managed domain services.

A company wants to enforce MFA for all external partner access to its internal applications, regardless of the partner's identity provider. Conditional Access policies can be configured to require MFA for guest users from external tenants, making it the correct answer in that scenario.

Why candidates pick the wrong answer

Candidates may confuse B2B (business-to-business) with B2C (business-to-consumer) due to similar acronyms, or assume that any external user scenario falls under B2C, not realizing that B2C is for consumers, not business partners with existing corporate identities.

Candidates may confuse 'Domain Services' with identity services for external users, or think it supports federation because it integrates with Entra ID.

Candidates may confuse Conditional Access with a feature that manages external identities because it is a powerful security tool often associated with access control for external users, but it does not handle identity federation or external authentication.

Full explanation →

146

MCQmedium

A company uses Microsoft Sentinel as its SIEM. The security team wants to automatically trigger a playbook when a high-severity incident is created. Which automation option should be used?

A.Azure Policy assignment

B.Microsoft Power Automate flow directly from Sentinel

C.Automation rule in Microsoft Sentinel

D.Azure Logic Apps HTTP trigger

AnswerC

Automation rules in Microsoft Sentinel are the core mechanism for orchestrating automated responses to security incidents and alerts, streamlining the Security Orchestration, Automation, and Response (SOAR) process. These rules allow security teams to define specific conditions (e.g., incident severity, associated entities) that, when met, will automatically trigger a pre-configured playbook (an Azure Logic App), assign incidents, change their status, or close them. This significantly enhances response efficiency and consistency by automating repetitive tasks.

Why this answer

Microsoft Sentinel automation rules are specifically designed to trigger automated responses—such as running playbooks—based on incident creation or update conditions, including severity level. When a high-severity incident is created, an automation rule can invoke a playbook without requiring manual intervention or external orchestration.

Exam trap

The trap here is that candidates confuse the automation rule (the trigger condition in Sentinel) with the playbook itself (the workflow logic), or mistakenly think a generic HTTP trigger or Power Automate flow can replace Sentinel's built-in incident-based automation rule.

How to eliminate wrong answers

Option A is wrong because Azure Policy assignment enforces compliance rules on Azure resources (e.g., tagging or location restrictions) and cannot trigger playbooks in response to Sentinel incidents. Option B is wrong because while Microsoft Power Automate can be used with Sentinel, directly creating a flow 'from Sentinel' is not the native automation mechanism; Sentinel uses automation rules to invoke playbooks (which may be built on Logic Apps or Power Automate), but the rule itself is the trigger. Option D is wrong because Azure Logic Apps HTTP trigger is a generic webhook trigger that requires an external caller; Sentinel automation rules are the intended way to invoke Logic Apps playbooks based on incident conditions, not a direct HTTP trigger from Sentinel.

Full explanation →

147

MCQmedium

A company stores financial reports in SharePoint Online that contain credit card numbers. The compliance team needs to automatically apply a sensitivity label that encrypts the documents when they detect credit card data. Which Microsoft Purview solution should they configure?

A.Information Protection

B.Data Loss Prevention

C.Data Lifecycle Management

D.Records Management

AnswerA

Microsoft Purview Information Protection (MPIP) provides sensitivity labels that can be configured to automatically detect sensitive information, such as financial data patterns, within documents stored in SharePoint Online. These labels then apply specific protection actions, including visual markings, encryption, and access restrictions, ensuring that financial reports are classified and secured based on their content without manual intervention. This directly addresses the need to protect financial reports.

Why this answer

Microsoft Purview Information Protection (A) is the correct solution because it enables the creation of auto-labeling policies that can automatically apply a sensitivity label with encryption when credit card numbers are detected in SharePoint Online documents. This directly addresses the requirement to classify and protect sensitive data at rest based on content inspection.

Exam trap

The trap here is that candidates confuse the detection and blocking capabilities of Data Loss Prevention (DLP) with the automatic classification and encryption features of Information Protection, assuming DLP can also apply labels, when in fact DLP only monitors and controls data in motion or at rest without modifying the document's protection settings.

Why the other options are wrong

Data Loss Prevention (DLP) policies can detect credit card numbers and block or warn users, but they do not automatically apply sensitivity labels or encrypt documents. The requirement is to label and encrypt, which is a function of Information Protection.

Records Management is used for managing retention and disposition of records, not for automatically applying sensitivity labels based on content detection like credit card numbers.

When would these options actually be correct?

A company needs to prevent users from sharing credit card numbers via email or SharePoint by blocking the transmission or warning the user. In that scenario, Data Loss Prevention would be the correct solution.

An organization needs to retain financial documents for a regulatory period of 7 years and then automatically delete them. Records Management would be the correct solution to define retention labels and disposition rules.

Why candidates pick the wrong answer

Candidates often confuse DLP with sensitivity labels because both involve detecting sensitive data like credit card numbers, but DLP focuses on preventing data loss through actions like blocking sharing, not on labeling or encryption.

Candidates may confuse Records Management with Information Protection because both involve labeling, but Records Management focuses on retention and deletion, not on encryption or content-based classification.

Full explanation →

148

MCQhard

Your organization is implementing Microsoft Purview Information Protection and needs to ensure that files shared externally cannot be forwarded or printed. Which protection mechanism should be applied?

A.Azure Information Protection with rights management

B.Microsoft Purview Data Lifecycle Management retention policy

C.Sensitivity label with user-defined permissions

D.DLP policy with block action

AnswerA

Azure Information Protection (AIP) leverages Azure Rights Management Service (RMS) to apply encryption and usage restrictions directly to documents and emails. This allows organizations to define granular controls, such as preventing forwarding, printing, or copying, even after the content has been shared outside the organization. These protections persist with the data, ensuring automatic enforcement of usage rights regardless of where the file resides or who accesses it.

Why this answer

Azure Information Protection with rights management (now part of Microsoft Purview Information Protection) allows you to apply persistent protection that restricts actions like forwarding and printing on files shared externally. This is achieved through Azure Rights Management (Azure RMS) encryption and usage rights, which travel with the file regardless of where it is stored or sent.

Exam trap

The trap here is that candidates often confuse sensitivity labels with user-defined permissions as a reliable way to enforce restrictions, but user-defined permissions rely on end-user configuration and do not guarantee consistent, organization-wide protection like Azure Information Protection with rights management does.

How to eliminate wrong answers

Option B is wrong because a Microsoft Purview Data Lifecycle Management retention policy is designed to retain or delete data based on compliance requirements, not to enforce usage restrictions like preventing forwarding or printing. Option C is wrong because a sensitivity label with user-defined permissions allows end users to set their own protection settings, which is not a guaranteed, centrally enforced mechanism to block forwarding and printing for all external sharing scenarios. Option D is wrong because a DLP policy with block action can prevent sensitive data from being shared externally in the first place, but it cannot enforce persistent restrictions (like no forwarding or printing) on files that have already been shared.

Full explanation →

149

MCQmedium

A company uses Microsoft Entra ID. They want to enforce that users accessing the payroll application from outside the corporate network must use multifactor authentication and must access the app only from devices that are marked as compliant by Intune. Which Conditional Access component should they use to combine these requirements?

A.Conditions

B.Grant controls

C.Sign-in risk policy

D.Session controls

AnswerB

Grant controls are the 'then' part of a Microsoft Entra Conditional Access policy that dictate what must be satisfied *before* access to a cloud application is granted. These controls allow administrators to enforce specific requirements such as requiring multi-factor authentication (MFA), a device marked as compliant, or a hybrid Azure AD joined device. They directly enforce the desired authentication and device posture necessary for access.

Why this answer

B is correct because Grant controls in a Conditional Access policy allow administrators to specify the access requirements that must be satisfied before a user can access a resource. In this scenario, the requirement to enforce both multifactor authentication and device compliance (from Intune) is achieved by configuring the Grant control to 'Require multifactor authentication' and 'Require device to be marked as compliant', combined with the 'Require all the selected controls' option. This ensures that both conditions must be met simultaneously for access to the payroll application from outside the corporate network.

Exam trap

The trap here is that candidates confuse 'Conditions' (the 'when' and 'where' of the policy) with 'Grant controls' (the 'what must happen' to gain access), leading them to incorrectly select Conditions as the component that combines the requirements.

How to eliminate wrong answers

Option A is wrong because Conditions define the signals or triggers for the policy (e.g., user location, device platform, application), not the actions or requirements that must be met once the policy is triggered. Option C is wrong because Sign-in risk policy is a specific type of Identity Protection policy that responds to real-time risk detections (e.g., anonymous IP address, atypical travel) and is not designed to combine static requirements like MFA and device compliance for a specific application. Option D is wrong because Session controls enforce limitations on the user session after access is granted (e.g., app-enforced restrictions, sign-in frequency), not the pre-access requirements like MFA or device compliance.

Full explanation →

150

MCQeasy

A company uses Microsoft Entra ID. They have a financial application that should only be accessible from Windows devices. The security team wants to create a Conditional Access policy to block access from other operating systems such as macOS or Linux. Which assignment condition should they configure?

A.Locations

B.Device platforms

C.Client apps

D.Sign-in risk

AnswerB

The Device platforms condition in Microsoft Entra Conditional Access precisely targets the operating system of the device attempting to access resources. By configuring this condition to include only specific OS types, such as Windows, administrators can effectively block access attempts originating from non-compliant or unauthorized platforms like macOS, iOS, Android, or Linux. This ensures that sensitive financial data is only accessed from devices running approved operating systems, directly meeting the requirement to restrict access based on the device's OS.

Why this answer

The Device platforms condition in a Conditional Access policy allows administrators to target specific operating systems (e.g., Windows, iOS, Android, macOS) or block others. By configuring this condition to only include Windows devices, the policy will block access from macOS, Linux, or any other non-Windows platform. This directly addresses the security team's requirement to restrict the financial application to Windows devices only.

Exam trap

The trap here is that candidates often confuse Device platforms with Client apps, thinking that blocking 'mobile apps' or 'browsers' would restrict the OS, but Client apps only controls the type of application client, not the underlying operating system.

Why the other options are wrong

Locations control access based on geographic or network locations (e.g., IP ranges), not the operating system of the device. The requirement is to block macOS and Linux, which is about device platform, not location.

The question specifies blocking access based on the operating system (Windows vs. macOS/Linux), which is a device platform condition, not a client app condition. Client apps refer to the type of application (e.g., browser, mobile app, legacy auth), not the OS.

Sign-in risk is used to detect and respond to risky authentication attempts (e.g., leaked credentials, anonymous IP addresses), not to restrict access based on the device's operating system. The question specifically requires blocking macOS or Linux, which is a device platform condition.

When would these options actually be correct?

A Conditional Access policy should block access from untrusted countries or corporate network ranges. For example, 'Block access from all locations except the corporate office IP range' would use the Locations condition.

A Conditional Access policy should block access from specific client apps, such as blocking legacy authentication protocols (e.g., POP, IMAP) to enforce modern authentication. For example, a policy that blocks all client apps except 'Exchange ActiveSync' to secure email access.

A Conditional Access policy should block access when the sign-in risk level is 'High' to prevent compromised accounts from accessing sensitive data, such as requiring MFA or blocking access entirely for high-risk sign-ins.

Why candidates pick the wrong answer

Candidates may confuse 'location' with 'device' or think that restricting by location can indirectly control device types, but Azure AD locations are IP-based, not OS-based.

Candidates may confuse 'client apps' with 'device platforms' because both involve the endpoint, but client apps focus on the application type (e.g., browser, mobile app) rather than the operating system.

Candidates may confuse risk-based controls with device-based controls, thinking that blocking non-Windows devices is a security measure similar to blocking risky sign-ins, but they address different aspects of access control.

Full explanation →

Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 76–150