Microsoft Security, Compliance, and Identity Fundamentals SC-900 SC-900 Questions 226–300 | Page 4/17

226

MCQmedium

A company uses Microsoft 365 and wants to automatically apply a 3-year retention label to any document that contains a patent number in the format PAT-XXXXXX. The label should be applied at the time the document is created or modified. Which Microsoft Purview solution should the administrator configure?

A.Microsoft Purview Data Lifecycle Management

B.Microsoft Purview Communication Compliance

C.Microsoft Purview Data Loss Prevention (DLP)

D.Microsoft Purview Audit (Premium)

AnswerA

Microsoft Purview Data Lifecycle Management is the correct solution because it provides robust auto-labeling policies specifically designed for applying retention labels. These policies leverage sensitive information types, keywords, or trainable classifiers to automatically detect and apply appropriate retention labels to content across Microsoft 365 services like SharePoint, OneDrive, and Exchange. This ensures that data is retained or deleted according to organizational policies without requiring manual intervention, streamlining compliance efforts.

Why this answer

Microsoft Purview Data Lifecycle Management (formerly known as Microsoft 365 Retention) allows administrators to create auto-apply retention labels based on sensitive information types, such as a custom regex for patent numbers. When configured with a 'created or modified' condition, the label is automatically applied at the time the document is saved or edited, ensuring compliance with the 3-year retention requirement.

Exam trap

The trap here is that candidates often confuse Data Loss Prevention (DLP) with Data Lifecycle Management, assuming DLP can apply retention labels, but DLP only detects and protects data in transit or at rest without managing retention schedules.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview Communication Compliance is designed to detect and remediate inappropriate communications (e.g., harassment, insider trading) in Exchange Online, Teams, and Yammer, not to apply retention labels based on document content. Option C is wrong because Microsoft Purview Data Loss Prevention (DLP) can detect sensitive data like patent numbers and trigger alerts or block actions, but it cannot automatically apply retention labels; DLP policies enforce data protection, not lifecycle management. Option D is wrong because Microsoft Purview Audit (Premium) provides detailed logging of user and admin activities for forensic investigation, but it has no capability to apply retention labels or manage data lifecycle policies.

Full explanation →

227

MCQeasy

An organization is moving a virtual machine to Azure Infrastructure as a Service (IaaS). According to the shared responsibility model, which of the following security tasks is the customer responsible for?

A.Physical security of the datacenter

B.Applying security updates to the guest operating system

C.Maintaining the hypervisor

D.Power and cooling infrastructure

AnswerB

For an Azure Infrastructure as a Service (IaaS) virtual machine, the customer retains full responsibility for managing and securing the guest operating system. This critical duty includes regularly applying security updates, patches, and hotfixes to the OS (e.g., Windows Server, Linux distributions) to mitigate vulnerabilities. Microsoft provides the underlying infrastructure, but the customer must actively maintain the OS's security posture, including anti-malware and firewall configurations.

Why this answer

In an IaaS deployment, the customer retains responsibility for securing the guest operating system, including applying security updates. Microsoft manages the physical infrastructure and hypervisor, while the customer must patch and configure the OS running inside the virtual machine.

Exam trap

The trap here is that candidates often confuse IaaS with PaaS or SaaS, mistakenly thinking the provider handles all OS-level security, when in fact the customer is responsible for the guest OS in IaaS.

How to eliminate wrong answers

Option A is wrong because physical security of the datacenter is the sole responsibility of the cloud provider (Microsoft) under the shared responsibility model. Option C is wrong because maintaining the hypervisor is a provider-managed task; the customer has no access to the hypervisor layer. Option D is wrong because power and cooling infrastructure are part of the physical environment managed entirely by Microsoft.

Full explanation →

228

MCQmedium

Refer to the exhibit. The JSON shows a conditional access policy. What is the effect of this policy?

A.Requires MFA for Office 365 from trusted locations.

B.Applies only to external guest users.

C.Blocks all access to Office 365 from trusted locations.

D.Requires a compliant device for Office 365.

AnswerA

The policy's grant control explicitly states 'Require multi-factor authentication,' which means users must successfully complete an MFA challenge to gain access. When combined with a condition that specifies access to Office 365 from 'trusted locations,' this policy ensures enhanced security even from known network perimeters. It mandates an additional layer of identity verification for these specific access attempts. This configuration aligns perfectly with the principle of least privilege and Zero Trust.

Why this answer

The policy assigns the 'Require multifactor authentication' grant to Office 365 cloud apps, and the condition restricts it to 'trusted locations' (typically corporate networks or compliant IP ranges). This means users accessing Office 365 from those trusted locations must complete MFA, while access from untrusted locations is not affected by this policy (it may be handled by other policies). Option A correctly describes this effect.

Exam trap

The trap here is that candidates confuse 'Require MFA' with 'Block access' or assume that trusted locations imply automatic access without MFA, when in fact the policy explicitly requires MFA even from trusted locations.

How to eliminate wrong answers

Option B is wrong because the policy targets 'All users' (not just external guest users) and does not include a filter for user type. Option C is wrong because the policy grants 'Require multifactor authentication' — it does not block access; blocking would require the 'Block access' control. Option D is wrong because the policy does not include a 'Require compliant device' grant; it only specifies MFA.

Full explanation →

229

Multi-Selectmedium

A security team uses Microsoft Defender XDR to respond to incidents. Which THREE components are part of Microsoft Defender XDR?

Select 3 answers

A.Microsoft Defender for Office 365

B.Microsoft Defender for Endpoint

C.Microsoft Sentinel

D.Microsoft Intune

E.Microsoft Defender for Identity

AnswersA, B, E

Microsoft Defender for Office 365 is a crucial component of Microsoft Defender XDR, specializing in protecting an organization's email, collaboration tools, and data within the Office 365 suite. It provides advanced protection against phishing, business email compromise (BEC), malware, and other sophisticated threats targeting email and cloud applications like SharePoint, OneDrive, and Teams. By integrating these signals, it enables a unified security response across the entire digital estate.

Why this answer

Microsoft Defender XDR is a unified extended detection and response platform that natively integrates signals from Microsoft Defender for Office 365 (email and collaboration protection), Microsoft Defender for Endpoint (endpoint detection and response), and Microsoft Defender for Identity (on-premises identity threat detection). These three components share telemetry and automate incident correlation across domains, which is the core purpose of Defender XDR.

Exam trap

The trap here is that candidates confuse Microsoft Sentinel (a SIEM) as part of Defender XDR, when in fact Sentinel is a separate Azure service that can consume Defender XDR alerts but is not a component of the XDR platform itself.

Full explanation →

230

MCQmedium

An organization uses Microsoft 365 Defender. The security team receives an alert about a potential malware outbreak on multiple endpoints, and they need an integrated view that correlates signals from various Microsoft security solutions. Which Microsoft 365 Defender portal component provides this unified view?

A.Microsoft Defender for Cloud

B.Microsoft 365 Defender portal (security.microsoft.com)

C.Azure Sentinel

D.Microsoft Defender for Identity

AnswerB

The Microsoft 365 Defender portal (security.microsoft.com) is the centralized management console for the Microsoft 365 Defender suite. It provides a unified XDR (eXtended Detection and Response) experience, correlating signals from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Microsoft Defender for Cloud Apps. This integration enables security teams to investigate and respond to sophisticated multi-stage attacks across endpoints, email, identities, and applications from a single pane of glass, streamlining incident management.

Why this answer

The Microsoft 365 Defender portal (security.microsoft.com) is the correct answer because it provides a unified view of alerts and incidents across Microsoft 365 Defender components, including Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This integrated correlation enables security teams to see the full scope of a potential malware outbreak across multiple endpoints by combining signals from these solutions into a single incident timeline.

Exam trap

The trap here is that candidates often confuse the Microsoft 365 Defender portal with Azure Sentinel, mistakenly thinking a SIEM is required for correlation, whereas the Microsoft 365 Defender portal already provides built-in, cross-product correlation without needing a separate SIEM tool.

Why the other options are wrong

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) for multicloud environments, not a unified portal for Microsoft 365 Defender's correlated signals across endpoints, email, and identity.

Azure Sentinel is a cloud-native SIEM for security analytics and threat intelligence, not a unified portal for correlating signals from Microsoft 365 Defender solutions like Defender for Endpoint, Office 365, Identity, and Cloud Apps.

Microsoft Defender for Identity focuses on detecting identity-based threats using on-premises Active Directory signals, not on providing a unified view of malware outbreaks across endpoints from multiple Microsoft security solutions.

When would these options actually be correct?

When the question asks for a centralized tool to assess and improve the security posture of Azure, on-premises, and other cloud resources, or to protect cloud workloads with integrated Microsoft Defender plans.

Azure Sentinel would be correct if the question asked for a cloud-native SIEM that ingests logs from multiple sources (including third-party) for advanced threat hunting, correlation, and automated response across hybrid environments.

This option would be correct for a question asking: 'Which Microsoft solution provides identity threat detection and investigation capabilities for on-premises Active Directory environments?'

Why candidates pick the wrong answer

Candidates may confuse 'Defender for Cloud' with the Microsoft 365 Defender portal because both contain 'Defender' and relate to security, but they serve different scopes (cloud infrastructure vs. Microsoft 365 threat protection).

Candidates may confuse Azure Sentinel's SIEM capabilities with the unified incident view in Microsoft 365 Defender, as both involve correlation of security alerts, but Sentinel is broader and not specific to Microsoft 365 Defender's integrated portal.

Candidates may confuse Defender for Identity as part of the Microsoft 365 Defender suite and assume it contributes to the unified view, not realizing the portal itself is the integration point.

Full explanation →

231

MCQeasy

Your organization wants to prevent users from installing unapproved apps on company-managed Windows devices. Which Microsoft Intune feature should you use?

A.App control policies

B.Device configuration profiles

C.Conditional Access

D.Device compliance policies

AnswerA

App control policies, such as Windows Defender Application Control (WDAC) or AppLocker, are specifically designed to restrict which applications can run on devices. These policies enforce a strict allowlist or blocklist, preventing the execution of unauthorized software, including user-installed applications. By defining trusted applications based on publisher, path, or hash, they directly address the requirement to block unapproved installations and executions, ensuring a secure software environment.

Why this answer

App control policies in Microsoft Intune allow administrators to create and enforce rules that control which applications users can run on managed Windows devices. By configuring a baseline policy (e.g., using Windows Defender Application Control), you can block unapproved apps while allowing only trusted or explicitly permitted software, directly preventing users from installing unauthorized applications.

Exam trap

The trap here is that candidates confuse device compliance policies (which check device state) with app control policies (which enforce runtime app execution), leading them to choose compliance policies when the question specifically asks about preventing app installation.

How to eliminate wrong answers

Option B (Device configuration profiles) is wrong because they manage device settings (e.g., Wi-Fi, VPN, encryption) but do not enforce application execution rules. Option C (Conditional Access) is wrong because it controls access to cloud resources based on user, device, and location conditions, not local app installation. Option D (Device compliance policies) is wrong because they evaluate device health (e.g., OS version, encryption status) and trigger conditional access or remediation, but they do not block or allow specific app installations.

Full explanation →

232

MCQeasy

An organization wants to classify and label data automatically based on sensitive content patterns such as credit card numbers. Which Microsoft Purview solution should they use?

A.eDiscovery

B.Data Loss Prevention (DLP)

C.Compliance Manager

D.Audit

AnswerB

Microsoft Purview Data Loss Prevention (DLP) can automatically classify and label data based on sensitive content patterns like credit card numbers.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) can automatically classify and label data based on sensitive content patterns such as credit card numbers. Option A (eDiscovery) is for legal discovery, Option C (Compliance Manager) is for compliance assessments, and Option D (Audit) is for logging activities.

Full explanation →

233

MCQmedium

A company has a hybrid environment with on-premises Active Directory. The security team wants to detect advanced attacks such as pass-the-hash, malicious Kerberos ticket activity, and abnormal service account behavior. They want alerts from the on-premises environment to be integrated into Microsoft Defender for Cloud for centralized monitoring. Which Microsoft security solution should they deploy on their domain controllers?

A.Microsoft Defender for Cloud (agentless)

B.Microsoft Defender for Identity

C.Microsoft Defender for Office 365

D.Microsoft Entra ID Protection

AnswerB

Microsoft Defender for Identity (MDI) is specifically engineered to protect hybrid identity environments by monitoring on-premises Active Directory. It deploys lightweight sensors directly on domain controllers, which passively analyze network traffic and Windows events to detect suspicious user and entity behavior, including advanced attacks like pass-the-hash, Kerberos attacks, and Golden Ticket exploits. MDI provides real-time threat detection and security alerts, making it the ideal solution for securing on-premises AD from sophisticated identity-based threats.

Why this answer

Microsoft Defender for Identity (MDI) is the correct solution because it is specifically designed to detect advanced on-premises Active Directory attacks like pass-the-hash, malicious Kerberos ticket activity (e.g., Golden Ticket, Silver Ticket), and abnormal service account behavior. It integrates directly with Microsoft Defender for Cloud to provide centralized monitoring and alerting, fulfilling the requirement for on-premises domain controller protection.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud (agentless) with Microsoft Defender for Identity, assuming the cloud-based solution can monitor on-premises AD attacks without understanding that MDI is the dedicated on-premises identity threat detection tool.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud (agentless) provides vulnerability assessment and security posture management for cloud workloads, but it does not natively detect on-premises AD attack patterns like pass-the-hash or Kerberos ticket abuse. Option C is wrong because Microsoft Defender for Office 365 protects email, SharePoint, and Teams from phishing and malware, not on-premises Active Directory or domain controller activities. Option D is wrong because Microsoft Entra ID Protection focuses on cloud-based identity risks (e.g., leaked credentials, risky sign-ins) for Azure AD, not on-premises AD domain controller behavior or Kerberos attacks.

Full explanation →

234

MCQeasy

Your organization, Northwind Traders, uses Microsoft Intune to manage Windows 10 devices. You have created a compliance policy that requires devices to have BitLocker enabled. After assigning the policy, you notice that some devices are reporting as non-compliant due to BitLocker not being enabled. You have verified that the devices support BitLocker and that the policy is correctly assigned. You need to ensure that BitLocker is enabled on these devices automatically. What should you do?

A.Modify the compliance policy to allow non-compliant devices

B.Create an endpoint protection configuration profile to enable BitLocker

C.Create a Windows update ring policy

D.Use a PowerShell script to enable BitLocker manually

AnswerB

Configuration profiles can automatically enable BitLocker on devices.

Why this answer

An endpoint protection configuration profile in Microsoft Intune can be used to enforce BitLocker settings on Windows 10 devices automatically. This profile applies the necessary encryption policies without manual intervention. Option A is wrong because modifying the compliance policy to allow non-compliant devices does not enable BitLocker; it only accepts the non-compliant status.

Option C is wrong because Windows update ring policies control update deployment, not BitLocker configuration. Option D is wrong while a PowerShell script could enable BitLocker, it is not the standard or recommended method within Intune; configuration profiles provide a managed, scalable solution.

Full explanation →

235

Drag & Dropmedium

Order the steps to deploy Microsoft Intune for mobile device management.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Intune deployment includes setup, enrollment policies, compliance policies, app assignment, and enrollment.

Full explanation →

236

Multi-Selecteasy

Which TWO Microsoft Purview compliance solutions are used to manage data retention and deletion?

Select 2 answers

A.Data Lifecycle Management

B.Data Loss Prevention

C.Records Management

D.Communication Compliance

E.Audit

AnswersA, C

Microsoft Purview Data Lifecycle Management (DLM) is a compliance solution designed to govern information throughout its entire lifecycle. It enables organizations to define and apply retention labels and policies to content across Microsoft 365 services, ensuring that data is kept for necessary periods and then defensibly deleted when no longer required, aligning with regulatory and business obligations.

Why this answer

Data Lifecycle Management (A) is correct because it enables organizations to apply retention and deletion policies to content based on its age or classification, automatically managing data across SharePoint, OneDrive, Exchange, and Teams. Records Management (C) is correct because it provides a solution for declaring records, applying retention labels that lock content to prevent modification or deletion, and managing disposition reviews for permanent deletion. Both solutions are part of Microsoft Purview's information governance capabilities, specifically designed to control data retention and deletion.

Exam trap

The trap here is that candidates may confuse Data Loss Prevention (DLP) with data retention because both involve data lifecycle concepts, but DLP is solely about preventing data breaches through policy enforcement, not about scheduling retention or deletion.

Full explanation →

237

MCQmedium

A company wants to automatically classify sensitive documents in Microsoft 365 based on credit card numbers and retain them for 7 years. Which two Microsoft Purview solutions should they use together?

A.Sensitivity labels and retention policies

B.Microsoft Purview compliance portal and Microsoft 365 Defender

C.Insider risk management and communication compliance

D.Data Loss Prevention (DLP) and eDiscovery

AnswerA

Sensitivity labels, a core component of Microsoft Purview Information Protection, enable automatic classification of documents based on their content, such as the presence of credit card numbers, using sensitive information types (SITs). Once documents are classified and labeled, retention policies can be applied to these labels, ensuring the content is retained for a specified duration, like seven years, to meet regulatory or organizational compliance requirements. This combination provides both intelligent identification of sensitive data and its subsequent lifecycle management.

Why this answer

Sensitivity labels classify and protect content, and retention policies ensure data is kept for the required period. Data Loss Prevention (DLP) prevents sharing but does not retain; eDiscovery is for search and export; insider risk management detects risky activities. Therefore, sensitivity labels and retention policies are the correct combination.

Full explanation →

238

MCQmedium

You have a Conditional Access policy in Microsoft Entra ID. The policy has the following settings: Assignments > Users > Include: All guest and external users; Assignments > Target resources > Cloud apps: All cloud apps; Access controls > Grant: Require multi-factor authentication. What is the effect of this policy?

A.Requires MFA for all external users accessing any cloud app

B.Requires MFA for guest users only

C.Requires MFA for all users accessing all cloud apps

D.Requires MFA for external users except those with global admin role

AnswerA

The policy targets all external users and all cloud apps with MFA requirement.

Why this answer

The policy applies to all guest and external users and targets all cloud apps, with the grant control requiring multi-factor authentication. Therefore, it requires MFA for all external users accessing any cloud app. It is not limited to guest users only, does not apply to all internal users, and does not exclude external users with the Global Administrator role.

Full explanation →

239

MCQmedium

An organization is subject to regulatory requirements that mandate retention of employee records for 5 years after termination. After the retention period, the records must be permanently deleted. The compliance team wants to automatically enforce this process across all Microsoft 365 locations (Exchange, SharePoint, Teams). Which Microsoft Purview solution should they configure?

A.Microsoft Purview Data Loss Prevention (DLP)

B.Microsoft Purview Data Lifecycle Management

C.Microsoft Purview Records Management

D.Microsoft Purview Communication Compliance

AnswerB

Microsoft Purview Data Lifecycle Management (DLM) is the correct solution for managing content retention and deletion throughout its lifecycle. It enables organizations to create and apply retention policies that automatically preserve content for specified periods to meet regulatory, legal, or business obligations. Once the retention period expires, DLM ensures the content is permanently deleted, thereby addressing the question's requirement for mandated retention and eventual disposal.

Why this answer

Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it allows organizations to define retention and deletion policies that apply automatically across Exchange, SharePoint, and Teams. This solution enforces the 5-year retention period after termination and then permanently deletes the records, meeting the regulatory requirement without manual intervention.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management with Records Management, but Records Management is for declaring records and managing their disposition (e.g., with a retention label), while Data Lifecycle Management provides the automated, policy-based retention and deletion across all locations without requiring manual labeling.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Data Loss Prevention (DLP) is designed to prevent unauthorized sharing or leakage of sensitive data, not to enforce retention or deletion schedules. Option C is wrong because Microsoft Purview Records Management is used for declaring records and managing their disposition, but it requires a retention label to be applied (often manually or via auto-labeling) and is not the primary tool for automated lifecycle policies across all locations; Data Lifecycle Management provides the underlying retention policy that Records Management can leverage. Option D is wrong because Microsoft Purview Communication Compliance is focused on monitoring and reviewing communications (e.g., for regulatory compliance or insider risk), not on data retention or deletion.

Full explanation →

240

MCQmedium

A company manages Azure resources for multiple departments. The security team needs to grant IT administrators temporary, just-in-time access to high-privilege roles (e.g., Contributor, Owner) only when needed, with approval workflows. Which Microsoft Entra ID capability should they configure?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management (PIM)

D.Entitlement Management (Identity Governance)

AnswerC

Azure AD Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources within Azure AD, Azure, and other Microsoft online services. It enforces just-in-time (JIT) access, allowing users to activate privileged roles only when needed and for a limited duration. This capability significantly reduces the attack surface by eliminating standing administrative access, requiring explicit activation and often approval workflows for elevated permissions.

Why this answer

Privileged Identity Management (PIM) is the correct Microsoft Entra ID capability because it provides just-in-time (JIT) activation of high-privilege roles like Contributor and Owner, with time-bound approvals and approval workflows. PIM allows administrators to request temporary elevation to a role, which must be approved by designated approvers, and the access automatically expires after the specified duration. This directly addresses the requirement for temporary, approval-based access to privileged roles.

Exam trap

The trap here is that candidates often confuse Privileged Identity Management (PIM) with Entitlement Management, because both involve access requests and approvals, but PIM is specifically for just-in-time privileged role activation, while Entitlement Management is for ongoing access to resources like groups and apps.

Why the other options are wrong

Conditional Access enforces access policies based on signals like user, device, or location, but does not provide just-in-time role activation or approval workflows for privileged roles.

Identity Protection focuses on detecting and responding to identity-based risks (e.g., compromised credentials, risky sign-ins), not on granting temporary, just-in-time privileged access with approval workflows.

Entitlement Management focuses on managing access packages and resource access for users, not on providing just-in-time, time-bound, approval-based elevation to high-privilege Azure roles like Contributor or Owner.

When would these options actually be correct?

A company needs to require multi-factor authentication or block access from untrusted locations when administrators sign in to the Azure portal. Conditional Access would be the correct capability to configure such policies.

A question asks: 'Which Microsoft Entra ID capability should be used to automatically detect and block risky sign-ins and investigate compromised accounts?' — then Identity Protection is correct.

A company needs to automate access requests and approvals for users to join groups, access applications, or obtain SharePoint Online site memberships, with time-limited access and recurring reviews. Entitlement Management would be the correct choice for managing such access packages.

Why candidates pick the wrong answer

Candidates may confuse Conditional Access with access control for privileged roles, not realizing that PIM specifically handles time-bound role elevation and approval workflows.

Candidates may confuse 'protecting identities' with 'managing privileged access,' or think Identity Protection includes approval workflows because it deals with security and risk.

Candidates may confuse Entitlement Management's access request and approval workflows with PIM's just-in-time role activation, as both involve approvals and time-limited access, but Entitlement Management is for resource access, not privileged role elevation.

Full explanation →

241

Multi-Selectmedium

Which TWO capabilities are provided by Microsoft Defender for Cloud Apps? (Choose two.)

Select 2 answers

A.Mobile device management

B.Device compliance enforcement

C.Session controls for real-time monitoring of app usage

D.Email filtering and anti-phishing

E.Cloud app discovery to identify shadow IT

AnswersC, E

Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) provides robust session controls, a critical capability for real-time monitoring and governance of user activities within cloud applications. These controls enable organizations to enforce policies during a user session, such as blocking sensitive data downloads, requiring justification for specific actions, or protecting data with encryption, while maintaining full visibility into user interactions.

Why this answer

Microsoft Defender for Cloud Apps provides session controls that enable real-time monitoring and control of app usage. These controls use reverse proxy architecture to enforce policies on user activities within cloud apps, such as blocking downloads or requiring multi-factor authentication during a session.

Exam trap

The trap here is that candidates confuse the broad security portfolio of Microsoft 365 Defender and attribute capabilities like MDM or email filtering to Defender for Cloud Apps, when each solution has a distinct scope and integration point.

Full explanation →

242

MCQmedium

Your company uses Microsoft Defender for Identity to monitor on-premises Active Directory. You receive an alert about a potential lateral movement attack involving a service account. The alert indicates that the account was used to log in to multiple servers from a non-domain-joined machine. You need to investigate the alert and determine if the account is compromised. What should you do first?

A.Check if the account is a member of any privileged groups.

B.Immediately reset the service account password.

C.Review the account’s activity timeline in Microsoft Defender for Identity to see all logins and accessed resources.

D.Contact the user to verify if they performed the logins.

AnswerC

Reviewing the activity timeline provides a detailed record of all logins and accessed resources, enabling you to trace the lateral movement and decide on next steps. This is the correct first action.

Why this answer

The correct first step because Microsoft Defender for Identity provides an activity timeline for each account, allowing you to review all logins, resources accessed, and other suspicious activities. This helps determine if the account is compromised before taking any action. Option A is incorrect because the account may be a member of privileged groups, but that alone does not confirm compromise; the activity timeline provides more context.

Option B is incorrect because immediately resetting the password could disrupt legitimate operations and destroy evidence. Option D is incorrect because the user of a service account is typically not a person, and lateral movement alerts indicate automated or unauthorized behavior, so contacting a user is not appropriate.

Full explanation →

243

MCQmedium

A compliance officer needs to automatically detect documents containing passport numbers in SharePoint Online and apply a retention label that retains the documents for 10 years before deleting them. They also want to prevent users from permanently deleting these documents before the retention period ends. Which Microsoft Purview solution should they use to achieve this?

A.Microsoft Purview Information Protection

B.Microsoft Purview Data Lifecycle Management

C.Microsoft Purview Data Loss Prevention (DLP)

D.Microsoft Purview Audit

AnswerB

Microsoft Purview Data Lifecycle Management (DLM) is the correct solution for automatically detecting documents and managing their retention and deletion. DLM utilizes retention labels and policies that can be automatically applied to content based on specific conditions, such as sensitive information types or keywords. These policies ensure that documents are retained for required periods and then disposed of according to compliance regulations, including managing holds for legal discovery and disposition reviews.

Why this answer

Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it enables organizations to automatically apply retention labels to sensitive content—such as documents containing passport numbers—based on sensitive information types. It also enforces a retention period (10 years) and prevents users from permanently deleting documents before that period ends, meeting both the detection and preservation requirements.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management with Data Loss Prevention, assuming DLP handles retention, when in fact DLP only prevents data exfiltration and does not manage retention periods or deletion prevention.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Information Protection focuses on classifying and protecting data through sensitivity labels and encryption, not on managing retention periods or preventing permanent deletion. Option C is wrong because Microsoft Purview Data Loss Prevention (DLP) is designed to detect and prevent unauthorized sharing or leakage of sensitive data, not to enforce retention schedules or block permanent deletion. Option D is wrong because Microsoft Purview Audit provides logging and investigation of user and admin activities, but it does not automatically detect sensitive content or apply retention policies.

Full explanation →

244

MCQhard

Refer to the exhibit. You are analyzing a Microsoft Purview Data Lifecycle Management retention policy. What is the outcome of this policy?

A.Content from the HR department in Exchange and SharePoint is retained for 365 days and then deleted

B.Content from the HR department in Exchange and SharePoint is deleted after 90 days

C.Content from all employees in Exchange and SharePoint is retained for 365 days

D.Content from the HR department in Exchange and SharePoint is retained for 365 days

AnswerA

Correct. The policy retains content for 365 days and then deletes it, as shown in the exhibit.

Why this answer

The exhibit shows a Microsoft Purview Data Lifecycle Management retention policy scoped to the HR department with a retention period of 365 days and a deletion action at the end. Therefore, content from the HR department in Exchange and SharePoint is retained for 365 days and then deleted, matching option A.

Exam trap

The trap is that candidates may overlook the deletion action and assume the policy only retains without deletion, or misread the scope as applying to all employees instead of the HR department.

How to eliminate wrong answers

Option A is wrong because it incorrectly states that content is retained for 365 days and then deleted, which is actually the correct outcome described in option D, but option A is not listed as correct in the answer choices. Option B is wrong because it claims content is deleted after 90 days, but the policy specifies a retention period of 365 days, not 90. Option C is wrong because it states the policy applies to 'all employees,' but the exhibit clearly shows the scope is limited to the HR department only.

Full explanation →

245

MCQmedium

An organization wants to protect its Azure PaaS services, such as Azure SQL Database and Azure Key Vault, by detecting and alerting on suspicious activities like SQL injection attempts or unusual access patterns. They also need to integrate these alerts into a central security information and event management (SIEM) system for further analysis. Which Microsoft security solution provides the threat detection capability described?

A.Microsoft Sentinel

B.Microsoft Defender for Cloud

C.Microsoft Defender for Endpoint

D.Microsoft Defender for Identity

AnswerB

Microsoft Defender for Cloud provides comprehensive cloud security posture management (CSPM) and cloud workload protection (CWP) capabilities. It offers advanced threat protection specifically for Azure PaaS services like Azure SQL Database, Azure Key Vault, and Azure Storage accounts. This includes continuous monitoring, vulnerability assessments, and real-time threat detection alerts tailored to the unique attack vectors of these services, ensuring robust security for cloud-native applications.

Why this answer

Microsoft Defender for Cloud provides unified security management and advanced threat protection across hybrid cloud workloads, including Azure PaaS services like Azure SQL Database and Azure Key Vault. It detects suspicious activities such as SQL injection attempts and unusual access patterns using built-in behavioral analytics and integrates alerts into a central SIEM system via Azure Monitor or directly to Microsoft Sentinel.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel (a SIEM) with the threat detection capability itself, but Sentinel ingests alerts rather than generating them for PaaS services, making Defender for Cloud the correct answer for native threat detection.

Why the other options are wrong

Microsoft Sentinel is a SIEM and SOAR solution, but the question specifically asks for a solution that provides the threat detection capability for Azure PaaS services. Microsoft Defender for Cloud (formerly Azure Security Center) is the native threat detection service for Azure PaaS, while Sentinel ingests alerts from Defender for Cloud for central analysis.

Microsoft Defender for Endpoint is designed to protect endpoints (devices) from threats, not Azure PaaS services like Azure SQL Database or Azure Key Vault. It does not natively detect SQL injection or unusual access patterns on PaaS resources.

Microsoft Defender for Identity focuses on protecting on-premises Active Directory identities from advanced threats, not Azure PaaS services like SQL Database or Key Vault.

When would these options actually be correct?

A question that asks: 'An organization needs a cloud-native SIEM to aggregate security logs from multiple sources, including on-premises and multi-cloud environments, and perform advanced threat hunting and automated response.' In that scenario, Microsoft Sentinel would be the correct answer.

This option would be correct in a question asking: 'Which Microsoft security solution detects and alerts on suspicious activities on endpoints, such as malware or anomalous behavior on workstations and servers?'

A question asking which Microsoft solution detects identity-based attacks (e.g., pass-the-hash, kerberoasting) against on-premises Active Directory and provides alerts for compromised credentials.

Why candidates pick the wrong answer

Candidates may confuse Microsoft Sentinel's SIEM capabilities with the built-in threat detection for Azure PaaS, or think that Sentinel directly monitors PaaS services without understanding that it relies on Defender for Cloud for those specific detections.

Candidates may confuse 'Defender for Cloud' with 'Defender for Endpoint' due to similar naming, or mistakenly think endpoint protection covers cloud PaaS services.

Candidates may confuse 'identity' protection with cloud workload protection, or assume Defender for Identity covers all identity-related threats including cloud services.

Full explanation →

246

MCQmedium

You are evaluating the Conditional Access policy JSON exhibit. The policy includes MFA for Exchange Online but excludes trusted locations. A user reports that they are prompted for MFA when accessing webmail from a trusted IP address. Which is the most likely cause?

A.The location condition is configured to include trusted locations

B.The policy targets high sign-in risk

C.The policy does not apply to Exchange Online

D.The policy requires device compliance

AnswerA

This statement is correct because a Conditional Access policy configured to "include" trusted locations in its `locations` condition will apply its grant controls, such as requiring multi-factor authentication (MFA), even when users are signing in from designated secure network segments. For most MFA policies, the best practice is to *exclude* trusted locations to provide a frictionless experience for users on corporate networks, making the inclusion of trusted locations an often misconfigured or overly restrictive setting.

Why this answer

The policy includes MFA for Exchange Online, but the location condition 'includeLocations' with 'AllTrusted' means it applies to trusted locations, not excludes them. To exclude trusted locations, the policy should use 'excludeLocations'. Therefore, the user is prompted for MFA when accessing from a trusted IP because the policy is incorrectly configured to include trusted locations, making option A the most likely cause.

Full explanation →

247

MCQhard

A financial services company uses Microsoft Purview and must comply with a regulation that requires communication surveillance for market abuse. They need to capture all electronic communications (email, Teams chats) of traders and scan for specific keywords and trading patterns. Which Microsoft Purview solution is specifically designed for this?

A.Communication Compliance

B.Data Lifecycle Management

C.eDiscovery (Standard)

D.Insider Risk Management

AnswerA

Microsoft Purview Communication Compliance is specifically engineered to proactively detect and remediate regulatory compliance risks, such as market abuse, insider trading, and harassment, within an organization's electronic communications. It leverages machine learning and policy-based scanning across platforms like Microsoft Teams, Exchange, and Yammer to identify potential violations. Financial services companies rely on this capability to meet stringent industry regulations by reviewing flagged messages and taking appropriate action, ensuring adherence to standards like FINRA or SEC rules.

Why this answer

Communication Compliance is the Microsoft Purview solution specifically designed to capture and analyze electronic communications (email, Teams chats) for regulatory compliance, such as detecting market abuse. It allows organizations to define policies that scan for specific keywords and trading patterns, automatically flagging messages that violate compliance rules. This directly addresses the requirement for communication surveillance in financial services under regulations like MiFID II or Dodd-Frank.

Exam trap

The trap here is confusing Communication Compliance with Insider Risk Management, as both deal with user behavior, but Communication Compliance is specifically for capturing and scanning communications for regulatory surveillance, while Insider Risk Management focuses on broader risk indicators like data theft or policy violations.

How to eliminate wrong answers

Option B (Data Lifecycle Management) is wrong because it focuses on retaining, deleting, or archiving data based on lifecycle policies, not on scanning communications for keywords or patterns. Option C (eDiscovery Standard) is wrong because it is designed for legal discovery and holds on content, not for proactive, real-time surveillance of communications for regulatory compliance. Option D (Insider Risk Management) is wrong because it detects risky user behavior (e.g., data exfiltration) using analytics and indicators, not specifically for capturing and scanning all trader communications for market abuse keywords and patterns.

Full explanation →

248

MCQhard

A multinational corporation wants to detect scenarios where employees in the finance department are accessing and downloading customer credit card data from a CRM system and then emailing that data to personal accounts. The security team needs to define policies that identify this pattern of activity, analyze user behavior over time (e.g., building a user's baseline), and automatically escalate high-risk incidents for investigation. Which Microsoft Purview solution should they deploy?

A.Microsoft Purview Communication Compliance

B.Microsoft Purview Data Loss Prevention (DLP)

C.Microsoft Purview Insider Risk Management

D.Microsoft Purview eDiscovery (Premium)

AnswerC

Microsoft Purview Insider Risk Management proactively identifies and mitigates potential data security risks originating from within an organization. It leverages machine learning to analyze user activity across various signals (e.g., file access, email, Teams, SharePoint) to establish behavioral baselines. By detecting deviations from these baselines and correlating multiple anomalous events, it uncovers patterns indicative of data theft, intellectual property leakage, or policy violations, whether malicious or inadvertent.

Why this answer

Microsoft Purview Insider Risk Management is designed to detect risky user activities that violate organizational policies, such as accessing sensitive data and exfiltrating it via email. It uses machine learning to establish user baselines over time and automatically escalates high-risk incidents for investigation, directly matching the scenario's requirements.

Exam trap

The trap here is that candidates often confuse Data Loss Prevention (DLP) with Insider Risk Management because both deal with data protection, but DLP enforces rules on data in motion or at rest without analyzing user behavior baselines or detecting insider threat patterns over time.

Why the other options are wrong

Communication Compliance focuses on detecting inappropriate communications (e.g., harassment, sensitive info sharing) but does not analyze user behavior over time or build baselines to identify anomalous patterns like finance employees emailing credit card data to personal accounts.

Data Loss Prevention (DLP) policies can block or alert on sensitive data being emailed, but they do not analyze user behavior over time or build baselines to detect anomalous patterns like an employee accessing and downloading data before emailing it. DLP lacks the user behavior analytics and risk scoring that Insider Risk Management provides.

Microsoft Purview eDiscovery (Premium) is used for legal investigations and litigation support to search, hold, and export content, not for real-time detection of risky user behavior or policy-based escalation of insider data exfiltration scenarios.

When would these options actually be correct?

A company wants to detect and prevent employees from sharing confidential information via email or Teams, such as trade secrets or offensive language, and requires policy-based alerts for review. Communication Compliance would be correct for monitoring communications for policy violations.

A company wants to prevent sensitive credit card data from being emailed to external recipients by automatically blocking the email or applying encryption. The security team needs a policy that scans emails and attachments for credit card numbers and enforces actions like blocking or warning. In this scenario, DLP is the correct solution.

A question where an organization needs to search across Exchange, SharePoint, and Teams for specific emails or documents related to a legal case, preserve them with legal holds, and export them for review would make eDiscovery (Premium) the correct answer.

Why candidates pick the wrong answer

Candidates may confuse Communication Compliance with Insider Risk Management because both deal with internal threats, but Communication Compliance is limited to communication monitoring without behavioral analytics or baselining.

Candidates may think DLP is sufficient because it can detect and block sensitive data in emails, but they overlook the requirement for user behavior analysis and baseline building, which are core features of Insider Risk Management.

Candidates may confuse eDiscovery's ability to search and analyze data with the proactive detection and policy enforcement needed for insider risk scenarios, especially when the question involves investigating suspicious activity.

Full explanation →

249

MCQmedium

A company uses Microsoft Entra ID. They want to require users to perform multifactor authentication (MFA) every 30 days on devices that are marked as compliant, but require MFA for every sign-in attempt on non-compliant devices. Which Conditional Access control should they configure to meet this requirement?

A.Grant control: Require MFA

B.Session control: Sign-in frequency

C.Conditions: Device state

D.Session control: Application restrictions

AnswerB

Sign-in frequency session control allows the administrator to specify how often a user must re-authenticate. This can be set to every 30 days for compliant devices and to 0 (every time) for non-compliant devices to achieve the goal.

Why this answer

The requirement specifies different MFA frequency based on device compliance: every 30 days for compliant devices and every sign-in for non-compliant devices. This is achieved by configuring a Session control called 'Sign-in frequency' in a Conditional Access policy, which allows administrators to set the reauthentication interval (e.g., 30 days) and can be scoped to specific conditions like device state (compliant vs. non-compliant). Grant controls like 'Require MFA' enforce MFA but do not control the frequency of re-prompting.

Exam trap

The trap here is that candidates confuse 'Grant controls' (which enforce MFA) with 'Session controls' (which manage sign-in frequency), leading them to pick 'Require MFA' instead of 'Sign-in frequency' when the question specifically asks about controlling the frequency of MFA prompts.

How to eliminate wrong answers

Option A is wrong because 'Grant control: Require MFA' enforces MFA on every sign-in but cannot differentiate between compliant and non-compliant devices or set a reauthentication frequency like 30 days. Option C is wrong because 'Conditions: Device state' is a condition that filters which devices the policy applies to (e.g., compliant or non-compliant), not a control that enforces MFA frequency. Option D is wrong because 'Session control: Application restrictions' controls access to specific apps or data (e.g., using app protection policies) and does not manage MFA reauthentication intervals.

Full explanation →

250

MCQmedium

Your organization uses Microsoft Purview to manage compliance. You need to create a policy that ensures data is retained for a specific period and then automatically deleted. Which solution should you use?

A.Microsoft Purview Audit

B.Microsoft Purview Compliance Manager

C.Microsoft Purview Information Protection

D.Microsoft Purview Data Lifecycle Management

AnswerD

Microsoft Purview Data Lifecycle Management (DLM) is the correct solution for managing the retention and deletion of data across an organization's Microsoft 365 environment. It allows administrators to create and apply retention policies and labels that automatically retain content for specified periods or delete it after a certain time or event. DLM ensures that data is kept for legal, regulatory, or business requirements and then defensibly disposed of when no longer needed, directly addressing retention and deletion needs.

Why this answer

Microsoft Purview Data Lifecycle Management (D) provides the ability to create retention and deletion policies that automatically retain data for a specified period and then delete it. This solution directly addresses the requirement to manage data retention and deletion schedules within Microsoft Purview.

Exam trap

The trap here is that candidates often confuse Information Protection (which handles classification and labeling) with Data Lifecycle Management (which handles retention and deletion), leading them to select option C instead of D.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Audit is used for logging and investigating user and admin activity, not for creating retention or deletion policies. Option B is wrong because Microsoft Purview Compliance Manager is a risk assessment and compliance score tool, not a data lifecycle policy engine. Option C is wrong because Microsoft Purview Information Protection focuses on classifying, labeling, and protecting data (e.g., sensitivity labels), not on automated retention and deletion schedules.

Full explanation →

251

MCQhard

Your organization, Contoso, uses Microsoft Entra ID for identity management. The security team has recently identified that several users have had their credentials compromised. You need to implement a solution that automatically enforces a password change for high-risk users and blocks sign-ins from risky locations. Additionally, you want to allow users to self-remediate by changing their password when they are at medium risk. You have the following requirements: - Users detected as high risk must be blocked from signing in until an administrator resets their password. - Users detected as medium risk must be prompted to change their password via self-service password reset before they can access resources. - All risk detections must be logged and reported to the security team. - The solution must use built-in Microsoft Entra capabilities without third-party tools. Which of the following actions should you take to meet the requirements?

A.Create conditional access policies that block sign-ins based on location and require MFA for all users.

B.Configure Microsoft Entra ID Protection user risk policies: set a policy to block access for high user risk and a policy to require password change for medium user risk. Enable risk reporting.

C.Administratively assign users to administrative units and require administrators to review risk manually.

D.Use Microsoft Entra ID Governance to create an access package and require approval for access.

AnswerB

Configuring Microsoft Entra ID Protection user risk policies directly fulfills all requirements by leveraging machine learning to detect anomalous user behavior and assign a risk level. A policy can be set to automatically block access for users deemed high risk, preventing potential breaches. Concurrently, another policy can enforce a password change for users with medium risk, proactively mitigating credential compromise. Enabling risk reporting ensures ongoing visibility and auditing of these security events.

Why this answer

Microsoft Entra ID Protection provides built-in user risk policies that automatically block sign-ins for high-risk users and require a password change for medium-risk users, meeting the requirements for automated enforcement and self-remediation. Additionally, ID Protection includes risk reporting capabilities that log all risk detections for the security team, all without third-party tools.

Exam trap

The trap here is that candidates often confuse conditional access policies (which control access based on conditions like location or device) with Identity Protection risk policies (which specifically enforce actions based on user or sign-in risk levels), leading them to choose Option A instead of the correct risk-based policy configuration.

How to eliminate wrong answers

Option A is wrong because conditional access policies that block sign-ins based on location and require MFA do not automatically enforce password changes based on user risk level, nor do they provide the granular risk-based remediation (block vs. password change) required for high and medium risk. Option C is wrong because manually assigning users to administrative units and requiring administrators to review risk manually does not automate enforcement or allow self-remediation; it contradicts the requirement for automatic password change and blocking. Option D is wrong because Microsoft Entra ID Governance access packages and approval workflows are designed for managing resource access and entitlement, not for enforcing risk-based password changes or blocking sign-ins based on compromised credentials.

Full explanation →

252

MCQmedium

A company uses Microsoft Entra ID (Microsoft Entra ID) to manage access to internal applications for employees and guest users. The compliance team requires that all guest users' access to a sensitive application must be reviewed every 90 days by the application owner. If the owner does not respond to the review request, the guest's access must be automatically revoked. Which Microsoft Entra ID feature should the company use?

A.Conditional Access

B.Identity Protection

C.Access Reviews

D.Privileged Identity Management (PIM)

AnswerC

Microsoft Entra ID Access Reviews are specifically designed to manage and streamline the periodic review of user access to resources like groups, applications, and roles. Administrators can configure recurring reviews, assign reviewers (e.g., resource owners, managers), and set up automated actions, such as removing access for users whose access is not approved or if the reviewer fails to respond within a specified timeframe. This capability directly addresses the need for periodic recertification and automated removal.

Why this answer

Access Reviews in Microsoft Entra ID allow administrators to create recurring reviews of guest user access to applications, groups, or roles. The scenario requires a 90-day review cycle with automatic revocation if the owner does not respond, which is a built-in configuration option within an Access Review policy. This directly meets the compliance team's requirement for periodic attestation and automated removal of access.

Exam trap

The trap here is confusing Access Reviews with Privileged Identity Management (PIM), since both involve approvals and time-bound access, but PIM focuses on privileged role activation while Access Reviews handle recurring attestation of any user's access to resources.

How to eliminate wrong answers

Option A is wrong because Conditional Access enforces access policies based on signals like location or device state, but it does not provide periodic attestation or automatic revocation based on reviewer non-response. Option B is wrong because Identity Protection detects and remediates identity-based risks such as leaked credentials or sign-ins from anonymous IP addresses, but it does not schedule recurring access reviews or revoke access due to reviewer inaction. Option D is wrong because Privileged Identity Management (PIM) manages just-in-time activation and approval workflows for privileged roles, but it is not designed for recurring attestation of guest user access to a sensitive application.

Full explanation →

253

MCQhard

A company uses Microsoft Purview to manage data lifecycle. They configure a retention label that marks content as a regulatory record and apply it to sensitive documents. A user with edit permissions attempts to modify a document that has this label applied. What will be the outcome?

A.The user can edit the document but cannot delete it.

B.The user cannot edit or delete the document.

C.The user can edit the document if they have edit permissions, and any changes are recorded in the audit log.

D.The user can edit the document only after obtaining a legal hold.

AnswerB

When a document is marked with a regulatory record label in Microsoft Purview, it becomes immutable to meet stringent compliance requirements. This means the content is locked down, preventing any user from editing or deleting it, regardless of their assigned permissions. This highest level of restriction ensures the integrity and non-repudiation of the record throughout its defined retention period.

Why this answer

When a retention label is configured as a regulatory record, it enforces the strictest retention and disposition controls. Regulatory records are immutable by design; once applied, no user—regardless of permissions—can edit or delete the content. This is because the label locks the document to prevent any modification or deletion until the retention period expires and a disposition review is completed.

Exam trap

The trap here is that candidates confuse 'regulatory record' with a standard retention label or a legal hold, assuming that edit permissions or audit logging still allow changes, when in fact regulatory records enforce complete immutability.

Why the other options are wrong

Regulatory records are immutable; once applied, users cannot edit or delete the content, regardless of permissions. Option A incorrectly suggests editing is allowed.

A regulatory record label in Microsoft Purview locks content, preventing any edits or deletions by users, even those with edit permissions. Option C incorrectly suggests edits are allowed and only logged.

A regulatory record label in Microsoft Purview imposes strict immutability: content cannot be edited or deleted by any user, regardless of permissions. Legal hold is a separate mechanism for preserving content during litigation, not a prerequisite for editing regulatory records.

When would these options actually be correct?

If the label were a standard retention label (not a regulatory record) with a retention action that only prevents deletion but allows edits, then users with edit permissions could modify the document but not delete it.

This option would be correct if the question described a standard retention label (not a regulatory record) that only blocks deletion but allows edits, with audit logging enabled for changes.

In a scenario where a document is under a legal hold (e.g., via eDiscovery hold) but not labeled as a regulatory record, a user with edit permissions might be able to edit the document only after the legal hold is removed, as the hold prevents deletion but not necessarily editing.

Why candidates pick the wrong answer

Candidates may confuse regulatory records with standard retention labels, assuming that edit permissions override retention settings, or they may think deletion is the only restricted action.

Candidates may confuse regulatory records with standard retention labels, assuming that edit permissions override retention policies and that audit logging is the primary control mechanism.

Candidates may confuse legal hold with retention labels, assuming that legal hold imposes similar restrictions on editing, or they may think that regulatory records require additional steps like legal hold before modification is allowed.

Full explanation →

254

MCQeasy

Which Microsoft security solution provides centralized investigation and response across identities, endpoints, email, and cloud apps by correlating alerts from multiple sources?

A.Microsoft Defender XDR

B.Microsoft Purview

C.Microsoft Sentinel

D.Microsoft Intune

AnswerA

Microsoft Defender XDR is the correct solution because it provides extended detection and response capabilities across multiple security domains. It unifies protection, detection, and response by automatically correlating alerts from identities (Defender for Identity), endpoints (Defender for Endpoint), email and collaboration (Defender for Office 365), and cloud apps (Defender for Cloud Apps). This integrated approach enables security teams to conduct centralized investigations into complex, multi-stage attacks within a single portal, significantly improving incident response efficiency.

Why this answer

Microsoft Defender XDR (Extended Detection and Response) is the correct answer because it is specifically designed to correlate alerts from identities, endpoints, email, and cloud apps into a single incident, providing centralized investigation and response. It uses the Microsoft 365 Defender portal to unify signals from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps, enabling automated remediation across these domains.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel (a SIEM) with Microsoft Defender XDR (an XDR), but Sentinel ingests logs from multiple sources for broad visibility while XDR natively correlates alerts from Microsoft's own security products for automated response.

How to eliminate wrong answers

Option B (Microsoft Purview) is wrong because it is a compliance and data governance solution focused on data classification, data loss prevention, and insider risk management, not on correlating security alerts for investigation and response. Option C (Microsoft Sentinel) is wrong because it is a cloud-native SIEM/SOAR that ingests logs from various sources but does not natively correlate alerts from Microsoft's security products into a unified incident as XDR does; it requires custom analytics rules. Option D (Microsoft Intune) is wrong because it is a mobile device management (MDM) and mobile application management (MAM) service for managing devices and apps, not a security alert correlation or response solution.

Full explanation →

255

MCQeasy

A healthcare organization must comply with HIPAA regulations. They need to classify and protect medical records stored in Microsoft 365. Which Microsoft Purview solution should they use?

A.Microsoft Purview Audit

B.Microsoft Purview Priva

C.Microsoft Purview Data Lifecycle Management

D.Microsoft Purview Information Protection

AnswerD

Microsoft Purview Information Protection (MIP) is the correct solution because it provides the comprehensive capabilities necessary for data classification and protection, crucial for HIPAA compliance. It enables organizations to discover, classify, and label sensitive data, such as Protected Health Information (PHI), using automated or manual methods. These sensitivity labels can then enforce protective actions like encryption, visual markings, and access restrictions, ensuring PHI is safeguarded throughout its lifecycle.

Why this answer

Microsoft Purview Information Protection (D) is the correct solution because it enables organizations to classify, label, and protect sensitive data—such as medical records—using sensitivity labels and encryption. This directly supports HIPAA compliance by ensuring that protected health information (PHI) is consistently safeguarded across Microsoft 365 services, including Exchange, SharePoint, and OneDrive.

Exam trap

The trap here is that candidates often confuse 'Audit' (logging) or 'Data Lifecycle Management' (retention) with data protection, but only Information Protection provides the classification and encryption capabilities required for HIPAA compliance.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Audit focuses on logging and investigating user and admin activities, not on classifying or protecting data content. Option B is wrong because Microsoft Purview Priva is designed for privacy management (e.g., subject rights requests and data minimization), not for data classification and protection of medical records. Option C is wrong because Microsoft Purview Data Lifecycle Management handles retention and deletion policies, not the active classification and encryption of sensitive data like medical records.

Full explanation →

256

MCQhard

You are investigating an alert in Microsoft Defender XDR. Based on the exhibit, what is the primary detection source for this alert?

A.Microsoft Sentinel

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Identity

D.Microsoft Defender for Cloud Apps

AnswerC

Microsoft Defender for Identity (MDI) is specifically designed to protect hybrid identity environments by monitoring Active Directory domain controllers and other identity infrastructure. It identifies, detects, and investigates advanced threats, compromised identities, and malicious insider actions directed at an organization's identity system. Therefore, an alert within Microsoft Defender XDR concerning identity-based attacks or suspicious authentication activities would originate directly from MDI's specialized detection capabilities.

Why this answer

The exhibit shows an alert from Microsoft Defender XDR with a detection source of 'Microsoft Defender for Identity'. Defender for Identity uses on-premises Active Directory signals and network traffic to detect identity-based threats like lateral movement, privilege escalation, and compromised credentials. The alert details indicate suspicious activity tied to an on-premises domain controller, which is the core focus of Defender for Identity.

Exam trap

The trap here is that candidates confuse Microsoft Defender XDR's unified alert interface with the underlying detection source, assuming that because the alert appears in the XDR portal, it must come from a more familiar product like Defender for Endpoint or Sentinel, rather than recognizing the identity-specific indicators (e.g., domain controller involvement, Kerberos anomalies) that point to Defender for Identity.

How to eliminate wrong answers

Option A is wrong because Microsoft Sentinel is a SIEM/SOAR platform that ingests alerts from multiple sources but is not itself a primary detection source for this specific alert; the exhibit shows the detection source as Defender for Identity, not Sentinel. Option B is wrong because Microsoft Defender for Endpoint focuses on endpoint-level threats (malware, fileless attacks, EDR) and would show a detection source like 'Microsoft Defender for Endpoint' in the alert, not the identity-based source shown. Option D is wrong because Microsoft Defender for Cloud Apps is a CASB focused on cloud application usage and shadow IT, not on-premises Active Directory identity attacks; its detection source would be 'Microsoft Defender for Cloud Apps'.

Full explanation →

257

MCQhard

A SOC analyst in Microsoft Sentinel needs to create a custom detection rule that triggers an incident when more than 10 failed logins occur from a single IP address within 5 minutes. Which rule type should they use?

A.Anomaly analytics rule

B.Near-real-time (NRT) analytics rule

C.Microsoft security analytics rule

D.Scheduled query analytics rule

AnswerD

Scheduled query analytics rules are the foundational method in Microsoft Sentinel for creating highly customizable detection logic using Kusto Query Language (KQL). They allow security analysts to define complex queries, perform aggregations, apply advanced filtering, and set precise threshold conditions over specified time ranges to identify specific threats and generate incidents based on unique organizational requirements.

Why this answer

A scheduled query analytics rule is the correct choice because it allows the SOC analyst to define a custom KQL query that counts failed logins per IP address over a 5-minute window and triggers an incident when the count exceeds 10. This rule type runs on a recurring schedule (e.g., every 5 minutes) and is designed for threshold-based detection scenarios like brute-force attacks.

Exam trap

The trap here is that candidates confuse near-real-time (NRT) rules with scheduled queries, but NRT rules cannot perform time-based aggregations over a 5-minute window and are limited to single-event detection with a 1-minute lookback.

How to eliminate wrong answers

Option A is wrong because anomaly analytics rules use machine learning to detect unusual patterns without predefined thresholds, not a hard count of 10 failed logins in 5 minutes. Option B is wrong because near-real-time (NRT) analytics rules run queries every minute with a 1-minute lookback, but they cannot aggregate over a 5-minute window; they are designed for low-latency detection of single events, not threshold-based aggregation. Option C is wrong because Microsoft security analytics rules are prebuilt templates that automatically ingest alerts from Microsoft security products (e.g., Microsoft Defender for Cloud), not custom detection rules written by an analyst.

Full explanation →

258

MCQhard

A company uses Microsoft Entra ID and a third-party SaaS application. They want to prevent users from downloading sensitive documents from the SaaS app when accessing from unmanaged personal devices, while still allowing read-only access. Which Conditional Access control should they apply to achieve this?

A.Require multifactor authentication (MFA)

B.Require compliant device (Intune compliance policy)

C.Use app control with Microsoft Defender for Cloud Apps session policy

D.Block access

AnswerC

Microsoft Defender for Cloud Apps (MDCAS) acts as a Cloud Access Security Broker (CASB), providing real-time session control over cloud applications. By implementing an MDCAS session policy with app control, traffic between the user and the third-party SaaS application is proxied, allowing for granular actions such as blocking file downloads while simultaneously permitting read-only access. This capability precisely addresses the requirement to allow users to view content but prevent data exfiltration through downloads, often based on contextual factors like device state or user group.

Why this answer

Microsoft Defender for Cloud Apps (MDCA) session policies enable granular control over user actions within a SaaS app, such as blocking downloads while allowing read-only access. This is achieved through reverse proxy architecture that intercepts and enforces policies on HTTP/HTTPS traffic in real time, regardless of device compliance or identity provider status. Conditional Access with MDCA session control is the only option that provides app-level data protection without requiring device management or blocking access entirely.

Exam trap

The trap here is that candidates often confuse identity-based controls (like MFA or device compliance) with app-level data protection controls, not realizing that only MDCA session policies can enforce granular actions like 'block download' while still allowing read-only access within the app itself.

How to eliminate wrong answers

Option A is wrong because requiring multifactor authentication (MFA) only verifies identity and does not control what users can do within a SaaS app after authentication, such as downloading documents. Option B is wrong because requiring a compliant device via Intune compliance policy would block access entirely from unmanaged personal devices, rather than allowing read-only access while preventing downloads. Option D is wrong because blocking access would prevent all access, including the desired read-only capability, which is too restrictive for the requirement.

Full explanation →

259

MCQmedium

A legal team is involved in a lawsuit and needs to ensure that all emails and documents related to the case are preserved in their original state, even if users edit or delete them. They also need the ability to search for these items and export them for legal review. Which Microsoft Purview solution should the compliance team configure to meet these requirements?

A.Microsoft Purview Compliance Manager

B.Microsoft Purview Data Lifecycle Management

C.Microsoft Purview eDiscovery (Standard)

D.Microsoft Purview Audit (Standard)

AnswerC

Microsoft Purview eDiscovery (Standard) is specifically designed to address legal and investigative requirements by enabling organizations to identify, preserve, collect, and export electronically stored information (ESI). It allows legal teams to place immutable legal holds on content across Microsoft 365 services like Exchange, SharePoint, OneDrive, and Teams, preventing modification or deletion. Furthermore, it provides robust content search capabilities and the ability to export collected items in a defensible manner for external review, directly supporting the needs of a lawsuit.

Why this answer

Microsoft Purview eDiscovery (Standard) is the correct solution because it provides the ability to place a legal hold on content (preserving emails and documents in their original state even if users edit or delete them), perform searches across Exchange Online, SharePoint Online, OneDrive for Business, and Teams, and export the results for legal review. This directly meets the requirements of preservation, search, and export for litigation.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management (retention/deletion) with eDiscovery (preservation/search/export), or mistakenly think Audit (Standard) can preserve and export content when it only records metadata about activities.

Why the other options are wrong

Compliance Manager helps assess and manage compliance posture through controls and assessments, but it does not preserve, search, or export content for legal hold or eDiscovery.

Data Lifecycle Management focuses on retaining or deleting data based on policies, not on preserving data for legal hold, search, and export. It does not provide the preservation, search, and export capabilities required for litigation.

Audit (Standard) logs user and admin activities but does not preserve content in its original state or provide search/export capabilities for legal review; it only records metadata of actions.

When would these options actually be correct?

A compliance officer needs to assess the organization's compliance against regulatory standards (e.g., GDPR, ISO 27001) and track improvement actions. Compliance Manager would be the correct solution.

A question asking for a solution to automatically retain emails for a specific period (e.g., 7 years) and then delete them, without needing legal hold or search/export capabilities, would make Data Lifecycle Management correct.

A compliance team needs to investigate a security incident by reviewing user activity logs (e.g., who accessed a file, when, and from where) and must retain those logs for 90 days. Audit (Standard) would be the correct solution.

Why candidates pick the wrong answer

Candidates may confuse 'compliance' broadly with legal preservation requirements, assuming Compliance Manager covers all compliance-related tasks including litigation holds.

Candidates may confuse data retention (Data Lifecycle Management) with legal preservation (eDiscovery), as both involve keeping data, but eDiscovery is specifically designed for legal contexts with hold, search, and export features.

Candidates may confuse auditing (tracking actions) with eDiscovery (preserving and searching content), assuming that audit logs can serve as a substitute for preserving original documents.

Full explanation →

260

Multi-Selecteasy

Which TWO Microsoft security solutions can be used to detect and respond to identity-based threats? (Choose two.)

Select 2 answers

A.Microsoft Defender for Cloud Apps

B.Microsoft Purview

C.Microsoft Defender for Identity

D.Microsoft Defender for Endpoint

E.Microsoft Entra ID Protection

AnswersC, E

Detects identity-based attacks.

Why this answer

Microsoft Defender for Identity (option C) is a cloud-based security solution that uses on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions. It specifically focuses on identity-based attacks such as pass-the-hash, Kerberos golden ticket, and brute-force attempts by analyzing network traffic and behavior.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud Apps (a CASB) with identity threat detection, but it is primarily for cloud app security, not on-premises identity attacks, while Microsoft Defender for Identity and Entra ID Protection are the two dedicated identity-focused solutions.

Full explanation →

261

MCQmedium

Your company uses Microsoft Defender for Endpoint. You need to investigate a potential malware outbreak on a specific device. Which feature should you use to get real-time visibility into running processes and network connections?

A.Threat analytics

B.Device inventory

C.Automated investigation

D.Live response

AnswerD

Live response in Microsoft Defender for Endpoint provides security analysts with immediate remote access to an endpoint using a secure shell connection. This capability allows investigators to run commands, collect forensic data such as files, registry keys, and process information in real-time, and take immediate remediation actions directly on the compromised device. It is specifically designed for interactive, on-demand data acquisition and incident response, making it the correct tool for collecting real-time data.

Why this answer

Live response gives security operators a remote shell connection to the device, enabling real-time investigation of running processes, network connections, and other forensic data. This is the correct feature for interactive, real-time visibility into a specific device during an active malware outbreak.

Exam trap

The trap here is that candidates confuse the interactive, real-time investigation capability of Live response with the automated, alert-driven workflows of Automated investigation, or they mistake Threat analytics for a tool that provides live device-level data rather than global threat intelligence.

How to eliminate wrong answers

Option A is wrong because Threat analytics provides intelligence about active threats and vulnerabilities, not real-time process or network visibility on a specific device. Option B is wrong because Device inventory lists all managed devices and their basic properties, but does not allow interactive investigation of running processes or network connections. Option C is wrong because Automated investigation runs predefined playbooks to automatically contain and remediate threats, but it does not give an operator real-time, interactive access to view processes or network connections on a device.

Full explanation →

262

MCQmedium

A company deploys a virtual machine on Azure IaaS. According to the Microsoft shared responsibility model, which of the following security responsibilities is primarily the customer's responsibility?

A.Physical security of the data centers

B.Patching the guest operating system and applications

C.Ensuring the hypervisor is secured

D.Maintaining the network infrastructure

AnswerB

For a virtual machine deployed on Azure IaaS, the customer retains full responsibility for managing the guest operating system, including all necessary security updates, patches, and configurations. This also extends to any applications installed within that OS, such as web servers or databases. Unlike PaaS or SaaS, where the provider handles these updates, IaaS requires the customer to actively maintain the software stack running inside their virtual machines to ensure security and performance.

Why this answer

In the Microsoft shared responsibility model, the customer is responsible for securing and patching the guest operating system and applications running on an Azure IaaS virtual machine. Microsoft manages the physical infrastructure, hypervisor, and network, while the customer controls the OS, applications, and data.

Exam trap

The trap here is that candidates often confuse IaaS with PaaS or SaaS, assuming Microsoft handles OS patching, but in IaaS the customer retains full control and responsibility for the guest OS and applications.

How to eliminate wrong answers

Option A is wrong because physical security of data centers is the sole responsibility of Microsoft as the cloud provider, not the customer. Option C is wrong because ensuring the hypervisor is secured is Microsoft's responsibility under the shared model, as the hypervisor is part of the virtualization layer managed by Azure. Option D is wrong because maintaining the network infrastructure, including physical switches and routers, is Microsoft's responsibility in IaaS, while the customer only manages virtual networks and configurations.

Full explanation →

263

MCQeasy

Your company is implementing Microsoft Entra ID and wants to ensure that users can sign in using their existing social media accounts. Which feature should you configure?

A.B2B collaboration

B.Conditional Access

C.External Identities

D.Identity Protection

AnswerC

Microsoft Entra External Identities is the comprehensive set of capabilities that allows organizations to manage all external users, including customers, partners, and citizens. It specifically supports enabling sign-in for consumers using social identity providers like Google, Facebook, and Microsoft accounts, as well as enterprise identity providers, allowing them to access applications and resources securely. This feature is crucial for scenarios requiring consumer-facing applications where users bring their own social identities.

Why this answer

External Identities in Microsoft Entra ID allows you to configure identity providers for social media accounts (e.g., Google, Facebook) so users can sign in with their existing credentials. This is done by enabling federation with social identity providers via the External Identities blade, which uses OAuth 2.0 and OpenID Connect protocols to authenticate users without creating a separate Microsoft account.

Exam trap

The trap here is that candidates confuse B2B collaboration (which is for business partners) with External Identities (which includes social identity providers), because both involve external users, but only External Identities supports social login providers like Google and Facebook.

How to eliminate wrong answers

Option A is wrong because B2B collaboration is specifically for inviting external business partners (e.g., from other Azure AD tenants) to access your resources, not for allowing social media account sign-ins. Option B is wrong because Conditional Access is a policy engine that enforces access controls (e.g., MFA, location) after authentication, not a feature for configuring social identity providers. Option D is wrong because Identity Protection is a risk-based detection and remediation service (e.g., leaked credentials, sign-in anomalies), not a feature for adding social identity providers.

Full explanation →

264

MCQeasy

A healthcare organization stores patient records in an encrypted database. Access to the database is restricted to authorized medical staff only. Which security principle is primarily being addressed by these measures?

A.Integrity

B.Availability

C.Non-repudiation

D.Confidentiality

AnswerD

Confidentiality is the fundamental security principle ensuring that sensitive information, such as patient records, is protected from unauthorized disclosure and access. Encryption directly supports confidentiality by rendering data unreadable to anyone without the correct decryption key, even if they gain access to the encrypted files. This mechanism, combined with robust access controls, ensures that only authorized individuals can view or process the confidential patient data.

Why this answer

Confidentiality ensures that sensitive data, such as patient records, is accessible only to authorized individuals. Encryption renders the data unreadable to unauthorized parties, and access restrictions enforce that only authorized medical staff can decrypt and view the records. This directly aligns with the principle of confidentiality, which is a core pillar of the CIA triad.

Exam trap

The trap here is that candidates may confuse confidentiality with integrity, mistakenly thinking that encryption alone also prevents data tampering, but encryption does not inherently protect against unauthorized modification unless combined with integrity checks like hashing or digital signatures.

Why the other options are wrong

The question focuses on restricting access to authorized users and encrypting data, which directly protects data from unauthorized disclosure (confidentiality), not from unauthorized modification (integrity).

The question focuses on encryption and access restrictions, which protect data from unauthorized disclosure, not on ensuring data is accessible when needed (availability).

Non-repudiation ensures that actions cannot be denied by the parties involved, typically through digital signatures or audit logs. The question focuses on restricting access and encrypting data, which directly protects confidentiality, not non-repudiation.

When would these options actually be correct?

A question describing measures to prevent unauthorized alteration of patient records, such as using checksums or audit logs to detect changes, would make integrity the correct answer.

A question describing measures like redundant servers, backup power, and disaster recovery plans to ensure systems remain operational despite failures or attacks would make availability the correct answer.

A question describing a system where digital signatures are used to prove that a specific doctor accessed or modified a patient record, and the goal is to prevent the doctor from denying that action. For example: 'A hospital implements digital signatures for all electronic prescriptions to ensure that prescribers cannot deny having issued them. Which principle is being addressed?'

Why candidates pick the wrong answer

Candidates may confuse encryption with integrity because encryption can also detect tampering in some modes, but the primary goal here is access restriction, not data alteration prevention.

Candidates may confuse 'access restricted to authorized staff' with ensuring that authorized staff can always access the data, but the primary goal here is preventing unauthorized access, not guaranteeing uptime.

Candidates may confuse non-repudiation with confidentiality because both involve security controls like encryption and access logs, but non-repudiation specifically addresses accountability and denial prevention, not data secrecy.

Full explanation →

265

MCQmedium

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email via the Outlook mobile app. Which policy type should you configure?

A.Device configuration policies

B.App protection policies

C.Device compliance policies

D.Conditional Access policies in Microsoft Entra ID

AnswerD

Conditional Access policies in Microsoft Entra ID serve as the enforcement engine that evaluates various signals, including the device compliance status reported by Intune, to make real-time access decisions for cloud applications. Conditional Access policies can be configured to explicitly require a device to be marked as "compliant" by Intune before allowing access to sensitive organizational resources, thereby linking device health directly to identity-based access control. They are the critical component for enforcing device compliance for cloud app access.

Why this answer

Conditional Access policies in Microsoft Entra ID are the correct choice because they evaluate device compliance status (reported by Intune) as a condition for granting access to cloud apps like Exchange Online. By requiring that only compliant devices can access corporate email via the Outlook mobile app, you configure a Conditional Access policy that blocks or grants access based on the device compliance state, integrating Intune's compliance assessment with Entra ID's access control.

Exam trap

The trap here is that candidates often confuse device compliance policies (which only define and report compliance) with Conditional Access policies (which enforce access decisions based on that compliance), leading them to incorrectly select Option C.

How to eliminate wrong answers

Option A is wrong because device configuration policies manage settings like Wi-Fi, VPN, or email profiles on devices, but they do not enforce access control based on compliance status. Option B is wrong because app protection policies manage how data is handled within apps (e.g., preventing copy/paste or requiring a PIN), but they do not evaluate device compliance to block access entirely. Option C is wrong because device compliance policies define the rules for what makes a device compliant (e.g., requiring encryption or a minimum OS version), but they do not themselves enforce access decisions; they only report compliance status to Intune, which must be used by a Conditional Access policy to block or allow access.

Full explanation →

266

MCQeasy

Refer to the exhibit. You are configuring an access package in Microsoft Entra Entitlement Management. Based on the policy, which users can request access to the HR App?

A.Any user in the organization can request access, but guests require manager approval.

B.Only administrators can assign access.

C.Only users in the HR department can request access.

D.Only guest users can request access.

AnswerA

This option accurately describes a common configuration in Azure AD entitlement management access packages. A policy configured for "users in your directory" typically allows all internal members to request access. Furthermore, entitlement management policies offer granular control to specify different approval requirements, such as mandating manager approval specifically for guest users, while internal users might have a different or no approval flow. This balances self-service with necessary oversight for external collaborators.

Why this answer

The access package policy shown in the exhibit is configured with 'For users in your directory' as the scope and 'Specific connected organization' is not selected, meaning any internal user can request. The policy also has 'Approval' set to 'Manager approval' only for 'Guest users', so internal users do not require approval, while guests do. This matches the description that any user in the organization can request, but guests need manager approval.

Exam trap

The trap here is that candidates may misinterpret the approval setting as applying to all users, when in fact it is configured only for guest users, leading them to incorrectly select an option that implies restricted access or exclusive guest access.

How to eliminate wrong answers

Option B is wrong because the policy allows users to request access directly; it does not restrict assignment to administrators only. Option C is wrong because the policy scope is set to 'All users' (or 'For users in your directory'), not limited to the HR department. Option D is wrong because the policy allows both internal users and guest users to request access, not exclusively guests.

Full explanation →

267

MCQhard

A global enterprise has a hybrid environment that includes on-premises Active Directory, Azure resources, Amazon Web Services (AWS), and Google Cloud Platform (GCP). The security team needs a single solution to collect security logs from all these sources, detect threats using advanced analytics and threat intelligence, and automate incident response via playbooks. They already have Microsoft Defender for Cloud protecting their Azure workloads. Which Microsoft security solution should they add to meet these requirements?

A.Microsoft Sentinel

B.Microsoft Defender for Cloud

C.Microsoft Defender for Identity

D.Microsoft Cloud App Security

AnswerA

Microsoft Sentinel is a scalable, cloud-native SIEM and SOAR that can ingest logs from on-premises, Azure, AWS, GCP, and many other sources. It provides threat detection and automated response via playbooks, making it the correct solution for the described need.

Why this answer

Microsoft Sentinel is a cloud-native SIEM and SOAR solution that ingests logs from a wide range of sources, including on-premises, Azure, AWS, and GCP. It provides advanced analytics, threat detection, and automated response through playbooks. Microsoft Defender for Cloud is a cloud security posture management (CSPM) and workload protection solution; while it does collect some logs and can send alerts to Sentinel, it does not provide the full SIEM/SOAR capabilities needed for multi-cloud aggregation and automation beyond Azure.

Microsoft Defender for Identity focuses on on-premises AD threats but not multi-cloud. Microsoft Cloud App Security is a CASB for SaaS apps, not a SIEM for infrastructure logs.

Full explanation →

268

MCQhard

A company uses a third-party SaaS CRM application. The security team needs to monitor user sessions in real-time when sales representatives access the CRM from personal, unmanaged devices. The goal is to prevent the download of sensitive customer data to local drives. The solution should block download actions and show a warning to the user. Which Microsoft security solution should the team deploy to enforce these session controls?

A.Microsoft Defender for Cloud Apps

B.Microsoft 365 Defender

C.Microsoft Sentinel

D.Microsoft Defender for Endpoint

AnswerA

Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing deep visibility and control over cloud applications. Through its Conditional Access App Control capabilities, it can proxy user sessions to third-party SaaS CRM applications in real-time. This allows for granular policy enforcement, such as blocking downloads of sensitive data to unmanaged devices, directly within the user's session, effectively preventing data loss.

Why this answer

Microsoft Defender for Cloud Apps (MDCA) provides session-level controls via its Conditional Access App Control feature. This allows real-time monitoring and control of user sessions in third-party SaaS apps like CRM, enabling actions such as blocking downloads and displaying warnings based on device compliance (e.g., unmanaged devices). The solution integrates with Azure AD Conditional Access to enforce these policies at the session layer without modifying the underlying SaaS application.

Exam trap

The trap here is that candidates often confuse the broad detection and response capabilities of Microsoft 365 Defender or Defender for Endpoint with the specific session-level enforcement provided by Defender for Cloud Apps, which is the only solution that can intercept and control user actions inside a third-party SaaS application in real time.

Why the other options are wrong

Microsoft 365 Defender is a unified pre- and post-breach enterprise defense suite that correlates signals across identities, endpoints, and data, but it does not provide real-time session monitoring and control for third-party SaaS apps like the CRM in this scenario.

Microsoft Sentinel is a SIEM/SOAR solution for security analytics and threat intelligence, not for real-time session control or conditional access policies. It does not natively block downloads or enforce session policies in third-party SaaS apps.

Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for devices, not on session-level control for SaaS applications. It cannot block download actions or show warnings within a third-party CRM session.

When would these options actually be correct?

Microsoft 365 Defender would be correct if the question asked for a solution to correlate and respond to advanced attacks across email, endpoints, identities, and cloud apps, such as detecting a multi-stage phishing campaign that compromises a user's credentials and then moves laterally to exfiltrate data.

A company needs to aggregate security logs from multiple sources (e.g., firewalls, servers, cloud apps) and create custom alerts for anomalous user behavior. Microsoft Sentinel would be the correct answer for centralized threat detection and incident response.

An exam question might ask: 'Which Microsoft solution provides endpoint detection and response, antivirus, and vulnerability management for devices?' In that context, Microsoft Defender for Endpoint would be the correct answer.

Why candidates pick the wrong answer

Candidates may confuse Microsoft 365 Defender's broad security coverage with the specific session control capabilities of Defender for Cloud Apps, or they may think that 'Defender' products all include similar app control features.

Candidates may confuse Sentinel's monitoring capabilities with the session control features of Defender for Cloud Apps, assuming any Microsoft security tool can enforce real-time policies on SaaS apps.

Candidates may confuse Defender for Endpoint with Defender for Cloud Apps because both have 'Defender' in the name and relate to security, leading them to assume endpoint protection can control SaaS app sessions.

Full explanation →

269

MCQmedium

Refer to the exhibit. An analyst runs a KQL query in Microsoft Sentinel. What is the primary purpose of this query?

A.To retrieve the most recent 10 malware alerts.

B.To find the single highest severity alert.

C.To count the total number of malware alerts in the last 24 hours.

D.To list all computers with malware alerts.

AnswerA

The query uses `take 10` to retrieve 10 malware alerts, but without an `order by` clause, the results are not guaranteed to be the most recent. The primary purpose is to return a limited set of 10 malware alerts.

Why this answer

The KQL query uses the `take` operator to return the first 10 rows of the result set after filtering for `Malware` alerts. Since the query does not include any `order by` or `sort` clause, the `take` operator returns an unspecified set of 10 records, and therefore does not guarantee the 'most recent' alerts. While the query's primary intent is to retrieve a limited number (10) of malware alerts, the 'most recent' qualifier in option A makes it an inaccurate description of the query's guaranteed outcome.

Therefore, option A is not entirely correct, and no other option accurately describes the query's purpose.

Exam trap

The trap here is that candidates often assume `take 10` returns the most recent 10 alerts, but without an explicit `order by TimeGenerated desc`, the result set is arbitrary and not guaranteed to be the most recent; the question's phrasing 'most recent' is a distractor that tests understanding of KQL ordering behavior. This trap note is accurate and correctly highlights why option A is flawed.

How to eliminate wrong answers

Option B is wrong because the query does not use any aggregation or sorting (e.g., `top`, `order by`, `max()`) to identify the single highest severity alert; it simply returns 10 arbitrary alerts. Option C is wrong because the query does not use the `count` operator or any aggregation to count total alerts; `take 10` limits the output to 10 rows, not a count of all alerts in the last 24 hours. Option D is wrong because the query does not project or group by computer names; it returns alert details, not a list of distinct computers, and the `take` operator restricts the result to 10 rows, not all computers with malware alerts.

Full explanation →

270

MCQeasy

Your organization uses Microsoft Entra ID. A user reports that they are unable to access any Microsoft 365 services because they forgot their password. Which self-service tool should they use?

A.Self-Service Password Reset (SSPR)

B.Password reset admin portal

C.Identity Protection

D.Privileged Identity Management

AnswerA

Self-Service Password Reset (SSPR) allows users to reset their forgotten password without administrator intervention, directly addressing the user's inability to access Microsoft 365 services due to password loss. SSPR operates through Microsoft Entra ID's authentication methods—such as security questions, phone verification, or email verification—to verify identity before permitting a reset, satisfying the constraint that the user cannot authenticate via their forgotten password.

Why this answer

Self-Service Password Reset (SSPR) allows users to reset their own passwords without administrator intervention. Option B, the Password reset admin portal, is intended for administrators to reset passwords for users, not for self-service. Option C, Identity Protection, is a feature that detects and responds to identity-based risks, not for password resets.

Option D, Privileged Identity Management, manages and monitors privileged roles and access, not password recovery.

Full explanation →

271

MCQeasy

An organization wants to protect against password spray attacks by automatically blocking sign-ins from suspicious IP addresses. Which Microsoft Entra feature should they use?

A.Microsoft Entra Self-Service Password Reset

B.Microsoft Entra Identity Protection

C.Microsoft Entra Privileged Identity Management

D.Microsoft Entra Multifactor Authentication

AnswerB

Microsoft Entra Identity Protection is purpose-built to detect and automatically remediate identity-based risks, including sophisticated password spray attacks. It utilizes machine learning and behavioral analytics to identify anomalous sign-in patterns, such as sign-ins from unfamiliar locations, impossible travel, or multiple failed attempts across various accounts from a suspicious IP address. Based on these risk detections, Identity Protection can enforce conditional access policies to block or challenge risky sign-ins, effectively preventing unauthorized access.

Why this answer

Microsoft Entra Identity Protection uses machine learning to detect and automatically block sign-ins from suspicious IP addresses, such as those associated with anonymous proxies or known malicious activity. It directly mitigates password spray attacks by applying risk-based conditional access policies that require additional verification or block the sign-in attempt.

Exam trap

The trap here is that candidates often confuse the detection and blocking capability (Identity Protection) with the enforcement mechanism (Conditional Access or MFA), but the question asks for the feature that 'automatically blocks sign-ins from suspicious IP addresses,' which is Identity Protection's risk-based policy integration.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Self-Service Password Reset (SSPR) allows users to reset their own passwords, but it does not detect or block sign-ins from suspicious IP addresses. Option C is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time access and role assignments for privileged accounts, not real-time sign-in risk detection. Option D is wrong because Microsoft Entra Multifactor Authentication (MFA) adds a second verification factor but does not automatically block sign-ins based on IP address reputation; it can be triggered by Identity Protection policies but is not the feature that performs the blocking itself.

Full explanation →

272

MCQmedium

Your organization uses Microsoft Entra ID and needs to block sign-ins from legacy authentication protocols to reduce risk. Which feature should you use?

A.Security defaults

B.Privileged Identity Management

C.Identity Protection

D.Conditional Access

AnswerD

Conditional Access can block legacy authentication by targeting client apps.

Why this answer

Conditional Access policies in Microsoft Entra ID allow you to block sign-ins from legacy authentication protocols by targeting client apps that use protocols like POP3, IMAP, SMTP, or older Office clients that do not support modern authentication. This is the correct feature because it provides granular, policy-based control to explicitly deny authentication requests that use legacy protocols, directly addressing the requirement to reduce risk from these less secure methods.

Exam trap

The trap here is that candidates often confuse Security defaults (which do block legacy authentication by default) with the ability to customize or target that block, but the question asks for a feature to 'block sign-ins from legacy authentication protocols' in a way that can be tailored to organizational needs, which only Conditional Access supports.

How to eliminate wrong answers

Option A is wrong because Security defaults provide a baseline set of security policies (like requiring MFA for all users and blocking legacy authentication) but are a fixed, non-customizable feature intended for small organizations; they cannot be selectively applied or fine-tuned to block legacy authentication for specific users or scenarios. Option B is wrong because Privileged Identity Management (PIM) is focused on just-in-time privileged access management, role activation, and approval workflows for administrative roles, not on controlling authentication protocols used during sign-in. Option C is wrong because Identity Protection uses risk-based policies (e.g., user risk, sign-in risk) to block or require MFA, but it does not have a direct setting to block legacy authentication protocols; it relies on Conditional Access policies to enforce such blocks.

Full explanation →

273

MCQeasy

A compliance administrator needs to generate a report showing all user activities related to accessing highly sensitive documents in SharePoint. Which Microsoft Purview solution should they use?

A.Audit (Standard or Premium)

B.eDiscovery

C.Data Loss Prevention

D.Communication Compliance

AnswerA

Microsoft Purview Audit (Standard or Premium) is the correct service for generating reports on user and administrator activities across Microsoft 365 services. It captures a comprehensive record of events, such as file access, mailbox activities, and system configuration changes, which are crucial for forensic investigations, regulatory compliance, and internal policy adherence. The unified audit log allows compliance administrators to search, filter, and export these activity records to demonstrate compliance with various regulations.

Why this answer

Audit (Standard or Premium) logs and records all user activities, including access to highly sensitive documents in SharePoint. Audit (Premium) provides deeper visibility with events like 'FileAccessed' and 'SensitivityLabelApplied', enabling compliance administrators to generate detailed reports on who accessed sensitive content and when.

Exam trap

The trap here is that candidates often confuse eDiscovery (which finds content) with Audit (which tracks activities), assuming both can generate activity reports, but only Audit captures the specific user actions needed for this scenario.

How to eliminate wrong answers

Option B (eDiscovery) is wrong because it is designed for searching and exporting content for legal or investigative purposes, not for generating activity reports on user access to documents. Option C (Data Loss Prevention) is wrong because it focuses on preventing unauthorized sharing or leakage of sensitive data through policies and alerts, not on auditing historical access activities. Option D (Communication Compliance) is wrong because it monitors communications (e.g., email, Teams) for policy violations like harassment or insider trading, not SharePoint document access events.

Full explanation →

274

MCQmedium

A company uses Microsoft Entra ID and wants to automatically detect and remediate over-privileged roles in their Azure subscriptions and AWS accounts. They need to get a unified view of permissions across multiple clouds. Which Microsoft Entra capability should they use?

A.Microsoft Entra Identity Protection

B.Microsoft Entra Permissions Management

C.Microsoft Entra Verified ID

D.Microsoft Entra ID Governance

AnswerB

Microsoft Entra Permissions Management, a Cloud Infrastructure Entitlement Management (CIEM) solution, provides comprehensive visibility and control over permissions across multi-cloud environments, including Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). It enables organizations to discover, remediate, and continuously monitor permissions, identifying and right-sizing over-privileged identities to enforce the principle of least privilege. This directly addresses the need for multi-cloud permissions visibility and automated remediation.

Why this answer

Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) solution that provides visibility into permissions across multi-cloud environments, including Azure and AWS. It automatically detects over-privileged roles and can remediate them by enforcing least-privilege access policies, making it the correct choice for the described requirement.

Exam trap

The trap here is that candidates confuse Microsoft Entra ID Governance with Permissions Management because both deal with 'permissions,' but Governance handles identity lifecycle and access reviews within Entra ID, not multi-cloud infrastructure permission analysis or automated remediation.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Identity Protection focuses on detecting identity-based risks such as compromised credentials and sign-in anomalies, not on managing cloud infrastructure permissions. Option C is wrong because Microsoft Entra Verified ID is a decentralized identity solution for verifiable credentials, unrelated to cloud permission management. Option D is wrong because Microsoft Entra ID Governance covers identity lifecycle, access reviews, and entitlement management within Microsoft Entra ID, but it does not provide multi-cloud permission visibility or automated remediation for over-privileged roles in AWS or Azure subscriptions.

Full explanation →

275

Multi-Selecthard

Which TWO scenarios are appropriate uses of Microsoft Purview Audit (Standard)?

Select 2 answers

A.Investigating a user who accessed a sensitive file in SharePoint.

B.Searching the audit log for admin activities in the past 60 days.

C.Generating custom reports with PowerShell for all activities.

D.Tracking when sensitivity labels are applied to documents.

E.Retaining audit logs for 2 years for compliance purposes.

AnswersA, B

Microsoft Purview Audit (Standard) is specifically designed to capture and log user activities across Microsoft 365 services, including SharePoint Online. This capability allows security administrators to efficiently search the unified audit log for specific events, such as a user accessing, viewing, or downloading a sensitive file, making it an appropriate and primary tool for investigating potential data breaches or unauthorized access incidents.

Why this answer

Microsoft Purview Audit (Standard) logs key events such as file access and admin activities, and retains logs for 90 days. Option A is correct because accessing a sensitive file in SharePoint generates an audit event captured by Audit (Standard). Option B is correct because searching the audit log for admin activities within the 90-day retention period is a core capability of Audit (Standard).

Exam trap

The trap here is that candidates assume all audit events are available in Audit (Standard), but Microsoft deliberately restricts high-value events like sensitivity label tracking and long-term retention to Audit (Premium), making options D and E tempting but incorrect.

Full explanation →

276

MCQmedium

A user reports that they cannot access the company's HR application, which requires Microsoft Entra ID authentication. The user can access other apps that also use Entra ID. What is the most likely cause?

A.The user's account is disabled.

B.The tenant is blocked for all sign-ins.

C.The user's password expired.

D.A conditional access policy is blocking access to that specific app.

AnswerD

Conditional Access policies provide granular control over access to specific cloud applications based on various conditions, such as user location, device state, or sign-in risk. An administrator could have configured a policy specifically targeting the HR application to block access under certain circumstances, while allowing access to other applications that are not subject to the same restrictive policy. This targeted enforcement is a core capability of Conditional Access and aligns perfectly with the observed behavior.

Why this answer

The user can access other Microsoft Entra ID-integrated apps, which rules out account-level issues like a disabled account or expired password. A conditional access policy can target specific applications, so it is the most likely cause of the block on just the HR app.

Exam trap

The trap here is that candidates often assume a user-specific issue (like disabled account or expired password) when they see a single user blocked, but the key clue is that other apps work, pointing to an app-specific conditional access policy rather than a global or user-level problem.

How to eliminate wrong answers

Option A is wrong because if the user's account were disabled, they would be unable to access any Entra ID-authenticated app, not just the HR app. Option B is wrong because a tenant-wide block would prevent all sign-ins for all users, not just this user's access to one app. Option C is wrong because an expired password would affect authentication to all apps using the same Entra ID tenant, not selectively block one app.

Full explanation →

277

MCQeasy

A company is moving its on-premises infrastructure to Azure. The CISO wants to understand the division of security responsibilities between the cloud provider and the customer. Which of the following models defines this division?

A.CIA triad (Confidentiality, Integrity, Availability)

B.Shared Responsibility Model

C.Zero Trust Model

D.Defense-in-Depth

AnswerB

This model clearly outlines which security controls are managed by Microsoft (e.g., physical security of datacenters) and which by the customer (e.g., user access and data classification).

Why this answer

The Shared Responsibility Model defines the division of security responsibilities between the cloud provider (Microsoft) and the customer. Microsoft is responsible for the security of the cloud (physical hosts, network, datacenters), while the customer is responsible for security in the cloud (data, identities, access management, and configurations). This model is foundational for understanding compliance and security ownership in Azure.

Exam trap

Microsoft often tests the distinction between security models (CIA triad, Zero Trust, Defense-in-Depth) and the Shared Responsibility Model, trapping candidates who confuse a security principle or architecture with the specific contractual division of security duties between cloud provider and customer.

How to eliminate wrong answers

Option A is wrong because the CIA triad (Confidentiality, Integrity, Availability) is a security model for designing and evaluating security controls, not a framework for dividing responsibilities between provider and customer. Option C is wrong because the Zero Trust Model is a security architecture that assumes no implicit trust and requires continuous verification of every request, not a model for assigning security duties between cloud provider and customer. Option D is wrong because Defense-in-Depth is a layered security strategy using multiple controls (physical, network, application, data) to protect resources, not a model that defines the split of responsibilities between the cloud provider and the customer.

Full explanation →

278

MCQmedium

A company wants to allow its partners to access a specific SharePoint Online site using their own corporate credentials. The company does not want to manage partner accounts. Which Microsoft Entra feature should they use?

A.Microsoft Entra External ID

B.Microsoft Entra Privileged Identity Management

C.Microsoft Entra Identity Protection

D.Microsoft Entra Conditional Access

AnswerA

Microsoft Entra External ID is the comprehensive solution for managing external identities and providing them secure access to your organization's applications and resources. It enables business-to-business (B2B) collaboration, allowing partners to use their existing corporate or social identities (e.g., Microsoft accounts, Google, federated SAML/WS-Fed providers) to sign in. This feature integrates external users directly into your Microsoft Entra tenant, facilitating seamless collaboration while maintaining administrative control over their access permissions.

Why this answer

Microsoft Entra External ID (formerly Azure AD B2B) allows organizations to grant external partners access to resources like SharePoint Online using their own corporate or social identities. This eliminates the need to create and manage separate user accounts for partners, as they authenticate through their home identity provider via federation or invitation redemption.

Exam trap

The trap here is that candidates often confuse Conditional Access (which controls access after authentication) with the identity provider federation capability of External ID, mistakenly thinking policies alone can enable external authentication without a dedicated identity solution.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra Privileged Identity Management (PIM) is used for just-in-time privileged role activation and access reviews within an organization, not for enabling external partner access with their own credentials. Option C is wrong because Microsoft Entra Identity Protection detects and remediates identity-based risks (e.g., leaked credentials, sign-ins from anonymous IPs) for internal users, not for managing external partner authentication. Option D is wrong because Microsoft Entra Conditional Access enforces policies (e.g., MFA, device compliance) on sign-in events but does not itself provide the mechanism for external identities to authenticate using their own credentials; it works in conjunction with External ID.

Full explanation →

279

Multi-Selectmedium

Which TWO of the following are components of the Microsoft Entra product family? (Choose two.)

Select 2 answers

A.Microsoft Defender for Identity

B.Microsoft Intune

C.Microsoft Purview

D.Microsoft Entra Permissions Management

E.Microsoft Entra ID

AnswersD, E

Permissions Management is a CIEM offering under Entra.

Why this answer

Options D and E are correct. Microsoft Entra ID is the core identity service, and Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) solution within the Microsoft Entra family. Option A is incorrect because Microsoft Defender for Identity is part of Microsoft Defender XDR, not part of the Microsoft Entra product family.

Option B is incorrect because Microsoft Intune is an endpoint management service. Option C is incorrect because Microsoft Purview is a data governance and compliance service.

Full explanation →

280

MCQmedium

A company uses Microsoft 365 and is concerned about phishing attacks targeting employees. They want to deploy a solution that can automatically analyze email messages for malicious links and attachments, and also provide click-time protection by rewriting URLs. Which Microsoft 365 Defender component should they use?

A.Microsoft Defender for Endpoint

B.Microsoft Defender for Office 365

C.Microsoft Defender for Cloud Apps

D.Microsoft Defender for Identity

AnswerB

Defender for Office 365 includes Safe Links, Safe Attachments, and anti-phishing policies to protect email and collaboration tools.

Why this answer

Microsoft Defender for Office 365 (MDO) is the correct component because it is specifically designed to protect against email-borne threats such as phishing. It includes Safe Links and Safe Attachments features that automatically scan email messages for malicious links and attachments, and it rewrites URLs to provide click-time protection by checking the link against a dynamic threat intelligence feed at the moment of the click.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Office 365 with Microsoft Defender for Endpoint, mistakenly thinking endpoint protection includes email security, but MDO is the only solution that provides email-specific URL rewriting and attachment sandboxing.

Why the other options are wrong

Microsoft Defender for Endpoint focuses on protecting devices (endpoints) from threats, not on analyzing email messages for phishing or providing URL rewriting. The question specifically asks for email protection features.

Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that focuses on securing cloud applications and data, not on analyzing email messages for phishing links or providing URL rewriting. The question specifically asks for email protection features, which are provided by Defender for Office 365.

Microsoft Defender for Identity focuses on detecting and investigating advanced threats and compromised identities using on-premises Active Directory signals, not on analyzing email messages for phishing or rewriting URLs.

When would these options actually be correct?

This option would be correct if the question asked: 'Which Microsoft 365 Defender component should be used to protect devices from malware and detect advanced attacks on endpoints?'

This option would be correct in a scenario where a company wants to discover and control the use of third-party cloud apps, enforce data loss prevention policies, or detect anomalous behavior across cloud services like Salesforce or Dropbox.

This option would be correct for a question about detecting identity-based attacks, such as when an organization wants to monitor for suspicious user behavior, lateral movement, or compromised credentials using on-premises Active Directory and cloud identity signals.

Why candidates pick the wrong answer

Candidates may confuse Defender for Endpoint with email security because both are part of Microsoft 365 Defender and deal with threat protection, but they target different attack surfaces.

Candidates may confuse the 'cloud' in the name with Microsoft 365 cloud email, or think that all Defender products include email protection, not realizing that Defender for Office 365 is the dedicated email security solution.

Candidates may confuse Defender for Identity with email security because both involve threat detection, and the name 'Identity' might be misassociated with user accounts targeted in phishing attacks.

Full explanation →

281

MCQhard

Your company uses Microsoft Purview Communication Compliance to detect and remediate inappropriate messages. You need to create a policy that monitors Microsoft Teams chats for potential harassment. Which type of policy should you create?

A.Data Loss Prevention (DLP) policy

B.Information Barriers policy

C.Communication Compliance policy

D.Retention policy

AnswerC

A Communication Compliance policy is specifically engineered within Microsoft Purview to detect, investigate, and remediate inappropriate messages across various Microsoft 365 communication channels, including Microsoft Teams, Exchange email, and Viva Engage. These policies leverage machine learning, keyword dictionaries, and trainable classifiers to identify content related to harassment, threats, sensitive information sharing, or regulatory violations. It provides a robust framework for organizations to proactively manage and mitigate communication risks, directly addressing the need to monitor for inappropriate messages.

Why this answer

Microsoft Purview Communication Compliance is specifically designed to detect and remediate inappropriate messages, such as harassment, in Microsoft Teams chats and other communication channels. It uses customizable policies to scan for offensive language, sensitive information, or policy violations, enabling organizations to enforce internal compliance rules.

Exam trap

The trap here is that candidates may confuse Communication Compliance with Data Loss Prevention (DLP), as both involve monitoring content, but DLP is focused on data protection (e.g., credit card numbers) while Communication Compliance targets behavioral policy violations like harassment.

How to eliminate wrong answers

Option A is wrong because a Data Loss Prevention (DLP) policy focuses on preventing the unauthorized sharing of sensitive data (e.g., credit card numbers, PII) rather than detecting harassment or inappropriate content in communications. Option B is wrong because an Information Barriers policy is used to restrict communication and collaboration between specific groups or users to prevent conflicts of interest, not to monitor for harassment. Option D is wrong because a Retention policy governs how long data is kept or deleted, not the detection or remediation of inappropriate messages.

Full explanation →

282

MCQmedium

A company uses Microsoft Sentinel to centralize security logs. They want to correlate AWS CloudTrail logs with Azure AD sign-in logs. Which Microsoft Sentinel feature should they use?

A.Workbooks

B.Playbooks

C.Analytics rules

D.Hunting

AnswerC

Microsoft Sentinel Analytics rules are the core mechanism for proactively detecting threats and generating incidents by correlating events across connected data sources. These rules leverage Kusto Query Language (KQL) to define specific patterns, behaviors, or anomalies that indicate malicious activity, executing on a scheduled basis to identify threats that might otherwise go unnoticed. They are specifically designed to perform the continuous event correlation required for automated threat detection and alerting.

Why this answer

Analytics rules in Microsoft Sentinel are designed to correlate and analyze data from multiple sources, such as AWS CloudTrail and Azure AD sign-in logs, to detect security threats. By creating a multi-source analytics rule, you can define conditions that trigger alerts when suspicious patterns emerge across these disparate log streams, enabling centralized threat detection.

Exam trap

The trap here is that candidates confuse 'correlation' with 'visualization' (Workbooks) or 'response' (Playbooks), but only Analytics Rules provide the automated, scheduled log correlation needed to detect multi-source threats.

How to eliminate wrong answers

Option A is wrong because Workbooks are visualization tools that display data but do not perform correlation or alerting; they rely on pre-existing queries and cannot actively correlate logs in real time. Option B is wrong because Playbooks automate responses to alerts (e.g., via Azure Logic Apps) but do not perform the initial correlation of log data; they execute after an alert is triggered. Option D is wrong because Hunting is an interactive, query-based process for manually investigating threats, not an automated feature for continuous correlation of logs from different sources.

Full explanation →

283

MCQhard

A company is designing a Microsoft 365 Defender incident response workflow. They want to automatically isolate a compromised device when a ransomware alert is triggered. Which Microsoft 365 component should be used to execute the automated response action?

A.Microsoft Defender for Endpoint

B.Microsoft Defender for Office 365

C.Microsoft Sentinel

D.Microsoft Purview

AnswerA

Microsoft Defender for Endpoint is the primary Endpoint Detection and Response (EDR) solution within the Microsoft 365 Defender suite, specifically designed for device-level protection. It includes robust Automated Investigation and Remediation (AIR) capabilities that leverage AI and machine learning to automatically analyze alerts, correlate events, and take immediate actions such as isolating devices, stopping processes, or quarantining files upon detection of a threat. These capabilities are fundamental for rapid incident response directly on the endpoint.

Why this answer

Microsoft Defender for Endpoint includes automated investigation and remediation (AIR) capabilities that can isolate a device from the network when a ransomware alert is triggered. This is the correct component because it provides endpoint detection and response (EDR) with built-in playbooks for automatic containment actions like device isolation.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel's SOAR capabilities (which can trigger isolation via playbooks) with the native automated response engine in Defender for Endpoint, but Sentinel is an orchestrator, not the component that directly executes the endpoint isolation action.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Office 365 protects email and collaboration tools (e.g., phishing, malware in attachments) but does not have the ability to isolate endpoints or execute device-level automated response actions. Option C is wrong because Microsoft Sentinel is a SIEM/SOAR platform that can orchestrate response actions via playbooks, but it is not the native component for directly isolating a device; it would typically trigger a Defender for Endpoint action via an API. Option D is wrong because Microsoft Purview focuses on data governance, compliance, and information protection (e.g., DLP, retention labels) and has no endpoint isolation capabilities.

Full explanation →

284

MCQhard

You are designing a compliance solution for a global company. You need to ensure that data stored in SharePoint Online is not accessible from a specific geographic region. Which Microsoft Purview feature should you use?

A.Compliance boundaries

B.Data loss prevention policy

C.Retention policy

D.Sensitivity labels

AnswerA

Compliance boundaries are used to define eDiscovery and audit scoping, not to restrict data access based on geographic region. They do not block access from a specific region.

Why this answer

This question is problematic because no Microsoft Purview feature listed directly restricts SharePoint Online data access based on geographic region. Compliance boundaries (A) are for eDiscovery scoping, not access control. Data loss prevention policies (B) prevent data loss but do not block access by region.

Retention policies (C) manage data lifecycle, not access. Sensitivity labels (D) classify and protect data but cannot enforce geographic restrictions on their own. For this requirement, you would use a non-Purview feature such as Conditional Access in Microsoft Entra ID or Multi-Geo capabilities.

Exam trap

The trap is that candidates often mistakenly believe Compliance boundaries can control data access by location, when in fact they are limited to eDiscovery and audit scoping. For geographic access restrictions, you would need Conditional Access (Entra ID) or Multi-Geo, which are not Purview features.

How to eliminate wrong answers

Option B is wrong because Data Loss Prevention (DLP) policies are designed to detect and prevent the accidental sharing of sensitive information (e.g., credit card numbers, PII) based on content inspection, not to restrict access based on geographic location. Option C is wrong because retention policies are used to preserve or delete data after a specified period for compliance or legal hold purposes, not to control access from specific regions. Option D is wrong because sensitivity labels classify and protect data with encryption or visual markings, but they do not provide geographic access restrictions; they control who can access data based on label permissions, not where the access originates.

Full explanation →

285

MCQmedium

Refer to the exhibit. An administrator runs the PowerShell command against Microsoft Defender for Endpoint. The output shows an alert with Severity 'High' and Status 'New'. What should the administrator do next to investigate the alert?

A.Change the severity to Medium to reduce false positives

B.Resolve the alert as a false positive

C.Create a Microsoft Sentinel analytics rule from the alert

D.Investigate the alert details in the Microsoft Defender XDR portal

AnswerD

The portal provides detailed information and actions.

Why this answer

The alert has a severity of 'High' and status 'New', indicating a potentially critical threat that requires immediate investigation. The correct next step is to use the Microsoft Defender XDR portal to examine the alert details, including the affected devices, user accounts, and related events, to determine the scope and impact of the threat. Changing severity or resolving the alert without investigation would risk missing a real security incident.

Exam trap

The SC-900 exam often tests the misconception that you should immediately change severity or resolve alerts based on a single data point, rather than following the proper incident response workflow of investigating in the unified security portal.

How to eliminate wrong answers

Option A is wrong because changing the severity from 'High' to 'Medium' is not a valid investigative step; severity is set by the detection logic based on threat impact, and manually reducing it could hide critical alerts and increase risk. Option B is wrong because resolving the alert as a false positive without investigation is premature and dangerous; the alert's 'High' severity and 'New' status require analysis to confirm whether it is a genuine threat or a false positive. Option C is wrong because creating a Microsoft Sentinel analytics rule from a single alert is not the immediate next step; analytics rules are used for custom detection logic over time, not for investigating an existing alert.

Full explanation →

286

MCQeasy

A user reports that they are unable to sign in to a SaaS application that is configured for single sign-on (SSO) with Microsoft Entra ID. The user can sign in to other applications. What should you check first?

A.Confirm the user's account is not disabled.

B.Verify that the user has reset their password recently.

C.Ensure the user has an appropriate Microsoft 365 license.

D.Check if the user is assigned to the application in Microsoft Entra ID.

AnswerD

For most enterprise applications configured with Microsoft Entra ID for single sign-on, explicit user or group assignment is a mandatory authorization step. If a user is not assigned to the application, Microsoft Entra ID will deny access even if their authentication credentials are valid, preventing them from reaching the SaaS application.

Why this answer

The most common cause of SSO failure for a single application, when the user can sign in to other apps, is that the user has not been assigned to that specific application in Microsoft Entra ID. Without explicit assignment, the user cannot authenticate via SSO even if their account is active and licensed. This is a core requirement for application-level access control in Entra ID.

Exam trap

The trap here is that candidates confuse global authentication issues (like disabled accounts or password problems) with application-specific authorization, which is governed by user assignment in Entra ID, not by the user's overall account state or licensing.

How to eliminate wrong answers

Option A is wrong because if the user's account were disabled, they would be unable to sign in to any application, not just the one in question. Option B is wrong because a recent password reset does not affect SSO sign-in; SSO relies on the user's primary authentication token, and a password change would apply globally, not selectively block one app. Option C is wrong because Microsoft 365 licensing is unrelated to SSO access for a third-party SaaS application; licensing controls access to Microsoft 365 services, not Entra ID application assignments.

Full explanation →

287

Multi-Selecthard

Which THREE of the following are capabilities of Microsoft Sentinel? (Select THREE.)

Select 3 answers

A.Security information and event management (SIEM)

B.User and entity behavior analytics (UEBA)

C.Mobile device management

D.Security orchestration, automation, and response (SOAR)

E.Data loss prevention

AnswersA, B, D

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) solution. It provides centralized security data collection from various sources, including users, applications, servers, and network devices, across an organization's entire digital estate. Sentinel then uses advanced analytics and threat intelligence to detect, investigate, and respond to threats by correlating these events in real-time. This capability is fundamental to its role in modern security operations.

Why this answer

Correct: A (SIEM), B (UEBA), D (SOAR). C is not a Sentinel capability; it is a feature of Microsoft Intune. E is a feature of Microsoft Purview.

Full explanation →

288

MCQmedium

Your organization uses Microsoft Sentinel as a SIEM. You need to create a rule that triggers an incident when a user account is created in an Azure subscription and then logs in from an unfamiliar location within 24 hours. Which type of rule should you configure?

A.Anomaly detection rule

B.Scheduled query rule

C.Fusion rule

D.Near-real-time (NRT) rule

AnswerB

Scheduled query rules are the appropriate choice for correlating events over a specific time window, such as 24 hours. These rules allow security analysts to write custom Kusto Query Language (KQL) queries that can join multiple data sources, apply complex logic, and identify specific patterns or sequences of events. They can be configured to run at defined intervals (e.g., daily) and look back over a specified period, making them ideal for long-duration correlation and custom threat detection scenarios.

Why this answer

A scheduled query rule is the correct choice because it allows you to define a KQL query that detects user account creation events (e.g., from AzureActivity) and then correlates those with sign-in logs (e.g., from SigninLogs) from unfamiliar locations within a 24-hour window. This rule type supports complex multi-table joins and time-based correlation, which is exactly what the scenario requires.

Exam trap

The trap here is that candidates often confuse scheduled query rules with near-real-time (NRT) rules, mistakenly thinking NRT rules can handle long correlation windows, but NRT rules are limited to a 10-minute lookback and cannot span 24 hours.

How to eliminate wrong answers

Option A is wrong because anomaly detection rules use machine learning to identify unusual patterns over time, not specific event-to-event correlation with a fixed time window. Option C is wrong because Fusion rules automatically correlate multiple alerts from different products to detect multi-stage attacks, but they do not allow you to define custom logic for a specific sequence of events like account creation followed by unfamiliar login. Option D is wrong because near-real-time (NRT) rules run queries every minute on data from the last 10 minutes, which cannot span a 24-hour correlation window.

Full explanation →

289

MCQeasy

Your organization wants to classify documents based on whether they contain confidential business information like trade secrets. You need to use a classifier that learns from example documents. What should you use?

A.Trainable classifier

B.Exact data match

C.Data loss prevention policy

D.Sensitive information type

AnswerA

Trainable classifiers are machine learning-based solutions in Microsoft Purview that enable organizations to identify and classify custom content types by learning from example documents. Administrators provide positive and negative examples, allowing the classifier to recognize specific categories of information, such as legal contracts or project specifications, that cannot be easily defined by simple patterns. This adaptive approach is ideal for nuanced document classification where the content's meaning, rather than just specific keywords or patterns, determines its category.

Why this answer

A trainable classifier is the correct choice because it uses machine learning to analyze example documents and learn patterns that distinguish content containing confidential business information, such as trade secrets. Unlike predefined sensitive information types, trainable classifiers can be customized to identify unique or proprietary content by training on your specific sample documents. This aligns with the requirement to 'learn from example documents' rather than relying on fixed patterns or exact matches.

Exam trap

The trap here is that candidates confuse 'trainable classifier' with 'sensitive information type' because both can be used in DLP policies, but only trainable classifiers learn from example documents via machine learning, whereas SITs rely on static patterns or exact data matching.

How to eliminate wrong answers

Option B is wrong because Exact Data Match (EDM) uses a database of exact strings (e.g., employee IDs) to match against, not learning from example documents; it cannot generalize to identify trade secrets. Option C is wrong because a Data Loss Prevention (DLP) policy is a rule-based enforcement mechanism that applies classifiers or conditions to prevent data exfiltration, but it is not itself a classifier that learns from examples. Option D is wrong because a Sensitive Information Type (SIT) is a predefined pattern (e.g., credit card numbers via regex) or a custom pattern you define manually, not a machine learning model that learns from example documents.

Full explanation →

290

MCQmedium

Refer to the exhibit. You are reviewing a risk detection in Microsoft Entra Identity Protection. The risk event indicates 'unfamiliarFeatures' with medium risk level for user John Doe from IP 203.0.113.5. What is the most likely cause of this risk detection?

A.There was an impossible travel event detected.

B.John Doe's credentials were leaked on the dark web.

C.The sign-in originated from an anonymous IP address.

D.The sign-in was from an unfamiliar location or device.

AnswerD

UnfamiliarFeatures detects sign-ins from unfamiliar locations or devices.

Why this answer

The 'unfamiliarFeatures' risk detection in Microsoft Entra Identity Protection specifically identifies sign-ins that exhibit properties unfamiliar to the user's typical behavior, such as a new device, browser, or geographic location. The detection is based on machine learning models that compare the current sign-in against the user's historical sign-in patterns, and a medium risk level indicates a moderate likelihood that the sign-in is not legitimate. This matches option D, as the risk event is triggered by a sign-in from an unfamiliar location or device, not by impossible travel, leaked credentials, or anonymous IP.

Exam trap

The trap here is that candidates confuse 'unfamiliarFeatures' with 'impossible travel' or 'anonymous IP address', but Microsoft Entra Identity Protection categorizes each risk detection type separately, and the question's specific risk event name directly points to unfamiliar sign-in properties, not to other detection types.

How to eliminate wrong answers

Option A is wrong because 'impossible travel' is a separate risk detection type that requires two sign-ins from geographically distant locations within a time window that makes physical travel impossible, which is not indicated by the 'unfamiliarFeatures' detection. Option B is wrong because 'leaked credentials' is a distinct risk detection that checks for credentials exposed in known data breaches or on the dark web, not for unfamiliar sign-in properties. Option C is wrong because 'anonymous IP address' is a different risk detection that flags sign-ins from known anonymous proxies or VPNs, which is not the same as an unfamiliar location or device; the IP 203.0.113.5 is a documentation example and not necessarily anonymous.

Full explanation →

291

MCQmedium

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their existing social media accounts, such as Google or Facebook, while maintaining security and compliance with conditional access policies. What should you configure?

A.Enable Microsoft Entra Permissions Management.

B.Deploy Microsoft Entra Verified ID.

C.Configure Microsoft Entra B2B collaboration for guest users.

D.Configure Microsoft Entra External ID with social identity providers.

AnswerD

Microsoft Entra External ID, formerly Azure AD B2C, is specifically designed to manage customer-facing applications and enable users to sign in using various identity providers, including social accounts like Google, Facebook, and Microsoft accounts. It provides robust capabilities for user flows, custom branding, and integration with applications, allowing organizations to configure social identity providers directly to facilitate seamless consumer access and apply conditional access policies.

Why this answer

Microsoft Entra External ID (formerly Azure AD External Identities) allows you to configure social identity providers such as Google and Facebook as external identity sources. This enables users to sign in with their existing social media accounts while still being subject to your tenant's conditional access policies, ensuring security and compliance.

Exam trap

The trap here is confusing Microsoft Entra B2B collaboration (for business guest users) with Microsoft Entra External ID (which includes social identity providers for consumer-facing apps), leading candidates to incorrectly select option C.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) tool for managing permissions across multi-cloud environments, not for configuring social identity providers. Option B is wrong because Microsoft Entra Verified ID is a decentralized identity solution based on verifiable credentials (W3C standards), not for integrating social media logins. Option C is wrong because Microsoft Entra B2B collaboration is designed for inviting external business partners as guest users using their work or school accounts, not for allowing end users to sign in with personal social media accounts.

Full explanation →

292

MCQmedium

Refer to the exhibit. An administrator runs this PowerShell command. What is the purpose of this command?

A.To set a retention policy for the HR site.

B.To apply a retention label to all files in the HR site.

C.To delete all files in the HR site that were accessed in the last 90 days.

D.To retrieve audit records of file access and modifications in the HR SharePoint site from the last 90 days.

AnswerD

The `Search-UnifiedAuditLog` cmdlet, combined with the `-Operations FileAccessed, FileModified` parameters, precisely targets the auditing of these specific file activities. The `-SiteIds` parameter scopes the search to the designated HR SharePoint site, and the `-StartDate` and `-EndDate` parameters accurately define the 90-day look-back period. This command effectively retrieves a comprehensive list of audit records detailing when files were accessed or modified within that specific site and timeframe.

Why this answer

The PowerShell cmdlet `Search-UnifiedAuditLog` is used to retrieve audit records from the Microsoft 365 unified audit log. The `-StartDate` and `-EndDate` parameters define the time range (last 90 days), and the `-RecordType` parameter filters for SharePoint audit events. The `-Operations` parameter with `FileAccessed` and `FileModified` specifies that only file access and modification events should be returned, making this command's purpose to retrieve audit records of file access and modifications in the HR SharePoint site from the last 90 days.

Exam trap

The trap here is that candidates may confuse the `Search-UnifiedAuditLog` cmdlet with cmdlets that manage retention or deletion, because the question mentions 'files' and '90 days' which can mislead test-takers into thinking it applies a policy or deletes data, when in fact it only retrieves audit records.

How to eliminate wrong answers

Option A is wrong because `Search-UnifiedAuditLog` retrieves audit records, not sets retention policies; retention policies are configured using `New-RetentionCompliancePolicy` or the Compliance Center. Option B is wrong because applying a retention label requires cmdlets like `Set-ComplianceTag` or `Publish-ComplianceTag`, and this command does not label files—it only searches audit logs. Option C is wrong because deleting files would require cmdlets like `Remove-PnPFile` or SharePoint Online management commands, and this command only retrieves audit log entries; it does not perform any deletion actions.

Full explanation →

293

MCQeasy

A company uses Microsoft Intune to manage devices. They want to ensure that only devices with a specific minimum operating system version can access corporate email. What should they configure?

A.Deploy an app protection policy for the email app

B.Create a device compliance policy specifying minimum OS version

C.Create a device configuration profile for OS settings

D.Configure a conditional access policy in Entra ID to block non-compliant devices

AnswerB

Device compliance policies in Microsoft Intune are specifically designed to define the security posture and configuration requirements that a device must meet to be considered "compliant." By specifying a minimum OS version, this policy directly establishes the foundational device-level standard required. This makes it the essential first step for enforcing operating system requirements before access to corporate resources can be granted.

Why this answer

To enforce a minimum operating system version for accessing corporate email, you need a device compliance policy in Microsoft Intune. This policy evaluates device attributes like OS version and marks devices as compliant or non-compliant. When combined with a Conditional Access policy in Entra ID, non-compliant devices can be blocked from accessing corporate resources, including email.

Exam trap

The trap here is that candidates often confuse device compliance policies (which evaluate device health) with device configuration profiles (which apply settings) or app protection policies (which protect data within apps), leading them to choose an option that does not enforce the OS version requirement.

How to eliminate wrong answers

Option A is wrong because app protection policies (MAM) manage data protection within an app (e.g., preventing copy/paste) and do not enforce OS version requirements on the device itself. Option C is wrong because device configuration profiles manage settings and features (e.g., Wi-Fi, VPN) but do not evaluate or enforce compliance conditions like OS version. Option D is wrong because a Conditional Access policy alone cannot block devices based on OS version; it requires a device compliance policy to first evaluate the OS version and mark the device as compliant or non-compliant.

Full explanation →

294

MCQeasy

Your organization wants to audit all activities related to accessing sensitive files in Microsoft SharePoint. Which Microsoft Purview solution should you use?

A.Audit (Premium)

B.Data lifecycle management

C.Information barriers

D.Data loss prevention

AnswerA

Microsoft Purview Audit (Premium) provides advanced auditing capabilities, including extended retention of audit logs (up to 10 years), intelligent insights, and access to high-value audit events crucial for forensic investigations. It captures a comprehensive record of user and admin activities across Microsoft 365 services, enabling organizations to track who accessed what, when, and from where, which is essential for security and compliance audits.

Why this answer

Audit (Premium) in Microsoft Purview provides detailed logging of user and admin activities, including granular events like file access, modification, and permission changes in SharePoint. This solution enables organizations to investigate and audit all activities related to sensitive files by capturing and retaining audit records with high-volume event support and custom alerting.

Exam trap

The trap here is that candidates often confuse Data Loss Prevention (DLP) with auditing, because DLP also monitors sensitive files, but DLP focuses on preventing data exfiltration rather than providing a retrospective audit trail of all access activities.

How to eliminate wrong answers

Option B (Data lifecycle management) is wrong because it focuses on retaining, deleting, or archiving data based on policies, not on auditing access activities. Option C (Information barriers) is wrong because it restricts communication and collaboration between specific user groups to prevent conflicts of interest, not to audit file access. Option D (Data loss prevention) is wrong because it detects and prevents unauthorized sharing or leakage of sensitive data, but it does not provide a comprehensive audit trail of all access activities.

Full explanation →

295

Drag & Dropmedium

Arrange the steps to conduct a data classification scan using Microsoft Purview Information Protection.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Data classification involves creating labels, publishing them, setting auto-labeling rules, running scans, and reviewing results.

Full explanation →

296

MCQmedium

A healthcare organization uses Microsoft 365. They need to prevent employees from sharing emails or documents that contain patient medical record numbers (MRNs) with external recipients. If an attempt is made, the message should be blocked and the sender should receive a policy tip notification. Which Microsoft Purview solution should they configure?

A.Data Lifecycle Management

B.Records Management

C.Data Loss Prevention (DLP)

D.Information Protection

AnswerC

Data Loss Prevention (DLP) is the correct solution because it is specifically designed to identify, monitor, and protect sensitive information across Microsoft 365 services, including email, SharePoint, and OneDrive. DLP policies leverage sensitive information types (SITs) to detect patterns like Medical Record Numbers (MRNs) within content. Upon detection, these policies can be configured to automatically block sharing with external recipients, provide policy tips to users, and generate alerts for administrators, thereby preventing unauthorized data exfiltration.

Why this answer

Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block the sharing of sensitive information, such as patient medical record numbers (MRNs), with external recipients. DLP policies can be configured to scan emails and documents for patterns (e.g., regex for MRNs), block the transmission, and display a policy tip notification to the sender, meeting all requirements.

Exam trap

The trap here is that candidates often confuse Information Protection (sensitivity labels) with DLP, but labels alone do not block sharing or provide policy tips—they require DLP policies for enforcement.

How to eliminate wrong answers

Option A is wrong because Data Lifecycle Management focuses on retaining and deleting data based on age or compliance requirements, not on preventing real-time sharing of sensitive data. Option B is wrong because Records Management is used to declare records, apply retention labels, and manage disposition, not to block external sharing or provide policy tips. Option D is wrong because Information Protection (e.g., sensitivity labels) applies classification and encryption but does not inherently block external sharing or trigger policy tip notifications; it requires integration with DLP for enforcement.

Full explanation →

297

MCQmedium

Your organization is adopting Microsoft 365 Copilot for enterprise users. Which Microsoft Purview capability should you configure to prevent sensitive data from being inadvertently shared during Copilot interactions?

A.Customer Lockbox

B.Data Loss Prevention (DLP) policies

C.Sensitivity labels

D.eDiscovery

AnswerB

Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various Microsoft 365 services, including applications integrated with Microsoft 365 Copilot. DLP policies can detect sensitive information types (e.g., credit card numbers, PII) and enforce actions such as blocking sharing, notifying users, or encrypting content, thereby preventing accidental or intentional data exfiltration when Copilot generates or processes content.

Why this answer

Data Loss Prevention (DLP) policies are the correct Microsoft Purview capability to prevent sensitive data from being inadvertently shared during Copilot interactions. DLP policies can inspect content in real time, including Copilot prompts and responses, and apply actions such as blocking or warning when sensitive information types (e.g., credit card numbers, social security numbers) are detected. This directly addresses the requirement to prevent inadvertent sharing of sensitive data within the Copilot environment.

Exam trap

The trap here is that candidates often confuse Sensitivity labels (which apply persistent protection like encryption) with DLP policies (which enforce real-time actions like blocking), leading them to choose labels instead of the correct DLP answer for preventing inadvertent sharing during live interactions.

How to eliminate wrong answers

Option A is wrong because Customer Lockbox provides a control mechanism for Microsoft support engineers to access your data during support requests, not for preventing data sharing during user interactions like Copilot. Option C is wrong because Sensitivity labels classify and protect data at rest and in transit (e.g., encryption, visual markings), but they do not actively monitor or block data sharing in real-time during Copilot interactions; DLP policies are needed for that enforcement. Option D is wrong because eDiscovery is used for searching and exporting content for legal or investigative purposes, not for preventing data loss or inadvertent sharing in live Copilot sessions.

Full explanation →

298

MCQeasy

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. Which Microsoft Entra ID feature should you use?

A.Conditional Access

B.Privileged Identity Management

C.Self-Service Password Reset

D.Identity Protection

AnswerA

Microsoft Intune assesses device compliance against organizational policies, such as requiring encryption or specific OS versions. Azure AD Conditional Access then leverages this compliance status as a condition within its policies. This allows organizations to enforce that only devices marked as 'compliant' by Intune are granted access to sensitive cloud applications and data, creating a robust security gate.

Why this answer

Conditional Access in Microsoft Entra ID is the correct feature because it allows you to enforce policies that require devices to be marked as compliant by Microsoft Intune before granting access to corporate email. By integrating with Intune, Conditional Access evaluates device compliance status in real time and blocks or allows access accordingly, ensuring only managed and compliant devices can reach email resources.

Exam trap

The trap here is that candidates often confuse Identity Protection (which handles user risk) with device compliance enforcement, but Conditional Access is the only feature that can combine device compliance signals with access control decisions.

How to eliminate wrong answers

Option B (Privileged Identity Management) is wrong because it manages just-in-time access and role activation for privileged roles, not device compliance checks. Option C (Self-Service Password Reset) is wrong because it handles password reset workflows and does not evaluate device health or compliance. Option D (Identity Protection) is wrong because it detects and remediates identity-based risks like leaked credentials or sign-ins from anonymous IPs, but it does not enforce device compliance policies.

Full explanation →

299

MCQmedium

A company uses Exchange Online. The security team wants to protect users from malicious email attachments. They need a solution that detonates attachments in a sandbox environment to check for malware behavior before the email is delivered to the recipient. Which Microsoft Defender for Office 365 feature should they enable?

A.Safe Attachments

B.Safe Links

C.Anti-phishing

D.Anti-spam

AnswerA

Safe Attachments is a crucial component of Microsoft Defender for Office 365 that provides advanced protection against unknown malware and zero-day threats in email attachments. It uses a virtual environment, or sandbox, to "detonate" (open and analyze) attachments in real-time before they reach the user's inbox. This process identifies malicious behavior and prevents the delivery of harmful files, even if their signatures are not yet known to traditional antivirus solutions.

Why this answer

Safe Attachments is the correct feature because it specifically detonates email attachments in a virtual sandbox environment before delivery, analyzing behavior for malicious activity. This matches the requirement to check attachments for malware behavior prior to inbox arrival, a capability unique to Safe Attachments within Defender for Office 365.

Exam trap

The trap here is that candidates confuse Safe Attachments (sandbox detonation of attachments) with Safe Links (URL scanning at click-time), as both are part of Defender for Office 365 but address different threat vectors.

Why the other options are wrong

Safe Links protects users from malicious URLs in emails and Office documents, not from email attachments. The question specifically asks about detonating attachments in a sandbox, which is the function of Safe Attachments.

Anti-phishing policies protect against deceptive messages that trick users into revealing credentials or clicking malicious links, but they do not detonate attachments in a sandbox to analyze malware behavior.

Anti-spam filters are designed to block unwanted bulk email (spam), not to detonate attachments in a sandbox to analyze malware behavior. The question specifically requires a feature that detonates attachments, which is Safe Attachments.

When would these options actually be correct?

Safe Links would be correct if the question asked about protecting users from clicking malicious links in emails or Office documents, such as in a scenario where attackers use phishing URLs to deliver malware or steal credentials.

A company wants to protect users from phishing attacks that use impersonation of executives or domains. Which Microsoft Defender for Office 365 feature should they enable?

Anti-spam would be correct if the question asked: 'Which Microsoft Defender for Office 365 feature should be enabled to filter out unsolicited bulk email and reduce inbox clutter?'

Why candidates pick the wrong answer

Candidates may confuse Safe Links with Safe Attachments because both are part of Microsoft Defender for Office 365 and deal with malware protection, but they target different threat vectors (links vs. attachments).

Candidates may confuse anti-phishing with attachment protection because both address email threats, or they may think phishing includes malware delivery via attachments.

Candidates may confuse anti-spam with anti-malware protection, assuming that spam filters also handle malicious attachments, but they are separate functions.

Full explanation →

300

MCQhard

A security team needs to investigate a potential data breach that may involve unauthorized access to sensitive files in SharePoint Online and OneDrive for Business. They want to search the unified audit log for file access events, including accesses from mobile devices and third-party applications. Additionally, they need to create custom alert policies that trigger when specific high-privilege users download large volumes of files in a short period. Which Microsoft Purview solution should they use?

A.Microsoft Purview Audit (Premium)

B.Microsoft Purview eDiscovery (Premium)

C.Microsoft Purview Data Lifecycle Management

D.Microsoft Purview Communication Compliance

AnswerA

Microsoft Purview Audit (Premium) is the correct choice because it provides advanced capabilities essential for investigating a data breach. It offers extended retention of audit logs, granular logging of user and admin activities across Microsoft 365 services like SharePoint, OneDrive, and Exchange, and the ability to create custom alert policies. These features enable security teams to conduct thorough forensic analysis, track suspicious activities, and identify the scope and impact of a potential breach.

Why this answer

Microsoft Purview Audit (Premium) is the correct solution because it provides the deep, granular logging required to investigate data breaches, including file access events from mobile devices and third-party applications in SharePoint Online and OneDrive for Business. It also supports the creation of custom alert policies that can trigger on specific activities, such as high-privilege users downloading large volumes of files in a short period, by leveraging the unified audit log's rich schema and advanced detection capabilities.

Exam trap

The trap here is that candidates often confuse eDiscovery (Premium) with audit capabilities, but eDiscovery is for searching and preserving content for legal cases, not for real-time monitoring or alerting on access patterns.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview eDiscovery (Premium) is designed for legal discovery and holds, not for real-time monitoring or custom alert policies on file access patterns. Option C is wrong because Microsoft Purview Data Lifecycle Management focuses on retention, deletion, and classification of data, not on auditing or alerting for unauthorized access events. Option D is wrong because Microsoft Purview Communication Compliance is used to detect policy violations in communications (e.g., emails, Teams messages), not to audit file access or create alerts for download anomalies.

Full explanation →

Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 226–300