Microsoft Security, Compliance, and Identity Fundamentals SC-900 SC-900 Questions 301–375 | Page 5/17

301

MCQeasy

A company wants to enable employees to securely access on-premises applications without needing a VPN. Which Microsoft Entra feature should they implement?

A.Identity Protection

B.B2B Collaboration

C.Application Proxy

D.Privileged Identity Management

AnswerC

Azure AD Application Proxy provides secure remote access to on-premises web applications for internal users without requiring a VPN or opening inbound firewall ports. It acts as a reverse proxy, publishing internal applications through Azure AD, allowing employees to authenticate with their Azure AD credentials. This solution enables seamless and secure access to corporate resources from any location, making it the ideal choice for the scenario described.

Why this answer

Microsoft Entra Application Proxy provides secure remote access to on-premises web applications by acting as a reverse proxy. It eliminates the need for a VPN by routing user traffic through the Entra ID service, which authenticates the user and then establishes a secure outbound connection to the on-premises application connector. This allows employees to access internal apps from anywhere using the same credentials and conditional access policies.

Exam trap

The trap here is that candidates often confuse Application Proxy with a VPN or assume that B2B Collaboration is needed for remote access, but the key differentiator is that Application Proxy is specifically designed for secure, VPN-less access to on-premises web apps through a reverse proxy architecture.

How to eliminate wrong answers

Option A is wrong because Identity Protection is a risk-based detection and remediation tool that identifies compromised identities and suspicious sign-ins, not a remote access solution for on-premises applications. Option B is wrong because B2B Collaboration enables external users (partners, vendors) to access your organization's resources using their own identities, but it does not provide a reverse proxy or secure channel to on-premises apps. Option D is wrong because Privileged Identity Management (PIM) manages just-in-time and time-bound access to privileged roles in Azure AD and Azure resources, not general remote access to on-premises applications.

Full explanation →

302

MCQmedium

Refer to the exhibit. A compliance administrator runs the PowerShell commands to create a DLP policy. Users complain that they are blocked from sending emails containing credit card numbers but cannot override the block. The administrator wants to allow override with a business justification. What should they do?

A.Change the SentInfo parameter to a different sensitive info type.

B.Remove the SharePoint location from the policy.

C.Enable the DLP policy by setting the Policy's Enabled parameter to $true.

D.Change the NotifyAllowOverride parameter to $true in the rule.

AnswerD

Setting NotifyAllowOverride to $true allows users to override the block with justification.

Why this answer

The `NotifyAllowOverride` parameter controls whether users can override a DLP rule action with a business justification. Setting it to `$true` enables the override prompt, allowing users to bypass the block when they provide a valid reason. The current policy blocks emails with credit card numbers without offering this option, so changing this parameter directly addresses the requirement.

Exam trap

The trap here is that candidates often confuse enabling a policy (Option C) with enabling override behavior, not realizing that a policy can be active and blocking but still lack the override mechanism unless `NotifyAllowOverride` is explicitly set to `$true`.

How to eliminate wrong answers

Option A is wrong because changing `SentInfo` to a different sensitive info type would alter which data the policy detects, not enable override functionality; the issue is about blocking behavior, not detection scope. Option B is wrong because removing the SharePoint location from the policy does not affect email blocking or override capabilities; it only removes coverage for SharePoint content. Option C is wrong because enabling the policy (setting `Enabled` to `$true`) would activate it if it were disabled, but the users are already being blocked, indicating the policy is already enabled; the problem is the lack of an override mechanism, not policy activation.

Full explanation →

303

MCQhard

Your organization is using Microsoft Entra ID with P2 licenses. You need to ensure that all guest users are reviewed for access quarterly, and if not approved, access is automatically removed. Which Microsoft Entra feature should you configure?

A.Microsoft Entra Privileged Identity Management

B.Microsoft Entra Identity Protection

C.Microsoft Entra Entitlement Management

D.Microsoft Entra Access Reviews

AnswerD

Microsoft Entra Access Reviews provide a systematic and efficient way for organizations to manage and attest to group memberships, access to enterprise applications, and privileged role assignments. They enable resource owners or designated reviewers to periodically verify who still requires access, and critically, can be configured to automatically revoke access for users who are not approved or fail to respond to the review, directly addressing the requirement to remove access if not approved.

Why this answer

Microsoft Entra Access Reviews (D) is the correct feature because it allows you to create recurring reviews for guest users, set the frequency to quarterly, and configure auto-apply settings to automatically remove access if the review is not approved. This directly meets the requirement for periodic attestation and automated remediation.

Exam trap

The trap here is that candidates confuse Entitlement Management (which creates access packages) with Access Reviews (which performs the actual recurring review and auto-removal), but only Access Reviews provides the quarterly schedule and automatic removal enforcement described in the scenario.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Privileged Identity Management (PIM) is designed for just-in-time privileged role activation and approval workflows, not for periodic access reviews of guest users. Option B is wrong because Microsoft Entra Identity Protection focuses on detecting and remediating identity-based risks (e.g., leaked credentials, sign-in anomalies), not on scheduling and automating access reviews. Option C is wrong because Microsoft Entra Entitlement Management manages access packages and catalogs for resource provisioning, but it does not natively provide the recurring review and auto-removal cycle; it relies on Access Reviews for that functionality.

Full explanation →

304

MCQmedium

Your organization is required to retain all HR-related documents for 7 years after an employee leaves. After that period, the documents must be permanently deleted. Which two Microsoft Purview features should you use together?

A.eDiscovery and audit logs

B.DLP policies and sensitivity labels

C.Sensitivity labels and auto-labeling

D.Retention labels and retention policies

AnswerD

Retention labels are applied directly to individual items like emails or documents, allowing for granular control over their retention and disposition based on content type or business function. Retention policies, conversely, are applied to entire locations such as Exchange mailboxes, SharePoint sites, or Teams channels, enforcing a baseline retention schedule for all content within that location. Together, these mechanisms ensure that data is retained for its required lifecycle and then appropriately disposed of, meeting regulatory and organizational compliance obligations.

Why this answer

Retention labels and retention policies. Retention labels allow you to apply retention settings (e.g., retain for 7 years then delete) to specific documents, while retention policies enforce those settings at the location level (e.g., all HR document libraries). Option A (eDiscovery and audit logs) is for search and audit, not retention.

Option B (DLP policies and sensitivity labels) is for data protection and classification, not retention. Option C (Sensitivity labels and auto-labeling) is for classification and automated labeling, not retention.

Full explanation →

305

MCQhard

You are the identity administrator for a multinational company using Microsoft Entra ID. The company has a Microsoft 365 E5 subscription. The security team wants to enforce the following requirements: 1. All users must use multi-factor authentication (MFA) when accessing sensitive applications (e.g., finance app). 2. Users from the IT department must use passwordless authentication methods (e.g., Windows Hello for Business) when accessing any resource. 3. All access to sensitive applications must be logged and monitored for anomalous activity. 4. Guest users from partner organizations must be automatically reviewed quarterly to ensure they still need access. 5. The company wants to minimize administrative overhead by automating as much as possible. You need to design a solution that meets these requirements using Microsoft Entra ID capabilities. Which combination of actions should you take?

A.Configure Self-Service Password Reset (SSPR) for all users. Enable Microsoft Entra ID Protection. Create an access review for guests.

B.Use Microsoft Entra ID Protection to enforce MFA based on risk. Implement Privileged Identity Management (PIM) for IT. Configure access reviews for guests.

C.Enable security defaults to enforce MFA for all users. Configure Microsoft Entra ID Protection to monitor anomalies. Use Microsoft Entra ID Governance to automate guest access reviews.

D.Create Conditional Access policies: one requiring MFA for the finance app, another requiring passwordless authentication strength for IT. Enable Microsoft Entra ID Protection to log and monitor sign-in risks. Create an access review for guest users.

AnswerD

This option directly addresses all specified requirements. Creating Conditional Access policies allows for precise enforcement: one policy can require MFA for the finance application, and another can mandate a passwordless authentication strength for the IT group. Enabling Microsoft Entra ID Protection ensures that sign-in risks are continuously logged and monitored, providing essential security insights. Finally, creating an access review for guest users fulfills the requirement for systematic management of external access.

Why this answer

It uses Conditional Access policies to enforce MFA for the finance app and passwordless authentication strength for IT, meeting requirements 1 and 2. Microsoft Entra ID Protection logs and monitors sign-in risks for sensitive apps (requirement 3), and an access review for guest users automates quarterly reviews (requirement 4). This minimizes administrative overhead by leveraging automation, aligning with requirement 5.

Exam trap

The trap here is that candidates often confuse security defaults (which enforce MFA for all users but lack granularity) with Conditional Access policies (which allow targeted MFA and authentication strength requirements), and they may overlook that passwordless enforcement requires an authentication strength policy, not just MFA.

How to eliminate wrong answers

Option A is wrong because SSPR does not enforce MFA or passwordless authentication; it only allows self-service password reset, and Entra ID Protection alone cannot enforce MFA without a Conditional Access policy. Option B is wrong because PIM is for just-in-time privileged access management, not for enforcing passwordless authentication for all IT users; it also does not address the MFA requirement for the finance app. Option C is wrong because security defaults enforce MFA for all users, not just for sensitive apps, and they do not support passwordless authentication strength policies; Entra ID Governance is not a specific feature for automating guest access reviews (access reviews are part of Entra ID Governance, but the option incorrectly implies a separate product).

Full explanation →

306

MCQhard

A multinational organization uses Microsoft Entra ID for identity management. External contractors need temporary elevated access to Azure resources for a critical project. The access must be time-bound (expires after 8 hours), require manager approval, and enforce multifactor authentication (MFA) when contractors activate the role. Which Microsoft Entra capability should they configure?

A.Privileged Identity Management (PIM)

B.Identity Protection

C.Conditional Access

D.Access Reviews

AnswerA

Microsoft Entra Privileged Identity Management (PIM) enables organizations to manage, control, and monitor access to important resources. It provides just-in-time (JIT) access, allowing users to activate privileged roles for a limited time period. This activation often requires multi-factor authentication (MFA) and an approval workflow, ensuring that elevated permissions are granted only when necessary and with proper oversight, significantly reducing the attack surface for privileged accounts.

Why this answer

Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure resources with time-bound activation (e.g., 8-hour expiry), requires approval workflows (manager approval), and enforces multifactor authentication (MFA) during role activation. PIM is specifically designed to manage, control, and monitor access to critical resources through time-limited, approved, and MFA-protected role assignments.

Exam trap

The trap here is that candidates confuse Conditional Access (which enforces MFA at sign-in) with PIM's ability to enforce MFA specifically during role activation, or they mistakenly think Access Reviews can grant time-bound access, when in fact Access Reviews only validate existing access and do not provide JIT activation or approval workflows.

How to eliminate wrong answers

Option B (Identity Protection) is wrong because it focuses on detecting and remediating identity-based risks (e.g., leaked credentials, sign-ins from anonymous IPs) and does not provide time-bound role activation, approval workflows, or MFA enforcement for privileged access. Option C (Conditional Access) is wrong because it enforces access policies (like MFA) based on signals (user, location, device) at sign-in time, but it does not manage role activation, time-bound expiry, or approval workflows for privileged roles. Option D (Access Reviews) is wrong because it is used to periodically review and certify existing group memberships or role assignments, not to grant temporary, time-bound elevated access with approval and MFA enforcement.

Full explanation →

307

Drag & Dropmedium

Order the steps to create a conditional access policy in Azure AD.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Creating a conditional access policy requires admin sign-in, navigating to Conditional Access, creating a new policy, configuring assignments and controls, then enabling it.

Full explanation →

308

MCQeasy

A security analyst is explaining the concept of 'defense in depth' to a new team member. Which of the following best describes the defense in depth strategy?

A.Using a single strong firewall to protect all network traffic

B.Implementing multiple layers of security controls to protect assets

C.Relying on user training as the primary security measure

D.Applying encryption only to data at rest

AnswerB

Implementing multiple layers of security controls is the core principle of defense in depth. This strategy involves strategically placing diverse, independent security mechanisms—such as physical security, network segmentation, host-based firewalls, application security, and data encryption—to create redundancy. Each layer is designed to detect, delay, or prevent an attacker from reaching critical assets, even if a preceding layer is compromised.

Why this answer

Defense in depth is a cybersecurity strategy that employs multiple layers of security controls across different parts of an IT environment (network, endpoint, application, data) to ensure that if one layer fails, another layer is already in place to mitigate the threat. This approach is fundamental to Microsoft's security architecture, as seen in products like Microsoft Defender for Cloud, which integrates protections across workloads, and Azure Active Directory (now Microsoft Entra ID), which layers conditional access policies on top of identity verification. Option B correctly captures this layered, redundant approach rather than relying on a single point of defense.

Exam trap

The trap here is that candidates often confuse 'defense in depth' with 'layered security' but then incorrectly select a single-layer option like a strong firewall (A) because they think a robust perimeter is sufficient, failing to recognize that the strategy explicitly requires multiple independent and overlapping controls.

How to eliminate wrong answers

Option A is wrong because relying on a single strong firewall violates the core principle of defense in depth, which requires multiple independent layers of security; a single firewall creates a single point of failure that, if breached, exposes the entire network. Option C is wrong because user training, while valuable, is a single administrative control and not a layered strategy; defense in depth demands technical controls (e.g., network segmentation, endpoint detection, encryption) in addition to user awareness. Option D is wrong because applying encryption only to data at rest ignores the need to protect data in transit (e.g., via TLS/SSL) and data in use, leaving critical attack surfaces exposed; defense in depth requires encryption across all data states.

Full explanation →

309

MCQhard

Your organization uses Microsoft Defender for Cloud to protect Azure subscriptions. You need to enforce that all storage accounts must have encryption at rest enabled. You have enabled Azure Policy to audit this configuration. However, you notice that some storage accounts are non-compliant. You need to automatically remediate non-compliant storage accounts. What should you do?

A.Create a Microsoft Defender for Cloud recommendation to enable encryption.

B.Use the compliance dashboard to manually enable encryption on non-compliant accounts.

C.Add a 'deployIfNotExists' policy to automatically enable encryption on storage accounts.

D.Change the policy effect from 'audit' to 'deny' to prevent creation of non-compliant accounts.

AnswerC

This remediates non-compliant accounts automatically.

Why this answer

A 'deployIfNotExists' policy assignment in Azure Policy can automatically remediate non-compliant storage accounts by enabling encryption at rest. This policy effect triggers a remediation task that deploys the required configuration (e.g., setting the 'Encryption' property to 'Enabled' on the storage account resource) without manual intervention. The audit policy only reports non-compliance, while deployIfNotExists actively enforces the desired state.

Exam trap

The trap here is that candidates confuse 'deny' (which only blocks future non-compliant resources) with 'deployIfNotExists' (which remediates existing resources), or assume Defender for Cloud recommendations can automatically fix non-compliance without additional policy configuration.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud recommendations are advisory and do not automatically remediate resources; they require manual approval or integration with Azure Policy for automation. Option B is wrong because manually enabling encryption via the compliance dashboard is not an automated solution and contradicts the requirement for automatic remediation. Option D is wrong because changing the policy effect to 'deny' only prevents creation or modification of non-compliant storage accounts in the future, but does not remediate existing non-compliant accounts.

Full explanation →

310

MCQmedium

A company uses Microsoft Entra ID. They want to ensure only current employees have access to a sensitive HR application. They implement a process where group membership for the HR app is reviewed quarterly by the HR manager, and any unnecessary access is automatically removed. Which Microsoft Entra feature should they use?

A.A

B.B

C.C

D.D

AnswerC

Microsoft Entra Access Reviews, a component of Entra ID Governance, are specifically designed to manage the lifecycle of access to resources by enabling organizations to periodically review who has access to groups, applications, or roles. This feature allows for scheduled reviews, automated notifications to reviewers, and the automatic removal of access for users who no longer require it, directly addressing the need for periodic access validation and cleanup.

Why this answer

The scenario describes a recurring review of group membership for the HR application, with automatic removal of unnecessary access. This is exactly what Microsoft Entra ID Governance's Access Reviews feature provides: scheduled reviews (e.g., quarterly) where a reviewer (the HR manager) attests to each member's continued need, and stale access is automatically revoked upon completion.

Exam trap

The trap here is that candidates often confuse Access Reviews with Privileged Identity Management (PIM) because both involve 'review' and 'access,' but PIM is specifically for privileged roles and time-bound activation, not for recurring attestation of standard application group memberships.

How to eliminate wrong answers

Option A is wrong because Privileged Identity Management (PIM) is designed for just-in-time privileged role activation and approval workflows, not for recurring attestation of standard group membership for an application. Option B is wrong because Conditional Access policies enforce real-time access controls based on conditions (location, device, risk), but they do not provide periodic review or automatic removal of group memberships. Option D is wrong because Identity Protection focuses on detecting and responding to identity-based risks (e.g., leaked credentials, anomalous sign-ins), not on scheduling and automating group membership attestation.

Full explanation →

311

MCQmedium

A user successfully authenticates to a system using a smart card. After authentication, the system checks whether the user's device is compliant with security policies before granting access to the network. This additional check is an example of which security concept?

A.Authorization

B.Authentication

C.Accounting

D.Non-repudiation

AnswerA

Checking device compliance is a condition that must be met before access is granted; this is part of the authorization process.

Why this answer

Authorization is the correct answer because after the user is authenticated via smart card, the system evaluates whether the user's device meets security compliance policies before granting network access. This decision—allowing or denying access based on conditions—is the core function of authorization, which determines what resources or actions an authenticated identity is permitted to perform.

Exam trap

The trap here is confusing the initial identity verification (authentication) with the subsequent policy-based access decision (authorization), especially when both steps occur sequentially in a single login flow.

How to eliminate wrong answers

Option B (Authentication) is wrong because authentication is the process of verifying identity (e.g., via smart card credentials), not the subsequent check of device compliance. Option C (Accounting) is wrong because accounting tracks and logs user activities and resource usage for auditing or billing, not for enforcing access decisions. Option D (Non-repudiation) is wrong because non-repudiation ensures that a user cannot deny having performed an action, typically via digital signatures or logs, and is unrelated to device compliance checks.

Full explanation →

312

MCQmedium

Your organization uses Microsoft Purview to manage insider risk. You need to create a policy that detects users who exfiltrate sensitive data by copying it to personal cloud storage services like Dropbox. Which solution should you use?

A.eDiscovery (Premium)

B.Audit (Premium)

C.Insider Risk Management

D.Communication Compliance

AnswerC

Insider Risk Management in Microsoft Purview is specifically designed to identify, analyze, and act on potential insider risks, including data exfiltration to unauthorized locations like personal cloud services. It leverages machine learning and customizable policies to detect risky activities based on behavioral indicators, enabling organizations to proactively address potential data loss before it escalates into a major incident.

Why this answer

Insider Risk Management in Microsoft Purview is specifically designed to detect, investigate, and act on risky user activities, including the exfiltration of sensitive data to personal cloud storage services like Dropbox. It uses predefined or custom policies with indicators such as copying files to unauthorized cloud apps, which aligns directly with the requirement to detect data exfiltration to personal cloud storage.

Exam trap

The trap here is that candidates often confuse Audit (Premium) with proactive detection, but Audit only provides logging after the fact, whereas Insider Risk Management offers real-time detection and alerting for risky behaviors like data exfiltration.

How to eliminate wrong answers

Option A is wrong because eDiscovery (Premium) is used for legal discovery and preservation of content, not for real-time detection of data exfiltration activities. Option B is wrong because Audit (Premium) provides logging and forensic investigation of past events but does not proactively detect or alert on risky data exfiltration patterns. Option D is wrong because Communication Compliance focuses on monitoring communications (e.g., email, Teams) for policy violations like harassment or insider trading, not on detecting data copying to external cloud storage services.

Full explanation →

313

MCQeasy

Your organization needs to classify documents containing personally identifiable information (PII) like social security numbers. Which Microsoft Purview solution should you configure?

A.Information Protection

B.Records Management

C.Auditing

D.Communication Compliance

AnswerA

Information Protection is the correct solution because it specifically provides capabilities to classify and label sensitive data within documents, whether manually by users or automatically based on content inspection. This service, often delivered through Microsoft Purview Information Protection (MPIP), enables organizations to apply sensitivity labels that not only categorize data but also enforce protective actions like encryption, access restrictions, and visual markings, directly addressing the need to classify documents containing specific information.

Why this answer

Microsoft Purview Information Protection (A) is the correct solution because it provides classification and labeling capabilities specifically designed to identify, label, and protect sensitive data such as PII (e.g., social security numbers). It uses trainable classifiers and exact data match (EDM) to automatically detect sensitive content and apply appropriate protection actions like encryption or access restrictions.

Exam trap

The trap here is that candidates often confuse Records Management (which deals with retention and deletion) with Information Protection (which deals with classification and labeling), leading them to select B when the question explicitly asks about classifying documents containing PII.

How to eliminate wrong answers

Option B (Records Management) is wrong because it focuses on managing the lifecycle of records (retention, deletion, and disposition) rather than classifying or protecting sensitive content like PII. Option C (Auditing) is wrong because it logs user and admin activities for compliance review but does not perform classification or protection of documents. Option D (Communication Compliance) is wrong because it monitors communications (e.g., emails, Teams messages) for policy violations like harassment or insider trading, not for classifying documents containing PII.

Full explanation →

314

MCQeasy

You are designing an identity solution for a new company that will use Microsoft Entra ID. The company wants employees to use biometrics (fingerprint) on their mobile devices to sign in without typing a password. Which Microsoft Entra feature should you implement?

A.Windows Hello for Business

B.Microsoft Authenticator app (passwordless)

C.SMS-based sign-in

D.FIDO2 security keys

AnswerB

The Microsoft Authenticator app provides a secure and convenient passwordless sign-in experience by leveraging the biometric capabilities (fingerprint or facial recognition) inherent to the user's mobile device. When a user attempts to sign in to an Azure AD-connected application, a notification is sent to the Authenticator app, prompting for approval using the device's native biometrics. This method securely verifies the user's identity on their registered mobile device, eliminating the need to type a password and enhancing security against phishing attacks. It directly addresses the requirement for mobile biometric authentication.

Why this answer

The Microsoft Authenticator app (passwordless) allows users to sign in to Microsoft Entra ID using biometrics (fingerprint, face, or PIN) on their mobile device without entering a password. This feature uses the device's built-in biometric capabilities to verify the user's identity, making it the correct choice for the described scenario.

Exam trap

The trap here is that candidates may confuse Windows Hello for Business with mobile biometrics, but Windows Hello for Business is specifically tied to Windows devices and not to mobile phones or tablets.

How to eliminate wrong answers

Option A is wrong because Windows Hello for Business is designed for Windows devices (PCs, laptops) using biometrics like fingerprint or facial recognition, not for mobile devices. Option C is wrong because SMS-based sign-in uses a text message code, not biometrics, and still requires a password for initial setup. Option D is wrong because FIDO2 security keys are hardware-based external devices (e.g., USB keys) that require physical possession, not mobile device biometrics.

Full explanation →

315

MCQmedium

A financial services company is required by regulation to prevent sensitive customer financial information from being shared externally via email. The compliance team wants to automatically scan all outgoing emails for patterns that match credit card numbers or account numbers. If a match is found, the email should be blocked and the sender should receive a policy tip. Which Microsoft Purview solution should be configured?

A.Microsoft Purview Audit

B.Microsoft Purview Data Lifecycle Management

C.Microsoft Purview Data Loss Prevention (DLP)

D.Microsoft Purview eDiscovery

AnswerC

Microsoft Purview Data Loss Prevention (DLP) proactively identifies, monitors, and protects sensitive information across Microsoft 365 services like Exchange Online, SharePoint Online, and OneDrive for Business. It uses policies to detect specific sensitive information types, such as credit card numbers or financial account details, within content. Upon detection, DLP can automatically block sharing, encrypt files, notify administrators, or provide policy tips to users, thereby preventing unauthorized data exfiltration and ensuring regulatory compliance.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block sensitive information—such as credit card numbers and account numbers—in outgoing emails. DLP policies can scan email content and attachments for predefined sensitive information types, and when a match is found, the email can be blocked and a policy tip sent to the sender, meeting the compliance requirement.

Exam trap

The trap here is that candidates may confuse DLP with eDiscovery or Audit because all three involve compliance, but only DLP provides proactive, real-time blocking and notification for outbound sensitive data.

Why the other options are wrong

Microsoft Purview Audit logs user and admin activities but does not scan or block outgoing emails for sensitive content like credit card numbers.

Microsoft Purview Data Lifecycle Management manages retention and deletion of data, not real-time scanning and blocking of outbound emails for sensitive content like credit card numbers.

Microsoft Purview eDiscovery is used for searching and exporting content from Exchange, SharePoint, and Teams for legal investigations, not for real-time scanning and blocking of outgoing emails containing sensitive data.

When would these options actually be correct?

When the requirement is to investigate a security incident by reviewing detailed logs of who accessed or sent sensitive data, such as tracking a data breach after it occurred.

A company needs to automatically retain emails containing financial data for 7 years and delete them after that period. The compliance team wants to set policies for data retention and deletion based on content classification.

A legal team needs to search for all emails containing a specific client's account number as part of a lawsuit discovery request. eDiscovery would be the correct tool to perform this search and export the results for legal review.

Why candidates pick the wrong answer

Candidates may confuse auditing (monitoring) with prevention (blocking), assuming that logging email activity can also enforce policy tips and blocks.

Candidates may confuse lifecycle management with data loss prevention because both involve data governance and policies, but lifecycle management focuses on retention/deletion rather than blocking transmission.

Candidates may confuse eDiscovery's content search capabilities with DLP's content scanning, thinking that eDiscovery can also block emails, or they may mistakenly believe that eDiscovery includes policy enforcement features.

Full explanation →

316

MCQhard

A financial services organization must comply with a regulation that requires all communications related to trades (including emails and Teams messages) to be retained for a period of 7 years. During retention, no user may edit or delete these records. After the 7 years, the records must be disposed of with an irreversible deletion that is verified by a compliance officer. Which Microsoft Purview solution should the organization use to enforce both retention and regulatory disposition?

A.Microsoft Purview Records Management (regulatory retention label)

B.Microsoft Purview Data Lifecycle Management (standard retention label)

C.Microsoft Purview Communication Compliance

D.Microsoft Purview Insider Risk Management

AnswerA

Records Management with a retention label marked as a regulatory record permanently locks the content, preventing any modification or deletion during the retention period. It also supports disposition workflows to require approval before permanent deletion.

Why this answer

Microsoft Purview Records Management with a regulatory retention label is the correct solution because it enforces immutable retention (no user edits or deletions) and mandates a disposition review by a compliance officer before irreversible deletion. Regulatory labels lock the retention policy at the highest level, preventing any user or administrator from shortening the retention period or bypassing the disposition workflow, which aligns with the 7-year retention and verified disposal requirement.

Exam trap

The trap here is that candidates confuse 'standard retention labels' (which allow edits and deletions by authorized users) with 'regulatory retention labels' (which enforce immutable retention and require disposition review), leading them to select Data Lifecycle Management instead of Records Management.

Why the other options are wrong

Standard retention labels in Data Lifecycle Management do not support regulatory disposition with irreversible deletion verified by a compliance officer; they lack the 'regulatory' record type and disposition verification workflow required by the regulation.

Communication Compliance is designed to detect and review communications that violate organizational policies (e.g., insider trading, harassment), not to enforce immutable retention or regulatory disposition. It does not provide the required 7-year retention with irreversible deletion and compliance officer verification.

Insider Risk Management is designed to detect, investigate, and act on risky user activities (e.g., data leaks, policy violations), not to enforce retention or regulatory disposition of records. It lacks the ability to apply retention labels or trigger irreversible deletion after a fixed period.

When would these options actually be correct?

An organization needs to retain emails for 3 years for general business purposes, after which users can delete them manually. Data Lifecycle Management with standard retention labels would be correct because no regulatory compliance or disposition verification is required.

An organization needs to monitor employee communications for potential regulatory violations (e.g., insider trading) and escalate them for legal review. The question would specify that the goal is to detect and investigate policy breaches in communications, not to retain or dispose of records.

An organization needs to detect and investigate potential data theft by employees who exfiltrate sensitive trade communications before the retention period ends. Insider Risk Management would be correct to identify and alert on such risky behavior.

Why candidates pick the wrong answer

Candidates confuse 'retention' with 'regulatory retention', assuming any retention label meets compliance needs, and overlook the specific requirements for irreversible deletion and disposition verification unique to Records Management.

Candidates may confuse the regulatory compliance aspect of Communication Compliance with the retention and disposition requirements, assuming that a solution named 'Communication Compliance' would handle all compliance needs for communications.

Candidates may confuse the 'compliance officer verification' requirement with insider risk workflows, mistakenly thinking that monitoring user actions for disposition verification is part of Insider Risk Management.

Full explanation →

317

MCQmedium

An organization wants to protect its fleet of Windows 10 laptops from advanced malware and ransomware. The solution must detect suspicious behavior (e.g., a process encrypting files) and provide security teams with the ability to isolate an infected device from the network for investigation. Which Microsoft security solution should they deploy?

A.Microsoft Defender for Cloud

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Cloud Apps

D.Microsoft Defender for Office 365

AnswerB

Microsoft Defender for Endpoint is the correct solution because it provides comprehensive, next-generation endpoint protection specifically designed for devices like Windows 10 laptops. It includes capabilities such as antivirus, behavioral analysis, endpoint detection and response (EDR) for advanced threat hunting, and automated investigation and remediation to protect against sophisticated malware and zero-day attacks. Furthermore, it offers vulnerability management and device isolation to contain threats effectively.

Why this answer

Microsoft Defender for Endpoint (MDE) is the correct solution because it provides endpoint detection and response (EDR) capabilities, including behavioral-based detection of advanced malware and ransomware (e.g., detecting a process encrypting files via machine learning and behavioral analytics). It also includes automated investigation and remediation features, such as the ability to isolate an infected device from the network (device isolation) to prevent lateral movement while allowing security teams to investigate.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a cloud workload protection tool) with endpoint protection, or they assume Defender for Office 365 covers all devices, when in fact only Defender for Endpoint provides the specific behavioral detection and device isolation for Windows 10 laptops.

Why the other options are wrong

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) for Azure, on-premises, and other cloud resources. It does not provide endpoint detection and response (EDR) capabilities like behavior monitoring and device isolation for Windows 10 laptops.

Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that focuses on securing cloud applications and services, not on endpoint-level malware detection or device isolation for Windows 10 laptops.

When would these options actually be correct?

An organization wants to assess and improve the security posture of its Azure virtual machines and detect threats across hybrid cloud workloads. They need a solution that provides security recommendations and just-in-time VM access. In that scenario, Microsoft Defender for Cloud would be the correct answer.

An organization wants to gain visibility into shadow IT, control access to cloud apps, and protect data in SaaS applications like Office 365 or Salesforce. They need to detect anomalous behavior in cloud app usage and enforce policies such as blocking downloads from unmanaged devices.

Why candidates pick the wrong answer

Candidates may confuse 'Defender for Cloud' with endpoint protection because the name includes 'Defender' and 'Cloud', assuming it covers all cloud-connected devices, including laptops. They may not realize it focuses on cloud infrastructure rather than endpoint devices.

Candidates may confuse 'cloud apps' with 'endpoint protection' or assume that any Microsoft Defender product provides comprehensive malware defense, overlooking the specific endpoint focus required for laptop protection and isolation.

Full explanation →

318

Multi-Selecteasy

Which TWO of the following are benefits of using Microsoft Entra ID Conditional Access? (Choose two.)

Select 2 answers

A.Allow users to reset their own passwords

B.Block access from locations that are not trusted

C.Automatically grant temporary admin access

D.Enforce multi-factor authentication based on user risk

E.Eliminate the need for passwords entirely

AnswersB, D

Microsoft Entra Conditional Access, a core component of Microsoft E (Enterprise Mobility + Security), enables organizations to define granular access policies based on various conditions, including network location. By configuring trusted IP ranges or blocking specific countries/regions, administrators can prevent unauthorized access attempts from untrusted geographical locations, significantly reducing the attack surface and enhancing security posture. This directly leverages the adaptive capabilities of Entra.

Why this answer

Conditional Access policies can enforce multi-factor authentication based on user risk (D) and block access from untrusted locations (B). Option A (allow users to reset their own passwords) is a feature of self-service password reset (SSPR), not Conditional Access. Option C (automatically grant temporary admin access) is a benefit of Privileged Identity Management (PIM).

Option E (eliminate the need for passwords entirely) is related to passwordless authentication, not Conditional Access.

Full explanation →

319

Multi-Selectmedium

Which TWO Microsoft Purview solutions can be used to protect sensitive data in Microsoft Teams chats and channels? (Choose two.)

Select 2 answers

A.Microsoft Purview Communication Compliance

B.Microsoft Purview Data Loss Prevention (DLP) policies

C.Microsoft Purview Sensitivity Labels

D.Microsoft Purview Information Barriers

E.Microsoft Purview Retention Policies

AnswersA, B

Microsoft Purview Communication Compliance is a powerful solution designed to actively scan and analyze communications, such as Microsoft Teams chats and emails, for policy violations. It leverages machine learning and predefined or custom policies to detect inappropriate sharing of sensitive information, harassment, or regulatory non-compliance. This solution enables organizations to identify risky content, investigate potential issues, and take remediation actions, directly addressing the protection of sensitive data within communication channels.

Why this answer

Microsoft Purview Communication Compliance is correct because it helps organizations detect and act on inappropriate or sensitive messages in Teams chats and channels by analyzing communications for policy violations such as offensive language, harassment, or sharing of sensitive data. Microsoft Purview Data Loss Prevention (DLP) policies are correct because they can be configured to automatically detect and prevent the sharing of sensitive information (e.g., credit card numbers, social security numbers) in Teams chats and channels by scanning messages and attachments in real time.

Exam trap

The trap here is that candidates often confuse Sensitivity Labels with DLP, thinking labels alone can prevent data leakage in chats, but labels only apply classification and encryption to files, not real-time scanning of message content.

Full explanation →

320

MCQeasy

Refer to the exhibit. The JSON snippet shows a sensitivity label configuration. What is the purpose of the 'SensitiveInfoTypes' property in this label?

A.It sets the retention period for content with this label.

B.It defines the user groups that can apply this label manually.

C.It specifies the sensitive information types that trigger automatic labeling.

D.It configures the encryption settings for the label.

AnswerC

This property precisely specifies the sensitive information types (SITs) that, when detected in content, will trigger the automatic application of this sensitivity label. These SITs act as conditions, allowing the system to identify and classify documents or emails containing specific patterns, such as credit card numbers or national identification numbers, without requiring manual user intervention, thereby enforcing data protection policies automatically.

Why this answer

The 'SensitiveInfoTypes' property in a sensitivity label configuration specifies which built-in or custom sensitive information types (e.g., credit card numbers, passport numbers) should be detected in content. When these types are matched, the label can be applied automatically through auto-labeling policies, ensuring consistent protection without requiring manual user action.

Exam trap

The trap here is that candidates often confuse the 'SensitiveInfoTypes' property with encryption or retention settings, because all three are configurable within a sensitivity label's wizard, but each serves a distinct purpose and is located in separate sections of the label configuration.

How to eliminate wrong answers

Option A is wrong because retention periods are configured via retention labels and policies, not through the 'SensitiveInfoTypes' property of a sensitivity label. Option B is wrong because user groups that can apply a label manually are defined in the label's scope and permissions settings, not by referencing sensitive information types. Option D is wrong because encryption settings (e.g., 'protect with encryption') are configured separately within the label's 'Encryption' section, not by the 'SensitiveInfoTypes' property.

Full explanation →

321

MCQmedium

Your organization has Microsoft Sentinel deployed. The security operations team needs to automatically respond to a security incident by opening an incident in ServiceNow and sending a notification to a Teams channel. What should you configure?

A.An automation rule with a playbook

B.A workbook

C.An analytics rule

D.A watchlist

AnswerA

Correct. Automation rules with playbooks enable automated responses integrated with external systems.

Why this answer

Automation rules in Microsoft Sentinel can trigger playbooks (based on Azure Logic Apps) that integrate with external systems like ServiceNow and Teams. Option B is wrong because workbooks provide visualizations, not automation. Option C is wrong because analytics rules create alerts, not automated responses.

Option D is wrong because watchlists are for correlation, not response.

Full explanation →

322

MCQmedium

A company's security team discovers that most recent account compromises resulted from attackers exploiting legacy authentication protocols (POP3, IMAP, SMTP Auth) that do not support multi-factor authentication. The team wants to immediately block all sign-in attempts using these legacy protocols while still allowing modern authentication methods (e.g., OAuth 2.0). Which Microsoft Entra ID feature should they configure?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management

D.Multi-factor Authentication

AnswerA

Conditional Access policies can include a 'Block legacy authentication' condition. This allows administrators to create a policy that blocks all sign-ins from clients that do not support MFA, effectively stopping attacks that rely on legacy protocols while preserving modern authentication.

Why this answer

Conditional Access policies in Microsoft Entra ID can be configured to block authentication attempts from legacy protocols (POP3, IMAP, SMTP Auth) by targeting client apps that do not support modern authentication. This allows the security team to immediately enforce a block on all sign-ins using these protocols while still permitting modern OAuth 2.0-based methods, directly addressing the requirement without disabling MFA for users who can use modern clients.

Exam trap

The trap here is that candidates often confuse the 'block legacy authentication' capability with MFA or Identity Protection, assuming that enabling MFA alone will stop legacy protocol abuse, when in fact legacy protocols bypass MFA entirely and require a Conditional Access policy to be explicitly blocked.

Why the other options are wrong

Identity Protection is designed to detect and respond to identity-based risks, such as suspicious sign-ins or leaked credentials, but it does not provide the capability to block specific authentication protocols like POP3, IMAP, or SMTP Auth.

Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles, but it does not block legacy authentication protocols. The question requires blocking sign-in attempts based on authentication protocol, which is a Conditional Access policy capability.

Multi-factor Authentication (MFA) is an authentication method, not a policy to block legacy protocols. The question asks for a feature to block sign-in attempts using legacy protocols, which requires a conditional access policy to enforce MFA or block specific authentication methods.

When would these options actually be correct?

A company wants to automatically block sign-ins from compromised accounts or from anonymous IP addresses. Identity Protection should be configured to enforce risk-based policies, such as requiring MFA for high-risk sign-ins or blocking sign-ins from risky sessions.

A company wants to implement just-in-time privileged access for administrators, requiring approval and time-bound role activation for elevated permissions. In that scenario, configuring Privileged Identity Management would be the correct answer.

A company wants to require all users to verify their identity with a second factor (e.g., phone call or app notification) during sign-in. The correct answer would be Multi-factor Authentication, as it is the feature that provides the additional verification step.

Why candidates pick the wrong answer

Candidates may confuse Identity Protection's risk detection with the ability to enforce access controls, not realizing that blocking legacy protocols is a Conditional Access policy action, not a risk-based detection feature.

Candidates may confuse PIM's role in controlling access with the ability to enforce authentication policies, or they might think that blocking legacy protocols is a privilege management task rather than an access control policy.

Candidates may confuse the goal of blocking legacy protocols with requiring MFA, thinking that enabling MFA will automatically prevent legacy protocol attacks, but MFA alone does not block legacy protocols unless enforced via Conditional Access.

Full explanation →

323

MCQhard

A financial institution uses Microsoft 365 and must ensure that Microsoft support engineers cannot access the institution's content (e.g., Exchange Online mailboxes, SharePoint sites) without explicit approval from the institution's compliance officer. The compliance officer needs to review and approve or reject each access request. Which Microsoft Purview feature should be configured?

A.Customer Lockbox

B.Communication Compliance

C.Insider Risk Management

D.Data Lifecycle Management

AnswerA

Customer Lockbox for Microsoft 365 provides an explicit, auditable workflow for customer approval when a Microsoft engineer needs to access customer content to resolve a support issue. This feature ensures that no Microsoft support personnel can gain access to customer data without the customer's designated approver, such as a compliance officer, granting explicit permission for each specific access request. It directly addresses the requirement for a financial institution to control and approve any potential access to their sensitive data by external parties, including Microsoft support.

Why this answer

Customer Lockbox is the correct feature because it provides a controlled access approval process for Microsoft support engineers to access customer content. When a support case requires access to Exchange Online mailboxes or SharePoint sites, Customer Lockbox ensures the request is sent to the institution's compliance officer for explicit approval or rejection before access is granted, meeting the requirement for explicit approval.

Exam trap

The trap here is that candidates often confuse Customer Lockbox with Insider Risk Management, mistakenly thinking that controlling internal user access is the same as controlling Microsoft support access, but Customer Lockbox is specifically designed for external support engineer access approval workflows.

Why the other options are wrong

Communication Compliance is designed to detect and review internal/external communications for policy violations (e.g., offensive language, insider trading), not to control Microsoft support engineers' access to customer content.

Insider Risk Management is designed to detect and investigate risky user activities (e.g., data leaks, policy violations) but does not control or require approval for Microsoft support engineers' access to customer content.

Data Lifecycle Management governs retention and deletion of data based on policies, not controlling Microsoft support engineers' access to content. It does not provide approval workflows for access requests.

When would these options actually be correct?

A company needs to monitor employee emails and Microsoft Teams messages for regulatory compliance (e.g., FINRA, SEC) and flag potential policy breaches for review by a compliance officer.

An organization wants to identify and investigate potential data theft by employees who are copying sensitive files to personal cloud storage. Insider Risk Management would be correct for detecting such insider threats.

An organization needs to automatically retain emails for 7 years and then delete them to comply with regulatory requirements. Data Lifecycle Management would be configured to apply retention labels and policies for this purpose.

Why candidates pick the wrong answer

Candidates may confuse the 'compliance officer review' requirement with Communication Compliance's review workflow, not realizing Customer Lockbox is the specific feature for controlling Microsoft support access.

Candidates may confuse 'insider risk' with 'external support access risk,' assuming that managing insider risks includes controlling Microsoft support personnel, but the feature is focused on internal users, not Microsoft engineers.

Candidates may confuse data governance features, thinking 'management' implies control over access, but Data Lifecycle Management focuses on data retention and deletion, not access authorization.

Full explanation →

324

MCQeasy

Refer to the exhibit. You run this PowerShell cmdlet. What is the outcome?

A.A guest user is created in Microsoft Entra ID and an invitation email is sent.

B.The external user is added as a member user without an invitation.

C.The external user is provisioned as a consumer account in Azure AD B2C.

D.The external user is added as a member user and cannot be a guest.

AnswerA

The New-MgInvitation or New-AzureADMSInvitation cmdlet, when executed with appropriate parameters like InvitedUserEmailAddress and SendInvitationMessage -eq $true, specifically facilitates Microsoft Entra B2B collaboration. This action creates a new guest user object in the inviting tenant's Microsoft Entra ID, representing the external user. Concurrently, an invitation email containing a unique redemption link is automatically dispatched to the specified external email address, enabling the invited user to accept the invitation and gain access.

Why this answer

The `New-MgInvitation` cmdlet creates a guest user in Microsoft Entra ID and sends an invitation email by default. This is the standard behavior for B2B collaboration, where the external user is assigned the 'Guest' user type and receives an email to accept the invitation and redeem their account.

Exam trap

The trap here is that candidates often confuse the `New-MgInvitation` cmdlet with `New-MgUser`, which creates a member user, and mistakenly think the invitation email is optional or that the user type can be changed to member without additional steps.

How to eliminate wrong answers

Option B is wrong because `New-MgInvitation` always sends an invitation email; it does not add the external user as a member user without an invitation. Option C is wrong because Azure AD B2C consumer accounts are created using separate B2C-specific cmdlets (e.g., `New-AzureADMSB2CUser`), not `New-MgInvitation`. Option D is wrong because the cmdlet explicitly creates a guest user, not a member user, and the guest user type cannot be changed to member via this cmdlet.

Full explanation →

325

Multi-Selecthard

Which TWO Microsoft Security Copilot capabilities can help security analysts during incident response?

Select 2 answers

A.Provide guided response steps

B.Generate incident summary reports

C.Provision user accounts

D.Configure firewall rules

E.Automatically block malicious emails

AnswersA, B

Copilot offers recommendations.

Why this answer

Microsoft Security Copilot is an AI-powered security analysis tool that integrates with Microsoft 365 Defender and Sentinel. It can provide guided response steps (option A) by suggesting playbook actions and remediation workflows based on the incident context, and it can generate incident summary reports (option B) by synthesizing data from alerts, entities, and investigations into a concise narrative. These capabilities directly assist analysts in understanding and responding to incidents more efficiently.

Exam trap

The trap here is that candidates may confuse Security Copilot's analytical and advisory capabilities with automated remediation actions (like blocking emails or configuring firewalls), which are handled by separate Microsoft security products such as Defender for Office 365 or Azure Firewall policies.

Full explanation →

326

MCQeasy

An organization implements a policy where users must provide two forms of verification, such as a password and a text message code, to access the corporate network. Which security concept does this demonstrate?

A.Authorization

B.Authentication

C.Accounting

D.Multifactor authentication

AnswerD

Multifactor authentication (MFA) is the security method that requires a user to provide two or more distinct verification factors from different categories to prove their identity. These factors typically include something the user *knows* (like a password), something the user *has* (like a phone or token), and/or something the user *is* (like a fingerprint). By combining multiple independent factors, MFA significantly enhances security by making it much harder for unauthorized users to gain access, even if one factor is compromised.

Why this answer

Multifactor authentication (MFA) requires two or more distinct factors (e.g., something you know like a password, and something you have like a text message code) to verify identity. This is correct because the policy explicitly demands two forms of verification, which is the defining characteristic of MFA, not just single-factor authentication.

Exam trap

The trap here is that candidates may confuse 'authentication' (the general process) with 'multifactor authentication' (a specific type), failing to recognize that the question explicitly describes two different verification methods, which is the hallmark of MFA.

How to eliminate wrong answers

Option A is wrong because authorization determines what resources a user can access after authentication, not the process of verifying identity. Option B is wrong because authentication is the broader process of proving identity, but the specific requirement for two forms of verification is MFA, not single-factor authentication. Option C is wrong because accounting (auditing) tracks user activities and resource usage for compliance and billing, not the verification process itself.

Full explanation →

327

MCQmedium

A company uses Microsoft Entra ID and wants to allow users to reset their own passwords without help desk intervention. However, they want to ensure that only users who have already registered for multifactor authentication (MFA) can use self-service password reset (SSPR). Which Microsoft Entra feature should the administrator configure to enforce this requirement?

A.Conditional Access

B.Self-Service Password Reset (SSPR) settings

C.Identity Protection

D.Privileged Identity Management

AnswerB

Self-Service Password Reset (SSPR) settings in Microsoft Entra ID directly control the user experience for password resets, including the authentication methods users must register and use. Administrators can configure the "Number of methods required to reset" and specify which "Methods available to users." Crucially, SSPR also offers an "Enforce registration" option, which can prompt users to register for SSPR (and thus their chosen authentication methods, including MFA options) at their next sign-in, ensuring they are prepared before a reset is needed.

Why this answer

Self-Service Password Reset (SSPR) settings in Microsoft Entra ID include a configuration option to require users to register for multifactor authentication (MFA) before they can use SSPR. By enabling the 'Require users to register when they sign in' setting under SSPR, the administrator ensures that only MFA-registered users can reset their own passwords, meeting the requirement without additional policies.

Exam trap

The trap here is that candidates often confuse Conditional Access (which enforces MFA during sign-in) with the SSPR registration requirement, but Conditional Access does not control the SSPR registration prerequisite—only the SSPR settings can enforce that users must be MFA-registered before using password reset.

How to eliminate wrong answers

Option A is wrong because Conditional Access is a policy engine that enforces access controls (e.g., requiring MFA during sign-in) but does not directly control SSPR registration requirements; it cannot enforce that only MFA-registered users can use SSPR. Option C is wrong because Identity Protection is designed to detect and respond to identity risks (e.g., leaked credentials, anomalous sign-ins) and does not manage SSPR registration or usage restrictions. Option D is wrong because Privileged Identity Management (PIM) provides just-in-time privileged role activation and access reviews, not password reset registration enforcement.

Full explanation →

328

MCQmedium

A company uses digital signatures on all official emails sent to customers. The signature is created using the sender’s private key, allowing recipients to verify that the email truly came from the claimed sender and that it was not altered in transit. Which security goal is primarily achieved by the digital signature?

A.Confidentiality

B.Integrity

C.Availability

D.Non-repudiation

AnswerD

Digital signatures achieve non-repudiation by cryptographically linking a message to its sender in a way that cannot be legitimately denied later. When a sender signs an email with their unique private key, they are essentially creating an unforgeable proof of origin. This signature, verifiable by anyone using the sender's public key, confirms that only the holder of that specific private key could have sent the message, thereby preventing the sender from disavowing their actions.

Why this answer

Digital signatures use asymmetric cryptography where the sender signs the email with their private key. The recipient can verify the signature using the sender's public key, which proves the identity of the sender and ensures the message has not been tampered with. This directly achieves non-repudiation because the sender cannot deny having sent the email, as only their private key could have created the signature.

Exam trap

The trap here is that candidates often confuse integrity with non-repudiation, but while digital signatures do ensure integrity, the primary security goal they achieve is non-repudiation because they provide cryptographic proof of the sender's identity that cannot be repudiated.

Why the other options are wrong

Digital signatures do not encrypt the email content; they only provide authentication and integrity verification. Confidentiality is about preventing unauthorized access, which is not achieved by signing with a private key.

Digital signatures primarily ensure non-repudiation and integrity, but the question specifically asks for the goal 'primarily achieved.' While integrity is partially achieved (detecting tampering), the primary goal is non-repudiation—proving the sender's identity and preventing denial. Integrity alone does not tie the signature to a specific sender's private key.

Digital signatures primarily ensure non-repudiation and integrity, not availability. Availability refers to systems and data being accessible when needed, which is not addressed by digital signatures.

When would these options actually be correct?

A question asking which security goal is achieved by encrypting the email body with the recipient's public key, or by using a symmetric key to encrypt data before transmission, would have confidentiality as the correct answer.

A question that asks: 'Which security goal ensures that data has not been modified during transmission?' In that context, integrity is the correct answer, as it focuses solely on detecting unauthorized changes, not on sender identity or non-repudiation.

In a scenario where a company implements redundant servers and failover mechanisms to ensure that its email system remains operational even during a hardware failure, the security goal primarily achieved is availability.

Why candidates pick the wrong answer

Candidates may confuse digital signatures with encryption because both involve cryptographic keys, or they might think that signing ensures the message is hidden from eavesdroppers.

Candidates may confuse integrity with non-repudiation because digital signatures do verify that the message was not altered (integrity). They overlook that the signature's primary purpose is to bind the sender's identity to the message, which is non-repudiation.

Candidates may confuse integrity (which digital signatures also provide) with availability, or mistakenly think that signing ensures the email service is always up.

Full explanation →

329

MCQmedium

A company uses Microsoft 365 E5 and is concerned about advanced phishing attacks that use adversary-in-the-middle (AiTM) techniques to steal session cookies and bypass multifactor authentication. Which Microsoft Defender for Office 365 feature should they configure to specifically protect against this type of attack?

A.Safe Attachments

B.Safe Links

C.Anti-Phishing (advanced policies)

D.Campaign Views

AnswerC

Advanced anti-phishing policies in Microsoft Defender for Office 365 are specifically engineered to detect and mitigate sophisticated phishing attacks, including adversary-in-the-middle (AiTM) threats. These policies leverage machine learning, behavioral analysis, and real-time signal detection to identify anomalous authentication flows, suspicious login patterns, and impersonation attempts. By analyzing various indicators, these advanced controls can effectively block phishing campaigns aimed at hijacking user sessions or stealing credentials via proxying techniques.

Why this answer

Advanced anti-phishing policies in Defender for Office 365 include protection against adversary-in-the-middle (AiTM) attacks by using machine learning models and impersonation detection to analyze and block phishing attempts that aim to steal session cookies and bypass multifactor authentication. This feature specifically detects and mitigates sophisticated phishing techniques that traditional anti-spam or link-checking mechanisms might miss, such as real-time credential harvesting and session hijacking via proxy servers.

Exam trap

The trap here is that candidates often confuse Safe Links (which protects against malicious URLs) with the broader anti-phishing protection needed for AiTM attacks, not realizing that AiTM attacks exploit the authentication process itself rather than just the URL, requiring advanced impersonation and proxy detection capabilities found only in anti-phishing policies.

How to eliminate wrong answers

Option A is wrong because Safe Attachments protects against malware in email attachments by detonating them in a sandbox, but it does not address session cookie theft or AiTM phishing techniques. Option B is wrong because Safe Links provides time-of-click protection against malicious URLs, but it focuses on blocking known malicious links at the point of click, not on detecting the proxy-based credential and session cookie interception used in AiTM attacks. Option D is wrong because Campaign Views is a reporting and analysis tool that provides visibility into phishing campaigns after they have been detected, not a proactive protection feature that prevents AiTM attacks.

Full explanation →

330

MCQmedium

A company uses Microsoft Entra ID and Intune for mobile device management. They want to grant access to a confidential project management site only from devices that are encrypted and have the latest anti-malware updates. Which Conditional Access assignment should they configure to enforce this requirement?

A.Sign-in risk

B.Device state

C.User risk

D.Application

AnswerB

The 'Device state' Conditional Access condition specifically evaluates whether a device is marked as compliant by a Mobile Device Management (MDM) solution like Microsoft Intune. This condition enforces that the device meets predefined security baselines, such as requiring disk encryption, an up-to-date operating system, or active anti-malware protection. By leveraging Intune's compliance reporting, this condition ensures only trusted and healthy devices can access corporate resources.

Why this answer

(Device state) is correct because Conditional Access policies can use the 'Device state' condition to require that devices are marked as compliant or are hybrid Azure AD joined. Compliance is determined by Intune compliance policies, which can enforce requirements like encryption and up-to-date anti-malware. By setting the 'Device state' condition to 'Compliant device' or 'Hybrid Azure AD joined device', access to the confidential site is granted only to devices meeting those security baselines.

Exam trap

The trap here is that candidates confuse 'Device state' (which enforces device compliance like encryption and anti-malware) with 'Sign-in risk' or 'User risk', which are identity-focused risk detections unrelated to device health.

How to eliminate wrong answers

Option A (Sign-in risk) is wrong because sign-in risk is a real-time detection of anomalous sign-in behavior (e.g., impossible travel, anonymous IP) and does not evaluate device encryption or anti-malware status. Option C (User risk) is wrong because user risk assesses the likelihood that a user's identity has been compromised based on historical events (e.g., leaked credentials), not device health attributes. Option D (Application) is wrong because the Application condition specifies which cloud apps the policy applies to, not the device compliance state; it controls scope, not device security posture.

Full explanation →

331

MCQmedium

Your organization uses Microsoft Purview eDiscovery to manage a legal case. You need to place a hold on emails for specific users, but you want to allow the system to apply the hold automatically. Which eDiscovery solution should you use?

A.Microsoft Purview eDiscovery (Standard)

B.Microsoft Purview Audit (Premium)

C.Microsoft Purview Communication Compliance

D.Microsoft Purview eDiscovery (Premium)

AnswerD

Microsoft Purview eDiscovery (Premium) is the advanced solution specifically engineered to manage complex eDiscovery workflows, including the crucial capability of automatic legal holds. It enables organizations to identify custodians, automatically place legal holds on their associated data sources (e.g., Exchange mailboxes, SharePoint sites, OneDrive accounts, Teams chats), and manage these holds centrally. This automation ensures that relevant data is preserved efficiently and consistently across the organization, significantly reducing manual effort and the risk of data spoliation during litigation or investigations.

Why this answer

Microsoft Purview eDiscovery (Premium) is the correct choice because it provides advanced legal hold capabilities, including the ability to apply holds automatically based on specified criteria such as user mailboxes or SharePoint sites. Unlike the Standard version, Premium supports policy-based holds that can be set to trigger automatically without manual intervention, which is essential for managing legal cases efficiently.

Exam trap

The trap here is that candidates often confuse eDiscovery (Standard) with eDiscovery (Premium), assuming both can handle automatic holds, but only Premium supports policy-driven, automated hold placement.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview eDiscovery (Standard) only supports manual holds that require an administrator to place and manage each hold individually, lacking the automatic hold functionality described in the question. Option B is wrong because Microsoft Purview Audit (Premium) is focused on logging and investigating user activity, not on placing holds on content for legal cases. Option C is wrong because Microsoft Purview Communication Compliance is designed to detect and manage policy violations in communications (e.g., inappropriate language or sensitive information), not to place legal holds on emails.

Full explanation →

332

MCQeasy

Your organization uses Microsoft Defender for Endpoint. You need to investigate a potential malware outbreak on several endpoints. Which feature allows you to search for indicators of compromise (IOCs) across all endpoints?

A.Incidents and alerts

B.Advanced hunting

C.Threat analytics

D.Device inventory

AnswerB

Advanced hunting uses KQL to search for IOCs across endpoints in Defender for Endpoint.

Why this answer

Advanced hunting in Microsoft Defender for Endpoint is a query-based threat hunting tool that allows security analysts to search for indicators of compromise (IOCs) across all endpoints using the Kusto Query Language (KQL). It provides access to raw, schema-based tables (e.g., DeviceEvents, DeviceFileEvents, DeviceNetworkEvents) for up to 30 days of historical data, enabling proactive detection of malware outbreak patterns across the entire fleet.

Exam trap

The trap here is that candidates confuse the reactive alert management in Incidents and alerts with the proactive, query-based hunting capability of Advanced hunting, often overlooking that only Advanced hunting supports raw IOC searches across historical endpoint data.

How to eliminate wrong answers

Option A is wrong because Incidents and alerts aggregate correlated detections and alerts into a single case view, but they do not allow raw, custom KQL-based searches for specific IOCs across all endpoints; they are reactive, not proactive hunting tools. Option C is wrong because Threat analytics provides curated threat intelligence reports, including mitigations and impact assessments, but it is not a search interface for querying raw endpoint data for custom IOCs. Option D is wrong because Device inventory lists all managed devices with their properties and health status, but it does not support querying for IOCs or historical event data across endpoints.

Full explanation →

333

MCQhard

A multinational corporation uses Microsoft Entra ID for identity management. They want to allow their external partners to use their own corporate credentials to access the company's resources, rather than creating guest accounts. Which Entra ID feature should they use?

A.Entra ID B2C

B.Entra ID Direct Federation

C.Entra ID Verified ID

D.Entra ID External ID

AnswerD

Microsoft Entra External ID is the comprehensive suite of capabilities within Entra ID that enables organizations to securely interact with external users, including partners, customers, and other collaborators. It facilitates various forms of external access, such as B2B collaboration, allowing partners to use their own corporate credentials through federation or other identity providers to access resources in your tenant.

Why this answer

Entra ID External ID (formerly Azure AD External Identities) is the correct feature because it enables external partners to authenticate using their own corporate credentials via federation, without requiring guest accounts. This allows seamless access to the company's resources while maintaining the partner's identity lifecycle.

Exam trap

The trap here is confusing Entra ID B2C (for customers) with External ID (for partners), as both involve external identities but serve different use cases—B2C is for consumer-facing apps with self-service sign-up, while External ID is for enterprise-to-enterprise federation.

How to eliminate wrong answers

Option A is wrong because Entra ID B2C is designed for customer-facing identity management, not for partner access to corporate resources. Option B is wrong because Entra ID Direct Federation is not a standalone feature; it is a configuration within External Identities that supports federation with identity providers like SAML/WS-Fed, but the overarching capability for partner access is External ID. Option C is wrong because Entra ID Verified ID is a decentralized identity solution using verifiable credentials (W3C standards), not for federating partner corporate credentials.

Full explanation →

334

Multi-Selecteasy

Which TWO capabilities are part of Microsoft Entra ID Protection? (Choose two.)

Select 2 answers

A.Passwordless authentication

B.Risk-based conditional access policies

C.Just-in-time privileged access

D.Reports on risky users and sign-ins

E.Conditional access policies for device compliance

AnswersB, D

Microsoft Entra ID Protection is a critical signal source for Conditional Access, enabling the creation of policies that automatically respond to detected risks. These policies can enforce actions like requiring multi-factor authentication, password change, or blocking access entirely when a user or sign-in is deemed risky by ID Protection's machine learning algorithms. This capability allows organizations to dynamically protect resources based on real-time threat intelligence.

Why this answer

Risk-based conditional access policies (B) are a core capability of Microsoft Entra ID Protection, allowing organizations to automatically enforce access controls based on detected risk levels from user and sign-in activities. Reports on risky users and sign-ins (D) provide the foundational telemetry that Entra ID Protection uses to identify and investigate potential identity compromises, making both integral to the service.

Exam trap

The trap here is that candidates confuse the risk-based policies in Entra ID Protection with general Conditional Access policies, but only risk-based policies are part of Entra ID Protection, while device compliance and other conditions belong to the broader Conditional Access service.

Full explanation →

335

MCQmedium

Your organization uses Microsoft Entra ID with P1 licenses. You need to provide a temporary access pass for a new employee to set up their account without a password. Which Microsoft Entra feature should you use?

A.Microsoft Entra Temporary Access Pass

B.Microsoft Entra Privileged Identity Management

C.Microsoft Entra Identity Protection

D.Microsoft Entra Verified ID

AnswerA

Microsoft Entra Temporary Access Pass (TAP) is a time-limited passcode issued by an administrator, specifically designed to enable passwordless onboarding and account recovery. It allows users to sign in without their primary password, register passwordless authentication methods like FIDO2 security keys or Microsoft Authenticator, and then expire, ensuring a secure transition to a fully passwordless state. This mechanism is crucial for new employees or users who have lost their primary authentication method, providing a secure initial access point.

Why this answer

The Temporary Access Pass (TAP) is a time-limited passcode issued by an administrator that allows a user to register passwordless authentication methods (e.g., Microsoft Authenticator, FIDO2 security key) without needing an existing password. This directly meets the requirement for a new employee to set up their account without a password, and it is available with Microsoft Entra ID P1 licenses.

Exam trap

The trap here is that candidates often confuse Privileged Identity Management (PIM) with any 'temporary' access feature, but PIM grants temporary privileged roles, not a passwordless onboarding token.

How to eliminate wrong answers

Option B is wrong because Privileged Identity Management (PIM) is used for just-in-time privileged role activation and access reviews, not for issuing temporary credentials for passwordless onboarding. Option C is wrong because Identity Protection detects and remediates identity-based risks (e.g., leaked credentials, sign-in anomalies) but does not provide a mechanism to create a temporary pass for initial setup. Option D is wrong because Verified ID is a decentralized identity solution for issuing and verifying verifiable credentials (e.g., diplomas, IDs) and is unrelated to temporary access passes for passwordless registration.

Full explanation →

336

MCQmedium

Your company uses Microsoft Entra ID. You need to enforce that all users register for MFA within 14 days of account creation. Which feature should you use?

A.Identity Protection

B.MFA registration campaign

C.Conditional Access

D.Security defaults

AnswerB

The Microsoft Entra ID MFA registration campaign policy is specifically designed to drive user adoption of multi-factor authentication by actively prompting users to register their MFA methods. This feature allows administrators to configure a grace period, expressed as a specific number of days, during which users are repeatedly prompted to register before MFA becomes mandatory for all sign-ins. It directly addresses the need to enforce registration within a customizable, set number of days.

Why this answer

The MFA registration campaign is specifically designed to nudge users to register for MFA within a configurable time frame after account creation. It sends targeted notifications and enforces registration by blocking access until the user completes MFA setup, directly meeting the 14-day requirement.

Exam trap

The trap here is that candidates often confuse Conditional Access (which enforces MFA at sign-in) with the registration campaign (which enforces the initial MFA setup process), not realizing that Conditional Access cannot force a user to register within a specific number of days—it only blocks access if MFA is absent.

How to eliminate wrong answers

Option A is wrong because Identity Protection is a risk-based detection and remediation tool (e.g., detecting leaked credentials or risky sign-ins), not a mechanism to enforce MFA registration deadlines. Option C is wrong because Conditional Access policies can require MFA during sign-in but cannot enforce a registration deadline or send reminder prompts; they only block access if MFA is not already registered. Option D is wrong because Security defaults enforce MFA registration for all users but do not allow a custom 14-day grace period—they require registration at first sign-in with no configurable delay.

Full explanation →

337

MCQeasy

A company wants to automatically apply a 'Confidential' sensitivity label to all documents containing credit card numbers. Which Microsoft Purview feature should be used to create the auto-labeling policy?

A.Microsoft Purview Data Loss Prevention

B.Microsoft Purview Communication Compliance

C.Microsoft Purview Data Lifecycle Management

D.Microsoft Purview Auto-labeling policies

AnswerD

Microsoft Purview Auto-labeling policies are specifically engineered to automatically apply sensitivity labels to content at rest or in transit across Microsoft 365 services. These policies leverage conditions such as sensitive information types, keywords, or trainable classifiers to identify specific content patterns. Upon a match, the designated sensitivity label, like 'confidential,' is automatically applied, ensuring consistent data classification without manual user intervention.

Why this answer

Microsoft Purview Auto-labeling policies are specifically designed to automatically apply sensitivity labels to documents and emails based on conditions such as the presence of sensitive information types (e.g., credit card numbers). This feature uses exact data match or pattern-based detection to label content at rest or in transit, fulfilling the requirement without manual intervention.

Exam trap

The trap here is that candidates often confuse Microsoft Purview Data Loss Prevention (DLP) with auto-labeling because both deal with sensitive data, but DLP enforces actions like blocking or alerting, not applying sensitivity labels automatically.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Data Loss Prevention (DLP) is focused on preventing unauthorized sharing or leakage of sensitive data by enforcing policies on endpoints, apps, and networks, not on automatically applying sensitivity labels. Option B is wrong because Microsoft Purview Communication Compliance is designed to detect and remediate inappropriate communications (e.g., harassment, insider trading) by analyzing messages, not to auto-label documents based on content patterns. Option C is wrong because Microsoft Purview Data Lifecycle Management (formerly Records Management) handles retention, deletion, and disposition of data, not the automatic application of sensitivity labels based on content inspection.

Full explanation →

338

MCQmedium

Your organization uses Microsoft Purview Information Barriers to prevent certain user groups from communicating with each other. You need to test the configuration before fully enforcing it. What should you do?

A.Run the Information Barriers policy in test mode

B.Define user segments in the Microsoft Purview compliance portal

C.Enable audit logging and then run the policy application

D.Use the Compliance Manager assessment for Information Barriers

AnswerA

Running an Information Barriers policy in test mode is the correct approach because it simulates the policy's enforcement without actually blocking any communications. This mode generates a detailed report outlining which users and communications would be affected by the policy, allowing administrators to review potential impacts, identify unintended restrictions, and refine the policy configuration before full activation. It provides a safe, non-disruptive method to validate the policy's effectiveness and accuracy against the organization's requirements.

Why this answer

Microsoft Purview Information Barriers include a dedicated test mode that allows administrators to validate policy behavior against user segments before enforcement. Running the policy in test mode evaluates whether communications between specified segments are correctly blocked or allowed, without actually preventing messages, enabling safe validation of the configuration.

Exam trap

The trap here is that candidates may confuse prerequisite configuration steps (like defining segments or enabling audit logging) with the actual testing mechanism, or assume that Compliance Manager can validate Information Barrier policies when it is designed for broader compliance posture assessment.

How to eliminate wrong answers

Option B is wrong because defining user segments is a prerequisite step for creating Information Barrier policies, not a method to test the configuration before enforcement. Option C is wrong because enabling audit logging captures events for compliance review but does not simulate or test the blocking behavior of Information Barrier policies. Option D is wrong because Compliance Manager is a risk assessment tool for regulatory compliance, not a feature for testing Information Barrier policy enforcement.

Full explanation →

339

MCQeasy

Your organization wants to automatically retain all customer emails for 7 years and then delete them. Which Microsoft Purview feature should you configure?

A.Data Lifecycle Management retention policy

B.Information Protection sensitivity labels

C.Audit log retention

D.eDiscovery hold

AnswerA

A Data Lifecycle Management retention policy is the correct solution because it allows an organization to define how long content should be retained and, optionally, when it should be deleted across various Microsoft 365 services. These policies can be applied broadly to entire locations, such as all Exchange mailboxes or SharePoint sites, ensuring automatic and consistent retention of all customer data according to organizational or regulatory requirements.

Why this answer

Data Lifecycle Management includes retention and deletion policies for Exchange Online. Option B is wrong because Information Protection is about classification. Option C is wrong because Audit is for logging.

Option D is wrong because eDiscovery is for search and hold.

Full explanation →

340

MCQhard

You are a security administrator for Contoso Ltd., a global financial services company with 5,000 employees. The company uses Microsoft 365 E5 licenses and has deployed Microsoft Entra ID, Microsoft Defender XDR, Microsoft Purview, and Microsoft Intune. Recently, the security team identified a risk: employees are sharing sensitive financial reports via external email recipients without encryption. To address this, you need to implement a solution that automatically applies encryption to emails containing the sensitive information type 'U.S. Bank Account Number' when sent to external recipients. The solution must not block the email but should encrypt it. Additionally, you want to notify the sender with a policy tip that the email will be encrypted. You have access to the Microsoft Purview compliance portal. What should you configure?

A.Configure an email encryption rule in Microsoft Defender for Office 365.

B.Create a Data Loss Prevention (DLP) policy in Microsoft Purview that detects 'U.S. Bank Account Number' and applies encryption to emails sent to external recipients, with a policy tip.

C.Enable Microsoft Purview Message Encryption for all users.

D.Create a sensitivity label with encryption and publish it to all users, then train users to apply it manually.

AnswerB

DLP can automatically apply encryption and show policy tips.

Why this answer

A Data Loss Prevention (DLP) policy in Microsoft Purview can automatically detect sensitive information types like 'U.S. Bank Account Number' and apply encryption to emails sent to external recipients, while also showing a policy tip to notify the sender. Option A is incorrect because Microsoft Defender for Office 365 does not provide DLP policies; DLP is part of Microsoft Purview.

Option C is incorrect because simply enabling Message Encryption for all users does not automatically apply encryption based on content; it requires a DLP policy or other mechanism. Option D is incorrect because sensitivity labels require manual application or auto-labeling rules, whereas DLP can automatically enforce encryption based on conditions like sensitive data detection.

Full explanation →

341

MCQeasy

Your organization's security team wants to automatically investigate and respond to sophisticated email threats like business email compromise (BEC) without manual intervention. Which Microsoft 365 security solution should you use?

A.Microsoft Defender for Cloud Apps

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Identity

D.Microsoft Defender for Office 365

AnswerD

Microsoft Defender for Office 365 is the specialized security solution designed to protect organizations from sophisticated threats in email, links, and collaboration tools like Microsoft Teams, SharePoint, and OneDrive. It offers advanced anti-phishing, anti-malware, and anti-spam capabilities, along with Safe Attachments and Safe Links to neutralize threats. Crucially, it includes Automated Investigation and Response (AIR) capabilities that automatically investigate and remediate email-borne threats such as Business Email Compromise (BEC), making it the correct choice for this scenario.

Why this answer

Microsoft Defender for Office 365 includes automated investigation and response (AIR) capabilities specifically designed to handle sophisticated email threats like business email compromise (BEC). It uses machine learning models and heuristics to detect BEC patterns—such as spoofed domains, compromised accounts, and social engineering—and can automatically trigger playbooks to contain, investigate, and remediate threats without manual intervention.

Exam trap

The trap here is that candidates often confuse 'email threat protection' with 'endpoint' or 'identity' solutions, mistakenly thinking BEC is an identity attack rather than an email-specific social engineering threat.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud Apps focuses on shadow IT discovery, cloud app permissions, and data protection across SaaS applications, not on email-specific threats like BEC. Option B is wrong because Microsoft Defender for Endpoint protects endpoints (devices) from malware, exploits, and file-based attacks, but does not natively analyze email headers or message content for BEC. Option C is wrong because Microsoft Defender for Identity monitors on-premises Active Directory signals for identity-based attacks (e.g., pass-the-hash, Kerberoasting), not email-borne social engineering attacks.

Full explanation →

342

Multi-Selectmedium

Which TWO of the following are capabilities of Microsoft Defender for Cloud Apps?

Select 2 answers

A.Information protection for files in Microsoft 365

B.Session controls to monitor and control app access in real time

C.Cloud discovery to identify shadow IT

D.Identity governance and access reviews

E.Vulnerability assessment for Azure virtual machines

AnswersB, C

Session controls are a core capability of Microsoft Defender for Cloud Apps, functioning as a Cloud Access Security Broker (CASB). These controls enable real-time monitoring and intervention for user sessions accessing cloud applications, allowing organizations to enforce policies such as blocking downloads of sensitive data, requiring step-up authentication, or protecting uploads of unclassified files. This ensures data protection and compliance even when users are accessing apps from unmanaged devices.

Why this answer

Microsoft Defender for Cloud Apps provides session controls that leverage reverse proxy architecture to monitor and control user app access in real time, enabling conditional access policies for cloud apps. Cloud discovery uses traffic logs from network appliances or Windows endpoints to identify shadow IT by analyzing app usage and risk scores.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud Apps with Microsoft Defender for Cloud (formerly Azure Security Center) or Microsoft Purview, leading them to select options like vulnerability assessment or information protection that belong to other services.

Full explanation →

343

MCQmedium

A company maintains an on-premises Active Directory environment with over 10,000 domain-joined computers. The security team is concerned about advanced attacks that use stolen credentials to move laterally, such as pass-the-hash attacks or DCSync attacks targeting domain controllers. They need a solution that monitors on-premises Active Directory traffic and event logs to detect these identity-based threats and provides alerts for investigation. Which Microsoft security solution should they deploy?

A.Microsoft Defender for Identity

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Cloud Apps

D.Microsoft Sentinel

AnswerA

Microsoft Defender for Identity is purpose-built to protect hybrid identity environments, specifically monitoring on-premises Active Directory domain controllers. It deploys lightweight sensors directly on domain controllers to profile network traffic and event logs, detecting advanced threats like Pass-the-Hash, Golden Ticket attacks, and DCSync. This specialized focus allows it to identify suspicious user and entity behavior patterns indicative of compromise within the AD infrastructure, providing critical alerts for security teams.

Why this answer

Microsoft Defender for Identity is the correct solution because it is specifically designed to monitor on-premises Active Directory traffic and event logs to detect advanced identity-based threats like pass-the-hash, pass-the-ticket, and DCSync attacks. It uses behavioral analytics and machine learning to identify suspicious activities, such as anomalous Kerberos ticket requests or replication attempts, and provides real-time alerts for investigation.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Identity with Microsoft Sentinel, assuming that a SIEM is always the best choice for threat detection, but Sentinel lacks the specialized Active Directory protocol-level analysis and behavioral models that Defender for Identity provides natively.

Why the other options are wrong

Microsoft Defender for Endpoint focuses on endpoint devices (e.g., malware, vulnerabilities) and does not natively monitor on-premises Active Directory traffic or event logs for identity-based attacks like pass-the-hash or DCSync.

Microsoft Defender for Cloud Apps focuses on securing cloud applications and detecting threats in cloud services, not on-premises Active Directory traffic or lateral movement attacks like pass-the-hash or DCSync.

Microsoft Sentinel is a SIEM/SOAR platform that ingests logs from multiple sources, but it does not natively monitor on-premises Active Directory traffic or detect identity-based attacks like pass-the-hash or DCSync without additional data connectors and analytics rules. The question specifically asks for a solution that monitors on-premises AD traffic and event logs for identity threats, which is the core function of Defender for Identity, not Sentinel.

When would these options actually be correct?

A company needs to detect and respond to advanced threats on endpoints, such as fileless malware, ransomware, or suspicious PowerShell execution, and requires endpoint detection and response (EDR) capabilities for its domain-joined computers.

A company uses multiple SaaS applications (e.g., Office 365, Salesforce) and needs to detect anomalous user behavior, data exfiltration, or compromised accounts in the cloud. They require a Cloud Access Security Broker (CASB) to monitor and control cloud app usage.

A question where the requirement is to centralize security logs from multiple sources (including on-premises AD, cloud apps, and endpoints) into a single platform for advanced threat hunting, correlation, and automated response across the entire environment. For example: 'The security team needs a unified SIEM solution to collect logs from on-premises AD, Azure AD, and third-party firewalls for incident investigation and automated playbooks.'

Why candidates pick the wrong answer

Candidates may confuse endpoint security with identity security, assuming that protecting domain-joined computers automatically covers Active Directory threat detection.

Candidates may think 'cloud apps' includes Active Directory in the cloud (Azure AD) or assume the solution covers all identity threats, but it is specifically for cloud application security, not on-prem AD monitoring.

Candidates may think Sentinel is the most comprehensive solution and assume it can directly monitor AD traffic, not realizing it requires additional configuration and data sources, while Defender for Identity is purpose-built for on-premises AD identity threats.

Full explanation →

344

MCQhard

Your organization uses Microsoft Defender XDR (formerly Microsoft 365 Defender). A user reports receiving a suspicious email with a link. The email was not blocked by Exchange Online Protection (EOP). Which feature should you use to investigate the link's reputation in real time?

A.Exchange Online Protection (EOP) filtering

B.Anti-phish policy

C.Safe Attachments policy

D.Safe Links policy

AnswerD

Safe Links policies provide real-time, click-time protection by dynamically rewriting URLs in emails and supported Office documents. When a user clicks a rewritten link, it is scanned against continuously updated reputation lists and, if necessary, detonated in a sandbox, blocking access to malicious sites. This ensures dynamic protection against evolving web-based threats and provides detailed reporting for security teams.

Why this answer

Safe Links is the correct feature because it provides real-time URL reputation checking at the time of click. When a user clicks a link in an email, Safe Links checks the link against Microsoft's threat intelligence to determine if it is malicious, even if the email itself was not blocked by EOP. This allows investigation of the suspicious link's reputation after delivery.

Exam trap

The trap here is that candidates confuse Safe Links with Safe Attachments, thinking both handle links, but Safe Attachments only scans file attachments, not URLs embedded in email bodies.

How to eliminate wrong answers

Option A is wrong because Exchange Online Protection (EOP) filtering is a pre-delivery filter that blocks known spam and malware, but it does not perform real-time link reputation checks after delivery. Option B is wrong because Anti-phish policy protects against phishing attempts by analyzing sender and message patterns, but it does not provide on-click URL reputation scanning. Option C is wrong because Safe Attachments policy scans email attachments for malware, not links within the message body.

Full explanation →

345

MCQmedium

Your company uses Microsoft Purview to protect sensitive data in SharePoint Online. You need to automatically apply a 'Confidential' sensitivity label to documents containing credit card numbers. What should you create?

A.An auto-labeling policy

B.A Data Loss Prevention (DLP) policy

C.A retention policy

D.An eDiscovery case

AnswerA

An auto-labeling policy in Microsoft Purview Information Protection is specifically designed to automatically apply sensitivity labels to content that matches predefined conditions. These conditions can include the presence of specific sensitive information types (e.g., credit card numbers, national ID numbers), keywords, or even content identified by trainable classifiers. This proactive approach ensures consistent classification and protection of sensitive data at scale, reducing reliance on manual user labeling.

Why this answer

Auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels based on sensitive info types, such as credit card numbers. Option B (DLP policy) is incorrect because while DLP can detect and protect sensitive data, it does not automatically apply labels; it applies actions like blocking or warning. Option C (retention policy) is incorrect because retention policies manage data retention and deletion, not labeling.

Option D (eDiscovery case) is incorrect because eDiscovery cases are used for searching and legal hold purposes.

Full explanation →

346

MCQhard

A security analyst wants to create a custom detection rule that tracks a specific multi-stage attack pattern: a user receives a phishing email, clicks a link, and then a script is executed on their device. The analyst needs to write a Kusto Query Language (KQL) query to detect this pattern and schedule it to run automatically, generating alerts. Which Microsoft 365 Defender capability should they use?

A.Advanced hunting

B.Custom detection rules

C.Automation

D.Threat analytics

AnswerB

Correct. Custom detection rules allow you to create a KQL query from advanced hunting and schedule it to run automatically, generating alerts for matching events.

Why this answer

Custom detection rules in Microsoft 365 Defender allow security analysts to write KQL queries that run on a schedule and automatically generate alerts when the query returns results. This capability is specifically designed to detect multi-stage attack patterns, such as the phishing email → link click → script execution chain described, by querying advanced hunting data and triggering incident creation.

Exam trap

The trap here is that candidates confuse Advanced hunting (a query tool) with Custom detection rules (a scheduled alerting engine), assuming that writing a KQL query in Advanced hunting alone is sufficient for automated detection, when in fact it requires the custom detection rule framework to run on a schedule and generate alerts.

How to eliminate wrong answers

Option A is wrong because Advanced hunting is an interactive query interface for exploring raw data, but it does not natively support scheduled execution or automatic alert generation; it requires manual execution or integration with custom detection rules. Option C is wrong because Automation in Microsoft 365 Defender refers to automated investigation and response (AIR) playbooks that react to alerts, not to the creation of custom detection queries or scheduled alert rules. Option D is wrong because Threat analytics provides curated threat intelligence reports and pre-built detections from Microsoft, but it does not allow users to write custom KQL queries or schedule their own detection logic.

Full explanation →

347

MCQmedium

A security team wants to discover which cloud applications (such as Dropbox, Salesforce, or unsanctioned file-sharing apps) are being used by employees, even if those apps are not sanctioned by IT. They need to analyze usage patterns, risk levels, and identify potential shadow IT. Which feature of Microsoft Defender for Cloud Apps should they enable?

A.App Connectors (API connectors)

B.Cloud Discovery

C.Conditional Access App Control

D.Microsoft Defender for Endpoint

AnswerB

Cloud Discovery, a core feature of Microsoft Defender for Cloud Apps (MDCA), is specifically designed to identify all cloud applications accessed by users within an organization. It achieves this by analyzing network traffic logs from firewalls, proxies, and other network devices, correlating IP addresses and URLs to known cloud services. This process provides a comprehensive overview of both sanctioned and unsanctioned "shadow IT" applications, which is precisely what a security team needs for initial discovery.

Why this answer

Cloud Discovery is the correct feature because it analyzes traffic logs from firewalls and proxies to identify cloud app usage, including unsanctioned apps like Dropbox or Salesforce, without requiring API integration. It provides risk scores, usage patterns, and shadow IT detection by comparing discovered apps against Microsoft's cloud app catalog of over 31,000 apps.

Exam trap

The trap here is that candidates often confuse Cloud Discovery (passive log analysis for unsanctioned apps) with App Connectors (active API integration for sanctioned apps), assuming both can discover shadow IT, but only Cloud Discovery identifies apps not already connected via API.

How to eliminate wrong answers

Option A is wrong because App Connectors (API connectors) require explicit admin consent and API access to sanctioned apps, so they cannot discover unsanctioned or unknown shadow IT apps. Option C is wrong because Conditional Access App Control enforces real-time access policies on sanctioned apps via reverse proxy, not discovery of unsanctioned apps. Option D is wrong because Microsoft Defender for Endpoint is an endpoint detection and response (EDR) solution focused on malware, vulnerabilities, and device threats, not cloud app discovery.

Full explanation →

348

MCQmedium

Your company uses Microsoft Defender for Cloud Apps to discover shadow IT. You have discovered a new cloud app that employees are using to store corporate data. The app is not sanctioned. You need to sanction the app but also ensure that users cannot upload sensitive data to it. You have configured a session policy to monitor the app. What additional step should you take?

A.Create a file policy in Microsoft Defender for Cloud Apps that detects sensitive data and blocks uploads.

B.Block the app entirely by adding it to the blocked list.

C.Configure a Conditional Access policy to require device compliance for the app.

D.Use the session policy to block all uploads to the app.

AnswerA

File policies can block uploads of sensitive data.

Why this answer

A file policy in Defender for Cloud Apps can detect sensitive data in files and block uploads, allowing the app to be sanctioned while preventing data leakage. Option B is incorrect because blocking the app entirely prevents its use, which is not the goal. Option C is incorrect because Conditional Access policies control access based on conditions like device compliance, not content-based blocking.

Option D is incorrect because the session policy currently only monitors; to block uploads based on content, you need a file policy.

Full explanation →

349

Multi-Selecteasy

Which THREE are capabilities of Microsoft Defender for Cloud?

Select 3 answers

A.Just-in-time (JIT) VM access

B.Vulnerability assessment for virtual machines

C.Cloud Security Posture Management (CSPM)

D.DDoS protection

E.SIEM and security orchestration

AnswersA, B, C

Reduces attack surface with managed access.

Why this answer

Just-in-time (JIT) VM access is a capability of Microsoft Defender for Cloud that reduces the attack surface by locking down inbound traffic to Azure VMs. It uses Network Security Group (NSG) rules to allow access only when requested by an authorized user, for a specified time window, and from a specific IP address. This prevents persistent open management ports like RDP (TCP 3389) or SSH (TCP 22) from being exposed to the internet.

Exam trap

The trap here is that candidates confuse the 'recommendations' or 'alerts' shown in Defender for Cloud (which may mention DDoS or SIEM integration) with Defender for Cloud's own native capabilities, leading them to incorrectly select D or E as direct features.

Full explanation →

350

MCQeasy

A company wants to use Microsoft Entra ID (Azure AD) to enforce multi-factor authentication (MFA) for all users accessing sensitive applications. Which security feature should they implement?

A.Privileged Identity Management (PIM)

B.Conditional Access policies

C.Password Protection

D.Identity Protection policies

AnswerB

Conditional Access policies are the primary tool within Microsoft Entra ID for enforcing specific access controls based on various conditions evaluated at sign-in. These policies allow administrators to define "if-then" statements, such as "if a user is accessing a specific cloud application, then require multi-factor authentication." This capability directly addresses the requirement to enforce MFA for designated applications, providing granular control over access.

Why this answer

Conditional Access policies allow administrators to enforce MFA based on conditions such as application sensitivity, user risk, or location. Option A (Privileged Identity Management) is incorrect because it manages just-in-time access for privileged roles, not MFA enforcement. Option C (Password Protection) is incorrect because it blocks weak passwords but does not enforce MFA.

Option D (Identity Protection) is incorrect because it detects identity risks and can trigger remediation but does not directly enforce MFA.

Full explanation →

351

MCQhard

Your organization has a Microsoft Entra ID tenant with 5,000 users. You need to implement a solution that automatically detects and remediates users with leaked credentials. Additionally, you need to require users to change their password when a high risk is detected. Which Microsoft Entra features should you configure?

A.Enable Microsoft Entra Identity Protection, configure a user risk policy to require password change when risk is medium or high.

B.Create an Access Review for all users and require them to confirm their access quarterly.

C.Enable Privileged Identity Management (PIM) and require multi-factor authentication for all role activations.

D.Configure a Conditional Access policy to require password change when sign-in risk is high.

AnswerA

Microsoft Entra Identity Protection actively monitors for various risk detections, including leaked credentials, which are identified through dark web monitoring and other sources. A user risk policy, configured within Identity Protection, can then automatically enforce remediation actions like requiring a password change when a user's aggregated risk level (e.g., medium or high) indicates potential compromise. This direct linkage ensures that detected credential compromises are promptly addressed.

Why this answer

Microsoft Entra Identity Protection detects leaked credentials by monitoring for credential exposures on the dark web and other sources. Configuring a user risk policy to require a password change when risk is medium or high automatically remediates the detected risk by forcing the user to update their password, directly addressing the requirement for automatic detection and remediation.

Exam trap

The trap here is confusing user risk (which detects leaked credentials and other user-level threats) with sign-in risk (which evaluates real-time session anomalies), leading candidates to incorrectly select Option D, which only addresses sign-in risk and not the required leaked credential detection.

How to eliminate wrong answers

Option B is wrong because Access Reviews are designed for periodic attestation of access rights, not for detecting or remediating leaked credentials or enforcing password changes based on risk. Option C is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role activation and requires MFA for those activations, but it does not detect leaked credentials or enforce user password changes for general users. Option D is wrong because a Conditional Access policy can require a password change only when sign-in risk is high, but it does not automatically detect leaked credentials; sign-in risk evaluates real-time session anomalies, not leaked credential exposure, and the question specifically requires detection of leaked credentials, which is a user risk feature.

Full explanation →

352

MCQmedium

A security operations team needs to protect Windows servers from ransomware and other advanced threats. They require a solution that provides endpoint detection and response (EDR), automated investigation, and the ability to isolate compromised machines from the network. Which Microsoft security solution should they deploy?

A.Microsoft Defender for Cloud

B.Microsoft Defender for Identity

C.Microsoft Defender for Office 365

D.Microsoft Defender for Endpoint

AnswerD

Microsoft Defender for Endpoint is the correct solution as it provides comprehensive endpoint detection and response (EDR), vulnerability management, and threat protection specifically for Windows servers and clients. It actively monitors for malicious activity, automates investigations, and can isolate compromised devices, directly addressing the need to protect servers from various threats.

Why this answer

Microsoft Defender for Endpoint (MDE) is the correct solution because it provides endpoint detection and response (EDR), automated investigation and remediation, and network isolation capabilities specifically for Windows servers and endpoints. These features directly address the requirement to protect against ransomware and advanced threats by detecting suspicious behavior, automatically investigating alerts, and allowing admins to isolate compromised machines from the network to prevent lateral movement.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a cloud security posture tool) with Microsoft Defender for Endpoint (an endpoint protection platform), especially since both names include 'Defender' and 'Cloud' can be misassociated with server workloads.

Why the other options are wrong

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) for multicloud environments, not an endpoint detection and response (EDR) solution for Windows servers. It lacks the ability to isolate compromised machines from the network.

Microsoft Defender for Identity focuses on protecting on-premises Active Directory identities and detecting identity-based attacks, not on endpoint detection, response, or isolation of compromised machines.

Microsoft Defender for Office 365 protects email and collaboration tools like Exchange Online and SharePoint, not Windows servers. It lacks endpoint detection and response (EDR) and network isolation capabilities for servers.

When would these options actually be correct?

A question asks: 'A company uses Azure and AWS and needs to assess security configurations, detect misconfigurations, and protect cloud workloads across both platforms. Which Microsoft solution should they use?'

A question asking for a solution to monitor and detect suspicious activities related to user accounts and Kerberos authentication in an on-premises Active Directory environment, especially to prevent lateral movement and privilege escalation.

A question asking for a solution to protect users from phishing, malicious attachments, and unsafe links in email and Office 365 apps, with features like Safe Attachments and Safe Links, would have Microsoft Defender for Office 365 as the correct answer.

Why candidates pick the wrong answer

Candidates may confuse 'cloud' in the name with protecting servers in the cloud, or assume it includes endpoint protection for cloud-based servers.

Candidates may confuse 'identity' with 'endpoint' security, or think that protecting identities is sufficient to stop ransomware, overlooking the need for EDR and machine isolation.

Candidates may confuse 'Office 365' with general Microsoft security, or assume it covers all Microsoft products, not realizing it is limited to cloud-based productivity suites.

Full explanation →

353

Multi-Selectmedium

Which TWO of the following are capabilities of Microsoft Entra ID? (Select two.)

Select 2 answers

A.Antivirus and antimalware protection

B.Identity as a Service (IDaaS) for cloud applications

C.Provide network firewall services

D.Manage mobile devices and applications

E.Single sign-on (SSO) to thousands of SaaS applications

AnswersB, E

Microsoft Entra ID serves as a comprehensive Identity as a Service (IDaaS) solution, providing a cloud-based platform for managing digital identities and controlling access to various cloud applications. It enables organizations to centralize user accounts, enforce authentication policies, and provision users to Software as a Service (SaaS) applications and custom cloud applications. This capability streamlines identity management operations and enhances security across diverse cloud environments.

Why this answer

Microsoft Entra ID is a cloud-based identity and access management service, providing Identity as a Service (IDaaS) for cloud applications. It enables organizations to manage user identities and control access to resources, including thousands of pre-integrated SaaS applications through single sign-on (SSO). This makes option B correct because Entra ID's core function is identity management, not endpoint security or network infrastructure.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID with broader security suites like Microsoft 365 Defender or Azure security services, mistakenly attributing endpoint protection or network firewall capabilities to identity management.

Full explanation →

354

MCQhard

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel. The JSON snippet shows a rule designed to create an incident when a high-severity alert is generated. However, the rule is not triggering. What is the most likely reason?

A.The logicAppResourceId is missing a required parameter.

B.The action should be of type 'Microsoft.SecurityInsights/AlertRule/Alert' instead.

C.Automation rules triggered on alert creation cannot create incidents; they can only run playbooks.

D.The trigger type is incorrect; it should be 'Microsoft.SecurityInsights/Incident'.

AnswerC

Automation rules configured to trigger upon the creation of an alert have a specific limitation regarding their direct actions. While they can successfully execute a playbook, which in turn can create an incident, the automation rule itself cannot directly perform a 'createIncident' action. This distinction is crucial for understanding the flow of operations, as direct incident creation is typically reserved for rules triggered by incident-related events.

Why this answer

Automation rules in Microsoft Sentinel that are triggered on alert creation (i.e., when an alert is generated) are designed only to run playbooks (automated response actions), not to create incidents. Incident creation from alerts is handled automatically by Sentinel's built-in analytics rules or by the incident creation rule type, not by an automation rule triggered on alert creation. The JSON snippet shows a trigger type of 'Microsoft.SecurityInsights/AlertRule/Alert', which confirms the rule fires on alert creation, and the action attempts to create an incident, which is not supported for this trigger type.

Exam trap

The trap here is that candidates often assume automation rules can freely create incidents from any trigger type, but Microsoft Sentinel strictly limits incident creation to analytics rule configurations or incident-scoped automation rules, not alert-scoped automation rules.

How to eliminate wrong answers

Option A is wrong because the logicAppResourceId is not missing a required parameter; the issue is not about missing parameters but about the fundamental incompatibility of the trigger type with the action. Option B is wrong because the action type 'Microsoft.SecurityInsights/AlertRule/Alert' would be incorrect for creating an incident; the correct action type for creating an incident is 'Microsoft.SecurityInsights/Incident', but even that action type is not allowed when the trigger is on alert creation. Option D is wrong because the trigger type 'Microsoft.SecurityInsights/AlertRule/Alert' is correct for an automation rule that fires when an alert is generated; changing it to 'Microsoft.SecurityInsights/Incident' would make the rule trigger on incident creation, not alert creation, which does not solve the problem of creating an incident from an alert.

Full explanation →

355

MCQhard

Your company uses Microsoft Defender for Cloud to secure multicloud workloads. You need to ensure that regulatory compliance frameworks (e.g., SOC 2, ISO 27001) are continuously assessed and any drift is reported. What should you implement?

A.Regulatory compliance standards in Microsoft Defender for Cloud

B.Microsoft Sentinel analytics rules

C.Azure Policy initiatives

D.Microsoft Defender for Cloud Apps session policies

AnswerA

Regulatory compliance standards in Microsoft Defender for Cloud provide continuous assessment of your cloud environment against a wide array of industry and regulatory benchmarks, such as ISO 27001, SOC 2, and PCI DSS. It automatically maps security recommendations to specific controls within these standards, offering a compliance score and detailed reports. This feature helps organizations understand their current compliance posture and provides actionable insights to remediate non-compliant resources, simplifying the audit preparation process.

Why this answer

Regulatory compliance standards in Defender for Cloud provide continuous assessment against frameworks. Option B is wrong because Microsoft Sentinel is for SIEM/SOAR, not compliance assessment. Option C is wrong because Azure Policy is used for policy enforcement, not assessment of compliance frameworks.

Option D is wrong because Defender for Cloud Apps focuses on cloud app security.

Full explanation →

356

MCQhard

Refer to the exhibit. A security analyst is reviewing an alert from Microsoft 365 Defender. The alert is associated with an incident. What is the best first step to investigate this alert?

A.Open the associated incident to view all related alerts and entities.

B.Isolate the affected user's device immediately.

C.Mark the alert as resolved.

D.Run an automated simulation to test the alert.

AnswerA

An incident aggregates multiple related alerts and entities (users, devices, mailboxes, IP addresses) into a single investigation unit. This holistic view is crucial for understanding the scope, impact, and attack chain, preventing siloed investigations of individual alerts. It allows for comprehensive threat hunting and response planning, making it the most effective initial step for a security analyst.

Why this answer

Microsoft 365 Defender incidents aggregate multiple alerts and entities (users, devices, mailboxes) into a single view, providing the full context needed to understand the attack chain. Opening the incident first allows the analyst to correlate the alert with related alerts, affected assets, and the incident timeline, which is the recommended initial step in incident response workflows.

Exam trap

The trap here is that candidates often jump to an immediate containment action (like isolating a device) without first gathering context, but Microsoft's incident-first approach emphasizes investigation before remediation to avoid false positives and ensure proportional response.

How to eliminate wrong answers

Option B is wrong because isolating the user's device immediately is a reactive containment step that should be taken only after confirming the device is compromised through incident investigation; premature isolation can disrupt legitimate operations and lose forensic evidence. Option C is wrong because marking the alert as resolved without investigation violates security best practices and could allow an active threat to persist undetected. Option D is wrong because running an automated simulation tests detection capabilities but does not help investigate a real, active alert; it is a testing or validation activity, not a response step.

Full explanation →

357

MCQmedium

A company uses Microsoft Entra ID and wants to allow external business partners to request access to a specific application through an approval process. The access should be time-limited and automatically expired. Which Microsoft Entra ID feature should be configured?

A.Conditional Access

B.Entitlement management

C.Privileged Identity Management (PIM)

D.Self-service group management

AnswerB

Microsoft Entra Entitlement Management is designed to streamline the lifecycle of access for both internal and external users, particularly for external partners needing access to specific applications or resources. It utilizes access packages, which bundle resources and define policies for requesting access, including approval workflows, mandatory reviews, and automatic expiration dates. This ensures that external access is granted only when needed, for a specific duration, and with appropriate oversight, making it ideal for managing B2B collaboration securely and efficiently.

Why this answer

Microsoft Entra entitlement management (part of Identity Governance) allows organizations to manage access for internal and external users through access packages, which include policies for requesting, approving, and automatically expiring access. Conditional Access is for enforcing policies during sign-in, PIM manages privileged roles, and self-service group management allows users to manage group membership but does not provide approval workflows or time-limited access for external users out-of-the-box.

Why the other options are wrong

Conditional Access enforces access policies based on signals like user location or device state, but it does not provide time-limited access requests with approval workflows for external partners.

Privileged Identity Management (PIM) manages just-in-time access for privileged roles (e.g., admin roles), not for external partners requesting access to a specific application with time-limited, auto-expiring access.

Self-service group management allows users to create and manage their own groups in Microsoft Entra ID, but it does not provide time-limited access or automated expiration for external partners. It lacks the approval workflows and access packages needed for this scenario.

When would these options actually be correct?

A company needs to require multi-factor authentication for all users accessing a sensitive application from outside the corporate network. Which feature should be configured?

A question asks: 'A company needs to provide time-limited, approvable access to Azure AD administrative roles (e.g., Global Administrator) for IT staff, with automatic expiration.' In that scenario, PIM is the correct feature.

An exam question might ask: 'A company wants to allow employees to create and manage their own groups for collaboration without IT intervention. Which feature should be configured?' In that case, self-service group management would be the correct answer.

Why candidates pick the wrong answer

Candidates may confuse Conditional Access with access management features, thinking it can handle external partner access requests and approvals, but it lacks the lifecycle and approval capabilities of Entitlement Management.

Candidates confuse PIM's time-limited role activation with entitlement management's time-limited resource access, and both involve approvals, leading to a mistaken choice.

Candidates may confuse self-service group management with entitlement management because both involve user-driven access requests, but they overlook the specific requirements for time-limited access and approval processes for external partners.

Full explanation →

358

MCQeasy

Your company wants to allow employees to use their corporate Microsoft Entra ID credentials to sign in to third-party SaaS applications like Salesforce and ServiceNow. Which Microsoft Entra feature should you configure?

A.Conditional Access policies.

B.Microsoft Entra B2B collaboration.

C.Microsoft Entra Identity Protection.

D.Enterprise applications with pre-integrated gallery apps.

AnswerD

Enterprise applications in Microsoft Entra ID provide the central framework for integrating various applications, including Software as a Service (SaaS) applications. The pre-integrated gallery apps offer ready-to-use templates with pre-configured settings for popular SaaS applications, significantly simplifying the process of enabling Single Sign-On (SSO). This allows employees to access corporate applications using their existing Microsoft Entra credentials without needing to re-authenticate, streamlining access and enhancing security.

Why this answer

Configuring a third-party SaaS application like Salesforce or ServiceNow as an Enterprise Application in Microsoft Entra ID allows you to set up federation using SAML 2.0 or OpenID Connect, enabling users to sign in with their corporate Entra ID credentials. The pre-integrated gallery apps provide pre-configured templates that simplify the setup of single sign-on (SSO) and user provisioning, making it the appropriate feature for this requirement.

Exam trap

The trap here is that candidates confuse Conditional Access (which controls access after authentication) with the actual SSO configuration feature, or they mistakenly think B2B collaboration is for internal users accessing external apps, when it is specifically for external users accessing internal resources.

How to eliminate wrong answers

Option A is wrong because Conditional Access policies are used to enforce access controls (e.g., MFA, location restrictions) after SSO is configured, not to enable the initial sign-in with corporate credentials. Option B is wrong because Microsoft Entra B2B collaboration is designed for inviting external users (guests) from other organizations, not for enabling internal employees to use their corporate credentials for third-party SaaS apps. Option C is wrong because Microsoft Entra Identity Protection is a risk-based security tool that detects and responds to identity threats (e.g., leaked credentials, impossible travel), not a feature for configuring SSO or authentication to external applications.

Full explanation →

359

MCQeasy

A company wants to use Microsoft Sentinel to collect security logs from on-premises servers and send them to Azure. Which data connector should they use?

A.Azure Monitor Agent (AMA)

B.Syslog connector

C.Microsoft Monitoring Agent (MMA)

D.Office 365 connector

AnswerA

The Azure Monitor Agent (AMA) is the correct and recommended solution for collecting security logs from both Windows and Linux servers, including on-premises, for ingestion into Microsoft Sentinel. It offers a more secure, efficient, and flexible data collection experience compared to its predecessor, allowing granular control over which logs are collected via Data Collection Rules (DCRs). AMA supports a wide range of log types, including security events, performance counters, and Syslog, making it ideal for comprehensive security monitoring.

Why this answer

The Azure Monitor Agent (AMA) is the correct choice because it is the current, unified data collection agent for Microsoft Sentinel that supports collecting security logs from Windows and Linux on-premises servers. It replaces the legacy Microsoft Monitoring Agent (MMA) and provides a more secure, scalable, and performant method to send logs to Azure Log Analytics workspaces, which underpin Sentinel.

Exam trap

The trap here is that candidates often confuse the Syslog connector (Option B) as the correct answer for on-premises Linux servers, but the question specifically asks for a data connector that directly collects logs from on-premises servers, and AMA is the modern, unified agent that handles both Windows and Linux without requiring an intermediate Syslog forwarder.

How to eliminate wrong answers

Option B (Syslog connector) is wrong because it is not a data connector for on-premises servers; it is a legacy method that requires a separate Syslog forwarder (e.g., rsyslog) and does not directly collect logs from servers without additional configuration. Option C (Microsoft Monitoring Agent) is wrong because it is the deprecated agent that Microsoft has announced will be retired by August 2024; it lacks the security and performance improvements of AMA, such as support for Azure Private Link and data collection rules. Option D (Office 365 connector) is wrong because it is specifically designed to ingest logs from Microsoft 365 services (e.g., Exchange, SharePoint) and cannot collect security logs from on-premises servers.

Full explanation →

360

MCQmedium

A company uses Microsoft Entra ID. The security team needs to grant temporary elevated access to the Global Administrator role for a specific task, such as configuring a new security policy. They want the user to request activation, which is then approved by a manager, and the privileges automatically expire after 4 hours. Which Microsoft Entra feature should they use?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management (PIM)

D.Self-Service Password Reset (SSPR)

AnswerC

Microsoft Entra Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources within an organization by implementing just-in-time (JIT) access. It enables users to activate privileged roles only when needed and for a limited, predefined duration, often requiring an approval workflow. PIM also provides automatic expiration of assignments and comprehensive auditing, significantly reducing the attack surface associated with standing privileged access.

Why this answer

Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access, allowing users to request activation of roles like Global Administrator. The activation can require approval from a manager and is automatically deactivated after a configurable maximum duration (e.g., 4 hours), directly meeting the security team's requirements.

Exam trap

The trap here is that candidates confuse Privileged Identity Management (PIM) with Conditional Access, because both involve policies and access control, but PIM specifically handles just-in-time privileged role activation with approval and expiration, while Conditional Access focuses on access conditions for all users.

How to eliminate wrong answers

Option A is wrong because Conditional Access enforces policies based on signals like user location or device compliance, but it does not provide time-bound role activation with approval workflows. Option B is wrong because Identity Protection detects and remediates identity-based risks (e.g., leaked credentials), not manage privileged role activation or expiration. Option D is wrong because Self-Service Password Reset (SSPR) allows users to reset their own passwords, not to elevate or manage role assignments.

Full explanation →

361

MCQmedium

A company is migrating its on-premises applications to Azure Infrastructure-as-a-Service (IaaS). According to the shared responsibility model, which of the following security responsibilities shifts from the customer to Microsoft during this migration?

A.Physical security of the data center infrastructure

B.Configuring network security groups (NSGs)

C.Patching the operating system on virtual machines

D.Managing user identities and access to the application

AnswerA

In the Azure Shared Responsibility Model, particularly for Infrastructure as a Service (IaaS) deployments, the cloud provider (Microsoft) is solely responsible for the physical security of the underlying data centers. This includes implementing robust access controls, continuous surveillance, environmental monitoring, and fire suppression systems to protect the hardware and infrastructure where customer data resides. Customers do not have any control or responsibility over the physical facilities.

Why this answer

When migrating on-premises applications to Azure IaaS, the shared responsibility model shifts physical security responsibilities—such as data center access controls, environmental controls, and hardware security—from the customer to Microsoft. Microsoft is responsible for the physical security of all Azure data centers, including perimeter security, surveillance, and facility access management, which were previously the customer's responsibility in their own on-premises environment.

Exam trap

The trap here is that candidates often confuse IaaS with PaaS or SaaS, mistakenly believing that Microsoft takes responsibility for OS patching or network security in IaaS, when in fact those remain customer responsibilities.

How to eliminate wrong answers

Option B is wrong because configuring network security groups (NSGs) remains the customer's responsibility under IaaS, as the customer controls network traffic filtering and segmentation for their virtual networks. Option C is wrong because patching the operating system on virtual machines is the customer's responsibility in IaaS, as Microsoft only manages the underlying hypervisor and physical hosts. Option D is wrong because managing user identities and access to the application is always the customer's responsibility, regardless of deployment model, as Microsoft provides identity services (like Azure AD) but the customer controls who has access and how permissions are configured.

Full explanation →

362

MCQeasy

A user reports that they cannot access a sensitive document in SharePoint Online. The administrator checks the document's permissions and sees that the user is not listed directly, but a group they belong to has been granted access. Which identity concept describes this scenario?

A.Role-based access control (RBAC)

B.Privilege escalation

C.Group-based access control

D.Attribute-based access control (ABAC)

AnswerC

Group-based access control allows permissions to be assigned to groups rather than individuals, simplifying management. This directly matches the scenario where a user gains access because they belong to a group that has been granted access.

Why this answer

Group-based access control allows permissions to be assigned to groups rather than individuals, simplifying management. Option A is wrong because role-based access control is a specific type of group-based access using roles. Option B is wrong because privilege escalation refers to gaining higher permissions, not normal access via groups.

Option D is wrong because attribute-based access control uses user attributes, not group membership.

Full explanation →

363

Multi-Selectmedium

Which TWO of the following are principles of the Zero Trust security model? (Select two.)

Select 2 answers

A.Verify explicitly

B.Perimeter-based security

C.Implicit trust

D.Trust but verify

E.Least privilege access

AnswersA, E

Always authenticate and authorize based on all data points.

Why this answer

The correct principles of Zero Trust are 'Verify explicitly' and 'Use least privilege access' (or 'Least privilege access'). Therefore, options A and E are correct. Option B (Perimeter-based security) is a traditional security model, opposite of Zero Trust.

Option C (Implicit trust) and D (Trust but verify) are not part of Zero Trust; Zero Trust assumes no implicit trust and uses 'verify explicitly' instead.

Full explanation →

364

MCQmedium

A security team needs to investigate a potential data leak where an employee may have emailed sensitive customer information to a competitor. They want to search the unified audit log for specific email activities, such as 'Send' or 'Forward', and generate a detailed report. Which Microsoft Purview solution should they use?

A.Microsoft Purview Compliance Manager

B.Microsoft Purview Data Loss Prevention (DLP)

C.Microsoft Purview Audit (Standard or Premium)

D.Microsoft Purview eDiscovery (Premium)

AnswerC

Microsoft Purview Audit (Standard or Premium) is the essential service for investigating user and administrator activities across Microsoft 365 services, including potential data leaks. It provides access to the unified audit log, which records a vast array of events such as file access, sharing, deletions, and email activities. Investigators can use the Audit log search tool to pinpoint specific actions, users, and timeframes related to a suspected leak, with Premium offering extended retention and advanced capabilities for in-depth forensic analysis.

Why this answer

Microsoft Purview Audit (Standard or Premium) is the correct solution because it captures and logs specific email activities such as 'Send' and 'Forward' from Exchange Online. The security team can search the unified audit log for these operations and export a detailed report for investigation. Compliance Manager, DLP, and eDiscovery do not provide this direct audit log search capability for individual email actions.

Exam trap

The trap here is that candidates confuse Data Loss Prevention (DLP) with audit logging, assuming DLP can retrospectively search for past email actions, when in fact DLP only applies proactive policies and alerts, not historical audit log queries.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Compliance Manager is a risk-assessment and compliance-score tool, not an audit log search tool; it cannot retrieve specific email activities like 'Send' or 'Forward'. Option B is wrong because Microsoft Purview Data Loss Prevention (DLP) is designed to prevent data leaks by applying policies to block or alert on sensitive content, but it does not provide a searchable audit log of past email actions for forensic investigation. Option D is wrong because Microsoft Purview eDiscovery (Premium) is used for legal hold, collection, and review of content for litigation, not for searching the unified audit log for email send/forward events.

Full explanation →

365

MCQmedium

A company uses Azure virtual machines and on-premises Windows servers. The security team wants a single solution that provides vulnerability assessment, a regulatory compliance dashboard (e.g., for ISO 27001), and integrated threat detection such as fileless malware and anomalous logins. Which Microsoft security solution should they use?

A.Microsoft Defender for Endpoint

B.Microsoft Defender for Cloud

C.Microsoft 365 Defender

D.Microsoft Sentinel

AnswerB

Microsoft Defender for Cloud provides comprehensive cloud security posture management (CSPM) and cloud workload protection (CWPP) across Azure, on-premises, and multi-cloud environments. It offers integrated vulnerability assessments, a secure score for continuous security posture improvement, and regulatory compliance dashboards to monitor adherence to industry standards. This service directly addresses the need for unified security management, threat protection, and compliance for both Azure virtual machines and on-premises Windows servers.

Why this answer

Microsoft Defender for Cloud (formerly Azure Security Center and Azure Defender) is the correct choice because it provides unified security management across Azure VMs and on-premises servers. It includes built-in vulnerability assessment (via Qualys or Microsoft Defender Vulnerability Management), a regulatory compliance dashboard with built-in standards like ISO 27001, and integrated threat detection for fileless malware, anomalous logins, and other advanced attacks. This single solution meets all the requirements listed in the question.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud with Microsoft 365 Defender, mistakenly thinking the latter covers all security workloads, but Microsoft 365 Defender is limited to Microsoft 365 services and does not manage Azure infrastructure or on-premises servers.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for devices, but it does not provide a regulatory compliance dashboard for standards like ISO 27001 or native vulnerability assessment across hybrid infrastructure. Option C is wrong because Microsoft 365 Defender is a suite that correlates signals from Microsoft 365 services (e.g., Defender for Endpoint, Defender for Office 365) and is not designed to manage security posture or compliance for Azure VMs and on-premises servers. Option D is wrong because Microsoft Sentinel is a cloud-native SIEM/SOAR solution for log collection and incident response, but it does not include built-in vulnerability assessment or a pre-configured regulatory compliance dashboard; those capabilities require additional integration and configuration.

Full explanation →

366

MCQmedium

A company uses Microsoft Entra ID. The security team wants to provide just-in-time (JIT) administrative access to Azure resources. They require that administrators must request approval before gaining elevated privileges, and that the elevated access automatically expires after the task is completed. Which Microsoft Entra capability should they use?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management (PIM)

D.Self-Service Password Reset (SSPR)

AnswerC

Correct. PIM enables just-in-time privileged access, requiring approval and setting time-bound access that automatically expires.

Why this answer

Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure resources with time-bound activation, approval workflows, and automatic expiration. PIM allows administrators to request elevation for a specific role, which must be approved by designated approvers, and the elevated access automatically expires after the configured duration (e.g., 1–8 hours). This directly meets the security team's requirements for approval-based, time-limited administrative access.

Exam trap

The trap here is that candidates often confuse Conditional Access (which controls access to apps and resources) with PIM (which controls time-bound elevation of roles), because both involve 'access' and 'conditions,' but only PIM provides JIT activation with approval and automatic expiration.

How to eliminate wrong answers

Option A is wrong because Conditional Access enforces access policies based on signals like user location or device compliance, but it does not provide JIT role activation, approval workflows, or automatic expiration of elevated privileges. Option B is wrong because Identity Protection detects and remediates identity-based risks (e.g., leaked credentials or sign-ins from anonymous IPs), but it does not manage privileged role assignments or time-bound elevation. Option D is wrong because Self-Service Password Reset (SSPR) allows users to reset their own passwords without administrator intervention, which is unrelated to granting or managing elevated administrative access to Azure resources.

Full explanation →

367

MCQmedium

A company uses Microsoft 365 and must comply with a regulation that requires all business records, including emails and documents, to be retained for exactly 5 years. They need to automatically apply a retention label to any item that contains the keyword 'Contract' when the item is created or modified. Which Microsoft Purview solution should they use to configure this automatic labeling?

A.Data Lifecycle Management

B.Data Loss Prevention (DLP)

C.Audit

D.Compliance Manager

AnswerA

Microsoft Purview Data Lifecycle Management (formerly Information Governance) enables organizations to manage content throughout its lifecycle. It allows the creation of retention labels that can be automatically applied to content in Microsoft 365 locations like Exchange, SharePoint, and OneDrive based on specific conditions, such as keywords, sensitive information types, or trainable classifiers. This capability directly supports compliance regulations by ensuring data is retained or deleted according to policy, without manual intervention, thus meeting the requirement for automatic labeling based on content.

Why this answer

Data Lifecycle Management (DLM) in Microsoft Purview enables automatic retention labeling based on sensitive content, such as keywords like 'Contract'. It uses auto-labeling policies to apply retention labels at the time of creation or modification, ensuring compliance with the 5-year retention requirement without manual intervention.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management with Data Loss Prevention (DLP), assuming DLP can apply retention labels, but DLP only enforces actions like blocking or warning, not retention labeling.

How to eliminate wrong answers

Option B is wrong because Data Loss Prevention (DLP) policies are designed to prevent unauthorized sharing or leakage of sensitive data, not to apply retention labels for lifecycle management. Option C is wrong because Audit in Microsoft Purview records user and admin activities for forensic analysis, but it cannot automatically label items based on content. Option D is wrong because Compliance Manager provides risk assessments and recommendations for regulatory compliance, but it does not apply retention labels or enforce retention policies.

Full explanation →

368

MCQeasy

You run the following PowerShell command in your Microsoft Entra ID environment: Get-AzureADPolicy -Type TokenLifetimePolicy What is the command retrieving?

A.Conditional access policies

B.Named locations

C.Role assignments

D.Token lifetime policies

AnswerD

This cmdlet specifically retrieves token lifetime policies, which define token expiration durations.

Why this answer

The command retrieves all policies of type 'TokenLifetimePolicy', which are used to define token lifetimes. Option A is wrong because conditional access policies use a different type. Option B is wrong because named locations are not policies.

Option C is wrong because role assignments are not policies.

Full explanation →

369

MCQmedium

A company uses Microsoft Entra ID. They want to require all users accessing the external vendor portal to accept a terms of use document before they are granted access. The acceptance must be revoked after 30 days, requiring the user to accept again. Which Conditional Access component should the administrator configure?

A.Assignments

B.Access controls (Grant)

C.Conditions

D.Session controls

AnswerB

Access controls, specifically the "Grant" controls within Conditional Access policies, are precisely where administrators define the requirements users must satisfy to gain access to a resource. This section allows for mandating actions like multifactor authentication, requiring a device to be marked as compliant, or, critically, demanding explicit acceptance of Terms of Use before access is permitted. It directly enforces the "allow or block" decision based on specified conditions.

Why this answer

The administrator needs to enforce a terms of use acceptance that expires after 30 days. In Conditional Access, the 'Access controls (Grant)' section includes the 'Require terms of use' option, which can be configured to require re-acceptance after a specified duration (e.g., 30 days). This directly meets the requirement by blocking access until the user accepts the current version of the terms of use document.

Exam trap

The trap here is that candidates often confuse 'Session controls' (which manage sign-in frequency or app restrictions) with the ability to enforce terms of use acceptance, but only the 'Grant' control can require a terms of use document to be accepted.

How to eliminate wrong answers

Option A is wrong because 'Assignments' define which users, groups, or applications the policy applies to, not the specific access requirements like terms of use acceptance. Option C is wrong because 'Conditions' define signals such as location, device state, or risk level that trigger the policy, but they do not enforce the acceptance of a terms of use document. Option D is wrong because 'Session controls' manage user experience during a session (e.g., app enforced restrictions, sign-in frequency), but they cannot enforce a terms of use acceptance requirement.

Full explanation →

370

Drag & Dropmedium

Arrange the steps to configure Azure AD Privileged Identity Management (PIM) for a role in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

PIM setup involves first accessing PIM, then selecting a role, configuring settings, assigning eligible users, and managing approvals.

Full explanation →

371

MCQmedium

A legal team is handling a lawsuit and needs to gather all electronically stored information (ESI) related to a specific case from across Microsoft 365, including emails, Teams messages, and SharePoint documents. They need to place a hold on the custodians' data to prevent deletion or modification, and then collect, review, and export the data. Which Microsoft Purview solution should they use?

A.Microsoft Purview eDiscovery (Premium)

B.Microsoft Purview eDiscovery (Standard)

C.Microsoft Purview Audit (Premium)

D.Microsoft Purview Data Lifecycle Management

AnswerA

Microsoft Purview eDiscovery (Premium) is the comprehensive solution specifically engineered for managing the entire electronic discovery workflow required for complex legal cases. It enables legal teams to identify specific custodians, place defensible legal holds on their data across Exchange mailboxes, SharePoint sites, OneDrive accounts, and Microsoft Teams, and then perform advanced collection, processing, review, and analysis of electronically stored information (ESI) using features like analytics and predictive coding. This robust capability ensures all relevant data is preserved and efficiently prepared for litigation.

Why this answer

Microsoft Purview eDiscovery (Premium) is the correct solution because it provides end-to-end workflow for legal cases, including the ability to place legal holds on custodians' data across Exchange, Teams, SharePoint, and OneDrive to preserve ESI, and then collect, review, and export that data. The Premium tier adds advanced features like custodian management, review sets, and predictive coding, which are essential for complex litigation scenarios.

Exam trap

The trap here is that candidates confuse eDiscovery (Standard) with eDiscovery (Premium), assuming the Standard tier can handle custodian holds and advanced review, but only Premium provides the full legal hold and collection workflow required for complex litigation.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview eDiscovery (Standard) lacks custodian-based holds, advanced review sets, and predictive coding; it is designed for basic search and export, not for managing complex legal holds and multi-source collection. Option C is wrong because Microsoft Purview Audit (Premium) focuses on logging and investigating user and admin activities, not on placing holds or collecting and exporting ESI for litigation. Option D is wrong because Microsoft Purview Data Lifecycle Management is used for retention and deletion policies (e.g., managing data expiration), not for legal hold, collection, or review of ESI in active litigation.

Full explanation →

372

MCQmedium

A company uses Microsoft 365 and needs to protect endpoints from ransomware attacks that encrypt files. The security team wants automated investigation and response capabilities for malware incidents on Windows devices. Which Microsoft security solution should they use?

A.Microsoft Defender for Office 365

B.Microsoft Defender for Cloud Apps

C.Microsoft Defender for Identity

D.Microsoft Defender for Endpoint

AnswerD

Microsoft Defender for Endpoint delivers a comprehensive endpoint security solution for devices across various platforms, including Windows, macOS, Linux, Android, and iOS. It integrates next-generation antivirus, Endpoint Detection and Response (EDR) capabilities, automated investigation and remediation, and vulnerability management to proactively protect against and respond to sophisticated threats. This service is specifically engineered to secure endpoints from malware, exploits, and other malicious activities, making it the correct choice for device protection.

Why this answer

Microsoft Defender for Endpoint (D) is the correct answer because it provides endpoint detection and response (EDR) capabilities, including automated investigation and remediation for malware incidents on Windows devices. It uses behavioral sensors, cloud analytics, and threat intelligence to detect ransomware encryption behavior and automatically contain or remediate affected endpoints, aligning with the requirement for automated response.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Office 365 (which protects email and collaboration) with endpoint protection, failing to recognize that automated investigation and response for Windows devices specifically requires an endpoint-focused solution like Microsoft Defender for Endpoint.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Office 365 protects email, SharePoint, and Teams from phishing and malware, not endpoints like Windows devices. Option B is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that governs cloud app usage and data, not endpoint-level ransomware protection. Option C is wrong because Microsoft Defender for Identity monitors on-premises Active Directory for identity-based attacks (e.g., Kerberos abuse), not file-encrypting ransomware on endpoints.

Full explanation →

373

MCQeasy

You are configuring Microsoft Entra ID Governance. You need to ensure that when a user leaves the organization, their access to all SaaS applications is automatically revoked. Which Microsoft Entra feature should you use?

A.Microsoft Entra Conditional Access

B.Microsoft Entra Privileged Identity Management (PIM)

C.Microsoft Entra Access Reviews

D.Microsoft Entra Terms of Use

AnswerC

Microsoft Entra Access Reviews are a fundamental capability within Microsoft Entra ID Governance that allows organizations to efficiently manage group memberships, access to enterprise applications, and privileged role assignments. They enable administrators or business owners to regularly review who has access to what, and crucially, to automatically remove access for users who no longer need it, especially when their accounts are disabled or they leave the organization, thereby enforcing least privilege and compliance.

Why this answer

Microsoft Entra Access Reviews allows administrators to create recurring reviews of user access to SaaS applications. When a user leaves the organization, an automated access review can be configured to remove their access based on the review results, ensuring revocation of access to all assigned SaaS apps. This directly addresses the requirement for automatic revocation upon departure.

Exam trap

The trap here is that candidates often confuse Conditional Access (which controls access during authentication) with lifecycle management features like Access Reviews, which handle ongoing governance and automatic removal of access after a user leaves.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Conditional Access enforces access policies based on conditions like location or device state at sign-in time, but it does not automatically revoke access when a user leaves the organization. Option B is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time privileged role activation and approval workflows, not the lifecycle-based revocation of access to SaaS applications for departing users. Option D is wrong because Microsoft Entra Terms of Use presents acceptance policies to users before accessing resources, but it does not automate access removal when a user leaves.

Full explanation →

374

MCQeasy

A company configures its identity and access management system so that employees are granted only the permissions necessary to perform their job functions. For example, a sales representative has read-only access to the customer database and cannot modify financial records. Which security principle is being applied in this scenario?

A.Segregation of duties

B.Defense in depth

C.Least privilege

D.Zero Trust

AnswerC

The principle of least privilege dictates that users, applications, or systems should be granted only the minimum necessary permissions required to perform their legitimate job functions or tasks. This minimizes the potential damage from a compromised account or an insider threat by restricting access to only essential resources and operations. Granting a sales representative read-only access to customer data exemplifies this, as it provides necessary visibility without allowing unauthorized modification or deletion.

Why this answer

The scenario describes granting employees only the permissions necessary to perform their job functions, which is the core definition of the least privilege principle. In Microsoft identity and access management, this is implemented by assigning the minimum required Azure RBAC roles or Microsoft Entra ID directory roles, ensuring users have no more access than needed. This directly reduces the attack surface and limits potential damage from compromised accounts.

Exam trap

The trap here is that candidates confuse least privilege with Zero Trust, but Zero Trust is a broader architectural model that includes least privilege as one component, not the specific principle being described in this scenario.

How to eliminate wrong answers

Option A is wrong because segregation of duties (also known as separation of duties) requires splitting critical tasks among multiple people to prevent fraud or error, not limiting permissions to the minimum needed. Option B is wrong because defense in depth is a layered security strategy using multiple controls (e.g., firewalls, encryption, monitoring) across different layers, not a principle for granting specific permissions. Option D is wrong because Zero Trust is a security model based on 'never trust, always verify' and continuous authentication, not specifically about granting only necessary permissions.

Full explanation →

375

MCQmedium

A security architect is explaining identity management concepts to the IT team. Which statement correctly describes the difference between authentication and authorization?

A.Authentication verifies what a user can do, while authorization verifies who the user is.

B.Authorization must always occur before authentication.

C.Authentication verifies the identity of a user, while authorization determines the resources they can access.

D.Authentication and authorization are synonymous terms in identity management.

AnswerC

This statement accurately distinguishes between authentication and authorization, which are sequential and complementary processes in identity management. Authentication is the crucial initial step where a system confirms the legitimacy of a user's claimed identity, often through credentials. Following successful authentication, authorization then evaluates the user's verified identity against predefined policies to determine their specific access rights to resources.

Why this answer

Authentication is the process of verifying a user's identity (e.g., via password, biometric, or certificate), while authorization determines what resources or actions that authenticated identity is permitted to access. In Microsoft Entra ID, authentication occurs first via protocols like OAuth 2.0 or OpenID Connect, and authorization is then enforced through role-based access control (RBAC) or conditional access policies.

Exam trap

The trap here is that candidates often confuse the order or swap the definitions of authentication and authorization, leading them to pick Option A or B, but the key is remembering that authentication always precedes authorization and that they are distinct processes.

How to eliminate wrong answers

Option A is wrong because it reverses the definitions: authentication verifies who the user is, not what they can do, and authorization determines what a user can do, not who they are. Option B is wrong because authorization must always occur after authentication, not before; you cannot determine access rights without first confirming the user's identity. Option D is wrong because authentication and authorization are distinct concepts; authentication confirms identity, while authorization governs access permissions, and they are not synonymous.

Full explanation →

Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 301–375