Microsoft Security, Compliance, and Identity Fundamentals SC-900 SC-900 Questions 451–525 | Page 7/17

451

MCQhard

A company is involved in a lawsuit. The legal team needs to preserve all emails, documents, and Teams messages from five key employees (custodians) that are related to a specific project. The data must be collected securely and provided for legal review without modifying the original data. Which Microsoft Purview solution should they use?

A.Data Lifecycle Management

B.eDiscovery (Premium)

C.Records Management

D.Communication Compliance

AnswerB

eDiscovery (Premium) is the correct solution as it provides a comprehensive, end-to-end workflow specifically designed for legal discovery requirements within Microsoft 365. It enables legal teams to identify, preserve, collect, process, review, and export data from various sources like Exchange mailboxes, SharePoint sites, and Teams, all while maintaining the integrity of the original data and managing legal holds efficiently for specific custodians.

Why this answer

eDiscovery (Premium) is the correct solution because it is specifically designed for legal investigations, allowing organizations to identify, preserve, collect, and export relevant data (emails, documents, Teams messages) from custodians without altering the original data. It supports legal hold, advanced search, and secure export for legal review, meeting the lawsuit requirements.

Exam trap

The trap here is that candidates confuse Data Lifecycle Management or Records Management with eDiscovery, but those solutions manage retention and deletion policies rather than providing the custodial hold, search, and export capabilities required for legal preservation and review.

How to eliminate wrong answers

Option A (Data Lifecycle Management) is wrong because it focuses on automating retention and deletion policies for compliance and governance, not on preserving data for legal hold or collecting it for litigation. Option C (Records Management) is wrong because it is used to classify and manage records for regulatory compliance, often with immutable retention, but it does not provide the custodial search, hold, and export capabilities needed for eDiscovery. Option D (Communication Compliance) is wrong because it is designed to detect and mitigate policy violations (e.g., insider trading, harassment) in communications, not to preserve and collect data for legal proceedings.

Full explanation →

452

MCQmedium

A company wants to allow employees to securely access internal applications from their personal devices. The security policy requires that access is only granted if the device is compliant with company security policies (e.g., encryption enabled, password required, up-to-date operating system). Which Microsoft Entra ID capability should they use?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management

D.Microsoft Entra Verified ID

AnswerA

Conditional Access policies in Microsoft Entra ID are fundamental for implementing Zero Trust principles by evaluating specific conditions before granting access. These policies can enforce requirements such as multifactor authentication, specific location, or crucially, that a device must be marked as compliant by Microsoft Intune. This ensures that only trusted devices meeting organizational security standards can access internal applications, directly addressing the need for secure access from compliant endpoints.

Why this answer

Conditional Access in Microsoft Entra ID is the correct capability because it allows administrators to define policies that enforce device compliance before granting access to applications. By integrating with Microsoft Intune, Conditional Access can require that devices meet specific security policies—such as encryption, password requirements, and OS updates—before allowing access. This directly addresses the requirement to grant access only from compliant personal devices.

Exam trap

The trap here is that candidates often confuse Identity Protection (risk-based conditional access) with device compliance Conditional Access, but Identity Protection does not evaluate device health or compliance policies.

How to eliminate wrong answers

Option B is wrong because Identity Protection focuses on detecting and responding to identity-based risks (e.g., leaked credentials, anomalous sign-ins), not on enforcing device compliance. Option C is wrong because Privileged Identity Management (PIM) manages just-in-time access and approval workflows for privileged roles, not device-level security checks. Option D is wrong because Microsoft Entra Verified ID is a decentralized identity solution for verifiable credentials (e.g., digital IDs), not for device compliance enforcement.

Full explanation →

453

MCQmedium

A company uses Microsoft Entra ID. A junior administrator needs to occasionally reset passwords for the IT department. The security team wants to grant this permission only for a limited time and require an approval from a senior administrator before the permission becomes active. All password reset actions must be audited. Which Microsoft Entra ID feature should they configure?

A.Entra ID Identity Protection

B.Entra ID Privileged Identity Management (PIM)

C.Entra ID Conditional Access

D.Entra ID Terms of Use

AnswerB

Entra ID Privileged Identity Management (PIM) is the correct solution because it directly addresses the need for secure, time-bound access to administrative roles. PIM enables just-in-time (JIT) role activation, meaning users only get elevated permissions when needed and for a limited duration. It integrates approval workflows, requiring an authorized approver to grant temporary access, and provides detailed audit logs for accountability, aligning perfectly with managing role permissions with approval.

Why this answer

Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access, allowing the junior administrator to request a time-limited role for password reset that requires approval from a senior administrator. PIM also enables auditing of all role activations and actions, meeting the security team's requirements for limited duration, approval workflow, and auditability.

Exam trap

The trap here is that candidates often confuse PIM with Conditional Access, thinking that Conditional Access can enforce time-limited permissions, but Conditional Access controls access to resources based on conditions, not the activation or approval of privileged roles.

Why the other options are wrong

Entra ID Identity Protection is designed to detect and respond to identity-based risks, such as compromised credentials or suspicious sign-ins, not to manage time-limited, approval-based permissions for password resets.

Conditional Access controls access based on conditions like location or device state, but does not provide time-limited, approval-based role activation or auditing of specific actions like password reset.

When would these options actually be correct?

A company wants to automatically detect and block risky sign-in attempts, such as those from anonymous IP addresses or with leaked credentials, and require multi-factor authentication for high-risk users.

A company wants to require multi-factor authentication when administrators reset passwords from outside the corporate network. Conditional Access would be the correct feature to enforce this policy.

Why candidates pick the wrong answer

Candidates may confuse Identity Protection's risk-based policies with the ability to control permissions, or think it includes privileged access management features.

Candidates may confuse Conditional Access with Privileged Identity Management because both involve security policies, but Conditional Access focuses on access conditions, not just-in-time privileged role activation.

Full explanation →

454

MCQmedium

A company wants to gain visibility into the cloud applications that employees are using (e.g., unsanctioned SaaS apps), assess the risk level of each app based on multiple factors, and block access to high-risk applications. Which Microsoft security solution should they deploy?

A.Microsoft Defender for Endpoint

B.Microsoft Defender for Office 365

C.Microsoft Defender for Cloud Apps

D.Microsoft Sentinel

AnswerC

Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing comprehensive visibility and control over cloud applications used across an organization. It automatically discovers all cloud apps, both sanctioned and unsanctioned (shadow IT), assesses their risk based on over 25,000 applications in its catalog, and enables granular policy enforcement for access, data protection, and threat prevention within these applications. This capability directly addresses the need to gain visibility into what cloud applications employees are utilizing.

Why this answer

Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility into cloud application usage, assesses risk based on factors like compliance, app store ratings, and security controls, and can block access to high-risk apps via reverse proxy or API integration. This directly matches the requirement to discover unsanctioned SaaS apps and enforce access controls.

Exam trap

The trap here is confusing a CASB (Defender for Cloud Apps) with an EDR (Defender for Endpoint) or SIEM (Sentinel), as candidates often think 'visibility into apps' means endpoint monitoring or log analysis rather than cloud-specific app discovery and risk assessment.

Why the other options are wrong

Microsoft Defender for Endpoint focuses on endpoint devices (e.g., desktops, servers) to prevent, detect, and respond to threats, not on discovering and controlling cloud application usage. It does not provide visibility into unsanctioned SaaS apps or allow blocking access based on app risk.

Microsoft Defender for Office 365 focuses on securing email and collaboration tools (Exchange, SharePoint, Teams), not on discovering and controlling unsanctioned cloud app usage across the organization.

Microsoft Sentinel is a SIEM/SOAR solution for security analytics and threat intelligence across the enterprise, not specifically designed to discover, assess, and block unsanctioned cloud applications. The question focuses on cloud app visibility and control, which is the domain of Defender for Cloud Apps.

When would these options actually be correct?

A company wants to protect its endpoints from malware, detect advanced attacks on devices, and investigate security incidents on workstations and servers. Which Microsoft security solution should they deploy?

A company wants to protect against email-borne threats like phishing, malware, and business email compromise (BEC), and enforce policies for safe links and attachments in Office 365. In that scenario, Microsoft Defender for Office 365 is the correct solution.

An organization needs to centralize security event monitoring, correlate alerts from multiple sources (e.g., on-premises, cloud, identities), and automate incident response across their entire environment. In that scenario, Microsoft Sentinel would be the correct choice.

Why candidates pick the wrong answer

Candidates may confuse 'endpoint' with 'cloud apps' or assume that all Microsoft security tools can monitor cloud usage, leading them to choose Defender for Endpoint without recognizing its device-centric scope.

Candidates may confuse the 'Defender' branding and assume all Defender products provide similar cloud app visibility, or they may think Office 365 covers all cloud apps because it includes cloud-based services.

Candidates may confuse Sentinel's broad security analytics capabilities with the specific cloud app discovery and control features of Defender for Cloud Apps, or they may think Sentinel can directly block cloud app access, which it cannot without integration.

Full explanation →

455

MCQmedium

A compliance administrator configures the above retention policy. A document created on January 1, 2025, in SharePoint Online will be retained until when?

A.Indefinitely

B.January 1, 2026

C.December 31, 2025

D.January 1, 2025

AnswerC

This option is correct because the retention policy specifies a 365-day period starting from the content creation date. If a document is created on January 1, 2025, counting 365 full days forward means the retention period concludes at the end of December 31, 2025. This ensures the item is preserved for the entire calendar year from its creation, making December 31, 2025, the precise end date for its active retention.

Why this answer

The retention policy uses the 'When created' trigger, so a document created on January 1, 2025 is retained for 365 days from that date, expiring on December 31, 2025. Option A is incorrect because the retention period is finite. Option B is incorrect because the retention duration is 365 days from creation, not from the end of the year.

Option D is incorrect because the retention period does not end on the creation date itself.

Full explanation →

456

MCQhard

A security team needs to investigate a potential data breach in Microsoft 365. They require detailed forensic logs showing every instance of mailbox access, mailbox search performed by administrators, and changes to email forwarding rules in Exchange Online. The logs must be retained for 1 year. Which Microsoft Purview solution should they use?

A.Audit (Standard)

B.Audit (Premium)

C.eDiscovery (Standard)

D.eDiscovery (Premium)

AnswerB

Audit (Premium) logs high-value events like mailbox access and forwarding rule changes, and supports up to 1-year retention, making it the correct choice.

Why this answer

Audit (Premium) is required because the question specifies detailed forensic logs for mailbox access, administrator mailbox searches, and changes to email forwarding rules—all of which are high-value, user-specific events that are only captured by Audit (Premium). Audit (Standard) logs basic events but lacks the granularity for these specific operations, and it retains logs for only 90 days by default, whereas Audit (Premium) supports up to 1 year of retention. eDiscovery solutions are for searching and exporting content, not for continuous logging of administrative actions.

Exam trap

The trap here is that candidates confuse eDiscovery (which is for searching and exporting content) with auditing (which is for logging events), and they underestimate the specific event types that require Audit (Premium) over Audit (Standard).

How to eliminate wrong answers

Option A is wrong because Audit (Standard) does not log detailed mailbox access events, administrator mailbox searches, or changes to email forwarding rules; it only captures basic CRUD operations and has a default retention of 90 days, not 1 year. Option C is wrong because eDiscovery (Standard) is a content search and export tool, not a logging or auditing solution; it cannot provide forensic logs of mailbox access or rule changes. Option D is wrong because eDiscovery (Premium) is an advanced content search, review, and analytics tool for legal cases, not a continuous audit log solution; it does not generate or retain logs of administrative actions.

Full explanation →

457

MCQmedium

Your company uses Microsoft Entra ID and wants to implement a passwordless authentication strategy for all users. You have a mix of Windows 10 devices, iOS devices, and Android devices. You need a solution that works across all platforms and does not require users to remember passwords. What should you implement?

A.Deploy FIDO2 security keys to all users and register them in Microsoft Entra ID.

B.Deploy Microsoft Authenticator with phone sign-in enabled for all users.

C.Implement certificate-based authentication using smart cards.

D.Enable Windows Hello for Business on all Windows devices.

AnswerB

Deploying Microsoft Authenticator with phone sign-in provides a highly scalable and user-friendly passwordless solution by leveraging users' existing smartphones. This method supports cross-platform compatibility across Windows, iOS, and Android devices, enabling a consistent authentication experience without requiring passwords. Users simply approve a notification on their mobile device, making it an efficient and broadly applicable choice for an entire organization.

Why this answer

Microsoft Authenticator with phone sign-in enabled provides a cross-platform passwordless authentication solution that works on Windows 10, iOS, and Android devices. It uses a key-based authentication model where the user's phone generates a cryptographic key pair, eliminating the need for passwords while supporting all required device types.

Exam trap

The trap here is that candidates often assume FIDO2 security keys (Option A) are the only true passwordless solution, but they overlook the cross-platform limitation and the fact that Microsoft Authenticator also implements FIDO2/WebAuthn, making it the more practical choice for heterogeneous device environments.

How to eliminate wrong answers

Option A is wrong because FIDO2 security keys require a USB or NFC interface, which is not supported on all iOS devices (iOS does not support FIDO2 over NFC for authentication in all scenarios), and deploying physical keys to all users is less scalable and platform-agnostic than a phone-based solution. Option C is wrong because certificate-based authentication using smart cards requires specialized hardware (smart card readers) and is not natively supported on iOS and Android devices without additional middleware, making it impractical for a cross-platform passwordless strategy. Option D is wrong because Windows Hello for Business is limited to Windows devices and does not address iOS or Android devices, failing the requirement for a solution that works across all platforms.

Full explanation →

458

Multi-Selecthard

Which TWO Microsoft Entra features can help protect against credential attacks?

Select 2 answers

A.Microsoft Entra Connect

B.Self-service password reset

C.Microsoft Entra password protection

D.Access reviews

E.Smart lockout

AnswersC, E

Microsoft Entra password protection actively safeguards user accounts by preventing the use of weak, easily guessable, or commonly compromised passwords. It enforces strong password policies by blocking known bad passwords globally and allows organizations to define custom banned password lists. This feature directly mitigates password spray and brute-force attacks by ensuring that even if an attacker attempts a common password, it will be rejected.

Why this answer

Microsoft Entra password protection (C) helps defend against credential attacks by automatically blocking weak passwords and common variations of known compromised passwords, such as those from botnets or public password lists. Smart lockout (E) protects against brute-force attacks by locking an account after a configurable number of failed sign-in attempts, using intelligent heuristics to distinguish between legitimate users and attackers. Both features directly mitigate password-based attacks like password spraying and brute force.

Exam trap

The trap here is that candidates often confuse self-service password reset (SSPR) with a security feature that prevents attacks, when in reality SSPR is a convenience feature for password recovery, not a proactive defense against credential threats.

Full explanation →

459

MCQeasy

Your organization uses Microsoft Purview Communication Compliance to detect potential harassment in Microsoft Teams messages. Which role is required to review and act on policy matches?

A.Communication Compliance admin

B.Communication Compliance analyst

C.Communication Compliance investigator

D.Compliance administrator

AnswerB

The Communication Compliance analyst is the frontline role specifically designated for the daily review and investigation of policy matches and alerts generated by Microsoft Purview. They are responsible for assessing potential policy violations, collaborating with subject matter experts, and taking appropriate actions such as escalating, resolving, or marking items as benign. This role is central to the operational enforcement of communication compliance policies.

Why this answer

The Communication Compliance analyst role is specifically designed to review policy matches, investigate message details, and take remediation actions such as escalating or resolving alerts in Microsoft Purview Communication Compliance. This role has the necessary permissions to view and act on detected violations without the broader administrative privileges of a Compliance administrator.

Exam trap

The trap here is that candidates often confuse the 'Communication Compliance analyst' role with the 'Communication Compliance admin' role, assuming the admin role includes review capabilities, but Microsoft deliberately separates configuration from review to enforce least-privilege access.

How to eliminate wrong answers

Option A is wrong because the Communication Compliance admin role is responsible for configuring policies and global settings, not for reviewing or acting on individual policy matches. Option C is wrong because there is no built-in role named 'Communication Compliance investigator' in Microsoft Purview; this is a distractor that does not exist. Option D is wrong because the Compliance administrator role has broad compliance management permissions but lacks the specific granular permissions required to review and act on Communication Compliance policy matches.

Full explanation →

460

MCQeasy

A security administrator is configuring permissions for a new cloud-based expense reporting application. The administrator assigns each employee only the permissions they need to perform their job functions. For example, employees in the Sales department can view expense reports but cannot approve or modify financial data. Which security principle is the administrator implementing?

A.Defense in depth

B.Least privilege

C.Separation of duties

D.Zero trust

AnswerB

This is the correct answer because the administrator is granting the minimal permissions required for each employee's role, directly applying the least privilege principle.

Why this answer

The administrator is granting each employee only the permissions necessary to perform their job functions, such as Sales being able to view but not approve or modify financial data. This directly implements the principle of least privilege, which restricts access rights to the minimum required for legitimate tasks. In cloud-based applications like expense reporting systems, least privilege reduces the attack surface and limits potential damage from compromised accounts.

Exam trap

The trap here is that candidates confuse least privilege with separation of duties, because both involve restricting access, but separation of duties specifically requires splitting conflicting tasks (e.g., submit vs. approve) across different users to prevent fraud, whereas least privilege focuses on minimizing permissions per user.

Why the other options are wrong

Defense in depth is a layered security strategy using multiple controls, not about limiting permissions to only what is needed. The question describes assigning minimal permissions per job role, which is least privilege.

The scenario describes assigning permissions based on job needs, which is least privilege. Separation of duties involves splitting critical tasks among multiple people to prevent fraud, not limiting permissions to the minimum necessary.

Zero trust is a security model that assumes no implicit trust and requires continuous verification for every access request, but the question describes assigning minimal permissions based on job roles, which is the principle of least privilege, not zero trust.

When would these options actually be correct?

Defense in depth would be correct if the question described implementing multiple security layers (e.g., firewall, antivirus, encryption, and access controls) to protect the expense reporting application from various threats.

A question where the administrator requires two different employees to approve and process expense reports to prevent a single person from both creating and approving payments would make separation of duties correct.

A question describing a network architecture where every access request, even from inside the corporate network, must be authenticated, authorized, and encrypted, with micro-segmentation and continuous monitoring, would make zero trust the correct answer.

Why candidates pick the wrong answer

Candidates may confuse defense in depth with least privilege because both involve multiple security measures, but defense in depth focuses on layers, not on minimizing permissions.

Candidates may confuse 'separation of duties' with 'least privilege' because both involve restricting access, but separation of duties focuses on dividing tasks to prevent conflicts of interest, not on minimizing permissions per role.

Candidates may confuse zero trust with least privilege because both involve restricting access, but zero trust is broader and includes continuous verification, while least privilege focuses on minimal permissions.

Full explanation →

461

MCQhard

A company runs a mix of on-premises servers and Azure virtual machines. They deploy Microsoft Defender for Endpoint on all servers. The security team wants to create custom queries to hunt for a specific attack pattern that involves a sequence of events across multiple machines, such as a PowerShell script being downloaded and then executed on several servers. They need to write their own detection rules based on advanced hunting data. Which Microsoft 365 Defender capability should they use?

A.Advanced hunting in Microsoft 365 Defender

B.Microsoft Defender for Cloud

C.Microsoft Defender for Office 365

D.Microsoft Sentinel

AnswerA

Advanced hunting is a powerful, proactive threat hunting tool integrated directly within the Microsoft 365 Defender portal. It allows security analysts to leverage Kusto Query Language (KQL) to explore raw event data from various Microsoft 365 security products, including Defender for Endpoint, Defender for Office 365, Defender for Identity, and Microsoft Defender for Cloud Apps. This capability enables the creation of sophisticated custom detection rules and the identification of unique threats across endpoints, email, identities, and cloud applications from a single interface.

Why this answer

Advanced hunting in Microsoft 365 Defender provides a Kusto Query Language (KQL)-based query interface that allows security teams to create custom detection rules by searching raw data across endpoints, email, and identities. This capability directly supports the scenario of writing custom queries to hunt for multi-machine attack patterns, such as a PowerShell script download followed by execution, by correlating events like DeviceProcessEvents and DeviceFileEvents across multiple devices.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel's advanced hunting (which is also KQL-based but is a separate Azure service) with the advanced hunting capability native to Microsoft 365 Defender, leading them to select Sentinel even though the question explicitly asks for a Microsoft 365 Defender capability.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that focuses on securing Azure, on-premises, and multi-cloud resources through recommendations and vulnerability assessments, not on providing a custom KQL-based hunting interface for endpoint-specific event sequences. Option C is wrong because Microsoft Defender for Office 365 is designed to protect against threats in email, SharePoint, OneDrive, and Teams, and does not include advanced hunting capabilities for endpoint processes or file events across servers. Option D is wrong because Microsoft Sentinel is a cloud-native SIEM/SOAR solution that ingests data from multiple sources and offers advanced hunting, but the question specifically asks for a Microsoft 365 Defender capability; Sentinel is a separate Azure service, not a component of Microsoft 365 Defender.

Full explanation →

462

MCQhard

A multinational corporation must comply with the General Data Protection Regulation (GDPR). They use Microsoft Purview Compliance Manager to manage compliance activities. The compliance manager wants to automatically assign each control to the appropriate team member for remediation. What should they configure?

A.Create new assessments for each regulation

B.Configure improvement actions with owners

C.Set up connectors to import external risk data

D.Use the Microsoft 365 admin center to delegate tasks

AnswerB

Configuring improvement actions with owners in Microsoft Purview Compliance Manager is the direct mechanism for operationalizing compliance requirements. These actions represent specific tasks derived from controls and regulations, such as implementing a data encryption policy or updating a privacy notice. Assigning an owner ensures accountability, facilitates the delegation of remediation efforts, and enables tracking of progress and evidence submission, directly addressing the need to comply with regulations like GDPR.

Why this answer

To automatically assign each control to the appropriate team member for remediation in Microsoft Purview Compliance Manager, you must configure improvement actions with owners. Each improvement action can be assigned to a specific user who is responsible for implementing the remediation steps, and this assignment triggers automatic notifications and tracking within the compliance score.

Exam trap

The trap here is that candidates often confuse creating assessments (which organize controls) with the actual assignment of remediation tasks, leading them to choose Option A instead of understanding that improvement actions with owners are the mechanism for automatic assignment.

Why the other options are wrong

Creating new assessments for each regulation helps evaluate compliance but does not automatically assign controls to team members for remediation. The question specifically asks for automatic assignment, which requires configuring improvement actions with owners.

Setting up connectors to import external risk data helps bring in risk signals from outside sources, but it does not automatically assign controls to team members for remediation. The question specifically asks about assigning controls to appropriate team members, which is achieved by configuring improvement actions with owners.

The Microsoft 365 admin center is used for general administrative tasks like user management and service configuration, not for assigning compliance controls to team members. Compliance Manager's improvement actions with owners is the correct feature for this purpose.

When would these options actually be correct?

A company needs to assess compliance against multiple regulations (e.g., GDPR, ISO 27001) and wants to create separate compliance scorecards for each. In that scenario, creating new assessments for each regulation would be the correct action.

In a scenario where an organization wants to integrate risk data from external systems (e.g., vulnerability scanners or third-party risk assessments) into Microsoft Purview Compliance Manager to enhance compliance assessments, configuring connectors would be the correct action.

This option would be correct if the question asked about delegating administrative tasks (e.g., assigning roles or permissions) in Microsoft 365, such as assigning a user as a global admin or managing service requests, rather than assigning compliance controls.

Why candidates pick the wrong answer

Candidates may think that assessments are the primary tool for managing compliance tasks, so creating new ones seems like a logical step to assign work, but they overlook that assignment is done at the improvement action level.

Candidates may confuse the need to import external data with the assignment process, thinking that external risk data could help identify which team member should handle a control, but the actual assignment mechanism is through improvement action owners.

Candidates may confuse the Microsoft 365 admin center as a central hub for all management tasks, including compliance, and assume it can handle task delegation for compliance activities.

Full explanation →

463

MCQhard

Your organization uses Microsoft Entra ID with P2 licenses. You need to implement a policy that requires users to perform multifactor authentication (MFA) when accessing the finance application from an untrusted network, but not when accessing it from the corporate network. Which Microsoft Entra feature should you configure?

A.Microsoft Entra Entitlement Management

B.Microsoft Entra ID Protection MFA registration policy

C.Microsoft Entra Conditional Access policy

D.Microsoft Entra Privileged Identity Management (PIM)

AnswerC

Microsoft Entra Conditional Access policies are powerful 'if-then' statements that evaluate various signals, such as user, device, location, and application, to make real-time access decisions. By configuring a Conditional Access policy, an organization can specify conditions (e.g., users signing in from untrusted networks) and then enforce specific controls, such as requiring Multi-Factor Authentication, before granting access to resources. This capability directly addresses the need to enforce MFA during sign-in based on location.

Why this answer

Microsoft Entra Conditional Access policies allow you to enforce MFA based on conditions such as network location. By configuring a policy that targets the finance application and includes a condition for 'untrusted networks' (e.g., any location other than the corporate network's trusted IP ranges), you can require MFA only when access originates from outside the corporate network. This is the correct feature for granular, condition-based access controls.

Exam trap

The trap here is that candidates often confuse the MFA registration policy (which only ensures users have registered MFA methods) with a Conditional Access policy that actually enforces MFA during sign-in based on conditions like network location.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Entitlement Management is used for managing access packages and identity governance (e.g., automated access requests and reviews), not for enforcing MFA based on network location. Option B is wrong because the Microsoft Entra ID Protection MFA registration policy only enforces that users register for MFA, not that they perform MFA during sign-in based on network conditions. Option D is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time privileged role activation and approval workflows, not location-based MFA enforcement for application access.

Full explanation →

464

MCQmedium

A company uses Microsoft Entra ID. The security team wants to grant temporary, time-limited administrative access to Azure subscriptions only when needed, with an approval workflow. Which Microsoft Entra capability should they use?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management (PIM)

D.Entra ID Governance

AnswerC

Microsoft Entra Privileged Identity Management (PIM) is the dedicated solution for managing, controlling, and monitoring access to critical resources across Microsoft Entra ID, Azure, and other Microsoft Online Services. It enables just-in-time (JIT) access, allowing users to activate eligible administrative roles for a limited, time-bound period. PIM also supports multi-stage approval workflows for role activation, ensuring that elevated privileges are granted only when necessary and with proper authorization, directly addressing the requirement for time-bound, approved elevation.

Why this answer

Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure AD and Azure resources, including Azure subscriptions. PIM supports time-bound role activation with an approval workflow, allowing the security team to grant temporary administrative access only when needed, which directly matches the requirement.

Exam trap

The trap here is that candidates confuse PIM with Conditional Access, thinking that Conditional Access can enforce time-limited access via session controls, but Conditional Access cannot grant or revoke Azure RBAC role assignments or require an approval workflow for role activation.

How to eliminate wrong answers

Option A is wrong because Conditional Access is a policy engine that enforces access controls (e.g., MFA, device compliance) based on signals like user location or risk, but it does not provide time-limited role activation or an approval workflow for privileged access. Option B is wrong because Identity Protection focuses on detecting and remediating identity-based risks (e.g., leaked credentials, anomalous sign-ins) and does not manage role assignments or temporary privileged access. Option D is wrong because Entra ID Governance encompasses broader capabilities like access reviews, entitlement management, and lifecycle workflows, but the specific feature for time-limited, approval-based privileged access to Azure subscriptions is PIM, not governance as a whole.

Full explanation →

465

MCQhard

An organization implements a security policy where users must authenticate using a smart card and PIN. After successful authentication, the system checks whether the user's device is managed by the organization and complies with security baselines. If the device is compliant, the user is granted access to the corporate network. If not, access is denied. This approach most directly reflects which security model?

A.Defense in depth

B.Zero Trust

C.CIA triad

D.Least privilege

AnswerB

Zero Trust is an architectural model that mandates explicit verification for every access request, regardless of whether the user or device is inside or outside the traditional network perimeter. The policy of blocking access if a device is non-compliant directly embodies the 'never trust, always verify' principle by continuously validating device health and posture before granting access to organizational resources. This approach ensures that access decisions are dynamic and based on real-time context, rather than static network location.

Why this answer

The scenario explicitly enforces 'never trust, always verify' by requiring authentication (smart card + PIN) and then validating device compliance before granting network access. This directly aligns with the Zero Trust model's core principle of conditional access based on identity and device health, rather than implicit trust from network location.

Exam trap

The trap here is that candidates confuse Zero Trust with Defense in depth because both involve multiple security layers, but Zero Trust specifically requires per-request verification of identity and device health, whereas Defense in depth relies on static layers without dynamic device compliance checks.

How to eliminate wrong answers

Option A is wrong because Defense in depth is a layered security strategy (e.g., firewalls, IDS, antivirus) that does not specifically mandate per-request device compliance checks before granting network access. Option C is wrong because the CIA triad (Confidentiality, Integrity, Availability) is a high-level security objective, not an operational model that dictates authentication and device health verification as a prerequisite for access. Option D is wrong because Least privilege focuses on granting only necessary permissions (e.g., read-only vs. write), not on verifying device compliance before allowing network connectivity.

Full explanation →

466

MCQmedium

An organization decides to eliminate passwords for their employees. They deploy Windows Hello for Business on company-issued laptops, allowing users to sign in with a PIN or a biometric gesture (e.g., fingerprint). The IT team also enables Microsoft Authenticator and FIDO2 security keys as alternative sign-in methods. Which Microsoft Entra ID capability are they leveraging?

A.Microsoft Entra ID Protection

B.Conditional Access

C.Passwordless authentication

D.Self-Service Password Reset (SSPR)

AnswerC

Passwordless authentication directly addresses the goal of eliminating passwords by replacing them with stronger, more convenient alternatives. In Microsoft Entra ID, this includes methods like Windows Hello for Business, Microsoft Authenticator app, and FIDO2 security keys. These methods leverage biometrics, device-bound credentials, or cryptographic keys to verify user identity, significantly enhancing security and streamlining the sign-in experience without ever requiring a traditional password.

Why this answer

The organization is implementing passwordless authentication by removing passwords and using Windows Hello for Business (PIN/biometrics), Microsoft Authenticator, and FIDO2 security keys. These methods replace the password with a cryptographic key pair bound to the device or user, satisfying the definition of passwordless authentication in Microsoft Entra ID.

Exam trap

The trap here is that candidates confuse the authentication method (passwordless) with the security policies that protect it (Conditional Access) or the risk detection that monitors it (Identity Protection), leading them to select a wrong answer that sounds related but is not the core capability being demonstrated.

Why the other options are wrong

Microsoft Entra ID Protection is a security tool that detects and remediates identity-based risks (e.g., leaked credentials, anomalous sign-ins), not a method for eliminating passwords. The question focuses on deploying passwordless sign-in methods (PIN, biometrics, Authenticator, FIDO2), which is a passwordless authentication capability.

Conditional Access is a policy engine that enforces access controls based on signals like user, device, or location, but it is not the capability that enables passwordless sign-in methods like Windows Hello for Business, Microsoft Authenticator, or FIDO2 keys.

The scenario describes eliminating passwords and using PIN, biometrics, Authenticator, and FIDO2 keys for sign-in, which is passwordless authentication. SSPR is a feature that allows users to reset their own passwords when forgotten, not to eliminate passwords entirely.

When would these options actually be correct?

A question describing an organization that wants to automatically block sign-ins from risky IP addresses or detect compromised credentials would make Entra ID Protection the correct answer. For example: 'An organization uses risk-based policies to require MFA when a sign-in is from an anonymous IP address.'

An organization wants to require multi-factor authentication (MFA) for all users accessing sensitive apps, but only when they sign in from untrusted networks. They configure a policy that triggers MFA based on location and risk level. This scenario uses Conditional Access to enforce access controls.

A question where users are allowed to reset their own passwords without IT help, using methods like security questions, email, or phone verification, and the organization wants to reduce helpdesk calls for password resets.

Why candidates pick the wrong answer

Candidates may confuse 'passwordless authentication' with 'identity protection' because both are security features in Entra ID, and the scenario involves eliminating passwords, which could be seen as a protective measure against password attacks.

Candidates may confuse the policy enforcement layer (Conditional Access) with the authentication method itself (passwordless), especially when passwordless methods are often combined with Conditional Access policies for security.

Candidates may confuse passwordless authentication with password reset capabilities, thinking that eliminating passwords involves resetting them, or they may not clearly distinguish between authentication methods and self-service recovery options.

Full explanation →

467

MCQhard

Refer to the exhibit. The Conditional Access policy is configured to block access for high-risk users. A user with a medium risk level attempts to sign in. What will happen?

A.Access is blocked

B.User is redirected to a password reset page

C.Access is granted

D.User is prompted for MFA

AnswerC

Access is granted because the fundamental conditions defined within the Conditional Access policy's "Assignments" section were not entirely satisfied. When a policy's conditions are not met, the policy is not triggered, and its configured controls—whether to grant, block, or require specific actions—are not enforced. In such cases, access typically defaults to being granted, assuming no other active policies or security defaults intervene to restrict it.

Why this answer

The Conditional Access policy is configured to block access for high-risk users only. Since the user has a medium risk level, the policy condition is not met, so the policy does not apply. Therefore, access is granted based on the default behavior of allowing sign-in when no Conditional Access policy is triggered.

Exam trap

The trap here is that candidates often assume any risk level triggers the block action, but Conditional Access policies only enforce controls when the condition exactly matches the configured risk level, not for lower or higher levels unless explicitly specified.

How to eliminate wrong answers

Option A is wrong because the policy specifically targets high-risk users, and a medium-risk user does not match the condition, so access is not blocked. Option B is wrong because a password reset page is triggered only by a policy that requires password change (e.g., user risk policy with 'Require password change' control), which is not configured here. Option D is wrong because MFA prompt would require a policy with 'Require multifactor authentication' control, which is not present in this configuration.

Full explanation →

468

MCQmedium

Your organization has a Microsoft Purview Data Lifecycle Management policy that deletes emails after 3 years. A legal hold is placed on a user's mailbox. What happens to the emails?

A.Only emails created before the hold are deleted

B.Emails are preserved and not deleted despite the retention policy

C.Emails are deleted immediately to avoid conflicting policies

D.Emails are deleted after 3 years as per the retention policy

AnswerB

A legal hold, also known as an eDiscovery hold, establishes an absolute preservation requirement that takes precedence over any conflicting retention policies. Its primary function is to ensure that all relevant data, such as emails, remains immutable and discoverable for legal or investigative purposes. This means emails will be preserved and not deleted, even if a retention policy would otherwise dictate their removal, until the hold is explicitly released.

Why this answer

When a legal hold is placed on a user's mailbox in Microsoft Purview, it takes precedence over any deletion actions from Data Lifecycle Management policies. The hold preserves all mailbox content, including emails that would otherwise be deleted after 3 years, ensuring data is retained for legal or compliance purposes. This is because legal holds are designed to prevent permanent deletion of data subject to litigation or investigation.

Exam trap

The trap here is that candidates often assume retention policies always execute deletion regardless of other configurations, but Microsoft Purview explicitly prioritizes holds over deletion actions, making the hold a superseding rule.

How to eliminate wrong answers

Option A is wrong because legal holds preserve all existing emails regardless of creation date, not just those created before the hold; the hold applies to all current content and prevents deletion. Option C is wrong because conflicting policies do not cause immediate deletion; instead, Microsoft Purview resolves conflicts by prioritizing holds over retention deletion actions. Option D is wrong because the legal hold overrides the retention policy's deletion timeline, so emails are not deleted after 3 years while the hold is active.

Full explanation →

469

Matchingmedium

Match each compliance framework to its primary focus.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Data protection and privacy for EU citizens

Information security management system standard

Cybersecurity risk management framework

Healthcare data privacy and security in the US

Service organization controls for data security

Why these pairings

Correct matches: GDPR = data privacy, ISO 27001 = information security management, SOC 2 = trust service criteria. Common confusions include mixing GDPR with financial controls (SOX) or privacy with broader security.

Full explanation →

470

Multi-Selectmedium

Which THREE are benefits of using Microsoft Purview Compliance Manager?

Select 3 answers

A.Create Data Loss Prevention policies.

B.View a compliance score that indicates your overall compliance posture.

C.Assign compliance tasks to other users in your organization.

D.Receive recommendations for improvement actions to achieve compliance.

E.Automatically apply sensitivity labels to documents.

AnswersB, C, D

A core benefit of Microsoft Purview Compliance Manager is its ability to provide a quantifiable compliance score, which serves as a real-time indicator of an organization's overall compliance posture against various regulations and standards. This score is dynamically calculated based on the implementation status of recommended actions and controls, allowing organizations to quickly assess their progress and identify areas needing improvement. It provides a clear, measurable metric for tracking compliance efforts over time.

Why this answer

Compliance Manager provides a compliance score to indicate your overall compliance posture (B), suggests improvement actions to achieve compliance (D), and allows you to assign compliance tasks to other users (C). Option A is incorrect because Data Loss Prevention policies are created in the Microsoft Purview compliance portal, not directly in Compliance Manager. Option E is incorrect because automatically applying sensitivity labels is done through auto-labeling policies, not Compliance Manager.

Full explanation →

471

MCQhard

An organization is migrating from on-premises Active Directory to Microsoft Entra ID. They need to synchronize user passwords so that users can use the same password for both on-premises and cloud resources. Which authentication method should they choose?

A.Password Hash Synchronization

B.Seamless Single Sign-On

C.Pass-through Authentication

D.Federation with AD FS

AnswerA

Password Hash Synchronization (PHS) is a cloud authentication method that securely synchronizes a cryptographic hash of a user's password from an on-premises Active Directory to Azure AD. This allows users to sign in to cloud services using the same credentials they use on-premises, without exposing their actual passwords in the cloud. It provides a simple, robust solution for hybrid identity, enabling a seamless transition for users during migration while maintaining a cloud-managed authentication experience.

Why this answer

Password Hash Synchronization (PHS) is the correct choice because it synchronizes a hash of the user's on-premises Active Directory password to Microsoft Entra ID, allowing users to authenticate with the same password for both on-premises and cloud resources. This method is specifically designed for password synchronization without requiring any additional infrastructure or real-time validation against on-premises systems.

Exam trap

The trap here is that candidates confuse 'synchronization' with 'single sign-on' or 'pass-through validation,' assuming that Seamless SSO or Pass-through Authentication also synchronize passwords, when in fact they do not transfer password hashes to the cloud.

How to eliminate wrong answers

Option B (Seamless Single Sign-On) is wrong because it does not synchronize passwords; it only provides automatic sign-in for domain-joined devices on corporate networks by using Kerberos delegation, but the actual password validation still relies on another method like PHS or Pass-through Authentication. Option C (Pass-through Authentication) is wrong because it validates passwords directly against on-premises Active Directory in real time without synchronizing password hashes to the cloud, which means it does not meet the requirement to synchronize passwords for offline or cloud-only authentication. Option D (Federation with AD FS) is wrong because it uses a federated trust with on-premises Active Directory Federation Services (AD FS) for authentication, requiring complex infrastructure and redirecting authentication to on-premises servers, rather than synchronizing password hashes to Microsoft Entra ID.

Full explanation →

472

MCQhard

Your company has Microsoft Defender for Office 365 and wants to configure anti-phishing policies to protect against spear-phishing attacks targeting executives. Which policy setting should you enable to provide the highest level of protection?

A.Malware filter

B.Impersonation protection for users

C.Bulk email filtering

D.Spoof intelligence

AnswerB

Impersonation protection in Microsoft Defender for Office 365 is specifically designed to identify and block emails where the sender's display name or email address closely resembles a protected user or domain within the organization. This feature actively analyzes the sender's identity to detect sophisticated phishing attacks where attackers attempt to trick recipients into believing the email originates from a trusted internal source, thereby directly addressing user-targeted phishing and business email compromise (BEC) scenarios.

Why this answer

Impersonation protection for users is the correct setting because it specifically defends against spear-phishing attacks that impersonate high-value targets like executives. Microsoft Defender for Office 365 uses machine learning and sender intelligence to detect and block emails that spoof the display name or email address of protected users, providing the highest level of protection against targeted impersonation attacks.

Exam trap

The trap here is that candidates often confuse spoof intelligence (which checks domain authentication) with impersonation protection (which checks user identity), leading them to select Spoof intelligence despite it not addressing display name or user-level impersonation attacks.

How to eliminate wrong answers

Option A is wrong because the Malware filter is designed to detect and block malicious attachments and links, not to identify impersonation or social engineering tactics used in spear-phishing. Option C is wrong because Bulk email filtering manages high-volume commercial email (e.g., newsletters) based on bulk complaint levels, not targeted impersonation of specific individuals. Option D is wrong because Spoof intelligence analyzes email authentication (SPF, DKIM, DMARC) to detect domain spoofing, but it does not protect against display name or user impersonation attacks that bypass these checks.

Full explanation →

473

MCQmedium

A legal team needs to preserve all electronic documents related to an ongoing lawsuit. These documents reside in Exchange Online mailboxes, SharePoint Online sites, and OneDrive for Business accounts. The team also needs the ability to search across these locations for specific keywords and export the results for review. Which Microsoft Purview solution should they use?

A.Microsoft Purview eDiscovery (Premium)

B.Microsoft Purview Data Lifecycle Management

C.Microsoft Purview Data Loss Prevention

D.Microsoft Purview Audit

AnswerA

eDiscovery (Premium) provides end-to-end workflow for legal investigations, including identifying and holding relevant data, searching for specific content using keywords and conditions, reviewing results with advanced analytics, and exporting data for external review. It is the appropriate solution for litigation holds and search.

Why this answer

Microsoft Purview eDiscovery (Premium) is the correct solution because it provides end-to-end workflow for preserving, searching, and exporting content from Exchange Online mailboxes, SharePoint Online sites, and OneDrive for Business accounts. It supports legal hold to preserve data, keyword search across these sources, and export of results for review, meeting all requirements of the legal team.

Exam trap

The trap here is that candidates confuse eDiscovery with Audit, thinking Audit can search and export content, but Audit only provides activity logs, not the ability to preserve or export the actual documents.

Why the other options are wrong

Microsoft Purview Data Lifecycle Management focuses on retaining or deleting content based on policies, not on preserving data for legal hold or performing search and export across mailboxes, SharePoint, and OneDrive for litigation purposes.

Data Loss Prevention (DLP) policies prevent accidental sharing of sensitive data but do not provide legal hold, search, or export capabilities across mailboxes, SharePoint, and OneDrive for litigation purposes.

Microsoft Purview Audit provides logging of user and admin activities but does not support preservation, search, or export of content across mailboxes, sites, and accounts for legal hold purposes.

When would these options actually be correct?

A correct scenario would be: 'An organization needs to automatically retain emails for 7 years to comply with regulatory requirements and then delete them. Which solution should they use?' In that case, Data Lifecycle Management would be correct.

A company wants to automatically detect and block emails containing credit card numbers from being sent to external recipients. Microsoft Purview Data Loss Prevention would be the correct solution to enforce such policies.

An organization needs to investigate a security incident and must review all user activities (e.g., file access, email sends) across Exchange, SharePoint, and OneDrive for a specific time period. Audit would be the correct solution for searching and exporting audit logs.

Why candidates pick the wrong answer

Candidates may confuse the need to 'preserve' documents with data lifecycle management's retention policies, not realizing that eDiscovery (Premium) provides legal hold, search, and export capabilities specifically for litigation.

Candidates may confuse the need to protect data (DLP) with the need to preserve and search data for legal cases, as both involve data governance concepts.

Candidates may confuse the search and export capabilities of Audit with eDiscovery, or think that auditing includes content preservation and search, when it only tracks activities.

Full explanation →

474

Multi-Selectmedium

Which TWO of the following are capabilities of Microsoft Purview Information Protection?

Select 2 answers

A.Searching for content in eDiscovery

B.Preventing data loss via policies

C.Setting retention periods for content

D.Applying sensitivity labels to documents and emails

E.Encrypting content with Azure Rights Management

AnswersD, E

Applying sensitivity labels to documents and emails is a fundamental capability of Microsoft Purview Information Protection. These labels allow organizations to classify data based on its sensitivity level, such as 'Confidential' or 'Public,' and then automatically enforce corresponding protection actions. This includes visual markings, encryption, and access restrictions, ensuring consistent data governance and protection across various platforms and applications.

Why this answer

Microsoft Purview Information Protection (MIP) focuses on classifying, labeling, and protecting sensitive data. Applying sensitivity labels to documents and emails (Option D) is a core MIP capability, as labels enforce protection actions like encryption or visual markings. Encrypting content with Azure Rights Management (Option E) is the underlying technology that MIP uses to apply persistent protection, making it a direct capability of the solution.

Exam trap

The trap here is that candidates confuse the broad 'Microsoft Purview' umbrella with its specific sub-solutions, mistakenly attributing eDiscovery, DLP, or retention capabilities to Information Protection when each is a distinct workload with separate functions.

Full explanation →

475

MCQmedium

A company uses Microsoft Entra ID. The IT department wants to ensure that users are prompted to change their password only when there is a high likelihood that their credentials have been compromised, rather than forcing periodic password changes. They also want to block users from using common passwords from a custom list of banned passwords. Which Microsoft Entra features should they use?

A.Identity Protection and Password Protection

B.Conditional Access and Multi-Factor Authentication

C.Privileged Identity Management and Identity Governance

D.Access Reviews and Entitlement Management

AnswerA

Microsoft Entra Identity Protection actively detects potential vulnerabilities affecting user identities, such as leaked credentials or risky sign-in behaviors, and can automate remediation actions including forcing a password change for high-risk users. Microsoft Entra Password Protection specifically prevents users from creating weak, commonly used, or custom-banned passwords, directly addressing the prevention of easily guessable or compromised passwords within the organization.

Why this answer

Identity Protection uses machine learning to detect leaked credentials and risky sign-in behaviors, triggering a password change prompt only when compromise is likely, not on a fixed schedule. Password Protection enforces custom banned password lists (e.g., common passwords or company-specific terms) at the time of password change or reset, blocking weak passwords in real time.

Exam trap

The trap here is that candidates confuse Identity Protection with Conditional Access, assuming risk-based policies are the same as password change triggers, or they think Password Protection is part of MFA or PIM, when in fact it is a separate feature focused solely on password content validation.

How to eliminate wrong answers

Option B is wrong because Conditional Access controls access policies (e.g., requiring MFA based on risk) but does not manage password change triggers or banned password lists; Multi-Factor Authentication adds a second verification factor but does not detect credential compromise or enforce password bans. Option C is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role activation and approval workflows, not password policies or compromise detection; Identity Governance handles access certifications and lifecycle, not password change logic. Option D is wrong because Access Reviews are for periodic recertification of group memberships or application access, and Entitlement Management manages access packages and catalogs; neither feature triggers password changes based on compromise likelihood or enforces custom banned password lists.

Full explanation →

476

MCQeasy

You work at a mid-sized company that uses Microsoft Defender for Business (a subscription included with Microsoft 365 Business Premium). The company has 300 devices enrolled in Microsoft Intune. Recently, a malware outbreak occurred on several devices. You need to implement a solution that automatically remediates devices that are found to be infected with malware. The solution should isolate the device from the network and run a full scan. Which action should you take?

A.Create a Conditional Access policy to block access for devices with malware.

B.Create an Intune compliance policy to mark devices as non-compliant if malware is detected.

C.Enable automatic investigation and remediation in Microsoft Defender for Business.

D.Configure Microsoft Defender Antivirus to run a weekly scan.

AnswerC

Microsoft Defender for Business includes automated investigation and remediation capabilities that can automatically isolate infected devices and run full scans when malware is detected.

Why this answer

Correct: C. Microsoft Defender for Business includes automated investigation and remediation capabilities that can automatically isolate infected devices and run full scans. Option A: Conditional Access policies control access based on conditions but do not perform remediation actions like isolation or scanning.

Option B: Intune compliance policies can mark devices as non-compliant but do not automatically remediate malware. Option D: Configuring Microsoft Defender Antivirus to run a weekly scan is a scheduled task, not an automatic response to detected malware.

Full explanation →

477

MCQeasy

A security operations team uses Microsoft Sentinel to centralize security log analysis. They need to ingest logs from a third-party firewall that does not have a native connector. What should the team use to bring the firewall logs into Microsoft Sentinel?

A.Data connectors

B.Playbooks

C.Workbooks

D.Analytics rules

AnswerA

Microsoft Sentinel's primary function as a Security Information and Event Management (SIEM) solution relies on ingesting security data from diverse sources. Data connectors are the specific mechanisms that facilitate this ingestion, establishing a secure link between various data sources (like Azure Activity Logs, Microsoft 365 Defender, firewalls, or custom applications) and the Log Analytics workspace underpinning Sentinel. They normalize and stream logs, making them available for analysis, threat detection, and investigation within the platform. For sources without direct API integration, generic connectors like Syslog or Common Event Format (CEF) are utilized to centralize data.

Why this answer

Microsoft Sentinel uses data connectors to ingest logs from various sources, including third-party devices that lack native connectors. For a firewall without a built-in connector, the team can use the Common Event Format (CEF) connector or Syslog connector, which are both categorized as data connectors. These connectors allow the firewall to forward logs via Syslog or CEF over UDP/TCP, which Sentinel then parses and ingests into the Log Analytics workspace.

Exam trap

The trap here is that candidates confuse data connectors (which handle ingestion) with playbooks or workbooks (which handle response or visualization), leading them to select a post-ingestion tool instead of the correct ingestion method.

Why the other options are wrong

Playbooks are automated response workflows triggered by alerts, not used for ingesting logs from external sources into Microsoft Sentinel.

Workbooks are used for visualizing and reporting on data already ingested into Microsoft Sentinel, not for ingesting logs from external sources like a third-party firewall.

Analytics rules are used to detect threats and generate incidents based on ingested data, not to ingest logs from external sources. They operate on data already in Sentinel, so they cannot bring in firewall logs.

When would these options actually be correct?

A security team needs to automate incident response actions, such as blocking an IP address on a firewall, when a specific alert is triggered in Microsoft Sentinel. Playbooks would be the correct answer.

A security team needs to create a custom dashboard to monitor trends in firewall log data that has already been ingested into Microsoft Sentinel. They should use Workbooks to build interactive visualizations and reports.

A security team has already ingested firewall logs into Microsoft Sentinel and wants to create automated alerts for suspicious traffic patterns. In that scenario, analytics rules would be the correct choice to define detection logic and trigger incidents.

Why candidates pick the wrong answer

Candidates may confuse playbooks with data connectors because both involve automation, but playbooks handle response actions, not log ingestion.

Candidates may confuse Workbooks with data connectors because both involve handling data, but Workbooks are for visualization, not ingestion.

Candidates may confuse analytics rules with data ingestion mechanisms, thinking that rules can pull in data from external sources, or they may assume that any 'rule' can handle log collection.

Full explanation →

478

MCQhard

A security operations center (SOC) team uses Microsoft Sentinel with User and Entity Behavior Analytics (UEBA) enabled. They notice an alert about a user accessing a sensitive HR application from an unusual IP address at 3 AM. What does UEBA primarily use to detect this anomaly?

A.Static rule-based thresholds defined by the SOC

B.Manual input from the SOC team

C.Historical behavior baselines and machine learning

D.Threat intelligence feeds from Microsoft

AnswerC

User and Entity Behavior Analytics (UEBA) relies critically on establishing comprehensive historical behavior baselines for users and entities within an environment. Machine learning algorithms continuously process vast datasets of activity, learning what constitutes "normal" behavior over time for each individual or system. By comparing current activities against these dynamically learned baselines, UEBA can effectively identify deviations and anomalous patterns that indicate potential security threats, such as insider threats or compromised accounts, without requiring explicit rules.

Why this answer

UEBA in Microsoft Sentinel detects anomalies by establishing a baseline of normal user behavior over time—such as typical login times, locations, and accessed applications—using machine learning models. When a user accesses a sensitive HR app from an unusual IP at 3 AM, the deviation from this learned baseline triggers an alert, not a static rule or manual input.

Exam trap

The trap here is that candidates confuse UEBA's ML-driven behavioral baselines with static rule-based detection or external threat intelligence, assuming any unusual IP must come from a threat feed rather than recognizing the anomaly is based on the user's own historical patterns.

How to eliminate wrong answers

Option A is wrong because static rule-based thresholds require manual configuration and cannot adapt to individual user behavior patterns; UEBA relies on dynamic, ML-driven baselines. Option B is wrong because manual input from the SOC team is not the primary detection mechanism—UEBA automates anomaly detection without requiring human-defined rules or inputs. Option D is wrong because threat intelligence feeds identify known malicious indicators (e.g., IPs from botnets), but the anomaly here is based on behavioral deviation from a user's own history, not on external threat data.

Full explanation →

479

MCQhard

A company wants to monitor Microsoft Teams messages and corporate emails for policy violations related to potential harassment and inappropriate behavior. They need a solution that allows them to define policies with conditions (e.g., keywords, patterns), automatically flag suspicious conversations, and optionally send notifications to the sender or escalate to a reviewer. Additionally, they need the ability to train employees when a minor violation is detected. Which Microsoft Purview solution should they use?

A.Data Loss Prevention (DLP)

B.Communication Compliance

C.Information Protection

D.Audit

AnswerB

Communication Compliance is the correct solution, specifically designed to help organizations detect, investigate, and act on inappropriate messages within Microsoft Teams, Exchange Online, Yammer, and other communication platforms. It leverages intelligent classifiers and customizable policies to identify potential regulatory compliance issues, code-of-conduct violations, or instances of harassment. This service provides a robust framework for reviewing flagged communications, taking remediation actions such as notifying users, and fostering a compliant and respectful workplace environment.

Why this answer

Communication Compliance is the correct solution because it is specifically designed to detect policy violations in Microsoft Teams messages and corporate emails by scanning for keywords, patterns, and other conditions. It can automatically flag suspicious conversations, send notifications to the sender, escalate to a reviewer, and even train employees on minor violations through its built-in remediation workflows.

Exam trap

The trap here is that candidates often confuse Communication Compliance with Data Loss Prevention (DLP) because both involve policy-based scanning of communications, but DLP lacks the behavioral monitoring, notification, and training capabilities required for harassment and inappropriate behavior scenarios.

Why the other options are wrong

Information Protection focuses on classifying and protecting sensitive data (e.g., labels, encryption) but does not include monitoring communications for policy violations like harassment or sending training notifications.

Audit logs user and admin activity but does not define policies to monitor content for harassment or policy violations, nor does it provide training or notification features.

When would these options actually be correct?

A company needs to classify documents and emails containing credit card numbers and apply encryption automatically. Information Protection with sensitivity labels would be the correct solution.

A company needs to track user and admin activities across Microsoft 365 services for security investigations or compliance reporting, such as who accessed sensitive files or changed permissions.

Why candidates pick the wrong answer

Candidates may confuse 'protecting information' broadly with monitoring communications, or think that policies for harassment involve protecting information from misuse.

Candidates may think Audit is used for monitoring communications because it tracks activities, but it lacks content analysis and policy enforcement capabilities.

Full explanation →

480

MCQeasy

A hotel uses a key card system. Guests insert their card into the door lock, which reads the card's ID number. The system checks the ID number against a list of authorized rooms. If the ID matches an authorized room, the door unlocks. In this scenario, which concept is demonstrated when the system checks the ID number against the list of authorized rooms?

A.Identification

B.Authentication

C.Authorization

D.Non-repudiation

AnswerC

Authorization is the process of verifying that an authenticated identity is allowed to perform a specific action or access a resource. The system checking the card ID against a list of authorized rooms is a classic example of authorization.

Why this answer

The system checks the ID number against a list of authorized rooms to determine what action (unlocking the door) the guest is allowed to perform. This is the definition of authorization: granting or denying access rights based on verified identity. Authentication (proving who you are) has already occurred when the card was issued or when the system reads the ID; the check against the list is purely about permissions.

Exam trap

The trap here is that candidates confuse 'checking the ID' with authentication, but the scenario explicitly states the ID is already read and the check is against a list of authorized rooms, which is a permission check, not a proof-of-identity check.

Why the other options are wrong

Identification is the process of claiming an identity (e.g., presenting a username or ID number), but the system is not just reading the ID; it is checking whether that ID is permitted to access a specific resource. The act of verifying permissions is authorization, not identification.

The system is checking if the guest's ID is allowed to access a specific room, which is authorization (granting access rights). Authentication would be verifying the guest's identity (e.g., checking a PIN or biometric), not checking against a list of authorized rooms.

Non-repudiation ensures that an action cannot be denied later, typically through digital signatures or logs. In this scenario, the system is simply checking if the ID is allowed to open the door, not preventing denial of the action.

When would these options actually be correct?

A question asks: 'A user enters their username on a login screen. Which concept does this represent?' In that scenario, the user is claiming an identity, so identification would be the correct answer.

Authentication would be correct if the question described the door lock verifying the guest's identity, such as by checking a PIN code against a stored credential or using a fingerprint scanner to confirm the guest is who they claim to be.

A question where a user sends a digitally signed email and later claims they did not send it. The system uses the digital signature to prove the email was indeed sent by that user, demonstrating non-repudiation.

Why candidates pick the wrong answer

Candidates may confuse the reading of the ID number (which is identification) with the subsequent check against the authorized list, mistakenly thinking the entire process is identification rather than recognizing the permission-checking step as authorization.

Candidates often confuse authentication with authorization because both involve identity checks. The key card ID is used for identification, and the subsequent check against the room list is authorization, but the step of 'checking the ID number' sounds like verifying identity, leading to the wrong choice.

Candidates may confuse authorization with non-repudiation because both involve verifying permissions or actions, but non-repudiation focuses on irrefutable proof of an action, not access rights.

Full explanation →

481

MCQmedium

A healthcare organization must comply with HIPAA. They need to automatically detect protected health information (PHI) such as medical record numbers in outgoing email, prevent users from sharing these emails with unauthorized external recipients, and apply a retention label that retains PHI emails for six years. Which Microsoft Purview solution should they use?

A.Microsoft Purview Data Loss Prevention (DLP)

B.Microsoft Purview Information Protection (sensitivity labels)

C.Microsoft Purview Data Lifecycle Management (retention policies)

D.Microsoft Purview Audit

AnswerA

DLP policies can be configured to scan Exchange Online emails for PHI, automatically block unauthorized sharing, and apply a retention label via an associated policy action. This meets all the stated requirements.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it can automatically detect sensitive data like PHI (e.g., medical record numbers) in outgoing emails using built-in or custom sensitive info types, block unauthorized external sharing, and trigger a retention label action via auto-labeling policies to retain the emails for six years. DLP policies integrate with Exchange Online to inspect email content in transit, apply access restrictions, and enforce retention labels through Power Automate or auto-labeling rules.

Exam trap

The trap here is that candidates confuse the detection and blocking capability of DLP with the classification-only capability of Information Protection (sensitivity labels), or they incorrectly think Data Lifecycle Management alone can enforce access controls, when in fact DLP is the only solution that combines content inspection, real-time blocking, and label application in a single policy.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview Information Protection (sensitivity labels) can classify and protect data with encryption or markings, but it cannot automatically detect PHI in outgoing email and block sharing with unauthorized external recipients—that requires DLP policy actions. Option C is wrong because Microsoft Purview Data Lifecycle Management (retention policies) can retain emails for six years, but it cannot detect PHI or prevent sharing; it only manages retention and deletion. Option D is wrong because Microsoft Purview Audit logs user and admin activities for forensic investigation, but it cannot detect PHI in real-time, block email sharing, or apply retention labels.

Full explanation →

482

MCQeasy

A healthcare company stores patient records in an Azure SQL database. To protect the data, they enable Transparent Data Encryption (TDE) for the database and require all client connections to use TLS. Which security goal is being primarily addressed by these measures?

A.Integrity

B.Confidentiality

C.Availability

D.Non-repudiation

AnswerB

Confidentiality is the principle that sensitive information, such as patient records, is protected from unauthorized disclosure and accessible only to authorized entities. Implementing encryption, both for data at rest (e.g., Transparent Data Encryption for Azure SQL Database) and data in transit (e.g., TLS/SSL), directly ensures that even if data is intercepted or accessed by an unauthorized party, it remains unreadable and unintelligible, thereby upholding its confidentiality.

Why this answer

Transparent Data Encryption (TDE) encrypts data at rest in the Azure SQL database, ensuring that even if the physical storage media is compromised, the data remains unreadable. Requiring TLS for client connections encrypts data in transit, preventing eavesdropping or interception. Both measures directly protect the confidentiality of patient records by preventing unauthorized access to the data.

Exam trap

The trap here is that candidates may confuse encryption (which protects confidentiality) with integrity or non-repudiation, especially when TLS is involved, but TLS primarily provides confidentiality and only secondary integrity via MACs, not the primary goal in this context.

How to eliminate wrong answers

Option A is wrong because integrity is about ensuring data has not been tampered with, which is typically addressed by hashing or digital signatures, not by encryption alone. Option C is wrong because availability refers to ensuring systems and data are accessible when needed, which is achieved through redundancy, backups, and disaster recovery, not encryption. Option D is wrong because non-repudiation ensures that an action cannot be denied, usually via digital signatures or audit logs, not by encrypting data at rest or in transit.

Full explanation →

483

Multi-Selectmedium

Which TWO of the following are capabilities of Microsoft Purview Communication Compliance? (Select TWO.)

Select 2 answers

A.Enforce company policies on communication channels

B.Detect offensive language in emails and Teams messages

C.Automatically apply sensitivity labels to documents

D.Prevent sharing of credit card numbers via email

E.Place legal holds on user mailboxes

AnswersA, B

Microsoft Purview Communication Compliance is specifically designed to help organizations detect, investigate, and remediate policy violations in internal and external communications. This capability allows administrators to define policies that automatically scan communication channels, such as Microsoft Teams, Exchange email, and Yammer, for content that violates company standards, regulatory requirements, or ethical guidelines, thereby enforcing appropriate conduct and preventing risks.

Why this answer

Microsoft Purview Communication Compliance allows organizations to enforce company policies on communication channels such as email, Microsoft Teams, and third-party platforms. It does this by scanning communications for policy violations (e.g., insider trading, harassment) and enabling designated reviewers to take remediation actions like escalating or archiving messages.

Exam trap

The trap here is that candidates confuse Communication Compliance with Data Loss Prevention (DLP) or Information Protection, since all three involve content scanning—but Communication Compliance is specifically for monitoring and reviewing communications for policy violations, not for automatic labeling or blocking sensitive data.

Full explanation →

484

MCQmedium

Your organization uses Microsoft Defender for Office 365. Users report receiving phishing emails that bypassed the default anti-phishing policy. What should you do to improve protection?

A.Create a custom anti-phishing policy.

B.Enable Safe Attachments.

C.Configure anti-malware policy.

D.Increase the spam confidence level (SCL) threshold.

AnswerA

Custom policies can include impersonation protection and advanced settings.

Why this answer

The default anti-phishing policy in Microsoft Defender for Office 365 provides baseline protection, but it cannot be customized. To address specific threats like phishing emails that bypass default settings, you must create a custom anti-phishing policy. This allows you to fine-tune spoof intelligence, impersonation protection, and mailbox intelligence thresholds to catch sophisticated phishing attempts that evade the default policy.

Exam trap

The trap here is that candidates often confuse anti-phishing policies with anti-spam or anti-malware policies, mistakenly thinking that increasing the SCL threshold or enabling Safe Attachments will address phishing, when in fact phishing protection requires dedicated impersonation and spoofing controls only available in a custom anti-phishing policy.

How to eliminate wrong answers

Option B is wrong because Safe Attachments is a separate feature designed to detect and block malicious attachments in email and SharePoint, not to improve anti-phishing protection against phishing URLs or impersonation attacks. Option C is wrong because anti-malware policies focus on detecting malware (e.g., viruses, ransomware) in email attachments and messages, not on phishing-specific threats like spoofed senders or deceptive links. Option D is wrong because increasing the spam confidence level (SCL) threshold would actually reduce the sensitivity of spam filtering, allowing more spam and phishing messages to reach users, which is the opposite of improving protection.

Full explanation →

485

MCQeasy

Your organization wants to enforce MFA for all users accessing the Azure portal. However, users accessing from the corporate office network should not be prompted for MFA. Which Conditional Access assignment should you configure?

A.Include all users, include trusted locations.

B.Include all trusted locations.

C.Include Azure portal app, exclude trusted locations.

D.Include all locations, exclude trusted locations.

AnswerD

This Conditional Access policy configuration effectively enforces Multi-Factor Authentication (MFA) for all users attempting to access resources from any network location, while simultaneously creating a specific exception for trusted network environments. By including "all locations" and then explicitly excluding "trusted locations," the policy ensures MFA is mandated for external or untrusted access attempts, but users on the secure corporate network are not prompted for an additional factor, balancing robust security with user experience.

Why this answer

Conditional Access policies evaluate assignments based on conditions such as user, app, and location. To enforce MFA for all users accessing the Azure portal while excluding the corporate office network, you must include all users and the Azure portal app, then exclude trusted locations (the corporate network). This ensures MFA is required only when access originates from outside the trusted corporate network.

Exam trap

The trap here is that candidates often confuse 'include' and 'exclude' assignments, mistakenly thinking that including trusted locations will skip MFA, when in fact you must exclude trusted locations to bypass MFA from those networks.

How to eliminate wrong answers

Option A is wrong because it includes all users and includes trusted locations, which would require MFA even from the corporate network, contradicting the requirement to skip MFA from trusted locations. Option B is wrong because it only includes trusted locations, which does not specify which users or apps are targeted, leaving the policy incomplete and ineffective. Option C is wrong because it includes the Azure portal app but excludes trusted locations, yet it omits the user assignment (e.g., 'all users'), so the policy would not apply to any user.

Full explanation →

486

MCQmedium

A multinational company uses Microsoft 365 and has a retention policy that automatically applies a 7-year retention label to any document containing a credit card number. The retention label must be automatically applied at the time the document is created or modified. Which Microsoft Purview solution should the administrator use to configure this automatic labeling rule?

A.Microsoft Purview Data Lifecycle Management

B.Microsoft Purview Retention Policy

C.Microsoft Purview Sensitivity Labels

D.Microsoft Purview eDiscovery

AnswerA

Microsoft Purview Data Lifecycle Management is the correct service for managing data retention and deletion across an organization, offering retention labels that can be manually applied or, crucially, automatically applied via auto-labeling policies. These policies leverage conditions like sensitive information types, keywords, or trainable classifiers to ensure content-specific retention actions are taken without manual intervention. This directly addresses the need for content-based automatic retention.

Why this answer

Microsoft Purview Data Lifecycle Management (formerly known as Microsoft 365 Records Management) is the correct solution because it provides the ability to create and apply retention labels automatically based on sensitive information types, such as credit card numbers, using auto-labeling policies. This ensures that the retention label is applied at the time of document creation or modification, meeting the requirement for automatic application without user intervention.

Exam trap

The trap here is that candidates confuse 'Retention Policy' (which applies at the container level) with 'Retention Labels' (which can be auto-applied at the item level), leading them to select Option B, but the question specifically requires automatic labeling based on content, which only Data Lifecycle Management supports.

How to eliminate wrong answers

Option B is wrong because a Microsoft Purview Retention Policy applies retention settings at the container level (e.g., entire site or mailbox) and cannot be configured to automatically apply a specific retention label based on content containing a credit card number; it lacks the granularity for content-based auto-labeling. Option C is wrong because Sensitivity Labels are designed for classification and protection (e.g., encryption, access restrictions) based on sensitivity, not for retention duration; while they can be auto-applied, they do not enforce a 7-year retention period by default. Option D is wrong because Microsoft Purview eDiscovery is used for searching, holding, and exporting content for legal or investigative purposes, not for configuring automatic retention label application based on content detection.

Full explanation →

487

MCQeasy

A company wants to ensure that only authorized users can access sensitive financial data stored in Microsoft SharePoint Online. Which identity feature should they use to require a second form of verification?

A.Microsoft Authenticator

B.Self-service password reset

C.Conditional Access

D.Multi-factor authentication

AnswerD

Multi-factor authentication (MFA) is a security process that requires users to provide two or more distinct verification factors from independent categories to prove their identity. By combining something the user knows (e.g., a password), something the user has (e.g., a phone, smart card), or something the user is (e.g., a fingerprint), MFA significantly enhances security by making it much harder for unauthorized users to gain access, directly fulfilling the requirement for a second form of verification.

Why this answer

Multi-factor authentication (MFA) is the correct answer because it requires a second form of verification, such as a phone call or app notification, in addition to a password. Conditional Access is a policy engine that can enforce MFA but is not itself a verification method. Self-service password reset and Microsoft Authenticator are features that support MFA but are not the overarching concept.

Full explanation →

488

MCQeasy

Your organization wants to enable single sign-on (SSO) for users accessing Microsoft 365 apps from unmanaged devices while enforcing multifactor authentication (MFA). Which Microsoft Entra feature should you configure?

A.Self-Service Password Reset (SSPR)

B.Conditional Access

C.Privileged Identity Management (PIM)

D.Identity Protection

AnswerB

Azure Active Directory Conditional Access is the policy engine that evaluates specific conditions before granting access to resources. It enables organizations to enforce strong authentication requirements, such as Multi-Factor Authentication (MFA), and control access based on factors like user location, device compliance, or application sensitivity. This capability is fundamental for implementing Single Sign-On (SSO) securely by defining the prerequisites for a user's initial authentication and subsequent access to integrated applications.

Why this answer

Conditional Access is the correct feature because it allows you to create policies that enforce specific access controls, such as requiring MFA, based on conditions like device state (unmanaged). By combining a device condition (e.g., 'Device is not compliant' or 'Device is unmanaged') with a grant control requiring MFA, you can achieve SSO for users while enforcing MFA on unmanaged devices. This directly addresses the requirement without affecting managed devices.

Exam trap

The trap here is that candidates often confuse Identity Protection (which detects risk) with Conditional Access (which enforces policy), or mistakenly think SSPR or PIM can enforce MFA on unmanaged devices, when only Conditional Access provides the conditional logic to tie device state to authentication requirements.

How to eliminate wrong answers

Option A is wrong because Self-Service Password Reset (SSPR) is a feature for users to reset their own passwords, not for enforcing MFA or controlling access based on device state. Option C is wrong because Privileged Identity Management (PIM) manages just-in-time access and approval workflows for privileged roles, not device-based access policies or MFA enforcement for all users. Option D is wrong because Identity Protection detects and remediates identity-based risks (e.g., leaked credentials, sign-ins from anonymous IPs) but does not natively enforce MFA based on device management status; it can trigger Conditional Access policies but is not the policy engine itself.

Full explanation →

489

MCQmedium

Your company is implementing data loss prevention (DLP) policies in Microsoft Purview. You need to prevent users from sharing credit card numbers via email. Which type of sensitive information type should you use in the DLP rule?

A.Custom keyword list

B.Built-in sensitive information type

C.Trainable classifier

D.Exact data match (EDM) based classification

AnswerB

Correct because Microsoft Purview includes a predefined sensitive information type for credit card numbers that uses pattern recognition, checksum validation, and keyword lists.

Why this answer

A built-in sensitive information type for credit card numbers is available in Microsoft Purview. Option A is incorrect because a custom keyword list would be inefficient and unreliable for detecting credit card numbers. Option C is incorrect because a trainable classifier is used for custom classification, not for predefined patterns like credit cards.

Option D is incorrect because Exact Data Match (EDM) classification requires a custom database, not a built-in type.

Full explanation →

490

Multi-Selecthard

A security administrator uses Microsoft Entra ID Protection to identify and respond to identity-based risks. Which two types of risk detections can be reviewed in Microsoft Entra ID Protection? (Choose two.)

Select 2 answers

A.Sign-in risk

B.User risk

C.Application permission risk

D.Device compliance risk

AnswersA, B

Microsoft Entra ID Protection actively monitors and evaluates various sign-in attempts for suspicious patterns, classifying them as "sign-in risk." This includes detecting anomalies like impossible travel from geographically disparate locations, sign-ins from anonymous IP addresses or malware-linked IPs, and unfamiliar sign-in properties such as new devices or locations. These real-time detections are crucial for preventing unauthorized access by compromised accounts.

Why this answer

Microsoft Entra ID Protection evaluates identity-based risks by analyzing two primary detection types: sign-in risk and user risk. Sign-in risk assesses the probability that a specific authentication attempt is unauthorized, while user risk evaluates the likelihood that a user account has been compromised based on aggregated suspicious activities.

Exam trap

The trap here is that candidates often confuse risk detection types with other security features like device compliance or application permissions, but Entra ID Protection specifically focuses on sign-in and user risk detections only.

Full explanation →

491

MCQhard

Your company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive information. You need to create a policy that prevents users from sharing credit card numbers via email, but allows them to share internally with other employees. The policy should also notify the user when an attempt is made to share externally. What should you configure?

A.Create a DLP policy with the condition 'Content contains credit card number' and action 'Block access to content' for all recipients.

B.Create a DLP policy with the condition 'Content contains credit card number' and action 'Block external sharing' but allow internal sharing, and enable user notifications.

C.Create a DLP policy with the condition 'Content contains credit card number' and action 'Allow override' with a business justification.

D.Create a DLP policy with the condition 'Content contains credit card number' and action 'Notify user with policy tip' but no blocking.

AnswerB

This option is correct as it precisely addresses the common requirement to protect sensitive data from leaving the organization while enabling necessary internal collaboration. The 'Block external sharing' action directly prevents data exfiltration to unauthorized external parties, while explicitly allowing internal sharing supports legitimate business operations. Furthermore, enabling user notifications with policy tips is a best practice for educating users about compliance policies and fostering a security-aware culture.

Why this answer

Microsoft Purview DLP allows you to configure a policy that blocks external sharing of sensitive data (credit card numbers) while permitting internal sharing, and user notifications can be enabled to alert users when they attempt to share externally. This meets the requirement to prevent external sharing, allow internal sharing, and notify the user.

Exam trap

The trap here is that candidates often confuse 'Block access to content' with 'Block external sharing', not realizing that the former blocks all sharing (internal and external) while the latter specifically targets external recipients, allowing internal sharing as required.

How to eliminate wrong answers

Option A is wrong because blocking access to content for all recipients would prevent both internal and external sharing, which does not meet the requirement to allow internal sharing. Option C is wrong because allowing override with a business justification would permit users to bypass the block, potentially allowing external sharing without proper control, and does not inherently block external sharing by default. Option D is wrong because notifying the user with a policy tip but no blocking would not prevent external sharing, only warn the user, which fails the requirement to block external sharing.

Full explanation →

492

MCQmedium

A company has a Microsoft Entra ID tenant and an on-premises Active Directory Domain Services (AD DS) forest. They need to synchronize user accounts, groups, and passwords from AD DS to Microsoft Entra ID. Due to network restrictions, they prefer a lightweight agent that can be deployed on-premises and supports staging mode for testing. Which identity synchronization tool should they use?

A.Microsoft Entra Connect Sync

B.Microsoft Entra Connect Health

C.Microsoft Entra Cloud Sync

D.Microsoft Identity Manager (MIM)

AnswerA

Microsoft Entra Connect Sync is the primary and recommended tool for establishing hybrid identity by synchronizing users, groups, and devices from a single on-premises Active Directory Domain Services (AD DS) forest to Microsoft Entra ID. It supports various authentication methods like Password Hash Synchronization (PHS), Pass-through Authentication (PTA), and federation with AD FS. Its robust feature set includes attribute filtering, writeback capabilities, and a crucial staging mode for testing configurations before full deployment, making it ideal for most enterprise scenarios.

Why this answer

Microsoft Entra Connect Sync is the correct choice because it is the full-featured synchronization tool that supports staging mode for testing and can be deployed as a lightweight agent on-premises. It synchronizes user accounts, groups, and passwords from AD DS to Microsoft Entra ID, including password hash synchronization, pass-through authentication, and federation integration, making it ideal for complex on-premises environments with network restrictions.

Exam trap

The trap here is that candidates confuse 'Cloud Sync' as the lightweight agent because it is simpler, but they overlook that Cloud Sync does not support staging mode, which is explicitly required in the question.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra Connect Health is a monitoring and analytics tool, not a synchronization engine; it provides health insights for Entra Connect Sync but does not perform identity sync itself. Option C is wrong because Microsoft Entra Cloud Sync is a lightweight agent that syncs from AD DS to Entra ID but does not support staging mode; it is designed for simpler scenarios and lacks the full staging and testing capabilities of Entra Connect Sync. Option D is wrong because Microsoft Identity Manager (MIM) is an on-premises identity management solution that can sync to Entra ID but is not a lightweight agent; it requires a full server deployment and does not natively support staging mode for Entra ID synchronization.

Full explanation →

493

MCQmedium

Your company, Proseware, uses Microsoft Entra ID P2. You have a custom application that integrates with Microsoft Graph API to read user profiles. The application uses client credentials flow (application permissions). You need to ensure that the application can only read user profiles and not perform any other operations. Additionally, you want to review and approve the permissions periodically. What should you do?

A.Create a Conditional Access policy to restrict the app to read-only operations.

B.Enable Privileged Identity Management for the app and require approval for each API call.

C.Use delegated permissions for the application and assign users to the app role.

D.In Microsoft Entra ID, grant the application the User.Read.All permission and configure an access review for the application permissions.

AnswerD

Granting the `User.Read.All` application permission provides the necessary access for an application to read all user profiles in Microsoft Entra ID without granting excessive write or administrative capabilities, adhering to the principle of least privilege. Configuring an access review for these application permissions ensures that the granted access is periodically re-evaluated by designated reviewers, promoting ongoing security hygiene and preventing the accumulation of stale or unnecessary permissions over time.

Why this answer

The application uses client credentials flow (application permissions), which requires granting an application permission like User.Read.All to read all user profiles. Configuring an access review for the application permissions in Microsoft Entra ID allows periodic review and approval of those permissions, meeting the requirement to ensure the app can only read user profiles and that permissions are reviewed periodically.

Exam trap

The trap here is that candidates may confuse Conditional Access policies or PIM with permission management, not realizing that application permissions in the client credentials flow are static and require access reviews for periodic oversight, not dynamic runtime controls.

How to eliminate wrong answers

Option A is wrong because Conditional Access policies control user sign-in and access conditions, not the scope of permissions granted to an application; they cannot restrict an app to read-only operations after permissions are granted. Option B is wrong because Privileged Identity Management (PIM) is designed for just-in-time privileged role activation, not for requiring approval on each API call; it does not restrict the permissions of an application or approve individual API calls. Option C is wrong because delegated permissions operate on behalf of a signed-in user and are not suitable for a client credentials flow (application permissions) which runs without a user context; assigning users to an app role does not change the permission type.

Full explanation →

494

MCQhard

A multinational corporation must comply with the EU General Data Protection Regulation (GDPR). They need to respond to a data subject access request (DSAR) by searching for personal data across Exchange Online, SharePoint Online, and OneDrive for Business. Which Microsoft Purview solution should they use?

A.Data Lifecycle Management

B.Audit (Premium)

C.eDiscovery (Premium)

D.Data Loss Prevention (DLP)

AnswerC

eDiscovery can search across mailboxes, sites, and OneDrive to find personal data for DSARs.

Why this answer

EDiscovery (Premium) provides powerful search capabilities across Exchange Online, SharePoint Online, and OneDrive for Business, making it suitable for DSARs. Option A is incorrect because Data Lifecycle Management focuses on retention and deletion policies, not content search. Option B is incorrect because Audit (Premium) logs user activities but does not search for specific content.

Option D is incorrect because Data Loss Prevention (DLP) prevents data leakage but does not provide the content search needed for DSARs.

Full explanation →

495

MCQhard

Refer to the exhibit. You are reviewing a Microsoft Purview classification rule. The rule is enabled and set to apply a sensitivity label. However, you notice that documents containing EU personal data are not being labeled automatically. What is the most likely cause?

A.The label ID is invalid

B.The rule does not include a condition to detect sensitive data

C.The rule status is Disabled

D.The rule is not scoped to SharePoint Online

AnswerB

For an auto-labeling policy or rule to effectively identify and apply a sensitivity label to content, it must incorporate specific conditions that define what constitutes sensitive data. These conditions typically involve detecting specific sensitive information types (SITs), keywords, or patterns within documents or emails. Without any defined conditions, the rule lacks the necessary criteria to evaluate content, rendering it incapable of matching or labeling any data, regardless of other policy settings.

Why this answer

The rule is enabled and applies a sensitivity label, but documents containing EU personal data are not being labeled automatically. For automatic labeling to occur, the classification rule must include a condition that detects sensitive data types (e.g., EU passport numbers or GDPR-defined personal data). Without such a condition, the rule has no trigger to identify the content and apply the label, even if the rule is active and scoped correctly.

Exam trap

Microsoft often tests the misconception that enabling a rule and setting a label is sufficient for automatic labeling, when in fact a sensitive data detection condition is mandatory for the rule to trigger.

How to eliminate wrong answers

Option A is wrong because an invalid label ID would cause a configuration error or prevent the label from being applied at all, but the question states the rule is enabled and set to apply a sensitivity label, implying the label ID is valid. Option C is wrong because the rule status is explicitly stated as enabled, not disabled. Option D is wrong because the rule not being scoped to SharePoint Online would prevent labeling in that workload, but the issue is that documents are not being labeled at all, regardless of location, and the core problem is the lack of a detection condition.

Full explanation →

496

MCQeasy

An organization wants to ensure that only managed and compliant devices can access corporate email in Exchange Online. Which Microsoft Entra ID Conditional Access policy setting should they use?

A.Require device to be marked as compliant

B.Require approved client app

C.Require hybrid Azure AD joined device

D.Require multi-factor authentication

AnswerA

This Conditional Access control directly addresses the requirement by ensuring that only devices evaluated and reported as 'compliant' by Microsoft Intune (or a third-party MDM integrated with Azure AD) are granted access. Device compliance policies define security baselines, such as minimum OS versions, encryption status, or antivirus presence. By enforcing this control, the organization guarantees that devices accessing resources adhere to established security standards and are actively managed.

Why this answer

To ensure only managed and compliant devices access corporate email in Exchange Online, the 'Require device to be marked as compliant' setting in a Conditional Access policy evaluates the device's compliance status reported by Microsoft Intune. This ensures that devices meet security policies (e.g., encryption, patch levels) before granting access, directly addressing the requirement for managed and compliant access.

Exam trap

The trap here is that candidates often confuse 'hybrid Azure AD joined' (a device identity state) with 'compliant' (a device health state), leading them to choose Option C, but only compliance ensures the device meets security policies, not just domain join.

How to eliminate wrong answers

Option B is wrong because 'Require approved client app' controls which client applications (e.g., Outlook mobile) can access Exchange Online, but it does not enforce device management or compliance; a non-compliant device could still use an approved app. Option C is wrong because 'Require hybrid Azure AD joined device' mandates that the device is joined to both on-premises AD and Azure AD, which is a domain-join state, not a compliance check; a hybrid joined device could be non-compliant with Intune policies. Option D is wrong because 'Require multi-factor authentication' adds an authentication layer but does not verify device management or compliance; a compromised but MFA-enabled device could still access email.

Full explanation →

497

MCQhard

A company uses Microsoft Purview. A compliance officer applies a retention label to a set of legal documents and configures the label to mark the items as records. After the label is applied, a user attempts to delete one of these documents from SharePoint Online. What will be the outcome?

A.The user is allowed to delete the document, but a copy is retained in a preservation hold.

B.The user receives an access denied error and cannot delete the document.

C.The document is deleted and immediately purged from the recycle bin.

D.The delete action is allowed but an audit event is generated and the document is still retained for the specified period.

AnswerB

When a compliance officer applies a record label to a document in Microsoft Purview, the item becomes an immutable record. This action prevents any user, including the creator or an administrator, from deleting or modifying the document during its retention period. Consequently, any attempt to delete the document will result in an "access denied" error, ensuring the integrity and immutability required for regulatory compliance and legal obligations.

Why this answer

When a retention label is configured to mark items as records, the items become immutable and locked. In SharePoint Online, records cannot be deleted by users; any attempt to delete a record results in an 'access denied' error because the retention policy overrides standard user permissions to enforce compliance.

Exam trap

The trap here is that candidates often confuse 'records' with 'regulatory records' or assume that retention labels only trigger audit events without blocking actions, but marking as a record strictly prohibits deletion and editing.

Why the other options are wrong

When a retention label marks items as records, they become immutable and cannot be deleted by users. The label prevents deletion entirely, not just with a copy retained.

When a retention label marks items as records, they become immutable and cannot be deleted by users; deletion is blocked entirely, not allowed with immediate purge.

When a retention label marks items as records, they become immutable and cannot be deleted by users. Option D describes behavior for items under a retention policy without record marking, not for records.

When would these options actually be correct?

This option would be correct if the question stated that a preservation hold (e.g., eDiscovery hold) was applied to the document instead of a retention label marking it as a record. In that case, deletion is blocked but a copy is preserved.

If a retention policy (not label) with a 'delete only' action is applied to a location, and the user deletes a document, it may be immediately purged from the recycle bin if the retention period is set to zero days.

If the question specified that the retention label was configured to retain content but not mark as records, and the user deletes the document, then the delete would be allowed but the document would be retained in a preservation hold for the specified period, with an audit event generated.

Why candidates pick the wrong answer

Candidates may confuse retention labels that mark as records with preservation holds, both of which prevent deletion but differ in behavior: records block deletion outright, while holds retain a copy.

Candidates may confuse the behavior of retention labels that mark as records with retention policies that allow deletion after a period, or think that 'record' status only triggers a purge rather than blocking deletion.

Candidates may confuse retention policies (which allow deletion but retain copies) with record labeling (which blocks deletion entirely), or they may think audit logging always accompanies deletion actions.

Full explanation →

498

MCQmedium

Your organization, Fabrikam, has recently merged with another company. You need to provide seamless access to resources for users from both companies while maintaining separate identity directories. The users from the acquired company have their own Microsoft Entra ID tenant. You need to enable them to access applications in your tenant using their existing corporate credentials, without creating new accounts. Additionally, you want to enforce conditional access policies from your tenant for these users. Which approach should you use?

A.Create new user accounts in your tenant for the acquired company's users and assign them access.

B.Set up a federation trust between your tenant and the other company's on-premises Active Directory.

C.Use Microsoft Entra B2C to create a custom identity provider for the other company.

D.Use Microsoft Entra B2B collaboration to invite users from the other tenant as guest users, and apply conditional access policies to guest users.

AnswerD

Microsoft Entra B2B collaboration is the correct and most efficient solution for integrating users from another Microsoft Entra ID tenant following a merger. It allows Fabrikam to invite the acquired company's users as guest accounts, enabling them to authenticate using their existing credentials from their home tenant. Furthermore, Fabrikam can apply its own Conditional Access policies to these guest users, ensuring consistent security and compliance standards are enforced for all access to its resources.

Why this answer

Microsoft Entra B2B collaboration allows you to invite external users from another Microsoft Entra tenant to access your applications using their own corporate identities. This approach meets the requirement of not creating new accounts, and because guest users are represented as user objects in your tenant, you can enforce your own conditional access policies on them. Option D is correct because it directly addresses the need for seamless access with separate directories and policy control.

Exam trap

The trap here is confusing Microsoft Entra B2B collaboration (for business-to-business guest access with existing corporate identities) with Microsoft Entra B2C (for customer-facing identity management), leading candidates to incorrectly select option C.

How to eliminate wrong answers

Option A is wrong because creating new user accounts violates the requirement to use existing corporate credentials without creating new accounts. Option B is wrong because federation trust with on-premises Active Directory does not directly enable access to applications in your Microsoft Entra tenant for users from another Microsoft Entra tenant; it is used for hybrid identity scenarios with your own on-premises directory. Option C is wrong because Microsoft Entra B2C is designed for customer-facing identity management with social or local accounts, not for enabling access for users from another Microsoft Entra tenant using their existing corporate credentials.

Full explanation →

499

MCQmedium

A company uses Microsoft 365 and many third-party SaaS apps like Salesforce and Box. The security team wants to detect when a user downloads a large number of files from a cloud storage app after hours, which may indicate data exfiltration. Which Microsoft security solution should be used to detect such anomalous behavior in cloud apps?

A.Microsoft Defender for Office 365

B.Microsoft Defender for Identity

C.Microsoft Defender for Cloud Apps

D.Microsoft Defender for Cloud

AnswerC

Microsoft Defender for Cloud Apps functions as a comprehensive Cloud Access Security Broker (CASB), providing deep visibility, robust control, and advanced threat protection for data across an organization's entire cloud application landscape, including both Microsoft and numerous third-party SaaS applications. It excels at discovering shadow IT, enforcing granular data loss prevention policies, and detecting anomalous user behavior or threats within these diverse cloud environments. Its capabilities are specifically tailored to monitor and secure interactions with external SaaS applications, making it the correct choice for this scenario.

Why this answer

Microsoft Defender for Cloud Apps (MDCA) is the correct solution because it provides Cloud Access Security Broker (CASB) functionality, including anomaly detection policies that can identify unusual user behavior such as downloading a large number of files from a cloud storage app after hours. MDCA uses machine learning to establish a baseline of normal user activity and then triggers alerts when deviations like high-volume downloads occur, which is a classic indicator of data exfiltration.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud Apps with Microsoft Defender for Cloud, mistakenly thinking the latter covers SaaS app security, when in fact Defender for Cloud is focused on infrastructure workload protection (CSPM/CWPP) and not user behavior in cloud apps.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Office 365 focuses on protecting email and collaboration tools (Exchange Online, SharePoint, Teams) from threats like phishing and malware, not on detecting anomalous behavior across third-party SaaS apps like Salesforce or Box. Option B is wrong because Microsoft Defender for Identity monitors on-premises Active Directory and hybrid identities for attacks like pass-the-hash or Kerberos abuse, not user activity in cloud apps. Option D is wrong because Microsoft Defender for Cloud is designed for securing cloud workloads (VMs, containers, databases) in Azure and multi-cloud environments, not for detecting user-driven data exfiltration in SaaS applications.

Full explanation →

500

MCQeasy

A company uses Microsoft Entra ID. They want to allow employees to access the expense reporting application only from managed devices that are compliant with security policies and from trusted IP ranges. Additionally, if the user's sign-in risk is high, access must be blocked. Which of the following conditions should the administrator configure in a Conditional Access policy to enforce these requirements?

A.Only Device state and Locations

B.Only Sign-in risk and Device state

C.Device state, Locations, and Sign-in risk

D.Only Locations and Sign-in risk

AnswerC

This configuration provides a robust and comprehensive security posture by combining all three essential conditions. Device state ensures that only healthy, managed, and compliant devices can access resources, mitigating endpoint-related risks. Locations restricts access to authorized network perimeters, such as corporate offices or VPNs, preventing unauthorized external access. Sign-in risk dynamically assesses the likelihood of a compromised sign-in and can block or challenge suspicious attempts, providing a multi-faceted defense against evolving threats.

Why this answer

The scenario requires three distinct conditions: device compliance (Device state), trusted network locations (Locations), and high sign-in risk (Sign-in risk). Conditional Access policies in Microsoft Entra ID allow combining these assignments to enforce granular access controls. Only by including all three can the administrator block access when the user's sign-in risk is high, while also requiring a managed device and trusted IP range.

Exam trap

The trap here is that candidates often assume only two conditions are needed (e.g., device and location, or risk and device) and overlook the third, but the question explicitly lists three distinct requirements that must all be enforced simultaneously.

How to eliminate wrong answers

Option A is wrong because it omits Sign-in risk, which is explicitly required to block access when sign-in risk is high. Option B is wrong because it omits Locations, which is needed to restrict access to trusted IP ranges. Option D is wrong because it omits Device state, which is required to enforce access only from managed devices that are compliant with security policies.

Full explanation →

501

MCQmedium

A security administrator at an organization using Microsoft Entra ID needs to automatically detect user sign-ins that exhibit risky behavior, such as signing in from a suspicious IP address or using leaked credentials. The administrator also wants the system to automatically calculate a risk level for each user and take actions like requiring a password reset when risk is high. Which Microsoft Entra ID feature should the administrator use?

A.Identity Protection

B.Privileged Identity Management (PIM)

C.Conditional Access

D.Identity Governance

AnswerA

Identity Protection detects and handles risky sign-ins and user behavior, providing automated risk-based remediation.

Why this answer

Microsoft Entra ID Protection is the correct feature because it automatically detects risky sign-in behaviors—such as sign-ins from suspicious IP addresses, anonymous IP addresses, or leaked credentials—and calculates a user risk level. It can then automatically trigger remediation actions like requiring a password reset when the risk level is high, directly matching the administrator's requirements.

Exam trap

The trap here is that candidates often confuse Conditional Access with Identity Protection, but Conditional Access is the enforcement layer that uses risk signals from Identity Protection—it does not perform the detection or risk calculation itself.

Why the other options are wrong

Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles in Microsoft Entra ID, but it does not detect risky sign-ins or calculate user risk levels based on behaviors like suspicious IP addresses or leaked credentials.

Conditional Access enforces policies based on signals like location or device state, but it does not automatically detect risky sign-ins or calculate user risk levels; it relies on Identity Protection for risk detection.

Identity Governance focuses on managing user access rights and certifications, not on detecting risky sign-in behaviors or calculating risk levels. It does not automatically detect suspicious IP addresses or leaked credentials.

When would these options actually be correct?

PIM would be correct if the question asked for a feature that provides just-in-time privileged access, role activation with approval workflows, or auditing of privileged role assignments to reduce standing access.

A question asking: 'An administrator needs to block sign-ins from untrusted locations unless multi-factor authentication is completed. Which feature should be used?' — Conditional Access would be correct for enforcing such access controls.

An organization needs to automate the review and certification of user access to resources, ensuring that only authorized users have access and that access is periodically recertified. In that scenario, Identity Governance would be the correct feature.

Why candidates pick the wrong answer

Candidates may confuse PIM with Identity Protection because both involve security and risk, but PIM focuses on privileged access management rather than user sign-in risk detection.

Candidates may confuse Conditional Access's ability to respond to risk signals with the automatic detection and risk calculation that Identity Protection provides, assuming CA includes risk assessment.

Candidates may confuse 'governance' with 'protection' or think that managing user identities includes risk detection, but Identity Governance is about access lifecycle management, not real-time risk analysis.

Full explanation →

502

MCQmedium

A company wants to require multi-factor authentication (MFA) for all users accessing a financial application, but only when they sign in from outside the corporate network. Which Microsoft Entra ID feature should be used?

A.Identity Protection

B.Conditional Access

C.Privileged Identity Management (PIM)

D.Self-Service Password Reset (SSPR)

AnswerB

Conditional Access policies evaluate various signals in real-time, including user, device, application, and network location. Administrators can configure these policies to mandate specific controls, such as multi-factor authentication (MFA), when certain conditions are met, like a user attempting to access resources from an untrusted network or outside the corporate IP range. This directly addresses the requirement to enforce MFA for users accessing resources under specific conditions.

Why this answer

Conditional Access is the correct choice because it allows administrators to define policies that enforce multi-factor authentication (MFA) based on specific conditions, such as network location. In this scenario, a Conditional Access policy can be configured to require MFA only when users access the financial application from outside the corporate network, using the 'Locations' condition to distinguish trusted IP ranges from external sign-ins. This granular control directly addresses the requirement without affecting internal access.

Exam trap

The trap here is that candidates often confuse Identity Protection's risk-based MFA triggers with Conditional Access's location-based MFA enforcement, assuming Identity Protection alone can enforce MFA based on network location, whereas it only provides risk signals that must be consumed by a Conditional Access policy.

Why the other options are wrong

Identity Protection is a tool for detecting and responding to identity risks, but it does not enforce access controls like requiring MFA based on network location. Conditional Access is the feature that applies policies such as location-based MFA requirements.

Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles, not location-based MFA enforcement. It does not evaluate network location to trigger MFA.

Self-Service Password Reset (SSPR) allows users to reset their own passwords without administrator intervention, but it does not enforce multi-factor authentication based on network location. The requirement to require MFA only when signing in from outside the corporate network is a conditional access policy, which is handled by Conditional Access, not SSPR.

When would these options actually be correct?

Identity Protection would be correct if the question asked: 'Which Microsoft Entra ID feature should be used to detect and automatically respond to risky sign-in behaviors, such as sign-ins from anonymous IP addresses or leaked credentials?'

A company needs to provide just-in-time privileged access to Azure AD roles and require approval or MFA for role activation. In that scenario, PIM is the correct feature to use.

A company wants to allow users to reset their own passwords securely by verifying their identity through a second factor, such as a phone call or text message. Which Microsoft Entra ID feature should be used?

Why candidates pick the wrong answer

Candidates may confuse Identity Protection's risk detection capabilities with Conditional Access's policy enforcement, thinking that risk-based policies automatically include location-based MFA requirements.

Candidates may confuse PIM's ability to require MFA for role activation with Conditional Access's ability to require MFA based on location, because both involve MFA but serve different purposes.

Candidates may confuse SSPR with MFA because SSPR can require MFA during the password reset process, leading them to think it can enforce MFA for sign-ins.

Full explanation →

503

MCQhard

A multinational organization uses Microsoft Entra ID for identity management. The security team wants to implement a Conditional Access policy that blocks access from untrusted locations unless the user's device is marked as compliant by Microsoft Intune. However, users traveling to trusted partner locations should be allowed access even if their device is non-compliant. Which two conditions should be configured in the policy?

A.Locations: All trusted locations; Grant: Require compliant device.

B.Locations: All trusted locations; Grant: Block access.

C.Locations: All locations, exclude trusted locations; Grant: Require compliant device.

D.Locations: All locations; Grant: Require compliant device.

AnswerC

This policy correctly targets "All locations" while specifically excluding "trusted locations" from its scope. Consequently, it applies only to untrusted network locations. For access attempts originating from these untrusted environments, the policy mandates that the device must be compliant with organizational security standards. Access from trusted locations is not governed by this specific policy, effectively allowing access from those locations without requiring device compliance, which aligns with typical security requirements.

Why this answer

The policy must block access from untrusted locations unless the device is compliant, while allowing access from trusted partner locations even if the device is non-compliant. By setting 'Locations: All locations' and excluding trusted locations, the policy applies only to untrusted locations. Then, 'Grant: Require compliant device' ensures that only compliant devices can access from those untrusted locations, meeting both requirements.

Exam trap

The trap here is that candidates often confuse 'exclude trusted locations' with 'include trusted locations,' leading them to choose options that incorrectly apply the policy to trusted locations instead of untrusted ones.

How to eliminate wrong answers

Option A is wrong because it applies the policy to all trusted locations, which would block non-compliant devices from trusted partner locations, contradicting the requirement to allow access from trusted locations even if non-compliant. Option B is wrong because it blocks access from all trusted locations entirely, which does not allow any access from trusted partner locations, regardless of device compliance. Option D is wrong because it applies the policy to all locations without excluding trusted locations, meaning non-compliant devices would be blocked from trusted partner locations as well, failing the requirement to allow access from those locations.

Full explanation →

504

MCQeasy

A company implements regular data backups and a disaster recovery plan to restore critical systems after an outage. Which security principle is primarily being addressed by these measures?

A.Confidentiality

B.Integrity

C.Availability

D.Non-repudiation

AnswerC

Regular data backups and a disaster recovery plan are fundamental controls to ensure Availability. Availability guarantees that authorized users can access information and systems when needed, without undue interruption. By creating redundant copies of data and establishing procedures to restore operations after disruptive events, these measures directly support the continuous accessibility and usability of critical business resources.

Why this answer

Regular data backups and a disaster recovery plan directly ensure that critical systems and data can be restored and remain accessible after an outage. This aligns with the Availability principle of the CIA triad, which guarantees that authorized users have reliable access to resources when needed. In Azure, this is supported by services like Azure Backup and Azure Site Recovery, which provide automated backup and failover capabilities to maintain uptime.

Exam trap

The trap here is that candidates often confuse backups and disaster recovery with Confidentiality or Integrity, mistakenly thinking that protecting data copies implies preventing unauthorized access or tampering, rather than recognizing that the core goal is restoring access and system operation.

Why the other options are wrong

Data backups and disaster recovery plans primarily ensure that systems and data can be restored after an outage, which directly supports availability. Confidentiality is about preventing unauthorized access, not about restoring systems after failures.

Integrity ensures data is not tampered with or altered, but backups and disaster recovery primarily restore availability after an outage, not protect against unauthorized modifications.

Non-repudiation ensures that actions or transactions cannot be denied by the parties involved, typically through digital signatures or audit logs. Data backups and disaster recovery do not address non-repudiation; they focus on restoring system functionality after an outage, which is about availability.

When would these options actually be correct?

A question that asks which security principle is addressed by encrypting data at rest and in transit, or by implementing access controls to prevent unauthorized disclosure, would have confidentiality as the correct answer.

A question asking which security principle is addressed by hashing or digital signatures to verify data has not been altered during transmission would make integrity the correct answer.

A question that asks: 'A company uses digital signatures to ensure that employees cannot deny having submitted expense reports. Which security principle is being addressed?' In that context, non-repudiation would be the correct answer because digital signatures provide proof of origin and integrity, preventing denial of actions.

Why candidates pick the wrong answer

Candidates may confuse backups with protecting data from unauthorized access, thinking backups prevent data breaches, but backups are about recovery, not confidentiality.

Candidates may confuse backups with ensuring data remains unchanged (integrity), not realizing backups primarily restore access (availability).

Candidates may confuse non-repudiation with availability because both involve ensuring that systems and data are accessible when needed, but non-repudiation specifically deals with accountability and proof of actions, not system uptime or recovery.

Full explanation →

505

MCQeasy

Your organization, Fabrikam Inc., uses Microsoft 365 and has Microsoft Purview licensed. You need to implement a compliance solution to monitor and prevent the sharing of confidential financial data via email. Specifically, you want to: (1) Detect when users send emails containing financial account numbers (e.g., credit card numbers) to external recipients. (2) Automatically block such emails with a policy tip notifying the sender. (3) Allow the sender to override the block if they provide a business justification. (4) Create a report of all blocked emails for compliance review. Which Microsoft Purview feature should you configure?

A.Microsoft Purview Communication Compliance

B.Microsoft Purview Message Encryption

C.Microsoft Purview Data Loss Prevention (DLP)

D.Microsoft Purview Data Lifecycle Management

AnswerC

Data Loss Prevention (DLP) policies can detect sensitive information such as credit card numbers in emails, block the message with a policy tip, allow override with business justification, and generate reports for compliance review.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive information in emails and apply actions such as block with policy tip and allow override with justification. DLP also provides incident reports. Option A (Communication Compliance) is for communication monitoring, not data protection.

Option B (Message Encryption) is for email encryption, not blocking. Option D (Data Lifecycle Management) is for retention, not real-time blocking.

Full explanation →

506

MCQeasy

Your organization uses Microsoft Entra ID and needs to allow external partners to sign in using their own identity providers (e.g., Google or Facebook). Which Microsoft Entra feature should you configure?

A.Microsoft Entra Privileged Identity Management

B.Microsoft Entra External Identities (B2B collaboration)

C.Microsoft Entra Verified ID

D.Microsoft Entra Identity Protection

AnswerB

Microsoft Entra External Identities, particularly its B2B collaboration feature, is the correct solution for enabling external users to securely access an organization's applications and resources. This service allows guest users to sign in using their own corporate credentials, social identities, or other identity providers, seamlessly integrating them into the host organization's Microsoft Entra ID tenant for collaborative purposes.

Why this answer

Microsoft Entra External Identities (B2B collaboration) is the correct feature because it allows external partners to sign in using their own identity providers, such as Google or Facebook, through federation. B2B collaboration supports SAML/WS-Fed identity providers and social identity providers like Google, enabling guest users to access your organization's resources without needing a separate Microsoft account. This directly meets the requirement for external partner access with their own credentials.

Exam trap

The trap here is that candidates often confuse B2B collaboration with B2C (Azure AD B2C) or think PIM is needed for external access, but B2B collaboration is specifically designed for federating external identities from any IdP without requiring a separate directory.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Privileged Identity Management (PIM) is a feature for managing, controlling, and monitoring access to privileged roles within your own directory, not for enabling external identity providers. Option C is wrong because Microsoft Entra Verified ID is a decentralized identity solution based on verifiable credentials (W3C standards) for issuing and verifying claims, not for federating external sign-in with Google or Facebook. Option D is wrong because Microsoft Entra Identity Protection is a risk-based security tool that detects and responds to identity threats (e.g., leaked credentials, sign-in anomalies), not a feature for configuring external identity providers.

Full explanation →

507

MCQhard

A legal department is preparing for litigation. They need to preserve all potentially relevant content in Exchange Online, SharePoint Online, and Teams to prevent deletion or modification. Additionally, they must search across these locations for specific keywords and export the results for external review. Which Microsoft Purview solution should they use?

A.eDiscovery (Standard)

B.Audit (Standard)

C.Data Lifecycle Management

D.Communication Compliance

AnswerA

eDiscovery (Standard) allows legal hold, search, and export of content across Exchange, SharePoint, Teams, and more for legal cases.

Why this answer

eDiscovery (Standard) is the correct solution because it provides the capabilities to place Exchange Online, SharePoint Online, and Teams content on legal hold to preserve it from deletion or modification, and it includes built-in search and export functions for litigation. This solution directly addresses the requirements for preservation, keyword search across multiple workloads, and export for external review.

Exam trap

The trap here is that candidates often confuse Audit (Standard) with eDiscovery because both are in the Purview compliance portal, but Audit only records events while eDiscovery provides the legal hold, search, and export actions required for litigation.

Why the other options are wrong

Audit (Standard) logs user and admin activities but does not provide capabilities to preserve content via legal hold or search/export content across Exchange, SharePoint, and Teams for litigation.

Data Lifecycle Management focuses on retaining or deleting content based on policies (e.g., retention tags), not on preserving content for litigation (legal hold) or searching/exporting for eDiscovery purposes.

Communication Compliance is designed to detect and mitigate communication risks (e.g., harassment, insider trading) by analyzing messages, not to preserve, search, and export content for litigation hold and eDiscovery purposes.

When would these options actually be correct?

An organization needs to investigate a security incident and must review user activity logs (e.g., who accessed a file, when, and from where) across Microsoft 365 services for a specific time period.

A question asking which solution to use for automatically retaining emails for a regulatory compliance period (e.g., 7 years) and then deleting them, without needing to search or export for litigation.

A company wants to monitor employee communications for policy violations, such as inappropriate language or sharing of confidential information, and automatically flag or remediate those messages. Communication Compliance would be the correct solution.

Why candidates pick the wrong answer

Candidates may confuse auditing with eDiscovery because both involve searching and reviewing data, but Audit focuses on activity logs rather than preserving and exporting content items.

Candidates may confuse retention policies (Data Lifecycle Management) with legal hold (eDiscovery), as both involve preserving data, but Data Lifecycle Management lacks search and export capabilities for litigation.

Candidates may confuse the monitoring and search capabilities of Communication Compliance with the preservation and search features of eDiscovery, especially since both involve scanning communications across Exchange, SharePoint, and Teams.

Full explanation →

508

MCQmedium

A user reports frequent password reset requests. You suspect password spray attacks. Which Microsoft Entra ID feature should you use to investigate?

A.Identity Protection risk detections

B.Audit logs

C.Conditional Access policies

D.Multifactor authentication

AnswerA

Azure AD Identity Protection actively monitors user sign-ins and user behavior for suspicious activities, including password spray attacks, impossible travel, anomalous IP addresses, and leaked credentials. When it detects these risks, it generates risk detections that can trigger automated responses or alert administrators. This capability directly addresses the need to identify the cause of frequent password reset requests by pinpointing the underlying attack patterns.

Why this answer

Identity Protection risk detections are the correct feature because they specifically analyze sign-in patterns and flag suspicious activities such as password spray attacks. A password spray attack involves an attacker trying a small number of common passwords against many accounts, and Identity Protection uses machine learning to detect this anomalous behavior and generate risk detections like 'Unfamiliar sign-in properties' or 'Malicious IP address'.

Exam trap

The trap here is that candidates confuse Audit logs (which show what happened) with Identity Protection risk detections (which analyze why it happened), leading them to pick Audit logs as the investigative tool for attack patterns.

How to eliminate wrong answers

Option B is wrong because Audit logs record administrative actions and configuration changes, not real-time sign-in risk analysis; they would show password reset events but not identify the attack pattern. Option C is wrong because Conditional Access policies enforce access controls based on conditions (e.g., require MFA), but they do not provide investigative insights into attack patterns like password spray. Option D is wrong because Multifactor authentication is a security control that adds a second verification step, not a detective tool for analyzing sign-in anomalies.

Full explanation →

509

MCQhard

A company uses Microsoft 365 and many third-party SaaS apps like Salesforce and Box. The security team needs to discover which unsanctioned cloud apps employees are using (Shadow IT). They also want to get a risk score for each app and receive alerts when a high-risk app is used. Which Microsoft security solution should they use?

A.Microsoft Defender for Endpoint

B.Microsoft Defender for Identity

C.Microsoft Defender for Cloud Apps

D.Microsoft Purview Compliance Manager

AnswerC

Defender for Cloud Apps includes Cloud Discovery, which identifies used apps, assigns risk scores, and alerts on high-risk app usage.

Why this answer

Microsoft Defender for Cloud Apps (MDCA) is the correct solution because it is specifically designed for Cloud Access Security Broker (CASB) functions, including Shadow IT discovery, risk scoring of cloud apps, and policy-based alerts. It integrates with Microsoft 365 and third-party SaaS apps via API connectors and log collectors to identify unsanctioned app usage and assign a risk score based on factors like compliance, security controls, and industry standards.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud Apps with other Defender products (Endpoint or Identity) because they all share the 'Defender' branding, but only Cloud Apps provides CASB capabilities for Shadow IT discovery and app risk scoring.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for devices, not on discovering unsanctioned cloud app usage or providing app-specific risk scores. Option B is wrong because Microsoft Defender for Identity monitors on-premises Active Directory and hybrid identities for attacks like pass-the-hash, not cloud app discovery or Shadow IT. Option D is wrong because Microsoft Purview Compliance Manager is a compliance management tool for assessing regulatory posture and managing controls, not for discovering unsanctioned cloud apps or generating risk scores for third-party SaaS applications.

Full explanation →

510

MCQeasy

A security administrator needs to identify and remediate misconfigurations in Azure resources that could lead to security breaches. They want a central dashboard that provides a secure score based on security controls and recommendations. Which Microsoft solution should they use?

A.Microsoft Defender for Cloud

B.Microsoft Sentinel

C.Microsoft 365 Defender

D.Microsoft Intune

AnswerA

Defender for Cloud provides a secure score and actionable recommendations to improve the security posture of cloud and hybrid resources.

Why this answer

Microsoft Defender for Cloud provides a centralized dashboard that continuously assesses Azure resources against security best practices, delivering a secure score based on implemented security controls and actionable recommendations. This directly matches the administrator's need to identify and remediate misconfigurations that could lead to breaches.

Exam trap

The trap here is confusing Microsoft Defender for Cloud's posture management and secure score with Microsoft Sentinel's threat detection capabilities, as both appear under the 'Microsoft security solutions' umbrella but serve fundamentally different purposes.

Why the other options are wrong

Microsoft Sentinel is a SIEM/SOAR solution for threat detection and response, not a tool for identifying and remediating misconfigurations in Azure resources or providing a secure score based on security controls.

Microsoft 365 Defender is designed for securing Microsoft 365 environments (e.g., email, endpoints, identities), not for assessing and remediating misconfigurations in Azure resources or providing a secure score for Azure security controls.

Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) service, not a tool for assessing Azure resource misconfigurations or providing a secure score. It focuses on managing devices and apps, not on cloud security posture.

When would these options actually be correct?

A question asking for a cloud-native SIEM that provides intelligent security analytics and threat intelligence across the enterprise, with capabilities to detect, investigate, and respond to threats using log data from various sources.

A question asking for a unified solution to detect, investigate, and respond to advanced threats across Microsoft 365 services (like email, Office 365, and endpoints) would make Microsoft 365 Defender the correct answer.

A question asks: 'An organization needs to enforce compliance policies on corporate mobile devices and ensure they meet security requirements before accessing company resources. Which Microsoft solution should they use?' In that scenario, Microsoft Intune would be correct.

Why candidates pick the wrong answer

Candidates may confuse Sentinel's security monitoring and alerting features with the configuration assessment and secure scoring capabilities of Defender for Cloud, as both are security tools in Azure.

Candidates may confuse Microsoft 365 Defender with Defender for Cloud because both have 'Defender' in their names and deal with security, but they serve different scopes (M365 vs. Azure).

Candidates may confuse Intune's security policy enforcement capabilities with cloud security posture management, or think that because Intune can enforce security settings, it can also assess Azure resource misconfigurations.

Full explanation →

511

MCQhard

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to prevent users from copying credit card numbers from an internal web application to a personal cloud storage app. Which DLP policy setting should they configure?

A.Browser DLP

B.Exchange DLP

C.Teams DLP

D.Endpoint DLP with clipboard control

AnswerD

Endpoint DLP can restrict clipboard operations on Windows devices.

Why this answer

Endpoint DLP with clipboard control is the correct setting because it monitors and restricts data movement at the device level, specifically preventing users from copying sensitive content (like credit card numbers) from a web application and pasting it into an unauthorized personal cloud storage app. This policy enforces restrictions on clipboard operations between different applications on the endpoint, directly addressing the cross-application data exfiltration scenario described.

Exam trap

The trap here is that candidates often confuse Browser DLP (which only controls data within the browser) with the broader endpoint-level clipboard control needed to prevent cross-application data transfer, leading them to select Option A instead of D.

How to eliminate wrong answers

Option A is wrong because Browser DLP protects data only within the browser context (e.g., preventing pasting into web forms or uploading to websites), but it does not control clipboard operations between a browser and a separate desktop application like a personal cloud storage app. Option B is wrong because Exchange DLP applies to email messages and attachments in Exchange Online, not to clipboard-based copying from a web application to a cloud storage app. Option C is wrong because Teams DLP protects data within Microsoft Teams chats and channels, not across applications on an endpoint.

Full explanation →

512

MCQmedium

A compliance administrator creates a retention policy as shown in the exhibit. What is the overall effect of this policy on content in SharePoint Online?

A.Content is deleted immediately after 7 years from creation.

B.Content is automatically labeled after 7 years.

C.Content is retained indefinitely after 7 years.

D.Content is retained for 7 years and then automatically deleted.

AnswerD

The policy combines retention with a delete action at the end.

Why this answer

The retention policy in the exhibit is configured to retain content for 7 years and then delete it. This means content in SharePoint Online will be kept for the specified duration and automatically purged at the end of the retention period, which matches option D.

Exam trap

The trap here is confusing 'retention' with 'deletion' timing—candidates often think retention policies only preserve content indefinitely or that deletion happens immediately at the end of the period, but Microsoft's retention policies enforce a 'retain then delete' lifecycle by default.

How to eliminate wrong answers

Option A is wrong because it states content is deleted immediately after 7 years from creation, but the policy explicitly retains content for 7 years before deletion, not immediately upon creation. Option B is wrong because retention policies do not automatically apply labels; labels are applied via sensitivity or retention labels, not retention policies. Option C is wrong because the policy specifies a retention period of 7 years, not indefinite retention; indefinite retention would require a different configuration (e.g., 'retain forever').

Full explanation →

513

MCQmedium

An organization uses Microsoft Intune to manage devices. They need to ensure that only devices with a minimum OS version can access corporate email. What should they configure?

A.App protection policy

B.Device enrollment restriction

C.Compliance policy and conditional access

D.Device configuration profile

AnswerC

Intune compliance policies define the specific security and health requirements that a device must meet to be considered compliant, such as requiring a minimum OS version, disk encryption, or antivirus software. Conditional Access policies then integrate with Azure AD to evaluate this compliance status in real-time. This powerful combination ensures that only devices meeting the defined compliance standards are granted access to sensitive organizational applications and data, providing robust, continuous enforcement.

Why this answer

Combining a compliance policy (which checks the device OS version against a minimum requirement) with a Conditional Access policy (which blocks access if the device is non-compliant) is the standard Microsoft approach to enforce OS version requirements for accessing corporate email. The compliance policy marks devices below the minimum OS version as non-compliant, and the Conditional Access policy then denies access to Exchange Online or other corporate resources for those non-compliant devices.

Exam trap

The trap here is that candidates confuse Device enrollment restrictions (which set OS version limits at enrollment time) with Compliance policies (which enforce OS version requirements continuously after enrollment), leading them to pick Option B instead of C.

How to eliminate wrong answers

Option A is wrong because App protection policies (MAM) manage how data is handled within apps (e.g., preventing copy/paste or requiring PIN) and do not enforce device-level OS version requirements; they apply to apps regardless of device management. Option B is wrong because Device enrollment restrictions control which devices can enroll in Intune (e.g., by platform or OS version during enrollment) but do not enforce ongoing OS version compliance for already enrolled devices accessing email. Option D is wrong because Device configuration profiles configure device settings (e.g., Wi-Fi, VPN, certificates) but do not enforce compliance checks or block access based on OS version; they are not used for conditional access decisions.

Full explanation →

514

MCQeasy

A security architect is explaining the evolution of the security perimeter. They state that because users access corporate resources from anywhere on any device, the traditional network perimeter is no longer sufficient. What does the architect identify as the new primary security perimeter?

A.The cloud infrastructure

B.The data center

C.The identity

D.The endpoint

AnswerC

Identity has emerged as the new security perimeter in modern architectures, particularly with the adoption of Zero Trust principles. It serves as the control plane for all access decisions, authenticating every user and device, and authorizing their access requests to resources regardless of their network location or the device they are using. This approach ensures that access is granted only after verifying the identity and context, making it the most critical security boundary.

Why this answer

In modern zero-trust architectures, identity is the new primary security perimeter because it enables granular access control regardless of network location. Since users access corporate resources from anywhere on any device, authentication and authorization (via protocols like OAuth 2.0, SAML, and OpenID Connect) become the decisive factor for granting access, rather than the traditional network boundary. This shift is foundational to Microsoft's identity-centric security model, where Azure AD (now Microsoft Entra ID) acts as the control plane for all resource access.

Exam trap

The trap here is that candidates often confuse the endpoint (the device) with identity, but the endpoint is merely a vector for identity claims—without identity as the authoritative control point, device-based security alone cannot prevent unauthorized access from a different user on the same device.

How to eliminate wrong answers

Option A is wrong because cloud infrastructure is a deployment model, not a security perimeter; it still relies on identity and access controls to secure resources within it. Option B is wrong because the data center is a physical or virtual location that assumes a trusted network boundary, which is no longer sufficient when users and devices are outside that boundary. Option D is wrong because the endpoint is just one component of the security stack; without identity-based authentication and conditional access policies, an endpoint alone cannot enforce who or what can access corporate resources.

Full explanation →

515

MCQmedium

A company uses Microsoft Teams and wants to ensure that messages containing offensive language are flagged for review. Which Microsoft Purview solution should be used?

A.Microsoft Purview Information Barriers

B.Microsoft Purview Communication Compliance

C.Microsoft Purview Data Loss Prevention

D.Microsoft Purview Audit

AnswerB

Communication Compliance uses classifiers to detect offensive language.

Why this answer

Microsoft Purview Communication Compliance is designed to detect and flag messages containing offensive language, harassment, or other policy violations in Microsoft Teams, Exchange Online, and Yammer. It uses customizable policies and machine learning classifiers to automatically review communications and route flagged items for human review, making it the correct solution for this requirement.

Exam trap

The trap here is that candidates often confuse Communication Compliance with Data Loss Prevention, mistakenly thinking DLP handles offensive content when it actually only protects sensitive data, not language policy violations.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Information Barriers restrict communication and collaboration between specific groups (e.g., to prevent conflicts of interest), but they do not analyze message content for offensive language. Option C is wrong because Microsoft Purview Data Loss Prevention (DLP) focuses on preventing the accidental sharing of sensitive data (e.g., credit card numbers, PII) and does not detect offensive language. Option D is wrong because Microsoft Purview Audit logs user and admin activities for compliance and forensic investigation, but it does not proactively scan or flag message content for offensive language.

Full explanation →

516

Drag & Dropmedium

Order the steps to respond to a data breach using Microsoft 365 Defender incident response.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Incident response typically starts with identification, isolation, investigation, containment, then remediation.

Full explanation →

517

MCQmedium

Your organization is using Microsoft Sentinel as a SIEM. You want to automatically respond to a high-severity incident by opening a ticket in ServiceNow and notifying the security team via email. What should you create?

A.An automation rule

B.A workbook

C.An analytics rule

D.A watchlist

AnswerA

Automation rules are the core mechanism within Microsoft Sentinel for orchestrating and automating incident response workflows. They are designed to automatically apply actions to incidents upon creation or update, based on specified conditions like severity, tactics, or associated entities. These rules can trigger playbooks, which are logic apps that perform complex tasks such as integrating with external systems like ServiceNow for ticketing, sending email notifications to security teams, or isolating compromised hosts. This capability makes automation rules essential for efficient SOAR operations.

Why this answer

Automation rules in Microsoft Sentinel can be configured to trigger automated responses when an incident is created, such as running a playbook (a Logic App) that opens a ticket in ServiceNow and sends an email notification. Option B is wrong because workbooks are for visualization and reporting, not automation. Option C is wrong because analytics rules generate alerts/incidents based on data queries, but they do not directly perform response actions; instead, automation rules handle the response.

Option D is wrong because watchlists are collections of data for correlation and enrichment, not for automated response.

Full explanation →

518

Multi-Selectmedium

Which TWO Microsoft Purview solutions can be used to protect sensitive data in Microsoft Teams?

Select 2 answers

A.Information barriers

B.Communication compliance

C.Data Loss Prevention (DLP)

D.Sensitivity labels

E.eDiscovery

AnswersC, D

DLP policies can block sharing of sensitive data in Teams.

Why this answer

Data Loss Prevention (DLP) policies in Microsoft Purview can scan Microsoft Teams messages and files for sensitive data types (e.g., credit card numbers, social security numbers) and automatically block or warn users when such data is shared. Sensitivity labels can be applied to Teams files and messages to enforce encryption, access restrictions, or visual markings, thereby protecting sensitive data at rest and in transit.

Exam trap

The trap here is that candidates often confuse Information barriers (which control who can communicate) with DLP (which controls what data can be shared), or they mistakenly think Communication compliance is a protective measure when it is actually a detective and review tool.

Full explanation →

519

MCQmedium

Your organization uses Microsoft Entra ID for identity management. You need to enable users to sign in using a QR code from the Microsoft Authenticator app. Which Microsoft Entra feature should you configure?

A.FIDO2 security keys

B.Temporary Access Pass

C.Passwordless sign-in with Microsoft Authenticator

D.My Security-info (https://aka.ms/mysecurityinfo)

AnswerC

Passwordless sign-in with Microsoft Authenticator is a core feature that allows users to sign into Microsoft Entra ID-connected applications without entering a password. When a user attempts to sign in, they are presented with an option to scan a QR code displayed on the sign-in screen using the Microsoft Authenticator app on their mobile device. The app then securely approves the sign-in request, often after a number match confirmation, providing a seamless and secure authentication experience.

Why this answer

The Microsoft Authenticator app supports passwordless sign-in by allowing users to approve a notification or scan a QR code from the sign-in screen. This feature eliminates the need for a password and relies on the Authenticator app as a primary authentication method, which is configured under the Passwordless sign-in with Microsoft Authenticator option in Entra ID.

Exam trap

The trap here is that candidates confuse the QR code scanning capability of the Authenticator app with FIDO2 security keys, but the question specifically asks about using the Microsoft Authenticator app, not a separate hardware device.

How to eliminate wrong answers

Option A is wrong because FIDO2 security keys are hardware-based passwordless credentials that use public-key cryptography, not QR codes from the Microsoft Authenticator app. Option B is wrong because Temporary Access Pass is a time-limited passcode used for onboarding or recovery scenarios, not for QR-code-based sign-in. Option D is wrong because My Security-info (https://aka.ms/mysecurityinfo) is a user portal for managing authentication methods, not a feature that enables QR-code sign-in.

Full explanation →

520

MCQmedium

A compliance officer needs to retain customer records for 7 years and then automatically delete them. However, during an ongoing legal case, the legal team must preserve specific documents indefinitely without affecting the retention policy for other documents. Which combination of Microsoft Purview solutions should the company use?

A.Data Lifecycle Management and eDiscovery

B.Records Management and Audit

C.Information Protection and Data Loss Prevention

D.Communication Compliance and Insider Risk Management

AnswerA

Data Lifecycle Management sets the retention and deletion policy. eDiscovery allows legal holds to preserve specific content for litigation without altering the retention policy.

Why this answer

Data Lifecycle Management (DLM) allows you to define retention policies (e.g., 7 years) and then automatically delete data at the end of that period. eDiscovery (specifically, eDiscovery holds) lets you place a legal hold on specific documents, preserving them indefinitely without altering the broader retention policy. Together, they meet both the automatic deletion requirement and the need to preserve documents during litigation.

Exam trap

The trap here is that candidates confuse Records Management (which can also apply retention and deletion) with Data Lifecycle Management, but Records Management lacks the legal hold capability that eDiscovery provides for preserving specific documents during litigation.

How to eliminate wrong answers

Option B (Records Management and Audit) is wrong because Records Management focuses on declaring records and applying retention labels, but it does not provide the ability to place a legal hold on specific documents during litigation; Audit only tracks activities and does not enforce retention or holds. Option C (Information Protection and Data Loss Prevention) is wrong because Information Protection deals with sensitivity labels and encryption, while Data Loss Prevention prevents unauthorized sharing—neither addresses retention, deletion, or legal holds. Option D (Communication Compliance and Insider Risk Management) is wrong because Communication Compliance monitors for policy violations in communications, and Insider Risk Management detects risky user activities; neither solution manages retention policies or legal holds.

Full explanation →

521

MCQhard

A company is implementing Microsoft Purview Communication Compliance to detect inappropriate messages. They need to monitor Microsoft Teams channel messages and chat messages for potential policy violations. Which configuration is required?

A.Enable Microsoft Purview Data Loss Prevention (DLP) policies for Teams.

B.Set up an Exchange Online retention policy to retain Teams messages.

C.Deploy a third-party archiving solution for Teams messages.

D.Configure a Communication Compliance policy that includes Teams messages as the supervised communication channel.

AnswerD

Communication Compliance policies can supervise Teams messages by adding Teams as a channel.

Why this answer

Communication Compliance policies can be configured to monitor Microsoft Teams channel messages and chat messages natively, without requiring additional DLP policies, retention policies, or third-party archiving. The policy must include Teams messages as a supervised communication channel. Option A is incorrect because DLP policies are not required for Communication Compliance monitoring; they serve a different purpose.

Option B is incorrect because Exchange Online retention policies retain data but do not enable monitoring for policy violations. Option C is incorrect because Microsoft provides native integration for Teams monitoring, so a third-party solution is unnecessary.

Exam trap

Candidates may mistakenly believe that enabling DLP or retention policies is a prerequisite for monitoring Teams messages, but Communication Compliance directly supports Teams as a supervised channel without additional configuration.

Full explanation →

522

MCQmedium

Your organization uses Microsoft Entra ID for identity management. You need to implement a solution that allows users to sign in using their social media accounts, such as Google or Facebook. What should you configure?

A.Microsoft Authenticator app for passwordless sign-in

B.Privileged Identity Management

C.External identities (B2B) with social identity providers

D.Self-service password reset

AnswerC

Microsoft Entra External ID, specifically its B2B collaboration capabilities, is the correct solution for enabling external users to access an organization's resources using their existing social identity provider accounts. This feature allows organizations to invite guests who can then sign in using their Google, Facebook, or other configured social accounts, federating these external identities with the inviting Microsoft Entra tenant. It streamlines access for partners and customers without requiring them to create new credentials.

Why this answer

External identities (B2B) in Microsoft Entra ID allow you to configure social identity providers (e.g., Google, Facebook) as federation sources. This enables users to sign in with their existing social accounts by leveraging OAuth 2.0 and OpenID Connect protocols, without needing to create a separate Microsoft account.

Exam trap

The trap here is that candidates confuse 'External identities (B2B) with social identity providers' with 'B2C' or think that passwordless methods like Authenticator can be used to bring in external social users, when in fact Authenticator only works for users already in the Entra ID tenant.

How to eliminate wrong answers

Option A is wrong because the Microsoft Authenticator app for passwordless sign-in is a method for authenticating existing Entra ID users via phone-based approval or biometrics, not for federating external social identity providers. Option B is wrong because Privileged Identity Management (PIM) is a tool for managing, controlling, and monitoring access to privileged roles within Entra ID, not for configuring external identity providers. Option D is wrong because self-service password reset (SSPR) allows users to reset their own passwords for their Entra ID accounts, but it does not enable sign-in using external social identities.

Full explanation →

523

MCQhard

A user logs into a corporate laptop by inserting a smart card and entering a PIN. The user then attempts to open a confidential folder. The operating system checks the user's access rights and denies access. Which security concepts are demonstrated in this scenario?

A.Identification and authorization

B.Authentication and authorization

C.Authentication and accounting

D.Identification and authentication

AnswerB

This option is correct because the user's insertion of a smart card and input of a PIN constitute a multi-factor authentication process, verifying their claimed identity. Following successful authentication, the operating system then performs an authorization check, determining whether the authenticated user has the necessary permissions to access the requested folder. The denial of access clearly demonstrates an authorization decision based on established access controls.

Why this answer

The scenario demonstrates authentication (verifying the user's identity via smart card + PIN) and authorization (the OS checking access rights and denying access to the folder). Authentication confirms who the user is, while authorization determines what resources they can access. Option B correctly pairs these two concepts.

Exam trap

The trap here is that candidates confuse 'identification' with 'authentication' — the smart card + PIN is a multi-factor authentication process, not merely identification, and the access check is authorization, not accounting or identification.

How to eliminate wrong answers

Option A is wrong because identification alone (e.g., presenting a username) is not sufficient; the scenario includes a PIN and smart card, which are authentication factors, and the access check is authorization, not just identification. Option C is wrong because accounting (tracking resource usage, e.g., logging or auditing) is not demonstrated; no logs or usage records are mentioned. Option D is wrong because identification (e.g., claiming an identity) is not explicitly shown; the user authenticates via smart card + PIN, and the access check is authorization, not just authentication.

Full explanation →

524

MCQmedium

Refer to the exhibit. A user reports being unable to access Exchange Online from their personal laptop. The sign-in log shows failure due to device non-compliance. What should you configure to allow access while maintaining security?

A.Create a Conditional Access policy requiring compliant device

B.Reset the user's password

C.Block all personal devices

D.Enable MFA for the user

AnswerA

Creating a Conditional Access policy that requires a compliant device directly addresses access issues stemming from device non-compliance. This policy evaluates the device's security posture, as determined by an MDM solution like Microsoft Intune, ensuring it meets predefined organizational security standards (e.g., OS version, encryption, antivirus status). Access to protected resources is then granted only if the device is marked as compliant, thereby enforcing a secure endpoint environment.

Why this answer

The sign-in log indicates the failure is due to device non-compliance, meaning the user's personal laptop does not meet your organization's compliance policies (e.g., missing antivirus, encryption, or required updates). Creating a Conditional Access policy that requires a compliant device will block access from non-compliant devices while allowing access from compliant ones, maintaining security by enforcing device health checks before granting access to Exchange Online.

Exam trap

The trap here is that candidates often confuse device compliance with authentication factors like MFA or password resets, but the sign-in log explicitly states the failure is due to device non-compliance, so the solution must enforce device health, not just user identity verification.

How to eliminate wrong answers

Option B is wrong because resetting the user's password addresses credential compromise, not device compliance; the failure is due to the device not meeting compliance requirements, not an incorrect password. Option C is wrong because blocking all personal devices is overly restrictive and not necessary; Conditional Access can selectively allow compliant personal devices while blocking non-compliant ones, preserving user productivity. Option D is wrong because enabling MFA strengthens authentication but does not enforce device compliance; the sign-in failure is specifically due to device non-compliance, not a lack of multi-factor authentication.

Full explanation →

525

MCQhard

A company needs to provide a developer with temporary, time-bound administrative access to Azure resources to debug a production issue. The access must require approval from the manager and automatically expire after 4 hours. Which Microsoft Entra capability should they use?

A.Privileged Identity Management (PIM)

B.Conditional Access

C.Identity Protection

D.Entitlement Management

AnswerA

Privileged Identity Management (PIM) in Microsoft Entra ID Governance is specifically designed to manage, control, and monitor access to important resources. It enables just-in-time (JIT) activation of privileged roles, allowing users to activate administrative permissions only when needed and for a predefined, limited duration. This includes requiring approval for activation and providing comprehensive audit trails, directly addressing the requirement for temporary, time-bound administrative access.

Why this answer

Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access to Azure resources with time-bound activation, approval workflows, and automatic expiration. This directly matches the requirement for temporary, manager-approved administrative access that expires after 4 hours.

Exam trap

The trap here is confusing Entitlement Management (which manages access to apps/groups via access packages) with PIM (which manages time-bound role activation for Azure resources), leading candidates to pick D when the scenario explicitly requires Azure resource administrative access with automatic expiration.

How to eliminate wrong answers

Option B (Conditional Access) is wrong because it enforces access policies based on signals like location or device compliance, not time-bound role activation with approval. Option C (Identity Protection) is wrong because it detects and remediates identity-based risks like leaked credentials, not manages privileged access. Option D (Entitlement Management) is wrong because it governs access to applications and groups via access packages, not Azure resource roles with automatic expiration.

Full explanation →

Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 451–525