Microsoft Security, Compliance, and Identity Fundamentals SC-900 SC-900 Questions 526–600 | Page 8/17

526

MCQmedium

A company uses Microsoft Purview Compliance Manager to improve their compliance posture. They are preparing for a SOC 2 audit and need to score compliance with SOC 2 controls, track improvement actions, and assign tasks to responsible teams. Which component of Compliance Manager should they use to assign and track specific actions to improve their compliance score?

A.Assessment

B.Control

C.Improvement action

D.Template

AnswerC

Improvement actions are detailed tasks that can be assigned to groups or individuals, tracked, and documented to demonstrate compliance progress.

Why this answer

Improvement actions in Compliance Manager are the specific, actionable tasks that directly impact your compliance score. They represent the steps you need to take (e.g., configuring a policy, enabling logging) to satisfy a control. By assigning these actions to responsible teams and tracking their completion status, you can systematically improve your score and demonstrate progress during a SOC 2 audit.

Exam trap

The trap here is that candidates confuse 'Control' (the requirement) with 'Improvement action' (the task to meet the requirement), leading them to select B, even though controls are not directly assignable or trackable as individual tasks.

How to eliminate wrong answers

Option A is wrong because an Assessment is a container that groups controls from a specific regulation (like SOC 2) and tracks your overall compliance score, but it does not provide the granular, assignable tasks needed to drive improvement. Option B is wrong because a Control is a specific requirement from the regulation (e.g., 'Access must be logged'), but it is not the actionable item you assign to a team; the control is satisfied by completing one or more improvement actions. Option D is wrong because a Template is a reusable blueprint that defines the controls and improvement actions for a regulation (e.g., SOC 2 template), but it is not the mechanism for assigning and tracking individual tasks.

Full explanation →

527

Multi-Selecteasy

Which TWO of the following are capabilities of Microsoft Purview Data Loss Prevention?

Select 2 answers

A.Define retention periods for documents.

B.Search for content in Exchange Online mailboxes.

C.Block sharing of sensitive data via email.

D.Automatically apply sensitivity labels to content.

E.Provide policy tips to users when they attempt to share sensitive data.

AnswersC, E

Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify and prevent the unauthorized sharing of sensitive information, including via email. These policies can detect specific sensitive information types, such as credit card numbers or national ID numbers, within email content or attachments. Upon detection, a configured DLP policy can automatically block the email from being sent, thereby preventing the exfiltration of critical data.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is designed to detect and prevent the accidental or intentional sharing of sensitive information. Option C is correct because DLP policies can block the sharing of sensitive data via email by inspecting content in transit and applying actions such as blocking the message. Option E is correct because DLP can display policy tips to users in real time, warning them before they share sensitive data and allowing them to override the block with justification.

Exam trap

The trap here is that candidates confuse DLP with other Microsoft Purview solutions: they may think DLP defines retention periods (Records Management), searches content (eDiscovery), or applies sensitivity labels (Information Protection), when in fact DLP focuses on preventing data loss through monitoring and blocking actions, not on lifecycle management or labeling.

Full explanation →

528

MCQhard

Your company is adopting a Zero Trust network architecture. You need to implement microsegmentation for workloads running in Azure. Which Azure service should you use?

A.Azure Network Security Groups (NSGs)

B.Azure Firewall

C.Azure App Service

D.Azure Front Door

AnswerA

Azure Network Security Groups (NSGs) are fundamental for implementing a Zero Trust network architecture by enabling microsegmentation. NSGs allow administrators to define granular inbound and outbound security rules that filter network traffic to and from Azure resources within a virtual network, such as VMs and subnets. This capability ensures that only explicitly authorized traffic can flow between specific workloads, enforcing the 'never trust, always verify' principle at the network layer and significantly reducing the attack surface.

Why this answer

Azure Network Security Groups (NSGs) are the correct service for implementing microsegmentation because they allow you to create granular, stateful filtering rules based on source/destination IP addresses, ports, and protocols at the subnet or individual virtual machine (NIC) level. This enables east-west traffic segmentation between workloads within the same virtual network, which is a core principle of Zero Trust network architecture.

Exam trap

The trap here is that candidates often confuse Azure Firewall (a perimeter security service) with NSGs (a microsegmentation tool), mistakenly thinking a centralized firewall can achieve the same east-west traffic isolation that NSGs provide at the subnet/NIC level.

How to eliminate wrong answers

Option B (Azure Firewall) is wrong because it is a centralized, stateful firewall as a service that operates at the network perimeter or between virtual networks, not at the individual workload or subnet level required for microsegmentation. Option C (Azure App Service) is wrong because it is a platform-as-a-service (PaaS) for hosting web applications and APIs, not a network security or segmentation tool. Option D (Azure Front Door) is wrong because it is a global, scalable entry point for web traffic using HTTP/HTTPS load balancing and application delivery, not a service for internal workload segmentation.

Full explanation →

529

MCQhard

A company uses Microsoft Entra ID. They have a critical application that requires additional security. The security team wants to enforce multifactor authentication (MFA) for every access to the application, but they also want users to reauthenticate with MFA if a session lasts longer than 60 minutes, regardless of device compliance. Which Conditional Access control should the administrator configure?

A.Grant control: Require multifactor authentication

B.Session control: Sign-in frequency

C.Session control: Application enforced restrictions

D.Grant control: Require device to be marked as compliant

AnswerB

Sign-in frequency as a session control forces users to reauthenticate after a specified time period, ensuring MFA is revalidated if the session exceeds 60 minutes.

Why this answer

The requirement to force reauthentication with MFA after a specific time period (60 minutes) is a session-level control, not a grant control. The 'Sign-in frequency' session control in Conditional Access allows administrators to define how often a user must reauthenticate, including re-prompting for MFA, regardless of device compliance. This directly meets the scenario's need for a time-based reauthentication policy.

Exam trap

The trap here is that candidates confuse 'Grant controls' (which enforce conditions at sign-in) with 'Session controls' (which manage behavior after sign-in), leading them to select 'Require multifactor authentication' instead of 'Sign-in frequency' for time-based reauthentication.

How to eliminate wrong answers

Option A is wrong because 'Grant control: Require multifactor authentication' enforces MFA at initial sign-in but does not enforce reauthentication after a session duration; it lacks the time-based re-prompting capability. Option C is wrong because 'Session control: Application enforced restrictions' relies on the application itself to enforce policies (e.g., via device-based conditional access in Exchange Online), not on Entra ID to force reauthentication after a fixed time. Option D is wrong because 'Grant control: Require device to be marked as compliant' checks device health at sign-in but does not enforce a session timeout or reauthentication frequency, and the scenario explicitly states 'regardless of device compliance'.

Full explanation →

530

MCQeasy

A user reports they cannot access the company portal from their personal device. The device is not enrolled in Microsoft Intune. The admin wants to ensure only compliant devices can access corporate resources. What should the admin configure?

A.Conditional Access policy requiring device compliance

B.Enable password writeback

C.Enable Identity Protection sign-in risk policy

D.Microsoft Entra Privileged Identity Management

AnswerA

Conditional Access policies evaluate specific conditions, such as device state, before granting access to cloud applications like the company portal. By requiring a device to be marked as compliant by Microsoft Intune, these policies ensure that only devices meeting organizational security standards (e.g., OS version, encryption, antivirus) can access sensitive resources. This directly addresses a user's inability to access the portal if their device fails compliance checks, making it the correct solution.

Why this answer

A is correct because a Conditional Access policy can require device compliance before granting access to corporate resources. When the device is not enrolled in Microsoft Intune, it cannot report compliance status, so the policy blocks access. This ensures only managed, compliant devices can access the company portal.

Exam trap

The trap here is that candidates confuse device compliance policies with sign-in risk policies or identity governance features, mistakenly thinking risk-based controls or PIM can enforce device health, when only Conditional Access with Intune compliance can block non-enrolled personal devices.

How to eliminate wrong answers

Option B is wrong because password writeback is a feature for on-premises password synchronization to Entra ID, not for controlling device access. Option C is wrong because Identity Protection sign-in risk policy evaluates user sign-in risk (e.g., anonymous IP, leaked credentials), not device compliance. Option D is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role activation, not device-level access control.

Full explanation →

531

Multi-Selecthard

A company wants to implement a Zero Trust security model. Which TWO of the following are core principles of Zero Trust?

Select 2 answers

A.Trust based on network location

B.Verify explicitly

C.Perimeter-based security

D.Implicit trust for internal users

E.Least privilege access

AnswersB, E

One of the three core principles of Zero Trust.

Why this answer

Options B and E are correct. Zero Trust core principles are: verify explicitly (B), use least privilege access (E), and assume breach. Option A is incorrect because Zero Trust does not trust based on network location.

Option C is incorrect because perimeter-based security is not a Zero Trust principle. Option D is incorrect because Zero Trust rejects implicit trust for internal users.

Full explanation →

532

MCQhard

Refer to the exhibit. You are reviewing a Microsoft Purview sensitivity label configuration. A user reports that a document containing a sensitive info type with confidence 80 was not automatically labeled. What is the most likely cause?

A.The user has overridden the label application.

B.The encryption is disabled.

C.The encryption template ID is missing.

D.The auto-labeling policy is not configured to apply this label.

AnswerD

While a sensitivity label defines the specific protection settings, such as encryption and access controls, its mere existence does not automatically apply it to content. For automatic application, a distinct auto-labeling policy must be created and configured within Microsoft Purview to identify sensitive information based on specific conditions and then apply this particular label. The label definition itself is separate from its deployment via an auto-labeling policy.

Why this answer

Auto-labeling in Microsoft Purview requires a specific auto-labeling policy to be configured and published to the user or location. Even if a sensitivity label exists and a sensitive info type (SIT) is detected with high confidence, the label will not be applied automatically unless an auto-labeling policy is explicitly set to apply that label to documents matching the SIT. The user's report indicates the label was not applied, which points to the policy not being configured, not a user override or encryption issue.

Exam trap

The trap here is that candidates often confuse the existence of a sensitivity label with the configuration of an auto-labeling policy, assuming that if a label is published, it will automatically apply to matching content, but in reality, auto-labeling requires a separate policy to be explicitly configured.

How to eliminate wrong answers

Option A is wrong because the user overriding the label would require the label to have been applied first, and the user would have to manually change it; the scenario states the label was not applied at all. Option B is wrong because encryption being disabled does not prevent auto-labeling; encryption is a label action, not a prerequisite for label application. Option C is wrong because a missing encryption template ID would cause an error when applying encryption, but it would not prevent the label from being applied; the label could still be applied without encryption.

Full explanation →

533

MCQhard

Your company uses Microsoft Purview to manage data across Azure, on-premises SQL Server, and Amazon S3. You need to create a unified map of all data sources and their sensitivity labels. Which Microsoft Purview feature should you use?

A.Microsoft Purview Data Sharing

B.Microsoft Purview Data Map

C.Microsoft Purview Data Estate Insights

D.Microsoft Purview Data Catalog

AnswerB

The Microsoft Purview Data Map is the foundational component that automatically discovers, scans, and classifies data across hybrid environments, including Azure, on-premises, and multi-cloud sources. It creates a unified, graph-based metadata store of an organization's entire data estate, enabling comprehensive understanding and governance. This core capability is essential for building a holistic view of data assets and their relationships, which is fundamental to managing data across Azure.

Why this answer

Microsoft Purview Data Map is the correct feature because it provides a unified, automated map of data assets across hybrid and multi-cloud environments (Azure, on-premises SQL Server, and Amazon S3). It automatically scans and classifies data sources, applies sensitivity labels, and maintains a centralized metadata repository, enabling a holistic view of the data landscape and its sensitivity.

Exam trap

The trap here is that candidates often confuse the Microsoft Purview Data Catalog (which is the searchable inventory) with the Data Map (which is the underlying metadata and classification engine), leading them to select Option D instead of B.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Data Sharing is a feature for securely sharing data in-place across organizations or within an organization, not for creating a unified map of data sources and sensitivity labels. Option C is wrong because Microsoft Purview Data Estate Insights provides monitoring, analytics, and reporting on data estate health and usage, but it does not create the foundational map of data sources and labels; it relies on the Data Map. Option D is wrong because Microsoft Purview Data Catalog is a component that builds on the Data Map to enable data discovery and search, but the core mapping and labeling of data sources is performed by the Data Map itself.

Full explanation →

534

MCQeasy

A company wants to ensure that data is not altered during transmission between a client and a server. They use TLS encryption. Which security goal does this primarily address?

A.Confidentiality

B.Integrity

C.Availability

D.Non-repudiation

AnswerB

Integrity guarantees that data remains accurate, complete, and unaltered throughout its entire lifecycle, especially during transmission. This means preventing unauthorized or accidental modification, deletion, or corruption of data. Mechanisms such as cryptographic hashing (e.g., SHA-256) and digital signatures are commonly employed to detect any tampering, ensuring the data received is identical to the data sent.

Why this answer

TLS (Transport Layer Security) uses message authentication codes (MACs) and cryptographic hashing to ensure that data is not tampered with during transit. While TLS also provides confidentiality through encryption, the specific goal of preventing alteration during transmission is integrity. Therefore, option B is correct because integrity guarantees that the data received is exactly what was sent, unchanged by any intermediary.

Exam trap

The trap here is that candidates often assume TLS only provides confidentiality (encryption) and forget that TLS also explicitly ensures integrity through MACs or AEAD, leading them to incorrectly select 'Confidentiality' (Option A) when the question specifically asks about preventing alteration.

How to eliminate wrong answers

Option A is wrong because confidentiality is about preventing unauthorized access to data (secrecy), not about detecting or preventing alteration; TLS achieves confidentiality through symmetric encryption, but the question specifically asks about preventing alteration. Option C is wrong because availability ensures that systems and data are accessible when needed, which is unrelated to data integrity during transmission; TLS does not address availability. Option D is wrong because non-repudiation prevents a party from denying an action (e.g., using digital signatures), whereas TLS does not inherently provide non-repudiation—it focuses on secure communication, not proof of origin.

Full explanation →

535

MCQeasy

Your organization wants to use Microsoft Defender for Cloud Apps to detect anomalous user behavior across cloud applications. Which feature should you enable?

A.Anomaly detection policies

B.App connectors

C.Secure Score

D.Cloud Discovery

AnswerA

Anomaly detection policies use UEBA to detect unusual user behavior.

Why this answer

Anomaly detection policies in Microsoft Defender for Cloud Apps use machine learning and behavioral analytics to establish a baseline of normal user activity and then trigger alerts for deviations, such as impossible travel, unusual data exfiltration, or risky sign-in patterns. This directly addresses the requirement to detect anomalous user behavior across cloud applications.

Exam trap

The trap here is that candidates often confuse 'Cloud Discovery' (which identifies shadow IT) with 'anomaly detection' (which focuses on user behavior), or they mistakenly think 'App connectors' are needed for behavioral monitoring, when in fact connectors enable data ingestion but not the behavioral analysis itself.

How to eliminate wrong answers

Option B is wrong because App connectors are used to connect Defender for Cloud Apps to specific cloud applications via APIs for visibility and control, not to detect anomalous user behavior. Option C is wrong because Secure Score is a security posture measurement tool that assesses configurations and recommends improvements, not a real-time behavioral detection feature. Option D is wrong because Cloud Discovery analyzes traffic logs to identify shadow IT and cloud app usage, but it does not focus on anomalous user behavior detection.

Full explanation →

536

MCQmedium

A company uses Microsoft 365 and needs to classify and protect sensitive documents by applying encryption and visual markings (headers/footers) based on the content's sensitivity. They also want to automatically revoke access to documents that leave the organization. Which Microsoft Purview solution should they configure?

A.Microsoft Purview Data Lifecycle Management

B.Microsoft Purview Information Protection

C.Microsoft Purview Communication Compliance

D.Microsoft Purview Audit

AnswerB

Information Protection uses sensitivity labels to classify, encrypt, and apply visual markings to documents, and can enforce revocation of access for external users.

Why this answer

Microsoft Purview Information Protection (B) is the correct solution because it provides the capabilities to classify and protect sensitive documents using sensitivity labels. These labels can enforce encryption and apply visual markings like headers and footers based on content sensitivity. Additionally, Information Protection supports automatic revocation of access to documents that leave the organization through features like rights management and conditional access policies.

Exam trap

The trap here is that candidates may confuse Data Lifecycle Management (retention/deletion) with Information Protection (classification/encryption), or mistakenly think Communication Compliance or Audit can enforce document-level protection and revocation.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Data Lifecycle Management focuses on retaining and deleting data based on policies, not on classifying, encrypting, or applying visual markings to documents. Option C is wrong because Microsoft Purview Communication Compliance is designed to detect and manage inappropriate communications (e.g., harassment, insider trading) within emails and messages, not to classify or protect document content with encryption or markings. Option D is wrong because Microsoft Purview Audit provides logging and investigation of user and admin activities, not the ability to classify, encrypt, or revoke access to documents.

Full explanation →

537

MCQhard

Refer to the exhibit. You are reviewing Microsoft Entra sign-in logs. Which statement is true?

A.jdoe's sign-in had no risk detected.

B.jdoe's sign-in failed Conditional Access.

C.asmith's sign-in was likely from an application or service principal.

D.asmith's sign-in had a high risk level.

AnswerC

asmith's sign-in was indeed likely from an application or service principal, as indicated by the 'NonInteractiveUser' sign-in type. This specific type signifies that the authentication request originated from a client application, script, or service principal, rather than a direct interactive session initiated by a human user, facilitating automated access to resources.

Why this answer

The sign-in log entry for asmith shows an 'Application' sign-in type, which indicates the authentication was performed by an application or service principal rather than a user. In Microsoft Entra ID, sign-ins from applications or service principals are logged with a distinct sign-in type, and the exhibit displays 'Application' for asmith's entry, confirming this.

Exam trap

The trap here is that candidates may assume all sign-in logs represent user sign-ins and overlook the 'Sign-in type' column, leading them to misinterpret the risk level or Conditional Access status for a service principal entry.

How to eliminate wrong answers

Option A is wrong because the sign-in log for jdoe shows a 'Risk level' of 'Medium', indicating risk was detected, not 'No risk'. Option B is wrong because the sign-in log for jdoe shows 'Conditional Access' status as 'Success', not 'Failure', meaning Conditional Access policies were satisfied. Option D is wrong because the sign-in log for asmith shows a 'Risk level' of 'Low', not 'High'.

Full explanation →

538

MCQeasy

A user authenticates to a company's network by entering their password and then approving a push notification on their mobile phone. After authentication, the user attempts to access a shared folder containing financial reports. The access is denied because the user's account is not a member of the 'Finance' group. Which security concept is demonstrated when the user is denied access to the folder?

A.Authentication

B.Authorization

C.Non-repudiation

D.Accounting

AnswerB

Authorization is the security process that determines what actions an authenticated user or system is permitted to perform on a resource. After a user successfully proves their identity, the system evaluates their assigned rights and privileges, often based on roles or group memberships. In this scenario, denying access to a folder because the user lacks the necessary group membership is a direct application of an authorization policy, enforcing access control based on established permissions.

Why this answer

Authorization is the security concept that determines what resources a user is allowed to access after their identity has been verified. In this scenario, the user successfully authenticated but was denied access to the financial reports folder because their account lacked the necessary permissions—specifically, membership in the 'Finance' group. This access control decision is the essence of authorization, which enforces policies based on identity attributes like group membership.

Exam trap

The trap here is that candidates confuse authentication (proving who you are) with authorization (what you are allowed to do), especially when the question includes a multi-factor authentication step that seems to 'grant' access, but the denial is purely an authorization failure.

Why the other options are wrong

The user was denied access due to insufficient permissions (not being in the Finance group), which is an authorization decision, not authentication. Authentication only verifies identity, which already succeeded via password and push notification.

Non-repudiation ensures that a user cannot deny having performed an action, such as signing a document. The scenario describes access denial due to group membership, which is about authorization, not non-repudiation.

Accounting refers to tracking user activities and resource usage (e.g., logging access attempts), not to controlling access based on group membership. The denial here is due to lack of authorization, not accounting.

When would these options actually be correct?

Authentication would be correct if the question described a scenario where the user fails to prove their identity, such as entering an incorrect password or failing a biometric scan, and is therefore denied access to the network.

A user signs a digital contract using a private key, and later claims they did not sign it. The system provides proof of the signature, preventing denial. This demonstrates non-repudiation.

A user accesses a file server, and the system logs the access attempt, including timestamp, user identity, and file accessed. The question asks which concept is demonstrated by the logging of this activity.

Why candidates pick the wrong answer

Candidates often confuse authentication and authorization because both involve access control. They may think that being denied access is related to identity verification, not realizing that authentication already passed.

Candidates may confuse non-repudiation with authorization because both involve security controls, but non-repudiation focuses on accountability for actions, not access rights.

Candidates may confuse 'accounting' with 'access control' because both involve user actions and permissions, but accounting is about auditing and logging, not enforcing access decisions.

Full explanation →

539

MCQmedium

A company uses Microsoft Entra ID. They want to ensure that users who are traveling to a high-risk country, based on the sign-in IP address, are prompted for multi-factor authentication before accessing the company's CRM application. Which Microsoft Entra ID feature should they configure?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management

D.Azure AD Join

AnswerA

Conditional Access policies are the primary mechanism in Microsoft Entra ID for enforcing access decisions based on various conditions, including user location. Administrators can define "Named locations" using IP ranges or countries/regions, then create policies that require specific controls, such as multi-factor authentication (MFA), when users attempt to access applications from outside these trusted locations. This directly addresses the requirement to enforce location-based MFA for application access.

Why this answer

Conditional Access is the correct feature because it allows administrators to create policies that evaluate sign-in signals—such as the user's location derived from the IP address—and enforce access controls like requiring multi-factor authentication (MFA) before granting access to a specific application (e.g., the CRM app). By configuring a Conditional Access policy with a location condition targeting high-risk countries, the company can ensure that only users signing in from those IP ranges are prompted for MFA, while other sign-ins proceed normally.

Exam trap

The trap here is that candidates often confuse Identity Protection's risk-based MFA (which uses machine learning on user behavior) with Conditional Access's location-based MFA (which uses static IP-to-country mapping), leading them to select Identity Protection when the question explicitly specifies a high-risk country based on IP address rather than a risk score.

Why the other options are wrong

Identity Protection provides risk detection and remediation, but it does not enforce access controls like MFA prompts. Conditional Access is required to apply policies based on sign-in risk or location.

Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles in Microsoft Entra ID, but it does not enforce location-based multi-factor authentication prompts for specific applications.

Azure AD Join is used to join devices to Azure AD for single sign-on and management, not to enforce conditional access policies based on sign-in risk or location.

When would these options actually be correct?

Identity Protection would be correct if the question asked: 'Which feature identifies and reports risky sign-ins, such as those from anonymous IP addresses or atypical travel, but does not enforce access policies?'

A company needs to manage just-in-time privileged access to Azure AD roles, requiring approval and time-bound activation for administrators. PIM would be the correct feature to configure.

An exam question asking how to enable single sign-on and device management for corporate-owned Windows devices that are not domain-joined, with the goal of applying device-based conditional access policies.

Why candidates pick the wrong answer

Candidates confuse Identity Protection's risk detection capabilities with the policy enforcement that Conditional Access provides, assuming risk detection alone can trigger MFA.

Candidates may confuse PIM's role-based access controls with Conditional Access policies, assuming that managing privileged roles includes controlling authentication requirements based on risk.

Candidates may confuse Azure AD Join with Azure AD Conditional Access because both involve device identity and access control, but Azure AD Join is about device registration, not policy enforcement.

Full explanation →

540

MCQeasy

A company needs to allow external business partners to securely access internal SharePoint Online sites and Teams channels. The partners use various identity providers, including Microsoft Entra ID and Google. The company wants to manage these external users in their directory and assign access policies. Which Microsoft Entra ID capability should they use?

A.Microsoft Entra B2C (Business to Customer)

B.Microsoft Entra External ID (B2B Collaboration)

C.Microsoft Entra Domain Services

D.Microsoft Entra Identity Protection

AnswerB

Microsoft Entra External ID (B2B Collaboration) is the correct solution, specifically designed for securely collaborating with external business partners. It allows guest users from partner organizations to use their existing corporate or social identities to access specific applications and resources within your Microsoft Entra tenant. This integrates partners directly into your organization's access management framework, providing controlled and managed access to internal systems.

Why this answer

Microsoft Entra External ID (B2B Collaboration) is the correct capability because it allows the company to invite external business partners (B2B users) from any identity provider, including Microsoft Entra ID and Google, into their own Microsoft Entra directory. This enables the company to manage these external users in their directory, assign conditional access policies, and grant them secure access to internal SharePoint Online sites and Teams channels without requiring a separate application or customer-facing identity system.

Exam trap

The trap here is that candidates often confuse Microsoft Entra B2C (for customers) with B2B Collaboration (for business partners), leading them to select B2C because both involve external users, but B2C is for consumer-facing apps, not for granting access to internal resources like SharePoint and Teams.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra B2C (Business to Customer) is designed for customer-facing applications where external users sign in with social or local identities, not for managing business partners in the company's directory with access to internal resources like SharePoint and Teams. Option C is wrong because Microsoft Entra Domain Services provides managed domain services like LDAP, Kerberos, and NTLM for legacy applications, not for inviting and managing external business partners. Option D is wrong because Microsoft Entra Identity Protection is a security tool that detects identity-based risks and vulnerabilities, not a capability for inviting or managing external users.

Full explanation →

541

MCQmedium

A security team wants to discover all cloud applications being used by employees, including unsanctioned file sharing and collaboration apps. They plan to analyze traffic logs from their network firewall to identify usage patterns and assess each app's risk level. Which feature of Microsoft Defender for Cloud Apps should they enable?

A.Cloud Discovery

B.App Connectors

C.Conditional Access App Control

D.Information Protection

AnswerA

Microsoft Defender for Cloud Apps' Cloud Discovery feature is specifically engineered to provide comprehensive visibility into all cloud applications accessed by users within an organization. It accomplishes this by ingesting and analyzing traffic logs from firewalls and proxy servers, extracting details about accessed URLs and IP addresses. This process enables the identification of both sanctioned and unsanctioned (shadow IT) cloud services, building a complete catalog of an organization's cloud app landscape and assessing associated risks.

Why this answer

Cloud Discovery is the correct feature because it analyzes traffic logs from network firewalls and proxies to identify all cloud applications in use, including unsanctioned ones. It uses the Microsoft Defender for Cloud Apps catalog to assess each app's risk level based on factors like security posture, compliance certifications, and industry standards. This directly matches the scenario of discovering unsanctioned file sharing and collaboration apps from firewall logs.

Exam trap

The trap here is that candidates confuse Cloud Discovery (passive log analysis for unsanctioned app discovery) with App Connectors (active API integration for sanctioned app monitoring), leading them to choose B because they think 'connecting to apps' is needed to discover them.

How to eliminate wrong answers

Option B (App Connectors) is wrong because App Connectors are used to connect directly to sanctioned cloud apps (like Office 365, Salesforce) via APIs to pull data for monitoring and governance, not to discover unsanctioned apps from firewall logs. Option C (Conditional Access App Control) is wrong because it enforces real-time access policies on sanctioned apps using reverse proxy, not for discovering unknown apps from traffic logs. Option D (Information Protection) is wrong because it focuses on classifying and protecting sensitive data within files and emails, not on discovering cloud app usage patterns from network traffic.

Full explanation →

542

MCQeasy

You need to ensure that sensitive documents in Microsoft SharePoint Online are automatically classified and protected when they contain credit card numbers. What should you configure?

A.A sensitivity label with auto-labeling for Microsoft Purview Information Protection

B.A retention policy for SharePoint

C.A data loss prevention (DLP) policy

D.A retention label for regulatory compliance

AnswerA

Sensitivity labels with auto-labeling are specifically designed within Microsoft Purview Information Protection to automatically classify and apply protective measures to documents. They leverage sensitive information types and trainable classifiers to identify content, then enforce encryption, visual markings, and access restrictions, ensuring proactive data protection from creation and throughout its lifecycle.

Why this answer

A sensitivity label with auto-labeling for Microsoft Purview Information Protection is correct because it can automatically classify and protect documents based on sensitive content, such as credit card numbers, using built-in sensitive information types. This ensures that when a document in SharePoint Online contains credit card data, it is automatically labeled with encryption and usage restrictions without manual intervention.

Exam trap

The trap here is that candidates often confuse DLP policies with auto-labeling, but DLP policies only monitor and block data sharing, whereas auto-labeling with sensitivity labels actually classifies and protects the content itself.

How to eliminate wrong answers

Option B is wrong because a retention policy for SharePoint is designed to retain or delete content based on time, not to classify or protect documents based on sensitive data like credit card numbers. Option C is wrong because a data loss prevention (DLP) policy can detect and block sharing of sensitive data, but it does not automatically classify or apply protection (e.g., encryption) to the documents themselves; it only enforces rules on data in transit or at rest. Option D is wrong because a retention label for regulatory compliance is used to manage data retention and disposal, not to automatically classify or protect documents based on sensitive content like credit card numbers.

Full explanation →

543

MCQmedium

Your company is implementing data loss prevention (DLP) policies in Microsoft Purview. You need to create a policy that prevents users from sharing credit card numbers via email to external recipients. The policy should only apply to users in the Finance department. Which action should you take?

A.Create a retention label and apply auto-labeling for Finance

B.Create a sensitivity label and publish it to Finance users

C.Copy the default DLP template for financial data and modify it

D.Create a DLP policy, select the Finance user location, and add the credit card number condition

AnswerD

Creating a new Data Loss Prevention (DLP) policy is the direct and most effective method for preventing the unauthorized sharing of sensitive data. By selecting the Finance user location, the policy is precisely scoped to the relevant individuals, and adding the credit card number condition ensures that the policy specifically targets and enforces actions against this critical sensitive information type, directly addressing the company's objective.

Why this answer

To apply a DLP policy to specific users, you select their group (e.g., Finance) as a location when creating the policy. This ensures only Finance users are affected. Option A is wrong because auto-labeling with retention labels does not enforce DLP rules.

Option B is wrong because sensitivity labels classify data but do not block sharing. Option C is wrong because copying a default template may not allow precise scoping to Finance users; creating a new policy from scratch with location selection is more accurate.

Full explanation →

544

MCQmedium

A company with Microsoft 365 wants employees to access corporate applications from their personal Android and iOS devices. The security team requires that these devices be enrolled in mobile device management (MDM) for compliance policies, and that company data can be selectively wiped from the device without affecting personal data. Which Microsoft Entra device identity type should they configure for these personal devices?

A.Microsoft Entra registered

B.Microsoft Entra joined

C.Microsoft Entra hybrid joined

D.Microsoft Entra managed

AnswerA

Microsoft Entra registered devices are typically personal devices (Bring Your Own Device - BYOD) that users want to access corporate resources from. This identity type allows devices to be enrolled in Mobile Device Management (MDM) solutions like Microsoft Intune, enabling conditional access policies and selective wipe capabilities to protect organizational data without fully controlling the user's personal device.

Why this answer

Microsoft Entra registered is the correct device identity type for personal (BYOD) devices because it supports enrollment in MDM for compliance policies and enables selective wipe of company data without affecting personal data. This identity type registers the device with Entra ID without requiring organizational ownership, allowing users to access corporate applications while maintaining personal data separation.

Exam trap

The trap here is that candidates often confuse 'Microsoft Entra joined' with 'Microsoft Entra registered' because both involve device identity, but Entra joined implies full organizational control and no selective wipe capability, making it unsuitable for BYOD scenarios.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra joined is designed for organization-owned devices that are fully managed by the organization, not for personal BYOD devices, and it does not support selective wipe of only company data. Option C is wrong because Microsoft Entra hybrid joined requires on-premises Active Directory domain join and is intended for organization-owned devices that need both on-premises and cloud access, not for personal devices. Option D is wrong because 'Microsoft Entra managed' is not a valid device identity type in Microsoft Entra; the valid types are Entra registered, Entra joined, and hybrid Entra joined.

Full explanation →

545

Multi-Selecteasy

Which two scenarios are examples of using Microsoft Entra business-to-business (B2B) collaboration? (Choose two.)

Select 2 answers

A.A user from a partner organization is invited to access a SharePoint Online site.

B.An employee uses their Microsoft Entra ID to sign in to a third-party SaaS application.

C.Two internal departments share resources within the same tenant.

D.A vendor employee uses their own work email to access a Power BI dashboard shared by your company.

E.Customers use their Facebook accounts to sign in to a company's web application.

AnswersA, D

This scenario exemplifies Microsoft Entra B2B collaboration, where an organization extends access to its internal resources, such as a SharePoint Online site, to an external user from a partner organization. By inviting the partner user, a guest account is created in the inviting organization's Microsoft Entra tenant, allowing the external user to authenticate with their existing corporate credentials and securely access the shared resource. This facilitates secure inter-organizational cooperation.

Why this answer

Microsoft Entra B2B collaboration allows you to invite external users from partner organizations to access your company's resources, such as a SharePoint Online site. The invited user authenticates using their own home tenant credentials, and a B2B guest user object is created in your directory to represent them.

Exam trap

The trap here is confusing B2B collaboration (inviting external business partners with work/school accounts) with B2C collaboration (allowing consumers to sign in with social identities like Facebook or Google), leading candidates to incorrectly select Option E.

Full explanation →

546

MCQhard

You are a compliance administrator for Contoso, a multinational company that uses Microsoft 365. The company has the following requirements: 1. Automatically retain all documents containing personally identifiable information (PII) for 7 years. 2. Prevent users from sharing PII via email with external recipients unless they provide a business justification. 3. Monitor and alert when users access sensitive data outside of business hours. 4. Generate a compliance score for GDPR and ISO 27001. You need to configure the appropriate Microsoft Purview solutions. For each requirement, match the correct solution. Which combination of solutions should you use?

A.Information Protection for retention; DLP for sharing; Data Lifecycle Management for monitoring; Compliance Manager for scoring

B.Data Lifecycle Management for retention; Communication Compliance for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring

C.Data Lifecycle Management for retention; DLP for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring

D.Information Protection for retention; eDiscovery for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring

AnswerC

All requirements are correctly mapped.

Why this answer

Requirement 1 (retain PII for 7 years) is met by a retention label or policy from Data Lifecycle Management (not Information Protection, which is for classification). Requirement 2 (prevent sharing without justification) is met by a Data Loss Prevention (DLP) policy that can block sharing and require user override with business justification. Requirement 3 (monitor access outside business hours) is met by Insider Risk Management, which can detect anomalous access patterns.

Requirement 4 (compliance score) is met by Compliance Manager. Option A is wrong because Information Protection labels are for classification, not retention; also monitoring access outside hours needs Insider Risk Management, not DLP. Option B is wrong because Communication Compliance is for monitoring communications, not for preventing sharing via email; DLP is needed for that.

Option D is wrong because eDiscovery is for legal discovery, not for access monitoring.

Full explanation →

547

MCQeasy

Your organization uses Microsoft Defender for Cloud Apps. You need to detect anomalous user behavior such as impossible travel. Which type of policy should you configure?

A.Anomaly detection policy

B.Activity policy

C.App discovery policy

D.Session policy

AnswerA

Microsoft Defender for Cloud Apps' anomaly detection policies leverage machine learning and User Behavior Analytics (UBA) to identify unusual activities that deviate from a user's learned baseline. These policies are specifically designed to detect sophisticated threats like impossible travel, where a user logs in from geographically distant locations in an impossibly short timeframe, or unusual login locations, failed logins, and suspicious activities, by continuously monitoring and analyzing user and entity behavior.

Why this answer

Anomaly detection policies in Microsoft Defender for Cloud Apps use machine learning and behavioral analytics to establish a baseline of normal user activity and then flag deviations such as impossible travel (e.g., a user logging in from New York and then from London within an unrealistic time frame). This policy type is specifically designed to detect suspicious patterns like credential theft or account compromise without requiring predefined rules.

Exam trap

Microsoft often tests the distinction between rule-based policies (Activity policies) and machine-learning-based anomaly detection, leading candidates to choose Activity policy because they think they can manually define 'impossible travel' rules, but in practice, anomaly detection is the only automated way to handle such dynamic behavioral patterns.

How to eliminate wrong answers

Option B is wrong because Activity policies are rule-based and require you to define specific conditions (e.g., number of downloads from a location) to trigger alerts; they cannot automatically detect unknown anomalous patterns like impossible travel. Option C is wrong because App discovery policies are used to identify shadow IT by analyzing traffic logs to discover cloud apps in use, not to monitor user behavior for anomalies. Option D is wrong because Session policies control real-time user actions within a session (e.g., blocking downloads) based on risk, but they do not perform historical behavioral analysis to detect impossible travel.

Full explanation →

548

MCQmedium

A company uses Microsoft Entra ID and requires that all guest users from a partner organization must sign in using Microsoft Authenticator for MFA. The partner organization manages their own identities. What should you configure?

A.Enable Microsoft Entra ID Protection and configure MFA registration policy for guests

B.Use Microsoft Entra ID Governance to require access reviews for guests

C.Configure cross-tenant access settings to trust MFA from the partner's Microsoft Entra ID tenant

D.Create a Conditional Access policy that requires MFA for guest users

AnswerC

Cross-tenant access settings offer granular control over how users from other Microsoft Entra ID tenants interact with your resources. By configuring inbound trust settings, your tenant can be explicitly set to accept multi-factor authentication claims issued by the partner's home tenant. This crucial capability eliminates redundant MFA prompts for guest users, allowing your organization to leverage the partner's security controls and provide a seamless, yet secure, access experience.

Why this answer

Cross-tenant access settings in Microsoft Entra ID allow you to trust MFA claims from an external partner's tenant. Since the partner manages their own identities, trusting their MFA ensures that guest users from that partner organization can satisfy MFA requirements using their own Microsoft Authenticator without needing to register again in your tenant.

Exam trap

The trap here is that candidates often assume a Conditional Access policy (Option D) is the standard way to enforce MFA for guests, but they overlook the cross-tenant trust mechanism that allows the partner to manage their own MFA without guest user registration in the resource tenant.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Protection's MFA registration policy applies to users in your own tenant, not to guest users from a partner organization that manages their own identities. Option B is wrong because access reviews are used to periodically review and certify guest access, not to enforce MFA authentication requirements. Option D is wrong because a Conditional Access policy requiring MFA for guest users would force them to register for MFA in your tenant, which contradicts the requirement that the partner organization manages their own identities and that guests sign in using their own Microsoft Authenticator.

Full explanation →

549

MCQhard

A security architect is implementing a Zero Trust security model. The architect insists that the network perimeter should not be trusted and that security controls must be applied to all traffic, even within the corporate network. They also emphasize the need for continuous monitoring and detection of threats as if a breach has already occurred. Which Zero Trust principle is the architect primarily applying?

A.Verify explicitly

B.Least privilege access

C.Assume breach

D.Trust but verify

AnswerC

"Assume breach" is a foundational Zero Trust principle that mandates organizations operate under the constant premise that their network and resources have already been compromised or will inevitably be. This mindset drives proactive security measures such as micro-segmentation, continuous threat detection, robust incident response planning, and regular security posture assessments. It shifts focus from perimeter defense to protecting individual resources and minimizing the blast radius of any successful attack, making it central to a resilient Zero Trust architecture.

Why this answer

The architect's emphasis on not trusting the network perimeter and applying security controls to all traffic, combined with continuous monitoring as if a breach has already occurred, directly aligns with the 'Assume breach' principle of Zero Trust. This principle operates on the mindset that a breach is inevitable or has already happened, thus requiring constant verification and monitoring of all network traffic, even within the corporate network, rather than relying on a trusted internal zone.

Exam trap

Microsoft often tests the distinction between 'Assume breach' and 'Verify explicitly' by describing a scenario that includes both continuous monitoring and strict access controls, leading candidates to confuse the proactive verification requirement with the reactive breach-assumption mindset.

How to eliminate wrong answers

Option A is wrong because 'Verify explicitly' focuses on authenticating and authorizing every access request based on all available data points (e.g., user identity, device health, location), but it does not inherently assume that a breach has already occurred; it is about strict verification at each access attempt. Option B is wrong because 'Least privilege access' is about granting only the minimum permissions necessary for a user or system to perform a task, which is a separate pillar of Zero Trust that does not directly address the continuous monitoring and breach-assumption mindset described in the scenario. Option D is wrong because 'Trust but verify' is an outdated security model that assumes trust is granted initially and then verified periodically; Zero Trust explicitly rejects this approach by stating that no entity should be trusted by default, even inside the network.

Full explanation →

550

MCQmedium

A company wants to reduce the risk of privileged account misuse. They need to provide temporary, time-bound access to administrative roles in Microsoft Entra ID (Microsoft Entra ID) and require approval from a manager before granting the access. Which Microsoft Entra capability should they use?

A.Conditional Access policies

B.Microsoft Entra Privileged Identity Management (PIM)

C.Identity Protection

D.Entra ID Governance (Access Reviews)

AnswerB

Microsoft Entra Privileged Identity Management (PIM) directly addresses the risk of privileged account misuse by implementing just-in-time (JIT) access. It enables users to activate privileged roles only when needed, for a limited duration, and often requires an explicit approval workflow before elevation. This significantly reduces the attack surface by eliminating standing privileged access and provides comprehensive auditing of all privilege activations.

Why this answer

Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by allowing administrators to activate roles for a limited, time-bound duration. It also supports approval workflows, requiring a manager's approval before role activation is granted, directly addressing the need for temporary, approved access to administrative roles.

Exam trap

The trap here is that candidates often confuse PIM with Conditional Access or Access Reviews, mistakenly thinking those services can enforce time-bound approvals, but only PIM combines JIT activation with an approval workflow for privileged roles.

How to eliminate wrong answers

Option A is wrong because Conditional Access policies enforce access controls based on conditions like location or device compliance, but they do not provide time-bound role activation or approval workflows for privileged roles. Option C is wrong because Identity Protection detects and responds to identity-based risks (e.g., leaked credentials, sign-in anomalies), but it does not manage privileged role activation or require approval for role assignment. Option D is wrong because Entra ID Governance (Access Reviews) enables periodic review of existing role assignments to ensure they are still needed, but it does not provide temporary, time-bound activation with an approval process.

Full explanation →

551

MCQmedium

Your organization uses Microsoft Purview Records Management to manage high-value contracts. You need to ensure that once a contract is declared as a record, it cannot be modified or deleted by any user, including administrators. Which type of record should you use?

A.Disposition review

B.Event-based retention policy

C.Retention label with default settings

D.Regulatory record

AnswerD

A regulatory record in Microsoft Purview is specifically designed to meet stringent regulatory compliance requirements for absolute immutability. Once an item is declared a regulatory record, it becomes permanently locked, preventing any modification or deletion by any user, including global administrators. This level of unalterable preservation ensures the content's integrity and authenticity throughout its lifecycle, making it suitable for the most demanding legal and regulatory obligations.

Why this answer

Regulatory records provide the highest level of protection and cannot be modified or deleted by any user, including administrators. Option A is wrong because disposition review is a process for reviewing content before deletion, not a record type that locks content. Option B is wrong because event-based retention policies apply retention based on a trigger event, but they do not prevent modification or deletion once declared a record.

Option C is wrong because a retention label with default settings does not lock the record; it only applies retention settings without regulatory protections.

Full explanation →

552

MCQmedium

A financial services company uses Microsoft 365 and must comply with PCI DSS. They want to automatically prevent users from sending emails that contain credit card numbers to external recipients. If a user tries to send such an email, the system should block the message and notify the user with a policy tip. Which Microsoft Purview solution should they configure?

A.Data Loss Prevention (DLP)

B.Communication Compliance

C.Information Protection

D.Insider Risk Management

AnswerA

Microsoft Purview DLP policies can automatically detect sensitive data (e.g., credit card numbers) and take actions such as blocking the email and notifying the sender with a policy tip.

Why this answer

Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block sensitive data, such as credit card numbers, in transit (e.g., email). DLP policies can be configured with conditions to match credit card number patterns (using a built-in sensitive info type) and set actions to block the message and display a policy tip to the sender, meeting the PCI DSS compliance requirement.

Exam trap

The trap here is that candidates often confuse Information Protection (labels/encryption) with DLP, but Information Protection does not provide real-time blocking of outbound data; it only applies protection after classification, whereas DLP actively monitors and blocks data in motion.

How to eliminate wrong answers

Option B is wrong because Communication Compliance is designed to detect and remediate inappropriate or policy-violating communications (e.g., harassment, insider trading), not to block sensitive data like credit card numbers in email. Option C is wrong because Information Protection (e.g., sensitivity labels and encryption) focuses on classifying and protecting data at rest or in transit via encryption, but it does not automatically block outbound emails containing credit card numbers or provide policy tips. Option D is wrong because Insider Risk Management is used to detect, investigate, and act on risky user activities (e.g., data theft, leaks) based on analytics, not to enforce real-time blocking of specific data patterns in email.

Full explanation →

553

MCQeasy

A security analyst receives an alert from Microsoft Sentinel indicating a potential ransomware attack. The analyst needs to quickly understand the full scope of the attack, including all affected accounts and devices. Which Microsoft Sentinel feature should they use?

A.Analytics rules

B.Workbooks

C.Playbooks

D.Incident investigation

AnswerD

The incident investigation graph in Microsoft Sentinel is a crucial tool that provides security analysts with a visual, interactive representation of an alert or incident's scope and context. It dynamically maps entities like users, hosts, and IP addresses, showing their relationships and connections to related alerts and events. This graphical view is essential for understanding the attack chain, identifying affected assets, and effectively determining the overall impact and progression of a security event.

Why this answer

D is correct because Microsoft Sentinel's incident investigation feature provides a visual, interactive graph that maps relationships between entities (e.g., accounts, devices, IP addresses) involved in an incident. This allows the analyst to quickly see the full scope of a ransomware attack by exploring all affected resources and their connections, rather than relying on static reports or automated responses.

Exam trap

The trap here is that candidates often confuse 'incident investigation' with 'workbooks' or 'playbooks,' assuming that any visual tool or automated action can provide attack scope, when in fact only the investigation graph offers entity-level relationship mapping for a specific incident.

How to eliminate wrong answers

Option A is wrong because Analytics rules are used to generate alerts based on predefined detection logic (e.g., KQL queries), not to investigate the scope of an ongoing incident. Option B is wrong because Workbooks are interactive dashboards that provide aggregated visualizations and metrics, but they do not offer entity-level relationship mapping for a specific incident. Option C is wrong because Playbooks are automated response workflows (often based on Azure Logic Apps) that execute actions like blocking IPs or isolating devices, but they do not provide the investigative context needed to understand the full attack scope.

Full explanation →

554

MCQhard

Your organization has implemented Microsoft Entra ID Governance. You need to review and attest to the access rights of users in a specific group every quarter. The group contains both direct members and members from nested groups. Which Microsoft Entra feature should you use to automate this review?

A.Lifecycle workflows

B.Access reviews

C.Privileged Identity Management

D.Entitlement management

AnswerB

Microsoft Entra access reviews are a critical component of identity governance, specifically designed to enable organizations to efficiently manage access by regularly reviewing who has access to what resources. They allow designated reviewers, such as group owners or managers, to periodically attest to the continued necessity of access for users to groups, applications, or roles. This process ensures that access remains appropriate, adheres to the principle of least privilege, and helps maintain compliance with organizational policies and regulatory requirements.

Why this answer

Access Reviews in Microsoft Entra ID Governance allow you to create recurring reviews of group membership, including both direct members and transitive members from nested groups. This feature automates the attestation process by sending reviewers notifications and tracking their decisions, ensuring compliance with quarterly review requirements.

Exam trap

The trap here is confusing Entitlement Management (which handles access requests and packages) with Access Reviews (which handle periodic attestation), leading candidates to pick D when the question explicitly requires a recurring review and attestation workflow.

How to eliminate wrong answers

Option A is wrong because Lifecycle Workflows automate joiner-mover-leaver processes (e.g., provisioning/deprovisioning accounts), not periodic access attestation. Option C is wrong because Privileged Identity Management (PIM) focuses on just-in-time activation and oversight of privileged roles, not recurring reviews of standard group membership. Option D is wrong because Entitlement Management manages access packages and catalogs for requesting resources, but does not natively provide recurring attestation workflows for existing group members.

Full explanation →

555

MCQhard

Your organization uses Microsoft Intune and Microsoft Entra ID. You need to enforce that only compliant and managed devices can access corporate email in Microsoft 365. Additionally, if a device is jailbroken, access should be blocked. You also want to provide a seamless sign-in experience for compliant devices. You have Microsoft Entra ID P1 licenses. What should you configure?

A.Configure Mobile Application Management (MAM) policies to restrict access.

B.Configure Azure AD Join for all devices and enable device registration.

C.Create a Conditional Access policy in Microsoft Entra ID that requires device compliance and use Intune compliance policies to block jailbroken devices, with seamless SSO.

D.Configure Microsoft Defender for Endpoint to detect jailbroken devices.

AnswerC

Conditional Access with device compliance ensures only compliant devices access email.

Why this answer

It combines Conditional Access policies in Microsoft Entra ID with Intune compliance policies. Conditional Access can require device compliance, and Intune compliance policies can block jailbroken devices. Seamless SSO provides a frictionless sign-in experience for compliant devices.

Option A is incorrect because MAM policies manage app-level protection without device enrollment, but they do not enforce device compliance or block jailbroken devices. Option B is incorrect because Azure AD Join registers devices but does not automatically enforce compliance policies or block jailbroken devices. Option D is incorrect because Microsoft Defender for Endpoint is a threat protection solution and does not directly manage device compliance or conditional access.

Full explanation →

556

MCQeasy

Your organization uses Microsoft Defender for Cloud to protect Azure virtual machines. You need to ensure that critical vulnerabilities identified on the VMs are automatically remediated using a just-in-time patching mechanism. What should you configure?

A.Enable adaptive application controls and just-in-time VM access in Defender for Cloud

B.Deploy Microsoft Intune for update management

C.Configure Azure Automation Update Management

D.Enable Azure Update Manager

AnswerD

Correct. Azure Update Manager provides automated patching for Azure VMs, enabling just-in-time remediation of critical vulnerabilities.

Why this answer

Azure Update Manager is a unified service that provides managed update capabilities for Azure VMs and Arc-enabled servers. It enables just-in-time patching by allowing you to schedule and apply critical updates as needed, automatically remediating vulnerabilities. In contrast, Adaptive application controls and just-in-time VM access in Defender for Cloud are security controls that reduce attack surface but do not apply patches.

Intune is for endpoint management, and Azure Automation Update Management is a legacy solution being replaced by Azure Update Manager.

Exam trap

Candidates might confuse security controls (like JIT VM access) with actual patch deployment mechanisms. The question specifically asks for a patching mechanism, not an access control.

How to eliminate wrong answers

Option B is wrong because Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) solution for managing devices, not a just-in-time patching mechanism for Azure VMs; it focuses on endpoint management and compliance, not vulnerability remediation via JIT. Option C is wrong because Azure Automation Update Management is a patch management solution that schedules and deploys updates, but it does not provide just-in-time access control or automatic remediation of critical vulnerabilities in a JIT manner; it is a scheduled update service, not a JIT mechanism. Option D is wrong because Azure Update Manager is a unified service for managing updates across Azure and hybrid environments, but it lacks the just-in-time access control and adaptive application controls needed for automatic remediation of critical vulnerabilities; it focuses on update orchestration, not JIT patching.

Full explanation →

557

Multi-Selecteasy

Which TWO of the following are identity-related security best practices recommended by Microsoft? (Choose two.)

Select 2 answers

A.Share passwords with team members for critical accounts

B.Implement Conditional Access policies

C.Use single sign-on (SSO) without MFA

D.Disable sign-in logs to reduce storage costs

E.Enable multi-factor authentication (MFA)

AnswersB, E

Conditional Access enforces access controls based on signals.

Why this answer

The correct answers are B and E. Implementing Conditional Access policies allows organizations to enforce access controls based on conditions, which is a best practice for identity security. Enabling multi-factor authentication (MFA) adds an extra layer of security beyond passwords.

Option A is incorrect because sharing passwords violates security best practices. Option C is incorrect because SSO without MFA does not provide adequate protection. Option D is incorrect because disabling sign-in logs reduces visibility and hinders security monitoring.

Full explanation →

558

Multi-Selectmedium

Which TWO of the following are capabilities of Microsoft Purview Information Protection? (Choose two.)

Select 2 answers

A.Classify and label sensitive data

B.Block external sharing of files

C.Detect malware in email attachments

D.Apply encryption based on sensitivity labels

E.Monitor user activities in real-time

AnswersA, D

Microsoft Purview Information Protection (MPIP) is a foundational component that enables organizations to identify, categorize, and apply sensitivity labels to data across various locations, including Microsoft 365 services, on-premises file shares, and third-party cloud apps. This classification helps in understanding the data landscape and applying appropriate protection measures, making it a core capability.

Why this answer

Microsoft Purview Information Protection (MIP) enables organizations to classify and label sensitive data based on content inspection and policy rules. It also applies encryption and usage restrictions directly through sensitivity labels, ensuring data is protected regardless of where it is stored or shared.

Exam trap

The trap here is confusing Microsoft Purview Information Protection (which focuses on classification, labeling, and encryption) with other security solutions like DLP, Defender, or Audit, leading candidates to select options that are valid but belong to different services.

Full explanation →

559

MCQhard

Refer to the exhibit. You are reviewing Microsoft Entra sign-in logs for a user. The user successfully signed in from a mobile device running iOS, located in the US, with medium risk level. The sign-in did not require MFA. You have a Conditional Access policy that requires MFA for all users when sign-in risk is medium or higher. Why was MFA not triggered?

A.The Conditional Access policy may exclude 'Mobile Apps and Desktop clients' client apps.

B.The device is not compliant, so MFA was not required.

C.The sign-in risk level is medium, which is below the threshold.

D.The user is not assigned to the Conditional Access policy.

AnswerA

Conditional Access policies offer granular control over client applications. If a policy requiring MFA is specifically configured to apply only to 'Browser' client apps, then sign-ins originating from 'Mobile Apps and Desktop clients' would be explicitly excluded from that policy's enforcement. This allows the sign-in to proceed without triggering the MFA requirement, as the policy's scope does not encompass that particular client type. Such exclusions are common for compatibility or specific use cases.

Why this answer

The Conditional Access policy can be configured to exclude specific client apps, such as 'Mobile Apps and Desktop clients'. If the policy excludes these client apps, the sign-in from an iOS mobile device would not be subject to the MFA requirement, even though the sign-in risk is medium. The sign-in logs confirm MFA was not required, indicating the policy did not apply to this client app type.

Exam trap

The trap here is that candidates assume a medium risk level always triggers MFA, overlooking the client apps exclusion condition that can bypass the policy for specific device types.

How to eliminate wrong answers

Option B is wrong because device compliance is not a condition in the described policy; the policy only requires MFA based on sign-in risk, not device compliance. Option C is wrong because the policy explicitly requires MFA when sign-in risk is medium or higher, and the sign-in risk is medium, so the threshold is met. Option D is wrong because the user successfully signed in, and the policy applies to 'all users' unless specifically excluded; the logs show the policy did not trigger, which points to a client app exclusion rather than user assignment.

Full explanation →

560

MCQeasy

Your organization needs to prevent sensitive data in SharePoint Online from being shared externally. Which Microsoft Purview solution should you use?

A.Data Loss Prevention (DLP)

B.eDiscovery

C.Sensitivity labels

D.Insider Risk Management

AnswerA

Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various locations, including SharePoint Online. By configuring DLP policies, organizations can automatically detect content containing sensitive information types, such as credit card numbers or national ID numbers, and then apply protective actions. These actions can include blocking external sharing, notifying administrators, or even encrypting the content, thereby directly preventing unauthorized data exfiltration.

Why this answer

Data Loss Prevention (DLP) is the correct Microsoft Purview solution because it is specifically designed to detect and prevent the unauthorized sharing of sensitive data, such as credit card numbers or personally identifiable information (PII), by applying policies that can block external sharing in SharePoint Online. DLP policies can be configured to scan content in real-time and enforce actions like blocking access or sending notifications when sensitive data is detected in external sharing scenarios.

Exam trap

The trap here is that candidates often confuse sensitivity labels with DLP, assuming labels alone can block sharing, but labels only apply protection (e.g., encryption) and require DLP policies to enforce sharing restrictions.

How to eliminate wrong answers

Option B (eDiscovery) is wrong because eDiscovery is used for searching, holding, and exporting content for legal or investigative purposes, not for preventing data sharing in real-time. Option C (Sensitivity labels) is wrong because while sensitivity labels can classify and protect data with encryption or visual markings, they do not natively enforce external sharing blocks on their own; they require integration with DLP or conditional access policies to prevent sharing. Option D (Insider Risk Management) is wrong because it focuses on identifying and investigating risky user activities (e.g., data exfiltration by insiders) through analytics and alerts, rather than proactively blocking external sharing of sensitive data.

Full explanation →

561

MCQeasy

An organization uses Microsoft Defender for Endpoint (MDE). The security team wants to identify devices that have not received a security update in the last 30 days. Which report should they use?

A.Threat analytics report

B.Device health report

C.Vulnerability management dashboard

D.Microsoft Secure Score report

AnswerB

The Device health report within Microsoft Defender for Endpoint provides a comprehensive overview of the security posture and operational status of managed devices. This report specifically includes critical information such as the status of security updates, antivirus protection, firewall configuration, and sensor health. Organizations can leverage this report to quickly identify devices that are missing essential security updates, thereby addressing potential vulnerabilities and ensuring compliance.

Why this answer

The Device health report in Microsoft Defender for Endpoint provides a list of devices and their last security update status, including the date of the last update. This report directly answers the requirement to identify devices that have not received a security update in the last 30 days by showing the 'Last update' column and allowing filtering by update age.

Exam trap

The trap here is that candidates confuse the Vulnerability management dashboard (which shows vulnerabilities) with a report that tracks update installation recency, but the dashboard does not provide a simple list of devices by last update date.

How to eliminate wrong answers

Option A is wrong because the Threat analytics report focuses on active threats, vulnerabilities, and attack campaigns, not on the update compliance status of individual devices. Option C is wrong because the Vulnerability management dashboard shows discovered vulnerabilities and their severity across devices, but it does not directly report on whether a security update has been installed within a specific time window. Option D is wrong because Microsoft Secure Score measures an organization's security posture based on configuration and control implementation, not the update recency of individual endpoints.

Full explanation →

562

MCQeasy

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?

A.An app protection policy in Microsoft 365 admin center

B.A conditional access policy in Microsoft Entra ID

C.A conditional access policy in Azure AD

D.A device compliance policy in Intune

AnswerB

A conditional access policy in Microsoft Entra ID is the correct mechanism for enforcing access controls based on device compliance. These policies evaluate various signals, including whether a device is marked as 'compliant' by Microsoft Intune, before granting access to cloud applications and resources. By requiring a compliant device, organizations ensure that only trusted and healthy endpoints can access sensitive data, directly addressing the need to block access for non-compliant devices.

Why this answer

Conditional Access policies in Microsoft Entra ID (formerly Azure AD) are the correct mechanism to enforce access controls based on device compliance status. By integrating with Intune's device compliance policies, a Conditional Access policy can block or allow access to corporate email (e.g., Exchange Online) based on whether the device is marked as compliant. This is the standard approach for controlling access to cloud apps like email based on device health.

Exam trap

The trap here is that candidates confuse the role of Intune's device compliance policy (which only defines and reports compliance) with the Conditional Access policy (which enforces the access decision), leading them to select Option D instead of B.

How to eliminate wrong answers

Option A is wrong because app protection policies in the Microsoft 365 admin center (or Microsoft Intune) manage how data is handled within apps (e.g., preventing copy/paste), not whether a device is allowed to access corporate email at the authentication gate. Option C is wrong because 'Azure AD' is the legacy name; the current service is Microsoft Entra ID, and the exam expects the updated terminology. Option D is wrong because a device compliance policy in Intune only defines the compliance requirements (e.g., encryption, OS version) and marks the device as compliant or non-compliant; it does not itself enforce access control to corporate email—that requires a Conditional Access policy to act on the compliance state.

Full explanation →

563

MCQeasy

A company implements a sign-in process where a user must provide their password and then enter a temporary code sent to their mobile phone. Which security principle is this process primarily enforcing?

A.Authorization

B.Authentication

C.Accounting

D.Non-repudiation

AnswerB

Authentication verifies identity. Multi-factor authentication requires two or more forms of verification, such as a password and a code from a phone.

Why this answer

The process of verifying a user's identity by requiring both a password (something they know) and a temporary code sent to their mobile phone (something they have) is a classic implementation of multi-factor authentication (MFA). Authentication is the security principle that confirms the identity of a user, device, or system before granting access. This sign-in flow directly enforces authentication by combining two distinct factors to prove the user is who they claim to be.

Exam trap

The trap here is that candidates often confuse authentication (proving identity) with authorization (granting permissions), especially when the question describes a multi-step sign-in process that seems to 'allow access' — but the core principle being enforced is identity verification, not access control.

Why the other options are wrong

The process described (password + temporary code) is about verifying identity, not granting permissions. Authorization determines what an authenticated user is allowed to do, not how they prove who they are.

The sign-in process described (password + temporary code) is a method of verifying identity, which is authentication. Accounting refers to tracking user activities and resource usage, not verifying identity.

Non-repudiation ensures that a party cannot deny having performed an action, typically through digital signatures or audit trails. The described sign-in process (password + temporary code) is about verifying identity (authentication), not preventing denial of actions.

When would these options actually be correct?

A question asking: 'After a user logs in, the system checks whether they can access a specific file. Which security principle is being applied?' — here Authorization is correct because it controls access rights after identity is verified.

A question that asks: 'Which security principle is primarily enforced when an organization logs user access times, data modifications, and resource usage for auditing purposes?' would make Accounting the correct answer.

An exam question might ask: 'A company uses digital signatures on all financial transactions to ensure that employees cannot deny authorizing payments. Which security principle is this?' In that case, non-repudiation would be correct because it provides proof of origin and integrity.

Why candidates pick the wrong answer

Candidates may confuse authentication (proving identity) with authorization (granting permissions), especially when the scenario involves multiple steps and they think the code is 'authorizing' access.

Candidates may confuse 'accounting' with 'authentication' because both are part of AAA (Authentication, Authorization, Accounting) and the term 'account' appears in both contexts, leading to a mix-up.

Candidates may confuse authentication with non-repudiation because both involve identity verification. However, non-repudiation goes further by providing evidence that can be used to prove an action occurred, which is not the primary goal of the sign-in process described.

Full explanation →

564

MCQeasy

Your company is implementing a passwordless authentication strategy. You want users to be able to sign in using the Microsoft Authenticator app on their mobile devices. Which Microsoft Entra feature should you enable?

A.Windows Hello for Business

B.Passwordless phone sign-in with Microsoft Authenticator

C.FIDO2 security keys

D.Temporary Access Pass

AnswerB

Passwordless phone sign-in with Microsoft Authenticator leverages the user's mobile device as a second factor and a cryptographic key. When attempting to sign in, the user receives a notification on their Authenticator app, which they approve by matching a number or using biometrics, effectively eliminating the need to type a password. This method offers a convenient, secure, and widely applicable passwordless experience across various applications and services integrated with Azure Active Directory.

Why this answer

Passwordless phone sign-in with Microsoft Authenticator allows users to sign in without entering a password by approving a notification or entering a number displayed on the screen. This directly aligns with the requirement to use the Microsoft Authenticator app on mobile devices for a passwordless authentication strategy.

Exam trap

The trap here is that candidates may confuse 'passwordless' with any non-password method, but the question specifically requires the Microsoft Authenticator app, which eliminates Windows Hello for Business (device-bound) and FIDO2 (hardware-bound) as valid options.

How to eliminate wrong answers

Option A is wrong because Windows Hello for Business is a biometric or PIN-based credential tied to a specific Windows device, not a mobile app-based solution. Option C is wrong because FIDO2 security keys are hardware-based external devices (e.g., USB keys) that require physical possession, not the Microsoft Authenticator app on a mobile phone. Option D is wrong because Temporary Access Pass is a time-limited passcode used for onboarding or recovery scenarios, not a persistent passwordless sign-in method using the Authenticator app.

Full explanation →

565

MCQhard

A company receives a subject rights request (SRR) from a customer under GDPR, asking for the deletion of all personal data held about them. The compliance team needs a tool to orchestrate the discovery of this data across Microsoft 365 and other systems, and to track the response and fulfillment of the request. Which Microsoft Purview solution should they use?

A.Microsoft Purview eDiscovery

B.Microsoft Purview Audit

C.Microsoft Purview Data Lifecycle Management (retention labels)

D.Microsoft Priva (Privacy Management)

AnswerD

Microsoft Priva (Privacy Management) is purpose-built to streamline the complex process of responding to Subject Rights Requests (SRRs). It offers automated data discovery across Microsoft 365, Azure, and other connected data sources, identifying personal data relevant to a specific data subject. Priva provides a comprehensive workflow for review, redaction, collaboration, and secure fulfillment, ensuring compliance with global privacy regulations like GDPR and and CCPA.

Why this answer

Microsoft Priva (Privacy Management) is the correct solution because it is specifically designed to help organizations manage subject rights requests (SRRs) under regulations like GDPR. It automates the discovery of personal data across Microsoft 365 and connected systems, provides a workflow to track the request lifecycle, and facilitates the fulfillment of actions such as deletion. This directly addresses the compliance team's need to orchestrate discovery and track response for an SRR.

Exam trap

The trap here is that candidates often confuse eDiscovery (which handles legal holds and litigation) with privacy management (which handles subject rights requests), but eDiscovery lacks the automated SRR workflow and privacy-specific orchestration that Priva provides.

Why the other options are wrong

eDiscovery is designed for legal discovery of content in litigation or investigations, not for orchestrating and tracking subject rights requests under GDPR. It lacks the workflow automation and privacy-specific features needed to manage SRR fulfillment across multiple systems.

Microsoft Purview Audit is designed for logging and investigating user and admin activity, not for orchestrating discovery or tracking fulfillment of subject rights requests under GDPR.

Data Lifecycle Management (retention labels) is used to classify and manage data retention and deletion policies, not to orchestrate discovery of personal data across systems or track subject rights request fulfillment.

When would these options actually be correct?

A company receives a legal hold notice for an ongoing lawsuit and needs to search for and preserve relevant emails and documents across Microsoft 365. Microsoft Purview eDiscovery would be the correct solution to identify, hold, and export that content.

A company needs to investigate a potential security incident by reviewing all user actions (e.g., file access, sign-ins) across Microsoft 365 over the past 90 days. Which Microsoft Purview solution should they use?

A company needs to automatically apply retention or deletion policies to documents based on their content (e.g., financial records) to comply with internal data governance policies. The question would ask for a solution to manage data retention and deletion lifecycle.

Why candidates pick the wrong answer

Candidates may confuse the data search aspect of eDiscovery with the data discovery needed for SRRs, not realizing that SRR management requires dedicated privacy workflow tools like Priva.

Candidates may confuse auditing with the ability to track data for compliance, or assume that audit logs can help locate personal data, but Audit does not provide data discovery or request management capabilities.

Candidates may confuse retention labels with data deletion capabilities, assuming that labeling data for deletion is equivalent to managing SRR fulfillment, but SRR requires cross-system discovery and workflow tracking, not just policy-based deletion.

Full explanation →

566

MCQmedium

A company requires that all sensitive data in Microsoft Teams messages be automatically encrypted and labeled with a 'Confidential' tag. Which Microsoft Purview solution should they use?

A.Microsoft Purview Data Loss Prevention (DLP)

B.Microsoft Purview Data Lifecycle Management

C.Microsoft Purview Information Protection

D.Microsoft Purview Compliance Manager

AnswerC

Microsoft Purview Information Protection (MPIP) is the correct solution because it enables organizations to classify, label, and protect sensitive data across its lifecycle and various locations. Sensitivity labels, a core component of MPIP, can be configured with automatic labeling policies that detect specific sensitive information types (SITs) or trainable classifiers. Upon detection, these labels can apply visual markings, encryption, and access restrictions, ensuring that sensitive data in Microsoft Teams is consistently protected regardless of where it resides or travels.

Why this answer

Microsoft Purview Information Protection includes sensitivity labels that can be auto-applied to sensitive data in Teams messages. DLP policies can detect data but do not apply labels directly. Data Lifecycle Management handles retention.

Compliance Manager is for assessments.

Full explanation →

567

MCQhard

A company is designing a data governance strategy using Microsoft Purview. They need to allow data owners to define custom attributes for data assets and control who can access those assets. Which Purview feature should they use?

A.Microsoft Purview Data Estate Insights

B.Microsoft Purview Data Policy

C.Microsoft Purview Data Catalog

D.Microsoft Purview Data Map

AnswerC

Microsoft Purview Data Catalog allows data owners to manage custom attributes and set access controls on data assets.

Why this answer

Microsoft Purview Data Catalog allows data owners to manage custom attributes and set access controls on data assets. Option A is wrong because Data Estate Insights provides monitoring, not governance. Option B is wrong because Data Policy enables policies on data sources, not asset-level custom attributes.

Option D is wrong because Data Map is the underlying metadata store, not for end-user governance.

Full explanation →

568

MCQhard

Your organization is implementing Microsoft Entra Internet Access (formerly Microsoft Entra Internet Access). You need to secure access to public internet apps by enforcing traffic routing through Microsoft's network. Which feature should you enable?

A.Conditional Access

B.Global Secure Access

C.DDoS protection

D.Network segmentation

AnswerB

Microsoft Entra Global Secure Access is Microsoft's unified Security Service Edge (SSE) solution, designed to extend identity-centric security to network access. It functions as a cloud-delivered proxy, routing both internet-bound and private application traffic through Microsoft's global network security perimeter. This capability enables comprehensive traffic inspection, policy enforcement, and threat protection for all network flows, directly addressing the need for secure traffic routing and robust network security for an organization's users and devices.

Why this answer

Microsoft Entra Internet Access (part of Global Secure Access) routes traffic from users and devices through the Microsoft network to enforce security policies for public internet apps. Enabling Global Secure Access allows you to configure traffic forwarding profiles that redirect internet-bound traffic through Microsoft Entra Internet Access, ensuring consistent policy enforcement and threat protection.

Exam trap

The trap here is that candidates often confuse Conditional Access (an identity-based policy tool) with network-level traffic routing, not realizing that Global Secure Access is the specific feature designed to enforce traffic routing through Microsoft's network for internet-bound apps.

How to eliminate wrong answers

Option A is wrong because Conditional Access is an identity-driven policy engine that enforces access controls based on signals like user, device, and location, but it does not route traffic through Microsoft's network. Option C is wrong because DDoS protection (Azure DDoS Protection) mitigates distributed denial-of-service attacks at the network layer, not traffic routing or secure access to internet apps. Option D is wrong because network segmentation (e.g., virtual networks, subnets) isolates network traffic within an organization's infrastructure but does not redirect internet-bound traffic through Microsoft's network.

Full explanation →

569

MCQhard

You are a compliance officer at a healthcare organization that uses Microsoft 365. The organization must comply with HIPAA regulations. You have Microsoft Purview, Microsoft Defender for Cloud Apps, and Microsoft Intune. You need to ensure that all devices accessing patient health information (PHI) are compliant with the organization's security policies, which require device encryption, a minimum OS version, and the use of a compliant mobile device management (MDM) provider. Currently, some devices are not managed by Intune. You need to enforce that only compliant devices can access PHI stored in SharePoint Online. What should you do?

A.Create a device compliance policy in Microsoft Intune and assign it to all users

B.Deploy an app protection policy in Microsoft Intune to restrict data access

C.Configure a conditional access policy in Microsoft Entra ID to require compliant devices

D.Create a DLP policy in Microsoft Purview to block access from non-compliant devices

AnswerC

Conditional access can require devices to be marked as compliant.

Why this answer

A conditional access policy in Microsoft Entra ID can be configured to require that devices accessing SharePoint Online be marked as compliant. Device compliance is determined by Intune compliance policies (covering encryption, OS version, MDM enrollment) but the enforcement is done via conditional access. Option A is wrong because creating a compliance policy alone does not enforce the requirement; you need a conditional access policy to block non-compliant devices.

Option B is wrong because app protection policies manage data access at the app level but do not enforce device compliance (e.g., OS version or device encryption). Option D is wrong because DLP policies focus on preventing data leakage, not on device compliance.

Full explanation →

570

MCQhard

A company runs critical applications on Windows Server virtual machines in Azure and on-premises. The security team wants to reduce the exposure of administrative ports (e.g., RDP, SSH) by requiring administrators to request just-in-time (JIT) access. The request should require approval from a central team, and the port should be opened only for a limited time. Which Microsoft security solution provides this JIT capability for both Azure and on-premises servers (when connected via Azure Arc)?

A.Microsoft Entra Privileged Identity Management (PIM)

B.Microsoft Defender for Identity

C.Microsoft Defender for Cloud (with just-in-time VM access)

D.Microsoft Defender for Cloud Apps

AnswerC

Microsoft Defender for Cloud provides advanced threat protection and security posture management for hybrid cloud workloads, including Windows Server virtual machines. Its Just-in-Time (JIT) VM access feature specifically addresses the requirement by allowing temporary, controlled access to management ports like RDP. This significantly reduces the attack surface by keeping these ports closed by default, only opening them for a limited time upon approval, which is crucial for securing critical applications.

Why this answer

Microsoft Defender for Cloud's just-in-time (JIT) VM access capability reduces exposure to administrative ports (RDP, SSH) by locking down inbound traffic to Azure VMs and Azure Arc-enabled on-premises servers. It requires administrators to request access, which can be configured to require approval from a central team, and automatically opens the specified ports for a limited time before closing them again. This directly matches the scenario's need for JIT access with approval and time-limited port opening across hybrid environments.

Exam trap

The trap here is that candidates confuse Privileged Identity Management (PIM) with just-in-time VM access because both involve 'just-in-time' and 'approval,' but PIM controls role activation in Azure AD/Entra ID, not network-level port access to virtual machines.

Why the other options are wrong

Microsoft Entra PIM manages just-in-time privileged access to Azure AD roles and Azure resources, but it does not provide JIT access to administrative ports (RDP/SSH) on virtual machines, whether in Azure or on-premises via Azure Arc.

Microsoft Defender for Identity is an on-premises security solution that detects identity threats using Active Directory signals, but it does not provide just-in-time (JIT) access control for administrative ports on VMs.

Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that focuses on securing cloud applications, not on managing just-in-time access to administrative ports on VMs. It does not provide JIT VM access capabilities.

When would these options actually be correct?

A question asks: 'Which Microsoft solution provides just-in-time and time-bound privileged role assignments for Azure AD roles, such as Global Administrator, with approval workflows?' In that context, Microsoft Entra PIM is the correct answer.

A question asking which Microsoft solution detects and investigates advanced attacks against on-premises Active Directory environments, such as pass-the-hash or golden ticket attacks, would have Microsoft Defender for Identity as the correct answer.

A question asks: 'Which Microsoft solution provides visibility and control over shadow IT, enforces data loss prevention policies, and detects anomalous behavior in cloud applications like Microsoft 365 and Salesforce?' In that scenario, Microsoft Defender for Cloud Apps would be the correct answer.

Why candidates pick the wrong answer

Candidates associate 'just-in-time' and 'approval' with PIM, but they overlook that PIM handles role-based access, not network-level port access for VMs.

Candidates may confuse 'Identity' in the name with identity-based access control, mistakenly thinking it includes JIT access management for administrative ports.

Candidates may confuse the 'just-in-time' concept with other security solutions, or assume that Defender for Cloud Apps includes JIT capabilities because it is part of the Microsoft Defender suite and deals with access control.

Full explanation →

571

Matchingmedium

Match each Azure security service to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Enforce organizational standards and assess compliance

Define repeatable Azure resources and policies

Unified security management and threat protection

Cloud-native SIEM and SOAR solution

Securely store and manage secrets and keys

Why these pairings

Common confusions involve mixing up the purposes of security management (Defender for Cloud), SIEM/SOAR (Sentinel), and secret management (Key Vault).

Full explanation →

572

MCQmedium

A company runs virtual machines in Azure and also maintains on-premises servers connected via Azure Arc. The security team needs a single dashboard to view security recommendations, detect misconfigurations, and track a secure score across both environments. They also want to enable advanced threat protection features such as just-in-time (JIT) VM access and file integrity monitoring for these workloads. Which Microsoft security solution should they implement?

A.Microsoft Defender for Cloud

B.Microsoft Sentinel

C.Microsoft Defender for Endpoint

D.Microsoft Defender for Cloud Apps

AnswerA

Defender for Cloud provides a unified dashboard with secure score, recommendations, and advanced threat protection for hybrid workloads including on-premises servers via Azure Arc.

Why this answer

Microsoft Defender for Cloud provides a unified dashboard that displays security recommendations, misconfigurations, and a secure score across both Azure and on-premises workloads connected via Azure Arc. It also includes advanced threat protection features like just-in-time (JIT) VM access and file integrity monitoring, making it the correct choice for this scenario.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM and workload protection platform) with Microsoft Sentinel (a SIEM), but the question explicitly asks for a single dashboard for security posture, secure score, and advanced threat protection features like JIT and file integrity monitoring, which are exclusive to Defender for Cloud.

Why the other options are wrong

Microsoft Sentinel is a SIEM and SOAR solution for collecting and analyzing security logs, not a dashboard for security recommendations, misconfigurations, or secure score across hybrid environments. It does not provide just-in-time VM access or file integrity monitoring.

Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for devices, not on providing a unified dashboard for security recommendations, misconfigurations, secure score, or advanced cloud workload protections like JIT VM access and file integrity monitoring across hybrid environments.

Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) focused on SaaS application security, not on providing a unified dashboard for VM secure score, misconfigurations, or advanced threat protection like JIT VM access and file integrity monitoring across Azure and on-premises servers.

When would these options actually be correct?

A company needs to aggregate security events from multiple sources (e.g., Azure, on-premises, third-party) for threat detection, incident response, and automated orchestration. The question would specify log collection, correlation, and alerting across diverse data sources.

A company needs to protect endpoints (e.g., workstations, servers) from advanced threats, with capabilities like antivirus, EDR, and threat hunting. The question would specify endpoint security, not hybrid cloud workload management or secure score.

A company uses multiple SaaS applications (e.g., Office 365, Salesforce) and needs to detect shadow IT, control access, and prevent data leaks from these apps. They also require visibility into user activities and anomaly detection across cloud apps.

Why candidates pick the wrong answer

Candidates may confuse Sentinel's security monitoring capabilities with Defender for Cloud's posture management and workload protection, especially since both involve security dashboards and threat detection.

Candidates may confuse 'Defender for Endpoint' with 'Defender for Cloud' due to similar naming, or assume endpoint protection covers all security needs, overlooking the specific requirements for cloud workload protection and secure score.

Candidates may confuse 'Cloud Apps' with 'Cloud' and think it covers all cloud workloads, or they may assume it includes VM security features due to the 'Defender' branding.

Full explanation →

573

MCQmedium

A compliance officer needs to investigate a potential data exfiltration incident. They must search the unified audit log for all activities where users accessed a specific sensitive SharePoint site in the last 7 days. Additionally, they need to create a custom alert that triggers when more than 10 file downloads occur from that site within an hour. Which Microsoft Purview solution should they use?

A.Microsoft Purview Audit (Standard)

B.Microsoft Purview Data Loss Prevention (DLP)

C.Microsoft Purview eDiscovery

D.Microsoft Purview Communications Compliance

AnswerA

Microsoft Purview Audit (Standard) provides access to the unified audit log, enabling organizations to search for user and administrator activities across various Microsoft 365 services, including SharePoint Online. This service allows compliance officers to investigate past events, such as unusual file downloads, and to create custom alert policies based on specific activity patterns or thresholds. Its capability to search historical audit data and configure alerts for suspicious behaviors directly addresses the need for both investigation and proactive monitoring.

Why this answer

Microsoft Purview Audit (Standard) logs all user activities, including file accesses and downloads from SharePoint sites, for 90 days. The compliance officer can search the unified audit log for the specific site's activities over the last 7 days and create custom alert policies (e.g., threshold-based alerts for >10 downloads per hour) using the Microsoft 365 Defender portal. This makes Audit (Standard) the correct solution for both investigation and alerting.

Exam trap

The trap here is that candidates confuse the investigative and alerting capabilities of Audit (Standard) with the preventive controls of DLP, assuming DLP can retroactively search logs or create threshold-based alerts, when in fact DLP only applies real-time policies to content in transit or at rest.

Why the other options are wrong

Microsoft Purview Data Loss Prevention (DLP) is designed to prevent data exfiltration by enforcing policies on sensitive data, not to investigate past incidents or create alerts based on activity thresholds from the unified audit log.

Microsoft Purview eDiscovery is designed for legal investigations and content searches across data sources, not for real-time monitoring of user activities or creating custom alerts based on download thresholds from the unified audit log.

Microsoft Purview Communications Compliance is designed to monitor and manage internal and external communications for regulatory compliance, not to investigate data exfiltration via audit logs or create alerts based on file download thresholds from SharePoint.

When would these options actually be correct?

A question asks: 'An organization needs to prevent users from sharing credit card numbers via email. Which Microsoft Purview solution should they use?' In that scenario, DLP would be correct because it can detect and block sensitive data in transit.

A legal team needs to identify and preserve all documents containing specific keywords from a SharePoint site as part of a litigation hold. They must search across mailboxes, sites, and Teams for relevant content and export it for review. In this case, Microsoft Purview eDiscovery would be the correct solution.

A question asking which solution monitors employee communications (e.g., email, Teams) for inappropriate language, sensitive information sharing, or regulatory compliance (e.g., FINRA, SEC rules) would make Communications Compliance the correct answer.

Why candidates pick the wrong answer

Candidates may confuse DLP's data protection capabilities with audit and alerting, assuming DLP can both monitor and alert on download activities, but DLP focuses on policy enforcement rather than historical investigation and custom alert rules.

Candidates may confuse eDiscovery's ability to search audit logs and content with the real-time alerting and investigation capabilities of Audit, especially when the question involves searching for user activities and setting thresholds.

Candidates may confuse 'compliance' with general compliance tasks like investigating incidents, or think Communications Compliance covers all compliance-related monitoring including data exfiltration.

Full explanation →

574

MCQhard

Your company is deploying Microsoft Entra ID Governance. They want to automate the review of guest user access to Microsoft Teams and remove access when guests leave the partner organization. Which feature should they implement?

A.Access reviews and connected organizations

B.Entitlement management

C.Terms of use

D.Password policies

AnswerA

Access reviews are a core component of Microsoft Entra ID Governance, enabling organizations to periodically review access rights for users, including guests. When combined with connected organizations, which define external partners, access reviews can be configured to automatically remove guest accounts or their access to resources if their access is no longer justified or if reviewers fail to attest to their continued need. This directly addresses the requirement for automated removal of guest access.

Why this answer

Access reviews in Microsoft Entra ID Governance allow you to create recurring reviews of guest user access to resources like Microsoft Teams. By configuring the review to include connected organizations, you can automatically remove guest access when the guest's identity is no longer associated with a partner organization, such as when they leave the partner company. This automation is achieved through the integration of access reviews with the connected organization's lifecycle, ensuring that guest access is revoked without manual intervention.

Exam trap

The trap here is that candidates often confuse entitlement management (which handles access requests and provisioning) with access reviews (which handle periodic attestation and automated removal), leading them to choose entitlement management instead of the correct feature for automated removal based on partner organization changes.

How to eliminate wrong answers

Option B is wrong because entitlement management is used to manage access packages and automate the request and approval process for resources, but it does not directly automate the removal of guest access based on the guest leaving a partner organization; that is the function of access reviews with connected organizations. Option C is wrong because terms of use are used to present and require acceptance of legal or policy documents before accessing resources, not to automate access removal based on organizational membership changes. Option D is wrong because password policies control password complexity, expiration, and lockout settings, and have no role in automating the review or removal of guest access based on partner organization membership.

Full explanation →

575

MCQeasy

Your company uses Microsoft Purview to manage records. You need to ensure that financial records are retained for 7 years and then permanently deleted. Which type of policy should you create?

A.A retention policy with a retention period of 7 years and then delete

B.A sensitivity label set to 'Financial' with auto-labeling

C.A retention label that triggers a disposition review after 7 years

D.A DLP policy that blocks sharing of financial records

AnswerA

A retention policy with a retention period of 7 years and then delete is the correct solution because retention policies are designed to automatically apply retention and deletion actions across entire locations, such as SharePoint sites or Exchange mailboxes. This policy ensures that content is retained for the specified 7 years and then permanently deleted without requiring any manual intervention, directly fulfilling the requirement for automatic disposition.

Why this answer

A retention policy with a retention period of 7 years and then delete is correct because it applies a time-based retention rule to financial records at the container or folder level, ensuring they are kept for exactly 7 years and then permanently removed without human intervention. This meets the requirement for automatic deletion after the retention period, as opposed to a disposition review which requires manual approval.

Exam trap

The trap here is that candidates confuse a retention label with a retention policy, thinking a label is required for deletion, but a retention policy can enforce deletion at the container level without needing a label or human review.

How to eliminate wrong answers

Option B is wrong because a sensitivity label set to 'Financial' with auto-labeling classifies data based on sensitivity but does not enforce a retention or deletion schedule; it only applies protection actions like encryption or headers. Option C is wrong because a retention label that triggers a disposition review after 7 years requires a human to approve deletion, which contradicts the requirement for permanent deletion without manual steps. Option D is wrong because a DLP policy blocks sharing of financial records to prevent data loss but does not manage retention or deletion timelines.

Full explanation →

576

MCQeasy

A company uses Microsoft Entra ID (Microsoft Entra ID) to manage user access to cloud applications. The security team wants to enforce that users must provide a second form of authentication, such as a phone call or mobile app notification, in addition to their password. Which Microsoft Entra capability should they enable?

A.Conditional Access

B.Identity Protection

C.Multi-Factor Authentication

D.Privileged Identity Management

AnswerC

Multi-Factor Authentication (MFA) is the security feature specifically designed to enhance account security by requiring users to provide two or more distinct verification factors to prove their identity. These factors typically come from different categories, such as something you know (password), something you have (phone, authenticator app), or something you are (biometrics). MFA directly implements and provides the additional authentication factor beyond the primary password, making it the correct choice for adding a second verification method.

Why this answer

Multi-Factor Authentication (MFA) is the correct capability because it requires users to provide a second form of authentication (e.g., phone call, mobile app notification) in addition to their password. This directly addresses the security team's requirement for a second authentication factor, which is the core function of MFA in Microsoft Entra ID.

Exam trap

The trap here is that candidates may confuse Conditional Access (which can *require* MFA) with the actual MFA capability itself, but the question asks for the capability that *provides* the second form of authentication, not the policy that enforces it.

How to eliminate wrong answers

Option A is wrong because Conditional Access is a policy engine that enforces conditions (e.g., location, device state) to grant access, but it does not itself provide a second authentication factor; it can require MFA as a control, but the capability to provide the second factor is MFA. Option B is wrong because Identity Protection uses risk signals (e.g., leaked credentials, anonymous IP addresses) to detect and respond to potential identity threats, but it does not enforce a second authentication factor; it can trigger MFA via Conditional Access, but the second factor itself is MFA. Option D is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role activation and approval workflows, not the enforcement of a second authentication factor for all users.

Full explanation →

577

MCQmedium

A company uses Microsoft Entra ID. The security team wants to automatically detect user behaviors that indicate possible compromise, such as leaked credentials, impossible travel, or anomalous login patterns. When a user is determined to be at high risk, the system should automatically require the user to reset their password the next time they sign in. Which Microsoft Entra capability should they use?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management (PIM)

D.Identity Governance

AnswerB

Microsoft Entra ID Protection is specifically designed to detect and remediate identity-based risks. It analyzes sign-in and user behavior to identify threats like impossible travel, leaked credentials, or unfamiliar sign-in properties. Crucially, it allows administrators to configure user risk policies that can automatically enforce actions such as requiring a password reset or blocking access when a user's risk level is deemed high, directly addressing the need for automated remediation.

Why this answer

Identity Protection is the correct Microsoft Entra capability because it is specifically designed to automatically detect risky user behaviors such as leaked credentials, impossible travel, and anomalous sign-in patterns. It assigns a risk level to users and sign-ins, and can be configured with a Conditional Access policy to enforce actions like requiring a password reset at next sign-in when a user is deemed high risk. This directly matches the security team's requirement for automated detection and remediation.

Exam trap

Microsoft often tests the distinction between detection and enforcement: candidates mistakenly choose Conditional Access because it enforces the password reset, but the question asks for the capability that automatically detects the risky behaviors, which is Identity Protection—Conditional Access is the enforcement mechanism, not the detection engine.

How to eliminate wrong answers

Option A is wrong because Conditional Access is a policy engine that enforces access controls based on conditions (e.g., location, device state), but it does not itself detect risky behaviors like leaked credentials or impossible travel; it relies on Identity Protection to provide the risk signals. Option C is wrong because Privileged Identity Management (PIM) focuses on just-in-time privileged role activation, approval workflows, and access reviews for administrative roles, not on detecting user compromise behaviors or enforcing password resets for risky users. Option D is wrong because Identity Governance manages user lifecycle, access certifications, and entitlement management (e.g., access reviews, group membership), but it does not include risk detection or automatic remediation for compromised accounts.

Full explanation →

578

MCQeasy

A company uses Microsoft Entra ID. A new IT support technician is hired and needs to be able to reset passwords for users but must not be allowed to delete user accounts or modify group memberships. Which built-in Microsoft Entra ID role should be assigned to this technician?

A.User Administrator

B.Password Administrator

C.Helpdesk Administrator

D.Global Administrator

AnswerB

The Password Administrator role in Microsoft Entra ID is specifically designed for helpdesk personnel who need to reset passwords for users and manage service requests related to identity issues. This role grants the necessary permissions to perform password resets without conferring broader administrative rights, such as the ability to create or delete user accounts, modify group memberships, or manage other user properties. It perfectly adheres to the principle of least privilege by providing only the capabilities essential for password management tasks.

Why this answer

The Password Administrator role is the correct choice because it grants the specific permissions required to reset passwords for all users, including administrators, while explicitly excluding permissions to delete user accounts or modify group memberships. This role is designed for scenarios where a technician needs to perform password-related tasks without broader user management capabilities.

Exam trap

The trap here is that candidates often confuse the Password Administrator role with the Helpdesk Administrator role, mistakenly thinking the latter is more restrictive, when in fact the Helpdesk Administrator has broader user management capabilities including modifying user properties and managing support tickets.

Why the other options are wrong

The User Administrator role can reset passwords but also allows deleting user accounts and modifying group memberships, which exceeds the required permissions.

The Helpdesk Administrator role can reset passwords, but it also allows managing support tickets and other helpdesk functions, which is broader than the requirement. However, the key issue is that the Password Administrator role is more restrictive and specifically designed for password resets, making it the correct choice.

The Global Administrator role has full access to all Microsoft Entra ID features, including deleting user accounts and modifying group memberships, which exceeds the technician's required permissions.

When would these options actually be correct?

A question where the technician needs to manage all user and group objects, including creating users, resetting passwords, and managing group memberships, but not have full administrative access.

A company needs a technician who can reset passwords AND manage service requests (support tickets) in the Microsoft 365 admin center, but not delete users or modify groups. In that scenario, Helpdesk Administrator would be the correct role.

This role would be correct if the question asked for a role that can manage all aspects of Microsoft Entra ID, including security settings, user administration, and access to all administrative features, with no restrictions.

Why candidates pick the wrong answer

Candidates may think 'User Administrator' is the standard role for user management tasks like password resets, overlooking its broader permissions.

Candidates may think 'Helpdesk' implies password reset duties, and they might not be aware of the Password Administrator role's existence or its narrower scope.

Candidates may choose this option because they think the technician needs broad administrative powers to reset passwords, overlooking the specific restrictions mentioned in the question.

Full explanation →

579

MCQhard

Refer to the exhibit. You are creating a Microsoft Purview sensitivity label for HR data. The JSON shows a label configuration. What is the likely effect of setting the sensitivity value to 90?

A.The label automatically encrypts the document

B.The label triggers auditing for 90 days

C.The label sets a 90-day retention period

D.The label will be applied with higher priority than labels with lower sensitivity values

AnswerD

In Microsoft Purview, sensitivity labels are assigned a priority order, typically based on their sensitivity value. When multiple auto-labeling policies might apply different labels to the same content, the label with the higher sensitivity value (and thus higher priority) will be applied. This ensures that the most restrictive or appropriate classification and protection settings are consistently enforced.

Why this answer

In Microsoft Purview, sensitivity labels are assigned an integer priority value (typically 0 to 100). A higher sensitivity value indicates a higher priority. When multiple labels are available, the label with the highest sensitivity value is applied by default or takes precedence in auto-labeling and policy conflicts.

Setting the value to 90 ensures this HR label is prioritized over labels with lower values, such as 75 or 50.

Exam trap

The SC-900 exam often tests the misconception that the sensitivity value directly controls encryption, retention, or auditing, when in fact it only determines label priority in a hierarchical classification scheme.

How to eliminate wrong answers

Option A is wrong because sensitivity labels do not automatically encrypt documents unless an encryption action (e.g., 'Protect' with user-defined permissions) is explicitly configured in the label settings; the JSON snippet only shows a sensitivity value, not an encryption action. Option B is wrong because auditing is controlled by audit policies in Microsoft 365, not by the sensitivity value; a value of 90 does not trigger or set an audit duration. Option C is wrong because retention periods are configured separately via retention labels or retention policies in Microsoft Purview, not by the sensitivity value of a sensitivity label.

Full explanation →

580

MCQmedium

A company has several custom-developed web applications hosted on-premises. The company wants to provide employees with secure remote access to these applications without deploying a traditional VPN. Employees should be able to sign in using their existing Microsoft Entra ID credentials, and the solution should pass through multi-factor authentication policies. Which Microsoft Entra ID feature should they implement?

A.Microsoft Entra Application Proxy

B.Microsoft Entra Domain Services

C.Microsoft Entra Privileged Identity Management

D.Microsoft Entra Identity Protection

AnswerA

Microsoft Entra Application Proxy is the correct solution because it provides secure remote access to on-premises web applications by acting as a reverse proxy. It integrates these applications with Microsoft Entra ID, allowing users to authenticate using their Entra ID credentials, including multi-factor authentication and Conditional Access policies. The Application Proxy connector, installed on the on-premises network, establishes an outbound-only connection to the Entra ID cloud service, eliminating the need for inbound firewall rules or a VPN.

Why this answer

Microsoft Entra Application Proxy provides secure remote access to on-premises web applications by acting as a reverse proxy. It allows employees to sign in with their existing Microsoft Entra ID credentials and enforces conditional access policies, including multi-factor authentication, without requiring a traditional VPN.

Exam trap

The trap here is that candidates often confuse Microsoft Entra Application Proxy with a traditional VPN or assume that Microsoft Entra Domain Services is needed for authentication, but the key requirement is secure remote access without VPN, which only Application Proxy fulfills by acting as a reverse proxy with Entra ID integration.

Why the other options are wrong

Microsoft Entra Domain Services provides managed domain services like domain join and LDAP, not secure remote access to on-premises web applications with Microsoft Entra ID authentication and MFA.

Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles in Microsoft Entra ID, but it does not provide secure remote access to on-premises web applications. The question requires a solution for remote application access, not identity governance.

Microsoft Entra Identity Protection is a risk-based detection and remediation tool, not a remote access solution. It does not provide secure access to on-premises web applications or pass through authentication to them.

When would these options actually be correct?

A company needs to migrate legacy on-premises applications that require LDAP or NTLM authentication to the cloud without rewriting them. They want to use Microsoft Entra ID for authentication but the apps don't support modern protocols. In this case, Entra Domain Services would provide the necessary domain services.

A company needs to implement just-in-time privileged access for administrators managing critical Azure resources, requiring time-bound role assignments and approval workflows. PIM would be the correct answer for managing and auditing privileged roles.

An exam question asks: 'A company wants to automatically detect and respond to suspicious sign-in behaviors, such as impossible travel or leaked credentials, and enforce conditional access policies based on user risk. Which Microsoft Entra feature should they implement?'

Why candidates pick the wrong answer

Candidates may confuse 'Domain Services' with providing access to on-premises resources, or think that domain services are needed for authentication and MFA pass-through.

Candidates may confuse PIM with a security feature that controls access, but they overlook that PIM focuses on role-based access control for privileged identities, not on proxying application traffic.

Candidates may confuse Identity Protection's security monitoring capabilities with the secure access requirements of the question, thinking that identity protection includes remote access features.

Full explanation →

581

MCQmedium

Your company uses Microsoft Defender for Cloud to assess security posture. A recommendation states that virtual machines should have just-in-time (JIT) network access enabled. What is the primary security benefit of enabling JIT?

A.It reduces the attack surface by opening ports only when necessary

B.It replaces the need for network security groups

C.It encrypts all network traffic between the VM and clients

D.It permanently blocks all inbound traffic to the VM

AnswerA

Just-in-Time (JIT) VM access significantly reduces the attack surface by ensuring that management ports, such as RDP and SSH, remain closed by default. It dynamically opens these ports only for a limited time and from specified source IP addresses when an authorized request is made. This temporary, conditional access minimizes the window of opportunity for malicious actors to exploit open ports, thereby enhancing the security posture of virtual machines.

Why this answer

JIT network access reduces the attack surface by keeping network ports closed by default and opening them only when needed for legitimate traffic, based on user requests. It does not block all inbound traffic permanently; it allows authorized requests. It does not encrypt traffic or replace firewall rules; it complements them.

Full explanation →

582

MCQeasy

A company wants to allow users to reset their own passwords from the login screen without contacting IT. Which Microsoft Entra ID feature enables this?

A.Conditional Access

B.Multifactor authentication

C.Self-Service Password Reset

D.Identity Protection

AnswerC

Correct: SSPR enables users to reset passwords without IT intervention.

Why this answer

Self-Service Password Reset (SSPR) is the Microsoft Entra ID feature that allows users to reset their own passwords from the login screen without contacting IT. It is specifically designed to reduce helpdesk workload by enabling password changes or unlocks through a verified authentication method, such as a phone call, text message, or the Microsoft Authenticator app.

Exam trap

The trap here is that candidates often confuse Conditional Access with SSPR because both appear in the login flow, but Conditional Access enforces policies after authentication, whereas SSPR is a separate feature for password recovery before authentication completes.

How to eliminate wrong answers

Option A is wrong because Conditional Access is a policy engine that enforces access controls (e.g., requiring MFA or blocking sign-ins from specific locations) based on signals like user, device, or location, but it does not provide password reset functionality. Option B is wrong because Multifactor Authentication (MFA) adds an extra layer of security by requiring a second verification factor during sign-in, but it does not enable users to reset their own passwords. Option D is wrong because Identity Protection uses machine learning to detect and respond to identity-based risks (e.g., leaked credentials or anomalous sign-ins), but it does not include a self-service password reset capability.

Full explanation →

583

MCQeasy

A company wants to automatically detect and remediate compliance issues such as sharing sensitive data externally. Which Microsoft Purview solution should they use?

A.Microsoft Purview Records Management

B.Microsoft Purview Data Loss Prevention

C.Microsoft Purview eDiscovery

D.Microsoft Purview Audit

AnswerB

Microsoft Purview Data Loss Prevention (DLP) is precisely designed to identify, monitor, and protect sensitive information across various locations, including cloud services, endpoints, and on-premises. DLP policies use sophisticated rules to detect sensitive data and automatically apply remediation actions, such as blocking sharing, encrypting content, or notifying administrators, effectively preventing unauthorized disclosure and ensuring compliance.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect, alert, and automatically remediate when sensitive data (e.g., credit card numbers, personally identifiable information) is shared externally via email, Teams, or cloud apps. DLP policies can enforce actions like blocking the transmission or applying encryption, directly addressing the requirement to prevent unauthorized external sharing of sensitive data.

Exam trap

The trap here is that candidates often confuse the proactive, blocking capability of DLP with the reactive, investigative tools like eDiscovery or Audit, mistakenly thinking that logging or searching for past incidents fulfills the requirement to 'automatically detect and remediate' in real time.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Records Management focuses on managing the lifecycle of records (retention, deletion, and disposition) for compliance with regulatory requirements, not on detecting or preventing real-time data sharing violations. Option C is wrong because Microsoft Purview eDiscovery is used for searching, preserving, and exporting content for legal investigations or litigation, not for proactive detection and remediation of data sharing compliance issues. Option D is wrong because Microsoft Purview Audit provides logging and forensic visibility into user and admin activities (e.g., who accessed what and when), but it does not have the capability to automatically detect and block sensitive data sharing in transit.

Full explanation →

584

MCQhard

A multinational corporation stores highly sensitive intellectual property in SharePoint Online. To meet regulatory requirements, they need an additional layer of encryption beyond Microsoft's baseline encryption. The company wants to manage their own encryption keys using Azure Key Vault, so that if they remove the key from the service, the data becomes unreadable. Which Microsoft Purview solution should they implement?

A.Double Key Encryption

B.Customer Key

C.Information Rights Management

D.Customer Lockbox

AnswerB

Correct. Microsoft Purview Customer Key allows customers to provide and manage their own encryption keys using Azure Key Vault, providing an additional layer of encryption on top of the baseline. Data is encrypted using these keys, and the customer can control key access.

Why this answer

Customer Key (Option B) is the correct solution because it provides the ability to control and manage the encryption keys used to encrypt data at rest in Microsoft 365, including SharePoint Online. By using Azure Key Vault to store the keys, the organization can revoke access at any time, rendering the data unreadable—a key requirement for meeting regulatory obligations. This goes beyond Microsoft's baseline encryption by adding a customer-controlled layer of encryption.

Exam trap

The trap here is that candidates often confuse Customer Key with Double Key Encryption, mistakenly thinking DKE is required for customer-managed keys in Azure Key Vault, when in fact Customer Key is the correct solution for managing encryption keys at rest across Microsoft 365 workloads.

Why the other options are wrong

Double Key Encryption (DKE) requires two keys: one managed by Microsoft and one managed by the customer. The question specifies that the company wants to manage their own encryption keys using Azure Key Vault and that removing the key makes data unreadable, which aligns with Customer Key, not DKE. DKE is designed for scenarios where data must be encrypted with a key held outside Microsoft's control, but it does not use Azure Key Vault for the customer key.

Customer Lockbox provides controlled access for Microsoft engineers to your data during support requests, not an additional layer of encryption where you manage your own keys. It does not make data unreadable if you remove a key.

When would these options actually be correct?

A company needs to ensure that only they can decrypt sensitive data, even if Microsoft's systems are compromised, and they want to hold one of the two encryption keys themselves (not in Azure Key Vault). For example: 'A law firm stores highly confidential client documents in SharePoint Online and requires that no one, including Microsoft, can access the data without the firm's explicit key, which is stored on-premises.'

A company needs to ensure that Microsoft support engineers cannot access their data without explicit approval, often for compliance or audit purposes. The question would specify a need for access control during support sessions, not encryption key management.

Why candidates pick the wrong answer

Candidates may confuse Double Key Encryption with Customer Key because both involve customer-managed keys. The term 'double' might suggest an extra layer of encryption, which matches the question's requirement for an additional layer beyond baseline encryption.

Candidates may confuse 'Customer Lockbox' with a customer-managed encryption solution because both involve customer control, but Lockbox controls access, not encryption keys.

Full explanation →

585

MCQeasy

A company implements multiple layers of security controls: firewalls at the perimeter, intrusion detection systems on internal segments, antivirus software on all workstations, and encryption for sensitive data at rest and in transit. This strategy is intended to ensure that if one control fails, others still provide protection. Which security concept does this approach represent?

A.Least privilege

B.Defense in depth

C.Separation of duties

D.Zero trust

AnswerB

Defense in depth is a comprehensive cybersecurity strategy that employs a series of diverse and overlapping security mechanisms and controls to protect valuable assets. By implementing multiple layers—such as physical security, network segmentation, firewalls, intrusion detection systems, endpoint protection, and data encryption—organizations create a robust and resilient defense. This multi-layered approach ensures that if one security control fails or is bypassed, subsequent layers are still in place to detect and prevent a breach, significantly increasing the effort and time required for an attacker to succeed.

Why this answer

Defense in depth is the correct concept because it involves implementing multiple layers of security controls (e.g., firewalls, IDS, antivirus, encryption) so that if one layer fails, subsequent layers continue to provide protection. This layered approach ensures redundancy and mitigates the risk of a single point of failure, aligning with the scenario described.

Exam trap

The trap here is that candidates often confuse defense in depth with zero trust, mistakenly thinking that multiple layers automatically imply a zero-trust architecture, but zero trust specifically requires explicit verification per request rather than just layered controls.

Why the other options are wrong

The question describes multiple layers of security controls (firewalls, IDS, antivirus, encryption) working together to provide protection even if one fails. This is the definition of defense in depth, not least privilege, which focuses on granting only necessary permissions.

Separation of duties prevents fraud or error by dividing critical tasks among multiple people, not by layering security controls. The question describes multiple overlapping security layers, which is defense in depth, not separation of duties.

Zero trust is a security model that assumes no implicit trust and requires continuous verification of every access request, not a layered defense strategy. The question describes multiple overlapping controls, which is defense in depth, not zero trust.

When would these options actually be correct?

A scenario where a company restricts user access rights so that employees can only access the data and systems required for their job roles, with no unnecessary permissions. The question would ask about minimizing exposure to sensitive data.

A company requires that no single employee can approve a purchase order and also process the payment. This ensures that two people must collaborate to complete a financial transaction, reducing the risk of embezzlement. This scenario tests separation of duties.

A question describing a network architecture where no device or user is trusted by default, even if inside the corporate perimeter, and every access request must be authenticated and authorized regardless of location. For example: 'A company implements micro-segmentation, requires multi-factor authentication for all internal resource access, and continuously validates device health before granting access.'

Why candidates pick the wrong answer

Candidates may confuse 'least privilege' with the layered approach because both involve security controls, but least privilege is about access rights, not overlapping defenses.

Candidates may confuse 'separation of duties' with 'multiple layers of defense' because both involve multiple components, but separation of duties is about dividing responsibilities among people, not layering technical controls.

Candidates may confuse zero trust with defense in depth because both involve multiple security controls, but zero trust specifically focuses on eliminating implicit trust and verifying every access, not on layered protection against failure of a single control.

Full explanation →

586

MCQhard

Refer to the exhibit. You run a KQL query in Microsoft Sentinel to investigate ransomware alerts. The query returns: AlertSeverity High: 5, Medium: 3, Low: 2. The security team wants to automate a response for all high-severity ransomware alerts. What should you configure?

A.Create an analytics rule for ransomware

B.Create a hunting query for ransomware

C.Create a workbook to display ransomware alerts

D.Create an automation rule that triggers a playbook for high-severity ransomware incidents

AnswerD

Automation rules in Microsoft Sentinel are specifically engineered to manage and respond to incidents automatically, serving as the orchestrator for automated actions. By configuring an automation rule to trigger a specific playbook (an Azure Logic App) when a high-severity ransomware incident is created, organizations can execute predefined, automated response steps. This capability is central to Security Orchestration, Automation, and Response (SOAR), ensuring rapid and consistent handling of critical threats.

Why this answer

Microsoft Sentinel automation rules allow you to define automated responses triggered when incidents are created or updated. By configuring an automation rule with a condition that checks for 'AlertSeverity' equal to 'High' and 'Ransomware' as the related alert, you can invoke a playbook to automatically respond to high-severity ransomware incidents, such as isolating affected machines or blocking indicators of compromise.

Exam trap

Microsoft Sentinel components are often tested: analytics rules for detection, hunting queries for investigation, workbooks for visualization, and automation rules for automated response. Candidates commonly confuse the purpose of each, especially automation rules versus analytics rules.

How to eliminate wrong answers

Option A is wrong because an analytics rule is used to generate alerts from raw data based on detection logic, not to automate responses to already-created incidents. Option B is wrong because a hunting query is a proactive search for threats in historical data, not an automated response mechanism. Option C is wrong because a workbook provides visualizations and dashboards of data, but does not execute any automated actions or responses.

Full explanation →

587

MCQmedium

Your organization uses Microsoft Purview Audit to investigate a security incident. You need to search for activities performed by a specific user over the past 90 days. Which solution should you use?

A.Microsoft Purview Audit (Standard)

B.Microsoft Purview Audit (Premium)

C.Microsoft Defender XDR Advanced Hunting

D.Microsoft Purview eDiscovery (Standard)

AnswerA

Microsoft Purview Audit (Standard) is the appropriate service for general investigations requiring access to audit logs. It provides a default retention period of 90 days for most audited activities, which directly supports the requirement for a 90-day search. This service captures user and admin activities across various Microsoft 365 services, making it the foundational tool for compliance and forensic analysis within that timeframe.

Why this answer

Microsoft Purview Audit (Standard) provides 90-day retention for audit logs, which meets the requirement to search for user activities over the past 90 days. Option B (Audit Premium) offers longer retention but is not necessary for this 90-day search. Option C (Microsoft Defender XDR Advanced Hunting) is used for advanced threat hunting, not for auditing user activities.

Option D (eDiscovery Standard) is designed for legal and compliance searches, not for routine audit log searches.

Full explanation →

588

MCQmedium

You are reviewing a Microsoft Purview DLP policy configuration as shown in the exhibit. What is the expected behavior when a user sends an email containing a credit card number to an external recipient?

A.The email is delivered, but the user receives a warning.

B.The email is delivered, and the user is asked to provide a business justification.

C.The email is blocked, but only if the recipient is external and internal recipients are allowed.

D.The email is blocked, and the user receives a policy tip notification.

AnswerD

When a Microsoft Purview DLP policy is configured to block the sharing of sensitive information, the system actively prevents the email from being sent or delivered. Simultaneously, a policy tip notification is displayed to the sender within their email client or application. This notification informs the user about the policy violation, explains why the action was taken, and often provides guidance on how to resolve the issue, ensuring immediate feedback and education.

Why this answer

The DLP policy is configured to block external sharing when credit card numbers are detected. When a user sends an email with a credit card number to an external recipient, the email is blocked and the user receives a policy tip notification. Option A is incorrect because the email is not delivered.

Option B is incorrect because the email is blocked, not delivered with a justification prompt. Option C is incorrect because the policy blocks external recipients regardless of internal allowance.

Full explanation →

589

MCQeasy

Your organization wants to protect against phishing attacks by verifying the sender's identity for incoming emails. Which Microsoft Defender for Office 365 feature should you configure?

A.Anti-malware policy

B.Safe Links policy

C.Anti-phishing policy with SPF/DKIM/DMARC settings

D.Safe Attachments policy

AnswerC

An anti-phishing policy, especially when configured with SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance) settings, is specifically designed to combat phishing attacks. These authentication mechanisms verify the sender's identity and domain legitimacy, preventing spoofed emails and impersonation attempts from reaching recipients. This comprehensive approach directly addresses the core techniques used in phishing by ensuring email authenticity and enforcing policies on unauthenticated messages.

Why this answer

The anti-phishing policy in Microsoft Defender for Office 365 includes sender verification settings that leverage SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance). These protocols authenticate the sender's domain and verify that the email originated from an authorized server, directly addressing the requirement to protect against phishing by verifying sender identity.

Exam trap

The trap here is that candidates often confuse anti-phishing policies with Safe Links or Safe Attachments, assuming that link scanning or attachment sandboxing is the primary defense against phishing, when in fact sender verification via SPF/DKIM/DMARC is the foundational protection against identity spoofing in phishing attacks.

How to eliminate wrong answers

Option A is wrong because anti-malware policy is designed to detect and block malicious attachments or links in email, not to verify the sender's identity via email authentication protocols. Option B is wrong because Safe Links policy provides time-of-click protection by scanning URLs in emails and Office documents, but it does not authenticate the sender's domain or verify the email's origin. Option D is wrong because Safe Attachments policy uses detonation in a sandbox to analyze email attachments for malware, but it does not perform sender authentication checks like SPF, DKIM, or DMARC.

Full explanation →

590

MCQhard

A large enterprise uses a variety of cloud applications, including sanctioned apps like Microsoft 365 and unsanctioned apps that employees adopted without IT approval. The security team wants to discover all cloud applications in use, assess each app's risk score based on more than 80 risk factors, and control data sharing within sanctioned apps to prevent data leakage. Additionally, they need to identify which users are using a new, unknown file-sharing service. Which Microsoft security solution should be deployed to meet these requirements?

A.Microsoft Defender for Cloud

B.Microsoft Defender for Cloud Apps

C.Microsoft Defender for Endpoint

D.Microsoft Purview Data Loss Prevention (DLP)

AnswerB

Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security or MCAS) functions as a Cloud Access Security Broker (CASB). It provides comprehensive visibility into cloud applications, both sanctioned and unsanctioned (shadow IT), across an organization's network. By leveraging traffic logs from firewalls and proxies, it discovers all cloud apps, assesses their risk based on over 80 factors, and enables granular control over data and user activities within sanctioned applications to enforce security policies and prevent data leakage. This makes it ideal for managing the security posture of cloud app usage.

Why this answer

Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) is a Cloud Access Security Broker (CASB) that provides visibility into both sanctioned and unsanctioned cloud apps through its Cloud Discovery feature. It assesses risk scores based on over 80 risk factors (e.g., encryption standards, data residency, and compliance certifications) and enables data sharing controls via session policies (e.g., Conditional Access App Control) to prevent data leakage. It also supports anomaly detection to identify users of new, unknown file-sharing services by analyzing traffic logs from network appliances or endpoints.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM tool for Azure) with Microsoft Defender for Cloud Apps (a CASB), or they assume that Purview DLP alone can discover and risk-assess unsanctioned apps, when in fact DLP only controls data after the app is already identified and integrated.

Why the other options are wrong

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and workload protection solution, not designed to discover cloud apps, assess risk scores, or control data sharing across sanctioned and unsanctioned apps. It focuses on securing cloud infrastructure (e.g., VMs, databases) rather than SaaS application governance.

Microsoft Defender for Endpoint focuses on endpoint protection (antivirus, EDR) and does not provide cloud app discovery, risk assessment, or control over data sharing in cloud applications like Microsoft 365.

Microsoft Purview Data Loss Prevention (DLP) focuses on preventing data leakage by enforcing policies on sensitive data, but it does not discover cloud applications, assess risk scores, or identify users of unsanctioned apps. The question requires cloud app discovery and risk assessment, which are capabilities of Defender for Cloud Apps, not DLP.

When would these options actually be correct?

A question asking for a solution to assess and improve the security posture of Azure resources (e.g., virtual machines, storage accounts) by identifying misconfigurations, enabling compliance standards, and providing threat detection for cloud workloads. For example: 'Which Microsoft solution should be used to continuously monitor and improve the security of Azure VMs and storage accounts?'

An exam question asking for a solution to detect and respond to advanced threats on endpoints (e.g., malware, ransomware) and investigate compromised devices would make Defender for Endpoint the correct answer.

Microsoft Purview DLP would be correct in a scenario where an organization needs to prevent accidental sharing of sensitive data (e.g., credit card numbers or PII) across sanctioned apps like Microsoft 365 and endpoints, without requiring cloud app discovery or risk scoring. For example: 'A company wants to block emails containing social security numbers from being sent externally.'

Why candidates pick the wrong answer

The name 'Defender for Cloud' suggests it covers all cloud security needs, leading candidates to assume it includes app discovery and risk assessment. The lack of familiarity with the specific capabilities of Microsoft Defender for Cloud Apps (formerly Cloud App Security) causes confusion.

Candidates may confuse Defender for Endpoint with Defender for Cloud Apps because both have 'Defender' in the name and relate to security, but they serve different domains (endpoints vs. cloud apps).

Candidates may confuse DLP's data protection capabilities with the broader cloud app security requirements, especially since the question mentions controlling data sharing within sanctioned apps, which is a DLP function. However, they overlook that the primary need is discovery and risk assessment, which DLP does not provide.

Full explanation →

591

MCQmedium

Refer to the exhibit. The JSON snippet shows an app registration in Microsoft Entra ID. The password credential endDateTime is set to 2025-12-31. What will happen when that date is reached?

A.The secret will renew automatically.

B.The app will be unable to authenticate using that secret.

C.The app registration will be automatically deleted.

D.The app will be blocked from signing in.

AnswerB

When an application's client secret reaches its expiration date, it becomes invalid and can no longer be used to authenticate with Azure Active Directory. Any attempt by the application to acquire an access token using this expired secret will result in an authentication failure. This prevents the application from accessing protected resources or performing actions on behalf of itself.

Why this answer

When the password credential (client secret) reaches its endDateTime, the secret expires and becomes invalid. Microsoft Entra ID does not automatically renew secrets; the application must use a valid secret to authenticate. Once expired, any authentication attempt using that secret will fail, preventing the app from obtaining tokens.

Exam trap

The trap here is that candidates may assume secrets auto-renew or that the app registration is deleted, but Microsoft Entra ID treats secrets as static credentials that must be manually managed before expiration.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID does not automatically renew client secrets; the secret must be manually rotated or renewed by an administrator or via automation. Option C is wrong because an expired secret does not trigger deletion of the app registration; the registration remains intact and can be updated with a new secret. Option D is wrong because the app itself is not blocked from signing in; only the specific expired secret becomes invalid, and the app can still authenticate using a different valid secret or certificate.

Full explanation →

592

MCQeasy

You are a security administrator for a company using Microsoft Entra ID P2. The company has a critical application that should only be accessible by a specific group of users (the 'Finance' group). You need to ensure that any access to this application is automatically logged and that an administrator is notified when a user outside the Finance group attempts to access it. Additionally, the CEO wants a quarterly review of all users who have access to this application. Which combination of features should you use?

A.Grant access to the application via B2B collaboration and configure auditing.

B.Use Identity Protection to detect access attempts from non-Finance users and send alerts.

C.Assign the application to the Finance group using Privileged Identity Management, and enable sign-in logs.

D.Create a Conditional Access policy that restricts access to the Finance group, configure audit logging for the application, and set up an access review for the Finance group.

AnswerD

Conditional Access enforces access restriction, audit logs capture activity, and access reviews provide periodic recertification.

Why this answer

It combines Conditional Access to restrict access to the Finance group, audit logging to log access attempts (and trigger alerts), and access reviews for quarterly recertification. Option A is wrong because B2B collaboration is for external users, not for internal group-based access control. Option B is wrong because Identity Protection is for risk detection, not for group-based access restrictions.

Option C is wrong because Privileged Identity Management (PIM) is for managing privileged roles, not for assigning application access to standard user groups.

Full explanation →

593

Multi-Selecteasy

Which THREE are features of Microsoft Entra ID Protection? (Choose THREE.)

Select 3 answers

A.Privileged role management

B.Sign-in risk detection

C.Detection of leaked credentials

D.Risk-based conditional access

E.Identity governance

AnswersB, C, D

Identity Protection detects risky sign-ins such as from anonymous IP addresses.

Why this answer

Sign-in risk detection is a core feature of Microsoft Entra ID Protection. It uses real-time and offline machine learning models to evaluate each sign-in attempt for anomalies such as impossible travel, anonymous IP addresses, or atypical locations, assigning a risk level (low, medium, high). This allows organizations to automatically respond to suspicious sign-ins before compromise occurs.

Exam trap

The trap here is that candidates often confuse Entra ID Protection (focused on risk detection and remediation) with Entra ID Governance (focused on identity lifecycle and access controls), leading them to select Privileged role management or Identity governance as features of ID Protection.

Full explanation →

594

MCQmedium

A company uses Microsoft 365 and requires that users access corporate email and SharePoint from managed devices that meet security policy requirements, such as having encryption enabled and antivirus software running. The security team wants to enforce this access control within Microsoft Entra ID so that unmanaged devices are blocked. Which Microsoft Entra ID feature should they configure?

A.Identity Protection

B.Conditional Access

C.Access Reviews

D.Privileged Identity Management

AnswerB

Conditional Access policies in Azure AD evaluate various signals, including user, location, application, and device state, at the time of a sign-in attempt. These policies can specifically enforce requirements such as a device being marked as compliant by Microsoft Intune or being hybrid Azure AD joined, before granting access to Microsoft 365 cloud applications like Exchange Online or SharePoint Online. This directly addresses the need to control access based on specific device compliance criteria.

Why this answer

Conditional Access is the Microsoft Entra ID feature that enforces access control policies based on conditions such as device compliance, location, and user risk. By configuring a policy that requires devices to be marked as compliant (e.g., with encryption enabled and antivirus running) and blocking access from unmanaged devices, the security team can meet the stated requirement. This is the correct choice because Conditional Access directly integrates with Microsoft Intune device compliance policies to evaluate device health before granting access to corporate email and SharePoint.

Exam trap

The trap here is that candidates often confuse Identity Protection (which handles risk-based signals like leaked credentials) with Conditional Access (which enforces broader policies including device compliance), leading them to select A instead of B.

Why the other options are wrong

Identity Protection is used to detect and respond to identity-based risks (e.g., leaked credentials, sign-in anomalies), not to enforce device compliance or block unmanaged devices from accessing resources.

Access Reviews are used to audit and recertify user access rights, not to enforce real-time device compliance policies. The question requires blocking unmanaged devices at sign-in, which is a Conditional Access policy action.

When would these options actually be correct?

An organization wants to automatically detect and block sign-ins from compromised accounts or risky sessions, such as when a user's credentials appear on the dark web or when sign-ins originate from anonymous IP addresses.

A company needs to periodically verify that users still require access to sensitive SharePoint sites and remove stale accounts. The security team wants to automate this recertification process within Microsoft Entra ID.

Why candidates pick the wrong answer

Candidates may confuse 'protecting identities' with 'controlling access based on device health,' assuming Identity Protection handles all security policies for user access.

Candidates may confuse 'access control' with 'access reviews' because both involve managing permissions, but they serve different purposes: enforcement vs. attestation.

Full explanation →

595

MCQmedium

A legal team is managing a large litigation case involving over two million documents in SharePoint Online and Exchange Online. They want to reduce the time required for manual review by using a machine learning model that learns from a seed set of relevant and non-relevant documents and then predicts the relevance of the remaining documents. Which Microsoft Purview solution provides this advanced analytical capability?

A.Communication Compliance

B.eDiscovery (Standard)

C.eDiscovery (Premium)

D.Audit (Premium)

AnswerC

eDiscovery (Premium) is specifically designed to manage large-scale, complex litigation and regulatory investigations by offering an end-to-end workflow within Microsoft Purview. It extends beyond Standard capabilities with advanced features like custodian management, legal hold orchestration, and collection from non-Microsoft 365 sources. Crucially, it incorporates machine learning-driven analytics, including predictive coding (TAR), near-duplicate detection, and email threading, which significantly streamline the review process, reduce data volumes, and lower legal costs for extensive document sets.

Why this answer

eDiscovery (Premium) in Microsoft Purview provides advanced analytics capabilities, including predictive coding, which uses machine learning models trained on a seed set of relevant and non-relevant documents to automatically predict the relevance of the remaining content. This directly addresses the legal team's need to reduce manual review time for over two million documents in SharePoint Online and Exchange Online.

Exam trap

The trap here is that candidates often confuse eDiscovery (Standard) with eDiscovery (Premium) because both involve searching and holding content, but only Premium includes the advanced analytics and machine learning capabilities described in the scenario.

Why the other options are wrong

Communication Compliance is designed to detect and manage inappropriate communications (e.g., harassment, insider trading), not to perform machine learning-based relevance prediction on documents for eDiscovery review.

Audit (Premium) provides advanced auditing capabilities such as long-term retention and high-bandwidth access to audit logs, but it does not include machine learning models for predictive relevance scoring of documents in eDiscovery.

When would these options actually be correct?

A question asks: 'Which Microsoft Purview solution helps an organization detect and take action on inappropriate messages (e.g., offensive language or sensitive info sharing) in Microsoft Teams and Exchange Online?'

A question asks: 'Which Microsoft Purview solution provides extended audit log retention (e.g., 1 year or 10 years) and higher API bandwidth for retrieving audit records?' In that context, Audit (Premium) would be the correct answer.

Why candidates pick the wrong answer

Candidates may confuse the 'machine learning' aspect of Communication Compliance (which uses ML to detect policy violations) with the predictive coding ML in eDiscovery (Premium), assuming any ML-based tool can handle document relevance prediction.

Candidates may confuse 'Premium' with advanced analytics, assuming that Audit (Premium) includes machine learning capabilities, when in fact the 'Premium' in eDiscovery (Premium) specifically refers to the advanced analytics features like predictive coding.

Full explanation →

596

MCQmedium

Your company uses Microsoft Entra ID. You need to ensure that when a user's account is compromised and used to send spam, the account is automatically blocked from signing in. Which feature should you configure?

A.Microsoft Entra Conditional Access policy to block sign-ins from high-risk users

B.Microsoft Entra Privileged Identity Management

C.Microsoft Entra Identity Protection with a user risk policy to block high-risk users

D.Microsoft Entra Self-Service Password Reset

AnswerC

Microsoft Entra Identity Protection is the dedicated service for detecting, investigating, and remediating identity-based risks. A user risk policy within Identity Protection continuously monitors for suspicious activities, such as leaked credentials or impossible travel, to calculate a user's aggregate risk level. When this risk level crosses a configured threshold, the policy can be set to automatically block the user's sign-in attempt, directly fulfilling the requirement to prevent high-risk users from accessing resources.

Why this answer

Microsoft Entra Identity Protection uses machine learning to detect user risk, such as when an account is compromised and used to send spam. A user risk policy can be configured to automatically block sign-ins for high-risk users, directly addressing the requirement to block the compromised account from signing in.

Exam trap

The trap here is that candidates often confuse Conditional Access policies with Identity Protection user risk policies, but the question specifically asks for the feature that automatically blocks based on compromise (spam), which is the user risk policy in Identity Protection, not a general Conditional Access policy.

How to eliminate wrong answers

Option A is wrong because a Conditional Access policy can block sign-ins based on risk, but it requires a license (e.g., P2) and is typically used in conjunction with Identity Protection; however, the question specifically asks for the feature that automatically blocks based on compromise (spam), which is directly the user risk policy in Identity Protection. Option B is wrong because Privileged Identity Management (PIM) manages just-in-time access and approval workflows for privileged roles, not automatic blocking of compromised accounts. Option D is wrong because Self-Service Password Reset (SSPR) allows users to reset their own passwords, but it does not automatically block sign-ins when an account is compromised.

Full explanation →

597

MCQeasy

A company wants to ensure that only users with specific IP addresses can access its critical applications. Which Microsoft Entra feature should they configure?

A.Identity Protection

B.Privileged Identity Management

C.Conditional Access

D.Self-Service Password Reset

AnswerC

Azure AD Conditional Access serves as the policy engine for enforcing access controls based on specific conditions, making it the correct solution for IP-based restrictions. Administrators can define 'named locations' using public IP address ranges or country/region lists, then create policies that grant or block access if users are signing in from these specified locations. This allows precise control over who can access resources from particular network segments, directly addressing the company's requirement for IP-specific access.

Why this answer

Conditional Access is the correct feature because it allows administrators to create policies that enforce access controls based on conditions such as IP address location. By configuring a Conditional Access policy with a 'Locations' condition that includes only trusted IP address ranges, the company can block or grant access to critical applications based on the user's network location. This directly meets the requirement to restrict access to specific IP addresses.

Exam trap

The trap here is that candidates often confuse Identity Protection's risk-based conditional access (which uses IP reputation) with the explicit IP address location control provided by Conditional Access policies, leading them to select Identity Protection instead.

How to eliminate wrong answers

Option A is wrong because Identity Protection is designed to detect and respond to identity-based risks (e.g., leaked credentials, sign-ins from anonymous IPs) but does not provide granular IP address-based access control policies. Option B is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role activation and approval workflows, not network-level access restrictions based on IP addresses. Option D is wrong because Self-Service Password Reset (SSPR) allows users to reset their own passwords without administrator intervention, and it has no capability to restrict application access by IP address.

Full explanation →

598

MCQeasy

Your organization has deployed Microsoft Intune for mobile device management. You need to ensure that users can only access corporate resources from devices that are compliant with your security policies. Which policy type should you configure?

A.A Conditional Access policy

B.An app protection policy

C.A compliance policy

D.A configuration policy

AnswerA

Conditional Access policies can block or grant access based on device compliance status from Intune.

Why this answer

A Conditional Access policy is the correct choice because it enforces access controls at the identity level, evaluating device compliance status before granting access to corporate resources. When combined with Intune compliance policies, Conditional Access can block or allow access based on real-time device health checks, ensuring only compliant devices can connect.

Exam trap

The trap here is confusing the role of a compliance policy (which only assesses and reports device status) with a Conditional Access policy (which enforces the access decision based on that status), leading candidates to incorrectly select compliance policy as the enforcement mechanism.

How to eliminate wrong answers

Option B is wrong because an app protection policy manages how data is handled within applications (e.g., preventing copy/paste or requiring a PIN) but does not control device-level access to corporate resources. Option C is wrong because a compliance policy defines the security requirements a device must meet (e.g., encryption, OS version) but does not enforce access decisions; it only marks the device as compliant or non-compliant. Option D is wrong because a configuration policy pushes settings to devices (e.g., Wi-Fi profiles, email settings) but does not evaluate or enforce access restrictions based on compliance.

Full explanation →

599

MCQhard

Your organization uses Microsoft Purview Communication Compliance to detect harassing messages. You receive an alert for a message that appears to be a joke between colleagues. What should you do to prevent similar false positives?

A.Train users not to joke about sensitive topics

B.Delete the alert and ignore future similar messages

C.Refine the policy conditions to exclude certain keywords or users

D.Turn off the policy and use a different solution

AnswerC

Refining the policy conditions within Microsoft Purview Communication Compliance is the most effective and technically sound solution to reduce false positives while preserving the policy's intended protective scope. This involves precisely adjusting keywords, phrases, dictionaries, or even excluding specific users or groups known to generate benign matches, thereby ensuring the policy accurately targets genuine compliance risks without generating unnecessary alerts and administrative overhead.

Why this answer

Microsoft Purview Communication Compliance policies are configurable to reduce false positives. You can refine the policy by adding conditions to exclude specific keywords (e.g., 'joke' or 'just kidding') or specific users (e.g., known colleagues) from triggering alerts, without disabling the policy or relying on user behavior changes.

Exam trap

The trap here is that candidates may choose Option A (training users) because it seems proactive, but the question specifically asks how to prevent false positives in the detection system, which requires policy refinement, not user behavior change.

How to eliminate wrong answers

Option A is wrong because training users does not prevent false positives in the detection system; it only addresses human behavior, not the policy's configuration. Option B is wrong because deleting alerts and ignoring future similar messages bypasses compliance monitoring and violates audit requirements; alerts must be investigated or the policy adjusted. Option D is wrong because turning off the policy removes the compliance control entirely, which is unnecessary when the policy can be refined to exclude benign content.

Full explanation →

600

MCQmedium

Your organization uses Microsoft Entra ID with P2 licenses. You need to review and approve role activations for the Global Administrator role on a weekly basis. Which feature should you use?

A.Microsoft Entra Identity Protection

B.Microsoft Entra Conditional Access

C.Microsoft Entra Privileged Identity Management (PIM)

D.Microsoft Entra Access Reviews

AnswerC

Microsoft Entra Privileged Identity Management (PIM) is the correct solution for managing, controlling, and monitoring access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. It enables just-in-time (JIT) access, allowing users to activate privileged roles for a limited, predefined time, significantly reducing the exposure window of high-privilege accounts. PIM also integrates approval workflows, multi-factor authentication requirements for activation, and comprehensive audit trails, ensuring that elevated permissions are granted only when necessary and are fully accountable.

Why this answer

Microsoft Entra Privileged Identity Management (PIM) allows you to manage, control, and monitor access to important resources in your organization, including the ability to review and approve role activations for privileged roles like Global Administrator. Option A is wrong because Identity Protection is for detecting risks and vulnerabilities. Option B is wrong because Conditional Access controls access based on conditions, not role activation approval.

Option D is wrong because Access Reviews are for reviewing and recertifying access assignments, but not specifically for approving activations in real-time.

Full explanation →

Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 526–600