CCNA Describe the capabilities of Microsoft security solutions Questions — Page 4 of 6

226

MCQmedium

A security operations team uses multiple Microsoft security products, including Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Entra ID Protection. They want to aggregate alerts from these sources into a single dashboard, correlate them to create incidents, and use automated playbooks to respond to threats. The team also wants to query historical security data for threat hunting. Which Microsoft solution should they deploy?

A.Microsoft Sentinel

B.Microsoft 365 Defender portal

C.Microsoft Defender for Cloud

D.Azure Monitor

AnswerA

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It centralizes security data from various sources, including Microsoft 365 Defender, Azure AD Identity Protection, and other Microsoft security services, enabling comprehensive threat detection and incident response. Sentinel correlates alerts, creates actionable incidents, and facilitates automated remediation through playbooks, making it ideal for a security operations team managing multiple security products. Its powerful Kusto Query Language (KQL) also supports advanced threat hunting.

Why this answer

Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution that ingests alerts from multiple sources, including Microsoft Defender for Endpoint, Defender for Office 365, and Entra ID Protection, into a single dashboard. It correlates these alerts into incidents using analytics rules and supports automated playbooks via Azure Logic Apps. Additionally, Sentinel provides a Kusto Query Language (KQL)-based workspace for querying historical security data, enabling threat hunting.

Exam trap

The trap here is that candidates often confuse the Microsoft 365 Defender portal (which does unify alerts and incidents from Defender products) with a full SIEM/SOAR solution, overlooking that it lacks native automated playbook orchestration and long-term historical data querying for threat hunting, which are core to Microsoft Sentinel.

Why the other options are wrong

The Microsoft 365 Defender portal provides a unified view of alerts from Defender for Endpoint, Defender for Office 365, and Entra ID Protection, but it does not support custom querying of historical security data for threat hunting or advanced automation with playbooks beyond its built-in capabilities.

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) focused on securing cloud resources, not a SIEM/SOAR solution. It does not aggregate alerts from Defender for Endpoint, Office 365, and Entra ID Protection into a single dashboard with incident correlation and automated playbooks.

Azure Monitor is primarily for monitoring infrastructure performance and logs, not for aggregating security alerts from multiple Microsoft security products, correlating them into incidents, or running automated security playbooks. It lacks native SIEM and SOAR capabilities for security operations.

Practice this question →

227

Multi-Selecthard

Which TWO capabilities are provided by Microsoft Defender for Cloud? (Choose two.)

Select 2 answers

A.Secure score and security recommendations

B.Endpoint detection and response (EDR)

C.Vulnerability assessment for VMs

D.Cloud Access Security Broker (CASB)

E.Security Information and Event Management (SIEM)

AnswersA, C

Core features for posture management.

Why this answer

Microsoft Defender for Cloud provides a secure score that quantifies your security posture based on implemented controls, and it generates actionable security recommendations to remediate misconfigurations. Additionally, it offers vulnerability assessment for VMs, which identifies and helps remediate vulnerabilities in virtual machines. These are two distinct core capabilities of Defender for Cloud, while EDR, CASB, and SIEM are provided by other Microsoft security products.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud with other Microsoft security products like Defender for Endpoint (EDR), Defender for Cloud Apps (CASB), or Microsoft Sentinel (SIEM), because all are part of the Microsoft Security portfolio and often work together, but each has distinct primary capabilities.

Practice this question →

228

MCQmedium

A company uses Microsoft Defender for Endpoint to secure its devices, Microsoft Defender for Office 365 for email security, and Microsoft Defender for Identity for on-premises Active Directory. The security team wants a single console to view correlated incidents across these domains, where an incident might combine a suspicious email, a malicious file download, and a compromised account. Which Microsoft solution provides this unified incident view and automatic correlation?

A.Microsoft Sentinel

B.Microsoft Defender for Cloud

C.Microsoft 365 Defender (now Microsoft Defender XDR)

D.Microsoft Purview Compliance Portal

AnswerC

Microsoft Defender XDR (formerly Microsoft 365 Defender) is a unified pre- and post-breach enterprise defense suite that natively integrates and orchestrates detection, investigation, and response. It automatically correlates alerts and signals from its constituent services—Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps—into cohesive incidents. This comprehensive integration provides a holistic view of attacks and streamlines the security operations center (SOC) workflow from a single, centralized portal.

Why this answer

Microsoft 365 Defender (now Microsoft Defender XDR) is the correct answer because it provides a unified incident view across Microsoft Defender for Endpoint, Defender for Office 365, and Defender for Identity. It automatically correlates alerts from these domains—such as a suspicious email, a malicious file download, and a compromised account—into a single incident, enabling security teams to investigate and respond from one console.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel (a SIEM) with Microsoft 365 Defender (an XDR), mistakenly thinking Sentinel provides the same out-of-the-box cross-domain correlation, when in fact Sentinel requires manual configuration and is not the single console for native Defender product integration.

How to eliminate wrong answers

Option A is wrong because Microsoft Sentinel is a cloud-native SIEM/SOAR platform that ingests logs from multiple sources, but it does not natively provide the automatic, built-in correlation across Defender for Endpoint, Office 365, and Identity; it requires custom analytics rules and data connectors to achieve similar correlation. Option B is wrong because Microsoft Defender for Cloud is focused on securing cloud workloads (IaaS, PaaS, and data services) and does not integrate email security or on-premises Active Directory signals into a unified incident view. Option D is wrong because Microsoft Purview Compliance Portal is designed for data governance, compliance, and risk management (e.g., data loss prevention, eDiscovery), not for security incident correlation across endpoint, email, and identity domains.

Practice this question →

229

MCQmedium

Your company uses Microsoft Sentinel to manage security incidents. You need to automatically assign incidents to a specific analyst team based on the incident category (e.g., phishing incidents to the SOC team). What should you configure?

A.Create a watchlist mapping categories to teams and use it in analytics rules

B.Automation rule with a condition on incident category and an action to assign to the SOC team

C.Configure the analytics rule to set the incident owner in the rule query

D.Playbook triggered by incident creation that assigns the incident

AnswerB

Automation rules are the primary mechanism in Microsoft Sentinel for automatically managing incidents upon creation or update. By configuring an automation rule with a condition that matches the incident's category, it can directly execute an action to assign the incident to a specific owner or team, such as the SOC team, without requiring additional components or manual intervention. This provides an efficient and immediate way to route incidents.

Why this answer

Automation rules in Microsoft Sentinel allow you to define conditions based on incident properties (like category) and automatically take actions such as assigning the incident to a specific team. This is the correct and most efficient method for routing incidents by category without requiring custom code or external playbooks.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing a playbook (Option D) because they think automation rules cannot handle assignment, but Sentinel automation rules natively support the 'Assign incident' action without needing Logic Apps.

How to eliminate wrong answers

Option A is wrong because watchlists are used for correlating data or enriching alerts, not for triggering automated assignment actions based on incident categories. Option C is wrong because analytics rule queries generate alerts but cannot directly set the incident owner; ownership is managed at the incident level after creation. Option D is wrong because while a playbook triggered by incident creation could assign the incident, it is an over-engineered solution compared to the simpler, built-in automation rule, and playbooks require additional configuration and logic apps.

Practice this question →

230

MCQmedium

A security team wants to receive a unified security posture assessment for their hybrid workloads including Azure VMs, on-premises SQL servers, and AWS EC2 instances. They need to get actionable recommendations to harden configurations and improve their overall security score. Which Microsoft security solution provides this capability?

A.Microsoft Defender for Cloud

B.Microsoft Defender for Endpoint

C.Microsoft Sentinel

D.Microsoft Defender for Cloud Apps

AnswerA

Microsoft Defender for Cloud is the correct solution as it provides Cloud Security Posture Management (CSPM) capabilities across Azure, AWS, GCP, and on-premises environments. It continuously assesses the security configuration of resources, identifies misconfigurations, and offers actionable recommendations to improve security posture. This results in a unified secure score, giving security teams a consolidated view of their overall security health and compliance across their entire hybrid and multi-cloud estate.

Why this answer

Microsoft Defender for Cloud provides a unified security posture assessment across hybrid and multi-cloud workloads, including Azure VMs, on-premises SQL servers, and AWS EC2 instances. It continuously assesses configurations against security baselines (e.g., Azure Security Benchmark, CIS controls) and generates a secure score with actionable recommendations to harden resources. This aligns directly with the requirement for a single dashboard covering all listed workload types.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud (a posture management and CSPM tool) with Microsoft Sentinel (a SIEM), because both can ingest multi-cloud data, but only Defender for Cloud provides the unified secure score and actionable hardening recommendations for hybrid workloads.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for devices (e.g., workstations, servers) against threats like malware and ransomware, not on unified posture assessment or secure score for hybrid workloads. Option C is wrong because Microsoft Sentinel is a cloud-native SIEM/SOAR for threat detection, investigation, and response across logs and alerts, not a posture assessment tool for configuration hardening. Option D is wrong because Microsoft Defender for Cloud Apps is a CASB for shadow IT discovery, app permissions, and data protection in SaaS applications, not for assessing the security posture of VMs, SQL servers, or EC2 instances.

Practice this question →

231

MCQeasy

Your company uses Microsoft Defender XDR. You need to integrate threat intelligence from external sources to enrich alerts and automate response actions. Which feature should you use?

A.Automation rules

B.Threat analytics

C.Advanced hunting

D.Threat intelligence integration

AnswerD

Threat intelligence integration in Microsoft Defender XDR allows organizations to import custom indicators of compromise (IOCs) and threat intelligence feeds from various external sources. This capability enables security teams to enrich their existing alerts, detections, and investigations with context from third-party or proprietary threat intelligence platforms. By integrating external TI, Defender XDR can automatically correlate incoming security events against these custom indicators, significantly enhancing detection capabilities and providing more comprehensive insights into potential threats.

Why this answer

Microsoft Defender XDR's threat intelligence integration (option D) allows you to import custom threat indicators (IOCs) from external sources—such as STIX/TAXII feeds, APIs, or manual uploads—into the Microsoft 365 Defender platform. These indicators are then used to enrich alerts, trigger automated response actions via custom detection rules, and correlate with telemetry across endpoints, email, and identities. This directly meets the requirement to integrate external threat intelligence for enrichment and automation.

Exam trap

The trap here is that candidates confuse 'threat intelligence integration' with 'threat analytics' (option B), assuming both provide external threat data, but threat analytics only surfaces Microsoft's pre-analyzed reports, not custom external feeds.

How to eliminate wrong answers

Option A is wrong because automation rules in Microsoft Defender XDR are used to define automated actions (e.g., isolate a device, block a file) based on alert triggers, but they do not import or integrate external threat intelligence sources. Option B is wrong because threat analytics is a built-in feature that provides curated threat intelligence reports and insights from Microsoft's own research, not a mechanism to integrate custom external threat feeds. Option C is wrong because advanced hunting is a query-based tool for proactively searching raw telemetry data using Kusto Query Language (KQL), not a feature for importing external threat intelligence or automating responses based on it.

Practice this question →

232

MCQhard

An organization uses Microsoft Intune to manage devices. They need to ensure that only devices with a compliant antivirus solution can access corporate email. Which policy type should be configured?

A.App protection policy in Microsoft 365

B.Conditional Access policy in Microsoft Entra ID

C.Device compliance policy in Intune

D.Security baseline in Microsoft Defender for Cloud

AnswerB

Conditional Access policies in Microsoft Entra ID serve as the enforcement mechanism, evaluating conditions before granting access to cloud applications and resources. These policies can be configured to mandate that a device be marked as "compliant" by Microsoft Intune. This compliance status, in turn, is determined by Intune device compliance policies, which can include specific requirements for antivirus software being enabled and up-to-date. Consequently, Conditional Access acts as the critical gatekeeper, blocking access if the device's antivirus status, as reported by Intune, fails to meet the defined organizational compliance standards.

Why this answer

Conditional Access policies in Microsoft Entra ID evaluate signals such as device compliance status before granting access to cloud apps like corporate email. By integrating with Intune device compliance policies, they can block access from devices that lack a compliant antivirus solution. This is the correct mechanism because Conditional Access enforces the access decision at the authentication layer, not just at the device management layer.

Exam trap

The trap here is that candidates often confuse the role of Intune Device compliance policies (which only mark a device as compliant or non-compliant) with the enforcement mechanism of Conditional Access, assuming the compliance policy alone can block access to corporate resources.

How to eliminate wrong answers

Option A is wrong because App protection policies in Microsoft 365 manage how data is handled within apps (e.g., copy/paste restrictions) and do not evaluate device-level antivirus compliance. Option C is wrong because Device compliance policies in Intune define the compliance criteria (e.g., antivirus status) but do not enforce access to corporate email on their own; they require a Conditional Access policy to block access. Option D is wrong because Security baselines in Microsoft Defender for Cloud provide configuration recommendations for cloud resources, not device-level antivirus compliance enforcement for email access.

Practice this question →

233

MCQhard

A security operations team uses Microsoft 365 Defender and wants to detect, investigate, and automatically respond to advanced identity-based attacks targeting on-premises Active Directory, such as Pass-the-Hash (PtH) and Golden Ticket attacks. They also need to integrate these alerts into Microsoft Sentinel for central incident management. Which Microsoft security solution provides these capabilities?

A.Microsoft Defender for Identity

B.Microsoft Defender for Cloud Apps

C.Microsoft Defender for Endpoint

D.Microsoft Defender for Office 365

AnswerA

Microsoft Defender for Identity is purpose-built to safeguard on-premises Active Directory environments from sophisticated identity-based attacks. It leverages behavioral analytics to detect suspicious activities like Pass-the-Hash, Golden Ticket attacks, and lateral movement attempts across the network. By monitoring domain controllers and AD FS servers, it provides crucial insights into compromised identities and facilitates automated investigation and response within the Microsoft 365 Defender portal.

Why this answer

Microsoft Defender for Identity (MDI) is the correct answer because it is specifically designed to detect, investigate, and automatically respond to advanced identity-based attacks targeting on-premises Active Directory, including Pass-the-Hash (PtH) and Golden Ticket attacks. It uses behavioral analytics and machine learning to identify suspicious activities such as anomalous Kerberos ticket requests and NTLM authentication anomalies. MDI also natively integrates with Microsoft Sentinel, allowing alerts to be ingested for central incident management.

Exam trap

The trap here is that candidates may confuse Microsoft Defender for Identity with Microsoft Defender for Cloud Apps, assuming both handle identity threats, but only MDI specifically targets on-premises Active Directory attacks like PtH and Golden Ticket.

Why the other options are wrong

Microsoft Defender for Cloud Apps focuses on cloud application security, not on-premises Active Directory attacks like Pass-the-Hash or Golden Ticket. It does not provide native detection for these identity-based attacks targeting on-prem AD.

Microsoft Defender for Office 365 focuses on email and collaboration threats (phishing, malware in attachments/links), not on-premises Active Directory attacks like Pass-the-Hash or Golden Ticket. It does not provide identity-based attack detection for AD or integrate with Microsoft Sentinel for those alerts.

Practice this question →

234

MCQeasy

Your organization wants to use Microsoft Defender for Cloud to secure Azure virtual machines. Which feature should they enable to get vulnerability assessment without additional agents?

A.File integrity monitoring

B.Just-in-time VM access

C.Adaptive application controls

D.Vulnerability assessment

AnswerD

Microsoft Defender for Cloud's vulnerability assessment capability actively scans virtual machines, SQL databases, and other resources for security weaknesses, misconfigurations, and missing updates. It identifies known vulnerabilities (CVEs) in operating systems and installed applications, providing actionable recommendations to remediate these findings. This feature is crucial for maintaining a strong security posture by proactively discovering and addressing potential entry points for attackers, often leveraging integrated solutions like Qualys or Microsoft Defender for Endpoint's TVM.

Why this answer

Microsoft Defender for Cloud includes a built-in vulnerability assessment solution for Azure virtual machines that does not require any additional agents. When enabled, it uses the Qualys scanner integrated directly into the platform to continuously scan for vulnerabilities, providing findings without the need to deploy or manage separate agents on the VMs.

Exam trap

The trap here is that candidates may confuse 'vulnerability assessment' with other security controls like file integrity monitoring or adaptive application controls, not realizing that Defender for Cloud offers a dedicated, agentless vulnerability scanning capability specifically for VMs.

How to eliminate wrong answers

Option A is wrong because File integrity monitoring (FIM) tracks changes to critical files, registries, and system settings, not vulnerability scanning. Option B is wrong because Just-in-time (JIT) VM access reduces the attack surface by controlling network access to VMs, not by assessing vulnerabilities. Option C is wrong because Adaptive application controls create allowlists for running applications to prevent malware, not to scan for software vulnerabilities.

Practice this question →

235

MCQmedium

A company uses Microsoft 365 and wants to deploy a security solution that can automatically detect and remediate advanced attacks on endpoints (workstations and servers), such as ransomware and fileless attacks. They also want to provide incident response teams with detailed forensic data and the ability to isolate an infected machine from the network. Which Microsoft security solution should they use?

A.Microsoft Defender for Office 365

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Identity

D.Microsoft Defender for Cloud Apps

AnswerB

Microsoft Defender for Endpoint is a comprehensive enterprise endpoint security platform designed to protect devices from advanced threats. It offers Endpoint Detection and Response (EDR) capabilities, next-generation protection, attack surface reduction, and automated investigation and remediation. This solution actively monitors endpoints for malicious activity, isolates compromised devices, and provides a unified view of security incidents across an organization's device fleet, making it ideal for endpoint deployment.

Why this answer

Microsoft Defender for Endpoint (MDE) is the correct solution because it provides endpoint detection and response (EDR) capabilities, including automatic detection and remediation of advanced attacks like ransomware and fileless attacks. It also offers detailed forensic data for incident response and the ability to isolate an infected machine from the network, meeting all the specified requirements.

Exam trap

The trap here is that candidates confuse the endpoint-focused capabilities of Microsoft Defender for Endpoint with the email/identity/cloud-specific scopes of the other Defender products, failing to recognize that only MDE provides automated endpoint remediation and network isolation for workstations and servers.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Office 365 focuses on protecting email, SharePoint, and Teams from threats like phishing and malware, not on endpoint-level attacks or machine isolation. Option C is wrong because Microsoft Defender for Identity monitors on-premises Active Directory and cloud identities for compromised credentials and lateral movement, but does not provide endpoint detection, forensic data, or network isolation for workstations and servers. Option D is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that governs and protects cloud applications, not endpoints; it cannot detect fileless attacks on workstations or isolate machines from the network.

Practice this question →

236

Multi-Selecthard

Which THREE Microsoft Purview solutions help protect sensitive data in Microsoft 365? (Choose three.)

Select 3 answers

A.Data Loss Prevention

B.Information Protection (sensitivity labels)

C.Insider Risk Management

D.Audit

E.eDiscovery

AnswersA, B, C

Microsoft Purview Data Loss Prevention (DLP) actively identifies, monitors, and protects sensitive information across endpoints, cloud applications, and on-premises repositories. It enforces policies to prevent the unauthorized sharing, transfer, or exfiltration of sensitive data, whether accidental or malicious, by detecting specific content and context and blocking or auditing the action. This proactive approach is fundamental to safeguarding an organization's critical information assets.

Why this answer

Data Loss Prevention (DLP) is correct because it identifies, monitors, and automatically protects sensitive data across Exchange Online, SharePoint, OneDrive, and Teams by applying policies that block or warn users when sensitive content (e.g., credit card numbers or PII) is shared inappropriately. It uses deep content analysis, including keyword matches, regex patterns, and machine learning classifiers, to enforce protection actions.

Exam trap

The trap here is that candidates confuse Audit and eDiscovery as protective solutions because they are part of the Microsoft Purview compliance portal, but they are detective and investigative tools, not preventive controls like DLP, Information Protection, or Insider Risk Management.

Practice this question →

237

MCQmedium

Your organization uses Microsoft Sentinel. You need to create an analytics rule that triggers an incident when more than 10 failed sign-ins occur from a single IP address within 5 minutes. Which rule type should you use?

A.Fusion rule

B.Scheduled query rule

C.Near-real-time (NRT) rule

D.ML Behavior Analytics rule

AnswerB

Correct: Scheduled rules allow aggregation (e.g., count>10) over time windows.

Why this answer

A scheduled query rule is correct because it allows you to define a KQL query that counts failed sign-ins per IP address over a 5-minute window and triggers an incident when the count exceeds 10. This rule type supports custom aggregation and threshold-based alerting, which is exactly what the requirement specifies.

Exam trap

The trap here is that candidates confuse NRT rules with scheduled queries, assuming NRT means 'real-time thresholding,' but NRT rules cannot perform multi-minute aggregations and are limited to single-event or simple pattern matching.

How to eliminate wrong answers

Option A is wrong because Fusion rules use machine learning to correlate multiple alerts into a single incident, not to trigger on a simple threshold of failed sign-ins from a single IP. Option C is wrong because Near-real-time (NRT) rules run queries every minute with a 1-minute lookback, but they cannot aggregate over a 5-minute window; they are designed for low-latency, single-event detection. Option D is wrong because ML Behavior Analytics rules use machine learning to detect anomalous patterns over time, not a fixed numeric threshold like 10 failed sign-ins within 5 minutes.

Practice this question →

238

MCQhard

A security administrator needs to block legacy authentication protocols across all applications in Microsoft Entra ID. Which conditional access policy setting should they configure?

A.Under 'Grant', select 'Block access'

B.Under 'Conditions', configure 'Locations' to block all locations

C.Set 'Sign-in frequency' to 1 hour

D.Under 'Conditions', configure 'Client apps' to block legacy authentication

AnswerD

Under 'Conditions', configuring 'Client apps' allows administrators to target specific client applications and authentication protocols. By selecting 'Other clients' (which includes clients using legacy authentication protocols like Exchange ActiveSync, POP, IMAP, and older Office clients), and then applying a 'Block' grant control, the policy effectively prevents sign-ins from these legacy methods. This precisely addresses the requirement to block legacy authentication without impacting modern authentication flows.

Why this answer

Legacy authentication protocols (such as POP3, IMAP4, SMTP, and older Office clients) do not support modern authentication methods like MFA or conditional access. By configuring the 'Client apps' condition in a Conditional Access policy to block legacy authentication, the administrator can prevent these insecure sign-in attempts across all applications in Microsoft Entra ID.

Exam trap

The trap here is that candidates may confuse 'Block access' under 'Grant' (which is a general block) with the specific condition needed to target legacy protocols, or they may think that location or sign-in frequency settings can address protocol-level restrictions.

How to eliminate wrong answers

Option A is wrong because 'Block access' under 'Grant' is a control that blocks all access after conditions are evaluated, but it does not specifically target legacy authentication protocols; it would block all users regardless of client type. Option B is wrong because configuring 'Locations' to block all locations would prevent sign-ins from any geographic location, which is unrelated to blocking legacy authentication protocols. Option C is wrong because setting 'Sign-in frequency' to 1 hour controls session lifetime and reauthentication prompts, not the type of authentication protocol used during sign-in.

Practice this question →

239

MCQeasy

Your company is adopting Microsoft Copilot for Microsoft 365 to improve productivity. The security team is concerned about data leakage, as Copilot can access emails, documents, and other content. You need to ensure that sensitive data, such as credit card numbers and social security numbers, is not inadvertently exposed by Copilot. The organization uses Microsoft Purview sensitivity labels and DLP. You need to configure a solution that automatically detects and prevents Copilot from accessing or generating content containing these sensitive data types. What should you do?

A.Configure Microsoft Defender for Cloud Apps to control Copilot

B.Disable Copilot for users who handle sensitive data

C.Apply sensitivity labels to all documents containing sensitive data

D.Create a DLP policy in Microsoft Purview that detects sensitive data types and blocks Copilot actions

AnswerD

DLP can monitor and block Copilot interactions with sensitive data.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive data types (e.g., credit card numbers, social security numbers) and automatically block or warn when Copilot for Microsoft 365 attempts to access or generate content containing such data. Option A is incorrect because Microsoft Defender for Cloud Apps is designed to control cloud app usage, but it does not integrate directly with Copilot for content-level data loss prevention. Option B is incorrect because disabling Copilot for certain users is a blunt approach that impacts productivity and does not provide targeted protection against data leakage.

Option C is incorrect because while sensitivity labels help classify data, they alone do not prevent Copilot from accessing or generating sensitive content; DLP policies are required to enforce protection based on those labels.

Practice this question →

240

MCQeasy

Your organization wants to enable passwordless authentication for users. Which Microsoft Entra ID feature should you use?

A.Conditional Access

B.Privileged Identity Management

C.Identity Protection

D.Passwordless authentication methods

AnswerD

Passwordless authentication methods, including Windows Hello for Business, FIDO2 security keys, and the Microsoft Authenticator app, are the specific technologies that allow users to sign in without needing to type a password. These methods replace traditional passwords with more secure alternatives, significantly reducing the risk of phishing, credential stuffing, and brute-force attacks. Directly enabling and configuring these options within Microsoft Entra ID is the fundamental step to implement passwordless authentication for an organization's users.

Why this answer

Passwordless authentication methods is the correct feature because it is the specific Microsoft Entra ID capability that allows users to sign in without a password, using methods such as Windows Hello for Business, the Microsoft Authenticator app, FIDO2 security keys, or phone sign-in. This directly enables the organization's goal of passwordless authentication.

Exam trap

The trap here is that candidates may confuse Conditional Access (which can require passwordless methods as a grant control) with the actual feature that enables passwordless authentication, but Conditional Access only enforces policies, not the underlying authentication methods themselves.

How to eliminate wrong answers

Option A is wrong because Conditional Access is a policy engine that enforces access controls (e.g., requiring MFA or blocking sign-ins from untrusted locations) based on signals, but it does not itself provide or enable passwordless authentication methods. Option B is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role activation and access reviews for Azure AD roles and Azure resources, not passwordless sign-in capabilities. Option C is wrong because Identity Protection detects and remediates identity-based risks (e.g., leaked credentials, impossible travel) using risk policies, but it does not configure or offer passwordless authentication methods.

Practice this question →

241

MCQeasy

A company uses a third-party SaaS project management application. The security team wants to monitor and control user sessions when employees access the application from personal, unmanaged devices. Specifically, they want to block the download of files to local drives and display a warning message to the user if they attempt to download. Which Microsoft security solution should they deploy?

A.Microsoft Defender for Cloud Apps

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Office 365

D.Microsoft Defender for Identity

AnswerA

Correct. Defender for Cloud Apps with Conditional Access App Control provides session-level monitoring and control for SaaS apps, enabling actions like blocking downloads.

Why this answer

Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) is the correct solution because it provides session-level controls via Conditional Access App Control. This allows the security team to monitor and control user sessions in real-time, including blocking file downloads to unmanaged devices and displaying custom warning messages, by proxying the SaaS application traffic through Defender for Cloud Apps.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud Apps with Microsoft Defender for Office 365, assuming all SaaS app protection falls under Office 365, but Defender for Cloud Apps is the cross-SaaS session control solution.

Why the other options are wrong

Microsoft Defender for Endpoint focuses on endpoint protection (antivirus, EDR) and does not provide session-level control or conditional access policies for SaaS applications like blocking downloads from unmanaged devices.

Microsoft Defender for Office 365 focuses on protecting email and collaboration tools like Exchange, SharePoint, and Teams, not on monitoring and controlling user sessions for third-party SaaS applications accessed from personal devices.

Microsoft Defender for Identity focuses on detecting and investigating advanced attacks on on-premises Active Directory, not on controlling user sessions or file downloads in third-party SaaS applications.

Practice this question →

242

Multi-Selecthard

Which THREE are features of Microsoft Purview Data Lifecycle Management (formerly Records Management)? (Choose three.)

Select 3 answers

A.Retention policies

B.Data loss prevention

C.Sensitivity labels

D.Retention labels

E.Disposition review

AnswersA, D, E

Microsoft Purview retention policies are a core feature of Data Lifecycle Management, enabling organizations to proactively manage content across various locations like Exchange mailboxes, SharePoint sites, OneDrive accounts, and Microsoft 365 Groups. These policies apply retention settings at a broad, container level, ensuring that all content within a specified location is either retained for a minimum period or deleted after a certain time, or both, to meet compliance and regulatory requirements. They are crucial for enforcing consistent data governance across the enterprise.

Why this answer

Retention policies are a core feature of Microsoft Purview Data Lifecycle Management because they allow administrators to apply retention settings at the container level (e.g., entire SharePoint site, Exchange mailbox, or OneDrive account) to automatically retain or delete content based on a defined schedule. This ensures that organizational data is kept for the required period and then removed, supporting compliance and governance requirements without manual intervention.

Exam trap

The trap here is that candidates often confuse the features of Microsoft Purview Data Lifecycle Management (retention policies, retention labels, disposition review) with those of Information Protection (sensitivity labels) or Data Loss Prevention, leading them to incorrectly select DLP or sensitivity labels as lifecycle management features.

Practice this question →

243

MCQhard

A company has deployed Microsoft Defender for Identity and wants to detect pass-the-hash attacks in real time. Which alert type should they monitor?

A.Suspected Kerberoasting attack

B.Suspected Brute Force attack

C.Suspected Pass-the-Hash attack

D.Suspected Golden Ticket attack

AnswerC

A Suspected Pass-the-Hash (PtH) attack involves an attacker authenticating to a remote system or service by directly using a user's NTLM hash, without ever needing to know the plaintext password. Microsoft Defender for Identity excels at detecting PtH by analyzing NTLM authentication traffic for anomalies, such as a user authenticating from a new source IP address or to a resource without a corresponding Kerberos pre-authentication. This technique bypasses traditional password-based authentication mechanisms, making it a critical threat for MDI to identify.

Why this answer

Microsoft Defender for Identity specifically detects pass-the-hash attacks by monitoring anomalous NTLM authentication patterns, such as the use of hashed credentials from one machine to authenticate to another. The 'Suspected Pass-the-Hash attack' alert is triggered when Defender for Identity identifies a hash being reused across multiple devices in a way that indicates lateral movement, which is the core behavior of a pass-the-hash attack.

Exam trap

The trap here is that candidates often confuse pass-the-hash with Kerberoasting or Golden Ticket attacks, but the key differentiator is that pass-the-hash relies on NTLM hash reuse in real time, while the others involve Kerberos ticket manipulation or offline cracking.

How to eliminate wrong answers

Option A is wrong because a suspected Kerberoasting attack involves requesting Kerberos service tickets (TGS) for service accounts to crack their passwords offline, not real-time hash reuse. Option B is wrong because a suspected Brute Force attack involves repeated failed login attempts against a single account or endpoint, not the reuse of captured password hashes. Option D is wrong because a suspected Golden Ticket attack involves forging a Kerberos Ticket Granting Ticket (TGT) using the KRBTGT account hash, not the real-time reuse of NTLM hashes.

Practice this question →

244

MCQmedium

Your organization uses Microsoft Defender for Cloud Apps. A security analyst needs to receive an alert whenever a user accesses a cloud app from a new IP address that is not in the organization's trusted IP range. What should the analyst configure?

A.A file policy

B.A session policy

C.An app permission policy

D.An anomaly detection policy

AnswerD

An anomaly detection policy in Microsoft Defender for Cloud Apps leverages machine learning and behavioral analytics to identify unusual and potentially suspicious activities across your cloud applications. These policies establish a baseline of normal user behavior and then flag deviations, such as impossible travel, sign-ins from unfamiliar locations or IP addresses, and unusual activity volumes. Therefore, it is the correct policy type for detecting and alerting on sign-ins originating from new or previously unseen IP addresses.

Why this answer

An anomaly detection policy in Microsoft Defender for Cloud Apps is designed to identify unusual user activities, such as access from a new IP address outside the organization's trusted IP range. This policy leverages machine learning to establish a baseline of normal behavior and triggers alerts when deviations occur, making it the correct choice for this scenario.

Exam trap

The trap here is that candidates often confuse anomaly detection policies with session policies, mistakenly thinking session policies can alert on new IP addresses, but session policies only enforce controls during active sessions and do not generate standalone alerts for access from untrusted IPs.

How to eliminate wrong answers

Option A is wrong because a file policy is used to monitor and control file sharing and data exfiltration based on content inspection or metadata, not to detect anomalous access patterns like new IP addresses. Option B is wrong because a session policy controls real-time user sessions (e.g., blocking downloads or requiring authentication) based on app or user attributes, but it does not generate alerts for new IP address access outside trusted ranges. Option C is wrong because an app permission policy governs which third-party apps can access organizational data via OAuth permissions, not user access from specific IP addresses.

Practice this question →

245

MCQeasy

A security analyst receives an alert about a suspicious process on a device. The security solution automatically investigates the device, gathers evidence, and determines that a known malware variant was detected. It then presents an action plan to the analyst for remediation. Which Microsoft security solution provides this automated investigation and response capability?

A.Microsoft Defender for Cloud Apps

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Identity

D.Microsoft Defender for Office 365

AnswerB

Microsoft Defender for Endpoint (MDE) is a unified endpoint security platform that utilizes behavioral analytics, machine learning, and cloud intelligence to detect, investigate, and respond to advanced threats on devices. When a security analyst receives an alert about a suspicious process, MDE's Endpoint Detection and Response (EDR) capabilities automatically collect telemetry, analyze process trees, and can initiate automated investigation playbooks to determine the scope and severity of the threat, isolating the device if necessary. This directly addresses the need to investigate a suspicious process on an endpoint.

Why this answer

Microsoft Defender for Endpoint provides automated investigation and response (AIR) capabilities that automatically investigate alerts, gather evidence, and determine remediation actions. When a suspicious process is detected, Defender for Endpoint's AIR engine analyzes the device, identifies known malware variants, and presents an action plan to the security analyst for approval or execution.

Exam trap

Microsoft often tests the distinction between endpoint-focused security (Defender for Endpoint) and cloud/identity/email-focused solutions, so candidates mistakenly choose Defender for Cloud Apps or Defender for Identity when the scenario clearly describes on-device process investigation and automated response.

Why the other options are wrong

Microsoft Defender for Cloud Apps focuses on cloud application security, not endpoint device investigation and automated remediation of malware on devices.

Microsoft Defender for Identity focuses on detecting and investigating advanced attacks on on-premises Active Directory, not on automated investigation and response for suspicious processes on devices.

Microsoft Defender for Office 365 focuses on protecting email and collaboration tools like Exchange Online, SharePoint, and Teams, not on automated investigation and response for endpoint devices.

Practice this question →

246

MCQhard

Refer to the exhibit. You are evaluating a custom Azure Policy definition. The policy is intended to audit whether users assigned to a management role have MFA enabled. However, the policy is not triggering alerts for non-compliant users. What is the most likely cause?

A.The 'mfaEnabledPrincipals' parameter is not populated with the list of MFA-enabled users.

B.The policy mode is set to 'All' instead of 'Indexed'.

C.The policy only evaluates role assignments of type 'Microsoft.Authorization/roleAssignments' but not users.

D.The effect 'auditIfNotExists' should be 'deny' to trigger alerts.

AnswerA

The 'mfaEnabledPrincipals' parameter is crucial for this policy's logic, as the 'existenceCondition' relies on it to identify principals who have MFA enabled. If this parameter is not populated with the correct list of MFA-enabled user principal IDs, the policy's 'where' clause cannot accurately determine which principals are compliant. Consequently, the policy will fail to correctly evaluate whether non-MFA-enabled users hold owner role assignments, rendering its compliance assessment ineffective.

Why this answer

The policy definition includes a parameter named 'mfaEnabledPrincipals' that must be populated with the list of user object IDs who have MFA enabled. If this parameter is empty or not provided, the 'auditIfNotExists' effect cannot evaluate any users against the expected MFA status, resulting in no non-compliant alerts being triggered. Azure Policy relies on explicit parameter values to define the baseline for compliance evaluation.

Exam trap

The trap here is that candidates assume the policy will automatically detect MFA status from Azure AD, but Azure Policy requires explicit parameter input to define the compliant state, and failing to populate that parameter silently disables the audit.

How to eliminate wrong answers

Option B is wrong because the policy mode 'All' is appropriate for auditing Azure Active Directory resources (such as users and role assignments) and is not the cause of the failure; 'Indexed' mode is used for resource provider modes like 'Microsoft.Kubernetes.Data' and is irrelevant here. Option C is wrong because the policy does evaluate role assignments of type 'Microsoft.Authorization/roleAssignments' to identify users in management roles, but the issue is that the MFA-enabled user list is missing, not that the scope is incorrect. Option D is wrong because the 'auditIfNotExists' effect is designed to log non-compliance without blocking actions, and changing it to 'deny' would not trigger alerts; alerts are generated by Azure Policy compliance states, not by the effect type.

Practice this question →

247

MCQmedium

Your company uses Microsoft Purview Information Protection. They want to automatically apply a 'Confidential' sensitivity label to documents containing a credit card number. What should they create?

A.A sensitivity label

B.A data loss prevention (DLP) policy

C.An auto-labeling policy

D.A retention label policy

AnswerC

An auto-labeling policy is specifically designed within Microsoft Purview Information Protection to automatically scan content across various locations, such as SharePoint, OneDrive, and Exchange, for predefined conditions. When these conditions, which often include sensitive information types, keywords, or trainable classifiers, are met, the policy automatically applies a specified sensitivity label to the content. This ensures consistent and automated classification and protection without requiring manual user intervention.

Why this answer

An auto-labeling policy in Microsoft Purview Information Protection is designed to automatically apply sensitivity labels to documents and emails based on conditions such as the presence of sensitive information types (e.g., credit card numbers). This allows the 'Confidential' label to be applied without user intervention, meeting the requirement.

Exam trap

The trap here is confusing the function of a DLP policy (which blocks or alerts on sensitive data) with an auto-labeling policy (which applies a sensitivity label based on content), as both use sensitive information types but serve different purposes.

How to eliminate wrong answers

Option A is wrong because a sensitivity label defines the classification and protection settings (e.g., encryption, markings) but does not automatically apply itself; it must be assigned via a policy. Option B is wrong because a data loss prevention (DLP) policy enforces rules to prevent sharing of sensitive data (e.g., blocking email with credit card numbers), but it does not apply sensitivity labels. Option D is wrong because a retention label policy manages data retention and deletion rules, not sensitivity classification or automatic labeling based on content.

Practice this question →

248

MCQhard

You are analyzing sign-in logs in Microsoft Sentinel. Based on the KQL query in the exhibit, what is the purpose of this query?

A.Identify users who have attempted to sign in with a disabled account more than 10 times in the last 7 days.

B.Identify all sign-in attempts from a specific IP address.

C.Identify impossible travel activity across different locations.

D.Identify locations with the highest number of failed sign-ins.

AnswerA

This query correctly identifies users targeting disabled accounts by specifically filtering for `ResultType 50057`, which signifies an account is disabled. By then grouping these events by `UserPrincipalName`, counting the occurrences, and applying a `where count_ > 10` clause within a specified 7-day timeframe, it precisely pinpoints users exceeding the defined threshold of failed attempts against disabled accounts. This is a critical indicator of potential malicious activity or persistent user error.

Why this answer

The KQL query filters sign-in logs for events where the 'ResultType' is '50057', which specifically indicates a sign-in attempt from a disabled account. It then groups by user and counts occurrences, using a 'where' clause to filter for users with more than 10 such attempts. Finally, it limits the results to the last 7 days via the time range filter in the query or the workspace time filter.

This directly identifies users who have attempted to sign in with a disabled account more than 10 times in the last 7 days.

Exam trap

The trap here is that candidates may confuse the 'ResultType' value '50057' with a generic failed sign-in code (e.g., '50053' for locked accounts or '50126' for invalid credentials), leading them to incorrectly select option D (locations with highest failed sign-ins) instead of recognizing the specific disabled-account scenario.

How to eliminate wrong answers

Option B is wrong because the query does not filter by any IP address field (e.g., 'IPAddress', 'ClientIP'), so it cannot identify sign-in attempts from a specific IP address. Option C is wrong because the query does not compare timestamps or locations to detect impossible travel; it only counts disabled-account sign-in failures per user. Option D is wrong because the query focuses on a specific result type (50057) for disabled accounts, not all failed sign-ins, and it groups by user, not by location.

Practice this question →

249

MCQmedium

A company uses Microsoft Purview to map their data estate. They need to classify data stored in Azure SQL Database and Amazon S3. What should they use?

A.Microsoft Intune

B.Microsoft Sentinel

C.Microsoft Defender for Cloud

D.Microsoft Purview Data Map

AnswerD

The Microsoft Purview Data Map is the foundational component of Microsoft Purview, designed to automatically discover, catalog, and classify data assets across an organization's entire data estate, including on-premises, multi-cloud, and SaaS sources. It creates a unified metadata repository, providing a holistic view of data locations, types, and relationships. This capability is essential for understanding data landscapes, enabling data governance, compliance, and risk management initiatives.

Why this answer

Microsoft Purview Data Map is the correct choice because it provides automated data discovery, classification, and lineage across hybrid and multi-cloud environments, including Azure SQL Database and Amazon S3. It uses built-in scanners and classifiers to scan structured and unstructured data sources, mapping sensitive data types such as PII or financial information. This directly fulfills the requirement to classify data across both Azure and AWS platforms.

Exam trap

The trap here is that candidates often confuse Microsoft Purview Data Map with Microsoft Defender for Cloud, mistakenly thinking that Defender for Cloud's 'data classification' feature (which only applies to Azure SQL and Azure Storage) can also scan Amazon S3, but it cannot—only Purview Data Map supports multi-cloud data sources like AWS S3.

How to eliminate wrong answers

Option A is wrong because Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) service, focused on managing endpoints and enforcing compliance policies, not on data classification or scanning data stores. Option B is wrong because Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration Automation and Response) solution that ingests logs and alerts for threat detection, not for scanning and classifying data at rest in databases or object stores. Option C is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides security recommendations and threat protection for cloud resources, but it does not perform data classification or map data estates across Azure SQL and S3.

Practice this question →

250

MCQmedium

A company runs workloads in Azure and Amazon Web Services (AWS). The security team wants a single, unified dashboard to assess the security posture of all cloud resources, get prioritized recommendations for misconfigurations, and enable just-in-time (JIT) virtual machine access across both cloud environments. Which Microsoft security solution should they use?

A.Microsoft Sentinel

B.Microsoft Defender for Cloud Apps

C.Microsoft Defender for Cloud

D.Azure Policy

AnswerC

Microsoft Defender for Cloud offers unified security management and threat protection across hybrid and multi-cloud environments, including Azure and AWS. It provides Cloud Security Posture Management (CSPM) for continuous assessment of security configurations, offering recommendations to improve posture. Additionally, its Cloud Workload Protection (CWP) features include just-in-time (JIT) VM access, which significantly reduces the attack surface by only opening management ports when needed.

Why this answer

Microsoft Defender for Cloud is the correct solution because it provides a unified dashboard for assessing security posture across multi-cloud environments, including Azure and AWS. It delivers prioritized recommendations for misconfigurations using the Microsoft cloud security benchmark and supports just-in-time (JIT) VM access to reduce attack surfaces by controlling inbound traffic on demand.

Exam trap

The trap here is confusing Microsoft Defender for Cloud (a CSPM and workload protection platform) with Microsoft Sentinel (a SIEM), leading candidates to choose Sentinel because it also aggregates logs from multiple clouds, but it lacks the specific posture assessment dashboard and JIT VM access features described in the question.

Why the other options are wrong

Microsoft Sentinel is a SIEM/SOAR solution for threat detection and response, not a unified dashboard for assessing security posture across multi-cloud environments. It does not provide prioritized recommendations for misconfigurations or JIT VM access.

Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) focused on SaaS application usage and shadow IT, not a unified dashboard for assessing security posture across Azure and AWS with JIT VM access.

Azure Policy enforces and audits compliance rules across Azure resources but does not provide a unified dashboard for AWS, prioritized recommendations for misconfigurations, or JIT VM access across multi-cloud environments.

Practice this question →

251

MCQeasy

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate Microsoft 365 resources. You have configured a Conditional Access policy in Microsoft Entra ID that requires devices to be marked as compliant. However, some users report that they can still access email on their non-compliant Android devices. You need to troubleshoot and resolve the issue. What should you do?

A.Change the Conditional Access policy to block access for non-compliant devices instead of requiring compliance.

B.Check the Conditional Access policy is enabled and includes 'Office 365 Exchange Online' as a cloud app, and that the users have the appropriate licenses for Intune.

C.Ensure that the Android devices are enrolled in Microsoft Intune and have a compliance policy assigned.

D.Verify that the Conditional Access policy includes the users who are accessing email.

AnswerB

This is correct: the policy must be enabled, target Exchange Online, and users must have Intune licenses for compliance enforcement.

Why this answer

The Conditional Access policy must be enabled and configured to include 'Office 365 Exchange Online' as a cloud app, and the affected users need to have Intune licenses assigned. If the policy is not enabled or does not target the correct app, non-compliant devices may still access email. Option A is incorrect because requiring compliance is the correct setting, not blocking; blocking is a separate action.

Option C is incorrect because even if devices are enrolled, the policy must include the correct cloud app and users. Option D is incorrect because while the policy must include users, the primary issue is typically the policy not covering Exchange Online or missing licenses.

Practice this question →

252

Multi-Selectmedium

Which THREE components are part of Microsoft Defender XDR? (Choose three.)

Select 3 answers

A.Microsoft Purview

B.Microsoft Defender for Office 365

C.Microsoft Sentinel

D.Microsoft Defender for Identity

E.Microsoft Defender for Endpoint

AnswersB, D, E

Part of the XDR suite.

Why this answer

Microsoft Defender XDR is a unified security operations platform that integrates threat signals across endpoints, identities, and email/collaboration tools. Its core components include Microsoft Defender for Office 365 (email and collaboration protection), Microsoft Defender for Identity (identity security), and Microsoft Defender for Endpoint (endpoint detection and response). Option A (Microsoft Purview) is a data governance and compliance solution, not part of XDR.

Option C (Microsoft Sentinel) is a cloud-native SIEM that can ingest data from XDR but is not a built-in component of Defender XDR. Therefore, the correct answers are B, D, and E.

Exam trap

The trap here is that candidates confuse Microsoft Sentinel (a SIEM) as part of Defender XDR, but Sentinel is an external analytics layer that can ingest Defender XDR data, not a built-in component of the XDR suite.

Practice this question →

253

MCQmedium

A security analyst needs to detect and investigate compromised identities in on-premises Active Directory. They want to monitor for lateral movement, reconnaissance, and credential theft using behavioral analytics. Which Microsoft security solution is designed specifically for this purpose?

A.Microsoft Defender for Office 365

B.Microsoft Defender for Cloud

C.Microsoft Defender for Identity

D.Microsoft Sentinel

AnswerC

Microsoft Defender for Identity is the dedicated solution for detecting and investigating advanced threats and compromised identities within on-premises Active Directory environments. It deploys lightweight sensors directly on domain controllers to monitor network traffic and Windows events, leveraging behavioral analytics and machine learning to identify suspicious activities. This allows it to detect attack patterns such as lateral movement, credential theft, reconnaissance, and other indicators of compromise targeting on-premises user accounts and domain infrastructure.

Why this answer

Microsoft Defender for Identity (MDI) is a cloud-based security solution that leverages on-premises Active Directory signals to identify, detect, and investigate advanced threats like lateral movement, reconnaissance, and credential theft. It uses behavioral analytics and machine learning to profile user and entity behavior, alerting on suspicious activities such as Pass-the-Hash, DCSync, and Kerberoasting without requiring agents on domain controllers.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Identity with Microsoft Sentinel, assuming Sentinel's SIEM capabilities automatically cover identity-based behavioral analytics, but Sentinel lacks the native, agentless Active Directory behavioral profiling that MDI provides.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Office 365 focuses on email and collaboration threats (phishing, malware in attachments, and malicious links) and does not monitor on-premises Active Directory or lateral movement. Option B is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and workload protection platform for Azure, AWS, and GCP resources, not for on-premises Active Directory identity threats. Option D is wrong because Microsoft Sentinel is a SIEM/SOAR solution that can ingest logs from various sources, but it is not purpose-built for detecting compromised identities via behavioral analytics on Active Directory; it requires additional configuration and data connectors to achieve similar functionality.

Practice this question →

254

MCQmedium

A security analyst needs to investigate a potential malware outbreak that started on an on-premises Windows server several days ago. They want to trace the attack timeline, see which files were modified, and understand how the attacker moved laterally across the network. Which Microsoft solution provides advanced endpoint detection and response (EDR) for on-premises servers?

A.Microsoft Defender for Cloud

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Office 365

D.Microsoft Defender for Identity

AnswerB

Microsoft Defender for Endpoint is the dedicated Endpoint Detection and Response (EDR) solution designed to protect, detect, investigate, and respond to advanced threats on endpoints, including on-premises servers. It provides comprehensive capabilities such as real-time monitoring, behavioral analytics, automated investigation and remediation, and advanced threat hunting tools. This platform is specifically engineered to identify and analyze malware, track its activities, and facilitate a security analyst's investigation into potential compromises directly on the affected machines.

Why this answer

Microsoft Defender for Endpoint (MDE) provides advanced endpoint detection and response (EDR) capabilities, including behavioral-based detection, automated investigation, and threat analytics. For on-premises Windows servers, MDE can be deployed via Microsoft Defender for Cloud (formerly Azure Security Center) or directly, enabling full attack timeline reconstruction, file modification tracking, and lateral movement path analysis through its rich telemetry and incident graph.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud's 'servers' workload protection with the actual EDR engine, not realizing that Defender for Cloud merely enables MDE on servers but does not replace its dedicated endpoint detection and response capabilities.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and workload protection platform that can enable MDE on servers but does not itself provide the EDR functionality; it integrates with MDE for that purpose. Option C is wrong because Microsoft Defender for Office 365 protects email, SharePoint, OneDrive, and Teams from malicious content, not on-premises server endpoints or lateral movement analysis. Option D is wrong because Microsoft Defender for Identity is an identity-based threat detection solution that monitors Active Directory signals for attacks like pass-the-hash, not file-level or endpoint-level EDR on servers.

Practice this question →

255

Multi-Selecteasy

Which TWO Microsoft security solutions can be used to detect and respond to threats across email, endpoints, and identities? (Choose two.)

Select 2 answers

A.Microsoft Intune

B.Microsoft Defender for Cloud Apps

C.Microsoft Purview

D.Microsoft Sentinel

E.Microsoft Defender XDR

AnswersD, E

Sentinel provides SIEM and SOAR capabilities across multiple sources.

Why this answer

Microsoft Sentinel (option D) is correct because it is a cloud-native SIEM and SOAR platform that ingests logs from across the entire environment—including email, endpoints, and identity sources—to detect and respond to threats using analytics and automated playbooks. Microsoft Defender XDR (option E) is correct because it is a unified, pre- and post-breach detection and response solution that correlates signals across email (Exchange Online), endpoints (Microsoft Defender for Endpoint), and identities (Microsoft Defender for Identity).

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud Apps (a CASB focused on cloud app security) with a cross-domain detection and response solution, but it does not natively cover email or endpoint threat detection, making it an incorrect choice for this question.

Practice this question →

256

MCQhard

Refer to the exhibit. You are reviewing an ARM template for an Azure resource. Assuming the resource is a Key Vault, what is the effect of the networkAcls configuration?

A.The Key Vault is accessible from any network.

B.The Key Vault is accessible only from the 10.0.0.0/24 subnet.

C.The Key Vault is accessible from all Azure services.

D.The Key Vault is not accessible from any network.

AnswerB

This statement is correct. The network access configuration includes an "ipRules" entry specifically allowing traffic from the "10.0.0.0/24" subnet. Since the "defaultAction" is set to "Deny," any network traffic originating from outside this explicitly permitted IP range will be blocked. This creates a precise security boundary, restricting access exclusively to the specified subnet.

Why this answer

The networkAcls configuration in the ARM template defines IP firewall rules for the Key Vault. By specifying a defaultAction of 'Deny' and a single ipRule with a value of '10.0.0.0/24', the Key Vault is configured to allow traffic only from the 10.0.0.0/24 subnet. All other traffic, including traffic from other networks and Azure services, is denied by default.

Exam trap

The trap here is that candidates may assume a single ipRule with a subnet means the Key Vault is accessible from all Azure services or from any network, but the defaultAction of 'Deny' explicitly blocks all traffic except the allowed IP range, and the absence of a bypass setting prevents Azure services from accessing the vault.

How to eliminate wrong answers

Option A is wrong because the defaultAction is set to 'Deny', which means the Key Vault is not accessible from any network by default; only explicitly allowed IP ranges can access it. Option C is wrong because allowing access from all Azure services would require setting the bypass parameter to 'AzureServices' and the defaultAction to 'Allow', or adding a specific rule for Azure services; the current configuration does not include that. Option D is wrong because the Key Vault is accessible from the 10.0.0.0/24 subnet as defined by the ipRule, so it is not completely inaccessible.

Practice this question →

257

MCQhard

A multinational corporation needs to restrict data sharing in Microsoft Teams to comply with regional regulations. Users must not be able to share files with external domains from specific departments. What should the administrator configure?

A.Microsoft Intune device compliance policy

B.Microsoft Defender for Cloud Apps session policy

C.Data Loss Prevention (DLP) policy in Microsoft Purview

D.Sensitivity labels with container management in Microsoft Purview

AnswerD

Sensitivity labels with container management in Microsoft Purview are specifically designed to classify and protect data by applying predefined policies to content and its containers. When a sensitivity label is applied to a Microsoft Teams, SharePoint site, or Microsoft 365 Group, it can automatically enforce specific sharing and access policies, including blocking external sharing for all content within that labeled container. This ensures that data belonging to a particular department or project, once labeled, adheres to predefined organizational sharing restrictions, providing granular control at the container level.

Why this answer

Sensitivity labels with container management in Microsoft Purview allow administrators to configure external sharing restrictions for Microsoft Teams, SharePoint, and Groups. By applying a sensitivity label to a team, you can block external sharing for specific departments, ensuring compliance with regional regulations. This is the correct solution because it directly controls sharing behavior at the container level based on the label's settings.

Exam trap

The trap here is that candidates often confuse DLP policies (which block sensitive content) with container-level sharing restrictions, not realizing that DLP cannot block all external sharing from a specific department—it only acts on content patterns.

How to eliminate wrong answers

Option A is wrong because Microsoft Intune device compliance policy enforces device-level security requirements (e.g., encryption, OS version) and does not control data sharing restrictions in Teams. Option B is wrong because Microsoft Defender for Cloud Apps session policy monitors and controls user sessions in real-time (e.g., blocking downloads) but cannot restrict external domain sharing at the Teams container level. Option C is wrong because Data Loss Prevention (DLP) policy in Microsoft Purview scans and prevents sharing of sensitive data (e.g., credit card numbers) but does not block all sharing with external domains from specific departments; it is content-based, not department-based.

Practice this question →

258

MCQmedium

An organization uses Microsoft Purview Data Loss Prevention (DLP) to prevent sensitive data from being shared externally. They need to block sharing of credit card numbers in emails and Teams messages. What should they create?

A.A retention label to retain credit card data

B.A DLP policy with a rule that detects credit card numbers and blocks sharing

C.An audit policy to log credit card sharing

D.A sensitivity label that marks credit card data

AnswerB

Microsoft Purview Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and protect sensitive information across various locations, including Microsoft 365 services, endpoints, and cloud apps. A DLP policy configured with a rule to detect credit card numbers (a sensitive information type) can automatically block sharing attempts, notify users, or encrypt content, thereby preventing unauthorized data exfiltration. This directly addresses the requirement to block sharing of sensitive data.

Why this answer

Microsoft Purview DLP policies are specifically designed to detect and automatically block the sharing of sensitive data, such as credit card numbers, across services like Exchange Online (email) and Microsoft Teams. By creating a DLP policy with a rule that includes a sensitive information type for credit card numbers and an action to block external sharing, the organization can enforce the required protection. Retention labels, audit policies, and sensitivity labels do not provide the real-time blocking capability needed for this scenario.

Exam trap

The trap here is that candidates often confuse sensitivity labels (which classify and protect data) with DLP policies (which enforce actions like blocking based on content detection), leading them to select a sensitivity label instead of the DLP policy that actually blocks the sharing.

How to eliminate wrong answers

Option A is wrong because a retention label is used to retain or delete data based on compliance requirements, not to block the sharing of sensitive information in real time. Option C is wrong because an audit policy only logs events for review after they occur, it does not prevent or block the sharing of credit card numbers. Option D is wrong because a sensitivity label applies classification and protection (like encryption or visual markings) but does not include a rule to automatically detect and block sharing of specific data patterns like credit card numbers.

Practice this question →

259

MCQhard

Your organization uses Microsoft Sentinel as its SIEM. You need to create an analytics rule that detects when a user account is created in Azure AD and then, within 10 minutes, that same account is used to grant admin consent to an application. You have a KQL query that joins AuditLogs and SigninLogs. However, the rule is generating too many false positives. You need to refine the query to reduce false positives. What should you do?

A.Change the rule to alert on every admin consent grant event regardless of account creation.

B.Remove the join with SigninLogs and only use AuditLogs.

C.Add a condition to exclude accounts that are known admin accounts or service accounts.

D.Increase the time window from 10 minutes to 30 minutes.

AnswerC

This solution directly addresses the issue of excessive false positives by allowing legitimate administrative and service accounts to perform necessary admin consent grants without triggering alerts. By explicitly excluding these known, authorized entities, the rule focuses on detecting anomalous or unauthorized consent grants from potentially compromised user accounts or malicious actors. This targeted approach significantly reduces alert fatigue, enabling security analysts to concentrate on high-fidelity alerts that indicate actual threats.

Why this answer

Known admin or service accounts are often used for legitimate, automated admin consent grants, which can trigger false positives. By excluding these accounts from the detection logic, the rule focuses on anomalous behavior from non-privileged accounts, reducing noise while preserving the core detection of suspicious account creation followed by admin consent grant.

Exam trap

The trap here is that candidates may think widening the time window or simplifying the query will reduce false positives, but in reality, these changes either increase noise or break the correlation logic, whereas excluding known legitimate accounts directly addresses the root cause of false alerts.

How to eliminate wrong answers

Option A is wrong because alerting on every admin consent grant event would massively increase false positives, as many legitimate admin consent grants occur without a preceding account creation. Option B is wrong because removing the join with SigninLogs would eliminate the temporal correlation between account creation and the subsequent sign-in used for consent, breaking the detection logic entirely. Option D is wrong because increasing the time window from 10 to 30 minutes would allow more unrelated events to match, likely increasing false positives rather than reducing them.

Practice this question →

260

MCQmedium

A security team wants to detect when a user downloads an unusually large number of files from a third-party cloud storage app (e.g., Box) after logging in from an unfamiliar location. They also want to automatically suspend the user's account if such behavior is detected. Which Microsoft security solution should they use?

A.Microsoft Defender for Office 365

B.Microsoft Defender for Cloud Apps

C.Microsoft Defender for Identity

D.Microsoft Defender for Endpoint

AnswerB

Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing comprehensive visibility, control, and protection across all cloud applications, both sanctioned and unsanctioned. It actively monitors user activities, including file downloads and uploads, across third-party SaaS applications, detecting anomalous behaviors like mass downloads that could indicate data exfiltration. This solution is specifically engineered to identify and respond to threats within the cloud app ecosystem, making it ideal for detecting when a user downloads a file from a cloud service.

Why this answer

Microsoft Defender for Cloud Apps (MDCA) is the correct solution because it provides Cloud Access Security Broker (CASB) capabilities, including anomaly detection for user behavior across third-party cloud apps like Box. It can detect activities such as an unusually large number of file downloads from an unfamiliar location using its built-in behavioral analytics and then automatically apply a governance action, such as suspending the user's account, via policy-driven automated responses.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud Apps with Microsoft Defender for Office 365, assuming that 'cloud apps' only refers to Microsoft 365 services, but MDCA specifically covers third-party SaaS apps like Box, Salesforce, and AWS, while Defender for Office 365 is limited to Microsoft's own collaboration suite.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Office 365 focuses on protecting email and collaboration tools within Exchange Online, SharePoint Online, and Teams, not on monitoring third-party cloud storage apps like Box for anomalous download behavior. Option C is wrong because Microsoft Defender for Identity is designed to detect on-premises Active Directory attacks (e.g., lateral movement, privilege escalation) using network traffic and event logs, not to monitor user activity in third-party SaaS applications. Option D is wrong because Microsoft Defender for Endpoint is an endpoint detection and response (EDR) solution that protects devices (Windows, macOS, Linux) from malware and advanced threats, not cloud app usage or user account suspension in SaaS platforms.

Practice this question →

261

MCQeasy

An organization wants to provide a secure way for external partners to access specific SharePoint sites without creating new user accounts. What Microsoft Entra B2B feature should they use?

A.Azure AD B2C

B.Direct federation

C.Azure AD Domain Services

D.B2B collaboration

AnswerD

Azure AD B2B collaboration allows organizations to securely invite external users, such as partners, vendors, or customers, to access their applications and resources while letting these users sign in with their own identities. This includes identities from other Azure AD tenants, social identity providers (like Google or Microsoft accounts), or even email one-time passcodes. It provides a streamlined and secure method for external users to access shared resources without creating new credentials in the inviting organization's directory, maintaining strong security controls and compliance.

Why this answer

B2B collaboration is the correct Microsoft Entra B2B feature because it allows external partners to access specific SharePoint sites using their own identities (e.g., work or social accounts) without requiring new user accounts or passwords to be created in the organization's tenant. This is achieved through invitation-based redemption, where the partner user is represented as a guest user object in the directory, enabling fine-grained access control via SharePoint site sharing policies.

Exam trap

The trap here is that candidates confuse B2B collaboration (for external partner access with existing identities) with Azure AD B2C (for customer-facing identity management), or mistakenly think Direct federation is required for partner access when B2B collaboration already handles the invitation and redemption process without creating new accounts.

How to eliminate wrong answers

Option A is wrong because Azure AD B2C (Business-to-Consumer) is designed for customer-facing applications with self-service sign-up, not for granting external partners access to internal SharePoint sites without creating accounts. Option B is wrong because Direct federation is an authentication method that establishes a trust relationship with an external IdP for inbound SAML/WS-Fed federation, but it does not provide the invitation-based guest access model needed for ad-hoc partner access to SharePoint. Option C is wrong because Azure AD Domain Services provides managed domain services (e.g., LDAP, Kerberos) for legacy applications, not for external partner identity management or SharePoint access.

Practice this question →

262

MCQhard

Refer to the exhibit. You run a Kusto query in Microsoft Defender XDR Advanced Hunting. What does this query return?

A.Top 10 high-severity alert titles by number of distinct affected devices

B.Top 10 alert titles by number of distinct devices, including all severities

C.Top 10 devices with the most high-severity alerts

D.Top 10 high-severity alert titles by total number of alerts

AnswerA

This option accurately describes a Kusto query that would use `where AlertSeverity == 'High'` to filter, then `summarize DistinctDevices = dcount(DeviceName) by AlertTitle`, and finally `top 10 by DistinctDevices desc` to achieve the stated goal. The use of `dcount(DeviceName)` correctly calculates the number of unique devices affected by each alert title, directly matching the 'distinct affected devices' requirement. Grouping by `AlertTitle` ensures the ranking is based on alert types, providing the top 10 most impactful alert titles.

Why this answer

The query filters for high-severity alerts, then summarizes by AlertTitle and counts distinct DeviceName values. It orders by that count descending and takes the top 10, so it returns the top 10 high-severity alert titles ranked by the number of distinct affected devices.

Exam trap

The trap here is that candidates confuse 'distinct devices' with 'total alerts' or 'devices with the most alerts', and overlook the explicit severity filter, leading them to choose options that ignore the high-severity filter or misidentify the aggregation column.

How to eliminate wrong answers

Option B is wrong because the query explicitly filters for high-severity alerts (where Severity == 'High'), so it does not include all severities. Option C is wrong because the query summarizes by AlertTitle, not by DeviceName; it returns alert titles, not device names. Option D is wrong because the query uses dcount(DeviceName) to count distinct devices, not a count of total alerts (which would use count()).

Practice this question →

263

Multi-Selecteasy

Which TWO features are part of Microsoft Defender XDR?

Select 2 answers

A.Automated investigation and response

B.Cloud app discovery

C.Endpoint data loss prevention

D.Identity Protection

E.Incident management across workloads

AnswersA, E

XDR includes AIR capabilities.

Why this answer

Automated investigation and response (AIR) is a core capability of Microsoft Defender XDR, enabling automatic response to threats across workloads. Option E is correct because Incident management across workloads allows security teams to manage and correlate incidents from multiple sources in a unified console within Defender XDR. Option B is incorrect because Cloud app discovery is a feature of Microsoft Defender for Cloud Apps, not Defender XDR.

Option C is incorrect because Endpoint data loss prevention (Endpoint DLP) is part of Microsoft Purview compliance solutions. Option D is incorrect because Identity Protection is a feature of Microsoft Entra ID (formerly Azure AD), not Defender XDR.

Practice this question →

264

MCQmedium

Your organization, Contoso Ltd., uses Microsoft 365 and Microsoft Defender XDR. You are a security administrator. Recently, a user named John Doe reported that his account is sending phishing emails internally. You suspect his account is compromised. You need to contain the threat immediately while preserving forensic data. The company has the following security solutions: Microsoft Entra ID P2, Microsoft Defender for Office 365, Microsoft Defender for Endpoint, Microsoft Sentinel, and Microsoft Purview. You need to prevent the compromised account from causing further damage. Which action should you take first?

A.Reset the user's password and require a password change

B.Revoke all refresh tokens for the user in Microsoft Entra ID

C.Disable the user account in Microsoft Entra ID

D.Create a mail flow rule in Exchange Online to block the user's emails

AnswerC

Disabling immediately blocks all authentication and access.

Why this answer

Disabling the user account in Microsoft Entra ID immediately prevents the compromised account from initiating any new actions, including sending phishing emails. This is the fastest containment step while preserving forensic data. Option A (reset password) is incorrect because it does not terminate active sessions; the attacker may still have a valid token.

Option B (revoke refresh tokens) is a useful step but is not as immediate as disabling the account, and it may not stop all sessions. Option D (create mail flow rule) is too slow and may not affect sessions already authenticated.

Practice this question →

265

MCQhard

Your organization uses Microsoft Sentinel for SIEM. You receive an alert that a user account was compromised. You need to automatically disable the user's access across all cloud apps (SaaS) and reset their password. What should you use?

A.Create a Microsoft Sentinel automated response playbook

B.Use Microsoft Intune to remote wipe the user's device

C.Manually disable the user in Microsoft Entra ID and reset password

D.Configure a Microsoft Defender for Cloud Apps session policy

AnswerA

Microsoft Sentinel automated response playbooks, built on Azure Logic Apps, are specifically designed for Security Orchestration, Automation, and Response (SOAR). They can be triggered by Sentinel incidents or alerts to execute predefined workflows, such as calling the Microsoft Graph API to disable a user account in Microsoft Entra ID and initiate a password reset. This provides an immediate, automated, and scalable response to detected threats, directly addressing the requirement for revoking user access and resetting passwords without human intervention.

Why this answer

Microsoft Sentinel's automated response playbooks, built on Azure Logic Apps, can trigger an incident-based workflow that disables the user in Microsoft Entra ID and resets their password via the Microsoft Graph API. This provides the necessary cross-cloud automation to remediate a compromised account across all SaaS apps without manual intervention.

Exam trap

The trap here is that candidates confuse the reactive, automated remediation capability of Sentinel playbooks with the proactive, policy-based controls of Defender for Cloud Apps or the device-focused actions of Intune, leading them to choose an option that addresses only a subset of the required actions.

How to eliminate wrong answers

Option B is wrong because remote wiping a user's device only removes corporate data from that specific endpoint and does not disable the user's account or reset their password across cloud apps. Option C is wrong because manual disabling and password reset in Microsoft Entra ID is a valid action but does not meet the requirement for automatic response triggered by a Sentinel alert. Option D is wrong because a Microsoft Defender for Cloud Apps session policy controls real-time access and data exfiltration prevention via reverse proxy, but it cannot directly disable a user account or reset a password.

Practice this question →

266

MCQmedium

Your organization uses Microsoft Sentinel as a SIEM. You need to collect security events from on-premises servers. Which connector should you use?

A.Azure Monitor Agent (AMA)

B.Azure Security Center connector

C.Microsoft 365 Defender connector

D.Log Analytics workspace

AnswerA

The Azure Monitor Agent (AMA) is the primary agent for collecting logs and performance data from virtual machines and physical servers, including those located on-premises. It replaces the legacy Log Analytics agent (MMA) and offers enhanced security, cost management, and multi-homing capabilities. AMA sends this collected data directly to a Log Analytics workspace, which serves as Sentinel's data repository for analysis and threat detection.

Why this answer

The Azure Monitor Agent (AMA) is the correct connector because it is the primary agent for collecting security events from on-premises Windows and Linux servers into a Log Analytics workspace, which Microsoft Sentinel uses as its data source. AMA supports data collection rules (DCRs) to filter and route specific security event IDs, replacing the legacy Log Analytics agent. This enables Sentinel to ingest Windows Security Events (e.g., Event ID 4625 for failed logons) for threat detection and incident creation.

Exam trap

The trap here is that candidates confuse the Log Analytics workspace (a storage container) with a data connector, or assume the Azure Security Center connector can collect raw event logs, when in fact only the Azure Monitor Agent (AMA) provides the direct, agent-based collection of security events from on-premises servers.

How to eliminate wrong answers

Option B is wrong because the Azure Security Center connector is used to ingest security alerts and recommendations from Microsoft Defender for Cloud, not raw security events from on-premises servers. Option C is wrong because the Microsoft 365 Defender connector ingests alerts and incidents from Microsoft 365 Defender (e.g., Defender for Endpoint, Defender for Office 365), not from on-premises server event logs. Option D is wrong because a Log Analytics workspace is the destination storage and query environment, not a connector; it cannot collect data directly from servers without an agent like AMA.

Practice this question →

267

MCQmedium

A company runs critical applications on Azure virtual machines and on-premises SQL servers. The security team wants to reduce VM attack surface by allowing just-in-time (JIT) access to RDP and SSH ports only when needed. Additionally, they need to monitor changes to important registry keys and system files on the SQL servers. Which Microsoft security solution should they use?

A.Microsoft Defender for Cloud

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Identity

D.Microsoft Defender for Cloud Apps

AnswerA

Microsoft Defender for Cloud provides comprehensive security posture management and threat protection for Azure resources, including virtual machines. It offers Just-in-Time (JIT) VM access, which significantly reduces the attack surface by locking down inbound traffic to VMs and only opening necessary ports for a limited, controlled period. Furthermore, its File Integrity Monitoring (FIM) capability continuously monitors operating system files, application files, and registry keys for suspicious modifications, alerting administrators to unauthorized changes that could indicate a compromise or misconfiguration.

Why this answer

Microsoft Defender for Cloud provides just-in-time (JIT) VM access to reduce the attack surface by locking down inbound traffic to RDP (port 3389) and SSH (port 22) until a user requests access. It also includes adaptive application controls and file integrity monitoring (FIM) to track changes to registry keys and system files on both Azure VMs and on-premises SQL servers. This makes it the single solution that addresses both requirements.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Endpoint's broader device protection capabilities with the specific JIT and FIM features that are exclusive to Microsoft Defender for Cloud.

How to eliminate wrong answers

Option B (Microsoft Defender for Endpoint) is wrong because it focuses on endpoint detection and response (EDR) for devices, including antivirus and behavioral analysis, but does not natively provide JIT VM access or file integrity monitoring for registry keys and system files. Option C (Microsoft Defender for Identity) is wrong because it is designed to detect identity-based threats using on-premises Active Directory signals, not to manage VM network access or monitor file/registry changes. Option D (Microsoft Defender for Cloud Apps) is wrong because it is a cloud access security broker (CASB) that controls and monitors cloud app usage, not VM access or on-premises SQL server file integrity.

Practice this question →

268

MCQmedium

Your company, Fabrikam, uses Microsoft 365 and has Microsoft Purview Information Protection deployed. You need to protect sensitive documents labeled as 'Confidential' so that they cannot be printed or copied when opened in Microsoft Word. You have created a sensitivity label with the appropriate encryption settings. However, users report that they can still print and copy content from these documents. You verify that the label is published and assigned to the correct users. What should you configure to enforce the protection?

A.Configure the sensitivity label to apply an Azure Rights Management template that restricts printing and copying

B.Implement conditional access policies to block access from unmanaged devices

C.Configure auto-labeling policies to apply the label automatically

D.Create a data loss prevention policy that blocks printing and copying

AnswerA

RMS templates define user permissions for protected content.

Why this answer

The sensitivity label must be configured with an Azure Rights Management (RMS) template that specifies user rights, such as denying printing and copying. The label's encryption settings allow applying an RMS template that restricts these actions. Option B is incorrect because conditional access policies control access to resources, not usage rights within documents.

Option C is incorrect because auto-labeling policies only automatically apply labels but do not enforce rights. Option D is incorrect because data loss prevention (DLP) policies can detect and block certain actions, but to prevent printing and copying within the document, rights management via RMS is required.

Practice this question →

269

MCQeasy

A company uses Microsoft Purview Information Protection to classify and label sensitive documents. The compliance team wants to automatically apply a 'Confidential' label to documents containing an employee's passport number. Which method should they use?

A.Manual labeling by users

B.Trainable classifiers

C.Auto-labeling policy

D.DLP policy

AnswerC

An auto-labeling policy in Microsoft Purview Information Protection is specifically designed to automatically detect sensitive information types, such as passport numbers, within content stored in SharePoint, OneDrive, or Exchange. Upon detection, the policy can then apply a pre-configured sensitivity label to the document or email, ensuring consistent classification and protection without requiring any user intervention. This capability directly addresses the need for automatic application of labels based on specific data patterns.

Why this answer

An auto-labeling policy in Microsoft Purview Information Protection automatically applies sensitivity labels to documents and emails based on sensitive information types (e.g., passport numbers) without user intervention. This method uses content scanning to detect patterns and enforce labeling rules, making it the correct choice for the compliance team's requirement.

Exam trap

The trap here is that candidates confuse DLP policies with auto-labeling, but DLP focuses on preventing data loss through actions like blocking or encryption, not on automatically applying sensitivity labels to content.

How to eliminate wrong answers

Option A is wrong because manual labeling relies on users to apply labels themselves, which is inconsistent and does not meet the requirement for automatic application. Option B is wrong because trainable classifiers use machine learning to identify content based on patterns or context, not specific sensitive information types like passport numbers; they are designed for more complex or ambiguous content. Option D is wrong because a DLP policy detects and prevents unauthorized sharing of sensitive data but does not apply sensitivity labels; it enforces actions like blocking or alerting, not labeling.

Practice this question →

270

MCQmedium

An organization wants to detect and respond to threats across their cloud infrastructure, including Azure, AWS, and GCP. Which Microsoft security solution should they centralize their security monitoring in?

A.Microsoft Purview

B.Microsoft Sentinel

C.Microsoft Defender for Cloud

D.Microsoft Defender for Cloud Apps

AnswerB

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It ingests security data from virtually any source, including users, devices, applications, and infrastructure, across multi-cloud and on-premises environments. Sentinel then uses AI and machine learning to detect advanced threats, investigate incidents, and automate responses, providing comprehensive threat detection and response capabilities.

Why this answer

Microsoft Sentinel is the correct choice because it is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration Automated Response (SOAR) solution designed to ingest logs and alerts from multiple cloud providers, including Azure, AWS, and GCP, via native connectors and industry-standard protocols like Syslog and CEF. It centralizes threat detection and response across heterogeneous cloud environments, whereas the other options focus on specific security domains or single-cloud protection.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM/CWPP tool) with a SIEM, but Defender for Cloud does not provide the centralized log ingestion, correlation, and incident response across multiple cloud providers that Sentinel offers.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview is a data governance and compliance solution focused on data classification, labeling, and risk management, not on detecting and responding to threats across cloud infrastructure. Option C is wrong because Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) that primarily secures Azure resources and can extend to AWS and GCP via connectors, but it lacks the centralized SIEM/SOAR capabilities for multi-cloud threat detection and response that Sentinel provides. Option D is wrong because Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that focuses on shadow IT discovery and SaaS application security, not on ingesting and correlating security logs from IaaS and PaaS workloads across Azure, AWS, and GCP.

Practice this question →

271

MCQhard

A security analyst is using Microsoft 365 Defender to investigate a sophisticated multi-stage attack. The analyst needs to query data across endpoints, email, and identity logs to identify the attacker's behavior patterns and correlate events. Which Microsoft 365 Defender capability should the analyst use?

A.Automated investigation and response

B.Threat analytics

C.Advanced hunting

D.Action center

AnswerC

Advanced hunting is a powerful, proactive threat hunting tool within Microsoft 365 Defender that allows security analysts to explore raw organizational data using Kusto Query Language (KQL). It aggregates data from endpoints, email, identity, and cloud apps, enabling custom queries to uncover sophisticated threats, identify anomalous behaviors, and correlate events across diverse security domains that automated systems might miss. This capability is crucial for deep investigations and creating custom detection rules.

Why this answer

Advanced hunting is the correct capability because it provides a Kusto Query Language (KQL)-based query interface that allows the security analyst to perform custom, cross-domain searches across data from endpoints (Microsoft Defender for Endpoint), email (Microsoft Defender for Office 365), and identity logs (Microsoft Defender for Identity). This enables the correlation of events and identification of attacker behavior patterns across a multi-stage attack, which is not possible with the other options.

Exam trap

The trap here is that candidates often confuse 'Advanced hunting' with 'Threat analytics' because both involve investigating threats, but Threat analytics is a passive reading tool for pre-built reports, while Advanced hunting is an active, custom query engine for raw data correlation.

Why the other options are wrong

Automated investigation and response (AIR) automates incident response actions, but the question requires querying and correlating data across endpoints, email, and identity logs, which is the purpose of Advanced hunting, not AIR.

Threat analytics provides threat intelligence reports and insights about known threats, but it does not allow the analyst to query raw data across endpoints, email, and identity logs for custom correlation and pattern identification.

The Action center is used to view and manage remediation actions taken by automated investigations, not for querying raw data across endpoints, email, and identity logs to correlate events.

Practice this question →

272

MCQmedium

A company uses Microsoft 365. The security team wants to protect users from clicking malicious URLs in email messages. The solution should rewrite all links in incoming emails so that when a user clicks them, the URL is checked in real time against a dynamic list of known malicious sites. Which Microsoft Defender for Office 365 feature should they enable?

A.Anti-phishing policies

B.Safe Attachments

C.Safe Links

D.Anti-spam policies

AnswerC

Safe Links is a critical component of Microsoft Defender for Office 365 that provides time-of-click protection against malicious URLs. It dynamically rewrites URLs in emails and Office documents, then scans them in real-time when a user clicks, blocking access to known malicious sites or warning the user if the link's destination has changed to become malicious since initial delivery. This proactive scanning helps prevent users from accessing compromised websites, even if the link was initially benign.

Why this answer

Safe Links is the correct feature because it is specifically designed to protect users from malicious URLs in email messages and Office documents. It rewrites all links in incoming emails so that when a user clicks them, the URL is checked in real time against a dynamic list of known malicious sites, providing time-of-click protection.

Exam trap

The trap here is that candidates often confuse Safe Links with Anti-phishing policies, but Anti-phishing policies handle impersonation and spoofing detection, not URL rewriting and real-time click verification.

Why the other options are wrong

Anti-phishing policies protect against phishing attempts by analyzing email content and sender reputation, but they do not rewrite URLs or perform real-time link checking against a dynamic list of malicious sites.

Safe Attachments protects against malicious attachments by detonating them in a sandbox, not by rewriting and checking URLs in real time. The question specifically requires URL rewriting and real-time link checking, which is the function of Safe Links.

Practice this question →

273

MCQmedium

Your organization uses Microsoft Sentinel. You need to create an automation rule that automatically closes a low-severity incident after 24 hours of inactivity. Which action should you include in the rule?

A.Run playbook

B.Create incident

C.Add comment

D.Change status to Closed

AnswerD

The 'Change status to Closed' action is the direct and appropriate method within Microsoft Sentinel to formally conclude an incident investigation. This action explicitly updates the incident's lifecycle state, marking it as resolved and no longer requiring active attention from analysts. It is commonly utilized within automation rules or playbooks to automatically close incidents that meet specific criteria, such as after a period of inactivity, successful remediation, or identification as a false positive.

Why this answer

Changing the status to 'Closed' is the direct action needed to automatically resolve a low-severity incident after a period of inactivity in Microsoft Sentinel. Automation rules can trigger status changes based on conditions like time elapsed, and closing the incident removes it from the active queue without manual intervention.

Exam trap

The trap here is that candidates confuse 'automation rule actions' with 'playbook capabilities', assuming a playbook is required to close an incident, when in fact a simple status change action suffices and is more efficient.

How to eliminate wrong answers

Option A is wrong because running a playbook is an action that executes a set of automated tasks (e.g., sending emails or enriching data), but it does not directly close the incident; you would still need a separate status change action. Option B is wrong because creating an incident would generate a new alert or incident, which is the opposite of closing an existing one. Option C is wrong because adding a comment only appends a note to the incident timeline and does not alter its status or lifecycle.

Practice this question →

274

MCQhard

A manufacturing company experiences repeated ransomware attacks targeting their on-premises file servers. They have Microsoft 365 E5 and want to implement a solution to detect and automatically respond to such threats across hybrid environments. What should they deploy?

A.Microsoft Defender for Identity

B.Microsoft Purview Communication Compliance

C.Microsoft Defender for Office 365

D.Microsoft Defender for Cloud Apps

AnswerA

Microsoft Defender for Identity is specifically designed to monitor on-premises Active Directory (AD) environments for suspicious activities and advanced threats. Ransomware attacks frequently involve compromising AD credentials for lateral movement and privilege escalation. Defender for Identity detects these attacker behaviors, such as Pass-the-Hash, Golden Ticket attacks, or unusual account access patterns, by analyzing network traffic and AD logs, providing crucial early detection against sophisticated ransomware campaigns targeting an organization's core identity infrastructure.

Why this answer

Microsoft Defender for Identity is the correct solution because it uses on-premises Active Directory signals to detect, investigate, and respond to advanced threats like ransomware targeting hybrid environments. It integrates with Microsoft 365 Defender to automatically initiate response actions (e.g., disabling compromised accounts) when suspicious lateral movement or credential theft is detected, directly addressing the scenario of repeated ransomware attacks on on-premises file servers.

Exam trap

The trap here is that candidates often confuse Defender for Identity (on-premises AD protection) with Defender for Office 365 (email protection) or Defender for Cloud Apps (SaaS shadow IT), failing to recognize that the question explicitly mentions on-premises file servers and hybrid environments, which require identity-based detection and response.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview Communication Compliance is designed to detect policy violations in communications (e.g., insider trading, harassment), not to detect or respond to ransomware attacks on file servers. Option C is wrong because Microsoft Defender for Office 365 protects email and collaboration tools (e.g., Exchange Online, SharePoint Online) from phishing and malware, but does not monitor on-premises file servers or Active Directory for ransomware activity. Option D is wrong because Microsoft Defender for Cloud Apps focuses on shadow IT and data protection in cloud applications (e.g., SaaS apps), not on-premises file servers or hybrid identity threats.

Practice this question →

275

MCQhard

An organization wants to implement a zero-trust security model. They plan to require multi-factor authentication (MFA) for all users accessing sensitive applications, but only when the sign-in risk is medium or higher. Which Microsoft Entra ID capability should they use?

A.Microsoft Entra ID Privileged Identity Management (PIM)

B.Microsoft Entra ID Conditional Access policy with risk condition

C.Microsoft Defender for Cloud Apps access policy

D.Microsoft Entra ID Protection risk detection policy

AnswerB

Microsoft Entra ID Conditional Access policies are the core enforcement engine for Zero Trust principles, allowing organizations to define precise conditions under which users can access resources. By incorporating a "sign-in risk" condition, these policies leverage real-time risk assessments from Microsoft Entra ID Protection. If the sign-in risk meets a predefined threshold, the policy can dynamically enforce specific controls, such as requiring multi-factor authentication (MFA) or blocking access, directly aligning with a risk-based Zero Trust model.

Why this answer

B is correct because Microsoft Entra ID Conditional Access policies allow administrators to enforce MFA based on sign-in risk level, which is evaluated by Microsoft Entra ID Protection. By configuring a policy with a risk condition (e.g., medium or higher), the organization can require MFA only when the sign-in risk meets that threshold, aligning with a zero-trust model that grants access based on real-time risk assessment rather than a static rule.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID Protection (which detects risk) with the actual policy engine (Conditional Access) that enforces actions like MFA, leading them to select option D instead of B.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Privileged Identity Management (PIM) is designed for just-in-time privileged role activation and access reviews, not for evaluating sign-in risk or enforcing MFA based on risk level. Option C is wrong because Microsoft Defender for Cloud Apps access policies control session-level actions (e.g., blocking downloads) based on app context or user behavior, but they do not natively evaluate Microsoft Entra ID sign-in risk to trigger MFA. Option D is wrong because Microsoft Entra ID Protection risk detection policy is a misnomer; Entra ID Protection provides risk detections and risk scores, but the actual enforcement (e.g., requiring MFA) must be configured through a Conditional Access policy that uses those risk conditions.

Practice this question →

276

MCQhard

A tenant administrator runs the PowerShell cmdlet shown in the exhibit. The output shows that some compliance policies have IsAssigned = $false. What does this indicate?

A.The compliance policy is scheduled to be assigned in the future

B.The compliance policy is not assigned to any user or device group

C.The compliance policy has been evaluated and found non-compliant

D.The compliance policy is a built-in policy that cannot be assigned

AnswerB

When the IsAssigned property for an Intune compliance policy returns False, it directly and unambiguously indicates that the policy has not been targeted or deployed to any user groups, device groups, or the entire tenant. For a compliance policy to become active, enforce settings, and report on device or user compliance, it must be explicitly assigned to the relevant scope within Microsoft Intune.

Why this answer

The `IsAssigned` property in the output of a compliance policy PowerShell cmdlet (such as `Get-DeviceCompliancePolicy`) directly indicates whether the policy has been assigned to any user or device group. When `IsAssigned = $false`, it means the policy exists in the tenant but has not been linked to any group via an assignment, so it is not being enforced on any devices. This is a core concept in Microsoft Intune and Microsoft 365 compliance: a policy must be assigned to a group to take effect.

Exam trap

The trap here is that candidates confuse `IsAssigned` with compliance evaluation status or policy type, mistakenly thinking it indicates future scheduling, non-compliance, or built-in restrictions, rather than understanding it simply reflects whether the policy has been assigned to a group.

How to eliminate wrong answers

Option A is wrong because a future scheduled assignment would still show `IsAssigned = $true` once the assignment is configured; the property reflects the existence of an assignment, not its activation time. Option C is wrong because `IsAssigned` has nothing to do with compliance evaluation results—non-compliant devices are tracked via the `ComplianceStatus` property, not `IsAssigned`. Option D is wrong because built-in policies (like default compliance policies) can still be assigned and would show `IsAssigned = $true` if they are; the property does not indicate whether a policy is built-in or custom.

Practice this question →

277

Multi-Selecteasy

A company wants to enforce multifactor authentication for all users. Which TWO Microsoft Entra ID features can be used together to achieve this?

Select 2 answers

A.Conditional Access

B.Identity Protection

C.Security defaults

D.Authentication methods (Settings)

E.Password protection

AnswersA, D

Conditional Access policies are the primary method in Microsoft Entra ID to enforce specific access requirements, such as multifactor authentication (MFA), based on various conditions like user location, device state, or application being accessed. These policies evaluate conditions in real-time and grant or block access, or require additional steps like MFA, ensuring robust security tailored to risk.

Why this answer

Conditional Access policies allow you to enforce multifactor authentication (MFA) based on specific conditions such as user, location, or device state. Authentication methods define the MFA verification options (e.g., Microsoft Authenticator, SMS, OATH tokens) that users can register and use. Together, Conditional Access triggers the MFA requirement, while Authentication methods control which verification methods are available.

Exam trap

The trap here is that candidates often confuse Identity Protection (which can trigger MFA based on risk) as a direct MFA enforcement feature, when in fact it only provides risk signals that must be used with Conditional Access to enforce MFA.

Practice this question →

278

MCQhard

A company deploys Microsoft Entra ID Protection. The security team wants to automatically block sign-ins from anonymous IP addresses. They configure a Conditional Access policy. Which assignment condition should they use?

A.User risk level condition with 'Medium'

B.Device condition with 'Compliant'

C.Sign-in risk level condition with 'High'

D.Location condition with 'Any IP'

AnswerC

The 'Sign-in risk level' condition directly assesses the risk associated with a specific authentication attempt in real-time, leveraging detections from Microsoft Entra ID Protection. An 'Anonymous IP address' is a prominent detection that contributes to a 'High' sign-in risk level, as it often indicates an attempt to obscure the user's true location, which is frequently associated with malicious activity. This condition is precisely designed to respond to such real-time anomalies.

Why this answer

C is correct because the sign-in risk level condition in Conditional Access allows you to target sign-ins that have been assessed by Microsoft Entra ID Protection as risky. Anonymous IP addresses are a specific sign-in risk detection, and configuring the policy to block sign-ins with a 'High' sign-in risk level will automatically block those sign-ins. This directly addresses the security team's requirement to block sign-ins from anonymous IP addresses.

Exam trap

The trap here is that candidates often confuse 'user risk' with 'sign-in risk', mistakenly selecting the user risk level condition when the scenario specifically describes blocking a sign-in event based on the IP address's anonymity.

How to eliminate wrong answers

Option A is wrong because user risk level condition targets the likelihood that a user's identity has been compromised, not the risk of a specific sign-in session from an anonymous IP address. Option B is wrong because the device condition with 'Compliant' is used to require that the device meets compliance policies, which does not block sign-ins based on the IP address's anonymity. Option D is wrong because 'Any IP' in the location condition includes all IP addresses, including trusted ones, and does not specifically target anonymous IP addresses; it would block or allow all sign-ins regardless of IP anonymity.

Practice this question →

279

MCQmedium

A company uses Microsoft 365 and sanctioned cloud apps like Salesforce and Box. The security team wants to prevent users from downloading sensitive documents from these apps when accessing from unmanaged personal devices, while still allowing read-only access. They need real-time session monitoring and control. Which Microsoft security solution should they use?

A.Microsoft Defender for Office 365

B.Microsoft Defender for Cloud Apps

C.Microsoft Defender for Identity

D.Microsoft Defender for Endpoint

AnswerB

Defender for Cloud Apps can enforce session policies via Conditional Access App Control, allowing granular control over actions like download, upload, and copy based on user, device, and data sensitivity.

Why this answer

Microsoft Defender for Cloud Apps provides real-time session monitoring and control via its Conditional Access App Control feature. This allows administrators to enforce policies that block downloads or restrict access to sensitive data based on device compliance, such as blocking downloads from unmanaged personal devices while permitting read-only access. The solution integrates with sanctioned cloud apps like Salesforce and Box to apply these controls at the session level.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud Apps with Microsoft Defender for Office 365, assuming that Office 365 covers all cloud app security, but Defender for Office 365 is limited to Microsoft 365 services and cannot enforce session policies on third-party SaaS apps like Salesforce or Box.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Office 365 focuses on email and collaboration security (e.g., anti-phishing, anti-malware) and does not provide session-level control over third-party cloud apps like Salesforce or Box. Option C is wrong because Microsoft Defender for Identity is designed to detect identity-based threats (e.g., compromised accounts, lateral movement) using on-premises Active Directory signals, not to monitor or control user sessions in cloud apps. Option D is wrong because Microsoft Defender for Endpoint is an endpoint detection and response (EDR) solution that protects devices from malware and attacks, but it does not offer real-time session monitoring or conditional access controls for cloud app sessions.

Practice this question →

280

MCQhard

Refer to the exhibit. You are reviewing a Microsoft Purview DLP policy JSON snippet. The policy is enabled and contains one rule. What is the effect of this rule?

A.Applies only to SharePoint, not Exchange.

B.Only audits the activity, does not block.

C.Blocks access and sends a policy tip to users.

D.Blocks access to content containing a credit card number in Exchange and SharePoint, without user notification.

AnswerD

The rule has 'BlockAccess' action and no notification settings.

Why this answer

The JSON snippet shows a DLP rule with an action of 'BlockAccess' and 'NotifyUser' set to 'False', meaning the rule blocks access to content containing a credit card number in both Exchange and SharePoint (the locations are not restricted to a single workload). Since 'NotifyUser' is false, no policy tip or email notification is sent to the user. Therefore, the correct effect is that access is blocked without user notification, matching option D.

Exam trap

The trap here is that candidates assume 'BlockAccess' always includes a policy tip or notification, but the 'NotifyUser' parameter independently controls whether users are informed, and when set to 'False', no notification is sent.

How to eliminate wrong answers

Option A is wrong because the rule applies to both Exchange and SharePoint (the 'Location' parameter in the JSON includes both workloads, not just SharePoint). Option B is wrong because the rule includes a 'BlockAccess' action, not just an audit action (audit-only rules use 'AuditOnly' or no block action). Option C is wrong because 'NotifyUser' is set to 'False', so no policy tip is sent to users; the rule blocks access but does not notify.

Practice this question →

281

MCQmedium

A security team manages a hybrid environment with on-premises Windows servers and Azure VMs. They need a solution that can detect lateral movement attacks, pass-the-hash attempts, and anomalous service account behavior on the on-premises Active Directory environment. They also want these alerts to be integrated into Microsoft Defender for Cloud for centralized monitoring. Which Microsoft security solution should they deploy on their on-premises domain controllers?

A.Microsoft Defender for Office 365

B.Microsoft Defender for Identity

C.Microsoft Defender for Endpoint

D.Microsoft Intune

AnswerB

Microsoft Defender for Identity is a cloud-based security solution specifically engineered to protect hybrid identity environments, integrating deeply with on-premises Active Directory. It leverages network traffic from domain controllers and Windows events to detect suspicious user and entity behavior, identifying advanced threats like reconnaissance, lateral movement, Golden Ticket attacks, and other identity-based attacks. This service provides crucial visibility and detection capabilities for attacks targeting the core authentication system in a hybrid setup.

Why this answer

Microsoft Defender for Identity (MDI) is the correct solution because it is specifically designed to monitor on-premises Active Directory traffic and detect advanced threats like lateral movement, pass-the-hash, and anomalous service account behavior. It integrates directly with Microsoft Defender for Cloud to provide centralized alerting and investigation across hybrid environments.

Exam trap

The trap here is that candidates may confuse Microsoft Defender for Identity with Microsoft Defender for Endpoint, assuming endpoint protection covers identity threats, but MDI is the only solution that directly monitors on-premises Active Directory for lateral movement and pass-the-hash attacks.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Office 365 protects against email-based threats (phishing, malware in attachments/links) and does not monitor on-premises Active Directory or detect lateral movement or pass-the-hash attacks. Option C is wrong because Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for devices (Windows, Linux, macOS) and does not natively analyze on-premises AD domain controller traffic for identity-based attacks. Option D is wrong because Microsoft Intune is a cloud-based mobile device management (MDM) and mobile application management (MAM) solution; it does not provide security monitoring or threat detection for on-premises Active Directory.

Practice this question →

282

MCQmedium

A security operations team investigates a multi-stage attack that began with a phishing email, then moved to credential compromise, and finally to lateral movement on endpoints. They need a single pane of glass to view the entire attack story, including the initial email, the compromised user's sign-in activities, and processes on affected devices. Which Microsoft security solution provides this unified investigation experience?

A.Microsoft Sentinel

B.Microsoft Defender for Cloud

C.Microsoft 365 Defender

D.Microsoft Defender for Identity

AnswerC

Microsoft 365 Defender is the unified XDR (Extended Detection and Response) solution designed to protect an organization's entire digital estate across endpoints, email, identity, and cloud applications. It automatically correlates alerts and incidents from its constituent services (Defender for Endpoint, Office 365, Identity, and Cloud Apps) into a single, comprehensive incident view. This unified perspective is crucial for investigating multi-stage attacks, as it provides a holistic timeline and context across various attack vectors, enabling security operations teams to understand the full scope and impact of sophisticated threats.

Why this answer

Microsoft 365 Defender (now Microsoft Defender XDR) provides a unified investigation experience by correlating signals across email, identity, and endpoint domains into a single incident view. This allows the security team to see the full attack story—from the initial phishing email in Defender for Office 365, to the compromised user's sign-in activities via Defender for Identity, and the lateral movement processes on endpoints through Defender for Endpoint—all within one console.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel (a SIEM) with Microsoft 365 Defender (an XDR), assuming that any cross-domain investigation requires a SIEM, when in fact Microsoft 365 Defender provides the native, pre-correlated attack story across email, identity, and endpoints without needing custom log ingestion.

Why the other options are wrong

Microsoft Sentinel is a SIEM/SOAR solution that aggregates logs from multiple sources, but it does not natively provide a unified investigation experience across email, identity, and endpoints in a single attack story. The question specifically asks for a single pane of glass for the entire attack chain, which is a core capability of Microsoft 365 Defender.

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP), not a unified investigation experience for multi-stage attacks spanning email, identity, and endpoints.

Microsoft Defender for Identity focuses on detecting and investigating identity-based threats using on-premises Active Directory signals, but it does not provide a unified view across email, cloud app sign-ins, and endpoint processes as required by this multi-stage attack scenario.

Practice this question →

283

MCQmedium

A company uses Microsoft Defender for Office 365 and wants to protect users from malicious attachments in email. They need a feature that scans email attachments in a sandbox environment before they are delivered to recipients. Which Defender for Office 365 feature should they use?

A.Safe Links

B.Safe Attachments

C.Anti-phishing policies

D.Anti-spam policies

AnswerB

Safe Attachments is a critical component of Microsoft Defender for Office 365 that provides advanced, zero-day protection against unknown malware and viruses in email attachments. It employs a detonation chamber, or sandboxing technology, to open and analyze attachments in a secure, isolated virtual environment. This process determines if an attachment is malicious before it is delivered to the user's inbox, making it the precise solution for scanning email attachments for threats.

Why this answer

Safe Attachments is the correct feature because it specifically detonates email attachments in a sandbox environment before delivery, analyzing them for malicious behavior. This protects users from zero-day threats and advanced malware that signature-based detection might miss.

Exam trap

The trap here is confusing Safe Attachments (which scans attachments in a sandbox) with Safe Links (which scans URLs), as both are part of Microsoft Defender for Office 365 but serve different protection purposes.

How to eliminate wrong answers

Option A is wrong because Safe Links protects users from malicious URLs in email and Office documents, not attachments. Option C is wrong because Anti-phishing policies protect against phishing attempts by analyzing sender reputation and impersonation patterns, not by scanning attachments in a sandbox. Option D is wrong because Anti-spam policies filter unwanted bulk email based on content and sender reputation, not by detonating attachments in a sandbox.

Practice this question →

284

MCQhard

You are troubleshooting a Windows device that is reporting as non-compliant in Microsoft Intune. The exhibit shows the output of a PowerShell command run on the device. Based on the output, which component is likely misconfigured?

A.Microsoft Defender for Endpoint sensor onboarding

B.Antivirus protection

C.Antispyware protection

D.Microsoft Defender Antivirus real-time protection

AnswerA

The PowerShell output displays the 'OnboardingState' property with a value of 0, which indicates the device is not onboarded to Microsoft Defender for Endpoint. This is the likely cause of the non-compliant status.

Why this answer

The PowerShell output shows the 'OnboardingState' value is 0, which indicates the device is not onboarded to Microsoft Defender for Endpoint. Intune uses the Defender for Endpoint sensor as a compliance signal; if the sensor is not properly onboarded, the device will report as non-compliant regardless of other security settings.

Exam trap

The trap here is that candidates often confuse 'onboarding state' with 'real-time protection' or 'antivirus status', but the PowerShell output explicitly shows the 'OnboardingState' property, which is unique to Microsoft Defender for Endpoint sensor configuration, not to Microsoft Defender Antivirus settings.

How to eliminate wrong answers

Option B is wrong because antivirus protection status is not indicated by the 'OnboardingState' value; it is a separate compliance policy setting. Option C is wrong because antispyware protection is a subset of antivirus protection and is not directly tied to the sensor onboarding state shown in the output. Option D is wrong because real-time protection is a feature of Microsoft Defender Antivirus, not the Defender for Endpoint sensor onboarding process; the output specifically shows the sensor onboarding state, not real-time protection status.

Practice this question →

285

MCQmedium

A financial institution is deploying Microsoft Sentinel to monitor security events across its hybrid cloud environment. They want to correlate alerts from multiple sources and automate incident response. Which Microsoft Sentinel feature should they use to create automated workflows?

A.Workbooks

B.Analytics rules

C.Playbooks

D.Hunting queries

AnswerC

Playbooks in Microsoft Sentinel, powered by Azure Logic Apps, are automated, scalable, and customizable workflows designed to orchestrate and automate incident response tasks. They can be triggered by analytics rules, incidents, or manual actions, performing predefined actions such as enriching incident data, blocking malicious IP addresses, isolating compromised hosts, or notifying security teams via various communication channels. This automation significantly reduces manual effort and accelerates response times.

Why this answer

Playbooks in Microsoft Sentinel are built on Azure Logic Apps and allow you to automate incident response by defining a series of actions triggered by alerts. They can orchestrate tasks such as blocking IPs, opening tickets, or notifying teams, making them the correct choice for creating automated workflows.

Exam trap

The trap here is confusing the purpose of Analytics rules (alert generation) with Playbooks (automated response), as both are part of the detection and response pipeline but serve distinct roles.

How to eliminate wrong answers

Option A is wrong because Workbooks are used for visualizing and analyzing data through dashboards, not for automating workflows. Option B is wrong because Analytics rules define conditions for generating alerts from data sources, but they do not execute automated response actions. Option D is wrong because Hunting queries are ad-hoc searches for potential threats in raw log data, not for creating automated incident response workflows.

Practice this question →

286

MCQmedium

Refer to the exhibit. A Microsoft Purview DLP policy is configured. When a user attempts to share a document containing a credit card number externally, what will happen?

A.The document is shared but the user is notified.

B.The sharing attempt is blocked and the user receives a notification.

C.The document is encrypted before sharing.

D.The policy has no effect because no severity level is set.

AnswerB

This option accurately describes the combined effect of common DLP policy actions. A Microsoft Purview DLP policy can be configured with multiple actions for a single rule. When BlockAccess is specified, it actively prevents the sharing attempt, ensuring the sensitive information remains within the defined boundaries. Concurrently, the NotifyUser action ensures that the individual attempting the prohibited action receives an immediate notification, explaining why their action was blocked and often providing guidance on compliance.

Why this answer

The exhibit shows a Microsoft Purview DLP policy configured with a 'Block' action for sharing documents containing credit card numbers externally. When the action is set to 'Block', the sharing attempt is prevented, and the user receives a notification explaining why the action was blocked. This aligns with the default behavior of DLP policies that enforce restrictive actions on sensitive data.

Exam trap

The trap here is that candidates may assume a missing severity level disables the policy, but in Microsoft Purview DLP, severity is only for reporting and alerting—the configured actions (e.g., Block, Notify) are enforced independently of severity settings.

How to eliminate wrong answers

Option A is wrong because the policy action is set to 'Block', not 'Audit' or 'Notify only', so the document is not shared; the user is notified but the sharing is blocked. Option C is wrong because encryption is a separate action (e.g., 'Encrypt' in sensitivity labels or DLP with Azure Information Protection), and the exhibit shows no encryption action configured—only 'Block' and 'Notify'. Option D is wrong because severity level is optional in DLP policies; the policy still enforces its configured actions (Block and Notify) regardless of whether a severity level is set.

Practice this question →

287

MCQeasy

A company wants to block users from accessing phishing websites via Microsoft Edge. Which Microsoft security solution should they use?

A.Microsoft Defender for Endpoint

B.Microsoft Purview

C.Microsoft Intune

D.Microsoft Defender SmartScreen

AnswerD

Microsoft Defender SmartScreen is a security feature integrated into Microsoft Edge and other Windows components that provides real-time protection against phishing sites, malicious websites, and potentially unwanted software downloads. It actively checks websites and files against a dynamic list of reported malicious content, alerting users or blocking access to help prevent them from falling victim to social engineering attacks or malware infections. This direct, browser-level intervention is precisely what's needed to block users from accessing phishing websites.

Why this answer

Microsoft Defender SmartScreen is the correct solution because it is specifically designed to protect users from phishing and malicious websites directly within Microsoft Edge. It operates by comparing visited URLs against a dynamic list of reported phishing sites and analyzing site behavior in real time, blocking access before the user can interact with the page.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Endpoint (a broad EDR platform) with the browser-specific anti-phishing feature, assuming that any 'Defender' product covers all security scenarios, when in fact SmartScreen is a distinct, lightweight component built into Edge.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Endpoint is an enterprise endpoint detection and response (EDR) solution that focuses on post-breach detection, investigation, and remediation of advanced threats on devices, not on blocking phishing websites in the browser. Option B is wrong because Microsoft Purview is a data governance, compliance, and risk management solution that handles data classification, retention, and eDiscovery, not real-time web threat blocking. Option C is wrong because Microsoft Intune is a cloud-based mobile device management (MDM) and mobile application management (MAM) service for managing devices and apps, not a browser-based anti-phishing filter.

Practice this question →

288

MCQhard

A company wants to gain visibility into the use of unsanctioned cloud applications (shadow IT) within their organization. The security team has access to network proxy logs that show traffic to various cloud services. They want to use a Microsoft security solution to analyze these logs and identify which cloud apps are being used, by whom, and how much data is being consumed. Which capability of Microsoft Defender for Cloud Apps should they use?

A.App governance

B.Cloud Discovery

C.Conditional Access App Control

D.App Connectors

AnswerB

Cloud Discovery, a core component of Microsoft Defender for Cloud Apps (MDCA), is specifically designed to analyze traffic logs from firewalls, proxies, and other network devices to identify all cloud applications accessed by users. This process enables organizations to gain comprehensive visibility into 'shadow IT' – unsanctioned cloud applications – and assess their associated risks, providing crucial insights into usage patterns across the environment.

Why this answer

Cloud Discovery in Microsoft Defender for Cloud Apps analyzes network proxy logs (or traffic logs from firewalls and proxies) to identify unsanctioned cloud app usage (shadow IT). It provides visibility into which cloud apps are being used, by which users, and how much data is consumed, directly matching the company's requirement to analyze logs for shadow IT detection.

Exam trap

The trap here is that candidates confuse Cloud Discovery (log analysis for shadow IT discovery) with App Connectors (API-based integration for managed apps), leading them to select App Connectors because they think 'connecting' to apps is needed to see usage.

Why the other options are wrong

App governance focuses on managing and governing app permissions and policies for OAuth-enabled apps, not on analyzing network proxy logs to discover unsanctioned cloud app usage.

Conditional Access App Control is used to enforce access policies on cloud apps in real-time, not to analyze proxy logs for discovering unsanctioned app usage. The question specifically requires analyzing network proxy logs to identify shadow IT, which is the function of Cloud Discovery.

App Connectors are used to connect to specific cloud apps via APIs for deep visibility and control, not to analyze network proxy logs for discovering unsanctioned cloud apps.

Practice this question →

289

MCQmedium

An organization uses Exchange Online and is concerned about phishing attacks that include malicious hyperlinks. They need a security solution that checks URLs at the time a user clicks them and blocks access to known malicious or suspicious websites. The solution must also provide real-time reputation analysis for link clicks. Which Microsoft security solution should they enable?

A.Microsoft Defender for Endpoint

B.Microsoft Defender for Office 365

C.Microsoft Defender for Cloud Apps

D.Microsoft Sentinel

AnswerB

Microsoft Defender for Office 365 (MDO) is the correct solution as it provides advanced threat protection specifically for email and collaboration tools like Exchange Online, SharePoint, OneDrive, and Microsoft Teams. Its Safe Links feature proactively rewrites URLs in emails and Office documents, scanning them at the time of click to prevent access to malicious websites. Additionally, Safe Attachments sandboxes email attachments to detect and neutralize zero-day malware before it reaches user inboxes, directly addressing concerns about malicious content.

Why this answer

Microsoft Defender for Office 365 (MDO) provides Safe Links, a feature specifically designed to protect against phishing attacks by scanning URLs at the time of click. It performs real-time reputation analysis against Microsoft's threat intelligence to block access to known malicious or suspicious websites. This directly addresses the requirement for click-time URL verification and blocking.

Exam trap

The trap here is that candidates confuse endpoint security (Defender for Endpoint) with email security (Defender for Office 365), overlooking that the question explicitly mentions Exchange Online and click-time URL analysis, which is a core Safe Links feature of MDO.

Why the other options are wrong

Microsoft Defender for Endpoint focuses on endpoint devices (e.g., desktops, servers) and does not provide URL click-time protection for email links in Exchange Online. The question specifically requires a solution for email phishing links, which is covered by Defender for Office 365.

Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that focuses on securing cloud applications and controlling data access, not on real-time URL click-time inspection for phishing links in email. The question specifically requires a solution that checks URLs at click time and provides reputation analysis for link clicks, which is a feature of Defender for Office 365 (Safe Links).

Microsoft Sentinel is a cloud-native SIEM/SOAR solution for security analytics and threat intelligence across the enterprise, not a tool for real-time URL click-time protection in Exchange Online. The question specifically requires a solution that checks URLs at click time in email, which is a feature of Defender for Office 365.

Practice this question →

290

Multi-Selecteasy

A company wants to use Microsoft Intune to manage devices. Which TWO capabilities does Intune provide?

Select 2 answers

A.Mobile device management (MDM)

B.Compliance assessment for cloud resources

C.Endpoint detection and response

D.Mobile application management (MAM)

E.Identity and access management

AnswersA, D

Microsoft Intune's Mobile Device Management (MDM) capabilities are fundamental for organizations to enroll, configure, and secure a diverse range of corporate and personal devices, including Windows, iOS/iPadOS, Android, and macOS. This core feature enables the enforcement of device-level security policies, deployment of settings and certificates, and remote actions like wiping or locking, ensuring devices meet organizational compliance before accessing sensitive resources.

Why this answer

Microsoft Intune provides Mobile Device Management (MDM) capabilities, allowing administrators to enroll devices, enforce configuration policies, and remotely wipe corporate data. Option D is correct because Intune also provides Mobile Application Management (MAM), enabling control over app access and data protection without requiring full device enrollment, using app protection policies.

Exam trap

The trap here is that candidates often confuse Intune's compliance policies (which are device-focused) with cloud resource compliance (Option B), or mistakenly associate Intune with identity management (Option E) because it integrates with Microsoft Entra ID for authentication.

Practice this question →

291

MCQeasy

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. Which policy should you configure?

A.Device compliance policy in Microsoft Intune

B.Enrollment restrictions in Microsoft Intune

C.App protection policy in Microsoft Intune

D.Conditional Access policy in Microsoft Entra ID

AnswerD

A Conditional Access policy in Microsoft Entra ID is the robust enforcement mechanism that evaluates various signals, including device compliance status reported by Intune, before granting access to cloud apps like email. It acts as the gatekeeper, allowing administrators to define conditions under which users can access resources. If a device is marked as non-compliant by Intune, a Conditional Access policy can then block access to sensitive applications, effectively linking device health to resource access.

Why this answer

Conditional Access policies in Microsoft Entra ID evaluate signals such as device compliance status from Intune before granting access to cloud apps like Exchange Online. By configuring a Conditional Access policy that requires device compliance, only devices marked as compliant by Intune can access corporate email. This is the correct mechanism because Conditional Access acts as the gatekeeper that enforces the compliance requirement at the authentication and authorization layer.

Exam trap

The trap here is that candidates often confuse the policy that defines compliance (Intune Device Compliance) with the policy that enforces access based on that compliance (Entra ID Conditional Access), leading them to pick Option A instead of D.

How to eliminate wrong answers

Option A is wrong because a Device compliance policy in Microsoft Intune defines the security requirements (e.g., encryption, OS version) and marks a device as compliant or non-compliant, but it does not enforce access control to corporate email on its own. Option B is wrong because Enrollment restrictions in Microsoft Intune control which devices can enroll into management (e.g., by platform or manufacturer), not whether already enrolled devices can access email. Option C is wrong because App protection policies in Microsoft Intune manage data protection within apps (e.g., preventing copy/paste or requiring PIN) but do not evaluate device compliance or block access to email based on the device's overall compliance state.

Practice this question →

292

MCQeasy

A company wants to collect security logs from on-premises servers, cloud applications, and network devices into a central repository, and then use advanced analytics detect threats and automate incident response. Which Microsoft security solution should they deploy?

A.Microsoft Sentinel

B.Microsoft Defender for Cloud

C.Microsoft 365 Defender

D.Azure Firewall

AnswerA

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It is explicitly designed to ingest security logs from diverse sources, including on-premises servers, network devices, and cloud services, through various data connectors like the Log Analytics agent. This centralized collection is fundamental for comprehensive threat detection, investigation, and automated response across hybrid environments.

Why this answer

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration Automated Response (SOAR) solution. It collects security logs from diverse sources like on-premises servers, cloud apps, and network devices into a central Log Analytics workspace, then uses built-in analytics and machine learning to detect threats and automate incident response via playbooks.

Exam trap

The trap here is that candidates confuse Microsoft Sentinel (a SIEM/SOAR) with Microsoft Defender for Cloud (a CSPM/CWPP), thinking both do log collection and threat detection, but only Sentinel provides a unified SIEM repository with advanced analytics and automated response across hybrid and multi-cloud sources.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP), not a SIEM; it focuses on assessing and hardening cloud resources, not central log collection and advanced threat analytics across hybrid environments. Option C is wrong because Microsoft 365 Defender is an Extended Detection and Response (XDR) solution that correlates signals across Microsoft 365 products (e.g., Defender for Endpoint, Defender for Office 365), but it does not ingest logs from third-party network devices or on-premises servers into a single SIEM repository. Option D is wrong because Azure Firewall is a managed network firewall service that filters traffic based on rules; it provides logging for its own traffic but cannot aggregate logs from multiple sources or perform threat detection analytics.

Practice this question →

293

MCQeasy

An organization wants to allow users to sign in using their mobile phone number and a verification code. Which Microsoft Entra ID feature enables this?

A.FIDO2 security keys

B.App passwords

C.SMS-based authentication

D.Password hash synchronization

AnswerC

SMS-based authentication in Azure AD allows users to sign in to cloud applications by entering their registered phone number instead of a traditional username and password. Upon entering the phone number, a one-time passcode (OTP) is sent via SMS to that number, which the user then enters to complete authentication. This method provides a convenient, passwordless experience, directly leveraging the ubiquity of mobile phones and SMS for identity verification and fulfilling the requirement to sign in using a phone number.

Why this answer

SMS-based authentication allows users to sign in to Microsoft Entra ID by entering their mobile phone number and receiving a verification code via text message. This is a form of passwordless authentication that leverages the user's phone number as the primary identifier and the SMS-delivered code as the second factor, meeting the organization's requirement for phone number and verification code sign-in.

Exam trap

The trap here is that candidates often confuse SMS-based authentication with App passwords, mistakenly thinking App passwords are used for phone-based sign-in, when in fact App passwords are a legacy workaround for non-MFA-aware apps and have nothing to do with phone number verification.

How to eliminate wrong answers

Option A is wrong because FIDO2 security keys are hardware-based passwordless authentication devices that use public-key cryptography (WebAuthn) and do not involve a mobile phone number or SMS verification codes. Option B is wrong because App passwords are legacy 16-character codes used only for apps that do not support modern authentication (e.g., older Office clients) when MFA is enforced; they are not a sign-in method using a phone number and verification code. Option D is wrong because Password hash synchronization is a synchronization feature that syncs password hashes from on-premises Active Directory to Microsoft Entra ID for hybrid identity, not a user-facing authentication method for signing in with a phone number and code.

Practice this question →

294

MCQeasy

A company uses Microsoft 365 and wants to protect its users from clicking malicious links in phishing emails. The security team needs a solution that rewrites URLs in email messages to check the link at the time of click, and blocks access if the link is malicious. Which Microsoft security solution should they use?

A.Azure Firewall

B.Microsoft Defender for Office 365

C.Microsoft Defender for Endpoint

D.Microsoft Defender for Identity

AnswerB

Microsoft Defender for Office 365 is specifically engineered to protect against advanced threats in email and collaboration services like Exchange Online, SharePoint, OneDrive, and Microsoft Teams. Its Safe Links feature proactively rewrites URLs in emails and Office documents, then scans them at the time of click to prevent users from accessing malicious websites. Additionally, Safe Attachments sandboxes suspicious attachments, ensuring comprehensive protection against phishing and malware delivered via email.

Why this answer

Microsoft Defender for Office 365 includes Safe Links, a feature specifically designed to protect users from malicious URLs in email messages. Safe Links rewrites URLs at the time of delivery, and when a user clicks a link, it checks the destination in real time against threat intelligence; if the link is malicious, access is blocked. This directly matches the requirement to rewrite URLs and perform click-time verification.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Office 365 (which includes Safe Links and Safe Attachments for email security) with Microsoft Defender for Endpoint (which protects devices) or Azure Firewall (which protects network traffic), leading them to select a solution that does not address the specific email URL rewriting requirement.

How to eliminate wrong answers

Option A is wrong because Azure Firewall is a network-layer firewall that filters traffic based on IP addresses, ports, and protocols; it does not rewrite URLs in email messages or perform click-time link inspection. Option C is wrong because Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR), antivirus, and vulnerability management on devices; it does not rewrite URLs in email or provide click-time URL protection. Option D is wrong because Microsoft Defender for Identity monitors on-premises Active Directory signals to detect identity-based attacks (e.g., lateral movement, privilege escalation); it does not inspect or rewrite URLs in email messages.

Practice this question →

295

MCQeasy

Your company wants to use Microsoft Defender for Identity to detect security threats from on-premises Active Directory. What is a prerequisite for deploying Defender for Identity?

A.Obtain Microsoft 365 E3 licenses

B.Install a sensor on each user's workstation

C.Install a sensor on a domain controller

D.Configure Azure AD Connect

AnswerC

Installing a sensor on a domain controller is the correct action for deploying Microsoft Defender for Identity. The Defender for Identity sensor passively monitors network traffic to and from the domain controller, as well as Windows events directly from the domain controller itself. This strategic placement allows it to detect suspicious activities, lateral movement paths, and advanced persistent threats targeting Active Directory, providing critical insights into identity-based attacks.

Why this answer

Microsoft Defender for Identity requires a sensor installed on a domain controller to capture and analyze on-premises Active Directory traffic, including authentication events and Kerberos requests. Without this sensor, Defender for Identity cannot monitor AD activities or detect threats like pass-the-hash or Golden Ticket attacks.

Exam trap

The trap here is that candidates confuse the licensing requirement (E5 vs. E3) with a deployment prerequisite, or mistakenly think Azure AD Connect is needed because Defender for Identity integrates with cloud services, but the sensor installation on a domain controller is the actual technical prerequisite.

How to eliminate wrong answers

Option A is wrong because Microsoft 365 E3 licenses do not include Defender for Identity; it requires a standalone license or an E5/A5/G5 subscription. Option B is wrong because sensors are installed on domain controllers, not on user workstations, as the sensor must capture domain-level network traffic and AD logs. Option D is wrong because Azure AD Connect is used for hybrid identity synchronization, not as a prerequisite for Defender for Identity deployment.

Practice this question →

296

MCQmedium

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP) to protect credit card numbers. You need to ensure that when a user attempts to share a document containing a credit card number via email, the email is blocked and the user receives a policy tip. Which action should you configure in the DLP policy?

A.Notify user

B.Audit only

C.Block with user notification

D.Block override

AnswerC

The "Block with user notification" action is a robust enforcement mechanism that actively prevents the sharing of sensitive information, such as blocking an email from being sent or a file from being shared. Simultaneously, it displays a policy tip to the end-user, clearly informing them why the action was blocked and providing guidance on how to comply with organizational policies or remediate the issue. This combination effectively enforces data protection while educating users on acceptable data handling practices.

Why this answer

In Microsoft Purview DLP, the 'Block with user notification' action sends a policy tip and blocks the email. 'Block override' allows override with justification. 'Audit only' logs without blocking. 'Notify user' sends an email but does not block. Option C is correct because it blocks the email and shows a policy tip.

Practice this question →

297

Multi-Selecthard

A SOC analyst is investigating a potential security incident in Microsoft Sentinel. Which three are valid methods to gather additional context about a user entity? (Choose three.)

Select 3 answers

A.Create an automation rule to assign the incident

B.Run an advanced hunting query in Microsoft 365 Defender

C.Open the entity page for the user in Microsoft Sentinel

D.Add the user to a watchlist

E.Run a playbook that queries external threat intelligence sources

AnswersB, C, E

Advanced hunting allows deep search across data sources.

Why this answer

Running an advanced hunting query in Microsoft 365 Defender allows the SOC analyst to proactively search for user-related activities, such as logins, alerts, and behaviors, across the Microsoft 365 security ecosystem. This provides deep, contextual data about the user entity that can help confirm or refute the incident, leveraging the Kusto Query Language (KQL) to correlate events from multiple data sources.

Exam trap

The trap here is that candidates may confuse operational actions (like assigning incidents or adding to watchlists) with investigative methods that actually retrieve or analyze user context, leading them to select options that manage incidents rather than gather evidence.

Practice this question →

298

MCQeasy

An organization uses Microsoft 365 Defender and wants to automate the investigation and response to common email-based phishing attacks. They want the system to automatically take actions such as deleting malicious emails from user inboxes across the organization after analysis. Which Microsoft 365 Defender component provides this automated capability?

A.Azure AD Identity Protection

B.Microsoft Defender for Office 365

C.Microsoft Defender for Endpoint

D.Microsoft Defender for Cloud Apps

AnswerB

Microsoft Defender for Office 365 is the correct solution because it provides advanced protection against sophisticated email and collaboration threats, including phishing, business email compromise, and malware delivered via email, Microsoft Teams, SharePoint, and OneDrive. It utilizes capabilities like Safe Attachments and Safe Links to scan content in real-time and includes automated investigation and response (AIR) for email-borne attacks, directly addressing the need to protect against email threats.

Why this answer

Microsoft Defender for Office 365 includes automated investigation and response (AIR) capabilities specifically designed for email-based threats like phishing. When a phishing email is detected, AIR can automatically trigger remediation actions—such as soft-deleting or hard-deleting the malicious message from user mailboxes—based on predefined playbooks, without requiring manual intervention.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Office 365 with Microsoft Defender for Endpoint, mistakenly thinking endpoint protection can handle email threats, but only Defender for Office 365 includes the email-specific automated investigation and response (AIR) engine.

Why the other options are wrong

Azure AD Identity Protection focuses on user identities and sign-in risks, not on email content or automated remediation of phishing emails in user mailboxes.

Microsoft Defender for Endpoint focuses on protecting devices (endpoints) from threats like malware and exploits, not on automating investigation and response to email-based phishing attacks, which is the domain of Defender for Office 365.

Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that focuses on securing cloud applications and services, not on automating investigation and response to email-based phishing attacks within Microsoft 365 Defender.

Practice this question →

299

MCQhard

Your organization, Contoso Ltd., has a hybrid environment with on-premises Active Directory and Microsoft Entra ID. You are deploying Microsoft Defender for Identity (MDI) to protect against identity-based attacks. You have installed the MDI sensor on domain controllers and configured the service with the necessary permissions. After installation, you notice that MDI is not generating alerts for pass-the-hash attacks. You have verified that the sensors are healthy and that audit policies are correctly configured. You need to ensure that MDI can detect pass-the-hash attacks. What should you do?

A.Enable password hash synchronization in Microsoft Entra Connect

B.Install the Azure ATP agent on all servers

C.Enable Kerberos event logging on domain controllers

D.Configure multi-factor authentication for all users

AnswerA

Enabling password hash synchronization in Microsoft Entra Connect is correct because it allows Microsoft Defender for Identity to analyze NTLM hashes and detect pass-the-hash attacks.

Why this answer

The current explanation states: "Enabling password hash synchronization (PHS) in Entra Connect allows MDI to analyze NTLM hashes and detect pass-the-hash attacks." This is incorrect. Password Hash Synchronization (PHS) is a method for synchronizing user password hashes from on-premises Active Directory to Microsoft Entra ID for cloud authentication purposes. MDI's detection of pass-the-hash attacks relies on monitoring NTLM authentication traffic and relevant security events on domain controllers, not on the hashes synchronized to Microsoft Entra ID via PHS. Therefore, enabling PHS does not enable or enhance MDI's ability to detect pass-the-hash attacks on-premises.

Option B is wrong because the MDI sensor is already installed on domain controllers, and installing it on all servers is not the specific missing step for pass-the-hash detection.

Option C is wrong because pass-the-hash attacks primarily leverage NTLM hashes, and while Kerberos logging is important for other attacks, it's not the primary mechanism for pass-the-hash detection. The stem also states audit policies are correctly configured.

Option D is wrong because multi-factor authentication is a preventative control that strengthens authentication; it does not enable MDI to detect pass-the-hash attacks. Given that the sensors are healthy and audit policies are correctly configured, none of the provided options directly address a common missing configuration for MDI to detect pass-the-hash attacks.

Practice this question →

300

MCQeasy

Your company uses Microsoft 365 E5 and wants to provide a unified security dashboard showing alerts from endpoints, email, identity, and cloud apps. Which solution should you use?

A.Microsoft Defender XDR portal (security.microsoft.com)

B.Microsoft Sentinel

C.Microsoft Intune admin center

D.Microsoft Purview Compliance Portal

AnswerA

The Microsoft Defender XDR portal, accessible at security.microsoft.com, is the centralized console for managing and responding to threats across an organization's entire digital estate. It provides a unified security dashboard by integrating signals from Microsoft Defender for Endpoint, Identity, Office 365, and Cloud Apps. This comprehensive view enables security analysts to correlate alerts, investigate incidents, and automate responses, making it the ideal solution for a unified security experience within Microsoft 365 E5.

Why this answer

Microsoft Defender XDR portal (security.microsoft.com) aggregates alerts from endpoints (Microsoft Defender for Endpoint), email (Microsoft Defender for Office 365), identity (Microsoft Defender for Identity), and cloud apps (Microsoft Defender for Cloud Apps) into a single unified dashboard. This is the correct solution because it provides cross-domain correlation and a centralized view of security incidents across these Microsoft 365 E5 workloads without requiring additional licensing or data ingestion.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel (a SIEM) with Microsoft Defender XDR (a unified security operations platform), but Sentinel is for ingesting third-party and custom logs, whereas Defender XDR natively aggregates alerts from Microsoft 365 E5 workloads without extra licensing or setup.

How to eliminate wrong answers

Option B is wrong because Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) solution that ingests logs from multiple sources, but it requires additional licensing and configuration to collect and correlate alerts; it is not a pre-built unified dashboard for Microsoft 365 E5 native alerts. Option C is wrong because the Microsoft Intune admin center focuses on endpoint management, device compliance, and mobile device management (MDM), not on aggregating security alerts from email, identity, and cloud apps. Option D is wrong because the Microsoft Purview Compliance Portal is designed for data governance, compliance management, and eDiscovery, not for real-time security alert correlation across endpoints, email, identity, and cloud apps.

Practice this question →