Hard Difficulty Questions

Data Lifecycle Management

Why wrong: Data Lifecycle Management handles retention and deletion of content, not compliance scoring or evidence collection.

Insider Risk Management

Why wrong: Insider Risk Management detects and investigates risky user behavior, not compliance scoring or recommendations.

Microsoft Defender for Endpoint

Why wrong: Incorrect. Defender for Endpoint protects endpoints from malware and attacks but does not manage OAuth app permissions in cloud apps.

Microsoft Defender for Office 365

Why wrong: Incorrect. Defender for Office 365 protects against threats in email, Teams, and SharePoint, but does not cover third-party cloud apps like Salesforce.

Microsoft Sentinel

Why wrong: Incorrect. Sentinel is a SIEM that can ingest logs from various sources and create detection rules, but it does not have built-in OAuth app governance policies.

Microsoft Defender for Cloud Apps

Why wrong: Defender for Cloud Apps focuses on monitoring and controlling cloud application usage, not on-premises Active Directory attacks.

Microsoft Defender for Endpoint

Why wrong: Defender for Endpoint provides endpoint detection and response (EDR) for devices, not specialized protection for on-premises AD identity attacks.

Microsoft Defender for Office 365

Why wrong: Defender for Office 365 protects against threats in email and Office applications, not against on-premises Active Directory attacks.

Network segmentation

Why wrong: Incorrect. While network segmentation is a technique used to support the 'Assume breach' principle, it is not one of the three core guiding principles of Zero Trust.

Dynamic groups

Why wrong: Dynamic groups automatically add or remove members based on rules but do not delegate administrative scopes to specific users.

Conditional Access policies

Why wrong: Conditional Access policies enforce access controls during sign-in but do not delegate administrative permissions to manage users.

Privileged Identity Management (PIM)

Why wrong: PIM provides time-based and approval-based role activation but does not restrict the management scope to a specific department.

Microsoft Purview Retention Labels with a disposition review that requires manual approval at the end of the retention period

Why wrong: A disposition review with manual approval does not guarantee automatic deletion; it would require someone to manually approve each item.

Microsoft Purview Retention Policy with a record label to mark items as regulatory records

Why wrong: Marking items as regulatory records makes them immutable and prevents modification or deletion, even after the retention period, so automatic deletion would not occur.

Microsoft Purview eDiscovery with a hold policy to preserve the documents indefinitely

Why wrong: eDiscovery hold is for preserving data for legal investigations; it does not enforce a retention period with automatic deletion.

Microsoft is responsible because they provide the cloud service and must protect against all threats.

Why wrong: Microsoft secures the cloud infrastructure, but the customer is accountable for their own accounts and devices.

Both Microsoft and the customer share equal responsibility for all layers of the service.

Why wrong: Responsibility is split: Microsoft for infrastructure (physical, network, host), customer for their own data, identities, and devices.

Neither party is responsible because the employee bypassed security controls.

Why wrong: The employee may have made an error, but overall accountability for endpoint and identity security lies with the customer organization.

Microsoft 365 Defender

Why wrong: Incorrect: Microsoft 365 Defender provides a unified incident detection and response experience across endpoints, email, identity, and cloud apps, but it does not offer real-time session control for third-party SaaS apps.

Microsoft Sentinel

Why wrong: Incorrect: Sentinel is a cloud-native SIEM for collecting and analyzing security telemetry; it does not have the capability to intervene in live user sessions.

Microsoft Defender for Endpoint

Why wrong: Incorrect: Defender for Endpoint secures devices (endpoints) but cannot control user actions within a web browser session for a SaaS application.

Provisioning

Why wrong: Provisioning refers to creating, managing, and deactivating user accounts and access rights, not the trust relationship that enables SSO.

Synchronization

Why wrong: Synchronization replicates user objects and attributes between directories (e.g., AD DS to Microsoft Entra ID), but it does not provide the trust for SSO using an external IdP.

Directory extension

Why wrong: Directory extension allows adding custom attributes to directory objects in Microsoft Entra ID, which is unrelated to SSO or federation trust.

Insider Risk Management

Why wrong: Incorrect. Insider Risk Management focuses on detecting risky user activities (e.g., data theft, leaks) using machine learning, but it is not primarily designed for communication monitoring and review.

Information Barriers

Why wrong: Incorrect. Information Barriers are used to prevent communication and collaboration between certain groups (e.g., to avoid conflicts of interest). They do not monitor or review communications for policy violations.

Audit (Standard or Premium)

Why wrong: Incorrect. Audit provides logging of user and admin activities but lacks built-in policy violation detection or review workflows. It is used for investigation after an incident, not proactive monitoring.

Microsoft Purview Audit

Why wrong: Audit provides activity logs but does not automatically detect or escalate risky patterns; it requires manual investigation.

Microsoft Purview Communication Compliance

Why wrong: Communication Compliance monitors inappropriate or policy-violating messages (e.g., harassment, financial misconduct), not general data copying or sharing activities.

Microsoft Purview Compliance Manager

Why wrong: Compliance Manager helps track compliance posture against standards but does not detect or investigate risky user activities.

Configuring the firewall rules for the web application

Why wrong: Firewall rules for the web application (e.g., Azure App Service access restrictions) are customer-managed to control inbound and outbound traffic.

Managing user access to the application

Why wrong: User authentication and authorization are application-level responsibilities managed by the customer using Microsoft Entra ID or other identity systems.

Encrypting the application data at rest in Azure SQL Database

Why wrong: While Microsoft provides transparent data encryption (TDE) for Azure SQL Database, the customer can choose to use it and manage encryption keys, making encryption at rest a shared or customer responsibility depending on configuration.

Applying operating system patches to the virtual machines running the App Service

Why wrong: Incorrect. In PaaS like Azure App Service, the platform (including OS) is maintained by Microsoft, so patching is not the customer's responsibility.

Configuring network security groups to filter traffic to the App Service

Why wrong: Incorrect. While customers can configure IP restrictions, the underlying network security groups and infrastructure are managed by Microsoft, so this is not fully under the customer's scope.

Ensuring physical security of the Azure data centers

Why wrong: Incorrect. Physical security of data centers is always the responsibility of the cloud provider, not the customer.

Microsoft Defender for Cloud

Why wrong: Defender for Cloud is a separate service for cloud infrastructure security and is not part of Microsoft 365 Defender.

Microsoft Sentinel

Why wrong: Sentinel is a cloud-native SIEM, not a component of Microsoft 365 Defender. It can integrate with Microsoft 365 Defender but is separate.

Identification and authorization

Why wrong: Identification is simply claiming an identity (e.g., by providing a username). The smart card and PIN are used to prove identity (authentication), not just claim it.

Authentication and accounting

Why wrong: Accounting tracks user activities for auditing or billing purposes. The scenario focuses on access control, not tracking.

Identification and authentication

Why wrong: While both identification and authentication occur, the scenario also includes authorization. The denial of access is an authorization decision, so the full set of concepts is authentication and authorization.

Assume breach

Why wrong: Assume breach focuses on minimizing impact by segmenting networks, monitoring for lateral movement, and using analytics. It does not describe the authentication/authorization requirement.

Use least privileged access

Why wrong: Use least privileged access is another principle that focuses on limiting access to the minimum necessary, but it does not cover the initial authentication and authorization step.

Segment access

Why wrong: Segment access is part of Zero Trust but is more about network segmentation and micro-segmentation, not the explicit verification of every request.

Microsoft Defender for Cloud

Why wrong: Defender for Cloud is for securing cloud workloads (VMs, databases) with posture management and threat detection; it does not discover or assess cloud apps.

Microsoft Defender for Endpoint

Why wrong: Defender for Endpoint protects devices from malware and attacks; it does not discover cloud apps.

Microsoft Purview Data Loss Prevention (DLP)

Why wrong: DLP can prevent data leakage but does not discover shadow IT or assess risk of cloud apps.

Secure score

Why wrong: Secure score measures overall security posture based on security recommendations, but does not directly evaluate against specific regulatory frameworks like HIPAA or HITRUST.

Microsoft Defender for Cloud Apps

Why wrong: Defender for Cloud Apps is a CASB (Cloud Access Security Broker) focused on SaaS applications, not on Azure or on-premises infrastructure compliance.

Microsoft Defender for Servers

Why wrong: Defender for Servers is a plan that provides enhanced security features for servers, such as file integrity monitoring and just-in-time access, but does not include the regulatory compliance dashboard.

Physical security of the datacenter hosting the App Service

Why wrong: Physical security of datacenters is always the responsibility of the cloud provider (Microsoft), regardless of the service model.

Patching the operating system of the App Service host machines

Why wrong: For PaaS, Microsoft manages the underlying host OS and automatically applies patches. The customer does not have access to the host OS.

Network security for the Azure backbone connecting datacenters

Why wrong: Network security for the Azure backbone and physical network infrastructure is managed by Microsoft. The customer is responsible for configuring network security groups (NSGs) and application security policies.

Confidentiality, achieved through encryption

Why wrong: Encryption protects data from unauthorized access but does not prove who sent the data; it addresses confidentiality.

Integrity, achieved through hashing

Why wrong: Hashing ensures data has not been altered but does not link the signature uniquely to the sender, so it does not prevent denial of sending.

Access control, achieved through permissions

Why wrong: Access control determines who can read or write data but does not provide a mechanism to prove that a specific action occurred.