Select Two (Multi-Select) Questions

Single sign-on (SSO)

Why it fails: Single sign-on (SSO) is a valuable identity management feature that streamlines user authentication by allowing access to multiple applications with one set of credentials. However, SSO itself is not a core Zero Trust principle; it primarily enhances user experience and can improve security by reducing password fatigue. Zero Trust demands continuous, explicit verification and granular authorization for every access request, which goes beyond the initial authentication facilitated by SSO.

Network perimeter security

Why it fails: Network perimeter security, which relies on a strong boundary to protect an assumed-trusted internal network, is fundamentally at odds with Zero Trust principles. Zero Trust explicitly rejects the concept of a trusted network segment, treating all network traffic and access requests, whether originating internally or externally, as untrusted. It mandates explicit verification for every access attempt, regardless of its network origin, thereby eliminating reliance on a traditional perimeter.

Searching for content in eDiscovery

Why it fails: Searching for content in eDiscovery is a capability of Microsoft Purview eDiscovery, which is a distinct solution within the broader Microsoft Purview compliance suite. While eDiscovery tools are integrated under the Purview umbrella, the specific function of performing content searches for legal or investigative purposes is handled by the specialized eDiscovery components, not by the core information protection features often associated with the general term "Microsoft Purview."

Preventing data loss via policies

Why it fails: Preventing data loss via policies is the primary function of Microsoft Purview Data Loss Prevention (DLP), a dedicated solution within the Microsoft Purview compliance portfolio. DLP policies are designed to identify, monitor, and automatically protect sensitive information across various locations and applications, actively preventing its unauthorized sharing or exfiltration. This is distinct from the classification and protection capabilities offered by Purview Information Protection.

Setting retention periods for content

Why it fails: Setting retention periods for content is a core capability of Microsoft Purview Data Lifecycle Management (DLM), which utilizes retention labels and policies to govern how long data is kept and when it should be deleted. DLM ensures compliance with regulatory requirements and organizational policies by managing the entire lifecycle of data. This function is separate from the classification and protection mechanisms provided by Purview Information Protection.

Communication monitoring

Why it fails: Communication monitoring is a core capability within Microsoft Purview Communication Compliance, a distinct solution focused on detecting and acting on inappropriate or risky communications within an organization. It utilizes AI and machine learning to identify policy violations like harassment, threats, or regulatory non-compliance in email, Teams chats, and other communication channels. This differs from Information Protection, which primarily deals with classifying and protecting the inherent sensitivity of data itself, rather than monitoring user communication content for behavioral risks.

Retention policies

Why it fails: Retention policies are a fundamental component of Microsoft Purview Data Lifecycle Management, which governs how long data is kept or deleted to meet regulatory, legal, and business requirements. These policies ensure data is retained for necessary periods and then disposed of appropriately, managing its entire lifecycle. While crucial for compliance, retention policies focus on the longevity and eventual disposition of data, whereas Information Protection is concerned with identifying, classifying, and applying protective measures to sensitive data at any point in its lifecycle.

Audit log investigation

Why it fails: Audit log investigation is a key function of Microsoft Purview Audit, a separate solution designed to provide a comprehensive record of user and administrator activities across Microsoft 365 services. Its primary purpose is to support forensic investigations, compliance reviews, and security monitoring by tracking actions performed on data and configurations. While essential for accountability and incident response, audit log investigation does not directly classify or apply protective measures to sensitive information, which is the domain of Information Protection.

Audit

Why it fails: Microsoft Purview Audit provides comprehensive logging of user and administrator activities across Microsoft 365 services, including file access, mailbox actions, and administrative changes. While essential for forensic investigations, compliance reporting, and understanding data usage patterns, Audit is a reactive tool that records events after they occur. It does not proactively prevent data loss or unauthorized access, making it distinct from direct data protection solutions.

eDiscovery

Why it fails: Microsoft Purview eDiscovery solutions are designed to identify, preserve, collect, process, review, and produce electronically stored information (ESI) in response to legal or regulatory requests. Its primary function is to facilitate legal discovery processes by efficiently managing and presenting relevant data. While it deals with sensitive data, eDiscovery is an investigative and legal response tool, not a proactive mechanism for preventing data loss or unauthorized disclosure.

Mobile device management

Why it fails: Mobile Device Management (MDM), which encompasses the enrollment, configuration, and security management of mobile devices like smartphones and tablets, is a core service provided by Microsoft Intune. Microsoft Defender for Endpoint, while protecting devices from threats, does not directly handle the lifecycle management, policy deployment, or application management aspects that are central to MDM capabilities.

Device compliance enforcement

Why it fails: Device compliance enforcement, which involves assessing whether devices meet specific organizational security standards (e.g., OS version, encryption status, antivirus presence) before granting access to resources, is primarily a function of Microsoft Intune. Intune evaluates device health against defined policies, and Microsoft Entra Conditional Access then leverages this compliance status to enforce access controls, rather than being a direct capability of Microsoft Defender.

Email filtering and anti-phishing

Why it fails: Email filtering and advanced anti-phishing capabilities, designed to protect against malicious attachments, suspicious links, and sophisticated phishing campaigns delivered via email, are core functionalities of Microsoft Defender for Office 365. While Microsoft Defender for Endpoint protects devices from threats that might originate from email, it does not directly perform the initial filtering, analysis, and remediation of incoming mail flow.

Identity Protection

Why it fails: Microsoft Entra Identity Protection is a security feature focused on detecting and remediating identity-based risks, such as compromised credentials, suspicious sign-ins, and anomalous user behavior. While vital for securing identities, its primary function is threat detection and response, not the systematic management, review, or certification of access entitlements. It acts as a real-time security layer rather than a governance tool for access lifecycle management.

Conditional Access

Why it fails: Microsoft Entra Conditional Access is a policy engine that enforces access controls by evaluating specific conditions at the time of a sign-in attempt. It determines whether a user is granted, blocked, or challenged for access based on factors like user location, device compliance, or application sensitivity. While critical for enforcing security policies, it dictates how access is granted or denied in real-time, rather than managing who should have what access over time as part of an identity governance framework.

Self-Service Password Reset

Why it fails: Self-Service Password Reset (SSPR) in Microsoft Entra ID empowers users to securely reset their forgotten or expired passwords without requiring administrator intervention. This feature significantly enhances user productivity and reduces the burden on IT help desks by automating a common support request. However, SSPR is specifically designed for managing the password lifecycle and user convenience, and it does not encompass the broader scope of identity governance, which involves managing access entitlements, roles, and resource provisioning.

Communication compliance

Why it fails: Microsoft Purview Communication Compliance is primarily used to help organizations detect, investigate, and act on inappropriate messages in their internal and external communications. While it monitors content for policy violations related to harassment, threats, or regulatory compliance, its core function is not to identify specific sensitive data patterns for protection. Instead, it focuses on user conduct and communication content types rather than applying direct data protection measures.

Insider risk management

Why it fails: Microsoft Purview Insider Risk Management helps organizations identify, analyze, and act on internal risks, such as data theft or data leakage, by monitoring user activities. It focuses on detecting risky user behaviors that could lead to data exposure, rather than directly identifying and protecting sensitive data itself. While it can help mitigate data loss by addressing user actions, it does not classify or apply protective measures to the data content.

eDiscovery

Why it fails: Microsoft Purview eDiscovery solutions are designed to identify, preserve, collect, process, review, and analyze electronically stored information (ESI) for legal or investigative purposes. Its primary role is to facilitate the discovery process in litigation or regulatory inquiries by searching for and exporting relevant content. It does not proactively identify sensitive data for protection or apply any protective measures to the data it discovers.

Review communications for policy violations

Why it fails: While reviewing communications for policy violations is a critical compliance function within Microsoft Purview, it is primarily handled by the dedicated Communication Compliance solution. This specialized service focuses on detecting and remediating inappropriate content, harassment, or regulatory policy breaches within internal and external communications, distinct from the user behavior analytics employed by Insider Risk Management for anomalous activity detection.

Conduct eDiscovery searches for legal cases

Why it fails: Conducting eDiscovery searches for legal cases is a distinct and specialized capability within Microsoft Purview, specifically managed by the eDiscovery (Standard) and eDiscovery (Premium) solutions. These tools are designed for identifying, preserving, collecting, processing, reviewing, and analyzing electronically stored information (ESI) for legal and investigative purposes, rather than the ongoing risk detection and behavioral analytics provided by other Purview services.

Block sharing of sensitive data via email

Why it fails: Blocking the sharing of sensitive data via email is a core function of Microsoft Purview's Data Loss Prevention (DLP) solution. DLP policies are configured to automatically identify, monitor, and protect sensitive information across various locations, including email, by preventing its unauthorized sharing based on predefined rules and content matching, which is an enforcement action distinct from merely identifying anomalous user activities.

Hunting rules

Why it fails: Hunting rules are not a distinct, automated rule type for threat detection within Microsoft Sentinel's analytics engine. Instead, "Hunting" refers to the proactive, manual exploration of security data by analysts using KQL queries to uncover novel or subtle threats that automated rules might miss. While a successful hunting query can be subsequently converted into a scheduled analytics rule, hunting itself is a human-driven investigative activity, not an automated detection mechanism.

Machine learning rules

Why it fails: "Machine learning rules" are not a standalone, configurable rule type that users directly create or manage within Microsoft Sentinel's analytics blade. While machine learning capabilities are an integral underlying technology for advanced detection mechanisms like Fusion rules, and some built-in analytics rules might utilize ML models internally, users do not define or deploy a category of rules explicitly labeled as "machine learning rules" alongside scheduled or NRT rules.

SMS-based verification

Why it fails: SMS-based verification is not a passwordless authentication method because it functions as a second factor, requiring a primary credential like a password first. Users still enter their password, then receive a one-time code via text message to confirm their identity. While it enhances security as multi-factor authentication, it does not replace the initial password requirement, making it unsuitable for passwordless scenarios.

Time-based one-time password (TOTP)

Why it fails: Time-based one-time passwords (TOTP) are not a passwordless authentication method; they serve as a second factor in multi-factor authentication. A TOTP code, generated by an authenticator app, is typically entered *after* a user provides their primary credential, such as a password. While providing an additional layer of security by requiring something the user has, TOTP does not eliminate the need for the initial password, distinguishing it from truly passwordless solutions.

Identity Protection

Why it fails: Identity Protection is a distinct feature of Microsoft Entra ID (formerly Azure AD) focused on detecting and remediating identity-based risks for user accounts within the Entra ID tenant. It identifies threats such as impossible travel, leaked credentials, and anomalous sign-in activities to protect user identities. While critical for overall security, it is not a direct component of Microsoft Entra Permissions Management, which is a Cloud Infrastructure Entitlement Management (CIEM) solution for managing permissions across multi-cloud infrastructure.

Access reviews

Why it fails: Access reviews are a core capability within Microsoft Entra ID Governance, designed to periodically evaluate and certify user access to groups, applications, and roles within an organization's Entra ID tenant. They ensure that users only retain access necessary for their current roles, helping to enforce the principle of least privilege over time. However, access reviews are a feature of Entra ID Governance, not an integral component of Microsoft Entra Permissions Management, which specializes in discovering, remediating, and monitoring permissions across multi-cloud infrastructure.

Retention label

Why it fails: A retention label is designed to manage the lifecycle of information, dictating how long content should be kept or when it should be deleted to meet regulatory or organizational requirements. Unlike sensitivity labels, which classify data based on its inherent sensitivity and apply protective actions, retention labels do not assess or apply protection based on the content's confidential nature. Therefore, a retention label would not be used to identify or apply sensitivity-based protection to documents containing passport numbers.

Data loss prevention (DLP) policy

Why it fails: A Data Loss Prevention (DLP) policy primarily focuses on preventing the unauthorized sharing, transfer, or exfiltration of sensitive information outside defined boundaries. While DLP policies can detect sensitive information types and *act* upon content that has a sensitivity label, their core function is to enforce protective actions like blocking, auditing, or notifying, rather than automatically *applying* sensitivity labels to documents. DLP policies operate on content *after* it has been created or is in transit, not as a primary mechanism for initial content classification and labeling.

Trainable classifier

Why it fails: A trainable classifier is an advanced machine learning tool used to identify types of content based on examples, rather than precise pattern matching. It is effective for classifying subjective or complex content categories, such as "resumes," "contracts," or "financial statements," where exact patterns are difficult to define. However, for highly structured and specific data like passport numbers, which follow a predictable pattern, a trainable classifier is less suitable and less efficient than a precise Sensitive Information Type.

Identity Protection

Why it fails: Microsoft Entra ID Protection is a monitoring and reporting tool that detects potential identity-based risks, such as leaked credentials or anomalous sign-ins, and can trigger automated responses. While it identifies risky users or sign-ins, it does not directly enforce multifactor authentication; instead, it feeds risk signals into Conditional Access policies, which then apply the enforcement.

Security defaults

Why it fails: Security defaults provide a baseline level of security for all organizations, automatically enabling multifactor authentication for administrative roles and requiring all users to register for MFA. While it enforces MFA, it is a simplified, "all-or-nothing" approach designed for ease of use and cannot be combined with or customized by Conditional Access policies; it's an alternative, less granular enforcement mechanism.

Password protection

Why it fails: Microsoft Entra ID Password Protection is a feature designed to prevent users from creating or using weak, commonly compromised, or custom-banned passwords within the organization. Its sole focus is on strengthening password hygiene by blocking specific password choices, and it has no direct functionality related to enforcing or managing multifactor authentication.

Passwordless authentication

Why it fails: Passwordless authentication, while enhancing security by eliminating passwords and reducing the attack surface for credential theft, is fundamentally an authentication method provided by Microsoft Entra ID. It allows users to sign in using methods like Windows Hello for Business, Microsoft Authenticator, or FIDO2 security keys. Microsoft Entra ID Protection, however, focuses on detecting, reporting, and automatically remediating identity-based risks, rather than offering specific authentication mechanisms.

Just-in-time privileged access

Why it fails: Just-in-time (JIT) privileged access is a core capability of Microsoft Entra Privileged Identity Management (PIM), designed to minimize the exposure time of privileged roles. PIM allows eligible users to activate administrative roles for a limited, predefined period, reducing the window for potential abuse or compromise. Microsoft Entra ID Protection, conversely, focuses on detecting identity-based risks and vulnerabilities, not on managing the temporary elevation of privileges.

Conditional access policies for device compliance

Why it fails: Conditional Access policies for device compliance ensure that only devices meeting specific security standards, often managed by Microsoft Intune, can access corporate resources. This capability is a fundamental aspect of Microsoft Entra Conditional Access itself, leveraging device state as a condition. While crucial for overall security, it operates independently of Microsoft Entra ID Protection's primary function, which is to detect and respond to identity-based risks like compromised credentials or unusual sign-in patterns.

Communication Compliance

Why it fails: Microsoft Purview Communication Compliance is designed to help organizations detect, investigate, and act on inappropriate messages in their internal and external communications, often related to regulatory compliance or conduct policies. While it monitors content for policy violations and behavioral risks, it does not directly apply protective measures like encryption, access controls, or data loss prevention to safeguard the data itself from unauthorized sharing or exfiltration. Its focus is on monitoring and remediation of communication content, not direct data protection.

eDiscovery

Why it fails: Microsoft Purview eDiscovery solutions are primarily used to identify, preserve, collect, process, review, and analyze electronically stored information (ESI) for legal or investigative matters. Although it deals with sensitive data, its purpose is to facilitate the legal discovery process by making data available and manageable for litigation or investigations. It does not proactively apply protective controls such as encryption, access restrictions, or data loss prevention policies to prevent unauthorized access or sharing of data.

Insider Risk Management

Why it fails: Microsoft Purview Insider Risk Management is designed to detect, investigate, and act on potentially malicious or inadvertent activities by internal users that could lead to data leakage or theft. It leverages signals from Microsoft 365 and other services to identify risky user behaviors and patterns. While it helps mitigate insider threats by providing investigative tools and actionable insights, its primary function is risk detection and management, not the direct application of protective controls like encryption or access policies to the data itself.

Data loss prevention

Why it fails: Data loss prevention (DLP) is a distinct solution within Microsoft Purview focused on identifying, monitoring, and protecting sensitive information from unauthorized sharing or transfer. While DLP is part of the broader Purview suite, its primary function is to prevent data exfiltration and misuse, rather than managing the lifecycle (retention, deletion, disposition) of data over time. Therefore, it is not considered a feature of Microsoft Purview Data Lifecycle Management, which specifically addresses retention and deletion.

Sensitivity labels

Why it fails: Sensitivity labels are a fundamental component of Microsoft Purview Information Protection, designed to classify and protect sensitive data by applying encryption, visual markings, and access restrictions. While they can trigger retention actions when published as part of a retention label, their primary role is data classification and protection, not the direct management of data retention or deletion throughout its lifecycle. Thus, sensitivity labels themselves are not a direct feature of Data Lifecycle Management.

Data Loss Prevention policies

Why it fails: Data Loss Prevention (DLP) policies are designed primarily to prevent the unauthorized sharing or exfiltration of sensitive information. While DLP policies can identify sensitive data based on specific criteria, their core function is to enforce protective actions like blocking, auditing, or notifying, rather than applying a persistent classification label or metadata to the content itself for ongoing management or categorization.

Retention policies

Why it fails: Retention policies in Microsoft Purview are used to manage the lifecycle of data by defining how long content should be kept or deleted to meet regulatory, legal, or business requirements. Although these policies can be applied to content that has already been classified, their purpose is focused on data governance (retention and deletion schedules), not the initial act of identifying, categorizing, or assigning a classification level to the data itself.

Audit policies

Why it fails: Audit policies are designed to record user and administrator activities across various Microsoft 365 services, providing a comprehensive log for security investigations, compliance adherence, and forensic analysis. Their function is to track and report on 'who did what, when, and where' with data, rather than to identify, categorize, or apply classification metadata to the content itself. Therefore, they do not directly contribute to data classification.

Allow only signed executables

Why it fails: "Allow only signed executables" describes a function of application control policies, such as Windows Defender Application Control (WDAC) or AppLocker, rather than an Attack Surface Reduction (ASR) rule. Application control explicitly defines which applications are permitted to run based on criteria like digital signatures, publishers, or file paths, providing a strict allowlist. ASR rules, conversely, focus on blocking specific malicious behaviors or actions performed by legitimate applications.

Block inbound connections from the internet

Why it fails: "Block inbound connections from the internet" is a fundamental capability of a network firewall, such as Windows Defender Firewall, not an Attack Surface Reduction (ASR) rule. Firewalls operate at the network layer, controlling traffic flow based on ports, protocols, and IP addresses to prevent unauthorized access. ASR rules, in contrast, operate at the endpoint level, focusing on the behavior of applications and scripts to prevent common attack techniques.

Block untrusted fonts

Why it fails: "Block untrusted fonts" is a specific operating system hardening feature, often managed through Group Policy or MDM, designed to mitigate vulnerabilities in font parsing that attackers could exploit. While it enhances security, it is not categorized as an Attack Surface Reduction (ASR) rule. ASR rules specifically target common attack vectors by preventing applications from performing suspicious actions, whereas font blocking addresses a particular class of software vulnerability.

Entra Verified ID

Why it fails: Microsoft Entra Verified ID enables organizations to issue and verify digital verifiable credentials, allowing individuals to prove their identity or attributes in a privacy-preserving manner. While it enhances trust in identity verification, it does not directly provide risk detection or policy enforcement capabilities based on user or sign-in risk levels. Its primary function is credential management and verification, not dynamic risk-based access control.

Self-Service Password Reset

Why it fails: Microsoft Entra Self-Service Password Reset (SSPR) allows users to reset their forgotten or locked passwords without administrator intervention, typically by verifying their identity through pre-registered authentication methods. While it improves user productivity and reduces helpdesk calls, SSPR is a specific feature for password management and does not contribute to detecting identity risks or enforcing access policies based on those risks.

Privileged Identity Management

Why it fails: Microsoft Entra Privileged Identity Management (PIM) enables organizations to manage, control, and monitor access to important resources by providing just-in-time and just-enough access to privileged roles. It helps reduce the exposure time of privileges, but its core function is privilege governance and auditing, not the real-time detection of user or sign-in risk to dynamically adjust access policies.

An employee uses their Microsoft Entra ID to sign in to a third-party SaaS application.

Why it fails: This describes a standard Single Sign-On (SSO) implementation for internal employees, leveraging Microsoft Entra ID as the identity provider for third-party SaaS applications. While it uses Microsoft Entra ID for authentication, it does not involve inviting external users or managing guest accounts for cross-organizational collaboration. Instead, it streamlines access for an organization's own workforce to applications outside its direct control.

Two internal departments share resources within the same tenant.

Why it fails: Sharing resources between internal departments within the same Microsoft Entra tenant is a fundamental aspect of internal access management, not B2B collaboration. All users involved are employees of the same organization, with their identities already managed within the single Microsoft Entra directory. This process relies on internal group memberships, permissions, and access policies, without the need for external identity federation or guest accounts.

Customers use their Facebook accounts to sign in to a company's web application.

Why it fails: This scenario describes Microsoft Entra B2C (Business-to-Consumer), which is designed for managing customer identities and access to consumer-facing applications. B2C allows customers to sign in using social identity providers like Facebook or by creating local accounts. This differs fundamentally from B2B, which focuses on inviting users from other organizations' directories for business collaboration, rather than managing individual consumer accounts.