Courseiva

CCNA Ms Security Capabilities Questions

75 of 413 questions · Page 1/6 · Ms Security Capabilities topic · Answers revealed

Practice these questionsExam hubAll questions
1
MCQmedium

A company uses Microsoft 365 and wants to protect its users from malicious links and attachments in email, as well as phishing attacks. Which Microsoft security solution is specifically designed for email and collaboration protection?

A.Microsoft Defender for Endpoint
B.Microsoft Defender for Office 365
C.Microsoft Defender for Cloud Apps
D.Microsoft Defender for Identity
AnswerB

Microsoft Defender for Office 365 is specifically designed to protect Microsoft 365 services, including email, Teams, and SharePoint Online, from advanced threats. It provides robust capabilities like Safe Attachments, which detonates suspicious attachments in a sandbox environment, and Safe Links, which rewrites and scans URLs at the time of click to prevent access to malicious websites, directly addressing the need for protection against malicious links and attachments in email.

Why this answer

Microsoft Defender for Office 365 (formerly Office 365 Advanced Threat Protection) is the dedicated security solution for email and collaboration workloads. It provides protection against malicious links (Safe Links), malicious attachments (Safe Attachments), and anti-phishing policies specifically for Exchange Online, SharePoint, OneDrive, and Teams. This directly matches the question's requirement for email and collaboration protection.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Endpoint (device protection) with Microsoft Defender for Office 365 (email and collaboration protection), because both names start with 'Microsoft Defender' and both involve threat detection, but they protect completely different attack surfaces.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Endpoint is designed for endpoint devices (Windows, macOS, Linux, Android, iOS) and focuses on preventing, detecting, and responding to threats on those devices, not on email or collaboration content. Option C is wrong because Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility, data loss prevention, and threat protection for cloud applications (e.g., Shadow IT discovery), not specifically for email and collaboration protection. Option D is wrong because Microsoft Defender for Identity is an on-premises Active Directory security solution that uses signals to detect advanced attacks like Pass-the-Hash and Kerberos Golden Ticket attacks, not email or collaboration threats.

Practice this question →
2
MCQhard

You are a security administrator for Contoso Ltd., which uses Microsoft 365 E5. The company has 10,000 users and uses Microsoft Entra ID for identity. The security team has noticed an increase in sign-in attempts from anonymous IP addresses and from locations outside the company's home country. They want to implement a solution that automatically blocks sign-ins from anonymous IP addresses and requires MFA for sign-ins from outside the home country. They also want to ensure that if a user's risk level is high, they are forced to change their password. The solution must use Microsoft Entra ID Protection and Conditional Access. You have already configured a Conditional Access policy to require MFA for all users. Which of the following is the most efficient way to meet all requirements with minimal administrative overhead?

A.Configure Identity Protection sign-in risk policy to block anonymous IP addresses, user risk policy to require password change for high-risk users, and create a Conditional Access policy to require MFA for sign-ins from outside the home country.
B.Create a single Conditional Access policy that blocks anonymous IP addresses, requires MFA based on location, and forces password change for high-risk users.
C.Configure Identity Protection to block anonymous IP addresses and require password change for high-risk users. Use Conditional Access to block sign-ins from outside the home country.
D.Configure Identity Protection to block anonymous IP addresses and require password change for high-risk users. Use Conditional Access to require MFA for all users.
AnswerA

This meets all requirements: anonymous IP blocked via risk policy, password change via user risk policy, location-based MFA via Conditional Access.

Why this answer

A is correct. Identity Protection sign-in risk policies can detect and block sign-ins from anonymous IP addresses. User risk policies can require a password change for high-risk users.

Conditional Access policies can enforce MFA based on location (e.g., outside home country). Option B is incorrect because a single Conditional Access policy cannot directly detect anonymous IP addresses (this is only available through Identity Protection). Option C is incorrect because it blocks sign-ins from outside the home country instead of requiring MFA.

Option D is incorrect because it uses Conditional Access to require MFA for all users, which is already done by the existing policy, and it does not specifically enforce MFA for outside home country; also, requiring MFA for all users adds unnecessary friction. The most efficient method to meet all requirements with minimal administrative overhead is to combine Identity Protection risk policies for anonymous IP and high risk, and create a separate Conditional Access policy for location-based MFA, as in option A.

Practice this question →
3
MCQmedium

Your organization uses Microsoft Defender for Cloud Apps to monitor cloud app usage. You discover that a user is accessing a sanctioned app from an unmanaged device. You need to ensure that when users access this app from unmanaged devices, they are prompted for additional authentication and their session is monitored. What should you configure?

A.Enable Microsoft Entra ID Identity Protection and configure a sign-in risk policy.
B.Create a Conditional Access policy that requires device compliance and block access for non-compliant devices.
C.Create a session policy in Microsoft Defender for Cloud Apps that blocks downloads for all devices.
D.Create a Conditional Access policy that uses the 'Require session control' grant and target 'All cloud apps' and 'Unmanaged devices' as conditions.
AnswerD

Creating a Conditional Access policy that uses the 'Require session control' grant and targets 'All cloud apps' and 'Unmanaged devices' as conditions is the correct approach. This configuration seamlessly integrates Microsoft Entra Conditional Access with Microsoft Defender for Cloud Apps (MDCA), routing sessions from unmanaged devices through MDCA's reverse proxy. This allows MDCA to apply granular, real-time session controls, such as blocking downloads, restricting copy-paste, or enforcing read-only access, specifically for those less trusted sessions while still permitting access to the cloud applications.

Why this answer

You need to use a Conditional Access policy with the 'Require session control' grant, targeting 'All cloud apps' and 'Unmanaged devices' as conditions. This integrates with Microsoft Defender for Cloud Apps to enforce additional authentication (via Microsoft Entra ID) and enable session monitoring, such as real-time activity logging and download blocking, for the sanctioned app when accessed from unmanaged devices.

Exam trap

The trap here is confusing session control (which allows conditional access with monitoring) with device compliance policies (which block or allow based on device state) or Identity Protection (which focuses on risk-based sign-in detection).

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Identity Protection's sign-in risk policy detects risky sign-ins (e.g., anonymous IP addresses) but does not specifically target unmanaged devices or provide session monitoring for cloud apps. Option B is wrong because requiring device compliance and blocking non-compliant devices would deny access entirely, not prompt for additional authentication and monitor the session as required. Option C is wrong because a session policy in Defender for Cloud Apps that blocks downloads for all devices does not enforce additional authentication or session monitoring for unmanaged devices specifically; it only restricts a single action (downloads) globally.

Practice this question →
4
MCQhard

Refer to the exhibit. You are a security administrator for a company using Azure Virtual Network Manager. You have deployed the security admin configuration shown. What is the impact of this rule?

A.It blocks inbound SMB traffic from the internet to the subnet.
B.It blocks outbound traffic from the subnet to the internet.
C.It denies all traffic from the internet to the subnet.
D.It blocks inbound RDP traffic from the internet.
AnswerA

This rule correctly identifies that Server Message Block (SMB) communication primarily uses TCP port 445. By setting the direction to 'Inbound' and the source to 'Internet' (or a broad public IP range), the rule effectively denies any attempts from external networks to establish an SMB connection with resources within the protected subnet. Blocking inbound SMB from the internet is a critical security measure to prevent common exploits and ransomware attacks that target this protocol.

Why this answer

This security admin configuration in Azure Virtual Network Manager creates a rule that denies inbound traffic on port 445 (SMB) from the 'Internet' service tag to the target subnet. Since the rule has a priority of 100 (lowest number = highest priority) and the action is 'Deny', it overrides any lower-priority or default allow rules, effectively blocking inbound SMB traffic from the internet to the subnet. The rule does not affect outbound traffic or other protocols like RDP unless they are explicitly specified.

Exam trap

The trap here is that candidates may confuse a specific port deny rule (SMB on port 445) with a general 'deny all' rule, or incorrectly assume the rule affects outbound traffic because they misread the direction or priority logic.

How to eliminate wrong answers

Option B is wrong because the rule's direction is 'Inbound', not 'Outbound', so it has no impact on outbound traffic from the subnet to the internet. Option C is wrong because the rule only denies traffic on port 445 (SMB), not all traffic; other protocols and ports are unaffected unless additional rules are present. Option D is wrong because the rule targets port 445 (SMB), not port 3389 (RDP); RDP traffic would require a separate rule to be blocked.

Practice this question →
5
MCQmedium

Your organization uses Microsoft Defender for Cloud to secure Azure resources. You need to ensure that all storage accounts have soft delete enabled to protect against accidental deletion. Which policy should you implement?

A.Azure Blueprints
B.Azure Policy with a built-in policy for storage accounts
C.Azure role-based access control (RBAC)
D.Defender for Cloud security recommendations
AnswerB

Azure Policy is the correct tool because it provides a robust system for defining, assigning, and managing standards for your Azure resources. It can evaluate resource configurations against defined rules and enforce compliance by preventing non-compliant deployments or remediating existing non-compliant resources. There are built-in policies specifically designed to audit or enforce settings like soft delete for storage accounts, ensuring continuous configuration enforcement across your subscriptions.

Why this answer

Azure Policy with a built-in policy for storage accounts is correct because it allows you to enforce organizational standards and assess compliance at scale. The built-in policy 'Storage accounts should have soft delete enabled' can be assigned to a subscription or resource group to automatically audit or remediate storage accounts that do not have soft delete configured, ensuring protection against accidental deletion.

Exam trap

The trap here is that candidates often confuse Azure Policy (which enforces configuration rules) with Defender for Cloud recommendations (which only suggest security improvements without automatic enforcement), leading them to select option D.

How to eliminate wrong answers

Option A is wrong because Azure Blueprints is used to orchestrate the deployment of resource templates, policies, and role assignments as a repeatable set of Azure resources, not to enforce a specific configuration like soft delete on existing storage accounts. Option C is wrong because Azure RBAC controls who has permissions to manage Azure resources (authentication and authorization), not the configuration state of those resources (like enabling soft delete). Option D is wrong because Defender for Cloud security recommendations provide alerts and suggested remediations for security misconfigurations, but they do not automatically enforce or prevent non-compliant resources from being created; they are advisory, not a policy enforcement mechanism.

Practice this question →
6
MCQhard

A company uses Microsoft Purview to classify and label data. The compliance team needs to automatically apply a 'Highly Confidential' sensitivity label to any document containing a passport number that is stored in SharePoint Online. The label should also encrypt the document. What should the compliance team configure?

A.Create a retention label with a retention rule
B.Create an auto-labeling policy for sensitivity labels
C.Create a data loss prevention (DLP) policy
D.Create a manual sensitivity label and train users
AnswerB

Auto-labeling policies can automatically apply labels with encryption based on sensitive info types.

Why this answer

Microsoft Purview auto-labeling policies can automatically apply sensitivity labels to documents based on conditions such as the presence of sensitive information types (e.g., passport numbers). When configured, the policy can also enforce encryption as part of the label's protection settings, ensuring that any document stored in SharePoint Online containing a passport number is automatically labeled 'Highly Confidential' and encrypted.

Exam trap

The trap here is confusing DLP policies (which block or alert on data in motion) with auto-labeling policies (which apply labels and encryption to data at rest), leading candidates to choose DLP when the requirement is to classify and protect stored documents.

How to eliminate wrong answers

Option A is wrong because retention labels are designed for data lifecycle management (retaining or deleting data) and do not support automatic classification or encryption based on sensitive content. Option C is wrong because a DLP policy can detect and block the sharing of sensitive data but cannot automatically apply a sensitivity label with encryption to the document itself. Option D is wrong because manual labeling requires user action and does not meet the requirement for automatic application; training users does not enforce the policy.

Practice this question →
7
MCQmedium

A company uses Azure virtual machines and also has physical servers in their on-premises datacenter. The security team needs a single dashboard to view security recommendations, detect misconfigurations, and get a secure score for both environments. They also want to integrate with Microsoft Defender for Cloud for threat protection. Which Microsoft security solution provides this unified visibility across hybrid workloads?

A.Microsoft Defender for Cloud
B.Microsoft Sentinel
C.Microsoft Defender for Endpoint
D.Microsoft Security Center
AnswerA

Microsoft Defender for Cloud is the unified solution for comprehensive security posture management and integrated threat protection across hybrid and multi-cloud environments. It provides a secure score, actionable recommendations to harden Azure virtual machines and on-premises physical servers, and advanced threat protection capabilities. This platform ensures consistent security policies and visibility for both cloud-native and hybrid workloads, making it ideal for managing security across diverse infrastructure.

Why this answer

Microsoft Defender for Cloud provides a unified dashboard that delivers security recommendations, misconfiguration detection, and a secure score across both Azure virtual machines and on-premises physical servers. It natively integrates with Microsoft Defender for Cloud's threat protection capabilities, enabling hybrid workload coverage without additional licensing or complex setup.

Exam trap

Microsoft often tests the distinction between Microsoft Defender for Cloud (unified posture management and threat protection) and Microsoft Sentinel (SIEM/SOAR), causing candidates to confuse the two due to overlapping security monitoring capabilities.

Why the other options are wrong

B

Microsoft Sentinel is a SIEM/SOAR solution for security analytics and threat intelligence, not a dashboard for security recommendations, misconfiguration detection, and secure score across hybrid workloads. The question specifically asks for unified visibility and secure score, which is provided by Defender for Cloud.

C

Microsoft Defender for Endpoint focuses on endpoint protection (antivirus, EDR) for devices, not on providing a unified dashboard with security recommendations, misconfiguration detection, and secure score for hybrid workloads including Azure VMs and on-premises servers.

D

Microsoft Security Center is a legacy name for what is now Microsoft Defender for Cloud. The question asks for the current solution that provides unified visibility across hybrid workloads, and the correct name is Microsoft Defender for Cloud, not Security Center.

Practice this question →
8
MCQmedium

A company wants to improve its security awareness program by periodically sending simulated phishing emails to employees to test their ability to identify malicious messages. The results should be tracked in a dashboard that shows which employees clicked the links. Which Microsoft 365 Defender capability should they use?

A.Attack Simulation Training
B.Microsoft Defender for Office 365
C.Microsoft Defender for Cloud Apps
D.Microsoft 365 Defender Incident Response
AnswerA

Attack Simulation Training, integrated within Microsoft 365 Defender, is specifically engineered to create and manage realistic simulated cyberattacks, such as phishing, credential harvest, and malware attachment campaigns. This service allows organizations to proactively assess employee susceptibility to various social engineering techniques and automatically delivers targeted training to those who fall for the simulations. Its primary purpose is to strengthen the human firewall by improving security awareness and behavior through practical, measured experience.

Why this answer

Attack Simulation Simulation Training is the correct answer because it is the specific Microsoft 365 Defender capability designed to create and launch simulated phishing campaigns, track employee interactions (e.g., clicks on malicious links), and report results in a dashboard. This feature is part of Microsoft Defender for Office 365 but is a distinct workload focused on security awareness training and measurement.

Exam trap

The trap here is that candidates confuse the broader Microsoft Defender for Office 365 (which includes anti-phishing policies) with the specific Attack Simulation Training feature, assuming the entire suite is needed for simulation, when in fact the simulation tool is a discrete component with its own dashboard and configuration portal.

Why the other options are wrong

B

Microsoft Defender for Office 365 provides email security features like anti-phishing and anti-spam, but it does not include the ability to create and manage simulated phishing campaigns with employee tracking dashboards. That specific functionality is part of Attack Simulation Training.

C

Microsoft Defender for Cloud Apps is a CASB for discovering and controlling cloud app usage, not for simulating phishing attacks or tracking employee click rates in a security awareness program.

D

Microsoft 365 Defender Incident Response is focused on managing and responding to security incidents after they occur, not on proactively simulating phishing attacks to train employees.

Practice this question →
9
Multi-Selecthard

An organization uses Microsoft Purview Information Protection to classify and protect data. Which TWO methods can be used to apply sensitivity labels automatically?

Select 2 answers
A.Auto-labeling policies in Microsoft 365 compliance center
B.Client-side automatic classification via the unified labeling client
C.Default labeling policy for Microsoft 365 Apps
D.Manual labeling by end users
E.PowerShell scripts to apply labels on export
AnswersA, B

Auto-labeling policies in the Microsoft 365 compliance center provide a powerful, server-side mechanism for automatically applying sensitivity labels to content at rest and in transit. These policies scan data stored in locations like SharePoint Online, OneDrive for Business, and Exchange Online, identifying sensitive information based on defined conditions such as sensitive information types, keywords, or trainable classifiers. Once a match is found, the policy automatically applies the configured label without requiring any user intervention, ensuring consistent data protection across the organization.

Why this answer

Auto-labeling policies can apply labels based on conditions. Client-side labeling via the Azure Information Protection unified labeling client also supports automatic classification. Manual labeling is not automatic.

Labeling in Microsoft 365 Apps is default but not automatic. PowerShell cannot directly apply labels automatically without scripts.

Practice this question →
10
MCQmedium

An organization uses Microsoft Intune to manage devices. The security team wants to ensure that only devices with a minimum OS version and antivirus enabled can access corporate email. What should they configure?

A.Conditional Access policy referencing device compliance
B.Device enrollment restrictions
C.App protection policies in Microsoft Defender for Cloud Apps
D.A device compliance policy
AnswerA

A Conditional Access policy is the mechanism that enforces access restrictions based on device health. It evaluates conditions, including the device's compliance status reported by Intune, to determine whether to grant or block access to specified cloud applications or resources. By referencing device compliance, it ensures that only devices meeting the organization's security standards can access sensitive data, effectively linking device posture to resource access control.

Why this answer

A Conditional Access policy referencing device compliance is correct because it allows the security team to enforce access controls based on real-time device health signals, such as minimum OS version and antivirus status. When a device is marked as non-compliant by Intune, the Conditional Access policy blocks access to corporate email (e.g., Exchange Online) until the device meets the required compliance criteria. This combines Intune's compliance evaluation with Azure AD's access enforcement, ensuring only healthy devices can access corporate resources.

Exam trap

The trap here is that candidates often confuse a device compliance policy (which only defines rules) with Conditional Access (which enforces access), leading them to select Option D, forgetting that compliance policies alone do not block access to corporate email.

How to eliminate wrong answers

Option B is wrong because device enrollment restrictions control which devices can be enrolled into Intune (e.g., by platform or OS version), but they do not enforce ongoing compliance checks like antivirus status or block access to email after enrollment. Option C is wrong because app protection policies in Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) manage data protection at the app level (e.g., preventing copy/paste), not device-level requirements like OS version or antivirus. Option D is wrong because a device compliance policy defines the rules for compliance (e.g., minimum OS, antivirus enabled), but it does not enforce access decisions on its own; it must be paired with a Conditional Access policy to block or grant access to corporate email.

Practice this question →
11
MCQeasy

An organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They need to prevent users from sharing credit card numbers via email outside the company. Which type of DLP rule action should they configure?

A.Block
B.Notify
C.Audit only
D.Encrypt
AnswerA

The "Block" action in Microsoft Purview Data Loss Prevention (DLP) policies is designed to actively prevent sensitive information from being transmitted outside the organization. When a DLP policy rule configured with this action is triggered by an email containing sensitive data, the system will immediately stop the email from being sent to its intended external recipients. This action directly fulfills the requirement to prevent data exfiltration, often accompanied by a policy tip informing the sender of the block and potential override options.

Why this answer

To prevent users from sharing credit card numbers via email outside the company, a DLP rule action of 'Block' is required. This action stops the email from being sent when sensitive content (e.g., credit card numbers) is detected, ensuring data exfiltration is prevented. The Block action can also be configured to show a policy tip to the user, but the core enforcement is the blocking of the message.

Exam trap

The trap here is that candidates often confuse 'Block' with 'Encrypt' or 'Notify', thinking that encryption or notification alone is sufficient to prevent data loss, but only Block actually stops the transmission of sensitive data.

How to eliminate wrong answers

Option B (Notify) is wrong because Notify only sends an alert or policy tip to the user or administrator without preventing the email from being sent; it does not block the action. Option C (Audit only) is wrong because Audit only logs the activity for review without any enforcement, allowing the email to be sent. Option D (Encrypt) is wrong because Encrypt applies rights management protection to the email but does not prevent the email from being sent; the recipient can still access the content if they have the appropriate permissions.

Practice this question →
12
Multi-Selectmedium

A cybersecurity analyst uses Microsoft Sentinel to detect threats. Which THREE types of analytics rules can be created?

Select 3 answers
A.Scheduled query rules
B.Near-real-time (NRT) rules
C.Hunting rules
D.Fusion rules
E.Machine learning rules
AnswersA, B, D

Scheduled query rules are the most widely used type of analytics rule in Microsoft Sentinel, executing a custom Kusto Query Language (KQL) query against ingested log data at predefined, recurring intervals. These rules are designed to detect specific patterns, anomalies, or thresholds in security events over time, automatically generating an incident when the query returns results, thus alerting security analysts to potential threats.

Why this answer

Scheduled query rules are correct because they allow you to define a KQL query that runs on a set schedule (e.g., every 5 minutes) to detect threats by analyzing log data from multiple sources. This is a core analytics rule type in Microsoft Sentinel for proactive threat detection based on time-based patterns.

Exam trap

The trap here is that candidates confuse 'hunting' (an interactive process) with an analytics rule type, or assume 'machine learning rules' exist as a separate category when they are actually implemented via Fusion and Anomaly rules.

Practice this question →
13
Multi-Selecthard

Which THREE actions can Microsoft Sentinel perform as part of automated incident response using playbooks?

Select 3 answers
A.Block an IP address on a firewall
B.Install anti-malware software on a device
C.Reset a user's password
D.Create an incident in ServiceNow
E.Modify a network security group rule
AnswersA, C, D

Playbooks can trigger firewall blocking via connectors.

Why this answer

Microsoft Sentinel playbooks, built on Azure Logic Apps, can automate responses to security incidents. Blocking an IP address on a firewall is a common automated action because Logic Apps connectors exist for many firewall vendors (e.g., Palo Alto, Fortinet), allowing Sentinel to trigger a block action directly from a playbook. Resetting a user's password is possible using connectors like Azure AD, enabling automated password resets as part of incident response.

Creating an incident in ServiceNow is supported via the ServiceNow connector, allowing integration with IT service management (ITSM) systems. These three actions leverage available Logic Apps connectors, while installing software or modifying NSG rules are not standard actions supported by Sentinel playbooks.

Exam trap

The trap here is that candidates may assume Sentinel can directly modify Azure NSG rules or install software on devices, but Sentinel playbooks rely on external connectors and APIs, and actions like installing software are not supported by any standard connector.

Practice this question →
14
MCQmedium

A company has on-premises Active Directory. They want to detect advanced attacks like Pass-the-Hash, DCSync, and malicious Kerberos activity using behavioral analytics. Which Microsoft security solution should they deploy on their domain controllers?

A.Microsoft Defender for Endpoint
B.Microsoft Defender for Office 365
C.Microsoft Defender for Identity
D.Microsoft Defender for Cloud Apps
AnswerC

Microsoft Defender for Identity (MDI) is purpose-built to detect advanced identity-based threats and anomalous activities specifically targeting on-premises Active Directory environments. It deploys sensors directly on domain controllers to monitor network traffic, authentication requests, and security logs, applying behavioral analytics and machine learning to identify suspicious user and entity behavior. This includes detecting reconnaissance, lateral movement, and credential theft techniques like Pass-the-Hash or Golden Ticket attacks, providing crucial insights into the AD attack kill chain.

Why this answer

Microsoft Defender for Identity (MDI) is the correct solution because it uses behavioral analytics and machine learning to detect advanced attacks specifically targeting on-premises Active Directory, such as Pass-the-Hash, DCSync, and malicious Kerberos activity. MDI monitors domain controller traffic, including Kerberos authentication and NTLM relay, to identify anomalous patterns indicative of these attacks.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Identity with Microsoft Defender for Endpoint, assuming endpoint protection covers domain controllers, but MDI is specifically designed for Active Directory security and behavioral analytics against identity-based attacks.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for devices like workstations and servers, not on monitoring domain controller traffic or Active Directory-specific attack vectors like DCSync. Option B is wrong because Microsoft Defender for Office 365 protects email and collaboration tools (e.g., Exchange Online, SharePoint) from threats like phishing and malware, not on-premises Active Directory attacks. Option D is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that monitors cloud applications and shadow IT, not on-premises domain controllers or Kerberos/NTLM traffic.

Practice this question →
15
MCQmedium

A security analyst in your organization receives an alert from Microsoft Defender XDR indicating that a user's device may be infected with ransomware. The analyst needs to immediately isolate the device from the network to prevent further spread. What should the analyst do?

A.Revoke the user's session in Microsoft Entra ID
B.Use Microsoft Defender for Endpoint to initiate device isolation
C.Open Microsoft Sentinel and run a playbook
D.Use Microsoft Intune to wipe the device
AnswerB

Microsoft Defender for Endpoint provides robust capabilities for immediate incident response, including the ability to isolate a device from the network. Initiating device isolation restricts the compromised endpoint's communication to only essential Defender for Endpoint services, effectively containing the threat and preventing lateral movement or data exfiltration. This action allows security analysts to investigate the incident without further risk to the broader network, making it the most appropriate and immediate containment measure.

Why this answer

Microsoft Defender for Endpoint includes a built-in device isolation capability that can be triggered directly from the Microsoft Defender XDR portal. This action immediately disconnects the device from all network communications (except the Defender service) to contain a confirmed ransomware infection, preventing lateral movement while allowing forensic analysis.

Exam trap

The trap here is that candidates confuse identity-based controls (session revocation) with endpoint-based network containment, or they overcomplicate the response by thinking a SOAR playbook is required when Defender for Endpoint provides a one-click isolation action directly in the alert workflow.

How to eliminate wrong answers

Option A is wrong because revoking the user's session in Microsoft Entra ID only invalidates authentication tokens and SSO sessions, but does not disconnect the device from the network or stop ransomware from spreading to other systems. Option C is wrong because Microsoft Sentinel is a SIEM/SOAR platform that can orchestrate automated responses via playbooks, but it is not the immediate, direct action an analyst should take for real-time device isolation; the playbook would typically call Defender for Endpoint's isolation API anyway. Option D is wrong because using Microsoft Intune to wipe the device is a destructive, irreversible action that removes all data and is not appropriate for immediate containment; it also requires policy deployment time and does not instantly isolate the device from the network.

Practice this question →
16
MCQmedium

A company uses Microsoft Defender for Cloud Apps. The security team discovers that a user has granted a third-party OAuth app with 'read all mail' and 'send mail as user' permissions. They want to automatically revoke the authorization for this risky app and block similar apps in the future. Which Defender for Cloud Apps feature should they use?

A.App Discovery
B.Conditional Access App Control
C.OAuth app policies
D.Cloud Discovery
AnswerC

Correct. OAuth app policies allow you to manage and revoke permissions for OAuth apps and set automatic governance actions.

Why this answer

OAuth app policies in Microsoft Defender for Cloud Apps allow security teams to automatically revoke permissions for risky third-party OAuth apps and block future similar apps. This feature specifically governs OAuth consent grants, such as 'read all mail' and 'send mail as user', by enabling automated governance actions like revoking permissions and blocking the app based on risk level.

Exam trap

The trap here is that candidates confuse App Discovery/Cloud Discovery (which identify unmanaged cloud app usage) with OAuth app policies (which specifically govern third-party app permissions and consent grants).

How to eliminate wrong answers

Option A is wrong because App Discovery is a feature for identifying Shadow IT by analyzing traffic logs to discover cloud apps in use, not for managing OAuth app permissions. Option B is wrong because Conditional Access App Control provides real-time session-level monitoring and control (e.g., blocking downloads) for managed apps, but it does not revoke or block OAuth app authorizations. Option D is wrong because Cloud Discovery is the underlying data collection mechanism for App Discovery, focusing on traffic analysis to identify cloud app usage, not on OAuth app governance.

Practice this question →
17
MCQmedium

A company wants to protect against malware and phishing attacks in email and collaboration tools like Microsoft Teams. Which Microsoft security solution should they use?

A.Microsoft Defender for Office 365
B.Microsoft Defender for Cloud Apps
C.Microsoft Defender for Endpoint
D.Microsoft Defender for Identity
AnswerA

Protects email and collaboration tools from malware and phishing.

Why this answer

Microsoft Defender for Office 365 (formerly Office 365 ATP) is the correct solution because it is specifically designed to protect email and collaboration tools like Microsoft Teams from malware, phishing, and other threats. It includes features such as Safe Links, Safe Attachments, and anti-phishing policies that scan URLs and attachments in real-time, and it integrates directly with Exchange Online and Teams to block malicious content before it reaches users.

Exam trap

The trap here is that candidates often confuse the broad 'Defender' branding and assume any Defender product covers all security scenarios, but each solution is scoped to a specific layer (email/collaboration, cloud apps, endpoints, or identity), and the question's focus on email and Teams directly points to Defender for Office 365.

How to eliminate wrong answers

Option B (Microsoft Defender for Cloud Apps) is wrong because it is a Cloud Access Security Broker (CASB) that focuses on discovering and controlling shadow IT, enforcing data loss prevention, and monitoring user activity across SaaS applications—not on protecting against malware and phishing in email and Teams. Option C (Microsoft Defender for Endpoint) is wrong because it is an endpoint detection and response (EDR) solution that protects devices (Windows, macOS, Linux) from threats like ransomware and exploits, not email or collaboration platforms. Option D (Microsoft Defender for Identity) is wrong because it is an identity security solution that uses Active Directory signals to detect advanced attacks like pass-the-hash and lateral movement, not email or Teams malware/phishing protection.

Practice this question →
18
MCQeasy

Your organization wants to label emails and documents as 'Confidential' automatically based on content patterns. Which Microsoft Purview feature should you use?

A.Audit log
B.Retention labels
C.Auto-labeling (sensitivity labels)
D.Data Loss Prevention policy
AnswerC

Auto-labeling for sensitivity labels is the correct solution because it automatically applies predefined sensitivity labels to emails and documents based on specific conditions, such as the presence of sensitive information types (e.g., credit card numbers, PII) or keywords. This process inspects content at rest or in transit and then applies the associated protective actions, including encryption, visual markings, and access restrictions, ensuring consistent classification and protection without manual intervention.

Why this answer

Auto-labeling (sensitivity labels) in Microsoft Purview can automatically apply 'Confidential' labels to emails and documents based on content patterns, such as credit card numbers or specific keywords. This feature uses pattern matching and machine learning classifiers to detect sensitive content and assign the appropriate sensitivity label without manual intervention.

Exam trap

The trap here is confusing Data Loss Prevention (DLP) policies with auto-labeling, as both use content patterns, but DLP blocks or monitors data sharing while auto-labeling applies sensitivity labels to the content itself.

How to eliminate wrong answers

Option A is wrong because Audit log records user and admin activities for security investigations, not for automatically labeling content based on patterns. Option B is wrong because Retention labels are used to manage data retention and deletion policies, not to classify content as 'Confidential' based on content patterns. Option D is wrong because Data Loss Prevention (DLP) policies monitor and block the sharing of sensitive data, but they do not automatically apply labels to content; labeling is a separate capability.

Practice this question →
19
MCQhard

Your company is implementing Microsoft Purview Data Loss Prevention (DLP). You need to prevent users from sharing sensitive data like credit card numbers via email with external recipients, but allow internal sharing. What should you configure?

A.Sensitivity labels with encryption
B.A DLP policy for Exchange Online with a condition 'content contains sensitive information type' and 'shared with people outside my organization'
C.Retention labels and policies
D.Conditional Access policies with session controls
AnswerB

This option directly addresses the requirement of preventing data loss by blocking external sharing of sensitive information. A Microsoft Purview Data Loss Prevention (DLP) policy configured for Exchange Online can accurately detect specific sensitive information types within email content. By combining this detection with a condition specifying 'shared with people outside my organization,' the policy can automatically block the email transmission, notify the sender, and alert administrators, effectively preventing unauthorized external disclosure.

Why this answer

To prevent sharing of sensitive data with external recipients via email, you need to configure a DLP policy that applies to Exchange Online and includes a condition for the sensitive information type (e.g., credit card numbers) and an action to block sharing when the content is shared with people outside the organization. Option B correctly describes this configuration. Option A is incorrect because sensitivity labels with encryption classify and protect data at rest and in transit but do not by themselves enforce sharing restrictions based on recipients.

Option C is incorrect because retention policies are used to retain or delete data, not to block sharing. Option D is incorrect because Conditional Access policies control access to applications based on conditions like user location or device state, not data sharing actions.

Practice this question →
20
MCQmedium

A security team needs to detect and investigate suspicious activities in their on-premises Active Directory environment, such as pass-the-hash attacks, Kerberoasting, and unusual service account behavior. They also want to integrate these alerts with Microsoft Defender for Cloud for a unified view across hybrid workloads. Which Microsoft security solution should they deploy on-premises?

A.Microsoft Defender for Identity
B.Microsoft Defender for Office 365
C.Microsoft Defender for Cloud Apps
D.Microsoft Defender for Endpoint
AnswerA

Microsoft Defender for Identity is purpose-built to protect hybrid identity environments by monitoring on-premises Active Directory (AD) domain controllers and AD FS servers. It leverages network traffic analysis and Windows event logs to detect sophisticated identity-based attacks, such as Pass-the-Hash, Pass-the-Ticket, Kerberoasting, and Golden Ticket attacks. By building behavioral profiles of users and entities, it identifies anomalous activities that indicate compromise, providing crucial insights into the identity attack kill chain.

Why this answer

Microsoft Defender for Identity (MDI) is the correct solution because it is specifically designed to detect and investigate advanced threats in on-premises Active Directory environments, including pass-the-hash attacks, Kerberoasting, and anomalous service account behavior. It uses behavioral analytics and integrates directly with Microsoft Defender for Cloud to provide a unified view across hybrid workloads, enabling security teams to correlate on-premises AD signals with cloud alerts.

Exam trap

The trap here is that candidates may confuse Microsoft Defender for Identity with Microsoft Defender for Endpoint, assuming endpoint protection covers AD attacks, but MDI is the only solution that specifically monitors Active Directory authentication and behavior on domain controllers.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Office 365 focuses on protecting email, SharePoint, OneDrive, and Teams from threats like phishing and malware, not on-premises Active Directory attacks. Option C is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that protects cloud applications and data, not on-premises AD environments. Option D is wrong because Microsoft Defender for Endpoint is designed for endpoint detection and response (EDR) on devices, not for monitoring Active Directory authentication protocols or service account behavior.

Practice this question →
21
MCQmedium

You are reviewing a Microsoft Purview sensitivity label configuration. Based on the exhibit, what will happen when this label is applied to a document?

A.The document will be watermarked only.
B.The document will be encrypted and will expire after a set period.
C.The document will be encrypted with AES256, watermarked with 'CONFIDENTIAL', and sharing will be blocked.
D.The document will display a warning before sharing.
AnswerC

All three actions are specified in the label configuration.

Why this answer

The exhibit shows a Microsoft Purview sensitivity label configured with both encryption (AES256) and content marking (a 'CONFIDENTIAL' watermark), and the sharing permissions are explicitly set to 'Block sharing'. This combination of settings ensures that when the label is applied, the document is encrypted, watermarked, and sharing is prevented.

Exam trap

The trap here is that candidates often confuse the 'expiration' setting with the 'encryption' setting, or assume that a watermark alone implies no encryption, when in fact the label can combine multiple actions (encryption, watermark, and sharing restrictions) simultaneously.

How to eliminate wrong answers

Option A is wrong because the label configuration includes encryption and sharing restrictions, not just a watermark. Option B is wrong because while the label does include encryption, it does not specify an expiration period; the exhibit shows no expiry setting. Option D is wrong because the label is configured to block sharing outright, not to display a warning before sharing.

Practice this question →
22
Multi-Selecteasy

Which TWO of the following are features of Microsoft Sentinel? (Choose two.)

Select 2 answers
A.Security Information and Event Management (SIEM)
B.Data loss prevention
C.Endpoint detection and response
D.Identity governance
E.Security Orchestration, Automation, and Response (SOAR)
AnswersA, E

Correct: Core SIEM capability.

Why this answer

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) solution that collects and analyzes security data from across an enterprise. It also provides Security Orchestration, Automation, and Response (SOAR) capabilities through built-in playbooks and automation rules, enabling automated incident response. These two core functions—SIEM and SOAR—are explicitly listed as features of Sentinel.

Exam trap

The trap here is that candidates confuse Microsoft Sentinel’s SIEM+SOAR capabilities with other Microsoft security products like Defender for Endpoint (EDR) or Purview (DLP), leading them to select options that are valid security features but belong to different services.

Practice this question →
23
MCQmedium

Refer to the exhibit. The exhibit shows an Azure Policy definition. A storage account named 'storagedev' is created with network ACLs set to allow all traffic (defaultAction: Allow) and no IP rules. What will happen when this policy is assigned?

A.The storage account will be created successfully
B.The policy will audit the storage account and mark it as non-compliant
C.The storage account creation will be denied
D.The storage account will be created, but the policy will modify the ACLs
AnswerC

The policy condition is met, and deny effect blocks creation.

Why this answer

The Azure Policy definition shown uses the 'Deny' effect, which explicitly blocks any resource creation that does not meet the specified conditions. Since the storage account 'storagedev' has network ACLs set to allow all traffic (defaultAction: Allow) and no IP rules, it violates the policy's requirement for restricted network access. Therefore, Azure Policy will deny the creation of this storage account, preventing it from being provisioned.

Exam trap

Microsoft often tests the distinction between 'Deny' and 'Audit' effects, where candidates mistakenly think a policy that marks non-compliance will still block creation, or that Azure Policy can automatically remediate without a specific 'DeployIfNotExists' or 'Modify' effect.

How to eliminate wrong answers

Option A is wrong because the policy uses the 'Deny' effect, not 'Audit' or 'Modify', so the storage account will not be created successfully. Option B is wrong because the 'Audit' effect would mark the resource as non-compliant but still allow creation; however, this policy uses 'Deny', which blocks creation entirely. Option D is wrong because the 'Deny' effect does not modify resources; it prevents their creation, and the 'Modify' or 'DeployIfNotExists' effects would be required to alter ACLs after creation.

Practice this question →
24
MCQeasy

A company wants to reduce the attack surface on its Windows devices by blocking common techniques used by malware, such as preventing Office applications from creating child processes or blocking executable files from running from the %TEMP% folder. Which Microsoft Defender for Endpoint feature should be configured?

A.Microsoft Defender Antivirus
B.Attack surface reduction rules
C.Network protection
D.Controlled folder access
AnswerB

Attack surface reduction (ASR) rules are a core component of Microsoft Defender for Endpoint, specifically designed to prevent common malware and ransomware techniques by blocking suspicious behaviors at the endpoint. These rules operate by preventing specific actions, such as Office applications creating executable child processes or scripts executing from temporary folders, which are frequently exploited by attackers. By proactively blocking these known exploit techniques, ASR rules significantly reduce the attack surface, enhancing endpoint security beyond traditional signature-based detection.

Why this answer

Attack surface reduction (ASR) rules are a feature of Microsoft Defender for Endpoint that specifically target common malware behaviors, such as blocking Office applications from creating child processes and preventing executable files from running from the %TEMP% folder. These rules are designed to reduce the attack surface by enforcing policies that stop suspicious or malicious actions at the process level, without relying solely on signature-based detection.

Exam trap

The trap here is that candidates often confuse Attack surface reduction rules with Microsoft Defender Antivirus or Controlled folder access, assuming that any 'blocking' feature is part of the antivirus or that folder protection covers execution, when in fact ASR rules are the only feature that enforces behavior-based policies on process creation and execution from specific locations.

Why the other options are wrong

A

Microsoft Defender Antivirus provides real-time protection against malware by scanning files and processes, but it does not specifically block behaviors like Office apps creating child processes or executables running from %TEMP%. Those are behavioral restrictions enforced by Attack Surface Reduction (ASR) rules.

C

Network protection prevents connections to malicious IPs/domains, not local process behaviors like Office apps creating child processes or executables running from %TEMP%.

D

Controlled folder access protects files in specific folders from unauthorized changes by ransomware and other threats, but it does not block Office apps from creating child processes or prevent executables from running from the %TEMP% folder.

Practice this question →
25
MCQeasy

A company uses Microsoft Intune to manage its devices. The security team wants to enforce that all devices running Windows 11 must have BitLocker enabled and a minimum operating system build version. Which Intune policy type should they use?

A.Configuration profile
B.Enrollment restriction
C.App protection policy
D.Compliance policy
AnswerD

Compliance policies define the security baselines and health requirements that devices must meet to be considered compliant within an organization, such as requiring device encryption, a minimum OS version, or an enabled firewall. These policies continuously evaluate device properties against the defined rules and can mark devices as non-compliant, often integrating with Conditional Access to restrict resource access until compliance is restored.

Why this answer

Compliance policies in Microsoft Intune define the rules and settings that devices must meet to be considered compliant, such as requiring BitLocker encryption and a minimum OS build version. When a device fails to meet these conditions, Intune can mark it as non-compliant and trigger conditional access policies to block access to corporate resources. This makes compliance policy the correct choice for enforcing security baselines like BitLocker and OS version requirements.

Exam trap

The trap here is that candidates often confuse configuration profiles (which apply settings) with compliance policies (which enforce and evaluate those settings), leading them to select A instead of D.

How to eliminate wrong answers

Option A is wrong because configuration profiles are used to configure device settings and features (e.g., Wi-Fi, VPN, email) but do not enforce compliance or trigger conditional access actions; they apply settings without a compliance check. Option B is wrong because enrollment restrictions control which devices can enroll (e.g., by platform, OS version, or manufacturer) but do not enforce ongoing requirements like BitLocker or build version after enrollment. Option C is wrong because app protection policies (MAM) manage data protection within apps on devices that may or may not be managed by Intune, focusing on app-level data loss prevention rather than device-level encryption or OS build version.

Practice this question →
26
MCQhard

Refer to the exhibit. The exhibit shows an alert from Microsoft Defender XDR. The security team needs to determine if the file 'invoice.docm' is known malware and if other devices in the organization have this file. What should they do next?

A.Isolate the device DESKTOP-01 immediately
B.Trigger the automated investigation for this alert
C.Review the user jdoe's recent activities
D.Search in Advanced Hunting for the file's SHA256 hash across all devices
AnswerD

Searching for the file's SHA256 hash in Advanced Hunting is the most effective immediate next step because it allows security analysts to quickly determine the prevalence of the malicious file across the entire organizational environment. Using this unique cryptographic identifier ensures an accurate and comprehensive search, revealing if other endpoints have encountered or executed the same file. This crucial information is essential for understanding the scope of the compromise and prioritizing subsequent containment and eradication efforts.

Why this answer

Searching for the file's SHA256 hash in Advanced Hunting allows the security team to query across all devices in the organization to determine if the file is known malware (by cross-referencing with threat intelligence) and to identify which other devices have the same file. Advanced Hunting in Microsoft Defender XDR supports Kusto Query Language (KQL) queries against the DeviceFileEvents table, enabling hash-based file discovery and reputation checks.

Exam trap

The trap here is that candidates may choose 'Trigger the automated investigation' thinking it will automatically determine malware status and scope, but automated investigation focuses on response actions rather than providing the specific hash-based query results needed to answer both questions.

How to eliminate wrong answers

Option A is wrong because isolating the device prematurely could disrupt business operations and does not answer whether the file is known malware or if other devices have it. Option B is wrong because triggering an automated investigation would start response actions based on the alert, but it does not directly provide the specific information about the file's malware status or its presence on other devices. Option C is wrong because reviewing user jdoe's recent activities focuses on user behavior rather than the file's hash-based identification and propagation across devices.

Practice this question →
27
Multi-Selecthard

Which THREE capabilities are provided by Microsoft Purview? (Choose three.)

Select 3 answers
A.Data classification and labeling
B.Data lifecycle management and retention
C.Data loss prevention (DLP)
D.Identity protection and risk detection
E.Threat and vulnerability management
AnswersA, B, C

Purview classifies and labels sensitive data.

Why this answer

Microsoft Purview provides data classification and labeling capabilities, enabling organizations to identify, categorize, and protect sensitive data across their digital estate. This includes automatic and manual labeling of documents and emails based on content inspection and machine learning classifiers, which is a core function of the Microsoft Purview Information Protection solution.

Exam trap

The trap here is that candidates often confuse Microsoft Purview's data security capabilities (classification, DLP, retention) with identity or threat management features that belong to Microsoft Entra ID or Microsoft Defender solutions.

Practice this question →
28
Multi-Selectmedium

Which THREE of the following are capabilities of Microsoft Defender for Office 365?

Select 3 answers
A.Safe Links protection in email and Office documents
B.Anti-phishing policies to protect against impersonation
C.Cloud discovery of unsanctioned SaaS apps
D.Device compliance policies for mobile devices
E.Safe Attachments scanning in email
AnswersA, B, E

Safe Links protects users from malicious URLs.

Why this answer

Safe Links is a core capability of Microsoft Defender for Office 365 that proactively scans URLs in email messages and Office documents (like Word, Excel, and PowerPoint) at the time of click. Safe Attachments scans email attachments in a detonation chamber before delivery to detect malicious content. Anti-phishing policies protect users from impersonation attacks by analyzing sender identity and email patterns.

Together, these three features provide multi-layered protection against email-borne threats.

Exam trap

The trap here is that candidates confuse the scope of Microsoft Defender for Office 365 with other Microsoft 365 security products, mistakenly attributing cloud discovery (Defender for Cloud Apps) or device compliance (Intune) to Defender for Office 365, which is strictly focused on email and Office document protection.

Practice this question →
29
MCQmedium

Refer to the exhibit. You are reviewing a Conditional Access policy JSON in Microsoft Entra ID. What will this policy do?

A.Block access when user risk is medium or high
B.Block sign-ins when sign-in risk is high
C.Require MFA when user risk is high
D.Block access when user risk is high
AnswerD

This statement is correct because the Conditional Access policy is configured with 'User risk level' set to 'High' as a specific condition. Furthermore, the 'Grant' control for this policy is explicitly set to 'Block access.' This combination precisely dictates that if a user's risk level is assessed as high by Azure AD Identity Protection, their attempt to access resources will be blocked.

Why this answer

The policy JSON specifies `"userRiskLevels": ["high"]` and `"builtInControls": ["block"]`, meaning it blocks access when the user risk level is high. User risk reflects the likelihood that the user's identity is compromised, based on Microsoft's risk detection signals. Option D correctly identifies this behavior.

Exam trap

The trap here is confusing user risk with sign-in risk; candidates often pick 'block sign-ins when sign-in risk is high' because they overlook the `userRiskLevels` field in the JSON and assume the policy targets sign-in risk instead.

How to eliminate wrong answers

Option A is wrong because the policy only targets user risk level 'high', not 'medium or high'; Conditional Access policies require explicit risk level values. Option B is wrong because the policy evaluates user risk, not sign-in risk (which would use `signInRiskLevels` in the JSON). Option C is wrong because the policy's control is 'block', not 'require MFA'; requiring MFA would use `"mfa"` in the `builtInControls` array.

Practice this question →
30
MCQhard

A company uses Salesforce and Box as cloud apps. The security team discovers that a third-party OAuth app with excessive permissions was granted access to Salesforce data by a user. They want a solution that can detect such risky OAuth apps and automatically revoke their permissions based on policy. Which Microsoft security solution provides this capability?

A.Microsoft Defender for Cloud Apps
B.Microsoft Defender for Endpoint
C.Microsoft Defender for Office 365
D.Microsoft Sentinel
AnswerA

Microsoft Defender for Cloud Apps (MDCAS) is the correct solution because it provides comprehensive visibility and control over cloud applications, including the discovery and assessment of OAuth-connected apps. It can identify risky OAuth apps that users have authorized to access data in connected cloud services like Salesforce and Box. Through its robust policy engine, MDCAS enables organizations to define and enforce granular policies, automatically revoking permissions for high-risk or non-compliant OAuth applications, thereby mitigating potential data exfiltration or unauthorized access risks.

Why this answer

Microsoft Defender for Cloud Apps (MDCA) is a Cloud Access Security Broker (CASB) that provides visibility into third-party OAuth apps connected to cloud services like Salesforce and Box. It can detect OAuth apps with excessive permissions and automatically revoke them based on conditional access or app governance policies, making it the correct solution for this scenario.

Exam trap

The trap here is that candidates may confuse Microsoft Defender for Cloud Apps with Microsoft Defender for Office 365, assuming the latter covers all cloud app security, when in reality MDCA is the dedicated CASB for multi-SaaS environments like Salesforce and Box.

How to eliminate wrong answers

Option B (Microsoft Defender for Endpoint) is wrong because it focuses on endpoint detection and response (EDR) for devices, not on monitoring or controlling OAuth permissions in SaaS applications. Option C (Microsoft Defender for Office 365) is wrong because it protects Exchange Online, SharePoint, and Teams from threats like phishing and malware, but does not manage OAuth app permissions in third-party SaaS apps like Salesforce. Option D (Microsoft Sentinel) is wrong because it is a Security Information and Event Management (SIEM) solution that ingests logs and generates alerts, but it lacks native capabilities to automatically revoke OAuth app permissions; it would require custom playbooks or integration with MDCA for such actions.

Practice this question →
31
MCQeasy

You are the security administrator for a small business that uses Microsoft 365 Business Premium. The company wants to enable multi-factor authentication (MFA) for all users. You need to ensure that users are prompted for MFA when they sign in from unfamiliar locations or devices. The solution should be easy to deploy without additional licensing. Which of the following should you configure?

A.Create a conditional access policy in Microsoft Entra ID that requires MFA for all cloud apps
B.Enable security defaults in Microsoft Entra ID
C.Deploy the Microsoft Authenticator app and instruct users to enable it
D.Configure identity protection to enable risk-based MFA
AnswerB

Security defaults provide a pre-configured set of security policies that include MFA and are included with Microsoft 365 Business Premium without additional licensing.

Why this answer

Security defaults are a pre-configured set of security policies that include MFA based on risk, specifically prompting for MFA when users sign in from unfamiliar locations or devices, and are available without additional licensing. Option A is incorrect because while Conditional Access policies are available with Microsoft 365 Business Premium (which includes Microsoft Entra ID P1), a simple policy requiring MFA for *all* cloud apps would prompt for MFA every time, not specifically when signing in from unfamiliar locations or devices. To achieve risk-based MFA with Conditional Access that specifically targets unfamiliar locations/devices, more advanced configurations or potentially Microsoft Entra ID P2 features (for advanced sign-in risk detection) might be needed, which would go against the 'easy to deploy' and 'no additional licensing' constraints if P2 is implied.

Security defaults provide this risk-based MFA out-of-the-box without complex configuration or P2 licensing. Option C is incorrect because deploying the Microsoft Authenticator app alone does not enforce MFA; a policy such as security defaults or conditional access is needed to prompt for MFA based on location or device. Option D is incorrect because identity protection risk-based MFA requires Azure AD Premium P2 licensing, which is not included in Business Premium.

Practice this question →
32
MCQmedium

You run the Microsoft Graph PowerShell command in the exhibit. What information does this command retrieve about the user?

A.The user's license assignments
B.The user's last sign-in dates
C.The user's assigned roles
D.The user's group memberships
AnswerB

The SignInActivity property, when retrieved for a user object via Microsoft Graph PowerShell, provides critical details about a user's authentication history. Specifically, it contains the 'lastSignInDateTime' for interactive sign-ins and 'lastNonInteractiveSignInDateTime' for non-interactive sign-ins. Therefore, executing a command that selects SignInActivity will accurately return the timestamps indicating the user's most recent successful authentication events.

Why this answer

The command `Get-MgUser -UserId user@contoso.com -Property SignInActivity | Select-Object -Property SignInActivity` retrieves the `SignInActivity` property of the specified user, which contains the `lastSignInDateTime` and `lastNonInteractiveSignInDateTime` fields. This data directly provides the user's last sign-in dates, making option B correct.

Exam trap

The trap here is that candidates confuse the `SignInActivity` property with license or role information, because the `Get-MgUser` command can retrieve many user properties, but only `SignInActivity` specifically returns sign-in timestamps.

How to eliminate wrong answers

Option A is wrong because license assignments are retrieved using `Get-MgUserLicenseDetail` or the `AssignedLicenses` property, not the `SignInActivity` property. Option C is wrong because assigned roles are retrieved using `Get-MgUserMemberOf` or the `DirectoryRole` cmdlets, not sign-in activity data. Option D is wrong because group memberships are retrieved using `Get-MgUserMemberOf` or `Get-MgGroupMember`, not the `SignInActivity` property.

Practice this question →
33
MCQeasy

A security analyst needs to investigate a potential data exfiltration incident involving sensitive files being sent via email. Which Microsoft Purview solution provides the necessary monitoring?

A.Microsoft Purview Compliance Manager
B.Microsoft Purview Insider Risk Management
C.Microsoft Purview Data Loss Prevention
D.Microsoft Purview Audit
AnswerC

Microsoft Purview Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and protect sensitive information across various locations, including email, SharePoint, OneDrive, and Teams. When configured, DLP can detect sensitive data types (e.g., credit card numbers, PII) within email content or attachments and then block, warn, or encrypt the message to prevent unauthorized exfiltration. This direct content inspection and enforcement capability makes it the ideal tool for investigating and preventing data loss via email.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it provides real-time monitoring and policy-based enforcement to detect and block sensitive files (e.g., credit card numbers, PII) from being sent via email. DLP policies can inspect email content and attachments in transit, triggering alerts or blocking the message to prevent data exfiltration.

Exam trap

The trap here is that candidates often confuse Insider Risk Management (which analyzes user behavior patterns) with DLP (which enforces content-based policies), leading them to choose Option B because they think 'insider threat' implies data exfiltration, but DLP is the actual monitoring and enforcement tool for email-based incidents.

How to eliminate wrong answers

Option A is wrong because Compliance Manager is a risk assessment and compliance scoring tool, not a monitoring solution for data exfiltration incidents. Option B is wrong because Insider Risk Management focuses on identifying risky user behaviors (e.g., unusual file access) through analytics and correlation, but it does not directly monitor or block email-based data exfiltration in real time. Option D is wrong because Audit provides logging and forensic search of past activities (e.g., who sent an email), but it lacks proactive monitoring or blocking capabilities to stop data exfiltration as it happens.

Practice this question →
34
MCQeasy

Your organization uses Microsoft Entra ID and wants to automatically block sign-ins from users located in countries that are not approved for business operations. Which Microsoft Entra ID feature should you configure?

A.Privileged Identity Management
B.Terms of Use
C.Conditional Access with Named Locations
D.Identity Protection user risk policy
AnswerC

Microsoft Entra Conditional Access policies are the primary tool for implementing granular access controls based on various signals, including user, device, application, and crucially, location. By configuring "Named Locations" to define specific IP address ranges or countries, an organization can create a Conditional Access policy to explicitly block or allow sign-ins from those defined geographic areas. This directly addresses the requirement to prevent access from specific countries by denying authentication attempts originating from those regions.

Why this answer

Conditional Access with Named Locations allows you to define geographic locations (e.g., countries) and then create a policy that blocks sign-ins from locations that are not approved for business operations. This is the correct feature because it directly enforces access controls based on the user's physical location at the time of authentication, using IP address ranges or country/region mapping.

Exam trap

The trap here is that candidates often confuse Identity Protection's risk-based policies with location-based blocking, but Identity Protection focuses on user and sign-in risk (e.g., impossible travel, anonymous IP) rather than static geographic restrictions.

How to eliminate wrong answers

Option A is wrong because Privileged Identity Management (PIM) manages just-in-time access and role activation for privileged roles, not location-based sign-in blocking. Option B is wrong because Terms of Use presents legal agreements that users must accept before accessing resources, but it does not enforce geographic restrictions. Option D is wrong because Identity Protection user risk policy responds to user risk levels (e.g., leaked credentials, anomalous behavior) and can block sign-ins based on risk, but it does not block sign-ins based on geographic location.

Practice this question →
35
MCQhard

Your organization uses Microsoft Sentinel to detect threats. A security analyst needs to create a custom analytics rule that triggers an incident when a user accesses more than 1000 files from an external IP address within 5 minutes. Which rule type should the analyst configure?

A.Fusion rule
B.ML Behavior Analytics rule
C.Scheduled query rule
D.Near-real-time (NRT) query rule
AnswerC

Scheduled query rules are the foundational and most flexible type of analytics rule in Microsoft Sentinel for custom threat detection. They allow security analysts to define precise Kusto Query Language (KQL) queries that run at specified intervals, look back over a defined time range (e.g., 5 minutes), and perform complex aggregations and filtering to identify threats based on custom thresholds and logic.

Why this answer

A scheduled query rule is the correct choice because it allows the analyst to define a custom KQL query that counts file access events from external IPs and triggers an incident when the threshold of 1000 files within 5 minutes is exceeded. This rule type supports aggregation, time windows, and custom thresholds, making it ideal for detecting specific behavioral patterns like high-volume access from external sources.

Exam trap

The trap here is that candidates confuse near-real-time (NRT) rules with scheduled rules, assuming NRT can handle any time window, but NRT rules are limited to a 1-minute lookback and cannot aggregate over longer periods like 5 minutes.

How to eliminate wrong answers

Option A is wrong because Fusion rules use pre-built machine learning models to correlate multiple alerts into a single incident, not custom user-defined thresholds or queries. Option B is wrong because ML Behavior Analytics rules rely on built-in machine learning models to detect anomalies based on baseline behavior, not custom KQL queries with explicit thresholds like 1000 files in 5 minutes. Option D is wrong because Near-real-time (NRT) query rules run queries every minute with a 1-minute lookback, but they cannot support a 5-minute time window or aggregation over that period; they are designed for low-latency detection of simple patterns, not complex threshold-based conditions.

Practice this question →
36
Multi-Selecteasy

A company wants to use Microsoft Defender for Cloud to secure their hybrid cloud environment. Which FOUR resource types can be assessed by Defender for Cloud?

Select 4 answers
A.Azure Virtual Machines
B.AWS EC2 instances
C.On-premises servers connected via Azure Arc
D.Kubernetes clusters
E.On-premises SQL Server
AnswersA, B, C, D

Azure Virtual Machines are native resources and are automatically assessed by Defender for Cloud.

Why this answer

Microsoft Defender for Cloud can assess Azure Virtual Machines (native), AWS EC2 instances via multi-cloud connector, on-premises servers connected via Azure Arc, and Kubernetes clusters (Azure or multi-cloud) via Defender for Containers. On-premises SQL Server without Azure Arc is not directly assessed.

Practice this question →
37
MCQhard

A company uses Microsoft Sentinel as its SIEM. They need to create a custom analytics rule that runs every hour and queries for failed logins from a specific IP address. Which rule scheduling option should they configure?

A.Run every 5 minutes with a 5-minute query period
B.Run every 24 hours with a 24-hour query period
C.Run every 1 hour with a 5-minute query period
D.Run every 1 hour with a 1-hour query period
AnswerD

This configuration is optimal for ensuring comprehensive hourly threat detection in Microsoft Sentinel. By running the analytics rule every hour and simultaneously querying the preceding 1-hour period, it guarantees that all relevant data generated within that timeframe is processed, preventing any data gaps. This balance between detection timeliness and resource utilization provides consistent and complete visibility into security events without excessive query frequency or unnecessary cost implications, aligning perfectly with a requirement for hourly monitoring.

Why this answer

To ensure the analytics rule captures all failed logins from the specified IP address that occur within the hour, the rule should be scheduled to run every 1 hour with a query period of 1 hour. This means each time the rule runs, it will query logs from the previous hour, covering the time since the last run. Options A and C have mismatched frequencies and query periods, and Option B runs too infrequently for hourly monitoring.

Practice this question →
38
MCQmedium

A security operations center (SOC) team needs to collect security logs from Azure services, on-premises servers, and third-party firewalls. They want a cloud-native solution that provides advanced threat detection through analytics, machine learning, and the ability to hunt for threats across all data sources. Which Microsoft solution should they deploy?

A.Microsoft Defender for Cloud
B.Microsoft 365 Defender
C.Microsoft Sentinel
D.Microsoft Defender for Identity
AnswerC

Microsoft Sentinel is the correct choice because it is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It is specifically designed to collect security data from virtually any source, including Azure services, other cloud providers, on-premises infrastructure, and third-party security solutions. Its powerful analytics, machine learning, and threat intelligence capabilities enable SOC teams to detect, investigate, and respond to threats across their entire enterprise environment effectively.

Why this answer

Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) solution that ingests logs from Azure services, on-premises servers, and third-party firewalls. It provides advanced threat detection via built-in analytics, machine learning models, and a powerful query language (Kusto Query Language) for threat hunting across all data sources.

Exam trap

The trap here is confusing Microsoft Defender for Cloud (a CSPM/CWPP tool) with Microsoft Sentinel (a cloud-native SIEM), as both appear in the Azure portal and deal with security logs, but only Sentinel provides centralized log ingestion, analytics, and threat hunting across heterogeneous sources.

Why the other options are wrong

A

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that focuses on securing Azure, hybrid, and multi-cloud environments, but it does not provide the advanced threat hunting, analytics, and machine learning capabilities across diverse log sources (on-premises, third-party) that Microsoft Sentinel offers as a SIEM/SOAR solution.

B

Microsoft 365 Defender is designed to protect Microsoft 365 environments (email, endpoints, identities) and does not natively ingest logs from third-party firewalls or on-premises servers outside the Microsoft ecosystem, nor does it provide the centralized SIEM/SOAR capabilities required for multi-source log collection and advanced threat hunting.

D

Microsoft Defender for Identity focuses on protecting on-premises Active Directory identities and detecting identity-based attacks, not on collecting and analyzing security logs from diverse sources like Azure services, on-premises servers, and third-party firewalls with advanced threat hunting.

Practice this question →
39
MCQmedium

A company uses Exchange Online. The security team wants to protect users from malware hidden in email attachments by detonating them in a secure sandbox environment before delivery. Which Microsoft Defender for Office 365 feature should they enable?

A.Safe Links
B.Safe Attachments
C.Anti-Phishing
D.Anti-Spoofing
AnswerB

Safe Attachments is a core component of Microsoft Defender for Office 365 that specifically addresses malicious file attachments. It employs dynamic analysis within a secure sandbox environment to "detonate" attachments, observing their behavior for suspicious activities or malicious payloads. This process occurs before the email reaches the recipient's inbox, effectively blocking or quarantining threatening files, including zero-day malware, based on their actual execution characteristics.

Why this answer

Safe Attachments is the correct feature because it specifically detonates email attachments in a secure, isolated sandbox environment to detect and block malware before the message reaches the user's inbox. This feature uses dynamic analysis to observe attachment behavior in real time, ensuring zero-day threats are identified and neutralized.

Exam trap

The trap here is that candidates often confuse Safe Links with Safe Attachments because both are part of Microsoft Defender for Office 365, but Safe Links deals with URLs while Safe Attachments deals with file payloads; the question explicitly mentions 'malware hidden in email attachments' which directly points to Safe Attachments.

Why the other options are wrong

A

Safe Links protects users from malicious URLs in emails and Office documents, not from malware hidden in email attachments. The question specifically asks about detonating attachments in a sandbox, which is the function of Safe Attachments.

C

Anti-Phishing protects against phishing attacks by analyzing email content and impersonation attempts, but it does not detonate attachments in a sandbox environment. The feature that performs sandbox detonation of attachments is Safe Attachments.

D

Anti-Spoofing is designed to prevent email spoofing by verifying sender identity, not to detonate malware in a sandbox. The question specifically asks for a feature that detonates attachments in a secure sandbox, which is Safe Attachments.

Practice this question →
40
MCQmedium

Your company uses Microsoft Purview Information Protection to classify and protect sensitive data. You need to ensure that when a user sends an email containing a credit card number, the email is automatically encrypted and a custom footer is added. Which two components should you configure?

A.Data Loss Prevention (DLP) policy for credit card numbers
B.Sensitivity label with auto-classification for credit card numbers
C.Auto-labeling policy that applies the sensitivity label to emails
D.Retention label and policy for credit card data
AnswerB, C

The label can detect credit card numbers and apply encryption.

Why this answer

Sensitivity labels with auto-classification for credit card numbers (Option B) allow automatic detection and classification of sensitive data types like credit card numbers. An auto-labeling policy (Option C) then applies the sensitivity label to emails, which can enforce encryption and add a custom footer. Together, these components ensure that emails containing credit card numbers are automatically encrypted and footers are added.

Exam trap

The trap here is that candidates often confuse DLP policies with sensitivity labels, thinking DLP can enforce encryption and footers, but DLP only detects and blocks, while sensitivity labels with auto-labeling policies handle classification, encryption, and footers.

How to eliminate wrong answers

Option A is wrong because a Data Loss Prevention (DLP) policy can detect credit card numbers and block or warn, but it does not natively apply encryption or custom footers; DLP policies are for preventing data loss, not for applying sensitivity labels or encryption. Option D is wrong because retention labels and policies are used for data lifecycle management (retention and deletion), not for real-time encryption or footer addition when sending emails.

Practice this question →
41
MCQeasy

An organization uses Microsoft Sentinel for security information and event management (SIEM) and security orchestration automated response (SOAR). They want to automatically respond to a specific incident by running a playbook. What should they configure?

A.Automation rule
B.Workbook
C.Hunting query
D.Analytics rule
AnswerA

Automation rules in Microsoft Sentinel are designed to orchestrate and automate incident response workflows. They allow security operations teams to define conditions based on incident properties (e.g., severity, specific entities) and then automatically perform actions, such as running a playbook, assigning an incident, or changing its status. This capability is crucial for reducing manual effort and accelerating response times to security threats.

Why this answer

Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including running playbooks. When an incident is created or updated, an automation rule can trigger a playbook (a collection of automated workflows based on Azure Logic Apps) to perform actions such as blocking a user or isolating a machine, directly addressing the requirement to automatically respond to a specific incident.

Exam trap

The trap here is that candidates often confuse analytics rules with automation rules, thinking that analytics rules can directly run playbooks, but in Sentinel, analytics rules only generate alerts, and automation rules are the mechanism to attach playbooks to incidents.

How to eliminate wrong answers

Option B (Workbook) is wrong because workbooks are interactive dashboards for visualizing and analyzing data, not for triggering automated responses. Option C (Hunting query) is wrong because hunting queries are used to proactively search for threats in raw data, not to automate incident response. Option D (Analytics rule) is wrong because analytics rules generate alerts based on scheduled queries or Microsoft security alerts, but they do not directly run playbooks; automation rules are needed to attach playbooks to incidents created from those alerts.

Practice this question →
42
MCQmedium

A company runs workloads in Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). The security team needs a single, unified dashboard to continuously assess the security posture of all cloud resources, identify misconfigurations, and receive prioritized recommendations for remediation. Which Microsoft security solution should they use?

A.Microsoft Defender for Cloud
B.Microsoft Defender for Cloud Apps
C.Microsoft Sentinel
D.Microsoft Defender for Endpoint
AnswerA

Microsoft Defender for Cloud is the correct solution because it provides comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWP) across multi-cloud environments, including Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). It centralizes security posture assessment, identifies misconfigurations, and offers prioritized recommendations for resources in both Azure and AWS from a single pane of glass, ensuring consistent security across the company's diverse infrastructure.

Why this answer

Microsoft Defender for Cloud is the correct solution because it provides a unified cloud security posture management (CSPM) dashboard that continuously assesses resources across Azure, AWS, and GCP. It identifies misconfigurations against industry benchmarks (e.g., CIS, NIST) and delivers prioritized, actionable recommendations to remediate risks, directly meeting the requirement for a single dashboard across multi-cloud environments.

Exam trap

The trap here is confusing a cloud security posture management (CSPM) tool (Defender for Cloud) with a cloud access security broker (CASB) or a SIEM/SOAR solution, leading candidates to pick Defender for Cloud Apps or Sentinel because they also provide security visibility, but for different use cases.

Why the other options are wrong

B

Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) focused on SaaS application usage and shadow IT discovery, not on assessing the security posture of IaaS/PaaS resources across multiple clouds like AWS and GCP.

C

Microsoft Sentinel is a SIEM/SOAR solution for security analytics and threat detection across the enterprise, not a unified dashboard for continuous cloud security posture assessment and misconfiguration identification across multi-cloud environments.

D

Microsoft Defender for Endpoint focuses on endpoint devices (e.g., workstations, servers) and does not provide a unified dashboard for assessing security posture across multi-cloud environments (Azure, AWS, GCP).

Practice this question →
43
Multi-Selecteasy

Which THREE features are part of Microsoft Entra ID? (Select three.)

Select 3 answers
A.Privileged Identity Management
B.Microsoft Sentinel
C.Conditional Access
D.Identity Protection
E.Microsoft Intune
AnswersA, C, D

Privileged Identity Management (PIM) is indeed a feature of Microsoft Entra ID, but it is not one of the two correct answers for this question. The intended correct options are Conditional Access and Identity Protection.

Why this answer

Conditional Access is a core feature of Microsoft Entra ID that allows administrators to enforce policies based on conditions such as user location, device state, or sign-in risk, enabling granular access control. Identity Protection is also part of Microsoft Entra ID, using machine learning to detect and respond to identity-based risks like leaked credentials or anomalous sign-in patterns. Privileged Identity Management (PIM) is a key capability of Microsoft Entra ID Governance, which is a set of features within Microsoft Entra ID for managing, controlling, and monitoring access to important resources, and is explicitly covered as a Microsoft Entra ID capability in the SC-900 exam objectives.

Exam trap

The trap here is that candidates may confuse features that integrate with Microsoft Entra ID (like Intune or Sentinel) as being part of Entra ID itself, when they are separate Azure services that only use Entra ID for authentication or data sources.

Practice this question →
44
MCQhard

Contoso has a hybrid identity with AD DS synced to Microsoft Entra ID. They want to block legacy authentication protocols that bypass MFA. Which security solution should they use?

A.Microsoft Entra Password Protection
B.Microsoft Entra ID Protection
C.Microsoft Entra Connect Health
D.Conditional Access policy
AnswerD

A Conditional Access policy is the correct solution because it allows administrators to define conditions under which users can access cloud applications. By configuring a policy to target "Client apps" and specifically selecting "Other clients" or "Exchange ActiveSync clients," organizations can effectively block authentication attempts originating from applications using legacy protocols such as POP3, IMAP4, or older Office clients that do not support modern authentication. This directly addresses the requirement to block legacy authentication.

Why this answer

Conditional Access policies in Microsoft Entra ID can be configured to block legacy authentication protocols (such as POP3, IMAP, SMTP, and basic authentication) by targeting client apps that do not support modern authentication. This directly prevents bypass of MFA because legacy protocols do not support MFA challenges, making them a common attack vector. By creating a policy that blocks all access from legacy authentication clients, Contoso enforces MFA for all sign-ins that use modern authentication.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID Protection (which detects risky sign-ins) with the actual enforcement mechanism (Conditional Access) that can block legacy authentication, or they mistakenly think Password Protection or Connect Health can control authentication protocols.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Password Protection is designed to detect and block weak passwords and common password attacks, not to control authentication protocols or enforce MFA. Option B is wrong because Microsoft Entra ID Protection focuses on detecting and responding to identity-based risks (e.g., leaked credentials, anomalous sign-ins) but does not itself block legacy authentication protocols; it can feed risk signals into Conditional Access but is not the direct control. Option C is wrong because Microsoft Entra Connect Health monitors the health of the on-premises AD DS sync infrastructure and provides alerts for sync errors or performance issues, but it has no capability to block authentication protocols or enforce MFA.

Practice this question →
45
MCQmedium

An organization uses Microsoft Sentinel for SIEM. The security operations center (SOC) wants to automatically create an incident when a user account is compromised and suspicious activity is detected. Which Microsoft Sentinel feature should be used?

A.Analytics rules
B.Watchlists
C.Automation playbooks
D.Workbooks
AnswerA

Analytics rules create incidents from detections.

Why this answer

Analytics rules in Microsoft Sentinel are the correct feature because they define conditions for generating alerts and can automatically create incidents when those conditions are met. In this scenario, an analytics rule can be configured to detect a compromised user account and suspicious activity, then automatically create an incident for the SOC to investigate.

Exam trap

The trap here is that candidates often confuse automation playbooks (which respond to incidents) with analytics rules (which create incidents), leading them to select playbooks for incident creation instead of detection logic.

How to eliminate wrong answers

Option B is wrong because watchlists are collections of data (e.g., IP addresses, user names) used for correlation and enrichment within analytics rules or queries, but they do not automatically create incidents on their own. Option C is wrong because automation playbooks are triggered by alerts or incidents to perform automated response actions (e.g., blocking a user), but they do not generate incidents; they respond to them. Option D is wrong because workbooks are visualization and reporting tools that provide dashboards and insights from data, but they do not create incidents or automate detection.

Practice this question →
46
MCQmedium

Your organization uses Microsoft Intune for mobile device management. You need to ensure that users cannot copy corporate data from managed apps to personal apps. Which policy should you configure?

A.App Configuration Policy
B.App Protection Policy
C.Device Compliance Policy
D.Conditional Access Policy
AnswerB

App Protection Policies (APP), also known as Mobile Application Management (MAM) policies, are specifically designed to protect organizational data within applications, irrespective of whether the device is enrolled in MDM. These policies enforce granular data loss prevention (DLP) controls, such as restricting copy/paste, preventing "save as" to personal storage locations, or blocking "open in" functionality to unmanaged applications. By creating a secure container around corporate data within compliant apps, APP ensures sensitive information remains within the organization's control, preventing its transfer to personal or unapproved applications.

Why this answer

App Protection Policies (APP) in Microsoft Intune are designed to manage how data is handled within applications, regardless of device enrollment. By configuring a 'Save as' or 'Copy/paste' restriction between managed and unmanaged apps, you can prevent corporate data from being transferred to personal apps. This policy operates at the app layer, not the device layer, making it the correct choice for this data leakage scenario.

Exam trap

The trap here is that candidates often confuse App Protection Policies with Device Compliance Policies, thinking that device-level controls can prevent app data leakage, but APP is the only policy that operates at the application layer to enforce data transfer restrictions.

How to eliminate wrong answers

Option A is wrong because App Configuration Policies are used to supply custom settings or configurations to apps (e.g., server URLs or theme colors), not to restrict data movement between apps. Option C is wrong because Device Compliance Policies evaluate device-level settings (e.g., jailbreak detection, minimum OS version) and do not control app-to-app data transfer. Option D is wrong because Conditional Access Policies enforce access controls at sign-in (e.g., require MFA or compliant device) but do not govern data behavior within apps after access is granted.

Practice this question →
47
MCQhard

Refer to the exhibit. You are a compliance administrator running PowerShell to update a sensitivity label in Microsoft Purview. The command fails with an error that the label is not found. What is the most likely cause?

A.The -Settings parameter is deprecated.
B.The cmdlet Get-MgInformationProtectionPolicy does not return labels.
C.The user does not have permissions to view labels.
D.The label name is misspelled.
AnswerB

The Get-MgInformationProtectionPolicy cmdlet is specifically designed to retrieve information protection policy objects, which define the overall framework for data protection within an organization. It does not enumerate or return individual sensitivity labels. To retrieve sensitivity labels, the correct cmdlet to use is Get-MgInformationProtectionSensitivityLabel, which is dedicated to managing and listing these specific classification objects.

Why this answer

The cmdlet Get-MgInformationProtectionPolicy retrieves the policy configuration but does not return individual sensitivity labels. To update a specific label, you must use Get-MgInformationProtectionSensitivityLabel to first retrieve the label object, then pipe it to Set-MgInformationProtectionSensitivityLabel. The error 'label not found' occurs because the cmdlet used does not expose labels, not because the label is missing or misspelled.

Exam trap

The trap here is that candidates assume any 'InformationProtection' cmdlet returns labels, but Microsoft deliberately separates policy-level and label-level cmdlets, so using the wrong one yields a 'not found' error even when the label exists.

How to eliminate wrong answers

Option A is wrong because the -Settings parameter is not deprecated; it is still valid for Set-MgInformationProtectionSensitivityLabel. Option C is wrong because the error message specifically states 'label is not found', not 'access denied', indicating a retrieval issue rather than a permission issue. Option D is wrong because even if the label name were misspelled, the cmdlet Get-MgInformationProtectionPolicy would not return labels at all, so the error would still occur regardless of spelling.

Practice this question →
48
MCQeasy

Refer to the exhibit. An administrator creates a Conditional Access policy in Microsoft Entra ID. What will this policy do?

A.Block access for Global Administrators unless they use MFA
B.Require MFA for all users
C.Require MFA for Global Administrators accessing any application
D.Require MFA for users accessing the Microsoft Entra admin center only
AnswerC

This statement accurately describes the conditional access policy's intended behavior and configuration. The policy's "Users and groups" condition is configured to target the "Global Administrator" directory role, ensuring only these privileged accounts are affected. Concurrently, the "Cloud apps or actions" condition is set to "All cloud apps," meaning it applies universally to any application accessed by these administrators. Finally, the "Grant" control enforces "Require multifactor authentication" for these specific users across all applications.

Why this answer

The policy targets 'Global Administrators' and the 'All cloud apps' condition, then requires 'Require multi-factor authentication' as the access control. This means any Global Administrator attempting to access any application (not just the Entra admin center) must satisfy MFA. Option C correctly captures this scope.

Exam trap

The trap here is that candidates often assume a policy targeting 'Global Administrators' with MFA only applies to the Azure portal, but the 'All cloud apps' condition extends the requirement to every cloud application the admin accesses.

How to eliminate wrong answers

Option A is wrong because the policy does not block access; it requires MFA, not a block, and it applies to all apps, not just when MFA is absent. Option B is wrong because the policy is scoped to the 'Global Administrators' group, not all users. Option D is wrong because the policy targets 'All cloud apps', not only the Microsoft Entra admin center.

Practice this question →
49
MCQhard

You are the security administrator for a large healthcare organization that uses Microsoft 365 E5. The organization must comply with HIPAA and GDPR regulations. You have implemented Microsoft Purview Information Protection with sensitivity labels to classify and protect patient data. Recently, the compliance team identified that some documents containing Protected Health Information (PHI) are being shared externally without protection. You need to prevent users from sharing documents classified as 'Highly Confidential' with external users unless the document is encrypted and labeled. Additionally, you must ensure that any external sharing of such documents is automatically blocked. You have the following options available. Which action should you take?

A.Configure auto-labeling for SharePoint to automatically apply the 'Highly Confidential' label to all documents containing PHI
B.Create a data loss prevention (DLP) policy in Microsoft Purview that detects the 'Highly Confidential' label and blocks sharing with external users
C.Configure a conditional access policy in Microsoft Entra ID to block external access to SharePoint sites containing PHI
D.Create a retention policy for SharePoint that prevents deletion of documents with the 'Highly Confidential' label
AnswerB

A DLP policy can detect the 'Highly Confidential' label and automatically block external sharing, meeting the requirement.

Why this answer

The correct action is to create a DLP policy in Microsoft Purview that detects the 'Highly Confidential' label and blocks sharing with external users. DLP policies are designed to inspect content and labels on documents, then take protective actions such as blocking external sharing, sending notifications, or applying restrictions. Auto-labeling (option A) applies labels automatically but does not enforce sharing restrictions.

Conditional access policies (option C) control access at the authentication level, not based on document labels. Retention policies (option D) manage data lifecycle, not sharing permissions.

Practice this question →
50
MCQhard

An organization is deploying Microsoft Intune for mobile device management. They need to ensure that all iOS devices must have a passcode of at least 6 characters and the device must be encrypted. What should they configure?

A.A Conditional Access policy
B.A device configuration profile
C.An app protection policy
D.A device compliance policy
AnswerD

A device compliance policy explicitly defines the security baselines and health requirements that a device must meet to be considered compliant with organizational standards. These policies specify settings like minimum OS versions, encryption status, password requirements, or the presence of antivirus software. Intune continuously evaluates devices against these defined rules, marking them as compliant or non-compliant, and can then report this status for Conditional Access enforcement.

Why this answer

Device compliance policies in Intune define the rules that devices must meet to be considered compliant, such as requiring a passcode of at least 6 characters and device encryption. Option A is incorrect because Conditional Access policies use compliance status to enforce access controls, but do not define the compliance rules themselves. Option B is incorrect because device configuration profiles push settings to devices but do not enforce compliance; they are used for configuring device settings.

Option C is incorrect because app protection policies manage how apps access and handle data, not device-level requirements like passcode and encryption.

Practice this question →
51
MCQeasy

Your company uses Microsoft Defender for Endpoint. A report shows that several devices are missing critical security updates. What feature should you use to deploy the missing updates?

A.Microsoft Intune update rings for Windows
B.Microsoft Defender for Endpoint's threat and vulnerability management (TVM)
C.Microsoft Configuration Manager
D.Microsoft Update
AnswerA

Microsoft Intune update rings for Windows provide a cloud-based solution for managing and deploying Windows updates to organizational endpoints. These rings allow administrators to define a phased rollout strategy, ensuring that devices receive updates in a controlled manner, which is crucial for maintaining security and operational stability. When a report indicates a need for updates, Intune is the primary cloud-native tool to enforce and monitor their deployment across managed devices.

Why this answer

Microsoft Intune update rings for Windows allow you to configure and deploy Windows quality and feature updates to managed devices. Since the question specifies deploying missing security updates, update rings provide the policy-based mechanism to schedule and enforce installation of those updates across devices enrolled in Intune.

Exam trap

The trap here is that candidates confuse TVM's vulnerability discovery capability with the actual deployment mechanism, assuming TVM can both find and install updates, when in fact it relies on Intune or Configuration Manager for remediation.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Endpoint's threat and vulnerability management (TVM) is a discovery and assessment tool that identifies missing updates and vulnerabilities, but it does not deploy updates; it integrates with Intune or Configuration Manager for remediation. Option C is wrong because Microsoft Configuration Manager is an on-premises management tool that can deploy updates, but the question does not specify an on-premises environment or co-management; Intune update rings are the correct cloud-native solution for deploying updates to devices managed via Microsoft Defender for Endpoint. Option D is wrong because Microsoft Update is the underlying service that hosts and distributes update content, not a management tool for deploying updates to specific devices; it lacks the policy and scheduling capabilities needed to target missing updates.

Practice this question →
52
Multi-Selectmedium

Which TWO Microsoft Purview solutions can be used to discover and classify sensitive data in Microsoft 365? (Select two.)

Select 2 answers
A.Data Loss Prevention
B.Information Protection
C.Sensitivity labels
D.Audit
E.Data Classification
AnswersB, E

Microsoft Purview Information Protection (MPIP) is a comprehensive solution designed to discover, classify, label, and protect sensitive data throughout an organization's digital estate. It leverages sensitivity labels, sensitive information types, and trainable classifiers to identify and categorize data based on its sensitivity, applying visual markings, encryption, and access restrictions to ensure proper handling and compliance.

Why this answer

Information Protection (option B) provides the ability to discover, classify, and protect sensitive data across Microsoft 365 by using trainable classifiers and content scanning. Data Classification (option E) offers a unified view of sensitive data across the tenant, including classification results from sensitivity labels and retention labels, enabling administrators to identify and monitor sensitive information at scale.

Exam trap

The SC-900 exam often tests the distinction between the tool that performs discovery (Data Classification) and the solution that enables classification (Information Protection), causing candidates to mistakenly select Sensitivity labels as a discovery solution instead of recognizing it as a labeling mechanism.

Practice this question →
53
MCQmedium

A company uses Microsoft Sentinel as its SIEM. The security team wants to automatically trigger a playbook when a high-severity incident is created. Which automation option should be used?

A.Azure Policy assignment
B.Microsoft Power Automate flow directly from Sentinel
C.Automation rule in Microsoft Sentinel
D.Azure Logic Apps HTTP trigger
AnswerC

Automation rules in Microsoft Sentinel are the core mechanism for orchestrating automated responses to security incidents and alerts, streamlining the Security Orchestration, Automation, and Response (SOAR) process. These rules allow security teams to define specific conditions (e.g., incident severity, associated entities) that, when met, will automatically trigger a pre-configured playbook (an Azure Logic App), assign incidents, change their status, or close them. This significantly enhances response efficiency and consistency by automating repetitive tasks.

Why this answer

Microsoft Sentinel automation rules are specifically designed to trigger automated responses—such as running playbooks—based on incident creation or update conditions, including severity level. When a high-severity incident is created, an automation rule can invoke a playbook without requiring manual intervention or external orchestration.

Exam trap

The trap here is that candidates confuse the automation rule (the trigger condition in Sentinel) with the playbook itself (the workflow logic), or mistakenly think a generic HTTP trigger or Power Automate flow can replace Sentinel's built-in incident-based automation rule.

How to eliminate wrong answers

Option A is wrong because Azure Policy assignment enforces compliance rules on Azure resources (e.g., tagging or location restrictions) and cannot trigger playbooks in response to Sentinel incidents. Option B is wrong because while Microsoft Power Automate can be used with Sentinel, directly creating a flow 'from Sentinel' is not the native automation mechanism; Sentinel uses automation rules to invoke playbooks (which may be built on Logic Apps or Power Automate), but the rule itself is the trigger. Option D is wrong because Azure Logic Apps HTTP trigger is a generic webhook trigger that requires an external caller; Sentinel automation rules are the intended way to invoke Logic Apps playbooks based on incident conditions, not a direct HTTP trigger from Sentinel.

Practice this question →
54
MCQhard

You are reviewing a Microsoft Purview auto-labeling policy configuration. Based on the exhibit, what happens when a document contains a credit card number and is labeled 'Confidential'?

A.Access is allowed
B.Encryption is applied to the document
C.An administrator is notified
D.Access is blocked
AnswerD

The rule blocks access when condition met.

Why this answer

The exhibit shows a Microsoft Purview auto-labeling policy configured to apply the 'Confidential' label when a credit card number is detected. The policy's action for this label is set to 'Block access,' meaning that when the condition is met, the document's access is blocked. Therefore, option D is correct because the policy explicitly blocks access to the document.

Exam trap

The trap here is that candidates often confuse the action of 'applying a label' with the label's default protection settings, assuming encryption is always applied, when in fact the policy's specific action (e.g., block access) determines the outcome.

How to eliminate wrong answers

Option A is wrong because the policy's action is to block access, not allow it; allowing access would contradict the purpose of auto-labeling with a restrictive label. Option B is wrong because encryption is a separate action that can be configured in a sensitivity label, but the exhibit shows the action is 'Block access,' not 'Encrypt.' Option C is wrong because administrator notification is not an action defined in the auto-labeling policy; the policy directly blocks access without requiring manual notification.

Practice this question →
55
MCQmedium

Your company uses Microsoft Defender for Cloud to secure Azure resources. You need to enable network security recommendations for all virtual networks. Which security policy should you enable?

A.Azure Security Benchmark
B.Adaptive network hardening
C.Network Security Group (NSG) flow logs
D.Just-in-time VM access
AnswerA

The Azure Security Benchmark is a Microsoft-authored, Azure-specific set of guidelines and best practices for securing resources on Azure. It provides a comprehensive framework, including built-in policies within Azure Policy, that Defender for Cloud uses to assess the security posture of your environment and generate actionable network security recommendations. These recommendations are directly aligned with industry standards and regulatory compliance requirements, offering a foundational security baseline.

Why this answer

The Azure Security Benchmark provides a comprehensive set of security recommendations, including network security controls for virtual networks, such as restricting inbound/outbound traffic and enforcing encryption. Enabling this policy in Microsoft Defender for Cloud applies built-in Azure Policy initiatives that assess and recommend network security configurations across all virtual networks. This directly meets the requirement to enable network security recommendations for all virtual networks.

Exam trap

The trap here is that candidates confuse a specific security feature (like adaptive network hardening or JIT VM access) with a broad security policy framework (Azure Security Benchmark) that provides overarching recommendations for network security.

How to eliminate wrong answers

Option B (Adaptive network hardening) is wrong because it is a specific Defender for Cloud feature that dynamically hardens NSG rules based on traffic patterns, not a security policy that enables network security recommendations for all virtual networks. Option C (Network Security Group flow logs) is wrong because it is a diagnostic logging feature that records IP traffic through NSGs, used for monitoring and analysis, not a security policy that provides recommendations. Option D (Just-in-time VM access) is wrong because it is a feature that reduces VM exposure by locking down inbound traffic and providing on-demand access, not a policy that enables network security recommendations for all virtual networks.

Practice this question →
56
MCQhard

Your organization has implemented Microsoft Defender for Cloud to protect Azure resources. You are responsible for security posture management. You need to ensure that all Azure VMs have the latest security updates installed. You have enabled automatic VM patching via Azure Update Manager. However, some VMs are not receiving updates because they are not registered with the Update Manager. You need to identify which VMs are missing updates and ensure they are patched. What should you do?

A.Create an Azure Policy to enforce automatic updates on all VMs.
B.Use the Microsoft Defender for Cloud recommendation 'System updates should be installed on your machines' to identify VMs missing updates, then enable auto-patching for those VMs.
C.Review Microsoft Defender for Cloud security alerts for 'Missing system updates'.
D.Use Azure Update Manager's compliance view to export a list of VMs with missing updates.
AnswerB

This recommendation lists VMs missing updates.

Why this answer

Microsoft Defender for Cloud provides the recommendation 'System updates should be installed on your machines' that identifies VMs missing updates, including those not registered with Azure Update Manager. Option A is incorrect because Azure Policy can enforce compliance but does not directly identify missing updates. Option C is incorrect because Azure Update Manager's compliance view shows update status for registered VMs but may not show unregistered VMs.

Option D is incorrect because security alerts are for threats, not missing updates.

Practice this question →
57
MCQhard

Refer to the exhibit. The KQL query is run in Microsoft Defender for Endpoint. What is the purpose of this query?

A.To find devices with a high number of operations on potentially sensitive files.
B.To list all devices that have files named confidential.
C.To detect malware on devices.
D.To list all file creation events.
AnswerA

The KQL query specifically targets DeviceFileEvents where the FileName contains "confidential," indicating potentially sensitive data. By then summarizing the count() of these events per DeviceName and filtering for EventCount > 5, the query effectively identifies devices exhibiting an unusually high volume of interactions with these specific files, which could signify suspicious activity or data exfiltration attempts.

Why this answer

The KQL query filters for `DeviceFileEvents` where `SensitivityLabel` is not empty, indicating files with sensitivity labels applied (e.g., confidential, internal). It then summarizes the count of operations per device and orders by the highest count. This identifies devices with a high number of operations on potentially sensitive files, aligning with data loss prevention (DLP) monitoring.

Exam trap

The trap here is that candidates may assume the query lists all file creation events (Option D) or detects malware (Option C), but the key is the `SensitivityLabel` filter, which directly ties to data protection and DLP, not general file events or malware.

How to eliminate wrong answers

Option B is wrong because the query does not filter for a specific file name like 'confidential'; it checks for any non-empty `SensitivityLabel`, which could include various labels. Option C is wrong because the query targets file operations with sensitivity labels, not malware detection (which would use `DeviceProcessEvents` or `DeviceEvents` with threat indicators). Option D is wrong because the query does not list all file creation events; it filters for events with a non-empty `SensitivityLabel` and summarizes counts, not listing every creation event.

Practice this question →
58
MCQeasy

A company wants to use Microsoft Defender for Office 365 to protect against malicious links in email. Which feature should they enable?

A.Safe Attachments
B.Anti-malware policy
C.Safe Links
D.Anti-spam policy
AnswerC

Safe Links is a core feature of Microsoft Defender for Office 365 specifically designed to protect users from malicious URLs. It operates by rewriting original links in emails and Office documents, replacing them with secure Microsoft Defender for Office 365 URLs. When a user clicks a rewritten link, Safe Links performs a real-time scan to determine if the destination website is malicious. If the link is deemed unsafe, the user is blocked from accessing the site, effectively preventing phishing attacks and drive-by downloads originating from embedded URLs.

Why this answer

Safe Links is the correct feature because it specifically protects against malicious links in email by scanning URLs at the time of click, checking them against real-time threat intelligence, and blocking or warning users if the link is malicious. This is a core capability of Microsoft Defender for Office 365 designed to prevent phishing and malware delivery via hyperlinks.

Exam trap

The trap here is that candidates often confuse Safe Links with Safe Attachments because both are part of Defender for Office 365, but Safe Links is specifically for URLs while Safe Attachments is for file attachments.

How to eliminate wrong answers

Option A is wrong because Safe Attachments protects against malicious attachments (files) in email, not links. Option B is wrong because Anti-malware policy focuses on detecting and removing malware from email attachments and messages, not on scanning URLs. Option D is wrong because Anti-spam policy filters out unwanted spam messages based on content and sender reputation, but does not perform real-time link scanning or protection against malicious URLs.

Practice this question →
59
MCQmedium

Your organization uses Microsoft Purview to classify data. You need to automatically apply a 'Confidential' sensitivity label to any document that contains a Social Security number. What should you create?

A.An auto-labeling policy for sensitivity labels
B.A sensitivity label policy with manual labeling
C.A Data Loss Prevention (DLP) policy
D.A retention policy
AnswerA

An auto-labeling policy within Microsoft Purview automatically applies sensitivity labels to content based on specific conditions, such as the detection of sensitive information types (SITs), keywords, or trainable classifiers. This method is ideal for large-scale data classification, ensuring consistent application of labels without manual intervention, thereby enabling automated protection and governance. It directly addresses the need to classify data programmatically and efficiently.

Why this answer

An auto-labeling policy for sensitivity labels in Microsoft Purview can automatically apply a 'Confidential' sensitivity label to documents containing sensitive information types like Social Security numbers. This policy uses content scanning and pattern matching to detect the data and apply the label without user intervention, meeting the requirement for automatic classification.

Exam trap

The trap here is confusing auto-labeling policies with DLP policies, as both deal with sensitive data, but DLP policies enforce actions on data in motion or at rest without applying labels, while auto-labeling policies specifically apply sensitivity labels based on content detection.

How to eliminate wrong answers

Option B is wrong because a sensitivity label policy with manual labeling requires users to manually select and apply the label, which does not meet the requirement for automatic application. Option C is wrong because a Data Loss Prevention (DLP) policy is designed to prevent unauthorized sharing or leakage of sensitive data by enforcing actions like blocking or alerting, not to automatically apply sensitivity labels. Option D is wrong because a retention policy governs how long data is kept or when it is deleted, and does not apply sensitivity labels based on content.

Practice this question →
60
MCQmedium

A company manages Azure virtual machines and on-premises servers. The security team needs a single dashboard that provides a secure score and actionable recommendations to improve the security posture across both environments. Which Microsoft solution should be used?

A.Microsoft 365 Defender portal
B.Microsoft Defender for Cloud
C.Microsoft Sentinel
D.Microsoft Defender for Cloud Apps
AnswerB

Microsoft Defender for Cloud is the correct solution because it provides comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities across Azure, on-premises, and multi-cloud environments. It delivers a secure score, actionable security recommendations, and advanced threat protection for virtual machines and servers, regardless of their hosting location. By integrating with Azure Arc, Defender for Cloud extends its security management and monitoring to on-premises servers, ensuring consistent security posture across the entire hybrid infrastructure.

Why this answer

Microsoft Defender for Cloud provides a unified dashboard that displays a secure score and actionable recommendations for Azure virtual machines, on-premises servers, and other cloud workloads. It integrates with Azure Arc to extend security monitoring to on-premises resources, enabling a single view of security posture across hybrid environments.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud (formerly Azure Security Center) with Microsoft 365 Defender, assuming the latter covers all security needs, but Microsoft 365 Defender is limited to Microsoft 365 workloads and does not assess Azure or on-premises infrastructure security posture.

Why the other options are wrong

A

The Microsoft 365 Defender portal focuses on securing Microsoft 365 workloads (email, endpoints, identities) and does not provide a unified secure score or recommendations for Azure VMs and on-premises servers.

C

Microsoft Sentinel is a SIEM/SOAR solution for security analytics and threat detection, not a dashboard for secure score and posture recommendations across hybrid environments.

D

Microsoft Defender for Cloud Apps is a cloud access security broker focused on SaaS applications, not on providing a unified secure score and recommendations for Azure VMs and on-premises servers.

Practice this question →
61
MCQhard

A company uses Microsoft Intune for mobile device management (MDM). They need to ensure that corporate data on personal devices is encrypted. Which configuration profile type should they deploy?

A.Email profile
B.Certificate profile
C.Compliance policy
D.Device restrictions profile
AnswerD

A Device restrictions profile in Microsoft Intune is the appropriate configuration profile for enforcing various security and functional settings on mobile devices, including device-level data encryption. This profile allows administrators to mandate specific encryption requirements, such as requiring storage encryption for the entire device, setting encryption types, or configuring related password policies necessary for unlocking encrypted data. It directly applies these security configurations to the device operating system.

Why this answer

Device restrictions profile in Microsoft Intune allows administrators to enforce device-level security settings, including encryption of corporate data on personal devices. This profile type can require BitLocker (Windows) or FileVault (macOS) encryption, and for mobile devices, it can mandate device encryption via policies that align with platform-specific encryption standards (e.g., Android's full-disk encryption or iOS Data Protection). By deploying a device restrictions profile with encryption settings enabled, the organization ensures that corporate data stored on the device is protected at rest.

Exam trap

The trap here is that candidates confuse compliance policies (which only check and report encryption status) with configuration profiles (which actually deploy the encryption setting), leading them to pick Option C instead of D.

How to eliminate wrong answers

Option A is wrong because an email profile configures email account settings (e.g., server, port, SSL) and does not enforce device-level encryption. Option B is wrong because a certificate profile deploys digital certificates for authentication or VPN/email signing, not encryption of data at rest on the device. Option C is wrong because a compliance policy evaluates whether a device meets security requirements (e.g., encryption status) and can mark it non-compliant, but it does not deploy the encryption settings themselves — it only reports or triggers conditional access actions.

Practice this question →
62
MCQeasy

Your company uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The security team wants to identify resources that are missing system updates. Which feature should they use?

A.Just-in-time VM access
B.Vulnerability assessment solutions
C.Adaptive application controls
D.Secure Score recommendations
AnswerD

Secure Score in Microsoft Defender for Cloud provides a quantifiable measure of an organization's security posture across its hybrid cloud environment. It aggregates findings from various security assessments, including those related to missing system updates, security misconfigurations, and other vulnerabilities. The platform generates specific, prioritized recommendations to address these issues, such as applying missing operating system patches or software updates, directly contributing to an improved security score and overall security posture.

Why this answer

Secure Score recommendations in Microsoft Defender for Cloud include a specific recommendation for 'System updates should be installed on your machines' (or similar naming). This recommendation identifies Azure resources, particularly VMs, that are missing critical or security system updates by integrating with the Update Management solution or Microsoft Defender for Cloud's built-in vulnerability assessment. Selecting this recommendation allows the security team to view and remediate missing updates, directly addressing the requirement to assess security posture regarding system updates.

Exam trap

The trap here is that candidates often confuse 'Vulnerability assessment solutions' (Option B) with 'system updates,' but vulnerability assessment focuses on software vulnerabilities and misconfigurations, whereas missing system updates are a distinct category tracked by a specific Secure Score recommendation.

How to eliminate wrong answers

Option A is wrong because Just-in-time VM access controls network access to management ports (e.g., RDP/SSH) by locking them down when not needed, but it does not assess or report on missing system updates. Option B is wrong because Vulnerability assessment solutions (e.g., integrated Qualys or Microsoft Defender Vulnerability Management) identify software vulnerabilities and misconfigurations, but they are not specifically focused on missing system updates; they cover a broader range of CVEs and weaknesses. Option C is wrong because Adaptive application controls use machine learning to define allowlists for applications running on Azure VMs, preventing unauthorized executables, but they do not evaluate the installation status of system updates.

Practice this question →
63
Multi-Selecteasy

Which TWO of the following are features of Microsoft Purview Data Loss Prevention (DLP)? (Select TWO.)

Select 2 answers
A.Detect and block malware
B.Apply sensitivity labels
C.Manage user access rights
D.Provide policy tips to users
E.Monitor and prevent sharing of sensitive data
AnswersD, E

Microsoft Purview Data Loss Prevention (DLP) policies are designed to provide policy tips to users directly within applications like Outlook, Teams, and SharePoint. These contextual notifications appear when users are about to perform an action that violates a DLP policy, such as sharing sensitive data externally. This feature educates users in real-time, helping them understand compliance requirements and correct their behavior before a data leak occurs.

Why this answer

Correct answers: D and E. D: Provide policy tips to users is a feature of Microsoft Purview DLP that educates users about policy violations. E: Monitor and prevent sharing of sensitive data is the primary function of DLP.

Option A: Detect and block malware is a feature of Microsoft Defender for Endpoint. Option B: Apply sensitivity labels is a feature of Microsoft Information Protection. Option C: Manage user access rights is a feature of Entra ID (Identity Governance).

Practice this question →
64
MCQeasy

Your organization uses Microsoft Intune to manage devices. You need to ensure that only devices with a passcode can access corporate email. What should you configure?

A.Device configuration policy
B.Enrollment restrictions
C.Device compliance policy
D.App protection policy
AnswerC

Device compliance policies are specifically designed to define the security and health standards that managed devices must meet to be considered "compliant" with organizational policies. These policies actively monitor and evaluate device attributes, such as the presence of a passcode, encryption status, or minimum OS version. If a device fails to meet any defined requirement, the compliance policy marks it as "non-compliant," which can then be leveraged by Conditional Access policies to block access to corporate resources.

Why this answer

A device compliance policy in Microsoft Intune evaluates device settings, such as requiring a passcode, and marks devices as noncompliant if they lack one. Conditional Access policies can then block noncompliant devices from accessing corporate email, ensuring only compliant devices with a passcode are allowed.

Exam trap

The trap here is confusing device compliance policies (which enforce security requirements and can block access) with device configuration policies (which only apply settings without enforcement), leading candidates to select Option A incorrectly.

How to eliminate wrong answers

Option A is wrong because a device configuration policy is used to deploy settings (like Wi-Fi or VPN profiles) but does not enforce compliance or block access based on those settings. Option B is wrong because enrollment restrictions control which devices can enroll in Intune (e.g., by platform or OS version), not whether an enrolled device has a passcode. Option D is wrong because an app protection policy applies to apps on devices that may or may not be managed by Intune, focusing on data protection (e.g., preventing copy/paste) rather than device-level passcode requirements.

Practice this question →
65
MCQhard

Refer to the exhibit. A security analyst in your SOC runs the provided KQL query in Microsoft Sentinel to identify users with repeated MFA or suspicious sign-in alerts. The query returns no results even though alerts exist. What is the most likely issue?

A.The 'extend' operator fails because 'Entities' array is empty.
B.The alert names do not contain the strings 'MFA' or 'Suspicious sign-in'.
C.The TimeGenerated filter is too restrictive; alerts older than 7 days are excluded.
D.The 'has' operator is case-sensitive and the alert names are in uppercase.
AnswerB

This is the most plausible reason for no results. The query specifically filters for `AlertName has 'MFA'` or `AlertName has 'Suspicious sign-in'`. If the actual alert names in the system use slightly different terminology, such as "Azure AD MFA Activity" or "Unusual Sign-in Attempt," they would not contain the exact substrings specified and thus would not be returned by the query. The absence of results strongly suggests a mismatch between the queried strings and the actual alert naming conventions.

Why this answer

The query filters alert names using the 'has' operator on the strings 'MFA' and 'Suspicious sign-in'. Since 'has' is case-insensitive, option D is incorrect. Option A is incorrect because even if the 'Entities' array is empty, the 'extend' operator would simply set the 'alert' field to an empty array, not prevent results.

Option C is incorrect because a 7-day time range is reasonable and likely includes relevant alerts. Therefore, the most likely issue is that the actual alert names do not contain the exact substrings 'MFA' or 'Suspicious sign-in', as stated in option B.

Practice this question →
66
Multi-Selecthard

Which THREE Microsoft Defender XDR components are included in the unified security operations platform? (Select three.)

Select 3 answers
A.Microsoft Defender for Office 365
B.Microsoft Defender for Cloud
C.Microsoft Defender for Identity
D.Microsoft Defender for Endpoint
E.Microsoft Defender for IoT
AnswersA, C, D

Microsoft Defender for Office 365 is a core component of Microsoft Defender XDR, providing robust protection against sophisticated threats originating from email and collaboration tools. It safeguards against phishing, spam, malware, and business email compromise across Exchange Online, SharePoint, OneDrive, and Microsoft Teams, integrating critical threat signals into the unified XDR platform for comprehensive incident response and automated remediation.

Why this answer

Microsoft Defender XDR (Extended Detection and Response) unifies signals from across the Microsoft 365 Defender portal. Microsoft Defender for Office 365 is a core component because it protects email, SharePoint, OneDrive, and Teams from threats like phishing and malware, and its alerts feed directly into the unified XDR incident queue. This integration allows cross-domain correlation with endpoint, identity, and cloud app signals.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud (a CSPM/CWPP tool) with a component of the unified XDR platform, when in fact it is a separate security solution focused on cloud infrastructure, not part of the Microsoft 365 Defender XDR suite.

Practice this question →
67
MCQmedium

An organization wants to protect against spear-phishing attacks where attackers impersonate the company's CEO or other trusted domains to trick employees into transferring funds. They need a security solution that uses machine learning to detect and prevent such impersonation attempts in incoming emails. Which Microsoft 365 protection feature should they enable?

A.Anti-spam policy
B.Anti-phishing policy (impersonation protection)
C.Safe Links
D.Safe Attachments
AnswerB

Anti-phishing policies, particularly those with impersonation protection in Microsoft Defender for Office 365, are specifically engineered to combat spear phishing by detecting sender impersonation. They leverage advanced machine learning models to analyze various email attributes, including sender address, display name, and domain reputation, to identify attempts to spoof trusted users within an organization or external legitimate domains. This targeted protection identifies and blocks emails where attackers spoof identities to trick recipients, directly addressing the core mechanism of spear phishing.

Why this answer

Anti-phishing policy with impersonation protection uses machine learning models to detect and block attempts to impersonate specific users (like the CEO) or trusted domains in incoming emails. This directly addresses the scenario of spear-phishing attacks that trick employees into transferring funds by mimicking trusted senders.

Exam trap

Microsoft often tests the distinction between anti-phishing policies (which include impersonation protection) and anti-spam policies, leading candidates to mistakenly choose anti-spam when the question explicitly mentions targeted impersonation rather than generic spam.

How to eliminate wrong answers

Option A is wrong because anti-spam policy focuses on bulk unsolicited email (spam) using content filters and IP reputation, not on detecting impersonation of specific individuals or domains. Option C is wrong because Safe Links protects users from clicking malicious URLs in emails or Office documents by scanning links at time of click, but it does not detect or prevent impersonation of trusted senders. Option D is wrong because Safe Attachments scans email attachments for malware using detonation in a sandbox environment, but it does not address the impersonation aspect of spear-phishing.

Practice this question →
68
Multi-Selecteasy

Which TWO of the following are capabilities of Microsoft Defender for Cloud? (Choose two.)

Select 2 answers
A.Email security
B.Identity protection
C.Endpoint detection and response (EDR)
D.Cloud Workload Protection (CWP)
E.Cloud Security Posture Management (CSPM)
AnswersD, E

CWP provides threat detection for workloads in Defender for Cloud.

Why this answer

Microsoft Defender for Cloud provides Cloud Security Posture Management (CSPM) to continuously assess your cloud resources against security baselines and regulatory standards, and Cloud Workload Protection (CWP) to deliver integrated threat detection and advanced defenses for workloads across Azure, on-premises, and other clouds. These two capabilities are core pillars of Defender for Cloud, enabling both proactive posture improvement and runtime workload protection.

Exam trap

The trap here is that candidates confuse the integrated capabilities of Microsoft Defender for Cloud with those of other Microsoft security products (Defender for Office 365, Entra ID Protection, Defender for Endpoint), leading them to select options that are valid security features but belong to separate services.

Practice this question →
69
MCQmedium

A company wants to improve its security posture across Microsoft 365. The security team needs a central dashboard that provides a score based on current security configurations, gives recommendations for improving the score, and allows tracking of improvement actions over time. Which Microsoft security solution should they use?

A.Microsoft Secure Score
B.Microsoft Defender for Cloud Apps
C.Microsoft Purview Compliance Manager
D.Microsoft Intune
AnswerA

Microsoft Secure Score is a robust measurement tool within the Microsoft 365 Defender portal designed to help organizations understand and improve their security posture. It aggregates security configurations and behaviors across various Microsoft services, providing a numerical score and actionable recommendations. These recommendations guide administrators in implementing best practices and mitigating risks, thereby enhancing overall tenant security over time.

Why this answer

Microsoft Secure Score is the correct solution because it provides a central dashboard that calculates a numerical score based on the tenant's current security configurations across Microsoft 365 services. It offers prioritized improvement actions, tracks progress over time, and allows security teams to monitor and manage their security posture in a single view.

Exam trap

The trap here is that candidates often confuse Microsoft Secure Score with Microsoft Purview Compliance Manager, because both provide a score and recommendations, but Secure Score focuses on security configurations while Compliance Manager focuses on regulatory compliance controls.

Why the other options are wrong

B

Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) focused on discovering and controlling cloud app usage, not a central dashboard for security configuration scores and improvement tracking across Microsoft 365.

C

Microsoft Purview Compliance Manager focuses on compliance with regulations and standards, not on improving the overall security posture through a score based on security configurations and tracking improvement actions.

D

Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) tool, not a central dashboard for security score, recommendations, and tracking improvements across Microsoft 365.

Practice this question →
70
Multi-Selectmedium

A security team uses Microsoft Defender XDR to respond to incidents. Which THREE components are part of Microsoft Defender XDR?

Select 3 answers
A.Microsoft Defender for Office 365
B.Microsoft Defender for Endpoint
C.Microsoft Sentinel
D.Microsoft Intune
E.Microsoft Defender for Identity
AnswersA, B, E

Microsoft Defender for Office 365 is a crucial component of Microsoft Defender XDR, specializing in protecting an organization's email, collaboration tools, and data within the Office 365 suite. It provides advanced protection against phishing, business email compromise (BEC), malware, and other sophisticated threats targeting email and cloud applications like SharePoint, OneDrive, and Teams. By integrating these signals, it enables a unified security response across the entire digital estate.

Why this answer

Microsoft Defender XDR is a unified extended detection and response platform that natively integrates signals from Microsoft Defender for Office 365 (email and collaboration protection), Microsoft Defender for Endpoint (endpoint detection and response), and Microsoft Defender for Identity (on-premises identity threat detection). These three components share telemetry and automate incident correlation across domains, which is the core purpose of Defender XDR.

Exam trap

The trap here is that candidates confuse Microsoft Sentinel (a SIEM) as part of Defender XDR, when in fact Sentinel is a separate Azure service that can consume Defender XDR alerts but is not a component of the XDR platform itself.

Practice this question →
71
MCQmedium

An organization uses Microsoft 365 Defender. The security team receives an alert about a potential malware outbreak on multiple endpoints, and they need an integrated view that correlates signals from various Microsoft security solutions. Which Microsoft 365 Defender portal component provides this unified view?

A.Microsoft Defender for Cloud
B.Microsoft 365 Defender portal (security.microsoft.com)
C.Azure Sentinel
D.Microsoft Defender for Identity
AnswerB

The Microsoft 365 Defender portal (security.microsoft.com) is the centralized management console for the Microsoft 365 Defender suite. It provides a unified XDR (eXtended Detection and Response) experience, correlating signals from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Microsoft Defender for Cloud Apps. This integration enables security teams to investigate and respond to sophisticated multi-stage attacks across endpoints, email, identities, and applications from a single pane of glass, streamlining incident management.

Why this answer

The Microsoft 365 Defender portal (security.microsoft.com) is the correct answer because it provides a unified view of alerts and incidents across Microsoft 365 Defender components, including Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This integrated correlation enables security teams to see the full scope of a potential malware outbreak across multiple endpoints by combining signals from these solutions into a single incident timeline.

Exam trap

The trap here is that candidates often confuse the Microsoft 365 Defender portal with Azure Sentinel, mistakenly thinking a SIEM is required for correlation, whereas the Microsoft 365 Defender portal already provides built-in, cross-product correlation without needing a separate SIEM tool.

Why the other options are wrong

A

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) for multicloud environments, not a unified portal for Microsoft 365 Defender's correlated signals across endpoints, email, and identity.

C

Azure Sentinel is a cloud-native SIEM for security analytics and threat intelligence, not a unified portal for correlating signals from Microsoft 365 Defender solutions like Defender for Endpoint, Office 365, Identity, and Cloud Apps.

D

Microsoft Defender for Identity focuses on detecting identity-based threats using on-premises Active Directory signals, not on providing a unified view of malware outbreaks across endpoints from multiple Microsoft security solutions.

Practice this question →
72
MCQeasy

Your organization wants to prevent users from installing unapproved apps on company-managed Windows devices. Which Microsoft Intune feature should you use?

A.App control policies
B.Device configuration profiles
C.Conditional Access
D.Device compliance policies
AnswerA

App control policies, such as Windows Defender Application Control (WDAC) or AppLocker, are specifically designed to restrict which applications can run on devices. These policies enforce a strict allowlist or blocklist, preventing the execution of unauthorized software, including user-installed applications. By defining trusted applications based on publisher, path, or hash, they directly address the requirement to block unapproved installations and executions, ensuring a secure software environment.

Why this answer

App control policies in Microsoft Intune allow administrators to create and enforce rules that control which applications users can run on managed Windows devices. By configuring a baseline policy (e.g., using Windows Defender Application Control), you can block unapproved apps while allowing only trusted or explicitly permitted software, directly preventing users from installing unauthorized applications.

Exam trap

The trap here is that candidates confuse device compliance policies (which check device state) with app control policies (which enforce runtime app execution), leading them to choose compliance policies when the question specifically asks about preventing app installation.

How to eliminate wrong answers

Option B (Device configuration profiles) is wrong because they manage device settings (e.g., Wi-Fi, VPN, encryption) but do not enforce application execution rules. Option C (Conditional Access) is wrong because it controls access to cloud resources based on user, device, and location conditions, not local app installation. Option D (Device compliance policies) is wrong because they evaluate device health (e.g., OS version, encryption status) and trigger conditional access or remediation, but they do not block or allow specific app installations.

Practice this question →
73
MCQmedium

A company has a hybrid environment with on-premises Active Directory. The security team wants to detect advanced attacks such as pass-the-hash, malicious Kerberos ticket activity, and abnormal service account behavior. They want alerts from the on-premises environment to be integrated into Microsoft Defender for Cloud for centralized monitoring. Which Microsoft security solution should they deploy on their domain controllers?

A.Microsoft Defender for Cloud (agentless)
B.Microsoft Defender for Identity
C.Microsoft Defender for Office 365
D.Microsoft Entra ID Protection
AnswerB

Microsoft Defender for Identity (MDI) is specifically engineered to protect hybrid identity environments by monitoring on-premises Active Directory. It deploys lightweight sensors directly on domain controllers, which passively analyze network traffic and Windows events to detect suspicious user and entity behavior, including advanced attacks like pass-the-hash, Kerberos attacks, and Golden Ticket exploits. MDI provides real-time threat detection and security alerts, making it the ideal solution for securing on-premises AD from sophisticated identity-based threats.

Why this answer

Microsoft Defender for Identity (MDI) is the correct solution because it is specifically designed to detect advanced on-premises Active Directory attacks like pass-the-hash, malicious Kerberos ticket activity (e.g., Golden Ticket, Silver Ticket), and abnormal service account behavior. It integrates directly with Microsoft Defender for Cloud to provide centralized monitoring and alerting, fulfilling the requirement for on-premises domain controller protection.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud (agentless) with Microsoft Defender for Identity, assuming the cloud-based solution can monitor on-premises AD attacks without understanding that MDI is the dedicated on-premises identity threat detection tool.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud (agentless) provides vulnerability assessment and security posture management for cloud workloads, but it does not natively detect on-premises AD attack patterns like pass-the-hash or Kerberos ticket abuse. Option C is wrong because Microsoft Defender for Office 365 protects email, SharePoint, and Teams from phishing and malware, not on-premises Active Directory or domain controller activities. Option D is wrong because Microsoft Entra ID Protection focuses on cloud-based identity risks (e.g., leaked credentials, risky sign-ins) for Azure AD, not on-premises AD domain controller behavior or Kerberos attacks.

Practice this question →
74
MCQeasy

Your organization, Northwind Traders, uses Microsoft Intune to manage Windows 10 devices. You have created a compliance policy that requires devices to have BitLocker enabled. After assigning the policy, you notice that some devices are reporting as non-compliant due to BitLocker not being enabled. You have verified that the devices support BitLocker and that the policy is correctly assigned. You need to ensure that BitLocker is enabled on these devices automatically. What should you do?

A.Modify the compliance policy to allow non-compliant devices
B.Create an endpoint protection configuration profile to enable BitLocker
C.Create a Windows update ring policy
D.Use a PowerShell script to enable BitLocker manually
AnswerB

Configuration profiles can automatically enable BitLocker on devices.

Why this answer

An endpoint protection configuration profile in Microsoft Intune can be used to enforce BitLocker settings on Windows 10 devices automatically. This profile applies the necessary encryption policies without manual intervention. Option A is wrong because modifying the compliance policy to allow non-compliant devices does not enable BitLocker; it only accepts the non-compliant status.

Option C is wrong because Windows update ring policies control update deployment, not BitLocker configuration. Option D is wrong while a PowerShell script could enable BitLocker, it is not the standard or recommended method within Intune; configuration profiles provide a managed, scalable solution.

Practice this question →
75
Multi-Selectmedium

Which TWO capabilities are provided by Microsoft Defender for Cloud Apps? (Choose two.)

Select 2 answers
A.Mobile device management
B.Device compliance enforcement
C.Session controls for real-time monitoring of app usage
D.Email filtering and anti-phishing
E.Cloud app discovery to identify shadow IT
AnswersC, E

Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) provides robust session controls, a critical capability for real-time monitoring and governance of user activities within cloud applications. These controls enable organizations to enforce policies during a user session, such as blocking sensitive data downloads, requiring justification for specific actions, or protecting data with encryption, while maintaining full visibility into user interactions.

Why this answer

Microsoft Defender for Cloud Apps provides session controls that enable real-time monitoring and control of app usage. These controls use reverse proxy architecture to enforce policies on user activities within cloud apps, such as blocking downloads or requiring multi-factor authentication during a session.

Exam trap

The trap here is that candidates confuse the broad security portfolio of Microsoft 365 Defender and attribute capabilities like MDM or email filtering to Defender for Cloud Apps, when each solution has a distinct scope and integration point.

Practice this question →
Page 1 of 6 · 413 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Ms Security Capabilities questions.

Start 20-question session