CCNA Ms Security Capabilities Questions — Page 2 of 6

MCQmedium

Your company uses Microsoft Defender for Identity to monitor on-premises Active Directory. You receive an alert about a potential lateral movement attack involving a service account. The alert indicates that the account was used to log in to multiple servers from a non-domain-joined machine. You need to investigate the alert and determine if the account is compromised. What should you do first?

A.Check if the account is a member of any privileged groups.

B.Immediately reset the service account password.

C.Review the account’s activity timeline in Microsoft Defender for Identity to see all logins and accessed resources.

D.Contact the user to verify if they performed the logins.

AnswerC

Reviewing the activity timeline provides a detailed record of all logins and accessed resources, enabling you to trace the lateral movement and decide on next steps. This is the correct first action.

Why this answer

The correct first step because Microsoft Defender for Identity provides an activity timeline for each account, allowing you to review all logins, resources accessed, and other suspicious activities. This helps determine if the account is compromised before taking any action. Option A is incorrect because the account may be a member of privileged groups, but that alone does not confirm compromise; the activity timeline provides more context.

Option B is incorrect because immediately resetting the password could disrupt legitimate operations and destroy evidence. Option D is incorrect because the user of a service account is typically not a person, and lateral movement alerts indicate automated or unauthorized behavior, so contacting a user is not appropriate.

Practice this question →

MCQmedium

An organization wants to protect its Azure PaaS services, such as Azure SQL Database and Azure Key Vault, by detecting and alerting on suspicious activities like SQL injection attempts or unusual access patterns. They also need to integrate these alerts into a central security information and event management (SIEM) system for further analysis. Which Microsoft security solution provides the threat detection capability described?

A.Microsoft Sentinel

B.Microsoft Defender for Cloud

C.Microsoft Defender for Endpoint

D.Microsoft Defender for Identity

AnswerB

Microsoft Defender for Cloud provides comprehensive cloud security posture management (CSPM) and cloud workload protection (CWP) capabilities. It offers advanced threat protection specifically for Azure PaaS services like Azure SQL Database, Azure Key Vault, and Azure Storage accounts. This includes continuous monitoring, vulnerability assessments, and real-time threat detection alerts tailored to the unique attack vectors of these services, ensuring robust security for cloud-native applications.

Why this answer

Microsoft Defender for Cloud provides unified security management and advanced threat protection across hybrid cloud workloads, including Azure PaaS services like Azure SQL Database and Azure Key Vault. It detects suspicious activities such as SQL injection attempts and unusual access patterns using built-in behavioral analytics and integrates alerts into a central SIEM system via Azure Monitor or directly to Microsoft Sentinel.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel (a SIEM) with the threat detection capability itself, but Sentinel ingests alerts rather than generating them for PaaS services, making Defender for Cloud the correct answer for native threat detection.

Why the other options are wrong

Microsoft Sentinel is a SIEM and SOAR solution, but the question specifically asks for a solution that provides the threat detection capability for Azure PaaS services. Microsoft Defender for Cloud (formerly Azure Security Center) is the native threat detection service for Azure PaaS, while Sentinel ingests alerts from Defender for Cloud for central analysis.

Microsoft Defender for Endpoint is designed to protect endpoints (devices) from threats, not Azure PaaS services like Azure SQL Database or Azure Key Vault. It does not natively detect SQL injection or unusual access patterns on PaaS resources.

Microsoft Defender for Identity focuses on protecting on-premises Active Directory identities from advanced threats, not Azure PaaS services like SQL Database or Key Vault.

Practice this question →

MCQhard

You are investigating an alert in Microsoft Defender XDR. Based on the exhibit, what is the primary detection source for this alert?

A.Microsoft Sentinel

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Identity

D.Microsoft Defender for Cloud Apps

AnswerC

Microsoft Defender for Identity (MDI) is specifically designed to protect hybrid identity environments by monitoring Active Directory domain controllers and other identity infrastructure. It identifies, detects, and investigates advanced threats, compromised identities, and malicious insider actions directed at an organization's identity system. Therefore, an alert within Microsoft Defender XDR concerning identity-based attacks or suspicious authentication activities would originate directly from MDI's specialized detection capabilities.

Why this answer

The exhibit shows an alert from Microsoft Defender XDR with a detection source of 'Microsoft Defender for Identity'. Defender for Identity uses on-premises Active Directory signals and network traffic to detect identity-based threats like lateral movement, privilege escalation, and compromised credentials. The alert details indicate suspicious activity tied to an on-premises domain controller, which is the core focus of Defender for Identity.

Exam trap

The trap here is that candidates confuse Microsoft Defender XDR's unified alert interface with the underlying detection source, assuming that because the alert appears in the XDR portal, it must come from a more familiar product like Defender for Endpoint or Sentinel, rather than recognizing the identity-specific indicators (e.g., domain controller involvement, Kerberos anomalies) that point to Defender for Identity.

How to eliminate wrong answers

Option A is wrong because Microsoft Sentinel is a SIEM/SOAR platform that ingests alerts from multiple sources but is not itself a primary detection source for this specific alert; the exhibit shows the detection source as Defender for Identity, not Sentinel. Option B is wrong because Microsoft Defender for Endpoint focuses on endpoint-level threats (malware, fileless attacks, EDR) and would show a detection source like 'Microsoft Defender for Endpoint' in the alert, not the identity-based source shown. Option D is wrong because Microsoft Defender for Cloud Apps is a CASB focused on cloud application usage and shadow IT, not on-premises Active Directory identity attacks; its detection source would be 'Microsoft Defender for Cloud Apps'.

Practice this question →

MCQhard

A SOC analyst in Microsoft Sentinel needs to create a custom detection rule that triggers an incident when more than 10 failed logins occur from a single IP address within 5 minutes. Which rule type should they use?

A.Anomaly analytics rule

B.Near-real-time (NRT) analytics rule

C.Microsoft security analytics rule

D.Scheduled query analytics rule

AnswerD

Scheduled query analytics rules are the foundational method in Microsoft Sentinel for creating highly customizable detection logic using Kusto Query Language (KQL). They allow security analysts to define complex queries, perform aggregations, apply advanced filtering, and set precise threshold conditions over specified time ranges to identify specific threats and generate incidents based on unique organizational requirements.

Why this answer

A scheduled query analytics rule is the correct choice because it allows the SOC analyst to define a custom KQL query that counts failed logins per IP address over a 5-minute window and triggers an incident when the count exceeds 10. This rule type runs on a recurring schedule (e.g., every 5 minutes) and is designed for threshold-based detection scenarios like brute-force attacks.

Exam trap

The trap here is that candidates confuse near-real-time (NRT) rules with scheduled queries, but NRT rules cannot perform time-based aggregations over a 5-minute window and are limited to single-event detection with a 1-minute lookback.

How to eliminate wrong answers

Option A is wrong because anomaly analytics rules use machine learning to detect unusual patterns without predefined thresholds, not a hard count of 10 failed logins in 5 minutes. Option B is wrong because near-real-time (NRT) analytics rules run queries every minute with a 1-minute lookback, but they cannot aggregate over a 5-minute window; they are designed for low-latency detection of single events, not threshold-based aggregation. Option C is wrong because Microsoft security analytics rules are prebuilt templates that automatically ingest alerts from Microsoft security products (e.g., Microsoft Defender for Cloud), not custom detection rules written by an analyst.

Practice this question →

Multi-Selecteasy

Which TWO Microsoft security solutions can be used to detect and respond to identity-based threats? (Choose two.)

Select 2 answers

A.Microsoft Defender for Cloud Apps

B.Microsoft Purview

C.Microsoft Defender for Identity

D.Microsoft Defender for Endpoint

E.Microsoft Entra ID Protection

AnswersC, E

Detects identity-based attacks.

Why this answer

Microsoft Defender for Identity (option C) is a cloud-based security solution that uses on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions. It specifically focuses on identity-based attacks such as pass-the-hash, Kerberos golden ticket, and brute-force attempts by analyzing network traffic and behavior.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud Apps (a CASB) with identity threat detection, but it is primarily for cloud app security, not on-premises identity attacks, while Microsoft Defender for Identity and Entra ID Protection are the two dedicated identity-focused solutions.

Practice this question →

MCQmedium

Your company uses Microsoft Defender for Endpoint. You need to investigate a potential malware outbreak on a specific device. Which feature should you use to get real-time visibility into running processes and network connections?

A.Threat analytics

B.Device inventory

C.Automated investigation

D.Live response

AnswerD

Live response in Microsoft Defender for Endpoint provides security analysts with immediate remote access to an endpoint using a secure shell connection. This capability allows investigators to run commands, collect forensic data such as files, registry keys, and process information in real-time, and take immediate remediation actions directly on the compromised device. It is specifically designed for interactive, on-demand data acquisition and incident response, making it the correct tool for collecting real-time data.

Why this answer

Live response gives security operators a remote shell connection to the device, enabling real-time investigation of running processes, network connections, and other forensic data. This is the correct feature for interactive, real-time visibility into a specific device during an active malware outbreak.

Exam trap

The trap here is that candidates confuse the interactive, real-time investigation capability of Live response with the automated, alert-driven workflows of Automated investigation, or they mistake Threat analytics for a tool that provides live device-level data rather than global threat intelligence.

How to eliminate wrong answers

Option A is wrong because Threat analytics provides intelligence about active threats and vulnerabilities, not real-time process or network visibility on a specific device. Option B is wrong because Device inventory lists all managed devices and their basic properties, but does not allow interactive investigation of running processes or network connections. Option C is wrong because Automated investigation runs predefined playbooks to automatically contain and remediate threats, but it does not give an operator real-time, interactive access to view processes or network connections on a device.

Practice this question →

MCQmedium

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email via the Outlook mobile app. Which policy type should you configure?

A.Device configuration policies

B.App protection policies

C.Device compliance policies

D.Conditional Access policies in Microsoft Entra ID

AnswerD

Conditional Access policies in Microsoft Entra ID serve as the enforcement engine that evaluates various signals, including the device compliance status reported by Intune, to make real-time access decisions for cloud applications. Conditional Access policies can be configured to explicitly require a device to be marked as "compliant" by Intune before allowing access to sensitive organizational resources, thereby linking device health directly to identity-based access control. They are the critical component for enforcing device compliance for cloud app access.

Why this answer

Conditional Access policies in Microsoft Entra ID are the correct choice because they evaluate device compliance status (reported by Intune) as a condition for granting access to cloud apps like Exchange Online. By requiring that only compliant devices can access corporate email via the Outlook mobile app, you configure a Conditional Access policy that blocks or grants access based on the device compliance state, integrating Intune's compliance assessment with Entra ID's access control.

Exam trap

The trap here is that candidates often confuse device compliance policies (which only define and report compliance) with Conditional Access policies (which enforce access decisions based on that compliance), leading them to incorrectly select Option C.

How to eliminate wrong answers

Option A is wrong because device configuration policies manage settings like Wi-Fi, VPN, or email profiles on devices, but they do not enforce access control based on compliance status. Option B is wrong because app protection policies manage how data is handled within apps (e.g., preventing copy/paste or requiring a PIN), but they do not evaluate device compliance to block access entirely. Option C is wrong because device compliance policies define the rules for what makes a device compliant (e.g., requiring encryption or a minimum OS version), but they do not themselves enforce access decisions; they only report compliance status to Intune, which must be used by a Conditional Access policy to block or allow access.

Practice this question →

MCQhard

A global enterprise has a hybrid environment that includes on-premises Active Directory, Azure resources, Amazon Web Services (AWS), and Google Cloud Platform (GCP). The security team needs a single solution to collect security logs from all these sources, detect threats using advanced analytics and threat intelligence, and automate incident response via playbooks. They already have Microsoft Defender for Cloud protecting their Azure workloads. Which Microsoft security solution should they add to meet these requirements?

A.Microsoft Sentinel

B.Microsoft Defender for Cloud

C.Microsoft Defender for Identity

D.Microsoft Cloud App Security

AnswerA

Microsoft Sentinel is a scalable, cloud-native SIEM and SOAR that can ingest logs from on-premises, Azure, AWS, GCP, and many other sources. It provides threat detection and automated response via playbooks, making it the correct solution for the described need.

Why this answer

Microsoft Sentinel is a cloud-native SIEM and SOAR solution that ingests logs from a wide range of sources, including on-premises, Azure, AWS, and GCP. It provides advanced analytics, threat detection, and automated response through playbooks. Microsoft Defender for Cloud is a cloud security posture management (CSPM) and workload protection solution; while it does collect some logs and can send alerts to Sentinel, it does not provide the full SIEM/SOAR capabilities needed for multi-cloud aggregation and automation beyond Azure.

Microsoft Defender for Identity focuses on on-premises AD threats but not multi-cloud. Microsoft Cloud App Security is a CASB for SaaS apps, not a SIEM for infrastructure logs.

Practice this question →

MCQhard

A company uses a third-party SaaS CRM application. The security team needs to monitor user sessions in real-time when sales representatives access the CRM from personal, unmanaged devices. The goal is to prevent the download of sensitive customer data to local drives. The solution should block download actions and show a warning to the user. Which Microsoft security solution should the team deploy to enforce these session controls?

A.Microsoft Defender for Cloud Apps

B.Microsoft 365 Defender

C.Microsoft Sentinel

D.Microsoft Defender for Endpoint

AnswerA

Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing deep visibility and control over cloud applications. Through its Conditional Access App Control capabilities, it can proxy user sessions to third-party SaaS CRM applications in real-time. This allows for granular policy enforcement, such as blocking downloads of sensitive data to unmanaged devices, directly within the user's session, effectively preventing data loss.

Why this answer

Microsoft Defender for Cloud Apps (MDCA) provides session-level controls via its Conditional Access App Control feature. This allows real-time monitoring and control of user sessions in third-party SaaS apps like CRM, enabling actions such as blocking downloads and displaying warnings based on device compliance (e.g., unmanaged devices). The solution integrates with Azure AD Conditional Access to enforce these policies at the session layer without modifying the underlying SaaS application.

Exam trap

The trap here is that candidates often confuse the broad detection and response capabilities of Microsoft 365 Defender or Defender for Endpoint with the specific session-level enforcement provided by Defender for Cloud Apps, which is the only solution that can intercept and control user actions inside a third-party SaaS application in real time.

Why the other options are wrong

Microsoft 365 Defender is a unified pre- and post-breach enterprise defense suite that correlates signals across identities, endpoints, and data, but it does not provide real-time session monitoring and control for third-party SaaS apps like the CRM in this scenario.

Microsoft Sentinel is a SIEM/SOAR solution for security analytics and threat intelligence, not for real-time session control or conditional access policies. It does not natively block downloads or enforce session policies in third-party SaaS apps.

Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for devices, not on session-level control for SaaS applications. It cannot block download actions or show warnings within a third-party CRM session.

Practice this question →

MCQmedium

Refer to the exhibit. An analyst runs a KQL query in Microsoft Sentinel. What is the primary purpose of this query?

A.To retrieve the most recent 10 malware alerts.

B.To find the single highest severity alert.

C.To count the total number of malware alerts in the last 24 hours.

D.To list all computers with malware alerts.

AnswerA

The query uses `take 10` to retrieve 10 malware alerts, but without an `order by` clause, the results are not guaranteed to be the most recent. The primary purpose is to return a limited set of 10 malware alerts.

Why this answer

The KQL query uses the `take` operator to return the first 10 rows of the result set after filtering for `Malware` alerts. Since the query does not include any `order by` or `sort` clause, the `take` operator returns an unspecified set of 10 records, and therefore does not guarantee the 'most recent' alerts. While the query's primary intent is to retrieve a limited number (10) of malware alerts, the 'most recent' qualifier in option A makes it an inaccurate description of the query's guaranteed outcome.

Therefore, option A is not entirely correct, and no other option accurately describes the query's purpose.

Exam trap

The trap here is that candidates often assume `take 10` returns the most recent 10 alerts, but without an explicit `order by TimeGenerated desc`, the result set is arbitrary and not guaranteed to be the most recent; the question's phrasing 'most recent' is a distractor that tests understanding of KQL ordering behavior. This trap note is accurate and correctly highlights why option A is flawed.

How to eliminate wrong answers

Option B is wrong because the query does not use any aggregation or sorting (e.g., `top`, `order by`, `max()`) to identify the single highest severity alert; it simply returns 10 arbitrary alerts. Option C is wrong because the query does not use the `count` operator or any aggregation to count total alerts; `take 10` limits the output to 10 rows, not a count of all alerts in the last 24 hours. Option D is wrong because the query does not project or group by computer names; it returns alert details, not a list of distinct computers, and the `take` operator restricts the result to 10 rows, not all computers with malware alerts.

Practice this question →

MCQmedium

A company uses Microsoft 365 and is concerned about phishing attacks targeting employees. They want to deploy a solution that can automatically analyze email messages for malicious links and attachments, and also provide click-time protection by rewriting URLs. Which Microsoft 365 Defender component should they use?

A.Microsoft Defender for Endpoint

B.Microsoft Defender for Office 365

C.Microsoft Defender for Cloud Apps

D.Microsoft Defender for Identity

AnswerB

Defender for Office 365 includes Safe Links, Safe Attachments, and anti-phishing policies to protect email and collaboration tools.

Why this answer

Microsoft Defender for Office 365 (MDO) is the correct component because it is specifically designed to protect against email-borne threats such as phishing. It includes Safe Links and Safe Attachments features that automatically scan email messages for malicious links and attachments, and it rewrites URLs to provide click-time protection by checking the link against a dynamic threat intelligence feed at the moment of the click.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Office 365 with Microsoft Defender for Endpoint, mistakenly thinking endpoint protection includes email security, but MDO is the only solution that provides email-specific URL rewriting and attachment sandboxing.

Why the other options are wrong

Microsoft Defender for Endpoint focuses on protecting devices (endpoints) from threats, not on analyzing email messages for phishing or providing URL rewriting. The question specifically asks for email protection features.

Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that focuses on securing cloud applications and data, not on analyzing email messages for phishing links or providing URL rewriting. The question specifically asks for email protection features, which are provided by Defender for Office 365.

Microsoft Defender for Identity focuses on detecting and investigating advanced threats and compromised identities using on-premises Active Directory signals, not on analyzing email messages for phishing or rewriting URLs.

Practice this question →

MCQmedium

A company uses Microsoft Sentinel to centralize security logs. They want to correlate AWS CloudTrail logs with Azure AD sign-in logs. Which Microsoft Sentinel feature should they use?

A.Workbooks

B.Playbooks

C.Analytics rules

D.Hunting

AnswerC

Microsoft Sentinel Analytics rules are the core mechanism for proactively detecting threats and generating incidents by correlating events across connected data sources. These rules leverage Kusto Query Language (KQL) to define specific patterns, behaviors, or anomalies that indicate malicious activity, executing on a scheduled basis to identify threats that might otherwise go unnoticed. They are specifically designed to perform the continuous event correlation required for automated threat detection and alerting.

Why this answer

Analytics rules in Microsoft Sentinel are designed to correlate and analyze data from multiple sources, such as AWS CloudTrail and Azure AD sign-in logs, to detect security threats. By creating a multi-source analytics rule, you can define conditions that trigger alerts when suspicious patterns emerge across these disparate log streams, enabling centralized threat detection.

Exam trap

The trap here is that candidates confuse 'correlation' with 'visualization' (Workbooks) or 'response' (Playbooks), but only Analytics Rules provide the automated, scheduled log correlation needed to detect multi-source threats.

How to eliminate wrong answers

Option A is wrong because Workbooks are visualization tools that display data but do not perform correlation or alerting; they rely on pre-existing queries and cannot actively correlate logs in real time. Option B is wrong because Playbooks automate responses to alerts (e.g., via Azure Logic Apps) but do not perform the initial correlation of log data; they execute after an alert is triggered. Option D is wrong because Hunting is an interactive, query-based process for manually investigating threats, not an automated feature for continuous correlation of logs from different sources.

Practice this question →

MCQhard

A company is designing a Microsoft 365 Defender incident response workflow. They want to automatically isolate a compromised device when a ransomware alert is triggered. Which Microsoft 365 component should be used to execute the automated response action?

A.Microsoft Defender for Endpoint

B.Microsoft Defender for Office 365

C.Microsoft Sentinel

D.Microsoft Purview

AnswerA

Microsoft Defender for Endpoint is the primary Endpoint Detection and Response (EDR) solution within the Microsoft 365 Defender suite, specifically designed for device-level protection. It includes robust Automated Investigation and Remediation (AIR) capabilities that leverage AI and machine learning to automatically analyze alerts, correlate events, and take immediate actions such as isolating devices, stopping processes, or quarantining files upon detection of a threat. These capabilities are fundamental for rapid incident response directly on the endpoint.

Why this answer

Microsoft Defender for Endpoint includes automated investigation and remediation (AIR) capabilities that can isolate a device from the network when a ransomware alert is triggered. This is the correct component because it provides endpoint detection and response (EDR) with built-in playbooks for automatic containment actions like device isolation.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel's SOAR capabilities (which can trigger isolation via playbooks) with the native automated response engine in Defender for Endpoint, but Sentinel is an orchestrator, not the component that directly executes the endpoint isolation action.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Office 365 protects email and collaboration tools (e.g., phishing, malware in attachments) but does not have the ability to isolate endpoints or execute device-level automated response actions. Option C is wrong because Microsoft Sentinel is a SIEM/SOAR platform that can orchestrate response actions via playbooks, but it is not the native component for directly isolating a device; it would typically trigger a Defender for Endpoint action via an API. Option D is wrong because Microsoft Purview focuses on data governance, compliance, and information protection (e.g., DLP, retention labels) and has no endpoint isolation capabilities.

Practice this question →

MCQmedium

Refer to the exhibit. An administrator runs the PowerShell command against Microsoft Defender for Endpoint. The output shows an alert with Severity 'High' and Status 'New'. What should the administrator do next to investigate the alert?

A.Change the severity to Medium to reduce false positives

B.Resolve the alert as a false positive

C.Create a Microsoft Sentinel analytics rule from the alert

D.Investigate the alert details in the Microsoft Defender XDR portal

AnswerD

The portal provides detailed information and actions.

Why this answer

The alert has a severity of 'High' and status 'New', indicating a potentially critical threat that requires immediate investigation. The correct next step is to use the Microsoft Defender XDR portal to examine the alert details, including the affected devices, user accounts, and related events, to determine the scope and impact of the threat. Changing severity or resolving the alert without investigation would risk missing a real security incident.

Exam trap

The SC-900 exam often tests the misconception that you should immediately change severity or resolve alerts based on a single data point, rather than following the proper incident response workflow of investigating in the unified security portal.

How to eliminate wrong answers

Option A is wrong because changing the severity from 'High' to 'Medium' is not a valid investigative step; severity is set by the detection logic based on threat impact, and manually reducing it could hide critical alerts and increase risk. Option B is wrong because resolving the alert as a false positive without investigation is premature and dangerous; the alert's 'High' severity and 'New' status require analysis to confirm whether it is a genuine threat or a false positive. Option C is wrong because creating a Microsoft Sentinel analytics rule from a single alert is not the immediate next step; analytics rules are used for custom detection logic over time, not for investigating an existing alert.

Practice this question →

Multi-Selecthard

Which THREE of the following are capabilities of Microsoft Sentinel? (Select THREE.)

Select 3 answers

A.Security information and event management (SIEM)

B.User and entity behavior analytics (UEBA)

C.Mobile device management

D.Security orchestration, automation, and response (SOAR)

E.Data loss prevention

AnswersA, B, D

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) solution. It provides centralized security data collection from various sources, including users, applications, servers, and network devices, across an organization's entire digital estate. Sentinel then uses advanced analytics and threat intelligence to detect, investigate, and respond to threats by correlating these events in real-time. This capability is fundamental to its role in modern security operations.

Why this answer

Correct: A (SIEM), B (UEBA), D (SOAR). C is not a Sentinel capability; it is a feature of Microsoft Intune. E is a feature of Microsoft Purview.

Practice this question →

MCQeasy

A company uses Microsoft Intune to manage devices. They want to ensure that only devices with a specific minimum operating system version can access corporate email. What should they configure?

A.Deploy an app protection policy for the email app

B.Create a device compliance policy specifying minimum OS version

C.Create a device configuration profile for OS settings

D.Configure a conditional access policy in Entra ID to block non-compliant devices

AnswerB

Device compliance policies in Microsoft Intune are specifically designed to define the security posture and configuration requirements that a device must meet to be considered "compliant." By specifying a minimum OS version, this policy directly establishes the foundational device-level standard required. This makes it the essential first step for enforcing operating system requirements before access to corporate resources can be granted.

Why this answer

To enforce a minimum operating system version for accessing corporate email, you need a device compliance policy in Microsoft Intune. This policy evaluates device attributes like OS version and marks devices as compliant or non-compliant. When combined with a Conditional Access policy in Entra ID, non-compliant devices can be blocked from accessing corporate resources, including email.

Exam trap

The trap here is that candidates often confuse device compliance policies (which evaluate device health) with device configuration profiles (which apply settings) or app protection policies (which protect data within apps), leading them to choose an option that does not enforce the OS version requirement.

How to eliminate wrong answers

Option A is wrong because app protection policies (MAM) manage data protection within an app (e.g., preventing copy/paste) and do not enforce OS version requirements on the device itself. Option C is wrong because device configuration profiles manage settings and features (e.g., Wi-Fi, VPN) but do not evaluate or enforce compliance conditions like OS version. Option D is wrong because a Conditional Access policy alone cannot block devices based on OS version; it requires a device compliance policy to first evaluate the OS version and mark the device as compliant or non-compliant.

Practice this question →

MCQmedium

Your organization is adopting Microsoft 365 Copilot for enterprise users. Which Microsoft Purview capability should you configure to prevent sensitive data from being inadvertently shared during Copilot interactions?

A.Customer Lockbox

B.Data Loss Prevention (DLP) policies

C.Sensitivity labels

D.eDiscovery

AnswerB

Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various Microsoft 365 services, including applications integrated with Microsoft 365 Copilot. DLP policies can detect sensitive information types (e.g., credit card numbers, PII) and enforce actions such as blocking sharing, notifying users, or encrypting content, thereby preventing accidental or intentional data exfiltration when Copilot generates or processes content.

Why this answer

Data Loss Prevention (DLP) policies are the correct Microsoft Purview capability to prevent sensitive data from being inadvertently shared during Copilot interactions. DLP policies can inspect content in real time, including Copilot prompts and responses, and apply actions such as blocking or warning when sensitive information types (e.g., credit card numbers, social security numbers) are detected. This directly addresses the requirement to prevent inadvertent sharing of sensitive data within the Copilot environment.

Exam trap

The trap here is that candidates often confuse Sensitivity labels (which apply persistent protection like encryption) with DLP policies (which enforce real-time actions like blocking), leading them to choose labels instead of the correct DLP answer for preventing inadvertent sharing during live interactions.

How to eliminate wrong answers

Option A is wrong because Customer Lockbox provides a control mechanism for Microsoft support engineers to access your data during support requests, not for preventing data sharing during user interactions like Copilot. Option C is wrong because Sensitivity labels classify and protect data at rest and in transit (e.g., encryption, visual markings), but they do not actively monitor or block data sharing in real-time during Copilot interactions; DLP policies are needed for that enforcement. Option D is wrong because eDiscovery is used for searching and exporting content for legal or investigative purposes, not for preventing data loss or inadvertent sharing in live Copilot sessions.

Practice this question →

MCQeasy

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. Which Microsoft Entra ID feature should you use?

A.Conditional Access

B.Privileged Identity Management

C.Self-Service Password Reset

D.Identity Protection

AnswerA

Microsoft Intune assesses device compliance against organizational policies, such as requiring encryption or specific OS versions. Azure AD Conditional Access then leverages this compliance status as a condition within its policies. This allows organizations to enforce that only devices marked as 'compliant' by Intune are granted access to sensitive cloud applications and data, creating a robust security gate.

Why this answer

Conditional Access in Microsoft Entra ID is the correct feature because it allows you to enforce policies that require devices to be marked as compliant by Microsoft Intune before granting access to corporate email. By integrating with Intune, Conditional Access evaluates device compliance status in real time and blocks or allows access accordingly, ensuring only managed and compliant devices can reach email resources.

Exam trap

The trap here is that candidates often confuse Identity Protection (which handles user risk) with device compliance enforcement, but Conditional Access is the only feature that can combine device compliance signals with access control decisions.

How to eliminate wrong answers

Option B (Privileged Identity Management) is wrong because it manages just-in-time access and role activation for privileged roles, not device compliance checks. Option C (Self-Service Password Reset) is wrong because it handles password reset workflows and does not evaluate device health or compliance. Option D (Identity Protection) is wrong because it detects and remediates identity-based risks like leaked credentials or sign-ins from anonymous IPs, but it does not enforce device compliance policies.

Practice this question →

MCQmedium

A company uses Exchange Online. The security team wants to protect users from malicious email attachments. They need a solution that detonates attachments in a sandbox environment to check for malware behavior before the email is delivered to the recipient. Which Microsoft Defender for Office 365 feature should they enable?

A.Safe Attachments

B.Safe Links

C.Anti-phishing

D.Anti-spam

AnswerA

Safe Attachments is a crucial component of Microsoft Defender for Office 365 that provides advanced protection against unknown malware and zero-day threats in email attachments. It uses a virtual environment, or sandbox, to "detonate" (open and analyze) attachments in real-time before they reach the user's inbox. This process identifies malicious behavior and prevents the delivery of harmful files, even if their signatures are not yet known to traditional antivirus solutions.

Why this answer

Safe Attachments is the correct feature because it specifically detonates email attachments in a virtual sandbox environment before delivery, analyzing behavior for malicious activity. This matches the requirement to check attachments for malware behavior prior to inbox arrival, a capability unique to Safe Attachments within Defender for Office 365.

Exam trap

The trap here is that candidates confuse Safe Attachments (sandbox detonation of attachments) with Safe Links (URL scanning at click-time), as both are part of Defender for Office 365 but address different threat vectors.

Why the other options are wrong

Safe Links protects users from malicious URLs in emails and Office documents, not from email attachments. The question specifically asks about detonating attachments in a sandbox, which is the function of Safe Attachments.

Anti-phishing policies protect against deceptive messages that trick users into revealing credentials or clicking malicious links, but they do not detonate attachments in a sandbox to analyze malware behavior.

Anti-spam filters are designed to block unwanted bulk email (spam), not to detonate attachments in a sandbox to analyze malware behavior. The question specifically requires a feature that detonates attachments, which is Safe Attachments.

Practice this question →

MCQhard

Your organization uses Microsoft Defender for Cloud to protect Azure subscriptions. You need to enforce that all storage accounts must have encryption at rest enabled. You have enabled Azure Policy to audit this configuration. However, you notice that some storage accounts are non-compliant. You need to automatically remediate non-compliant storage accounts. What should you do?

A.Create a Microsoft Defender for Cloud recommendation to enable encryption.

B.Use the compliance dashboard to manually enable encryption on non-compliant accounts.

C.Add a 'deployIfNotExists' policy to automatically enable encryption on storage accounts.

D.Change the policy effect from 'audit' to 'deny' to prevent creation of non-compliant accounts.

AnswerC

This remediates non-compliant accounts automatically.

Why this answer

A 'deployIfNotExists' policy assignment in Azure Policy can automatically remediate non-compliant storage accounts by enabling encryption at rest. This policy effect triggers a remediation task that deploys the required configuration (e.g., setting the 'Encryption' property to 'Enabled' on the storage account resource) without manual intervention. The audit policy only reports non-compliance, while deployIfNotExists actively enforces the desired state.

Exam trap

The trap here is that candidates confuse 'deny' (which only blocks future non-compliant resources) with 'deployIfNotExists' (which remediates existing resources), or assume Defender for Cloud recommendations can automatically fix non-compliance without additional policy configuration.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud recommendations are advisory and do not automatically remediate resources; they require manual approval or integration with Azure Policy for automation. Option B is wrong because manually enabling encryption via the compliance dashboard is not an automated solution and contradicts the requirement for automatic remediation. Option D is wrong because changing the policy effect to 'deny' only prevents creation or modification of non-compliant storage accounts in the future, but does not remediate existing non-compliant accounts.

Practice this question →

MCQmedium

An organization wants to protect its fleet of Windows 10 laptops from advanced malware and ransomware. The solution must detect suspicious behavior (e.g., a process encrypting files) and provide security teams with the ability to isolate an infected device from the network for investigation. Which Microsoft security solution should they deploy?

A.Microsoft Defender for Cloud

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Cloud Apps

D.Microsoft Defender for Office 365

AnswerB

Microsoft Defender for Endpoint is the correct solution because it provides comprehensive, next-generation endpoint protection specifically designed for devices like Windows 10 laptops. It includes capabilities such as antivirus, behavioral analysis, endpoint detection and response (EDR) for advanced threat hunting, and automated investigation and remediation to protect against sophisticated malware and zero-day attacks. Furthermore, it offers vulnerability management and device isolation to contain threats effectively.

Why this answer

Microsoft Defender for Endpoint (MDE) is the correct solution because it provides endpoint detection and response (EDR) capabilities, including behavioral-based detection of advanced malware and ransomware (e.g., detecting a process encrypting files via machine learning and behavioral analytics). It also includes automated investigation and remediation features, such as the ability to isolate an infected device from the network (device isolation) to prevent lateral movement while allowing security teams to investigate.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a cloud workload protection tool) with endpoint protection, or they assume Defender for Office 365 covers all devices, when in fact only Defender for Endpoint provides the specific behavioral detection and device isolation for Windows 10 laptops.

Why the other options are wrong

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) for Azure, on-premises, and other cloud resources. It does not provide endpoint detection and response (EDR) capabilities like behavior monitoring and device isolation for Windows 10 laptops.

Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that focuses on securing cloud applications and services, not on endpoint-level malware detection or device isolation for Windows 10 laptops.

Practice this question →

Multi-Selecteasy

Which TWO of the following are benefits of using Microsoft Entra ID Conditional Access? (Choose two.)

Select 2 answers

A.Allow users to reset their own passwords

B.Block access from locations that are not trusted

C.Automatically grant temporary admin access

D.Enforce multi-factor authentication based on user risk

E.Eliminate the need for passwords entirely

AnswersB, D

Microsoft Entra Conditional Access, a core component of Microsoft E (Enterprise Mobility + Security), enables organizations to define granular access policies based on various conditions, including network location. By configuring trusted IP ranges or blocking specific countries/regions, administrators can prevent unauthorized access attempts from untrusted geographical locations, significantly reducing the attack surface and enhancing security posture. This directly leverages the adaptive capabilities of Entra.

Why this answer

Conditional Access policies can enforce multi-factor authentication based on user risk (D) and block access from untrusted locations (B). Option A (allow users to reset their own passwords) is a feature of self-service password reset (SSPR), not Conditional Access. Option C (automatically grant temporary admin access) is a benefit of Privileged Identity Management (PIM).

Option E (eliminate the need for passwords entirely) is related to passwordless authentication, not Conditional Access.

Practice this question →

Multi-Selectmedium

Which TWO Microsoft Purview solutions can be used to protect sensitive data in Microsoft Teams chats and channels? (Choose two.)

Select 2 answers

A.Microsoft Purview Communication Compliance

B.Microsoft Purview Data Loss Prevention (DLP) policies

C.Microsoft Purview Sensitivity Labels

D.Microsoft Purview Information Barriers

E.Microsoft Purview Retention Policies

AnswersA, B

Microsoft Purview Communication Compliance is a powerful solution designed to actively scan and analyze communications, such as Microsoft Teams chats and emails, for policy violations. It leverages machine learning and predefined or custom policies to detect inappropriate sharing of sensitive information, harassment, or regulatory non-compliance. This solution enables organizations to identify risky content, investigate potential issues, and take remediation actions, directly addressing the protection of sensitive data within communication channels.

Why this answer

Microsoft Purview Communication Compliance is correct because it helps organizations detect and act on inappropriate or sensitive messages in Teams chats and channels by analyzing communications for policy violations such as offensive language, harassment, or sharing of sensitive data. Microsoft Purview Data Loss Prevention (DLP) policies are correct because they can be configured to automatically detect and prevent the sharing of sensitive information (e.g., credit card numbers, social security numbers) in Teams chats and channels by scanning messages and attachments in real time.

Exam trap

The trap here is that candidates often confuse Sensitivity Labels with DLP, thinking labels alone can prevent data leakage in chats, but labels only apply classification and encryption to files, not real-time scanning of message content.

Practice this question →

MCQmedium

Your organization has Microsoft Sentinel deployed. The security operations team needs to automatically respond to a security incident by opening an incident in ServiceNow and sending a notification to a Teams channel. What should you configure?

A.An automation rule with a playbook

B.A workbook

C.An analytics rule

D.A watchlist

AnswerA

Correct. Automation rules with playbooks enable automated responses integrated with external systems.

Why this answer

Automation rules in Microsoft Sentinel can trigger playbooks (based on Azure Logic Apps) that integrate with external systems like ServiceNow and Teams. Option B is wrong because workbooks provide visualizations, not automation. Option C is wrong because analytics rules create alerts, not automated responses.

Option D is wrong because watchlists are for correlation, not response.

Practice this question →

100

Multi-Selecthard

Which TWO Microsoft Security Copilot capabilities can help security analysts during incident response?

Select 2 answers

A.Provide guided response steps

B.Generate incident summary reports

C.Provision user accounts

D.Configure firewall rules

E.Automatically block malicious emails

AnswersA, B

Copilot offers recommendations.

Why this answer

Microsoft Security Copilot is an AI-powered security analysis tool that integrates with Microsoft 365 Defender and Sentinel. It can provide guided response steps (option A) by suggesting playbook actions and remediation workflows based on the incident context, and it can generate incident summary reports (option B) by synthesizing data from alerts, entities, and investigations into a concise narrative. These capabilities directly assist analysts in understanding and responding to incidents more efficiently.

Exam trap

The trap here is that candidates may confuse Security Copilot's analytical and advisory capabilities with automated remediation actions (like blocking emails or configuring firewalls), which are handled by separate Microsoft security products such as Defender for Office 365 or Azure Firewall policies.

Practice this question →

101

MCQmedium

A company uses Microsoft 365 E5 and is concerned about advanced phishing attacks that use adversary-in-the-middle (AiTM) techniques to steal session cookies and bypass multifactor authentication. Which Microsoft Defender for Office 365 feature should they configure to specifically protect against this type of attack?

A.Safe Attachments

B.Safe Links

C.Anti-Phishing (advanced policies)

D.Campaign Views

AnswerC

Advanced anti-phishing policies in Microsoft Defender for Office 365 are specifically engineered to detect and mitigate sophisticated phishing attacks, including adversary-in-the-middle (AiTM) threats. These policies leverage machine learning, behavioral analysis, and real-time signal detection to identify anomalous authentication flows, suspicious login patterns, and impersonation attempts. By analyzing various indicators, these advanced controls can effectively block phishing campaigns aimed at hijacking user sessions or stealing credentials via proxying techniques.

Why this answer

Advanced anti-phishing policies in Defender for Office 365 include protection against adversary-in-the-middle (AiTM) attacks by using machine learning models and impersonation detection to analyze and block phishing attempts that aim to steal session cookies and bypass multifactor authentication. This feature specifically detects and mitigates sophisticated phishing techniques that traditional anti-spam or link-checking mechanisms might miss, such as real-time credential harvesting and session hijacking via proxy servers.

Exam trap

The trap here is that candidates often confuse Safe Links (which protects against malicious URLs) with the broader anti-phishing protection needed for AiTM attacks, not realizing that AiTM attacks exploit the authentication process itself rather than just the URL, requiring advanced impersonation and proxy detection capabilities found only in anti-phishing policies.

How to eliminate wrong answers

Option A is wrong because Safe Attachments protects against malware in email attachments by detonating them in a sandbox, but it does not address session cookie theft or AiTM phishing techniques. Option B is wrong because Safe Links provides time-of-click protection against malicious URLs, but it focuses on blocking known malicious links at the point of click, not on detecting the proxy-based credential and session cookie interception used in AiTM attacks. Option D is wrong because Campaign Views is a reporting and analysis tool that provides visibility into phishing campaigns after they have been detected, not a proactive protection feature that prevents AiTM attacks.

Practice this question →

102

MCQeasy

Your organization uses Microsoft Defender for Endpoint. You need to investigate a potential malware outbreak on several endpoints. Which feature allows you to search for indicators of compromise (IOCs) across all endpoints?

A.Incidents and alerts

B.Advanced hunting

C.Threat analytics

D.Device inventory

AnswerB

Advanced hunting uses KQL to search for IOCs across endpoints in Defender for Endpoint.

Why this answer

Advanced hunting in Microsoft Defender for Endpoint is a query-based threat hunting tool that allows security analysts to search for indicators of compromise (IOCs) across all endpoints using the Kusto Query Language (KQL). It provides access to raw, schema-based tables (e.g., DeviceEvents, DeviceFileEvents, DeviceNetworkEvents) for up to 30 days of historical data, enabling proactive detection of malware outbreak patterns across the entire fleet.

Exam trap

The trap here is that candidates confuse the reactive alert management in Incidents and alerts with the proactive, query-based hunting capability of Advanced hunting, often overlooking that only Advanced hunting supports raw IOC searches across historical endpoint data.

How to eliminate wrong answers

Option A is wrong because Incidents and alerts aggregate correlated detections and alerts into a single case view, but they do not allow raw, custom KQL-based searches for specific IOCs across all endpoints; they are reactive, not proactive hunting tools. Option C is wrong because Threat analytics provides curated threat intelligence reports, including mitigations and impact assessments, but it is not a search interface for querying raw endpoint data for custom IOCs. Option D is wrong because Device inventory lists all managed devices with their properties and health status, but it does not support querying for IOCs or historical event data across endpoints.

Practice this question →

103

Multi-Selecteasy

Which TWO capabilities are part of Microsoft Entra ID Protection? (Choose two.)

Select 2 answers

A.Passwordless authentication

B.Risk-based conditional access policies

C.Just-in-time privileged access

D.Reports on risky users and sign-ins

E.Conditional access policies for device compliance

AnswersB, D

Microsoft Entra ID Protection is a critical signal source for Conditional Access, enabling the creation of policies that automatically respond to detected risks. These policies can enforce actions like requiring multi-factor authentication, password change, or blocking access entirely when a user or sign-in is deemed risky by ID Protection's machine learning algorithms. This capability allows organizations to dynamically protect resources based on real-time threat intelligence.

Why this answer

Risk-based conditional access policies (B) are a core capability of Microsoft Entra ID Protection, allowing organizations to automatically enforce access controls based on detected risk levels from user and sign-in activities. Reports on risky users and sign-ins (D) provide the foundational telemetry that Entra ID Protection uses to identify and investigate potential identity compromises, making both integral to the service.

Exam trap

The trap here is that candidates confuse the risk-based policies in Entra ID Protection with general Conditional Access policies, but only risk-based policies are part of Entra ID Protection, while device compliance and other conditions belong to the broader Conditional Access service.

Practice this question →

104

MCQeasy

Your organization's security team wants to automatically investigate and respond to sophisticated email threats like business email compromise (BEC) without manual intervention. Which Microsoft 365 security solution should you use?

A.Microsoft Defender for Cloud Apps

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Identity

D.Microsoft Defender for Office 365

AnswerD

Microsoft Defender for Office 365 is the specialized security solution designed to protect organizations from sophisticated threats in email, links, and collaboration tools like Microsoft Teams, SharePoint, and OneDrive. It offers advanced anti-phishing, anti-malware, and anti-spam capabilities, along with Safe Attachments and Safe Links to neutralize threats. Crucially, it includes Automated Investigation and Response (AIR) capabilities that automatically investigate and remediate email-borne threats such as Business Email Compromise (BEC), making it the correct choice for this scenario.

Why this answer

Microsoft Defender for Office 365 includes automated investigation and response (AIR) capabilities specifically designed to handle sophisticated email threats like business email compromise (BEC). It uses machine learning models and heuristics to detect BEC patterns—such as spoofed domains, compromised accounts, and social engineering—and can automatically trigger playbooks to contain, investigate, and remediate threats without manual intervention.

Exam trap

The trap here is that candidates often confuse 'email threat protection' with 'endpoint' or 'identity' solutions, mistakenly thinking BEC is an identity attack rather than an email-specific social engineering threat.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud Apps focuses on shadow IT discovery, cloud app permissions, and data protection across SaaS applications, not on email-specific threats like BEC. Option B is wrong because Microsoft Defender for Endpoint protects endpoints (devices) from malware, exploits, and file-based attacks, but does not natively analyze email headers or message content for BEC. Option C is wrong because Microsoft Defender for Identity monitors on-premises Active Directory signals for identity-based attacks (e.g., pass-the-hash, Kerberoasting), not email-borne social engineering attacks.

Practice this question →

105

Multi-Selectmedium

Which TWO of the following are capabilities of Microsoft Defender for Cloud Apps?

Select 2 answers

A.Information protection for files in Microsoft 365

B.Session controls to monitor and control app access in real time

C.Cloud discovery to identify shadow IT

D.Identity governance and access reviews

E.Vulnerability assessment for Azure virtual machines

AnswersB, C

Session controls are a core capability of Microsoft Defender for Cloud Apps, functioning as a Cloud Access Security Broker (CASB). These controls enable real-time monitoring and intervention for user sessions accessing cloud applications, allowing organizations to enforce policies such as blocking downloads of sensitive data, requiring step-up authentication, or protecting uploads of unclassified files. This ensures data protection and compliance even when users are accessing apps from unmanaged devices.

Why this answer

Microsoft Defender for Cloud Apps provides session controls that leverage reverse proxy architecture to monitor and control user app access in real time, enabling conditional access policies for cloud apps. Cloud discovery uses traffic logs from network appliances or Windows endpoints to identify shadow IT by analyzing app usage and risk scores.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud Apps with Microsoft Defender for Cloud (formerly Azure Security Center) or Microsoft Purview, leading them to select options like vulnerability assessment or information protection that belong to other services.

Practice this question →

106

MCQmedium

A company maintains an on-premises Active Directory environment with over 10,000 domain-joined computers. The security team is concerned about advanced attacks that use stolen credentials to move laterally, such as pass-the-hash attacks or DCSync attacks targeting domain controllers. They need a solution that monitors on-premises Active Directory traffic and event logs to detect these identity-based threats and provides alerts for investigation. Which Microsoft security solution should they deploy?

A.Microsoft Defender for Identity

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Cloud Apps

D.Microsoft Sentinel

AnswerA

Microsoft Defender for Identity is purpose-built to protect hybrid identity environments, specifically monitoring on-premises Active Directory domain controllers. It deploys lightweight sensors directly on domain controllers to profile network traffic and event logs, detecting advanced threats like Pass-the-Hash, Golden Ticket attacks, and DCSync. This specialized focus allows it to identify suspicious user and entity behavior patterns indicative of compromise within the AD infrastructure, providing critical alerts for security teams.

Why this answer

Microsoft Defender for Identity is the correct solution because it is specifically designed to monitor on-premises Active Directory traffic and event logs to detect advanced identity-based threats like pass-the-hash, pass-the-ticket, and DCSync attacks. It uses behavioral analytics and machine learning to identify suspicious activities, such as anomalous Kerberos ticket requests or replication attempts, and provides real-time alerts for investigation.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Identity with Microsoft Sentinel, assuming that a SIEM is always the best choice for threat detection, but Sentinel lacks the specialized Active Directory protocol-level analysis and behavioral models that Defender for Identity provides natively.

Why the other options are wrong

Microsoft Defender for Endpoint focuses on endpoint devices (e.g., malware, vulnerabilities) and does not natively monitor on-premises Active Directory traffic or event logs for identity-based attacks like pass-the-hash or DCSync.

Microsoft Defender for Cloud Apps focuses on securing cloud applications and detecting threats in cloud services, not on-premises Active Directory traffic or lateral movement attacks like pass-the-hash or DCSync.

Microsoft Sentinel is a SIEM/SOAR platform that ingests logs from multiple sources, but it does not natively monitor on-premises Active Directory traffic or detect identity-based attacks like pass-the-hash or DCSync without additional data connectors and analytics rules. The question specifically asks for a solution that monitors on-premises AD traffic and event logs for identity threats, which is the core function of Defender for Identity, not Sentinel.

Practice this question →

107

MCQhard

Your organization uses Microsoft Defender XDR (formerly Microsoft 365 Defender). A user reports receiving a suspicious email with a link. The email was not blocked by Exchange Online Protection (EOP). Which feature should you use to investigate the link's reputation in real time?

A.Exchange Online Protection (EOP) filtering

B.Anti-phish policy

C.Safe Attachments policy

D.Safe Links policy

AnswerD

Safe Links policies provide real-time, click-time protection by dynamically rewriting URLs in emails and supported Office documents. When a user clicks a rewritten link, it is scanned against continuously updated reputation lists and, if necessary, detonated in a sandbox, blocking access to malicious sites. This ensures dynamic protection against evolving web-based threats and provides detailed reporting for security teams.

Why this answer

Safe Links is the correct feature because it provides real-time URL reputation checking at the time of click. When a user clicks a link in an email, Safe Links checks the link against Microsoft's threat intelligence to determine if it is malicious, even if the email itself was not blocked by EOP. This allows investigation of the suspicious link's reputation after delivery.

Exam trap

The trap here is that candidates confuse Safe Links with Safe Attachments, thinking both handle links, but Safe Attachments only scans file attachments, not URLs embedded in email bodies.

How to eliminate wrong answers

Option A is wrong because Exchange Online Protection (EOP) filtering is a pre-delivery filter that blocks known spam and malware, but it does not perform real-time link reputation checks after delivery. Option B is wrong because Anti-phish policy protects against phishing attempts by analyzing sender and message patterns, but it does not provide on-click URL reputation scanning. Option C is wrong because Safe Attachments policy scans email attachments for malware, not links within the message body.

Practice this question →

108

MCQmedium

Your company uses Microsoft Purview to protect sensitive data in SharePoint Online. You need to automatically apply a 'Confidential' sensitivity label to documents containing credit card numbers. What should you create?

A.An auto-labeling policy

B.A Data Loss Prevention (DLP) policy

C.A retention policy

D.An eDiscovery case

AnswerA

An auto-labeling policy in Microsoft Purview Information Protection is specifically designed to automatically apply sensitivity labels to content that matches predefined conditions. These conditions can include the presence of specific sensitive information types (e.g., credit card numbers, national ID numbers), keywords, or even content identified by trainable classifiers. This proactive approach ensures consistent classification and protection of sensitive data at scale, reducing reliance on manual user labeling.

Why this answer

Auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels based on sensitive info types, such as credit card numbers. Option B (DLP policy) is incorrect because while DLP can detect and protect sensitive data, it does not automatically apply labels; it applies actions like blocking or warning. Option C (retention policy) is incorrect because retention policies manage data retention and deletion, not labeling.

Option D (eDiscovery case) is incorrect because eDiscovery cases are used for searching and legal hold purposes.

Practice this question →

109

MCQhard

A security analyst wants to create a custom detection rule that tracks a specific multi-stage attack pattern: a user receives a phishing email, clicks a link, and then a script is executed on their device. The analyst needs to write a Kusto Query Language (KQL) query to detect this pattern and schedule it to run automatically, generating alerts. Which Microsoft 365 Defender capability should they use?

A.Advanced hunting

B.Custom detection rules

C.Automation

D.Threat analytics

AnswerB

Correct. Custom detection rules allow you to create a KQL query from advanced hunting and schedule it to run automatically, generating alerts for matching events.

Why this answer

Custom detection rules in Microsoft 365 Defender allow security analysts to write KQL queries that run on a schedule and automatically generate alerts when the query returns results. This capability is specifically designed to detect multi-stage attack patterns, such as the phishing email → link click → script execution chain described, by querying advanced hunting data and triggering incident creation.

Exam trap

The trap here is that candidates confuse Advanced hunting (a query tool) with Custom detection rules (a scheduled alerting engine), assuming that writing a KQL query in Advanced hunting alone is sufficient for automated detection, when in fact it requires the custom detection rule framework to run on a schedule and generate alerts.

How to eliminate wrong answers

Option A is wrong because Advanced hunting is an interactive query interface for exploring raw data, but it does not natively support scheduled execution or automatic alert generation; it requires manual execution or integration with custom detection rules. Option C is wrong because Automation in Microsoft 365 Defender refers to automated investigation and response (AIR) playbooks that react to alerts, not to the creation of custom detection queries or scheduled alert rules. Option D is wrong because Threat analytics provides curated threat intelligence reports and pre-built detections from Microsoft, but it does not allow users to write custom KQL queries or schedule their own detection logic.

Practice this question →

110

MCQmedium

A security team wants to discover which cloud applications (such as Dropbox, Salesforce, or unsanctioned file-sharing apps) are being used by employees, even if those apps are not sanctioned by IT. They need to analyze usage patterns, risk levels, and identify potential shadow IT. Which feature of Microsoft Defender for Cloud Apps should they enable?

A.App Connectors (API connectors)

B.Cloud Discovery

C.Conditional Access App Control

D.Microsoft Defender for Endpoint

AnswerB

Cloud Discovery, a core feature of Microsoft Defender for Cloud Apps (MDCA), is specifically designed to identify all cloud applications accessed by users within an organization. It achieves this by analyzing network traffic logs from firewalls, proxies, and other network devices, correlating IP addresses and URLs to known cloud services. This process provides a comprehensive overview of both sanctioned and unsanctioned "shadow IT" applications, which is precisely what a security team needs for initial discovery.

Why this answer

Cloud Discovery is the correct feature because it analyzes traffic logs from firewalls and proxies to identify cloud app usage, including unsanctioned apps like Dropbox or Salesforce, without requiring API integration. It provides risk scores, usage patterns, and shadow IT detection by comparing discovered apps against Microsoft's cloud app catalog of over 31,000 apps.

Exam trap

The trap here is that candidates often confuse Cloud Discovery (passive log analysis for unsanctioned apps) with App Connectors (active API integration for sanctioned apps), assuming both can discover shadow IT, but only Cloud Discovery identifies apps not already connected via API.

How to eliminate wrong answers

Option A is wrong because App Connectors (API connectors) require explicit admin consent and API access to sanctioned apps, so they cannot discover unsanctioned or unknown shadow IT apps. Option C is wrong because Conditional Access App Control enforces real-time access policies on sanctioned apps via reverse proxy, not discovery of unsanctioned apps. Option D is wrong because Microsoft Defender for Endpoint is an endpoint detection and response (EDR) solution focused on malware, vulnerabilities, and device threats, not cloud app discovery.

Practice this question →

111

MCQmedium

Your company uses Microsoft Defender for Cloud Apps to discover shadow IT. You have discovered a new cloud app that employees are using to store corporate data. The app is not sanctioned. You need to sanction the app but also ensure that users cannot upload sensitive data to it. You have configured a session policy to monitor the app. What additional step should you take?

A.Create a file policy in Microsoft Defender for Cloud Apps that detects sensitive data and blocks uploads.

B.Block the app entirely by adding it to the blocked list.

C.Configure a Conditional Access policy to require device compliance for the app.

D.Use the session policy to block all uploads to the app.

AnswerA

File policies can block uploads of sensitive data.

Why this answer

A file policy in Defender for Cloud Apps can detect sensitive data in files and block uploads, allowing the app to be sanctioned while preventing data leakage. Option B is incorrect because blocking the app entirely prevents its use, which is not the goal. Option C is incorrect because Conditional Access policies control access based on conditions like device compliance, not content-based blocking.

Option D is incorrect because the session policy currently only monitors; to block uploads based on content, you need a file policy.

Practice this question →

112

Multi-Selecteasy

Which THREE are capabilities of Microsoft Defender for Cloud?

Select 3 answers

A.Just-in-time (JIT) VM access

B.Vulnerability assessment for virtual machines

C.Cloud Security Posture Management (CSPM)

D.DDoS protection

E.SIEM and security orchestration

AnswersA, B, C

Reduces attack surface with managed access.

Why this answer

Just-in-time (JIT) VM access is a capability of Microsoft Defender for Cloud that reduces the attack surface by locking down inbound traffic to Azure VMs. It uses Network Security Group (NSG) rules to allow access only when requested by an authorized user, for a specified time window, and from a specific IP address. This prevents persistent open management ports like RDP (TCP 3389) or SSH (TCP 22) from being exposed to the internet.

Exam trap

The trap here is that candidates confuse the 'recommendations' or 'alerts' shown in Defender for Cloud (which may mention DDoS or SIEM integration) with Defender for Cloud's own native capabilities, leading them to incorrectly select D or E as direct features.

Practice this question →

113

MCQeasy

A company wants to use Microsoft Entra ID (Azure AD) to enforce multi-factor authentication (MFA) for all users accessing sensitive applications. Which security feature should they implement?

A.Privileged Identity Management (PIM)

B.Conditional Access policies

C.Password Protection

D.Identity Protection policies

AnswerB

Conditional Access policies are the primary tool within Microsoft Entra ID for enforcing specific access controls based on various conditions evaluated at sign-in. These policies allow administrators to define "if-then" statements, such as "if a user is accessing a specific cloud application, then require multi-factor authentication." This capability directly addresses the requirement to enforce MFA for designated applications, providing granular control over access.

Why this answer

Conditional Access policies allow administrators to enforce MFA based on conditions such as application sensitivity, user risk, or location. Option A (Privileged Identity Management) is incorrect because it manages just-in-time access for privileged roles, not MFA enforcement. Option C (Password Protection) is incorrect because it blocks weak passwords but does not enforce MFA.

Option D (Identity Protection) is incorrect because it detects identity risks and can trigger remediation but does not directly enforce MFA.

Practice this question →

114

MCQmedium

A security operations team needs to protect Windows servers from ransomware and other advanced threats. They require a solution that provides endpoint detection and response (EDR), automated investigation, and the ability to isolate compromised machines from the network. Which Microsoft security solution should they deploy?

A.Microsoft Defender for Cloud

B.Microsoft Defender for Identity

C.Microsoft Defender for Office 365

D.Microsoft Defender for Endpoint

AnswerD

Microsoft Defender for Endpoint is the correct solution as it provides comprehensive endpoint detection and response (EDR), vulnerability management, and threat protection specifically for Windows servers and clients. It actively monitors for malicious activity, automates investigations, and can isolate compromised devices, directly addressing the need to protect servers from various threats.

Why this answer

Microsoft Defender for Endpoint (MDE) is the correct solution because it provides endpoint detection and response (EDR), automated investigation and remediation, and network isolation capabilities specifically for Windows servers and endpoints. These features directly address the requirement to protect against ransomware and advanced threats by detecting suspicious behavior, automatically investigating alerts, and allowing admins to isolate compromised machines from the network to prevent lateral movement.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a cloud security posture tool) with Microsoft Defender for Endpoint (an endpoint protection platform), especially since both names include 'Defender' and 'Cloud' can be misassociated with server workloads.

Why the other options are wrong

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) for multicloud environments, not an endpoint detection and response (EDR) solution for Windows servers. It lacks the ability to isolate compromised machines from the network.

Microsoft Defender for Identity focuses on protecting on-premises Active Directory identities and detecting identity-based attacks, not on endpoint detection, response, or isolation of compromised machines.

Microsoft Defender for Office 365 protects email and collaboration tools like Exchange Online and SharePoint, not Windows servers. It lacks endpoint detection and response (EDR) and network isolation capabilities for servers.

Practice this question →

115

MCQhard

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel. The JSON snippet shows a rule designed to create an incident when a high-severity alert is generated. However, the rule is not triggering. What is the most likely reason?

A.The logicAppResourceId is missing a required parameter.

B.The action should be of type 'Microsoft.SecurityInsights/AlertRule/Alert' instead.

C.Automation rules triggered on alert creation cannot create incidents; they can only run playbooks.

D.The trigger type is incorrect; it should be 'Microsoft.SecurityInsights/Incident'.

AnswerC

Automation rules configured to trigger upon the creation of an alert have a specific limitation regarding their direct actions. While they can successfully execute a playbook, which in turn can create an incident, the automation rule itself cannot directly perform a 'createIncident' action. This distinction is crucial for understanding the flow of operations, as direct incident creation is typically reserved for rules triggered by incident-related events.

Why this answer

Automation rules in Microsoft Sentinel that are triggered on alert creation (i.e., when an alert is generated) are designed only to run playbooks (automated response actions), not to create incidents. Incident creation from alerts is handled automatically by Sentinel's built-in analytics rules or by the incident creation rule type, not by an automation rule triggered on alert creation. The JSON snippet shows a trigger type of 'Microsoft.SecurityInsights/AlertRule/Alert', which confirms the rule fires on alert creation, and the action attempts to create an incident, which is not supported for this trigger type.

Exam trap

The trap here is that candidates often assume automation rules can freely create incidents from any trigger type, but Microsoft Sentinel strictly limits incident creation to analytics rule configurations or incident-scoped automation rules, not alert-scoped automation rules.

How to eliminate wrong answers

Option A is wrong because the logicAppResourceId is not missing a required parameter; the issue is not about missing parameters but about the fundamental incompatibility of the trigger type with the action. Option B is wrong because the action type 'Microsoft.SecurityInsights/AlertRule/Alert' would be incorrect for creating an incident; the correct action type for creating an incident is 'Microsoft.SecurityInsights/Incident', but even that action type is not allowed when the trigger is on alert creation. Option D is wrong because the trigger type 'Microsoft.SecurityInsights/AlertRule/Alert' is correct for an automation rule that fires when an alert is generated; changing it to 'Microsoft.SecurityInsights/Incident' would make the rule trigger on incident creation, not alert creation, which does not solve the problem of creating an incident from an alert.

Practice this question →

116

MCQhard

Your company uses Microsoft Defender for Cloud to secure multicloud workloads. You need to ensure that regulatory compliance frameworks (e.g., SOC 2, ISO 27001) are continuously assessed and any drift is reported. What should you implement?

A.Regulatory compliance standards in Microsoft Defender for Cloud

B.Microsoft Sentinel analytics rules

C.Azure Policy initiatives

D.Microsoft Defender for Cloud Apps session policies

AnswerA

Regulatory compliance standards in Microsoft Defender for Cloud provide continuous assessment of your cloud environment against a wide array of industry and regulatory benchmarks, such as ISO 27001, SOC 2, and PCI DSS. It automatically maps security recommendations to specific controls within these standards, offering a compliance score and detailed reports. This feature helps organizations understand their current compliance posture and provides actionable insights to remediate non-compliant resources, simplifying the audit preparation process.

Why this answer

Regulatory compliance standards in Defender for Cloud provide continuous assessment against frameworks. Option B is wrong because Microsoft Sentinel is for SIEM/SOAR, not compliance assessment. Option C is wrong because Azure Policy is used for policy enforcement, not assessment of compliance frameworks.

Option D is wrong because Defender for Cloud Apps focuses on cloud app security.

Practice this question →

117

MCQhard

Refer to the exhibit. A security analyst is reviewing an alert from Microsoft 365 Defender. The alert is associated with an incident. What is the best first step to investigate this alert?

A.Open the associated incident to view all related alerts and entities.

B.Isolate the affected user's device immediately.

C.Mark the alert as resolved.

D.Run an automated simulation to test the alert.

AnswerA

An incident aggregates multiple related alerts and entities (users, devices, mailboxes, IP addresses) into a single investigation unit. This holistic view is crucial for understanding the scope, impact, and attack chain, preventing siloed investigations of individual alerts. It allows for comprehensive threat hunting and response planning, making it the most effective initial step for a security analyst.

Why this answer

Microsoft 365 Defender incidents aggregate multiple alerts and entities (users, devices, mailboxes) into a single view, providing the full context needed to understand the attack chain. Opening the incident first allows the analyst to correlate the alert with related alerts, affected assets, and the incident timeline, which is the recommended initial step in incident response workflows.

Exam trap

The trap here is that candidates often jump to an immediate containment action (like isolating a device) without first gathering context, but Microsoft's incident-first approach emphasizes investigation before remediation to avoid false positives and ensure proportional response.

How to eliminate wrong answers

Option B is wrong because isolating the user's device immediately is a reactive containment step that should be taken only after confirming the device is compromised through incident investigation; premature isolation can disrupt legitimate operations and lose forensic evidence. Option C is wrong because marking the alert as resolved without investigation violates security best practices and could allow an active threat to persist undetected. Option D is wrong because running an automated simulation tests detection capabilities but does not help investigate a real, active alert; it is a testing or validation activity, not a response step.

Practice this question →

118

MCQeasy

A company wants to use Microsoft Sentinel to collect security logs from on-premises servers and send them to Azure. Which data connector should they use?

A.Azure Monitor Agent (AMA)

B.Syslog connector

C.Microsoft Monitoring Agent (MMA)

D.Office 365 connector

AnswerA

The Azure Monitor Agent (AMA) is the correct and recommended solution for collecting security logs from both Windows and Linux servers, including on-premises, for ingestion into Microsoft Sentinel. It offers a more secure, efficient, and flexible data collection experience compared to its predecessor, allowing granular control over which logs are collected via Data Collection Rules (DCRs). AMA supports a wide range of log types, including security events, performance counters, and Syslog, making it ideal for comprehensive security monitoring.

Why this answer

The Azure Monitor Agent (AMA) is the correct choice because it is the current, unified data collection agent for Microsoft Sentinel that supports collecting security logs from Windows and Linux on-premises servers. It replaces the legacy Microsoft Monitoring Agent (MMA) and provides a more secure, scalable, and performant method to send logs to Azure Log Analytics workspaces, which underpin Sentinel.

Exam trap

The trap here is that candidates often confuse the Syslog connector (Option B) as the correct answer for on-premises Linux servers, but the question specifically asks for a data connector that directly collects logs from on-premises servers, and AMA is the modern, unified agent that handles both Windows and Linux without requiring an intermediate Syslog forwarder.

How to eliminate wrong answers

Option B (Syslog connector) is wrong because it is not a data connector for on-premises servers; it is a legacy method that requires a separate Syslog forwarder (e.g., rsyslog) and does not directly collect logs from servers without additional configuration. Option C (Microsoft Monitoring Agent) is wrong because it is the deprecated agent that Microsoft has announced will be retired by August 2024; it lacks the security and performance improvements of AMA, such as support for Azure Private Link and data collection rules. Option D (Office 365 connector) is wrong because it is specifically designed to ingest logs from Microsoft 365 services (e.g., Exchange, SharePoint) and cannot collect security logs from on-premises servers.

Practice this question →

119

MCQmedium

A company uses Azure virtual machines and on-premises Windows servers. The security team wants a single solution that provides vulnerability assessment, a regulatory compliance dashboard (e.g., for ISO 27001), and integrated threat detection such as fileless malware and anomalous logins. Which Microsoft security solution should they use?

A.Microsoft Defender for Endpoint

B.Microsoft Defender for Cloud

C.Microsoft 365 Defender

D.Microsoft Sentinel

AnswerB

Microsoft Defender for Cloud provides comprehensive cloud security posture management (CSPM) and cloud workload protection (CWPP) across Azure, on-premises, and multi-cloud environments. It offers integrated vulnerability assessments, a secure score for continuous security posture improvement, and regulatory compliance dashboards to monitor adherence to industry standards. This service directly addresses the need for unified security management, threat protection, and compliance for both Azure virtual machines and on-premises Windows servers.

Why this answer

Microsoft Defender for Cloud (formerly Azure Security Center and Azure Defender) is the correct choice because it provides unified security management across Azure VMs and on-premises servers. It includes built-in vulnerability assessment (via Qualys or Microsoft Defender Vulnerability Management), a regulatory compliance dashboard with built-in standards like ISO 27001, and integrated threat detection for fileless malware, anomalous logins, and other advanced attacks. This single solution meets all the requirements listed in the question.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud with Microsoft 365 Defender, mistakenly thinking the latter covers all security workloads, but Microsoft 365 Defender is limited to Microsoft 365 services and does not manage Azure infrastructure or on-premises servers.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for devices, but it does not provide a regulatory compliance dashboard for standards like ISO 27001 or native vulnerability assessment across hybrid infrastructure. Option C is wrong because Microsoft 365 Defender is a suite that correlates signals from Microsoft 365 services (e.g., Defender for Endpoint, Defender for Office 365) and is not designed to manage security posture or compliance for Azure VMs and on-premises servers. Option D is wrong because Microsoft Sentinel is a cloud-native SIEM/SOAR solution for log collection and incident response, but it does not include built-in vulnerability assessment or a pre-configured regulatory compliance dashboard; those capabilities require additional integration and configuration.

Practice this question →

120

MCQmedium

A company uses Microsoft 365 and needs to protect endpoints from ransomware attacks that encrypt files. The security team wants automated investigation and response capabilities for malware incidents on Windows devices. Which Microsoft security solution should they use?

A.Microsoft Defender for Office 365

B.Microsoft Defender for Cloud Apps

C.Microsoft Defender for Identity

D.Microsoft Defender for Endpoint

AnswerD

Microsoft Defender for Endpoint delivers a comprehensive endpoint security solution for devices across various platforms, including Windows, macOS, Linux, Android, and iOS. It integrates next-generation antivirus, Endpoint Detection and Response (EDR) capabilities, automated investigation and remediation, and vulnerability management to proactively protect against and respond to sophisticated threats. This service is specifically engineered to secure endpoints from malware, exploits, and other malicious activities, making it the correct choice for device protection.

Why this answer

Microsoft Defender for Endpoint (D) is the correct answer because it provides endpoint detection and response (EDR) capabilities, including automated investigation and remediation for malware incidents on Windows devices. It uses behavioral sensors, cloud analytics, and threat intelligence to detect ransomware encryption behavior and automatically contain or remediate affected endpoints, aligning with the requirement for automated response.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Office 365 (which protects email and collaboration) with endpoint protection, failing to recognize that automated investigation and response for Windows devices specifically requires an endpoint-focused solution like Microsoft Defender for Endpoint.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Office 365 protects email, SharePoint, and Teams from phishing and malware, not endpoints like Windows devices. Option B is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that governs cloud app usage and data, not endpoint-level ransomware protection. Option C is wrong because Microsoft Defender for Identity monitors on-premises Active Directory for identity-based attacks (e.g., Kerberos abuse), not file-encrypting ransomware on endpoints.

Practice this question →

121

MCQhard

A company is implementing Microsoft Purview Information Protection. They want to automatically apply a 'Highly Confidential' sensitivity label to emails containing a specific credit card pattern. Which solution should they use?

A.Microsoft Sentinel

B.Microsoft Purview Data Loss Prevention

C.Microsoft Defender for Cloud Apps

D.Microsoft Purview Audit

AnswerB

Microsoft Purview Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and protect sensitive information across various locations within the Microsoft 365 environment and beyond. DLP policies can be configured with rules that detect specific types of sensitive information, such as financial data or personally identifiable information (PII), within content. Upon detection, these policies can be set to automatically apply a designated Microsoft Purview sensitivity label to the content, thereby enforcing predefined protection actions like encryption, access restrictions, or visual markings.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it can automatically apply sensitivity labels to emails based on content inspection, such as detecting credit card patterns using built-in sensitive info types. DLP policies can be configured to classify and label messages in transit in Exchange Online, ensuring the 'Highly Confidential' label is applied before the email leaves the organization.

Exam trap

The trap here is that candidates often confuse the automatic labeling capability of Microsoft Purview DLP with Microsoft Sentinel's ability to detect threats, but Sentinel cannot apply sensitivity labels to content based on data patterns.

How to eliminate wrong answers

Option A is wrong because Microsoft Sentinel is a SIEM/SOAR solution for security analytics and threat detection, not for content-based classification or automatic labeling of emails. Option C is wrong because Microsoft Defender for Cloud Apps is a CASB focused on shadow IT discovery and cloud app access control, not for inspecting and labeling email content in transit. Option D is wrong because Microsoft Purview Audit provides auditing and logging of user and admin activities, not the ability to automatically apply sensitivity labels based on content patterns.

Practice this question →

122

Multi-Selecteasy

Your organization uses Microsoft Purview to manage data sensitivity and compliance. Which TWO capabilities are provided by Microsoft Purview Information Protection?

Select 2 answers

A.Define retention labels to keep data for a specified period.

B.Detect and manage insider risk activities such as data theft by employees.

C.Enforce Data Loss Prevention (DLP) policies to prevent accidental sharing of sensitive data.

D.Create and publish sensitivity labels that can be applied to documents and emails.

E.Automatically classify data based on sensitive information types and machine learning models.

AnswersD, E

Creating and publishing sensitivity labels is a foundational capability of Microsoft Purview Information Protection. These labels allow organizations to classify data based on its sensitivity level, applying visual markings (like headers or watermarks) and persistent protection actions such as encryption and access restrictions. This ensures that sensitive documents and emails remain protected, even when shared outside the organization, as the protection travels with the data.

Why this answer

Microsoft Purview Information Protection (MIP) focuses on classifying, labeling, and protecting sensitive data. Option D is correct because sensitivity labels are the core mechanism in MIP for applying protection actions (e.g., encryption, access restrictions) to documents and emails. Option E is correct because MIP includes automatic classification using built-in sensitive information types (e.g., credit card numbers) and trainable classifiers based on machine learning models.

Exam trap

The trap here is that candidates confuse the distinct Microsoft Purview solutions: Information Protection (sensitivity labels/classification), Data Loss Prevention (policies to block sharing), Records Management (retention labels), and Insider Risk Management (user behavior analytics), leading them to select overlapping but incorrect options like A, B, or C.

Practice this question →

123

MCQmedium

A company uses Microsoft Defender for Cloud Apps to secure its cloud applications. The security team wants to monitor and control data activities in a third-party cloud app (e.g., Box) in real time. Specifically, they need to block downloads of files that have a 'Confidential' sensitivity label when users access the app from unmanaged devices. Which capability of Microsoft Defender for Cloud Apps should they configure?

A.Cloud Discovery

B.App connector

C.Conditional Access App Control

D.Information protection

AnswerC

Conditional Access App Control integrates directly with Azure AD Conditional Access policies to route user sessions through Defender for Cloud Apps. This enables real-time monitoring and control over user activities within cloud applications, such as preventing data downloads, uploads, or copy-pasting based on policy conditions. This granular, session-level enforcement is crucial for securing data in real-time during active user sessions, making it the correct solution for immediate data access restrictions.

Why this answer

Conditional Access App Control (CAAC) is the correct capability because it enforces real-time session policies that can block downloads based on sensitivity labels and device compliance. By integrating with Microsoft Defender for Cloud Apps, CAAC intercepts user sessions to third-party apps like Box and applies granular controls, such as blocking file downloads when the device is unmanaged and the file carries a 'Confidential' label.

Exam trap

The trap here is confusing API-based app connectors (which control data at rest) with reverse proxy-based Conditional Access App Control (which controls data in motion during user sessions).

Why the other options are wrong

Cloud Discovery analyzes traffic logs to identify shadow IT and assess cloud app usage, but it does not provide real-time control over data activities like blocking downloads based on sensitivity labels.

An app connector provides API-based visibility and control for cloud apps, but it cannot enforce real-time blocking of downloads based on device state or sensitivity labels. The question requires session-level control, which is only possible with Conditional Access App Control.

Information protection in Defender for Cloud Apps focuses on applying sensitivity labels and encryption to files, not on real-time control of access or blocking downloads based on device state. The question requires conditional access enforcement, which is provided by Conditional Access App Control.

Practice this question →

124

MCQeasy

Your organization uses Microsoft Purview to govern data in Azure Data Lake Storage. You need to create a data classification policy that automatically tags files containing personally identifiable information (PII) such as social security numbers. Which scanning solution should you use?

A.Microsoft Purview Information Protection

B.Microsoft Purview Data Loss Prevention (DLP)

C.Microsoft Purview Audit

D.Microsoft Purview Data Map scanning

AnswerD

Microsoft Purview Data Map scanning is the foundational capability responsible for automatically discovering, cataloging, and classifying data across an organization's entire data estate, including on-premises, multi-cloud, and SaaS sources. It uses built-in and custom classification rules, sensitive information types, and machine learning to identify sensitive data patterns and apply appropriate labels or classifications, populating the Data Map with metadata for governance. This process is central to understanding and managing data risk.

Why this answer

Microsoft Purview Data Map scanning is the correct solution because it provides automated scanning and classification of data assets across Azure Data Lake Storage and other sources. It uses built-in classifiers to detect sensitive data types like social security numbers and applies the classification labels directly to the files, enabling governance and policy enforcement.

Exam trap

The trap here is that candidates often confuse Microsoft Purview Information Protection (which applies labels to documents) with the scanning and classification capabilities of Purview Data Map, leading them to choose option A incorrectly.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Information Protection focuses on applying sensitivity labels and encryption to documents and emails, not on scanning and classifying data at rest in Azure Data Lake Storage. Option B is wrong because Microsoft Purview Data Loss Prevention (DLP) is designed to prevent unauthorized sharing or leakage of sensitive data, not to perform initial scanning and classification of files. Option C is wrong because Microsoft Purview Audit is used for logging and reviewing user activities and events, not for scanning or classifying data content.

Practice this question →

125

MCQhard

A company runs Windows Server virtual machines (VMs) on-premises and in Azure. The security team wants a unified view of missing security updates and known vulnerabilities (CVEs) across all VMs. They want to enable agentless scanning for Azure VMs and deploy a lightweight agent for on-premises machines. The results should be consolidated in a single dashboard with prioritized remediation recommendations. Which Microsoft security solution should they use?

A.Microsoft Defender for Cloud

B.Microsoft Defender for Endpoint

C.Microsoft Sentinel

D.Microsoft Defender for Identity

AnswerA

Defender for Cloud includes vulnerability assessment capabilities that cover VMs in Azure and on-premises (via Azure Arc). It provides a single dashboard showing missing patches and CVEs with actionable recommendations, and supports both agentless and agent-based scanning.

Why this answer

Microsoft Defender for Cloud provides unified visibility into security vulnerabilities and missing updates across hybrid workloads, including on-premises and Azure VMs. It supports agentless scanning for Azure VMs (using the cloud-based scanner) and allows deployment of the Azure Monitor Agent (or legacy Log Analytics agent) for on-premises machines, consolidating findings in a single dashboard with prioritized remediation recommendations based on the Secure Score and integrated vulnerability assessment (e.g., Qualys or Microsoft Defender Vulnerability Management).

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a cloud security posture management and workload protection solution) with Microsoft Defender for Endpoint (an endpoint detection and response tool), assuming both provide identical vulnerability scanning capabilities, but only Defender for Cloud offers agentless scanning for Azure VMs and a unified hybrid dashboard for missing updates and CVEs.

Why the other options are wrong

Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for individual devices, not unified vulnerability assessment across on-premises and Azure VMs with agentless scanning and consolidated dashboard.

Microsoft Sentinel is a SIEM/SOAR solution for security event collection and threat detection, not a vulnerability management tool. It lacks native agentless scanning for Azure VMs and a dedicated dashboard for missing security updates and CVEs with prioritized remediation.

Practice this question →

126

MCQhard

You are troubleshooting a Conditional Access policy in Microsoft Entra ID. The policy in the exhibit is not blocking some sign-ins that you expected to block. What is the most likely reason?

A.The policy only blocks based on user risk, not sign-in risk

B.The policy is not assigned to any users

C.The grant control is set to allow access

D.The policy excludes certain users

AnswerA

The conditions only include userRiskLevels, not signInRiskLevels.

Why this answer

The Conditional Access policy shown in the exhibit is configured to block access based on user risk level (e.g., high user risk), but it does not include sign-in risk as a condition. Sign-ins that exhibit suspicious behavior (e.g., from an anonymous IP address) but originate from a user account with low user risk will not be blocked, as the policy only evaluates user risk, not sign-in risk. To block such sign-ins, the policy must also include sign-in risk as a condition.

Exam trap

The trap here is that candidates often assume 'risk' in Conditional Access refers to both user and sign-in risk interchangeably, but the exam tests the distinction that these are separate conditions that must be explicitly configured in the policy.

How to eliminate wrong answers

Option B is wrong because if the policy were not assigned to any users, it would not affect any sign-ins at all, but the question states the policy is blocking some sign-ins, indicating it is assigned to at least some users. Option C is wrong because the grant control in the exhibit is set to 'Block access', not 'Allow access'; if it were set to allow, the policy would not block any sign-ins, contradicting the scenario. Option D is wrong because while excluding certain users could reduce the policy's scope, the question implies the policy is expected to block specific sign-ins but fails to do so; the most likely reason is a missing condition (sign-in risk), not an exclusion issue, as exclusions would be explicitly listed and would not explain why sign-ins that should be blocked are passing through.

Practice this question →

127

Multi-Selecthard

A company has deployed Microsoft 365 Defender to unify threat detection and response. Which two components are included within the Microsoft 365 Defender integrated solution? (Select all that apply.)

Select 2 answers

A.Microsoft Defender for Endpoint

B.Microsoft Defender for Cloud

C.Microsoft Defender for Office 365

D.Microsoft Sentinel

AnswersA, C

Microsoft Defender for Endpoint is a foundational component of Microsoft 365 Defender, providing robust endpoint detection and response (EDR) capabilities across various operating systems. It offers next-generation protection, automated investigation and remediation, and vulnerability management, integrating its rich telemetry directly into the unified M365 Defender portal. This integration enables comprehensive visibility and coordinated threat response across devices, ensuring endpoints are protected from sophisticated attacks.

Why this answer

Microsoft 365 Defender is an integrated threat protection suite that unifies detection and response across an organization's Microsoft 365 environment. It includes Microsoft Defender for Endpoint, which provides endpoint detection and response (EDR) capabilities for devices, and Microsoft Defender for Office 365, which protects against email, phishing, and collaboration threats. These two components work together within the Microsoft 365 Defender portal to correlate alerts and automate response across endpoints and Office 365 workloads.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a cloud security solution) with Microsoft Defender for Cloud Apps (a CASB component of Microsoft 365 Defender), leading them to incorrectly select Defender for Cloud as part of the integrated solution.

Why the other options are wrong

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) tool, not a component of the Microsoft 365 Defender integrated solution, which focuses on endpoint, email, and identity threats.

Microsoft Sentinel is a cloud-native SIEM and SOAR solution, not a component of Microsoft 365 Defender. The question asks for components within the integrated Microsoft 365 Defender solution, which includes Defender for Endpoint, Office 365, Identity, and Cloud Apps, but not Sentinel.

Practice this question →

128

MCQeasy

A company wants to use Microsoft Intune to enforce that mobile devices have a PIN of at least 6 characters to access corporate resources. What should they configure?

A.Device compliance policy

B.Conditional access policy

C.App protection policy

D.Device configuration profile

AnswerA

A Device compliance policy is the correct choice because it specifically defines the security posture and configuration requirements that a mobile device must meet to be considered compliant. This includes setting rules for device-wide security features such as requiring a PIN, specifying its minimum length, or enforcing encryption. Intune evaluates devices against these defined rules and reports their compliance status, which is then used by other policies for access enforcement.

Why this answer

A device compliance policy in Microsoft Intune defines the rules that devices must meet to be considered compliant, such as requiring a PIN of at least 6 characters. When a device is marked non-compliant, Conditional Access can block access to corporate resources. This is the correct mechanism to enforce the PIN requirement at the device level before granting access.

Exam trap

The trap here is confusing the enforcement of device settings (Device Compliance Policy) with the configuration of settings (Device Configuration Profile) or app-level protection (App Protection Policy), leading candidates to select D or C instead of A.

How to eliminate wrong answers

Option B is wrong because Conditional Access policies evaluate signals (like device compliance) to allow or block access, but they do not directly enforce device settings like PIN length; they rely on compliance policies to report that status. Option C is wrong because App Protection Policies (MAM) manage data protection within apps (e.g., copy/paste, encryption) and can require a PIN for app access, but they apply to apps on unmanaged devices and do not enforce device-level PIN requirements for all corporate resource access. Option D is wrong because Device Configuration Profiles push settings (e.g., Wi-Fi, VPN, email) to devices but do not enforce compliance or block access; they are for configuration, not conditional access enforcement.

Practice this question →

129

MCQhard

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP). You need to prevent users from sharing sensitive credit card numbers via email. The DLP policy must trigger automatically when a user attempts to send an email containing a credit card number. Which DLP configuration should you use?

A.Create a DLP policy with a condition that matches the Credit Card Number sensitive info type and an action to block the email

B.Configure Double Key Encryption for the Exchange Online mailbox

C.Configure a Safe Links policy in Microsoft Defender for Office 365

D.Use Microsoft Purview Customer Key for encryption

AnswerA

This is the correct DLP configuration to block emails with credit card numbers.

Why this answer

Microsoft Purview DLP policies can be configured to detect sensitive information types, such as the Credit Card Number (defined by regex and checksum validation per PCI DSS), and automatically apply an action to block the email from being sent. This meets the requirement for automatic, policy-driven prevention of sharing credit card numbers via email.

Exam trap

The trap here is that candidates confuse data-at-rest encryption controls (like Customer Key or Double Key Encryption) with data-loss prevention capabilities that inspect and block data in transit, leading them to select encryption options instead of the DLP policy.

How to eliminate wrong answers

Option B is wrong because Double Key Encryption (DKE) protects data at rest by requiring two keys for decryption, but it does not inspect or block outbound emails containing sensitive data. Option C is wrong because Safe Links policy in Microsoft Defender for Office 365 protects users from clicking malicious URLs in emails, not from sharing sensitive content like credit card numbers. Option D is wrong because Microsoft Purview Customer Key provides tenant-level encryption key control for data at rest, not real-time content inspection or blocking of outbound emails.

Practice this question →

130

MCQhard

Your organization is implementing Microsoft Defender for Office 365 to protect against phishing attacks. You need to ensure that when a user clicks a malicious link in an email, the user is warned and the action is blocked. Which policy should you configure?

A.Safe Attachments policy

B.Safe Links policy

C.Anti-spam policy

D.Anti-phishing policy

AnswerB

A Safe Links policy is designed to protect users from malicious URLs by providing time-of-click verification of web addresses in email and other Microsoft 365 apps. When a user clicks a link, Safe Links rewrites the URL and checks it against a list of known malicious sites, blocking access or warning the user if the destination is deemed unsafe. This proactive defense is specifically engineered to counter threats delivered via embedded links, making it the appropriate solution for protecting against malicious URLs.

Why this answer

Safe Links in Defender for Office 365 provides real-time time-of-click protection against malicious links. Option A is wrong because Safe Attachments scans attachments, not links. Option C is wrong because anti-phishing policies protect against spoofing and impersonation but do not block links at click time.

Option D is wrong because anti-spam policies filter spam, not malicious links.

Practice this question →

131

MCQmedium

A company uses Microsoft Sentinel for security information and event management (SIEM). The security team needs to detect and automatically respond to a potential privilege escalation attack where an attacker attempts to add a new user to the Global Administrator role in Microsoft Entra ID. What should the security team configure?

A.Deploy a device compliance policy in Microsoft Intune

B.Configure a data classification label in Microsoft Purview

C.Create a policy in Microsoft Defender for Cloud Apps

D.Create an analytics rule with an automated playbook in Microsoft Sentinel

AnswerD

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It ingests security logs from various sources, including Microsoft Entra ID audit logs, to detect threats using analytics rules defined with Kusto Query Language (KQL). An analytics rule can identify specific events, such as unauthorized role assignments, and then trigger an automated playbook (built with Azure Logic Apps) to perform immediate response actions like revoking a role, isolating a user, or sending notifications, directly addressing the need for detection and automated response to identity-related security incidents.

Why this answer

Microsoft Sentinel is the SIEM solution, and analytics rules define conditions that trigger automated responses. By creating an analytics rule that detects a user being added to the Global Administrator role (e.g., via the AuditLogs or IdentityProtection logs) and linking it to an automated playbook (a logic app), the security team can automatically respond to the privilege escalation attempt without manual intervention.

Exam trap

The trap here is that candidates may confuse Microsoft Sentinel's SIEM capabilities with Microsoft Defender for Cloud Apps' CASB features, but Sentinel is the only option that provides custom analytics rules with integrated automated playbooks for SIEM-based detection and response.

How to eliminate wrong answers

Option A is wrong because a device compliance policy in Microsoft Intune enforces device health and configuration requirements (e.g., requiring encryption or a minimum OS version) and does not detect or respond to role assignment events in Microsoft Entra ID. Option B is wrong because a data classification label in Microsoft Purview is used to tag and protect sensitive data (e.g., credit card numbers or health records) based on content inspection, not to monitor or react to administrative role changes. Option C is wrong because while Microsoft Defender for Cloud Apps can detect anomalous user behavior and enforce session policies, it is not the native SIEM tool for creating custom detection rules with automated playbooks; Sentinel is the correct platform for SIEM-based detection and response orchestration.

Practice this question →

132

MCQmedium

A company uses Microsoft Defender for Cloud Apps to monitor SaaS app usage. The security team wants to receive an alert when a user downloads more than 10 files from SharePoint Online within 5 minutes. Which type of policy should they create?

A.Session policy

B.Anomaly detection policy

C.OAuth app policy

D.File policy

AnswerB

Anomaly detection policies identify unusual user behavior, such as mass downloads, based on learned baselines.

Why this answer

An anomaly detection policy in Microsoft Defender for Cloud Apps is designed to identify unusual user behaviors, such as a spike in file downloads within a short time window. This policy uses machine learning to establish a baseline of normal activity and triggers alerts when deviations like downloading more than 10 files from SharePoint Online in 5 minutes occur, making it the correct choice for this use case.

Exam trap

The trap here is that candidates often confuse anomaly detection policies with session policies, mistakenly thinking that real-time control is required for alerting, when in fact anomaly detection policies are specifically designed for threshold-based behavioral alerts without blocking the action.

How to eliminate wrong answers

Option A is wrong because a session policy controls real-time user actions during a session (e.g., blocking downloads or requiring authentication) but does not trigger alerts based on historical activity thresholds like file count over time. Option C is wrong because an OAuth app policy governs permissions and usage of third-party OAuth applications, not user download behavior from SharePoint Online. Option D is wrong because a file policy focuses on detecting specific file types, content, or metadata (e.g., DLP rules), not on the volume or rate of file downloads by a user.

Practice this question →

133

MCQmedium

Your company uses Microsoft Sentinel to centralize security event monitoring. You need to create a custom analytics rule that triggers an alert when a user account is created outside of business hours. Which rule type should you use?

A.Microsoft Security incident creation rule

B.Anomaly analytics rule

C.Near-real-time (NRT) analytics rule

D.Scheduled query analytics rule

AnswerD

Scheduled query analytics rules are the most versatile and powerful type for implementing custom threat detection logic within Microsoft Sentinel. They enable security analysts to write complex KQL (Kusto Query Language) queries that run at defined intervals against various log tables, allowing for sophisticated correlation, aggregation, and pattern matching to identify specific security events, conditions, or indicators of compromise.

Why this answer

A scheduled query analytics rule is the correct choice because it allows you to define a KQL query that runs on a set schedule (e.g., every 5 minutes) and triggers an alert based on conditions such as user account creation events occurring outside of business hours. This rule type is designed for custom detection scenarios where you need to evaluate log data against specific time-based or threshold-based criteria, making it ideal for monitoring user creation events with a custom schedule.

Exam trap

The trap here is that candidates often confuse near-real-time (NRT) rules with scheduled rules, but NRT rules cannot run custom KQL queries with time-based conditions like 'outside business hours' because they are optimized for low-latency, simple pattern matching rather than scheduled, complex logic.

How to eliminate wrong answers

Option A is wrong because a Microsoft Security incident creation rule is used to automatically create incidents from alerts generated by other Microsoft security products (e.g., Microsoft Defender for Cloud), not to run custom KQL queries against log data. Option B is wrong because an anomaly analytics rule uses machine learning to detect unusual patterns in data over time, not to trigger alerts based on a fixed condition like time of day. Option C is wrong because a near-real-time (NRT) analytics rule processes data with minimal latency (under 5 minutes) but does not support custom scheduling or complex KQL logic for time-based conditions like 'outside business hours'; it is designed for high-frequency, low-latency scenarios.

Practice this question →

134

MCQhard

An organization uses Microsoft Entra ID for identity management. They want to implement a risk-based conditional access policy that requires multi-factor authentication (MFA) when sign-in risk is medium or high. Which policy settings should they configure?

A.Assign 'User risk' condition to 'Medium and above' and grant 'Require MFA'

B.Assign 'Device compliance' condition to 'Compliant' and grant 'Require MFA'

C.Assign 'Location' condition to 'All trusted locations' and grant 'Require MFA'

D.Assign 'Sign-in risk' condition to 'Medium and above' and grant 'Require MFA'

AnswerD

The 'Sign-in risk' condition, powered by Microsoft Entra ID Protection, specifically evaluates the real-time risk associated with an individual sign-in attempt. It utilizes machine learning to detect anomalies such as impossible travel, sign-ins from unfamiliar locations or devices, or atypical sign-in properties. Setting this condition to 'Medium and above' and granting 'Require MFA' directly addresses suspicious sign-in patterns by challenging potentially compromised sessions with an additional verification factor, thereby preventing unauthorized access.

Why this answer

The scenario explicitly requires a risk-based conditional access policy that triggers MFA based on sign-in risk level. In Microsoft Entra ID, the 'Sign-in risk' condition evaluates the likelihood that the authentication attempt is not legitimate, using signals such as anonymous IP addresses, atypical travel, or malware-linked IPs. By setting this condition to 'Medium and above' and granting 'Require MFA', the policy enforces MFA only when the sign-in risk is assessed as medium or high, directly matching the requirement.

Exam trap

The trap here is confusing 'User risk' (which targets compromised user accounts) with 'Sign-in risk' (which targets suspicious authentication attempts), leading candidates to incorrectly select Option A when the question specifically asks about sign-in risk.

How to eliminate wrong answers

Option A is wrong because 'User risk' condition evaluates the risk level of the user account (e.g., leaked credentials, suspicious activity), not the risk of the current sign-in session; this would address compromised accounts rather than risky sign-ins. Option B is wrong because 'Device compliance' condition checks whether the device meets compliance policies (e.g., BitLocker enabled, OS updates), which is unrelated to sign-in risk; this would enforce MFA based on device health, not risk level. Option C is wrong because 'Location' condition with 'All trusted locations' would typically exclude trusted locations from requiring MFA, or apply MFA only from untrusted locations, which does not align with a risk-based approach based on sign-in risk signals.

Practice this question →

135

Multi-Selectmedium

Your organization is deploying Microsoft Purview. You need to automatically apply a sensitivity label to documents that contain passport numbers. Which TWO components must you configure?

Select 2 answers

A.Sensitive information type for passport numbers

B.Retention label

C.Data loss prevention (DLP) policy

D.Auto-labeling policy

E.Trainable classifier

AnswersA, D

A Sensitive Information Type (SIT) for passport numbers is crucial because it defines the specific pattern, keywords, and proximity rules required to accurately identify passport numbers within content. This detection mechanism is a fundamental prerequisite for any automated process that aims to classify and protect documents containing such sensitive personal data. Without a defined SIT, Microsoft Purview would be unable to reliably locate and flag passport numbers for subsequent labeling actions.

Why this answer

A sensitive information type (SIT) for passport numbers defines the pattern and validation logic that Microsoft Purview uses to detect passport numbers in content. An auto-labeling policy then applies the specified sensitivity label automatically when the SIT is matched, enabling automated classification and protection without user intervention.

Exam trap

The trap here is that candidates often confuse a DLP policy with an auto-labeling policy, not realizing that DLP policies enforce protective actions (like blocking) while auto-labeling policies apply sensitivity labels based on content detection.

Practice this question →

136

MCQmedium

An organization runs workloads in Azure, an on-premises data center, and multiple third-party cloud environments. The security team needs a single, cloud-native solution that provides a unified view of the security posture across all these environments, along with a secure score and actionable recommendations. They also want to protect these workloads with advanced threat detection. Which Microsoft security solution should they implement?

A.Microsoft Sentinel

B.Microsoft Defender for Cloud

C.Microsoft 365 Defender

D.Microsoft Defender for Endpoint

AnswerB

Microsoft Defender for Cloud provides cloud security posture management (CSPM) and cloud workload protection (CWP) across hybrid and multi-cloud environments. It delivers a secure score, actionable recommendations, and advanced threat detection for servers, containers, databases, and more.

Why this answer

Microsoft Defender for Cloud is the correct choice because it provides a unified cloud-native security posture management (CSPM) solution that covers Azure, on-premises, and multi-cloud environments (including AWS and GCP). It delivers a secure score based on security controls and actionable recommendations via Azure Policy, and includes advanced threat detection (e.g., fileless attack detection, network anomaly detection) for workloads across these environments.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel (a SIEM) with a CSPM tool, but Sentinel does not provide a secure score or native multi-cloud posture recommendations; Defender for Cloud is the dedicated CSPM and workload protection solution.

Why the other options are wrong

Microsoft Sentinel is a SIEM/SOAR solution focused on log aggregation and incident response, not a unified security posture management tool with secure score and recommendations across hybrid and multi-cloud environments.

Microsoft 365 Defender is designed for securing Microsoft 365 workloads (email, endpoints, identities) and does not provide unified security posture management or secure score across multi-cloud and on-premises environments.

Microsoft Defender for Endpoint focuses on endpoint protection (antivirus, EDR) for devices, not on providing a unified security posture view and secure score across multi-cloud and on-premises environments. The question requires a cloud-native solution for hybrid and multi-cloud security posture management and advanced threat detection, which is Defender for Cloud.

Practice this question →

137

MCQhard

A security team monitors user activities in third-party cloud apps like Box and Dropbox. They want to automatically detect when a user performs an anomalous file download after signing in from an unusual location, and then suspend the user's account and initiate an investigation. Which Microsoft security solution should they use?

A.Microsoft Defender for Office 365

B.Microsoft Defender for Cloud Apps

C.Microsoft Defender for Identity

D.Microsoft Defender for Endpoint

AnswerB

Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing comprehensive visibility, control, and protection for data and user activities across sanctioned and unsanctioned cloud applications. It enables organizations to discover shadow IT, monitor user sessions in real-time, enforce data loss prevention policies, and detect anomalous behavior in third-party cloud services like Box, Dropbox, or Salesforce. This capability directly addresses the need to monitor user activities within external cloud applications.

Why this answer

Microsoft Defender for Cloud Apps (MDCA) is the correct solution because it provides Cloud Access Security Broker (CASB) functionality, including anomaly detection for user activities across third-party cloud apps like Box and Dropbox. It can automatically detect anomalous file downloads after unusual sign-in locations using behavioral analytics and then trigger automated actions such as suspending the user account and initiating an investigation via integration with Microsoft 365 Defender.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud Apps with Microsoft Defender for Identity, thinking both handle user behavior, but MDCA focuses on cloud app usage while MDI focuses on on-premises identity attacks.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Office 365 focuses on protecting email and collaboration tools (Exchange Online, SharePoint, Teams) from threats like phishing and malware, not on monitoring user activities in third-party cloud apps like Box or Dropbox. Option C is wrong because Microsoft Defender for Identity is designed to detect on-premises Active Directory attacks (e.g., Kerberos abuse, lateral movement) using domain controller traffic, not user behavior in SaaS apps. Option D is wrong because Microsoft Defender for Endpoint protects endpoints (Windows, macOS, Linux) from malware and advanced attacks, not user activities in cloud apps.

Practice this question →

138

MCQmedium

A security analyst needs to investigate a phishing campaign that targeted multiple users. They want to correlate email threat data with user actions and device signals. Which Microsoft security solution should they use as the primary investigation console?

A.Microsoft Defender for Endpoint

B.Microsoft Defender for Office 365

C.Microsoft 365 Defender

D.Microsoft Sentinel

AnswerC

Microsoft 365 Defender is the unified XDR (eXtended Detection and Response) solution that integrates signals from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This platform provides a holistic view, correlating alerts and incidents across email, endpoints, identities, and cloud applications. For a phishing campaign, it enables security analysts to trace the entire attack chain, from the initial email delivery and user interaction to potential endpoint compromise or identity theft, offering comprehensive investigation and response capabilities.

Why this answer

Microsoft 365 Defender (now Microsoft Defender XDR) is the correct choice because it provides a unified incident investigation and response experience that correlates signals across email, endpoints, identities, and cloud apps. For a phishing campaign targeting multiple users, the analyst needs to correlate email threat data (from Defender for Office 365) with user actions (from Azure AD/Identity) and device signals (from Defender for Endpoint) — this cross-domain correlation is the primary function of Microsoft 365 Defender's incident queue and advanced hunting.

Exam trap

The trap here is that candidates often choose Microsoft Defender for Office 365 because they focus on the 'phishing campaign' aspect, forgetting that the question specifically requires correlation with user actions and device signals, which only Microsoft 365 Defender provides as a unified console.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Endpoint focuses solely on endpoint (device) signals and cannot correlate email threat data or user actions from cloud apps. Option B is wrong because Microsoft Defender for Office 365 is limited to email and collaboration threats (e.g., phishing, malware in attachments) and does not ingest device signals or cross-domain user actions. Option D is wrong because Microsoft Sentinel is a SIEM/SOAR platform for ingesting logs from multiple sources and requires custom correlation rules, whereas the question asks for a primary investigation console that natively correlates email, user, and device data without additional configuration.

Practice this question →

139

MCQeasy

Your company wants to use Microsoft Purview to classify and protect sensitive data in Microsoft 365. The compliance team needs to automatically detect credit card numbers in emails and apply a label that encrypts the email. What should they configure?

A.A trainable classifier for credit card numbers

B.A retention label for credit card information

C.A data loss prevention (DLP) policy

D.A sensitivity label with auto-labeling for sensitive information types

AnswerD

Sensitivity labels are the correct and most comprehensive mechanism within Microsoft Purview for classifying data and applying a range of protective actions, including encryption, access restrictions, and visual markings. When configured with auto-labeling policies, these labels can automatically detect specific sensitive information types, such as credit card numbers, within content. Upon detection, the associated sensitivity label, along with its defined encryption and other protections, is automatically applied to the content, ensuring both classification and robust security.

Why this answer

Sensitivity labels with auto-labeling can automatically detect sensitive information types (such as credit card numbers) in emails and apply a label that enforces encryption. This meets the requirement to both classify and protect the data in transit.

Exam trap

The trap here is that candidates confuse DLP policies (which detect and block) with sensitivity labels (which classify and protect via encryption), leading them to choose C instead of D.

How to eliminate wrong answers

Option A is wrong because a trainable classifier is used for pattern recognition based on machine learning, not for automatically applying protection actions like encryption. Option B is wrong because retention labels manage data retention and deletion, not classification or encryption of sensitive content. Option C is wrong because a DLP policy can detect and block sensitive data but does not apply sensitivity labels or encryption; it enforces rules like blocking or warning, not labeling.

Practice this question →

140

MCQmedium

A security administrator needs to identify users who are repeatedly failing to authenticate from unusual locations. Which Microsoft 365 security feature provides this visibility?

A.Microsoft Purview Insider Risk Management

B.Microsoft Entra ID Protection

C.Microsoft Defender for Cloud Apps

D.Microsoft Sentinel

AnswerB

Microsoft Entra ID Protection is specifically designed to detect, investigate, and remediate identity-based risks by leveraging machine learning and heuristics. It identifies suspicious activities like impossible travel, sign-ins from infected devices, anonymous IP addresses, or password spray attacks. This service automatically applies conditional access policies to block or challenge risky sign-ins, thereby protecting user accounts from compromise.

Why this answer

Microsoft Entra ID Protection (formerly Azure AD Identity Protection) detects and reports risky sign-in behaviors, including repeated authentication failures from unusual locations. It uses machine learning models to evaluate sign-in risk based on factors like unfamiliar IP addresses, anonymous IP addresses, and atypical travel patterns, providing security administrators with visibility into such anomalies.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud Apps (a CASB) with identity protection, assuming it handles sign-in anomalies, when in fact Entra ID Protection is the dedicated service for analyzing authentication risk signals like repeated failures from unusual locations.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Insider Risk Management focuses on detecting and mitigating internal risks such as data theft or policy violations by authorized users, not on external authentication failures from unusual locations. Option C is wrong because Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility into cloud app usage and data protection, but it does not natively analyze sign-in failures from unusual locations; that is the role of identity protection. Option D is wrong because Microsoft Sentinel is a Security Information and Event Management (SIEM) solution that can ingest and correlate sign-in logs, but it is not a dedicated feature for automatically identifying repeated authentication failures from unusual locations; it requires custom analytics rules to achieve that.

Practice this question →

141

MCQmedium

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default filters. You need to create a custom mail flow rule to block similar emails based on specific keywords in the subject line. Which tool should you use?

A.Microsoft 365 Defender portal

B.Microsoft Defender for Cloud Apps portal

C.Exchange admin center

D.Microsoft Entra admin center

AnswerC

The Exchange admin center (EAC) is the dedicated web-based management console for Exchange Online, providing comprehensive control over mailboxes, recipients, permissions, and mail flow. Within the EAC, administrators can create and manage mail flow rules, also known as transport rules, which are powerful tools for inspecting and acting on messages based on various conditions, including subject keywords. These rules are essential for implementing specific organizational policies for email processing before or after Defender for Office 365's advanced protections.

Why this answer

To create a custom mail flow rule (also known as a transport rule) that blocks emails based on specific keywords in the subject line, you must use the Exchange admin center (EAC). Mail flow rules are processed by the Exchange Online transport pipeline and are configured within the EAC or via Exchange Online PowerShell, not through the Microsoft 365 Defender portal, which focuses on threat policies and incident response rather than transport-level rule creation.

Exam trap

The trap here is that candidates often confuse the Microsoft 365 Defender portal (which handles security policies) with the Exchange admin center (which handles mail flow rules), leading them to incorrectly select option A because they assume all email security configurations are centralized in the Defender portal.

How to eliminate wrong answers

Option A is wrong because the Microsoft 365 Defender portal is used for managing security policies like anti-phishing, anti-spam, and Safe Links/Safe Attachments, but it does not provide the interface to create custom mail flow rules (transport rules) that inspect subject lines. Option B is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) focused on shadow IT discovery, app permissions, and session controls, not on Exchange Online mail flow rule creation. Option D is wrong because the Microsoft Entra admin center manages identity and access management (IAM), including users, groups, and conditional access policies, but has no capability to configure mail flow rules for Exchange Online.

Practice this question →

142

MCQhard

A company runs Azure VMs and on-premises Windows servers. They need a solution that provides vulnerability assessment, regulatory compliance dashboard, and threat detection for their hybrid workloads. Which Microsoft security solution should they use?

A.Microsoft Defender for Cloud

B.Microsoft Sentinel

C.Microsoft Defender for Identity

D.Microsoft Defender for Cloud Apps

AnswerA

Microsoft Defender for Cloud provides comprehensive cloud security posture management (CSPM) and cloud workload protection (CWP) for hybrid environments. It offers integrated vulnerability assessment for Azure VMs and on-premises Windows servers, leveraging Azure Arc for the latter. Furthermore, it includes regulatory compliance dashboards to continuously monitor adherence to industry standards and provides threat detection capabilities across these diverse workloads.

Why this answer

Microsoft Defender for Cloud (formerly Azure Security Center and Azure Defender) provides unified security management across hybrid cloud workloads. It includes vulnerability assessment for VMs, a regulatory compliance dashboard with built-in standards like SOC 2 and PCI DSS, and integrated threat detection using behavioral analytics and machine learning. This makes it the correct choice for the described requirements.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel's SIEM capabilities with Defender for Cloud's workload protection features, but Sentinel requires manual log ingestion and does not provide native vulnerability scanning or compliance dashboards for VMs.

How to eliminate wrong answers

Option B is wrong because Microsoft Sentinel is a cloud-native SIEM and SOAR solution focused on log aggregation, incident response, and advanced threat hunting, not a built-in vulnerability assessment or compliance dashboard for VMs. Option C is wrong because Microsoft Defender for Identity is an on-premises identity security solution that detects threats using Active Directory signals, not a workload vulnerability or compliance tool. Option D is wrong because Microsoft Defender for Cloud Apps is a CASB for shadow IT discovery and app governance, not a solution for VM vulnerability assessment or regulatory compliance dashboards.

Practice this question →

143

MCQhard

Refer to the exhibit. You run an Advanced Hunting query in Microsoft Defender XDR. What is the primary purpose of this query?

A.Find IP addresses with failed logon attempts.

B.List all interactive logons from Office 365 applications.

C.Detect non-interactive logons to Office 365.

D.Identify accounts with high number of interactive logons, potentially indicating brute-force activity.

AnswerD

This option is correct because the query groups logon events by 'UserPrincipalName' and 'IPAddress', then counts the occurrences. By filtering for a high count (e.g., `count_ > 10`), it effectively identifies accounts or source IP addresses exhibiting an unusually large number of interactive sign-ins within the queried timeframe. This pattern is a strong indicator of potential brute-force attacks or credential stuffing attempts, where an attacker repeatedly tries to gain access to an account.

Why this answer

The query uses `AADSignInEventsBeta` to count interactive logon events per account, then filters for accounts with more than 10 such events. A high count of interactive logons from a single account is a classic indicator of brute-force activity, where an attacker repeatedly attempts to guess credentials. This makes D correct because the query's primary purpose is to identify accounts with a suspiciously high number of interactive logons.

Exam trap

The trap here is that candidates may confuse 'interactive logons' with 'failed logon attempts' (Option A) or assume the query targets Office 365 applications specifically (Option B), when in fact the query counts all interactive logons regardless of success or application, and the high count is the key indicator of brute-force activity.

How to eliminate wrong answers

Option A is wrong because the query does not filter for failed logon attempts (e.g., `ErrorCode != 0` or `Status == 'Failure'`); it counts all interactive logons regardless of success or failure. Option B is wrong because the query does not filter by application (e.g., `Application == 'Office 365'`); it counts all interactive logons across any application. Option C is wrong because the query specifically uses `LogonType == 2` (interactive logon) and does not include non-interactive logon types (e.g., LogonType 3 for network logons or LogonType 7 for unlock logons).

Practice this question →

144

MCQeasy

A security team is evaluating Microsoft security solutions to monitor user activities across multiple SaaS applications, including Salesforce and Dropbox, for signs of compromised accounts and data exfiltration. Which solution is specifically designed for this purpose?

A.Microsoft Defender for Cloud Apps

B.Microsoft Defender for Endpoint

C.Microsoft Sentinel

D.Microsoft 365 Defender

AnswerA

Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing comprehensive visibility, control, and threat protection for sanctioned and unsanctioned cloud applications. It directly monitors user activities within SaaS applications like Salesforce or Dropbox, detecting anomalous behavior, preventing data exfiltration, and enforcing compliance policies. This solution is purpose-built to address the unique security challenges posed by cloud application usage, offering real-time controls and deep insights into data movement and user interactions.

Why this answer

Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides deep visibility, data classification, and threat detection across SaaS applications like Salesforce and Dropbox. It uses behavioral analytics and anomaly detection to identify compromised accounts and data exfiltration by monitoring user activities and applying policies such as activity policies and app governance.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel (a SIEM) with a CASB, but Sentinel is a log aggregation and analysis platform, not a dedicated SaaS monitoring solution like Defender for Cloud Apps.

Why the other options are wrong

Microsoft Defender for Endpoint focuses on endpoint devices (e.g., laptops, servers) and does not natively monitor user activities across SaaS applications like Salesforce and Dropbox for compromised accounts and data exfiltration.

Microsoft Sentinel is a SIEM/SOAR solution for aggregating and analyzing security data from multiple sources, but it is not specifically designed to monitor user activities across SaaS applications like Salesforce and Dropbox for compromised accounts and data exfiltration; that is the role of Defender for Cloud Apps.

Microsoft 365 Defender is a unified pre- and post-breach enterprise defense suite that protects across endpoints, identities, email, and applications, but it does not specialize in monitoring user activities across third-party SaaS apps like Salesforce and Dropbox for signs of compromised accounts and data exfiltration. That specific capability is provided by Microsoft Defender for Cloud Apps.

Practice this question →

145

MCQeasy

A company wants to classify and label documents in SharePoint automatically based on sensitive content like social security numbers. Which Microsoft Purview solution should they use?

A.eDiscovery

B.Auto-labeling policy

C.Audit log

D.Data loss prevention policy

AnswerB

An auto-labeling policy is specifically designed to automatically apply sensitivity labels to content across Microsoft 365 services, including SharePoint, based on predefined conditions. These policies leverage sensitive information types, trainable classifiers, or keywords to identify sensitive data and then automatically assign the appropriate sensitivity label, directly fulfilling the requirement to classify and label documents without manual intervention.

Why this answer

Auto-labeling policies in Microsoft Purview can automatically detect sensitive content such as social security numbers in SharePoint documents and apply the appropriate sensitivity label. This enables consistent classification and protection without manual user intervention, directly meeting the company's requirement.

Exam trap

The trap here is confusing Data loss prevention (DLP) policies with auto-labeling policies, as both deal with sensitive data, but DLP focuses on preventing data exfiltration while auto-labeling handles classification and labeling.

How to eliminate wrong answers

Option A is wrong because eDiscovery is used for searching and exporting content for legal or investigative purposes, not for automatically classifying or labeling documents. Option C is wrong because Audit log records user and admin activities for compliance and forensic analysis, but it does not apply labels or classify content. Option D is wrong because Data loss prevention (DLP) policies detect and prevent unauthorized sharing of sensitive data, but they do not automatically classify or label documents; labeling is a separate capability provided by auto-labeling policies.

Practice this question →

146

MCQmedium

A company wants to automatically classify documents containing credit card numbers and apply encryption at rest in SharePoint Online. Which Microsoft Purview feature should be used?

A.Sensitivity labels with auto-classification

B.eDiscovery

C.Microsoft Purview Audit

D.Data Loss Prevention (DLP) policies

AnswerA

Sensitivity labels with auto-classification are the correct solution because they leverage content inspection rules, regular expressions, or trainable classifiers to automatically identify sensitive information within documents. Once identified, these labels can apply persistent protective actions such as encryption, visual markings (headers/footers/watermarks), and access restrictions, ensuring data is classified and secured at rest and in transit. This directly fulfills the requirement to automatically classify and protect documents containing sensitive data.

Why this answer

Sensitivity labels with auto-classification can automatically detect sensitive data types such as credit card numbers using built-in or custom sensitive info types, and then apply a label that enforces encryption at rest in SharePoint Online. This meets the requirement of both automatic classification and encryption enforcement without manual user intervention.

Exam trap

The trap here is that candidates often confuse DLP policies with sensitivity labels, assuming DLP can enforce encryption, but DLP only blocks or alerts on policy violations and does not apply encryption at rest.

How to eliminate wrong answers

Option B is wrong because eDiscovery is used for searching, holding, and exporting content for legal or investigative purposes, not for automatic classification or encryption of documents. Option C is wrong because Microsoft Purview Audit records user and admin activities for compliance and forensic analysis, but it does not classify content or apply encryption. Option D is wrong because Data Loss Prevention (DLP) policies can detect and block sharing of sensitive data but cannot directly apply encryption at rest to documents in SharePoint Online; encryption enforcement requires sensitivity labels.

Practice this question →

147

MCQhard

Refer to the exhibit. The KQL query is used in a Microsoft Sentinel analytics rule. What is the primary purpose of this rule?

A.To identify all files shared externally regardless of sensitivity

B.To automatically block external sharing of sensitive files

C.To detect when a file labeled 'Highly Confidential' is shared externally

D.To list all alerts generated by the rule

AnswerC

The KQL query is designed to identify specific security events by combining multiple filters. It targets events where files are shared externally (implied by the alert name or event type) and explicitly includes a condition to match `SensitivityLabel == 'Highly Confidential'`. This precise combination ensures that the query effectively detects and flags only those instances where highly confidential data is exposed outside the organization.

Why this answer

The KQL query filters for activities where a file labeled 'Highly Confidential' is shared externally, using the `SensitivityLabel` property and the `SharingType` field set to 'ExternalUser'. The rule's primary purpose is to detect such sharing events, not to block them or list all alerts. Option C correctly identifies this detection goal.

Exam trap

The trap here is that candidates confuse detection rules with automated remediation actions, assuming that a rule that detects external sharing of sensitive files also blocks it, whereas Sentinel rules only generate alerts unless explicitly configured with an automated response (e.g., via a playbook).

How to eliminate wrong answers

Option A is wrong because the query specifically filters for files with the 'Highly Confidential' sensitivity label, not all files shared externally. Option B is wrong because the rule is a detection rule that generates alerts; it does not automatically block sharing, which would require a different mechanism like a DLP policy or an automated response action. Option D is wrong because the rule itself generates alerts based on the query; listing all alerts is a separate function (e.g., in the Sentinel incidents blade), not the purpose of the rule.

Practice this question →

148

MCQmedium

A security operations team needs a solution that can detect and stop ransomware attacks on Windows servers and desktops in real time. They also want the ability to automatically isolate affected devices and, if necessary, roll back files modified by ransomware using a built-in recovery feature. Which Microsoft security solution provides these capabilities?

A.Microsoft Defender for Office 365

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Cloud Apps

D.Microsoft Defender for Cloud

AnswerB

Microsoft Defender for Endpoint is a comprehensive endpoint detection and response (EDR) solution that provides advanced threat protection, post-breach detection, automated investigation, and response capabilities for devices. It continuously monitors endpoint behavior, identifies malicious activities, and offers powerful remediation actions such as isolating compromised devices from the network and rolling back malicious file changes. These features are essential for containing and recovering from sophisticated endpoint attacks like ransomware.

Why this answer

Microsoft Defender for Endpoint (MDE) provides real-time detection and automated response to ransomware attacks on Windows servers and desktops. Its built-in attack surface reduction rules, endpoint detection and response (EDR), and automated investigation and remediation capabilities allow automatic device isolation. Additionally, MDE includes a file recovery feature that leverages Volume Shadow Copy to roll back files modified by ransomware, meeting all stated requirements.

Exam trap

The trap here is that candidates may confuse Microsoft Defender for Cloud (a cloud workload protection tool) with Microsoft Defender for Endpoint (an endpoint detection and response tool), failing to recognize that only MDE provides the specific combination of real-time endpoint protection, automated device isolation, and built-in file rollback for Windows servers and desktops.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Office 365 focuses on protecting email, SharePoint, and Teams from phishing, malware, and spam, not on endpoint-level ransomware detection or device isolation. Option C is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that provides visibility and control over cloud app usage, not real-time endpoint ransomware protection or file rollback. Option D is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and workload protection platform for cloud infrastructure (IaaS/PaaS), not designed for on-premises Windows servers and desktops or built-in file recovery.

Practice this question →

149

MCQmedium

A company wants to gain visibility into the cloud applications that employees are using (e.g., unsanctioned SaaS apps), assess the risk level of each app based on multiple factors, and block access to high-risk applications. Which Microsoft security solution should they deploy?

A.Microsoft Defender for Endpoint

B.Microsoft Defender for Office 365

C.Microsoft Defender for Cloud Apps

D.Microsoft Sentinel

AnswerC

Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing comprehensive visibility and control over cloud applications used across an organization. It automatically discovers all cloud apps, both sanctioned and unsanctioned (shadow IT), assesses their risk based on over 25,000 applications in its catalog, and enables granular policy enforcement for access, data protection, and threat prevention within these applications. This capability directly addresses the need to gain visibility into what cloud applications employees are utilizing.

Why this answer

Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility into cloud application usage, assesses risk based on factors like compliance, app store ratings, and security controls, and can block access to high-risk apps via reverse proxy or API integration. This directly matches the requirement to discover unsanctioned SaaS apps and enforce access controls.

Exam trap

The trap here is confusing a CASB (Defender for Cloud Apps) with an EDR (Defender for Endpoint) or SIEM (Sentinel), as candidates often think 'visibility into apps' means endpoint monitoring or log analysis rather than cloud-specific app discovery and risk assessment.

Why the other options are wrong

Microsoft Defender for Endpoint focuses on endpoint devices (e.g., desktops, servers) to prevent, detect, and respond to threats, not on discovering and controlling cloud application usage. It does not provide visibility into unsanctioned SaaS apps or allow blocking access based on app risk.

Microsoft Defender for Office 365 focuses on securing email and collaboration tools (Exchange, SharePoint, Teams), not on discovering and controlling unsanctioned cloud app usage across the organization.

Microsoft Sentinel is a SIEM/SOAR solution for security analytics and threat intelligence across the enterprise, not specifically designed to discover, assess, and block unsanctioned cloud applications. The question focuses on cloud app visibility and control, which is the domain of Defender for Cloud Apps.

Practice this question →

150

MCQeasy

Your organization uses Microsoft Purview Communication Compliance to detect potential harassment in Microsoft Teams messages. Which role is required to review and act on policy matches?

A.Communication Compliance admin

B.Communication Compliance analyst

C.Communication Compliance investigator

D.Compliance administrator

AnswerB

The Communication Compliance analyst is the frontline role specifically designated for the daily review and investigation of policy matches and alerts generated by Microsoft Purview. They are responsible for assessing potential policy violations, collaborating with subject matter experts, and taking appropriate actions such as escalating, resolving, or marking items as benign. This role is central to the operational enforcement of communication compliance policies.

Why this answer

The Communication Compliance analyst role is specifically designed to review policy matches, investigate message details, and take remediation actions such as escalating or resolving alerts in Microsoft Purview Communication Compliance. This role has the necessary permissions to view and act on detected violations without the broader administrative privileges of a Compliance administrator.

Exam trap

The trap here is that candidates often confuse the 'Communication Compliance analyst' role with the 'Communication Compliance admin' role, assuming the admin role includes review capabilities, but Microsoft deliberately separates configuration from review to enforce least-privilege access.

How to eliminate wrong answers

Option A is wrong because the Communication Compliance admin role is responsible for configuring policies and global settings, not for reviewing or acting on individual policy matches. Option C is wrong because there is no built-in role named 'Communication Compliance investigator' in Microsoft Purview; this is a distractor that does not exist. Option D is wrong because the Compliance administrator role has broad compliance management permissions but lacks the specific granular permissions required to review and act on Communication Compliance policy matches.

Practice this question →