CCNA Ms Security Capabilities Questions — Page 3 of 6

151

MCQhard

A company runs a mix of on-premises servers and Azure virtual machines. They deploy Microsoft Defender for Endpoint on all servers. The security team wants to create custom queries to hunt for a specific attack pattern that involves a sequence of events across multiple machines, such as a PowerShell script being downloaded and then executed on several servers. They need to write their own detection rules based on advanced hunting data. Which Microsoft 365 Defender capability should they use?

A.Advanced hunting in Microsoft 365 Defender

B.Microsoft Defender for Cloud

C.Microsoft Defender for Office 365

D.Microsoft Sentinel

AnswerA

Advanced hunting is a powerful, proactive threat hunting tool integrated directly within the Microsoft 365 Defender portal. It allows security analysts to leverage Kusto Query Language (KQL) to explore raw event data from various Microsoft 365 security products, including Defender for Endpoint, Defender for Office 365, Defender for Identity, and Microsoft Defender for Cloud Apps. This capability enables the creation of sophisticated custom detection rules and the identification of unique threats across endpoints, email, identities, and cloud applications from a single interface.

Why this answer

Advanced hunting in Microsoft 365 Defender provides a Kusto Query Language (KQL)-based query interface that allows security teams to create custom detection rules by searching raw data across endpoints, email, and identities. This capability directly supports the scenario of writing custom queries to hunt for multi-machine attack patterns, such as a PowerShell script download followed by execution, by correlating events like DeviceProcessEvents and DeviceFileEvents across multiple devices.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel's advanced hunting (which is also KQL-based but is a separate Azure service) with the advanced hunting capability native to Microsoft 365 Defender, leading them to select Sentinel even though the question explicitly asks for a Microsoft 365 Defender capability.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that focuses on securing Azure, on-premises, and multi-cloud resources through recommendations and vulnerability assessments, not on providing a custom KQL-based hunting interface for endpoint-specific event sequences. Option C is wrong because Microsoft Defender for Office 365 is designed to protect against threats in email, SharePoint, OneDrive, and Teams, and does not include advanced hunting capabilities for endpoint processes or file events across servers. Option D is wrong because Microsoft Sentinel is a cloud-native SIEM/SOAR solution that ingests data from multiple sources and offers advanced hunting, but the question specifically asks for a Microsoft 365 Defender capability; Sentinel is a separate Azure service, not a component of Microsoft 365 Defender.

Practice this question →

152

MCQhard

Your company has Microsoft Defender for Office 365 and wants to configure anti-phishing policies to protect against spear-phishing attacks targeting executives. Which policy setting should you enable to provide the highest level of protection?

A.Malware filter

B.Impersonation protection for users

C.Bulk email filtering

D.Spoof intelligence

AnswerB

Impersonation protection in Microsoft Defender for Office 365 is specifically designed to identify and block emails where the sender's display name or email address closely resembles a protected user or domain within the organization. This feature actively analyzes the sender's identity to detect sophisticated phishing attacks where attackers attempt to trick recipients into believing the email originates from a trusted internal source, thereby directly addressing user-targeted phishing and business email compromise (BEC) scenarios.

Why this answer

Impersonation protection for users is the correct setting because it specifically defends against spear-phishing attacks that impersonate high-value targets like executives. Microsoft Defender for Office 365 uses machine learning and sender intelligence to detect and block emails that spoof the display name or email address of protected users, providing the highest level of protection against targeted impersonation attacks.

Exam trap

The trap here is that candidates often confuse spoof intelligence (which checks domain authentication) with impersonation protection (which checks user identity), leading them to select Spoof intelligence despite it not addressing display name or user-level impersonation attacks.

How to eliminate wrong answers

Option A is wrong because the Malware filter is designed to detect and block malicious attachments and links, not to identify impersonation or social engineering tactics used in spear-phishing. Option C is wrong because Bulk email filtering manages high-volume commercial email (e.g., newsletters) based on bulk complaint levels, not targeted impersonation of specific individuals. Option D is wrong because Spoof intelligence analyzes email authentication (SPF, DKIM, DMARC) to detect domain spoofing, but it does not protect against display name or user impersonation attacks that bypass these checks.

Practice this question →

153

MCQeasy

You work at a mid-sized company that uses Microsoft Defender for Business (a subscription included with Microsoft 365 Business Premium). The company has 300 devices enrolled in Microsoft Intune. Recently, a malware outbreak occurred on several devices. You need to implement a solution that automatically remediates devices that are found to be infected with malware. The solution should isolate the device from the network and run a full scan. Which action should you take?

A.Create a Conditional Access policy to block access for devices with malware.

B.Create an Intune compliance policy to mark devices as non-compliant if malware is detected.

C.Enable automatic investigation and remediation in Microsoft Defender for Business.

D.Configure Microsoft Defender Antivirus to run a weekly scan.

AnswerC

Microsoft Defender for Business includes automated investigation and remediation capabilities that can automatically isolate infected devices and run full scans when malware is detected.

Why this answer

Correct: C. Microsoft Defender for Business includes automated investigation and remediation capabilities that can automatically isolate infected devices and run full scans. Option A: Conditional Access policies control access based on conditions but do not perform remediation actions like isolation or scanning.

Option B: Intune compliance policies can mark devices as non-compliant but do not automatically remediate malware. Option D: Configuring Microsoft Defender Antivirus to run a weekly scan is a scheduled task, not an automatic response to detected malware.

Practice this question →

154

MCQeasy

A security operations team uses Microsoft Sentinel to centralize security log analysis. They need to ingest logs from a third-party firewall that does not have a native connector. What should the team use to bring the firewall logs into Microsoft Sentinel?

A.Data connectors

B.Playbooks

C.Workbooks

D.Analytics rules

AnswerA

Microsoft Sentinel's primary function as a Security Information and Event Management (SIEM) solution relies on ingesting security data from diverse sources. Data connectors are the specific mechanisms that facilitate this ingestion, establishing a secure link between various data sources (like Azure Activity Logs, Microsoft 365 Defender, firewalls, or custom applications) and the Log Analytics workspace underpinning Sentinel. They normalize and stream logs, making them available for analysis, threat detection, and investigation within the platform. For sources without direct API integration, generic connectors like Syslog or Common Event Format (CEF) are utilized to centralize data.

Why this answer

Microsoft Sentinel uses data connectors to ingest logs from various sources, including third-party devices that lack native connectors. For a firewall without a built-in connector, the team can use the Common Event Format (CEF) connector or Syslog connector, which are both categorized as data connectors. These connectors allow the firewall to forward logs via Syslog or CEF over UDP/TCP, which Sentinel then parses and ingests into the Log Analytics workspace.

Exam trap

The trap here is that candidates confuse data connectors (which handle ingestion) with playbooks or workbooks (which handle response or visualization), leading them to select a post-ingestion tool instead of the correct ingestion method.

Why the other options are wrong

Playbooks are automated response workflows triggered by alerts, not used for ingesting logs from external sources into Microsoft Sentinel.

Workbooks are used for visualizing and reporting on data already ingested into Microsoft Sentinel, not for ingesting logs from external sources like a third-party firewall.

Analytics rules are used to detect threats and generate incidents based on ingested data, not to ingest logs from external sources. They operate on data already in Sentinel, so they cannot bring in firewall logs.

Practice this question →

155

MCQhard

A security operations center (SOC) team uses Microsoft Sentinel with User and Entity Behavior Analytics (UEBA) enabled. They notice an alert about a user accessing a sensitive HR application from an unusual IP address at 3 AM. What does UEBA primarily use to detect this anomaly?

A.Static rule-based thresholds defined by the SOC

B.Manual input from the SOC team

C.Historical behavior baselines and machine learning

D.Threat intelligence feeds from Microsoft

AnswerC

User and Entity Behavior Analytics (UEBA) relies critically on establishing comprehensive historical behavior baselines for users and entities within an environment. Machine learning algorithms continuously process vast datasets of activity, learning what constitutes "normal" behavior over time for each individual or system. By comparing current activities against these dynamically learned baselines, UEBA can effectively identify deviations and anomalous patterns that indicate potential security threats, such as insider threats or compromised accounts, without requiring explicit rules.

Why this answer

UEBA in Microsoft Sentinel detects anomalies by establishing a baseline of normal user behavior over time—such as typical login times, locations, and accessed applications—using machine learning models. When a user accesses a sensitive HR app from an unusual IP at 3 AM, the deviation from this learned baseline triggers an alert, not a static rule or manual input.

Exam trap

The trap here is that candidates confuse UEBA's ML-driven behavioral baselines with static rule-based detection or external threat intelligence, assuming any unusual IP must come from a threat feed rather than recognizing the anomaly is based on the user's own historical patterns.

How to eliminate wrong answers

Option A is wrong because static rule-based thresholds require manual configuration and cannot adapt to individual user behavior patterns; UEBA relies on dynamic, ML-driven baselines. Option B is wrong because manual input from the SOC team is not the primary detection mechanism—UEBA automates anomaly detection without requiring human-defined rules or inputs. Option D is wrong because threat intelligence feeds identify known malicious indicators (e.g., IPs from botnets), but the anomaly here is based on behavioral deviation from a user's own history, not on external threat data.

Practice this question →

156

MCQmedium

Your organization uses Microsoft Defender for Office 365. Users report receiving phishing emails that bypassed the default anti-phishing policy. What should you do to improve protection?

A.Create a custom anti-phishing policy.

B.Enable Safe Attachments.

C.Configure anti-malware policy.

D.Increase the spam confidence level (SCL) threshold.

AnswerA

Custom policies can include impersonation protection and advanced settings.

Why this answer

The default anti-phishing policy in Microsoft Defender for Office 365 provides baseline protection, but it cannot be customized. To address specific threats like phishing emails that bypass default settings, you must create a custom anti-phishing policy. This allows you to fine-tune spoof intelligence, impersonation protection, and mailbox intelligence thresholds to catch sophisticated phishing attempts that evade the default policy.

Exam trap

The trap here is that candidates often confuse anti-phishing policies with anti-spam or anti-malware policies, mistakenly thinking that increasing the SCL threshold or enabling Safe Attachments will address phishing, when in fact phishing protection requires dedicated impersonation and spoofing controls only available in a custom anti-phishing policy.

How to eliminate wrong answers

Option B is wrong because Safe Attachments is a separate feature designed to detect and block malicious attachments in email and SharePoint, not to improve anti-phishing protection against phishing URLs or impersonation attacks. Option C is wrong because anti-malware policies focus on detecting malware (e.g., viruses, ransomware) in email attachments and messages, not on phishing-specific threats like spoofed senders or deceptive links. Option D is wrong because increasing the spam confidence level (SCL) threshold would actually reduce the sensitivity of spam filtering, allowing more spam and phishing messages to reach users, which is the opposite of improving protection.

Practice this question →

157

MCQhard

Your company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive information. You need to create a policy that prevents users from sharing credit card numbers via email, but allows them to share internally with other employees. The policy should also notify the user when an attempt is made to share externally. What should you configure?

A.Create a DLP policy with the condition 'Content contains credit card number' and action 'Block access to content' for all recipients.

B.Create a DLP policy with the condition 'Content contains credit card number' and action 'Block external sharing' but allow internal sharing, and enable user notifications.

C.Create a DLP policy with the condition 'Content contains credit card number' and action 'Allow override' with a business justification.

D.Create a DLP policy with the condition 'Content contains credit card number' and action 'Notify user with policy tip' but no blocking.

AnswerB

This option is correct as it precisely addresses the common requirement to protect sensitive data from leaving the organization while enabling necessary internal collaboration. The 'Block external sharing' action directly prevents data exfiltration to unauthorized external parties, while explicitly allowing internal sharing supports legitimate business operations. Furthermore, enabling user notifications with policy tips is a best practice for educating users about compliance policies and fostering a security-aware culture.

Why this answer

Microsoft Purview DLP allows you to configure a policy that blocks external sharing of sensitive data (credit card numbers) while permitting internal sharing, and user notifications can be enabled to alert users when they attempt to share externally. This meets the requirement to prevent external sharing, allow internal sharing, and notify the user.

Exam trap

The trap here is that candidates often confuse 'Block access to content' with 'Block external sharing', not realizing that the former blocks all sharing (internal and external) while the latter specifically targets external recipients, allowing internal sharing as required.

How to eliminate wrong answers

Option A is wrong because blocking access to content for all recipients would prevent both internal and external sharing, which does not meet the requirement to allow internal sharing. Option C is wrong because allowing override with a business justification would permit users to bypass the block, potentially allowing external sharing without proper control, and does not inherently block external sharing by default. Option D is wrong because notifying the user with a policy tip but no blocking would not prevent external sharing, only warn the user, which fails the requirement to block external sharing.

Practice this question →

158

MCQeasy

An organization wants to ensure that only managed and compliant devices can access corporate email in Exchange Online. Which Microsoft Entra ID Conditional Access policy setting should they use?

A.Require device to be marked as compliant

B.Require approved client app

C.Require hybrid Azure AD joined device

D.Require multi-factor authentication

AnswerA

This Conditional Access control directly addresses the requirement by ensuring that only devices evaluated and reported as 'compliant' by Microsoft Intune (or a third-party MDM integrated with Azure AD) are granted access. Device compliance policies define security baselines, such as minimum OS versions, encryption status, or antivirus presence. By enforcing this control, the organization guarantees that devices accessing resources adhere to established security standards and are actively managed.

Why this answer

To ensure only managed and compliant devices access corporate email in Exchange Online, the 'Require device to be marked as compliant' setting in a Conditional Access policy evaluates the device's compliance status reported by Microsoft Intune. This ensures that devices meet security policies (e.g., encryption, patch levels) before granting access, directly addressing the requirement for managed and compliant access.

Exam trap

The trap here is that candidates often confuse 'hybrid Azure AD joined' (a device identity state) with 'compliant' (a device health state), leading them to choose Option C, but only compliance ensures the device meets security policies, not just domain join.

How to eliminate wrong answers

Option B is wrong because 'Require approved client app' controls which client applications (e.g., Outlook mobile) can access Exchange Online, but it does not enforce device management or compliance; a non-compliant device could still use an approved app. Option C is wrong because 'Require hybrid Azure AD joined device' mandates that the device is joined to both on-premises AD and Azure AD, which is a domain-join state, not a compliance check; a hybrid joined device could be non-compliant with Intune policies. Option D is wrong because 'Require multi-factor authentication' adds an authentication layer but does not verify device management or compliance; a compromised but MFA-enabled device could still access email.

Practice this question →

159

MCQmedium

A company uses Microsoft 365 and many third-party SaaS apps like Salesforce and Box. The security team wants to detect when a user downloads a large number of files from a cloud storage app after hours, which may indicate data exfiltration. Which Microsoft security solution should be used to detect such anomalous behavior in cloud apps?

A.Microsoft Defender for Office 365

B.Microsoft Defender for Identity

C.Microsoft Defender for Cloud Apps

D.Microsoft Defender for Cloud

AnswerC

Microsoft Defender for Cloud Apps functions as a comprehensive Cloud Access Security Broker (CASB), providing deep visibility, robust control, and advanced threat protection for data across an organization's entire cloud application landscape, including both Microsoft and numerous third-party SaaS applications. It excels at discovering shadow IT, enforcing granular data loss prevention policies, and detecting anomalous user behavior or threats within these diverse cloud environments. Its capabilities are specifically tailored to monitor and secure interactions with external SaaS applications, making it the correct choice for this scenario.

Why this answer

Microsoft Defender for Cloud Apps (MDCA) is the correct solution because it provides Cloud Access Security Broker (CASB) functionality, including anomaly detection policies that can identify unusual user behavior such as downloading a large number of files from a cloud storage app after hours. MDCA uses machine learning to establish a baseline of normal user activity and then triggers alerts when deviations like high-volume downloads occur, which is a classic indicator of data exfiltration.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud Apps with Microsoft Defender for Cloud, mistakenly thinking the latter covers SaaS app security, when in fact Defender for Cloud is focused on infrastructure workload protection (CSPM/CWPP) and not user behavior in cloud apps.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Office 365 focuses on protecting email and collaboration tools (Exchange Online, SharePoint, Teams) from threats like phishing and malware, not on detecting anomalous behavior across third-party SaaS apps like Salesforce or Box. Option B is wrong because Microsoft Defender for Identity monitors on-premises Active Directory and hybrid identities for attacks like pass-the-hash or Kerberos abuse, not user activity in cloud apps. Option D is wrong because Microsoft Defender for Cloud is designed for securing cloud workloads (VMs, containers, databases) in Azure and multi-cloud environments, not for detecting user-driven data exfiltration in SaaS applications.

Practice this question →

160

MCQhard

A company uses Microsoft 365 and many third-party SaaS apps like Salesforce and Box. The security team needs to discover which unsanctioned cloud apps employees are using (Shadow IT). They also want to get a risk score for each app and receive alerts when a high-risk app is used. Which Microsoft security solution should they use?

A.Microsoft Defender for Endpoint

B.Microsoft Defender for Identity

C.Microsoft Defender for Cloud Apps

D.Microsoft Purview Compliance Manager

AnswerC

Defender for Cloud Apps includes Cloud Discovery, which identifies used apps, assigns risk scores, and alerts on high-risk app usage.

Why this answer

Microsoft Defender for Cloud Apps (MDCA) is the correct solution because it is specifically designed for Cloud Access Security Broker (CASB) functions, including Shadow IT discovery, risk scoring of cloud apps, and policy-based alerts. It integrates with Microsoft 365 and third-party SaaS apps via API connectors and log collectors to identify unsanctioned app usage and assign a risk score based on factors like compliance, security controls, and industry standards.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud Apps with other Defender products (Endpoint or Identity) because they all share the 'Defender' branding, but only Cloud Apps provides CASB capabilities for Shadow IT discovery and app risk scoring.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for devices, not on discovering unsanctioned cloud app usage or providing app-specific risk scores. Option B is wrong because Microsoft Defender for Identity monitors on-premises Active Directory and hybrid identities for attacks like pass-the-hash, not cloud app discovery or Shadow IT. Option D is wrong because Microsoft Purview Compliance Manager is a compliance management tool for assessing regulatory posture and managing controls, not for discovering unsanctioned cloud apps or generating risk scores for third-party SaaS applications.

Practice this question →

161

MCQeasy

A security administrator needs to identify and remediate misconfigurations in Azure resources that could lead to security breaches. They want a central dashboard that provides a secure score based on security controls and recommendations. Which Microsoft solution should they use?

A.Microsoft Defender for Cloud

B.Microsoft Sentinel

C.Microsoft 365 Defender

D.Microsoft Intune

AnswerA

Defender for Cloud provides a secure score and actionable recommendations to improve the security posture of cloud and hybrid resources.

Why this answer

Microsoft Defender for Cloud provides a centralized dashboard that continuously assesses Azure resources against security best practices, delivering a secure score based on implemented security controls and actionable recommendations. This directly matches the administrator's need to identify and remediate misconfigurations that could lead to breaches.

Exam trap

The trap here is confusing Microsoft Defender for Cloud's posture management and secure score with Microsoft Sentinel's threat detection capabilities, as both appear under the 'Microsoft security solutions' umbrella but serve fundamentally different purposes.

Why the other options are wrong

Microsoft Sentinel is a SIEM/SOAR solution for threat detection and response, not a tool for identifying and remediating misconfigurations in Azure resources or providing a secure score based on security controls.

Microsoft 365 Defender is designed for securing Microsoft 365 environments (e.g., email, endpoints, identities), not for assessing and remediating misconfigurations in Azure resources or providing a secure score for Azure security controls.

Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) service, not a tool for assessing Azure resource misconfigurations or providing a secure score. It focuses on managing devices and apps, not on cloud security posture.

Practice this question →

162

MCQhard

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to prevent users from copying credit card numbers from an internal web application to a personal cloud storage app. Which DLP policy setting should they configure?

A.Browser DLP

B.Exchange DLP

C.Teams DLP

D.Endpoint DLP with clipboard control

AnswerD

Endpoint DLP can restrict clipboard operations on Windows devices.

Why this answer

Endpoint DLP with clipboard control is the correct setting because it monitors and restricts data movement at the device level, specifically preventing users from copying sensitive content (like credit card numbers) from a web application and pasting it into an unauthorized personal cloud storage app. This policy enforces restrictions on clipboard operations between different applications on the endpoint, directly addressing the cross-application data exfiltration scenario described.

Exam trap

The trap here is that candidates often confuse Browser DLP (which only controls data within the browser) with the broader endpoint-level clipboard control needed to prevent cross-application data transfer, leading them to select Option A instead of D.

How to eliminate wrong answers

Option A is wrong because Browser DLP protects data only within the browser context (e.g., preventing pasting into web forms or uploading to websites), but it does not control clipboard operations between a browser and a separate desktop application like a personal cloud storage app. Option B is wrong because Exchange DLP applies to email messages and attachments in Exchange Online, not to clipboard-based copying from a web application to a cloud storage app. Option C is wrong because Teams DLP protects data within Microsoft Teams chats and channels, not across applications on an endpoint.

Practice this question →

163

MCQmedium

An organization uses Microsoft Intune to manage devices. They need to ensure that only devices with a minimum OS version can access corporate email. What should they configure?

A.App protection policy

B.Device enrollment restriction

C.Compliance policy and conditional access

D.Device configuration profile

AnswerC

Intune compliance policies define the specific security and health requirements that a device must meet to be considered compliant, such as requiring a minimum OS version, disk encryption, or antivirus software. Conditional Access policies then integrate with Azure AD to evaluate this compliance status in real-time. This powerful combination ensures that only devices meeting the defined compliance standards are granted access to sensitive organizational applications and data, providing robust, continuous enforcement.

Why this answer

Combining a compliance policy (which checks the device OS version against a minimum requirement) with a Conditional Access policy (which blocks access if the device is non-compliant) is the standard Microsoft approach to enforce OS version requirements for accessing corporate email. The compliance policy marks devices below the minimum OS version as non-compliant, and the Conditional Access policy then denies access to Exchange Online or other corporate resources for those non-compliant devices.

Exam trap

The trap here is that candidates confuse Device enrollment restrictions (which set OS version limits at enrollment time) with Compliance policies (which enforce OS version requirements continuously after enrollment), leading them to pick Option B instead of C.

How to eliminate wrong answers

Option A is wrong because App protection policies (MAM) manage how data is handled within apps (e.g., preventing copy/paste or requiring PIN) and do not enforce device-level OS version requirements; they apply to apps regardless of device management. Option B is wrong because Device enrollment restrictions control which devices can enroll in Intune (e.g., by platform or OS version during enrollment) but do not enforce ongoing OS version compliance for already enrolled devices accessing email. Option D is wrong because Device configuration profiles configure device settings (e.g., Wi-Fi, VPN, certificates) but do not enforce compliance checks or block access based on OS version; they are not used for conditional access decisions.

Practice this question →

164

MCQmedium

Your organization is using Microsoft Sentinel as a SIEM. You want to automatically respond to a high-severity incident by opening a ticket in ServiceNow and notifying the security team via email. What should you create?

A.An automation rule

B.A workbook

C.An analytics rule

D.A watchlist

AnswerA

Automation rules are the core mechanism within Microsoft Sentinel for orchestrating and automating incident response workflows. They are designed to automatically apply actions to incidents upon creation or update, based on specified conditions like severity, tactics, or associated entities. These rules can trigger playbooks, which are logic apps that perform complex tasks such as integrating with external systems like ServiceNow for ticketing, sending email notifications to security teams, or isolating compromised hosts. This capability makes automation rules essential for efficient SOAR operations.

Why this answer

Automation rules in Microsoft Sentinel can be configured to trigger automated responses when an incident is created, such as running a playbook (a Logic App) that opens a ticket in ServiceNow and sends an email notification. Option B is wrong because workbooks are for visualization and reporting, not automation. Option C is wrong because analytics rules generate alerts/incidents based on data queries, but they do not directly perform response actions; instead, automation rules handle the response.

Option D is wrong because watchlists are collections of data for correlation and enrichment, not for automated response.

Practice this question →

165

MCQmedium

Your organization uses Microsoft Entra ID for identity management. You need to implement a solution that allows users to sign in using their social media accounts, such as Google or Facebook. What should you configure?

A.Microsoft Authenticator app for passwordless sign-in

B.Privileged Identity Management

C.External identities (B2B) with social identity providers

D.Self-service password reset

AnswerC

Microsoft Entra External ID, specifically its B2B collaboration capabilities, is the correct solution for enabling external users to access an organization's resources using their existing social identity provider accounts. This feature allows organizations to invite guests who can then sign in using their Google, Facebook, or other configured social accounts, federating these external identities with the inviting Microsoft Entra tenant. It streamlines access for partners and customers without requiring them to create new credentials.

Why this answer

External identities (B2B) in Microsoft Entra ID allow you to configure social identity providers (e.g., Google, Facebook) as federation sources. This enables users to sign in with their existing social accounts by leveraging OAuth 2.0 and OpenID Connect protocols, without needing to create a separate Microsoft account.

Exam trap

The trap here is that candidates confuse 'External identities (B2B) with social identity providers' with 'B2C' or think that passwordless methods like Authenticator can be used to bring in external social users, when in fact Authenticator only works for users already in the Entra ID tenant.

How to eliminate wrong answers

Option A is wrong because the Microsoft Authenticator app for passwordless sign-in is a method for authenticating existing Entra ID users via phone-based approval or biometrics, not for federating external social identity providers. Option B is wrong because Privileged Identity Management (PIM) is a tool for managing, controlling, and monitoring access to privileged roles within Entra ID, not for configuring external identity providers. Option D is wrong because self-service password reset (SSPR) allows users to reset their own passwords for their Entra ID accounts, but it does not enable sign-in using external social identities.

Practice this question →

166

MCQhard

Your company uses Microsoft Purview to manage data across Azure, on-premises SQL Server, and Amazon S3. You need to create a unified map of all data sources and their sensitivity labels. Which Microsoft Purview feature should you use?

A.Microsoft Purview Data Sharing

B.Microsoft Purview Data Map

C.Microsoft Purview Data Estate Insights

D.Microsoft Purview Data Catalog

AnswerB

The Microsoft Purview Data Map is the foundational component that automatically discovers, scans, and classifies data across hybrid environments, including Azure, on-premises, and multi-cloud sources. It creates a unified, graph-based metadata store of an organization's entire data estate, enabling comprehensive understanding and governance. This core capability is essential for building a holistic view of data assets and their relationships, which is fundamental to managing data across Azure.

Why this answer

Microsoft Purview Data Map is the correct feature because it provides a unified, automated map of data assets across hybrid and multi-cloud environments (Azure, on-premises SQL Server, and Amazon S3). It automatically scans and classifies data sources, applies sensitivity labels, and maintains a centralized metadata repository, enabling a holistic view of the data landscape and its sensitivity.

Exam trap

The trap here is that candidates often confuse the Microsoft Purview Data Catalog (which is the searchable inventory) with the Data Map (which is the underlying metadata and classification engine), leading them to select Option D instead of B.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Data Sharing is a feature for securely sharing data in-place across organizations or within an organization, not for creating a unified map of data sources and sensitivity labels. Option C is wrong because Microsoft Purview Data Estate Insights provides monitoring, analytics, and reporting on data estate health and usage, but it does not create the foundational map of data sources and labels; it relies on the Data Map. Option D is wrong because Microsoft Purview Data Catalog is a component that builds on the Data Map to enable data discovery and search, but the core mapping and labeling of data sources is performed by the Data Map itself.

Practice this question →

167

MCQeasy

Your organization wants to use Microsoft Defender for Cloud Apps to detect anomalous user behavior across cloud applications. Which feature should you enable?

A.Anomaly detection policies

B.App connectors

C.Secure Score

D.Cloud Discovery

AnswerA

Anomaly detection policies use UEBA to detect unusual user behavior.

Why this answer

Anomaly detection policies in Microsoft Defender for Cloud Apps use machine learning and behavioral analytics to establish a baseline of normal user activity and then trigger alerts for deviations, such as impossible travel, unusual data exfiltration, or risky sign-in patterns. This directly addresses the requirement to detect anomalous user behavior across cloud applications.

Exam trap

The trap here is that candidates often confuse 'Cloud Discovery' (which identifies shadow IT) with 'anomaly detection' (which focuses on user behavior), or they mistakenly think 'App connectors' are needed for behavioral monitoring, when in fact connectors enable data ingestion but not the behavioral analysis itself.

How to eliminate wrong answers

Option B is wrong because App connectors are used to connect Defender for Cloud Apps to specific cloud applications via APIs for visibility and control, not to detect anomalous user behavior. Option C is wrong because Secure Score is a security posture measurement tool that assesses configurations and recommends improvements, not a real-time behavioral detection feature. Option D is wrong because Cloud Discovery analyzes traffic logs to identify shadow IT and cloud app usage, but it does not focus on anomalous user behavior detection.

Practice this question →

168

MCQmedium

A security team wants to discover all cloud applications being used by employees, including unsanctioned file sharing and collaboration apps. They plan to analyze traffic logs from their network firewall to identify usage patterns and assess each app's risk level. Which feature of Microsoft Defender for Cloud Apps should they enable?

A.Cloud Discovery

B.App Connectors

C.Conditional Access App Control

D.Information Protection

AnswerA

Microsoft Defender for Cloud Apps' Cloud Discovery feature is specifically engineered to provide comprehensive visibility into all cloud applications accessed by users within an organization. It accomplishes this by ingesting and analyzing traffic logs from firewalls and proxy servers, extracting details about accessed URLs and IP addresses. This process enables the identification of both sanctioned and unsanctioned (shadow IT) cloud services, building a complete catalog of an organization's cloud app landscape and assessing associated risks.

Why this answer

Cloud Discovery is the correct feature because it analyzes traffic logs from network firewalls and proxies to identify all cloud applications in use, including unsanctioned ones. It uses the Microsoft Defender for Cloud Apps catalog to assess each app's risk level based on factors like security posture, compliance certifications, and industry standards. This directly matches the scenario of discovering unsanctioned file sharing and collaboration apps from firewall logs.

Exam trap

The trap here is that candidates confuse Cloud Discovery (passive log analysis for unsanctioned app discovery) with App Connectors (active API integration for sanctioned app monitoring), leading them to choose B because they think 'connecting to apps' is needed to discover them.

How to eliminate wrong answers

Option B (App Connectors) is wrong because App Connectors are used to connect directly to sanctioned cloud apps (like Office 365, Salesforce) via APIs to pull data for monitoring and governance, not to discover unsanctioned apps from firewall logs. Option C (Conditional Access App Control) is wrong because it enforces real-time access policies on sanctioned apps using reverse proxy, not for discovering unknown apps from traffic logs. Option D (Information Protection) is wrong because it focuses on classifying and protecting sensitive data within files and emails, not on discovering cloud app usage patterns from network traffic.

Practice this question →

169

MCQeasy

You need to ensure that sensitive documents in Microsoft SharePoint Online are automatically classified and protected when they contain credit card numbers. What should you configure?

A.A sensitivity label with auto-labeling for Microsoft Purview Information Protection

B.A retention policy for SharePoint

C.A data loss prevention (DLP) policy

D.A retention label for regulatory compliance

AnswerA

Sensitivity labels with auto-labeling are specifically designed within Microsoft Purview Information Protection to automatically classify and apply protective measures to documents. They leverage sensitive information types and trainable classifiers to identify content, then enforce encryption, visual markings, and access restrictions, ensuring proactive data protection from creation and throughout its lifecycle.

Why this answer

A sensitivity label with auto-labeling for Microsoft Purview Information Protection is correct because it can automatically classify and protect documents based on sensitive content, such as credit card numbers, using built-in sensitive information types. This ensures that when a document in SharePoint Online contains credit card data, it is automatically labeled with encryption and usage restrictions without manual intervention.

Exam trap

The trap here is that candidates often confuse DLP policies with auto-labeling, but DLP policies only monitor and block data sharing, whereas auto-labeling with sensitivity labels actually classifies and protects the content itself.

How to eliminate wrong answers

Option B is wrong because a retention policy for SharePoint is designed to retain or delete content based on time, not to classify or protect documents based on sensitive data like credit card numbers. Option C is wrong because a data loss prevention (DLP) policy can detect and block sharing of sensitive data, but it does not automatically classify or apply protection (e.g., encryption) to the documents themselves; it only enforces rules on data in transit or at rest. Option D is wrong because a retention label for regulatory compliance is used to manage data retention and disposal, not to automatically classify or protect documents based on sensitive content like credit card numbers.

Practice this question →

170

MCQeasy

Your organization uses Microsoft Defender for Cloud Apps. You need to detect anomalous user behavior such as impossible travel. Which type of policy should you configure?

A.Anomaly detection policy

B.Activity policy

C.App discovery policy

D.Session policy

AnswerA

Microsoft Defender for Cloud Apps' anomaly detection policies leverage machine learning and User Behavior Analytics (UBA) to identify unusual activities that deviate from a user's learned baseline. These policies are specifically designed to detect sophisticated threats like impossible travel, where a user logs in from geographically distant locations in an impossibly short timeframe, or unusual login locations, failed logins, and suspicious activities, by continuously monitoring and analyzing user and entity behavior.

Why this answer

Anomaly detection policies in Microsoft Defender for Cloud Apps use machine learning and behavioral analytics to establish a baseline of normal user activity and then flag deviations such as impossible travel (e.g., a user logging in from New York and then from London within an unrealistic time frame). This policy type is specifically designed to detect suspicious patterns like credential theft or account compromise without requiring predefined rules.

Exam trap

Microsoft often tests the distinction between rule-based policies (Activity policies) and machine-learning-based anomaly detection, leading candidates to choose Activity policy because they think they can manually define 'impossible travel' rules, but in practice, anomaly detection is the only automated way to handle such dynamic behavioral patterns.

How to eliminate wrong answers

Option B is wrong because Activity policies are rule-based and require you to define specific conditions (e.g., number of downloads from a location) to trigger alerts; they cannot automatically detect unknown anomalous patterns like impossible travel. Option C is wrong because App discovery policies are used to identify shadow IT by analyzing traffic logs to discover cloud apps in use, not to monitor user behavior for anomalies. Option D is wrong because Session policies control real-time user actions within a session (e.g., blocking downloads) based on risk, but they do not perform historical behavioral analysis to detect impossible travel.

Practice this question →

171

MCQeasy

A security analyst receives an alert from Microsoft Sentinel indicating a potential ransomware attack. The analyst needs to quickly understand the full scope of the attack, including all affected accounts and devices. Which Microsoft Sentinel feature should they use?

A.Analytics rules

B.Workbooks

C.Playbooks

D.Incident investigation

AnswerD

The incident investigation graph in Microsoft Sentinel is a crucial tool that provides security analysts with a visual, interactive representation of an alert or incident's scope and context. It dynamically maps entities like users, hosts, and IP addresses, showing their relationships and connections to related alerts and events. This graphical view is essential for understanding the attack chain, identifying affected assets, and effectively determining the overall impact and progression of a security event.

Why this answer

D is correct because Microsoft Sentinel's incident investigation feature provides a visual, interactive graph that maps relationships between entities (e.g., accounts, devices, IP addresses) involved in an incident. This allows the analyst to quickly see the full scope of a ransomware attack by exploring all affected resources and their connections, rather than relying on static reports or automated responses.

Exam trap

The trap here is that candidates often confuse 'incident investigation' with 'workbooks' or 'playbooks,' assuming that any visual tool or automated action can provide attack scope, when in fact only the investigation graph offers entity-level relationship mapping for a specific incident.

How to eliminate wrong answers

Option A is wrong because Analytics rules are used to generate alerts based on predefined detection logic (e.g., KQL queries), not to investigate the scope of an ongoing incident. Option B is wrong because Workbooks are interactive dashboards that provide aggregated visualizations and metrics, but they do not offer entity-level relationship mapping for a specific incident. Option C is wrong because Playbooks are automated response workflows (often based on Azure Logic Apps) that execute actions like blocking IPs or isolating devices, but they do not provide the investigative context needed to understand the full attack scope.

Practice this question →

172

MCQeasy

Your organization uses Microsoft Defender for Cloud to protect Azure virtual machines. You need to ensure that critical vulnerabilities identified on the VMs are automatically remediated using a just-in-time patching mechanism. What should you configure?

A.Enable adaptive application controls and just-in-time VM access in Defender for Cloud

B.Deploy Microsoft Intune for update management

C.Configure Azure Automation Update Management

D.Enable Azure Update Manager

AnswerD

Correct. Azure Update Manager provides automated patching for Azure VMs, enabling just-in-time remediation of critical vulnerabilities.

Why this answer

Azure Update Manager is a unified service that provides managed update capabilities for Azure VMs and Arc-enabled servers. It enables just-in-time patching by allowing you to schedule and apply critical updates as needed, automatically remediating vulnerabilities. In contrast, Adaptive application controls and just-in-time VM access in Defender for Cloud are security controls that reduce attack surface but do not apply patches.

Intune is for endpoint management, and Azure Automation Update Management is a legacy solution being replaced by Azure Update Manager.

Exam trap

Candidates might confuse security controls (like JIT VM access) with actual patch deployment mechanisms. The question specifically asks for a patching mechanism, not an access control.

How to eliminate wrong answers

Option B is wrong because Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) solution for managing devices, not a just-in-time patching mechanism for Azure VMs; it focuses on endpoint management and compliance, not vulnerability remediation via JIT. Option C is wrong because Azure Automation Update Management is a patch management solution that schedules and deploys updates, but it does not provide just-in-time access control or automatic remediation of critical vulnerabilities in a JIT manner; it is a scheduled update service, not a JIT mechanism. Option D is wrong because Azure Update Manager is a unified service for managing updates across Azure and hybrid environments, but it lacks the just-in-time access control and adaptive application controls needed for automatic remediation of critical vulnerabilities; it focuses on update orchestration, not JIT patching.

Practice this question →

173

Multi-Selectmedium

Which TWO of the following are capabilities of Microsoft Purview Information Protection? (Choose two.)

Select 2 answers

A.Classify and label sensitive data

B.Block external sharing of files

C.Detect malware in email attachments

D.Apply encryption based on sensitivity labels

E.Monitor user activities in real-time

AnswersA, D

Microsoft Purview Information Protection (MPIP) is a foundational component that enables organizations to identify, categorize, and apply sensitivity labels to data across various locations, including Microsoft 365 services, on-premises file shares, and third-party cloud apps. This classification helps in understanding the data landscape and applying appropriate protection measures, making it a core capability.

Why this answer

Microsoft Purview Information Protection (MIP) enables organizations to classify and label sensitive data based on content inspection and policy rules. It also applies encryption and usage restrictions directly through sensitivity labels, ensuring data is protected regardless of where it is stored or shared.

Exam trap

The trap here is confusing Microsoft Purview Information Protection (which focuses on classification, labeling, and encryption) with other security solutions like DLP, Defender, or Audit, leading candidates to select options that are valid but belong to different services.

Practice this question →

174

MCQeasy

Your organization needs to prevent sensitive data in SharePoint Online from being shared externally. Which Microsoft Purview solution should you use?

A.Data Loss Prevention (DLP)

B.eDiscovery

C.Sensitivity labels

D.Insider Risk Management

AnswerA

Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various locations, including SharePoint Online. By configuring DLP policies, organizations can automatically detect content containing sensitive information types, such as credit card numbers or national ID numbers, and then apply protective actions. These actions can include blocking external sharing, notifying administrators, or even encrypting the content, thereby directly preventing unauthorized data exfiltration.

Why this answer

Data Loss Prevention (DLP) is the correct Microsoft Purview solution because it is specifically designed to detect and prevent the unauthorized sharing of sensitive data, such as credit card numbers or personally identifiable information (PII), by applying policies that can block external sharing in SharePoint Online. DLP policies can be configured to scan content in real-time and enforce actions like blocking access or sending notifications when sensitive data is detected in external sharing scenarios.

Exam trap

The trap here is that candidates often confuse sensitivity labels with DLP, assuming labels alone can block sharing, but labels only apply protection (e.g., encryption) and require DLP policies to enforce sharing restrictions.

How to eliminate wrong answers

Option B (eDiscovery) is wrong because eDiscovery is used for searching, holding, and exporting content for legal or investigative purposes, not for preventing data sharing in real-time. Option C (Sensitivity labels) is wrong because while sensitivity labels can classify and protect data with encryption or visual markings, they do not natively enforce external sharing blocks on their own; they require integration with DLP or conditional access policies to prevent sharing. Option D (Insider Risk Management) is wrong because it focuses on identifying and investigating risky user activities (e.g., data exfiltration by insiders) through analytics and alerts, rather than proactively blocking external sharing of sensitive data.

Practice this question →

175

MCQeasy

An organization uses Microsoft Defender for Endpoint (MDE). The security team wants to identify devices that have not received a security update in the last 30 days. Which report should they use?

A.Threat analytics report

B.Device health report

C.Vulnerability management dashboard

D.Microsoft Secure Score report

AnswerB

The Device health report within Microsoft Defender for Endpoint provides a comprehensive overview of the security posture and operational status of managed devices. This report specifically includes critical information such as the status of security updates, antivirus protection, firewall configuration, and sensor health. Organizations can leverage this report to quickly identify devices that are missing essential security updates, thereby addressing potential vulnerabilities and ensuring compliance.

Why this answer

The Device health report in Microsoft Defender for Endpoint provides a list of devices and their last security update status, including the date of the last update. This report directly answers the requirement to identify devices that have not received a security update in the last 30 days by showing the 'Last update' column and allowing filtering by update age.

Exam trap

The trap here is that candidates confuse the Vulnerability management dashboard (which shows vulnerabilities) with a report that tracks update installation recency, but the dashboard does not provide a simple list of devices by last update date.

How to eliminate wrong answers

Option A is wrong because the Threat analytics report focuses on active threats, vulnerabilities, and attack campaigns, not on the update compliance status of individual devices. Option C is wrong because the Vulnerability management dashboard shows discovered vulnerabilities and their severity across devices, but it does not directly report on whether a security update has been installed within a specific time window. Option D is wrong because Microsoft Secure Score measures an organization's security posture based on configuration and control implementation, not the update recency of individual endpoints.

Practice this question →

176

MCQeasy

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?

A.An app protection policy in Microsoft 365 admin center

B.A conditional access policy in Microsoft Entra ID

C.A conditional access policy in Azure AD

D.A device compliance policy in Intune

AnswerB

A conditional access policy in Microsoft Entra ID is the correct mechanism for enforcing access controls based on device compliance. These policies evaluate various signals, including whether a device is marked as 'compliant' by Microsoft Intune, before granting access to cloud applications and resources. By requiring a compliant device, organizations ensure that only trusted and healthy endpoints can access sensitive data, directly addressing the need to block access for non-compliant devices.

Why this answer

Conditional Access policies in Microsoft Entra ID (formerly Azure AD) are the correct mechanism to enforce access controls based on device compliance status. By integrating with Intune's device compliance policies, a Conditional Access policy can block or allow access to corporate email (e.g., Exchange Online) based on whether the device is marked as compliant. This is the standard approach for controlling access to cloud apps like email based on device health.

Exam trap

The trap here is that candidates confuse the role of Intune's device compliance policy (which only defines and reports compliance) with the Conditional Access policy (which enforces the access decision), leading them to select Option D instead of B.

How to eliminate wrong answers

Option A is wrong because app protection policies in the Microsoft 365 admin center (or Microsoft Intune) manage how data is handled within apps (e.g., preventing copy/paste), not whether a device is allowed to access corporate email at the authentication gate. Option C is wrong because 'Azure AD' is the legacy name; the current service is Microsoft Entra ID, and the exam expects the updated terminology. Option D is wrong because a device compliance policy in Intune only defines the compliance requirements (e.g., encryption, OS version) and marks the device as compliant or non-compliant; it does not itself enforce access control to corporate email—that requires a Conditional Access policy to act on the compliance state.

Practice this question →

177

MCQhard

You are a compliance officer at a healthcare organization that uses Microsoft 365. The organization must comply with HIPAA regulations. You have Microsoft Purview, Microsoft Defender for Cloud Apps, and Microsoft Intune. You need to ensure that all devices accessing patient health information (PHI) are compliant with the organization's security policies, which require device encryption, a minimum OS version, and the use of a compliant mobile device management (MDM) provider. Currently, some devices are not managed by Intune. You need to enforce that only compliant devices can access PHI stored in SharePoint Online. What should you do?

A.Create a device compliance policy in Microsoft Intune and assign it to all users

B.Deploy an app protection policy in Microsoft Intune to restrict data access

C.Configure a conditional access policy in Microsoft Entra ID to require compliant devices

D.Create a DLP policy in Microsoft Purview to block access from non-compliant devices

AnswerC

Conditional access can require devices to be marked as compliant.

Why this answer

A conditional access policy in Microsoft Entra ID can be configured to require that devices accessing SharePoint Online be marked as compliant. Device compliance is determined by Intune compliance policies (covering encryption, OS version, MDM enrollment) but the enforcement is done via conditional access. Option A is wrong because creating a compliance policy alone does not enforce the requirement; you need a conditional access policy to block non-compliant devices.

Option B is wrong because app protection policies manage data access at the app level but do not enforce device compliance (e.g., OS version or device encryption). Option D is wrong because DLP policies focus on preventing data leakage, not on device compliance.

Practice this question →

178

MCQhard

A company runs critical applications on Windows Server virtual machines in Azure and on-premises. The security team wants to reduce the exposure of administrative ports (e.g., RDP, SSH) by requiring administrators to request just-in-time (JIT) access. The request should require approval from a central team, and the port should be opened only for a limited time. Which Microsoft security solution provides this JIT capability for both Azure and on-premises servers (when connected via Azure Arc)?

A.Microsoft Entra Privileged Identity Management (PIM)

B.Microsoft Defender for Identity

C.Microsoft Defender for Cloud (with just-in-time VM access)

D.Microsoft Defender for Cloud Apps

AnswerC

Microsoft Defender for Cloud provides advanced threat protection and security posture management for hybrid cloud workloads, including Windows Server virtual machines. Its Just-in-Time (JIT) VM access feature specifically addresses the requirement by allowing temporary, controlled access to management ports like RDP. This significantly reduces the attack surface by keeping these ports closed by default, only opening them for a limited time upon approval, which is crucial for securing critical applications.

Why this answer

Microsoft Defender for Cloud's just-in-time (JIT) VM access capability reduces exposure to administrative ports (RDP, SSH) by locking down inbound traffic to Azure VMs and Azure Arc-enabled on-premises servers. It requires administrators to request access, which can be configured to require approval from a central team, and automatically opens the specified ports for a limited time before closing them again. This directly matches the scenario's need for JIT access with approval and time-limited port opening across hybrid environments.

Exam trap

The trap here is that candidates confuse Privileged Identity Management (PIM) with just-in-time VM access because both involve 'just-in-time' and 'approval,' but PIM controls role activation in Azure AD/Entra ID, not network-level port access to virtual machines.

Why the other options are wrong

Microsoft Entra PIM manages just-in-time privileged access to Azure AD roles and Azure resources, but it does not provide JIT access to administrative ports (RDP/SSH) on virtual machines, whether in Azure or on-premises via Azure Arc.

Microsoft Defender for Identity is an on-premises security solution that detects identity threats using Active Directory signals, but it does not provide just-in-time (JIT) access control for administrative ports on VMs.

Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that focuses on securing cloud applications, not on managing just-in-time access to administrative ports on VMs. It does not provide JIT VM access capabilities.

Practice this question →

179

MCQmedium

A company runs virtual machines in Azure and also maintains on-premises servers connected via Azure Arc. The security team needs a single dashboard to view security recommendations, detect misconfigurations, and track a secure score across both environments. They also want to enable advanced threat protection features such as just-in-time (JIT) VM access and file integrity monitoring for these workloads. Which Microsoft security solution should they implement?

A.Microsoft Defender for Cloud

B.Microsoft Sentinel

C.Microsoft Defender for Endpoint

D.Microsoft Defender for Cloud Apps

AnswerA

Defender for Cloud provides a unified dashboard with secure score, recommendations, and advanced threat protection for hybrid workloads including on-premises servers via Azure Arc.

Why this answer

Microsoft Defender for Cloud provides a unified dashboard that displays security recommendations, misconfigurations, and a secure score across both Azure and on-premises workloads connected via Azure Arc. It also includes advanced threat protection features like just-in-time (JIT) VM access and file integrity monitoring, making it the correct choice for this scenario.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM and workload protection platform) with Microsoft Sentinel (a SIEM), but the question explicitly asks for a single dashboard for security posture, secure score, and advanced threat protection features like JIT and file integrity monitoring, which are exclusive to Defender for Cloud.

Why the other options are wrong

Microsoft Sentinel is a SIEM and SOAR solution for collecting and analyzing security logs, not a dashboard for security recommendations, misconfigurations, or secure score across hybrid environments. It does not provide just-in-time VM access or file integrity monitoring.

Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for devices, not on providing a unified dashboard for security recommendations, misconfigurations, secure score, or advanced cloud workload protections like JIT VM access and file integrity monitoring across hybrid environments.

Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) focused on SaaS application security, not on providing a unified dashboard for VM secure score, misconfigurations, or advanced threat protection like JIT VM access and file integrity monitoring across Azure and on-premises servers.

Practice this question →

180

MCQhard

Your company is deploying Microsoft Entra ID Governance. They want to automate the review of guest user access to Microsoft Teams and remove access when guests leave the partner organization. Which feature should they implement?

A.Access reviews and connected organizations

B.Entitlement management

C.Terms of use

D.Password policies

AnswerA

Access reviews are a core component of Microsoft Entra ID Governance, enabling organizations to periodically review access rights for users, including guests. When combined with connected organizations, which define external partners, access reviews can be configured to automatically remove guest accounts or their access to resources if their access is no longer justified or if reviewers fail to attest to their continued need. This directly addresses the requirement for automated removal of guest access.

Why this answer

Access reviews in Microsoft Entra ID Governance allow you to create recurring reviews of guest user access to resources like Microsoft Teams. By configuring the review to include connected organizations, you can automatically remove guest access when the guest's identity is no longer associated with a partner organization, such as when they leave the partner company. This automation is achieved through the integration of access reviews with the connected organization's lifecycle, ensuring that guest access is revoked without manual intervention.

Exam trap

The trap here is that candidates often confuse entitlement management (which handles access requests and provisioning) with access reviews (which handle periodic attestation and automated removal), leading them to choose entitlement management instead of the correct feature for automated removal based on partner organization changes.

How to eliminate wrong answers

Option B is wrong because entitlement management is used to manage access packages and automate the request and approval process for resources, but it does not directly automate the removal of guest access based on the guest leaving a partner organization; that is the function of access reviews with connected organizations. Option C is wrong because terms of use are used to present and require acceptance of legal or policy documents before accessing resources, not to automate access removal based on organizational membership changes. Option D is wrong because password policies control password complexity, expiration, and lockout settings, and have no role in automating the review or removal of guest access based on partner organization membership.

Practice this question →

181

MCQhard

Refer to the exhibit. You are creating a Microsoft Purview sensitivity label for HR data. The JSON shows a label configuration. What is the likely effect of setting the sensitivity value to 90?

A.The label automatically encrypts the document

B.The label triggers auditing for 90 days

C.The label sets a 90-day retention period

D.The label will be applied with higher priority than labels with lower sensitivity values

AnswerD

In Microsoft Purview, sensitivity labels are assigned a priority order, typically based on their sensitivity value. When multiple auto-labeling policies might apply different labels to the same content, the label with the higher sensitivity value (and thus higher priority) will be applied. This ensures that the most restrictive or appropriate classification and protection settings are consistently enforced.

Why this answer

In Microsoft Purview, sensitivity labels are assigned an integer priority value (typically 0 to 100). A higher sensitivity value indicates a higher priority. When multiple labels are available, the label with the highest sensitivity value is applied by default or takes precedence in auto-labeling and policy conflicts.

Setting the value to 90 ensures this HR label is prioritized over labels with lower values, such as 75 or 50.

Exam trap

The SC-900 exam often tests the misconception that the sensitivity value directly controls encryption, retention, or auditing, when in fact it only determines label priority in a hierarchical classification scheme.

How to eliminate wrong answers

Option A is wrong because sensitivity labels do not automatically encrypt documents unless an encryption action (e.g., 'Protect' with user-defined permissions) is explicitly configured in the label settings; the JSON snippet only shows a sensitivity value, not an encryption action. Option B is wrong because auditing is controlled by audit policies in Microsoft 365, not by the sensitivity value; a value of 90 does not trigger or set an audit duration. Option C is wrong because retention periods are configured separately via retention labels or retention policies in Microsoft Purview, not by the sensitivity value of a sensitivity label.

Practice this question →

182

MCQeasy

A company wants to allow users to reset their own passwords from the login screen without contacting IT. Which Microsoft Entra ID feature enables this?

A.Conditional Access

B.Multifactor authentication

C.Self-Service Password Reset

D.Identity Protection

AnswerC

Correct: SSPR enables users to reset passwords without IT intervention.

Why this answer

Self-Service Password Reset (SSPR) is the Microsoft Entra ID feature that allows users to reset their own passwords from the login screen without contacting IT. It is specifically designed to reduce helpdesk workload by enabling password changes or unlocks through a verified authentication method, such as a phone call, text message, or the Microsoft Authenticator app.

Exam trap

The trap here is that candidates often confuse Conditional Access with SSPR because both appear in the login flow, but Conditional Access enforces policies after authentication, whereas SSPR is a separate feature for password recovery before authentication completes.

How to eliminate wrong answers

Option A is wrong because Conditional Access is a policy engine that enforces access controls (e.g., requiring MFA or blocking sign-ins from specific locations) based on signals like user, device, or location, but it does not provide password reset functionality. Option B is wrong because Multifactor Authentication (MFA) adds an extra layer of security by requiring a second verification factor during sign-in, but it does not enable users to reset their own passwords. Option D is wrong because Identity Protection uses machine learning to detect and respond to identity-based risks (e.g., leaked credentials or anomalous sign-ins), but it does not include a self-service password reset capability.

Practice this question →

183

MCQhard

Refer to the exhibit. You run a KQL query in Microsoft Sentinel to investigate ransomware alerts. The query returns: AlertSeverity High: 5, Medium: 3, Low: 2. The security team wants to automate a response for all high-severity ransomware alerts. What should you configure?

A.Create an analytics rule for ransomware

B.Create a hunting query for ransomware

C.Create a workbook to display ransomware alerts

D.Create an automation rule that triggers a playbook for high-severity ransomware incidents

AnswerD

Automation rules in Microsoft Sentinel are specifically engineered to manage and respond to incidents automatically, serving as the orchestrator for automated actions. By configuring an automation rule to trigger a specific playbook (an Azure Logic App) when a high-severity ransomware incident is created, organizations can execute predefined, automated response steps. This capability is central to Security Orchestration, Automation, and Response (SOAR), ensuring rapid and consistent handling of critical threats.

Why this answer

Microsoft Sentinel automation rules allow you to define automated responses triggered when incidents are created or updated. By configuring an automation rule with a condition that checks for 'AlertSeverity' equal to 'High' and 'Ransomware' as the related alert, you can invoke a playbook to automatically respond to high-severity ransomware incidents, such as isolating affected machines or blocking indicators of compromise.

Exam trap

Microsoft Sentinel components are often tested: analytics rules for detection, hunting queries for investigation, workbooks for visualization, and automation rules for automated response. Candidates commonly confuse the purpose of each, especially automation rules versus analytics rules.

How to eliminate wrong answers

Option A is wrong because an analytics rule is used to generate alerts from raw data based on detection logic, not to automate responses to already-created incidents. Option B is wrong because a hunting query is a proactive search for threats in historical data, not an automated response mechanism. Option C is wrong because a workbook provides visualizations and dashboards of data, but does not execute any automated actions or responses.

Practice this question →

184

MCQmedium

You are reviewing a Microsoft Purview DLP policy configuration as shown in the exhibit. What is the expected behavior when a user sends an email containing a credit card number to an external recipient?

A.The email is delivered, but the user receives a warning.

B.The email is delivered, and the user is asked to provide a business justification.

C.The email is blocked, but only if the recipient is external and internal recipients are allowed.

D.The email is blocked, and the user receives a policy tip notification.

AnswerD

When a Microsoft Purview DLP policy is configured to block the sharing of sensitive information, the system actively prevents the email from being sent or delivered. Simultaneously, a policy tip notification is displayed to the sender within their email client or application. This notification informs the user about the policy violation, explains why the action was taken, and often provides guidance on how to resolve the issue, ensuring immediate feedback and education.

Why this answer

The DLP policy is configured to block external sharing when credit card numbers are detected. When a user sends an email with a credit card number to an external recipient, the email is blocked and the user receives a policy tip notification. Option A is incorrect because the email is not delivered.

Option B is incorrect because the email is blocked, not delivered with a justification prompt. Option C is incorrect because the policy blocks external recipients regardless of internal allowance.

Practice this question →

185

MCQeasy

Your organization wants to protect against phishing attacks by verifying the sender's identity for incoming emails. Which Microsoft Defender for Office 365 feature should you configure?

A.Anti-malware policy

B.Safe Links policy

C.Anti-phishing policy with SPF/DKIM/DMARC settings

D.Safe Attachments policy

AnswerC

An anti-phishing policy, especially when configured with SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance) settings, is specifically designed to combat phishing attacks. These authentication mechanisms verify the sender's identity and domain legitimacy, preventing spoofed emails and impersonation attempts from reaching recipients. This comprehensive approach directly addresses the core techniques used in phishing by ensuring email authenticity and enforcing policies on unauthenticated messages.

Why this answer

The anti-phishing policy in Microsoft Defender for Office 365 includes sender verification settings that leverage SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance). These protocols authenticate the sender's domain and verify that the email originated from an authorized server, directly addressing the requirement to protect against phishing by verifying sender identity.

Exam trap

The trap here is that candidates often confuse anti-phishing policies with Safe Links or Safe Attachments, assuming that link scanning or attachment sandboxing is the primary defense against phishing, when in fact sender verification via SPF/DKIM/DMARC is the foundational protection against identity spoofing in phishing attacks.

How to eliminate wrong answers

Option A is wrong because anti-malware policy is designed to detect and block malicious attachments or links in email, not to verify the sender's identity via email authentication protocols. Option B is wrong because Safe Links policy provides time-of-click protection by scanning URLs in emails and Office documents, but it does not authenticate the sender's domain or verify the email's origin. Option D is wrong because Safe Attachments policy uses detonation in a sandbox to analyze email attachments for malware, but it does not perform sender authentication checks like SPF, DKIM, or DMARC.

Practice this question →

186

MCQhard

A large enterprise uses a variety of cloud applications, including sanctioned apps like Microsoft 365 and unsanctioned apps that employees adopted without IT approval. The security team wants to discover all cloud applications in use, assess each app's risk score based on more than 80 risk factors, and control data sharing within sanctioned apps to prevent data leakage. Additionally, they need to identify which users are using a new, unknown file-sharing service. Which Microsoft security solution should be deployed to meet these requirements?

A.Microsoft Defender for Cloud

B.Microsoft Defender for Cloud Apps

C.Microsoft Defender for Endpoint

D.Microsoft Purview Data Loss Prevention (DLP)

AnswerB

Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security or MCAS) functions as a Cloud Access Security Broker (CASB). It provides comprehensive visibility into cloud applications, both sanctioned and unsanctioned (shadow IT), across an organization's network. By leveraging traffic logs from firewalls and proxies, it discovers all cloud apps, assesses their risk based on over 80 factors, and enables granular control over data and user activities within sanctioned applications to enforce security policies and prevent data leakage. This makes it ideal for managing the security posture of cloud app usage.

Why this answer

Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) is a Cloud Access Security Broker (CASB) that provides visibility into both sanctioned and unsanctioned cloud apps through its Cloud Discovery feature. It assesses risk scores based on over 80 risk factors (e.g., encryption standards, data residency, and compliance certifications) and enables data sharing controls via session policies (e.g., Conditional Access App Control) to prevent data leakage. It also supports anomaly detection to identify users of new, unknown file-sharing services by analyzing traffic logs from network appliances or endpoints.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM tool for Azure) with Microsoft Defender for Cloud Apps (a CASB), or they assume that Purview DLP alone can discover and risk-assess unsanctioned apps, when in fact DLP only controls data after the app is already identified and integrated.

Why the other options are wrong

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and workload protection solution, not designed to discover cloud apps, assess risk scores, or control data sharing across sanctioned and unsanctioned apps. It focuses on securing cloud infrastructure (e.g., VMs, databases) rather than SaaS application governance.

Microsoft Defender for Endpoint focuses on endpoint protection (antivirus, EDR) and does not provide cloud app discovery, risk assessment, or control over data sharing in cloud applications like Microsoft 365.

Microsoft Purview Data Loss Prevention (DLP) focuses on preventing data leakage by enforcing policies on sensitive data, but it does not discover cloud applications, assess risk scores, or identify users of unsanctioned apps. The question requires cloud app discovery and risk assessment, which are capabilities of Defender for Cloud Apps, not DLP.

Practice this question →

187

Multi-Selecteasy

Which THREE are features of Microsoft Entra ID Protection? (Choose THREE.)

Select 3 answers

A.Privileged role management

B.Sign-in risk detection

C.Detection of leaked credentials

D.Risk-based conditional access

E.Identity governance

AnswersB, C, D

Identity Protection detects risky sign-ins such as from anonymous IP addresses.

Why this answer

Sign-in risk detection is a core feature of Microsoft Entra ID Protection. It uses real-time and offline machine learning models to evaluate each sign-in attempt for anomalies such as impossible travel, anonymous IP addresses, or atypical locations, assigning a risk level (low, medium, high). This allows organizations to automatically respond to suspicious sign-ins before compromise occurs.

Exam trap

The trap here is that candidates often confuse Entra ID Protection (focused on risk detection and remediation) with Entra ID Governance (focused on identity lifecycle and access controls), leading them to select Privileged role management or Identity governance as features of ID Protection.

Practice this question →

188

MCQeasy

Your organization has deployed Microsoft Intune for mobile device management. You need to ensure that users can only access corporate resources from devices that are compliant with your security policies. Which policy type should you configure?

A.A Conditional Access policy

B.An app protection policy

C.A compliance policy

D.A configuration policy

AnswerA

Conditional Access policies can block or grant access based on device compliance status from Intune.

Why this answer

A Conditional Access policy is the correct choice because it enforces access controls at the identity level, evaluating device compliance status before granting access to corporate resources. When combined with Intune compliance policies, Conditional Access can block or allow access based on real-time device health checks, ensuring only compliant devices can connect.

Exam trap

The trap here is confusing the role of a compliance policy (which only assesses and reports device status) with a Conditional Access policy (which enforces the access decision based on that status), leading candidates to incorrectly select compliance policy as the enforcement mechanism.

How to eliminate wrong answers

Option B is wrong because an app protection policy manages how data is handled within applications (e.g., preventing copy/paste or requiring a PIN) but does not control device-level access to corporate resources. Option C is wrong because a compliance policy defines the security requirements a device must meet (e.g., encryption, OS version) but does not enforce access decisions; it only marks the device as compliant or non-compliant. Option D is wrong because a configuration policy pushes settings to devices (e.g., Wi-Fi profiles, email settings) but does not evaluate or enforce access restrictions based on compliance.

Practice this question →

189

MCQmedium

Your organization uses Microsoft Sentinel for security operations. You need to ensure that when a high-severity incident is created, a Microsoft Teams message is sent to the SOC team automatically. What should you configure?

A.Create an automation rule that triggers on incident creation and runs a playbook.

B.Create a playbook and attach it to an analytics rule.

C.Modify the analytics rule to include an automated response.

D.Configure a workbook to send email alerts.

AnswerA

Automation rules in Microsoft Sentinel are specifically designed to orchestrate responses to security incidents. By configuring an automation rule to trigger upon incident creation, it can then execute a pre-defined playbook (an Azure Logic App). This playbook can contain various actions, such as sending a notification to a Microsoft Teams channel, thereby automating the initial communication and response for new incidents.

Why this answer

Automation rules in Microsoft Sentinel allow you to define triggers (e.g., incident creation) and run a playbook as an action. A playbook can contain steps to send a Teams message. So you create an automation rule that triggers on incident creation and runs a playbook.

Option B is incorrect because attaching a playbook to an analytics rule is not the standard method; analytics rules create incidents, but automation rules handle the automated response. Option C is incorrect because analytics rules do not have a direct 'automated response' for sending notifications. Option D is incorrect because workbooks are used for data visualization and dashboards, not for automation.

Practice this question →

190

MCQmedium

A company runs a production Kubernetes cluster in Azure. The security team needs to continuously monitor the cluster for misconfigurations, such as containers running with privileged access or secrets exposed in environment variables. They also want to detect runtime threats like crypto-mining containers. Which Microsoft security solution should they use?

A.Microsoft Defender for Cloud

B.Microsoft Sentinel

C.Microsoft Defender for Endpoint

D.Microsoft Defender for Cloud Apps

AnswerA

Microsoft Defender for Cloud is the correct solution because it provides comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities specifically for Azure Kubernetes Service (AKS). It offers continuous security recommendations for AKS configurations, scans container images for vulnerabilities, and detects runtime threats within the cluster, including suspicious activities at the pod and node level, making it the primary tool for securing Kubernetes.

Why this answer

Microsoft Defender for Cloud provides Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities. It continuously assesses Kubernetes clusters against the CIS Kubernetes Benchmark, detecting misconfigurations like privileged containers and exposed secrets in environment variables, and uses behavioral analytics to detect runtime threats such as crypto-mining containers.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel's log aggregation capabilities with the proactive, agent-based posture management and runtime detection that Defender for Cloud provides specifically for Kubernetes workloads.

Why the other options are wrong

Microsoft Sentinel is a SIEM/SOAR solution for security analytics and threat intelligence, not a dedicated tool for continuous monitoring of Kubernetes misconfigurations or runtime threats like crypto-mining. Defender for Cloud provides native Kubernetes workload protection.

Microsoft Defender for Endpoint focuses on endpoint devices (e.g., servers, workstations) and does not provide Kubernetes-specific misconfiguration monitoring or runtime threat detection for containers.

Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) focused on SaaS applications, not on monitoring Kubernetes cluster configurations or runtime threats like crypto-mining containers.

Practice this question →

191

MCQmedium

A company uses a mix of Azure virtual machines and on-premises Windows and Linux servers. The security team wants a single, integrated solution that can continuously assess these servers for missing security updates, weak operating system configurations, and common vulnerabilities. The solution should provide prioritized remediation recommendations. Which Microsoft security solution should they use?

A.Microsoft Defender for Cloud

B.Microsoft Sentinel

C.Microsoft Defender for Identity

D.Microsoft 365 Defender

AnswerA

Microsoft Defender for Cloud is the correct solution as it provides comprehensive security posture management and threat protection across hybrid and multi-cloud environments. It natively performs vulnerability assessments for Azure virtual machines and on-premises servers, integrating with Azure Arc to extend its capabilities. This service offers continuous monitoring, security recommendations, and compliance management, directly addressing the need for OS-level vulnerability scanning and configuration recommendations.

Why this answer

Microsoft Defender for Cloud provides a unified infrastructure security management solution that continuously assesses hybrid workloads, including Azure VMs and on-premises Windows/Linux servers. It integrates with Azure Policy and Microsoft Defender Vulnerability Management to detect missing security updates, weak OS configurations, and common vulnerabilities, then delivers prioritized remediation recommendations based on risk scores.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a workload protection and compliance tool) with Microsoft 365 Defender (an endpoint and identity protection suite), leading them to choose the broader-sounding but incorrect option for a specific vulnerability assessment requirement.

Why the other options are wrong

Microsoft Sentinel is a SIEM/SOAR solution for security analytics and threat intelligence, not a continuous server assessment tool for missing updates, weak configurations, and vulnerabilities.

Microsoft Defender for Identity focuses on detecting identity-based threats using Active Directory signals, not on assessing servers for missing updates, weak OS configurations, or vulnerabilities across hybrid environments.

Microsoft 365 Defender is designed to protect endpoints, identities, email, and applications within the Microsoft 365 ecosystem, but it does not provide continuous assessment of on-premises servers for missing security updates, weak OS configurations, or common vulnerabilities across hybrid environments.

Practice this question →

192

Multi-Selectmedium

Which TWO of the following are capabilities of Microsoft Defender XDR? (Choose two.)

Select 2 answers

A.Correlate alerts from multiple domains into a single incident

B.Data loss prevention for sensitive information

C.Centralized log analytics for custom queries

D.Identity governance and access reviews

E.Automated investigation and response across domains

AnswersA, E

Defender XDR correlates alerts across endpoints, email, etc.

Why this answer

Microsoft Defender XDR correlates alerts from multiple domains—such as endpoint, email, identity, and cloud apps—into a single incident. This cross-domain correlation is a core capability of the XDR (Extended Detection and Response) solution, enabling security teams to see the full attack story in one place.

Exam trap

The trap here is that candidates confuse the broad security portfolio—such as DLP, SIEM, and identity governance—with the specific cross-domain correlation and automated response capabilities that define Microsoft Defender XDR.

Practice this question →

193

Multi-Selectmedium

Which TWO Microsoft Purview features can be used to classify and label sensitive data in Microsoft 365?

Select 2 answers

A.Auto-labeling policies

B.Data Loss Prevention policies

C.Retention policies

D.Sensitivity labels

E.Audit policies

AnswersA, D

Auto-labeling policies in Microsoft Purview are powerful tools that automatically apply sensitivity labels to content based on predefined conditions. These conditions often include the detection of specific sensitive information types, keywords, or regular expressions within documents and emails. By automatically assigning labels, these policies effectively classify data at scale, ensuring consistent application of classification without requiring manual user intervention.

Why this answer

Auto-labeling policies (A) are correct because they allow organizations to automatically apply sensitivity labels to data based on conditions such as sensitive information types or pattern matching, enabling classification and labeling without manual user intervention. Sensitivity labels (D) are correct because they are the core mechanism in Microsoft Purview for classifying and protecting sensitive data by applying persistent labels that can enforce encryption, access restrictions, and visual markings across Microsoft 365 services.

Exam trap

The trap here is that candidates often confuse Data Loss Prevention policies with classification and labeling, but DLP policies only enforce actions based on existing labels or sensitive info types, not create or apply the labels themselves.

Practice this question →

194

MCQhard

Your company uses Microsoft Defender for Endpoint. A security analyst reports that a device is showing multiple alerts for the same malware variant, but the alerts are being automatically suppressed after the initial detection. What is the most likely reason for this behavior?

A.Alert suppression is enabled to reduce noise from repeated detections

B.The alerts are classified as low severity

C.The device is not properly onboarded to Microsoft Defender for Endpoint

D.Automatic investigation and remediation resolved the alerts

AnswerA

Microsoft Defender for Endpoint incorporates automatic alert suppression mechanisms designed to combat alert fatigue within security operations. When the system detects multiple instances of the exact same threat or activity on a device within a short timeframe, it intelligently suppresses subsequent duplicate alerts. This ensures security analysts can focus on unique, high-fidelity threats rather than being overwhelmed by redundant notifications, streamlining incident response.

Why this answer

Microsoft Defender for Endpoint includes alert suppression as a built-in feature to reduce alert fatigue from repeated detections of the same malware variant on the same device. When the same file or behavior is detected multiple times, the system automatically suppresses subsequent alerts after the initial detection, consolidating them into a single incident. This behavior is controlled by suppression rules that are enabled by default for common malware patterns, ensuring security analysts are not overwhelmed by duplicate alerts.

Exam trap

The trap here is that candidates confuse alert suppression with automatic investigation and remediation, assuming that alerts are suppressed because they were already resolved, when in fact suppression is a separate noise-reduction mechanism that occurs before any remediation actions are taken.

How to eliminate wrong answers

Option B is wrong because low-severity classification does not cause automatic suppression of subsequent alerts; severity affects prioritization and alerting thresholds, but repeated detections of the same variant are suppressed regardless of severity. Option C is wrong because a device that is not properly onboarded would not generate any alerts in Microsoft Defender for Endpoint, let alone multiple alerts that are then suppressed. Option D is wrong because automatic investigation and remediation resolves alerts after detection, but the question describes alerts being suppressed after the initial detection, not resolved; suppression occurs before investigation and remediation actions are taken.

Practice this question →

195

MCQeasy

Your organization needs to monitor and respond to security threats across on-premises, cloud, and hybrid environments. Which Microsoft solution provides a unified SIEM and SOAR capability?

A.Microsoft Defender XDR

B.Microsoft Defender for Cloud

C.Microsoft Sentinel

D.Microsoft Intune

AnswerC

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It provides comprehensive capabilities for collecting security data from diverse sources, including Microsoft services, other cloud providers, and on-premises infrastructure. Sentinel leverages AI and machine learning for threat detection, investigation, and automated response, making it the ideal platform for monitoring and responding to security threats across an entire enterprise environment.

Why this answer

Microsoft Sentinel is the correct answer because it is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR) solution. It provides unified threat monitoring, detection, and response across on-premises, cloud, and hybrid environments by ingesting data from various sources, using built-in analytics, and enabling automated playbooks.

Exam trap

The trap here is that candidates often confuse Microsoft Defender XDR (an XDR tool) with a full SIEM/SOAR solution, but Sentinel is the only Microsoft offering that provides both SIEM and SOAR capabilities natively.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender XDR is an extended detection and response (XDR) solution that correlates alerts across endpoints, email, identities, and cloud apps, but it does not provide the full SIEM data ingestion and SOAR orchestration capabilities of Sentinel. Option B is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that focuses on securing cloud resources, not a unified SIEM/SOAR solution. Option D is wrong because Microsoft Intune is a cloud-based endpoint management and mobile device management (MDM) service, with no SIEM or SOAR functionality.

Practice this question →

196

MCQmedium

A user reports that they cannot access a sensitive document in SharePoint Online. The document has a 'Highly Confidential' sensitivity label. You verify the label is applied correctly. What is the most likely reason for the access issue?

A.The label's encryption settings restrict access to specific users

B.The sensitivity label is missing

C.A DLP policy is blocking access

D.A retention policy is blocking access

AnswerA

Sensitivity labels, when configured with encryption, apply rights management protection to documents. This protection can explicitly define which users or groups have specific access rights, such as view-only, edit, or full control. If a user reports being unable to access a sensitive document, it is highly probable that the label's encryption settings have been configured to restrict access to a specific set of authorized individuals, and the reporting user is not included in that authorized list. This is a fundamental capability of Microsoft Purview Information Protection.

Why this answer

The 'Highly Confidential' sensitivity label is configured with encryption that restricts access to specific users or groups. Since you verified the label is applied correctly, the most likely reason the user cannot access the document is that their account is not included in the encryption permissions defined by the label. Sensitivity labels in Microsoft Purview Information Protection use Azure Rights Management (Azure RMS) to enforce encryption, and only authorized users with the appropriate rights can decrypt and access the content.

Exam trap

The trap here is that candidates often confuse DLP policies with sensitivity label encryption, assuming DLP blocks access to labeled documents, when in fact DLP only monitors and controls sharing actions, not read access to already-stored content.

How to eliminate wrong answers

Option B is wrong because the question explicitly states you verified the label is applied correctly, so the label is not missing. Option C is wrong because DLP policies detect and prevent sharing of sensitive data but do not block access to already-stored documents; they act on actions like sending or sharing, not on read access. Option D is wrong because retention policies are designed to preserve or delete content based on timeframes, not to block access; they do not enforce access control or encryption.

Practice this question →

197

MCQhard

Your company uses Microsoft Defender for Cloud Apps to discover shadow IT. The security team wants to automatically block the use of a newly discovered high-risk cloud app across all users. What is the most efficient approach?

A.Create a Conditional Access policy to block the app for all users.

B.Manually add the app to the blocked list in the cloud discovery settings.

C.Create an app discovery policy with governance action to unsanction the app.

D.Configure session controls to monitor app usage.

AnswerC

Creating an app discovery policy with a governance action to unsanction the app is the correct and most automated method. This policy allows Microsoft Defender for Cloud Apps to continuously scan discovered applications based on defined criteria (e.g., risk score, category, usage patterns). When an app matches the policy, the configured governance action, such as 'Unsanction app,' automatically marks it as unauthorized and triggers enforcement mechanisms, effectively blocking its use across the organization.

Why this answer

An app discovery policy with the governance action to unsanction the app automatically blocks the app across all users via the Defender for Cloud Apps API. Option A is incorrect because Conditional Access policies are identity-based and not designed to block specific cloud apps directly during discovery. Option B is incorrect because manually adding the app to the blocked list is not automatic and requires ongoing manual effort.

Option D is incorrect because session controls monitor and control app usage in real time but do not permanently block the app.

Practice this question →

198

MCQhard

Refer to the exhibit. You are deploying a custom assessment automation in Microsoft Defender for Cloud using Bicep. The deployment fails with an error that the resource type is not valid. What is the most likely reason?

A.The API version is not supported.

B.The property 'supportedCloud' should be 'supportedClouds' as an array.

C.The name property is missing.

D.The resource type is misspelled.

AnswerB

Azure Policy definitions, particularly for custom assessments, require the `supportedClouds` property (plural) to correctly specify the cloud environments where the policy should be active. The exhibit incorrectly uses `supportedCloud` (singular), which is not a recognized property in the Azure Policy schema. Furthermore, this property is expected to be an array of strings, even if only one cloud is specified, ensuring proper schema validation and deployment. This specific misnaming and incorrect data type are critical errors preventing successful deployment.

Why this answer

In Bicep for Microsoft Defender for Cloud custom assessments, the property that defines which cloud environments the assessment applies to must be named 'supportedClouds' and must be an array of strings (e.g., ['Azure', 'AWS', 'GCP']). Using the singular 'supportedCloud' is invalid syntax and causes the deployment to fail with a resource type validation error.

Exam trap

The trap here is that candidates may assume the error is due to a simple typo in the resource type name (Option D) or an API version mismatch (Option A), when in fact the issue is a property name/syntax error that is specific to the Bicep/ARM schema for Defender for Cloud custom assessments.

How to eliminate wrong answers

Option A is wrong because an unsupported API version would produce a different error message (e.g., 'The API version is not supported' or 'No registered resource provider found'), not a 'resource type is not valid' error. Option C is wrong because the 'name' property is required for all Azure resources, and its absence would trigger a missing required property error, not a resource type validation error. Option D is wrong because a misspelled resource type would result in a 'resource type not found' or 'invalid resource type' error, but the exhibit shows the error is about the resource type not being valid, which points to a structural/property issue, not a typo in the type name.

Practice this question →

199

MCQeasy

Your company uses Microsoft Purview to govern data across on-premises and cloud sources. You need to classify sensitive data such as credit card numbers and social security numbers automatically. What should you create?

A.Data loss prevention policies

B.Sensitivity labels

C.Sensitive information types

D.Retention labels

AnswerC

Sensitive information types (SITs) are the fundamental building blocks in Microsoft Purview for automatically identifying sensitive data. They define specific patterns, keywords, regular expressions, and proximity rules that the system uses to detect particular types of sensitive information, such as credit card numbers, national identification numbers, or medical record numbers. This automatic pattern matching is precisely how Purview discovers and classifies data at scale, making SITs the direct answer to automatic classification.

Why this answer

Sensitive information types (like built-in types for credit card numbers and SSNs) are used in Microsoft Purview to automatically classify data. Option A is wrong because data loss prevention policies use classification but are not the classification mechanism itself. Option B is wrong because sensitivity labels are used for applying protection based on classification, not for classification itself.

Option D is wrong because retention labels are for data retention policies.

Practice this question →

200

MCQmedium

Your company uses Microsoft 365 E5 licenses and wants to prevent sensitive data from being shared externally via email. You need to configure a solution that automatically scans outgoing emails for credit card numbers and blocks them if detected. What should you use?

A.Microsoft Defender for Office 365 Safe Attachments policy

B.Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online

C.Microsoft Intune App Protection policy

D.Microsoft Entra ID Conditional Access policy

AnswerB

A Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online is specifically engineered to identify, monitor, and protect sensitive information sent via email. These policies utilize sensitive information types, keywords, and content matching to detect specific data patterns, such as credit card numbers or national ID numbers, within email messages and attachments. Upon detection, the policy can enforce actions like blocking the email, encrypting it, or notifying administrators, directly preventing unauthorized data egress.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online is the correct solution because it is specifically designed to inspect email content and attachments for sensitive data types, such as credit card numbers, using built-in sensitive info types. When a match is detected, the policy can automatically block the email from being sent externally, enforcing the organization's data protection requirements without manual intervention.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Office 365 (which handles malware and phishing) with Microsoft Purview DLP (which handles data protection), leading them to select the security-focused option instead of the compliance-focused one.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Office 365 Safe Attachments policy focuses on scanning email attachments for malware and malicious content, not on detecting sensitive data like credit card numbers. Option C is wrong because Microsoft Intune App Protection policy manages data protection at the app level on mobile devices, not email transport-level scanning for sensitive content. Option D is wrong because Microsoft Entra ID Conditional Access policy controls access to applications based on user, device, and location conditions, but does not inspect email content or block outgoing messages based on data patterns.

Practice this question →

201

MCQeasy

A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They want to improve their secure score. What should they do?

A.Implement the security recommendations

B.Remove all virtual machines from the subscription

C.Increase the Azure budget

D.Disable Microsoft Defender for Cloud

AnswerA

Implementing the security recommendations provided by Microsoft Defender for Cloud directly addresses identified vulnerabilities and misconfigurations within your Azure environment. Each recommendation, when remediated, contributes points towards your secure score, reflecting an improved security posture by aligning resources with best practices and security controls. This is the primary mechanism for actively enhancing the secure score and reducing your attack surface.

Why this answer

The secure score is calculated based on the implementation of security recommendations provided by Microsoft Defender for Cloud. By implementing these recommendations, the company improves their security posture and increases their secure score. Option B is incorrect because simply removing virtual machines does not address underlying security issues and may not improve the score.

Option C is incorrect because increasing the Azure budget does not directly impact the secure score; the score depends on security configurations, not spending. Option D is incorrect because disabling Microsoft Defender for Cloud would remove the security assessments and recommendations, leading to a lower or unavailable secure score.

Practice this question →

202

MCQmedium

Your organization uses Microsoft Purview to label and protect sensitive data. The compliance team wants to automatically apply a 'Confidential' label to documents containing personally identifiable information (PII) stored in SharePoint Online. What should they create?

A.A DLP policy to detect PII

B.A trainable classifier for PII

C.A retention label policy for PII

D.An auto-labeling policy for sensitivity labels

AnswerD

An auto-labeling policy for sensitivity labels is the precise mechanism within Microsoft Purview designed to automatically apply sensitivity labels to content that contains specific sensitive information types, such as PII. These policies scan content in designated locations (e.g., SharePoint, OneDrive, Exchange) and, upon detecting PII, automatically apply the configured sensitivity label. This label then enforces the associated protection actions, including encryption, visual markings, and access restrictions, thereby directly addressing the requirement to label and protect.

Why this answer

An auto-labeling policy for sensitivity labels in Microsoft Purview can automatically apply a 'Confidential' label to documents containing PII in SharePoint Online. This policy uses pattern-based detection (e.g., regex for PII like Social Security numbers) to classify and protect content at rest, aligning with the compliance team's requirement to label sensitive data automatically.

Exam trap

The trap here is confusing DLP policies (which detect and block) with auto-labeling policies (which classify and protect), leading candidates to choose A instead of D.

How to eliminate wrong answers

Option A is wrong because a DLP policy detects and protects sensitive data (e.g., blocking sharing) but does not automatically apply sensitivity labels; it enforces rules after detection. Option B is wrong because a trainable classifier uses machine learning to identify content patterns (e.g., PII) but does not apply labels; it is a component used within auto-labeling or DLP policies. Option C is wrong because a retention label policy manages data retention and deletion, not sensitivity classification; it does not apply 'Confidential' labels for protection.

Practice this question →

203

MCQmedium

A security analyst needs to query Microsoft 365 audit logs to find all activities where a user deleted a file from SharePoint Online in the last 24 hours. Which tool should they use?

A.Microsoft Sentinel

B.Microsoft Purview compliance portal audit search

C.Microsoft Graph PowerShell

D.Microsoft Defender for Cloud Apps

AnswerB

The Microsoft Purview compliance portal audit search provides the native, centralized, and most user-friendly interface for security analysts to query Microsoft 365 audit logs. This dedicated portal allows for comprehensive searching across various services like Exchange Online, SharePoint Online, Teams, and Azure AD, offering extensive filtering capabilities by date, user, activity, and workload. It is specifically designed for investigative purposes, enabling efficient identification of specific user or administrator actions without requiring complex scripting.

Why this answer

Microsoft Purview compliance portal audit search is the correct tool because it provides a dedicated, searchable interface for querying the Microsoft 365 unified audit log. This log records all user and admin activities, including file deletions from SharePoint Online, and supports time-based filters (e.g., last 24 hours) to retrieve specific events. It is purpose-built for compliance and security investigations without requiring additional licensing or complex scripting.

Exam trap

The trap here is that candidates may confuse Microsoft Sentinel (a SIEM) with a simple audit log search tool, but Sentinel is designed for advanced threat detection and correlation, not for direct, ad-hoc queries of the unified audit log without additional setup.

How to eliminate wrong answers

Option A is wrong because Microsoft Sentinel is a cloud-native SIEM that ingests audit logs from multiple sources, but it requires additional licensing and configuration to query Microsoft 365 audit logs; it is not the direct tool for a simple audit log query. Option C is wrong because Microsoft Graph PowerShell can retrieve audit log data via cmdlets like Search-UnifiedAuditLog, but it requires PowerShell scripting and module installation, making it less straightforward than the Purview portal for a one-off query. Option D is wrong because Microsoft Defender for Cloud Apps focuses on cloud app discovery, session controls, and anomaly detection, not on directly querying the unified audit log for historical file deletion events.

Practice this question →

204

MCQmedium

A company uses Microsoft 365 and allows employees to access corporate email and documents from their personal devices. The security team wants to protect against malicious links in emails and Microsoft Teams messages. When a user clicks a link, it should be checked in real-time to see if it leads to a known malicious site. If it does, access should be blocked. Which Microsoft security solution provides this capability?

A.Microsoft Defender for Endpoint

B.Microsoft Defender for Office 365

C.Microsoft Defender for Cloud Apps

D.Microsoft Defender for Identity

AnswerB

Microsoft Defender for Office 365 is the correct solution as it specifically provides advanced protection against phishing, spam, malware, and other threats delivered via email and collaboration tools like Microsoft Teams. Its key features, Safe Links and Safe Attachments, are designed to perform real-time scanning of URLs and attachments. Safe Links rewrites and scans URLs at the time of click, while Safe Attachments detonates suspicious files in a sandbox environment, directly addressing the need for real-time URL scanning in email and Teams.

Why this answer

Microsoft Defender for Office 365 includes Safe Links, which provides real-time URL scanning at the time of click. When a user clicks a link in an email or Teams message, the URL is rewritten and checked against a dynamic list of known malicious sites. If the link is determined to be malicious, access is blocked, and the user is redirected to a warning page.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Office 365 (which handles email and collaboration security) with Microsoft Defender for Endpoint (which handles device-level threats), leading them to choose the endpoint solution for a link-scanning scenario.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR), antivirus, and device-level threat protection, not on scanning links in email or Teams messages. Option C is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that provides visibility and control over cloud app usage, but it does not perform real-time link scanning in email or Teams. Option D is wrong because Microsoft Defender for Identity monitors on-premises Active Directory signals to detect identity-based attacks, such as lateral movement or privilege escalation, and does not inspect links in communications.

Practice this question →

205

MCQeasy

You are the security administrator for a company using Microsoft Defender XDR. A user reports receiving a suspicious email with a link. What Microsoft Defender XDR feature should you use to investigate the email's threat level?

A.Email & collaboration in Microsoft Defender XDR

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Cloud Apps

D.Microsoft Defender for Identity

AnswerA

Email & collaboration in Microsoft Defender XDR provides robust, integrated protection for email and collaboration tools like Microsoft Teams, identifying and mitigating threats such as phishing, malware, and spam. It unifies threat investigation and response capabilities across these communication vectors within a single portal, enabling security administrators to proactively defend against sophisticated email-borne attacks and ensure data integrity.

Why this answer

Microsoft Defender XDR's Email & collaboration feature (part of Defender for Office 365) is the correct tool for investigating a suspicious email. It provides a unified investigation experience, including threat explorer, email entity pages, and detonation analysis, allowing you to inspect the email's headers, attachments, URLs, and determine its threat level using Microsoft's threat intelligence and machine learning models.

Exam trap

The trap here is that candidates often confuse the broad 'Microsoft Defender XDR' umbrella with its specific components, mistakenly selecting a different Defender product (like Endpoint or Identity) instead of recognizing that email investigation is handled by the Email & collaboration workload within Defender for Office 365.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for devices, not email investigation; it would not provide email-specific threat analysis. Option C is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that monitors cloud application usage and data, not email messages or links. Option D is wrong because Microsoft Defender for Identity protects on-premises Active Directory identities using behavioral analytics and alerts on identity-based attacks, not email threat investigation.

Practice this question →

206

MCQmedium

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?

A.A device compliance policy

B.A conditional access policy

C.A device configuration policy

D.An app protection policy

AnswerB

A conditional access policy is the correct mechanism because it acts as the enforcement engine, evaluating various signals including the device's compliance status reported by Intune. This policy can be configured to explicitly require that a device be marked as 'compliant' before granting access to specific cloud applications or services. It effectively bridges device health with access control decisions, ensuring only trusted devices can reach sensitive data.

Why this answer

Conditional Access policies in Azure AD evaluate signals (like device compliance status reported by Intune) to enforce access controls. By configuring a Conditional Access policy that requires device compliance for the Exchange Online or corporate email app, only devices marked as compliant by Intune will be granted access. This is the correct mechanism to gate access based on compliance.

Exam trap

The trap here is that candidates confuse a device compliance policy (which only evaluates and marks compliance) with a Conditional Access policy (which enforces the access decision based on that compliance status), leading them to select option A instead of B.

How to eliminate wrong answers

Option A is wrong because a device compliance policy defines the rules (e.g., requiring encryption or a minimum OS version) that a device must meet to be considered compliant, but it does not enforce access control itself—it only marks the device as compliant or non-compliant. Option C is wrong because a device configuration policy manages device settings (e.g., Wi-Fi profiles, certificates) but does not evaluate or enforce compliance-based access to email. Option D is wrong because an app protection policy (MAM) manages data protection within apps (e.g., preventing copy-paste) and does not check device compliance; it applies even to unmanaged devices.

Practice this question →

207

MCQeasy

Your company uses Microsoft Intune to manage devices. You need to ensure that only devices that are compliant with your security policies can access corporate email via Microsoft Outlook. What should you implement?

A.Windows Information Protection

B.Device compliance policies

C.App protection policies

D.Conditional Access policies

AnswerD

Conditional Access policies in Azure Active Directory are the robust control plane for enforcing access decisions to cloud applications, including email, based on various signals. These policies evaluate conditions such as user identity, location, application, and crucially, the device's compliance status as reported by Intune. Based on this evaluation, Conditional Access can grant access, block access, or require additional authentication methods, making it the definitive mechanism for enforcing access control based on device compliance.

Why this answer

Conditional Access policies (D) are the correct choice because they evaluate device compliance status—determined by Intune compliance policies—as a condition for granting access. By configuring a Conditional Access policy that requires compliant devices, only devices meeting your security policies can authenticate to Microsoft Outlook and access corporate email. This is the Azure AD/Entra ID mechanism that enforces access control based on compliance state.

Exam trap

The trap here is that candidates confuse device compliance policies (which only define and report compliance) with Conditional Access (which enforces access decisions based on that compliance state), leading them to select Option B instead of D.

How to eliminate wrong answers

Option A is wrong because Windows Information Protection (WIP) is a data-loss prevention technology that protects corporate data on devices by separating personal and business data, but it does not control which devices can access email based on compliance. Option B is wrong because Device compliance policies define the security requirements (e.g., encryption, OS version) and mark devices as compliant or non-compliant, but they do not themselves block or allow access to email—they only generate a compliance state that must be enforced by another service. Option C is wrong because App protection policies (MAM) protect data at the app level (e.g., preventing copy/paste from Outlook) and do not evaluate device compliance or control initial access to corporate email based on device health.

Practice this question →

208

MCQhard

You are reviewing a Microsoft Purview DLP policy rule represented in JSON. What is the effect of this rule?

A.It blocks the sending of an email if it contains 10 or more credit card numbers with high confidence

B.It notifies the user when a single credit card number is detected in email

C.It triggers a policy tip when a single credit card number is detected

D.It blocks access to a SharePoint site containing credit card numbers

AnswerA

This option accurately describes a Microsoft Purview DLP policy configured to prevent data exfiltration. The policy rule is set to detect the presence of 10 or more credit card numbers, identified with a high confidence level, within an email message. Upon this condition being met, the specified action is to block the sending of that email, ensuring sensitive data remains within organizational boundaries.

Why this answer

The JSON rule defines a condition where the DLP policy blocks email transmission when the count of credit card numbers detected with high confidence meets or exceeds 10. The 'BlockAccess' action in the rule enforces this by preventing the email from being sent, and the 'NotifyUser' action with 'NotifyOnly' set to false ensures the user is notified of the block. This matches the behavior of a Microsoft Purview DLP policy that uses a threshold-based condition with high confidence to block sensitive data sharing.

Exam trap

The trap here is that candidates often confuse the 'NotifyUser' action with a simple policy tip or notification, overlooking that the 'BlockAccess' action combined with a threshold count (10) means the email is blocked, not just flagged, and that the rule is scoped to Exchange, not SharePoint.

How to eliminate wrong answers

Option B is wrong because the rule specifies a minimum count of 10 credit card numbers (via the 'Count' parameter set to 10), not a single instance, and the action is 'BlockAccess' with notification, not merely a notification without blocking. Option C is wrong because a policy tip is a type of notification that appears in Outlook or other apps, but the rule's 'NotifyUser' action with 'NotifyOnly' set to false indicates a block occurs, not just a tip; a policy tip alone would require 'NotifyOnly' set to true. Option D is wrong because the rule's 'Location' is set to 'Exchange' (email), not SharePoint; DLP policies are location-specific, and this rule applies to email transport, not SharePoint site access.

Practice this question →

209

Multi-Selecthard

An organization uses Microsoft Purview Audit to meet compliance requirements. Which TWO types of audit logs can be accessed?

Select 2 answers

A.Windows Security event logs

B.Azure Active Directory audit logs

C.Purview advanced audit logs

D.Microsoft 365 unified audit log

E.Azure SQL Database audit logs

AnswersC, D

Purview advanced audit logs represent an enhanced set of auditing capabilities available with specific Microsoft 365 E5 compliance licenses. These logs provide higher fidelity events, such as detailed mailbox item access or eDiscovery search activities, and offer extended audit log retention periods up to 10 years. They are integral to advanced forensic investigations and meeting stringent regulatory compliance requirements, building upon the foundational unified audit log.

Why this answer

Microsoft Purview Audit provides two primary audit log access methods: the Microsoft 365 unified audit log, which aggregates audit records from various Microsoft 365 services, and Purview advanced audit logs, which offer extended retention (up to 10 years) and high-value events like investigation of privileged access. These two options directly correspond to the core audit capabilities within Purview for compliance requirements.

Exam trap

The trap here is that candidates confuse Azure AD audit logs (which are part of Azure Monitor) with the Microsoft 365 unified audit log (which is part of Purview), leading them to select Option B as a correct answer when it is actually a separate service.

Practice this question →

210

Multi-Selecteasy

Which TWO Microsoft Purview solutions can help detect and prevent data exfiltration?

Select 2 answers

A.Microsoft Purview Insider Risk Management

B.Microsoft Purview Audit

C.Microsoft Purview Data Loss Prevention

D.Microsoft Purview Compliance Manager

E.Microsoft Purview eDiscovery

AnswersA, C

Microsoft Purview Insider Risk Management proactively detects and acts on malicious or inadvertent insider activities that could lead to data exfiltration. It leverages machine learning and behavioral analytics across Microsoft 365 services to identify unusual or risky user behaviors, such as downloading large amounts of sensitive data or sharing it externally, providing alerts and enabling remediation actions to prevent data loss.

Why this answer

Microsoft Purview Insider Risk Management (A) is correct because it uses behavioral analytics and machine learning to identify risky user activities that may indicate data exfiltration, such as copying files to unauthorized cloud services or external devices. Microsoft Purview Data Loss Prevention (DLP) (C) is correct because it enforces policies that inspect content in transit and at rest, blocking or alerting on sensitive data being shared outside the organization via email, endpoints, or cloud apps.

Exam trap

The trap here is that candidates may confuse Microsoft Purview Audit (logging) with a detection or prevention capability, or assume Compliance Manager or eDiscovery have a security monitoring role, when in fact they serve compliance and legal functions respectively.

Practice this question →

211

MCQmedium

Your organization recently deployed Microsoft Defender for Cloud Apps. You need to identify which users are using a personal Dropbox account to access corporate files. Which feature should you use?

A.Activity policies

B.Cloud Discovery

C.File policies

D.App permissions

AnswerB

Cloud Discovery is a core capability of Microsoft Defender for Cloud Apps (MDCA) that analyzes traffic logs from firewalls and proxies to identify all cloud services accessed by users in an organization. It provides comprehensive visibility into shadow IT by detecting unsanctioned cloud applications, assessing their risk levels, and generating reports that help administrators understand usage patterns and potential security or compliance gaps.

Why this answer

B is correct because Cloud Discovery in Microsoft Defender for Cloud Apps analyzes traffic logs from your network to identify shadow IT usage, including users accessing personal Dropbox accounts from corporate devices. It uses anonymized data from Microsoft Intelligent Security Graph to detect unsanctioned cloud apps and map user activity, enabling you to pinpoint which users are bypassing corporate storage policies.

Exam trap

The trap here is that candidates confuse Cloud Discovery (which identifies unsanctioned app usage) with Activity policies (which monitor actions within already-sanctioned apps), leading them to choose A because they think monitoring user actions is sufficient to detect personal account use.

How to eliminate wrong answers

Option A is wrong because Activity policies monitor and respond to specific user actions (e.g., multiple failed logins) but do not discover unknown cloud apps or identify personal account usage. Option C is wrong because File policies focus on detecting and protecting sensitive content within sanctioned apps (e.g., files containing credit card numbers), not on discovering unsanctioned app usage like personal Dropbox. Option D is wrong because App permissions manage OAuth token grants for third-party apps connected to Microsoft 365, not the detection of personal cloud storage accounts.

Practice this question →

212

MCQmedium

A company uses Microsoft Sentinel for security operations. They want to automatically create an incident and assign it to a senior analyst when a high-severity alert is generated. Which feature should they use?

A.Analytics rule

B.Automation rule

C.Workbook

D.Playbook

AnswerB

Automation rules are a core component of Microsoft Sentinel's Security Orchestration, Automation, and Response (SOAR) capabilities, enabling automated responses to alerts and incidents. They can be configured to automatically create incidents from incoming alerts, apply specific tags, change the incident status, and assign the incident to a designated owner or group. This direct capability to create and assign incidents makes them the correct choice for streamlining security operations.

Why this answer

Automation rules in Microsoft Sentinel allow you to automatically trigger incident creation, assignment, and other actions when an alert is generated. By configuring an automation rule with a condition for high-severity alerts, you can set it to create an incident and assign it to a specific senior analyst, streamlining the response process.

Exam trap

The trap here is that candidates often confuse playbooks with automation rules, thinking playbooks are required for incident creation, when in fact automation rules can directly create and assign incidents without needing a playbook.

How to eliminate wrong answers

Option A is wrong because analytics rules are used to generate alerts based on data queries, not to automate incident creation or assignment after an alert is generated. Option C is wrong because workbooks are visualization tools for dashboards and reports, not for automating incident workflows. Option D is wrong because playbooks are automated response workflows (often using Azure Logic Apps) that can be triggered by automation rules, but they are not the feature that directly creates and assigns incidents; automation rules handle that initial incident creation and assignment.

Practice this question →

213

MCQmedium

You are a security administrator for a company that uses Microsoft 365. The company has a Microsoft Purview Data Loss Prevention (DLP) policy that blocks sharing of Social Security Numbers (SSNs) externally. Recently, a user accidentally sent an email containing SSNs to an external partner after overriding the policy by selecting a business justification. Management wants to prevent users from overriding the policy for SSNs. You need to update the DLP policy to ensure that users cannot override the block for SSNs. What should you do?

A.Modify the rule to set 'Allow override' to 'No' in the policy tip configuration.

B.Increase the rule priority to ensure it is enforced before other rules.

C.Remove the policy tip from the rule to prevent users from overriding.

D.Change the action from 'Block with override' to 'Block' and remove the policy tip.

AnswerA

Setting 'Allow override' to 'No' within the policy tip configuration directly controls the user's ability to bypass a Data Loss Prevention (DLP) policy. This specific setting removes the 'override' button or option from the policy tip presented to the user, effectively preventing them from providing a business justification to proceed with a blocked action. This ensures strict enforcement while still providing the user with crucial information about the policy violation, aligning with best practices for user education.

Why this answer

The 'Allow override' setting in the policy tip configuration directly controls whether users can bypass a DLP block action by providing a business justification. Setting this to 'No' prevents any override for the rule that blocks SSNs, ensuring that the block is enforced without exception. This is the specific mechanism in Microsoft Purview DLP to disable user overrides for a given rule.

Exam trap

The trap here is that candidates may think removing the policy tip or changing the action to 'Block' is necessary, but the correct approach is to keep the policy tip and disable the override setting, which is a subtle but distinct configuration in the DLP rule properties.

How to eliminate wrong answers

Option B is wrong because increasing rule priority only affects the order in which rules are evaluated, not the ability to override a rule; it does not change the override behavior. Option C is wrong because removing the policy tip would hide the notification from users, but the underlying 'Block with override' action would still allow override via other methods (e.g., Outlook client override prompts). Option D is wrong because changing the action to 'Block' and removing the policy tip would indeed prevent override, but this is not the intended method—the correct approach is to keep the policy tip and set 'Allow override' to 'No', which maintains user awareness while disabling the override capability.

Practice this question →

214

MCQeasy

Your company uses Microsoft Intune to manage mobile devices. You need to ensure that company data on personal devices is protected if the device is lost or stolen. What should you configure?

A.Compliance policy with device health requirements

B.Conditional Access policy requiring compliant devices

C.Full wipe action

D.Selective wipe action

AnswerD

A Selective wipe action, often referred to as "Retire" in Microsoft Intune, is the appropriate choice for removing only organizational data while preserving the user's personal information. This action specifically targets and deletes all managed company applications, data, email profiles, and VPN connections that were deployed or configured by Intune. It is ideal for scenarios where an employee leaves the company or a BYOD device is unenrolled, ensuring corporate data security without impacting personal privacy.

Why this answer

Selective wipe (Option D) is the correct configuration because it removes only corporate data from a personal device while preserving the user's personal apps, photos, and settings. In Microsoft Intune, a selective wipe targets managed app data and company email profiles via Exchange ActiveSync, leaving the device usable for personal purposes. This is the appropriate action for protecting company data on a lost or stolen BYOD device without overstepping into the user's private information.

Exam trap

The trap here is that candidates often confuse 'selective wipe' with 'full wipe' or assume that a Conditional Access policy alone can retroactively protect data already on a device, when in fact only a selective wipe actively removes company data from a lost or stolen personal device.

How to eliminate wrong answers

Option A is wrong because a compliance policy with device health requirements (e.g., requiring encryption or a minimum OS version) does not actively remove data; it only marks the device as noncompliant and can trigger Conditional Access blocks, but it does not wipe or protect data after loss. Option B is wrong because a Conditional Access policy requiring compliant devices blocks access from noncompliant devices but does not remove existing company data already stored on the device; it is a preventive control, not a remediation action. Option C is wrong because a full wipe resets the entire device to factory defaults, deleting all personal data, which is inappropriate for personal devices in a BYOD scenario and violates user privacy; it is intended for corporate-owned devices.

Practice this question →

215

MCQmedium

A company has multiple Azure virtual machines running various workloads. They want a central solution that continuously assesses their security posture, identifies vulnerabilities, and provides recommendations to harden the environment. Which Azure service should they use?

A.Azure Firewall

B.Microsoft Defender for Cloud

C.Azure DDoS Protection

D.Microsoft Sentinel

AnswerB

Microsoft Defender for Cloud is the correct solution as it offers comprehensive cloud security posture management (CSPM) and cloud workload protection (CWP) capabilities. It continuously assesses the security state of Azure Virtual Machines, identifying vulnerabilities, misconfigurations, and deviations from security best practices. It then provides actionable security recommendations, a secure score, and integrates with vulnerability assessment tools to enhance the overall security posture of the VMs and their running workloads.

Why this answer

Microsoft Defender for Cloud is the correct service because it provides continuous security posture assessment, vulnerability identification, and actionable hardening recommendations across Azure, on-premises, and multi-cloud environments. It integrates with Azure Policy and uses the Secure Score to quantify security posture, making it the central solution described in the scenario.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a posture management and workload protection platform) with Microsoft Sentinel (a SIEM/SOAR for threat detection), because both are security services under the 'Defender' umbrella, but Sentinel focuses on log-based threat hunting rather than continuous vulnerability assessment and hardening recommendations.

How to eliminate wrong answers

Option A is wrong because Azure Firewall is a stateful network firewall that filters traffic based on rules (e.g., source/destination IP, port, protocol) but does not perform continuous security posture assessment or vulnerability scanning. Option C is wrong because Azure DDoS Protection is a dedicated service that mitigates Distributed Denial-of-Service attacks at the network layer (L3/L4) and does not assess vulnerabilities or provide hardening recommendations. Option D is wrong because Microsoft Sentinel is a Security Information and Event Management (SIEM) and Security Orchestration Automated Response (SOAR) solution that ingests logs and alerts for threat detection and incident response, not a continuous posture assessment and vulnerability management tool.

Practice this question →

216

MCQmedium

A security team wants to discover which cloud applications are being used by employees, including unsanctioned file-sharing and collaboration apps. They plan to upload network traffic logs from their firewall to analyze app usage and risk levels. Which feature of Microsoft Defender for Cloud Apps should they enable?

A.App Governance

B.Cloud Discovery

C.Conditional Access App Control

D.Information Protection

AnswerB

Cloud Discovery is a core capability of Microsoft Defender for Cloud Apps that specifically ingests and analyzes network traffic logs from firewalls, proxies, or endpoint agents. Its primary purpose is to identify all cloud applications accessed by users in an organization, including unsanctioned 'shadow IT,' and to assess their associated risk scores. This process provides crucial visibility into an organization's entire cloud app landscape by revealing usage patterns and potential vulnerabilities.

Why this answer

Cloud Discovery is the correct feature because it analyzes network traffic logs (uploaded from firewalls or proxies) to identify which cloud applications are in use, including unsanctioned file-sharing and collaboration apps. It provides a risk score for each discovered app, enabling the security team to assess usage and enforce governance policies.

Exam trap

The trap here is that candidates confuse Cloud Discovery (which analyzes uploaded logs to find unsanctioned apps) with Conditional Access App Control (which enforces policies on already-discovered apps), leading them to pick Option C instead of B.

How to eliminate wrong answers

Option A is wrong because App Governance focuses on monitoring and managing OAuth-enabled apps that have access to Microsoft 365 data, not on analyzing firewall logs to discover unsanctioned cloud apps. Option C is wrong because Conditional Access App Control enforces access policies in real-time for cloud apps (e.g., blocking downloads), but it does not perform discovery of apps from uploaded traffic logs. Option D is wrong because Information Protection deals with classifying, labeling, and protecting sensitive data (e.g., via sensitivity labels), not with discovering cloud app usage from network traffic.

Practice this question →

217

MCQmedium

Your organization uses Microsoft Purview Compliance Manager to track compliance with regulatory standards. You need to create a custom assessment for a new internal policy. What should you do first?

A.Define the score calculation method for the assessment

B.Create control actions and assign them to the assessment

C.Create a custom template with your internal controls

D.Use an existing Microsoft template and modify the improvement actions

AnswerC

To effectively incorporate an organization's unique internal controls and policies into Microsoft Purview Compliance Manager, creating a custom template is the essential first step. This custom template serves as the blueprint for any subsequent custom assessment, allowing administrators to define specific control families, controls, and their associated improvement actions that align precisely with internal requirements. Without a custom template, there is no structured framework to house these unique internal controls within the Compliance Manager environment.

Why this answer

In Microsoft Purview Compliance Manager, assessments are built from templates that define the controls, improvement actions, and scoring parameters. To create a custom assessment for a new internal policy, you must first create a custom template that includes your own controls, because assessments cannot be created from scratch without a template. This template serves as the foundation for the assessment, allowing you to define the specific controls and actions that map to your internal policy.

Exam trap

The trap here is that candidates often confuse the order of operations, thinking they can directly create an assessment or modify an existing template, when the correct first step is always to create a custom template that contains the internal controls.

How to eliminate wrong answers

Option A is wrong because defining the score calculation method is a configuration step that occurs after the template and assessment are created, not the first step. Option B is wrong because control actions are assigned to controls within a template, not directly to an assessment; you must first have a template with controls defined. Option D is wrong because modifying an existing Microsoft template's improvement actions would alter the built-in regulatory template, which is not intended for custom internal policies; you should instead create a new custom template from scratch.

Practice this question →

218

MCQhard

Refer to the exhibit. The exhibit shows an alert from Microsoft Defender for Endpoint. The SOC team needs to decode the PowerShell command to understand the malicious intent. Which tool or method should they use?

A.Search for the SHA256 hash in threat intelligence feeds

B.Decrypt the command using the device's decryption keys

C.Use PowerShell script block logging to capture the decoded command

D.Decode the Base64 string using a built-in decoder or online tool

AnswerD

The `-EncodedCommand` parameter in PowerShell specifically utilizes Base64 encoding to obfuscate or transmit commands. To understand the actual actions the command intends to perform, the Base64 string must be decoded. This can be easily achieved using various built-in PowerShell cmdlets, programming language functions, or readily available online decoding tools, providing immediate insight into the attacker's intent.

Why this answer

The exhibit shows a PowerShell command encoded in Base64, which is a common obfuscation technique used by attackers to hide malicious intent. Decoding the Base64 string using a built-in decoder (e.g., `[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String()`) or an online tool directly reveals the plaintext command. This is the correct approach because Base64 is not encryption—it is an encoding scheme that can be reversed without any keys.

Exam trap

The trap here is that candidates confuse encoding (Base64) with encryption, leading them to incorrectly select 'decrypt' or 'decryption keys' when the solution is simply decoding without any cryptographic key.

How to eliminate wrong answers

Option A is wrong because searching for the SHA256 hash in threat intelligence feeds would identify known malware samples, but it does not decode the PowerShell command itself; the hash is a fingerprint of the file, not the encoded string. Option B is wrong because the command is encoded with Base64, not encrypted, so there are no decryption keys involved; decryption implies a cipher and key, which is a fundamental misunderstanding of encoding vs. encryption. Option C is wrong because PowerShell script block logging captures the decoded command after it has been executed, but the SOC team needs to decode the command before execution to understand intent; script block logging is a detection mechanism, not a decoding tool.

Practice this question →

219

Multi-Selecteasy

Which TWO are capabilities of Microsoft Intune? (Choose two.)

Select 2 answers

A.Mobile application management (MAM)

B.Identity protection

C.Security posture management

D.Data loss prevention

E.Mobile device management (MDM)

AnswersA, E

Intune's Mobile Application Management (MAM) capabilities allow organizations to manage and protect corporate data within applications, even on personal devices (BYOD) not enrolled in MDM. This includes enforcing policies like requiring a PIN for app access, preventing copy/paste of corporate data to personal apps, and encrypting data at rest within the app container. MAM ensures data security and compliance without requiring full device control.

Why this answer

Microsoft Intune is a cloud-based endpoint management solution that provides both Mobile Device Management (MDM) and Mobile Application Management (MAM). MDM allows administrators to enroll, configure, and secure devices (e.g., enforce PIN policies, wipe lost devices), while MAM enables management of applications and their data on both enrolled and unenrolled devices (e.g., restrict copy/paste between managed apps). These are the two core capabilities of Intune.

Exam trap

The trap here is that candidates often confuse Intune's capabilities with those of other Microsoft security solutions, such as associating Identity Protection (Entra ID) or DLP (Purview) with Intune, because all are part of the Microsoft security ecosystem but serve distinct functions.

Practice this question →

220

MCQmedium

A security administrator receives an alert about a suspicious sign-in from an unfamiliar location. The user verified the sign-in as legitimate. Which Microsoft Entra ID feature should be used to reduce false positives for this user?

A.Passwordless authentication

B.Privileged Identity Management

C.Identity Protection confirm user safe

D.Conditional Access policies

AnswerC

The "Confirm user safe" action within Microsoft Entra Identity Protection is specifically designed to address false-positive risk detections. When a security administrator confirms a user is safe, it signals to the Identity Protection risk engine that the detected activity was legitimate and not a compromise. This action effectively dismisses the current risk event and helps refine the machine learning model, preventing similar future legitimate activities from generating new alerts for that specific user.

Why this answer

Microsoft Entra ID Identity Protection's 'Confirm user safe' feature allows administrators to manually override a risk detection when a user confirms a suspicious sign-in was legitimate. This reduces false positives by telling Identity Protection to ignore that specific risk event for that user, preventing future alerts based on the same detection.

Exam trap

The trap here is that candidates confuse Conditional Access policies (which can block or challenge sign-ins based on risk) with Identity Protection's manual risk remediation actions like 'Confirm user safe', but Conditional Access does not provide a way to retroactively dismiss a false positive alert.

How to eliminate wrong answers

Option A is wrong because passwordless authentication (e.g., Windows Hello for Business, FIDO2 security keys) eliminates passwords but does not provide a mechanism to confirm a suspicious sign-in as safe or reduce false positives from risk detections. Option B is wrong because Privileged Identity Management (PIM) manages just-in-time access and approval workflows for privileged roles, not the ability to dismiss or confirm risk detections for sign-in anomalies. Option D is wrong because Conditional Access policies enforce access controls (e.g., require MFA, block locations) based on conditions, but they do not include a 'confirm safe' action to reduce false positives after a sign-in has been flagged.

Practice this question →

221

MCQmedium

A company runs workloads in Microsoft Azure and in Google Cloud Platform (GCP). The security team needs a single dashboard to view the security posture of both cloud environments, get recommendations for misconfigurations based on best practices, and track compliance with industry standards such as ISO 27001 and PCI DSS. Which Microsoft security solution should they use?

A.Microsoft Defender for Cloud

B.Microsoft Sentinel

C.Microsoft Defender for Cloud Apps

D.Microsoft Defender for Endpoint

AnswerA

Defender for Cloud provides multicloud security posture management, including recommendations and compliance dashboards across Azure, AWS, and GCP.

Why this answer

Microsoft Defender for Cloud is the correct solution because it provides a unified dashboard for assessing and improving the security posture of multicloud environments, including Azure and GCP. It offers continuous assessment against best practices (e.g., the Microsoft cloud security benchmark), generates actionable recommendations for misconfigurations, and tracks compliance with industry standards like ISO 27001 and PCI DSS through built-in regulatory compliance dashboards.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel (a SIEM for threat detection) with Defender for Cloud (a CSPM for posture management), because both appear under the 'Microsoft security solutions' umbrella and both can ingest data from multiple clouds, but Sentinel is not designed for compliance tracking or misconfiguration recommendations.

Why the other options are wrong

Microsoft Sentinel is a SIEM/SOAR solution for security analytics and threat detection, not a dashboard for multi-cloud security posture management, misconfiguration recommendations, or compliance tracking against standards like ISO 27001 and PCI DSS.

Microsoft Defender for Endpoint focuses on endpoint protection (antivirus, EDR) for devices, not on multi-cloud security posture management, compliance tracking, or misconfiguration recommendations across Azure and GCP.

Practice this question →

222

MCQeasy

A company wants to deploy a single security operations portal that provides a unified view of alerts and incidents from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. Which Microsoft portal should the security team use?

A.Azure Portal

B.Microsoft 365 Defender portal

C.Microsoft 365 admin center

D.Azure Active Directory admin center

AnswerB

This portal serves as the unified Extended Detection and Response (XDR) hub, consolidating security alerts, incidents, and advanced hunting capabilities across Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Microsoft Defender for Cloud Apps. It provides security operations teams with a single-pane-of-glass view to investigate, analyze, and respond to threats across the entire digital estate, enabling comprehensive incident management and automated remediation.

Why this answer

The Microsoft 365 Defender portal (https://security.microsoft.com) is the correct answer because it provides a unified security operations center (SOC) experience, aggregating alerts and incidents from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This portal enables security teams to triage, investigate, and respond to cross-domain threats in a single pane of glass, leveraging automated incident correlation and advanced hunting capabilities.

Exam trap

The trap here is that candidates often confuse the Microsoft 365 Defender portal with the Azure Portal or the Microsoft 365 admin center, mistakenly thinking that security alerts are managed in the same place as Azure resources or tenant administration, when in fact the security portal is a dedicated, cross-workload console.

How to eliminate wrong answers

Option A is wrong because the Azure Portal (https://portal.azure.com) is designed for managing Azure resources, subscriptions, and services like Azure Security Center or Azure Sentinel, not for providing a unified view of Microsoft 365 Defender workloads. Option C is wrong because the Microsoft 365 admin center (https://admin.microsoft.com) is used for tenant-level administrative tasks such as user management, licensing, and service configuration, not for security incident response or alert aggregation. Option D is wrong because the Azure Active Directory admin center (https://aad.portal.azure.com) focuses on identity and access management, including user accounts, groups, and conditional access policies, and does not consolidate security alerts from Defender products.

Practice this question →

223

MCQhard

A company uses Microsoft Defender for Cloud to secure its hybrid cloud workload. The security team needs to ensure that all virtual machines (VMs) have Just-In-Time (JIT) VM access enabled. What should they use to enforce this across subscriptions?

A.Assign an Azure Policy initiative that requires JIT VM access

B.Use Azure Blueprints to deploy JIT access configuration

C.Enable the Defender for Cloud servers plan

D.Implement a Secure Score recommendation for JIT access

AnswerA

Assigning an Azure Policy initiative is the most effective method for enforcing Just-in-Time (JIT) VM access across an Azure environment. An initiative groups multiple policy definitions, allowing for comprehensive governance and consistent application of security controls. When assigned, it can audit for non-compliant resources and automatically remediate them to ensure all virtual machines adhere to the JIT access requirement, thereby significantly reducing the attack surface.

Why this answer

Azure Policy can enforce JIT VM access via a built-in initiative. Assigning an Azure Policy initiative across subscriptions ensures that any VM without JIT VM access enabled is non-compliant and can be remediated. Option B (Azure Blueprints) is an orchestration tool that can deploy resources but does not enforce configuration across subscriptions at scale.

Option C (Defender for Cloud servers plan) enables security features but does not enforce specific settings like JIT. Option D (Secure Score recommendations) is advisory and does not enforce compliance.

Practice this question →

224

MCQmedium

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. You need to prevent users from sharing credit card numbers in emails to external recipients. Which DLP rule action should you configure?

A.Audit the activity only

B.Allow the message but notify the user

C.Block the message from being sent

D.Allow the message with a policy tip

AnswerC

Choosing "Block the message from being sent" is the most direct and effective action within a Microsoft Purview Data Loss Prevention (DLP) policy to prevent sensitive data from leaving the organization. When this action is triggered, the email containing the identified sensitive information is immediately quarantined or rejected, ensuring it never reaches its intended external recipient. This directly fulfills the objective of data loss prevention by physically stopping the unauthorized transmission of critical data.

Why this answer

Microsoft Purview DLP allows you to configure rule actions that enforce protective measures. When you need to prevent users from sharing credit card numbers in emails to external recipients, the 'Block the message from being sent' action stops the email from being delivered, ensuring the sensitive data is not leaked. This action can be combined with a notification or override option, but the core enforcement is blocking the message.

Exam trap

The trap here is that candidates often confuse 'Block the message' with 'Allow with policy tip' because they think a warning is sufficient, but the question explicitly requires preventing the sharing, which only a block action achieves.

How to eliminate wrong answers

Option A is wrong because 'Audit the activity only' merely logs the event for review without preventing the email from being sent, which does not meet the requirement to block sharing. Option B is wrong because 'Allow the message but notify the user' permits the email to be delivered while only sending a notification, failing to stop the data leak. Option D is wrong because 'Allow the message with a policy tip' shows a warning to the user but still allows the email to be sent, which does not enforce the block.

Practice this question →

225

MCQeasy

Your organization wants to use Microsoft Entra ID to require multi-factor authentication (MFA) for all users when accessing a financial application. What should you configure?

A.Identity Protection policy

B.Conditional Access policy

C.Per-user MFA

D.MFA registration policy

AnswerB

Conditional Access policies are the control plane for access decisions in Microsoft Entra ID, allowing administrators to define specific conditions under which users can access resources. These policies can explicitly mandate controls like 'Require multifactor authentication' for specific users, groups, applications, or locations. This makes them the definitive tool for enforcing MFA requirements across an organization based on defined criteria and is the recommended modern approach.

Why this answer

Conditional Access policies in Microsoft Entra ID allow you to enforce MFA based on specific conditions, such as the application being accessed (the financial app). This is the correct, modern approach to require MFA for a specific application rather than for all sign-ins globally. It provides granular control by evaluating signals like user, device, location, and application before granting access.

Exam trap

The trap here is that candidates confuse the purpose of Identity Protection policies (risk-based) with Conditional Access policies (condition-based), or they mistakenly think Per-user MFA is the only way to enforce MFA for a specific app, when in fact it applies globally to all apps for that user.

How to eliminate wrong answers

Option A is wrong because Identity Protection policies are specifically designed to detect and respond to risky user behaviors (e.g., leaked credentials, anonymous IP addresses) and can trigger MFA automatically based on risk level, but they are not used to require MFA for all users accessing a specific application. Option C is wrong because Per-user MFA enforces MFA at the user account level for all applications, not for a specific application, and it lacks the conditional logic (e.g., location, device state) that Conditional Access provides; it is a legacy approach. Option D is wrong because the MFA registration policy (part of Entra ID Identity Protection) only enforces that users register for MFA, not that they actually use MFA during sign-in; it does not control when MFA is required for a specific application.

Practice this question →