CCNA Ms Security Capabilities Questions — Page 5 of 6

301

MCQmedium

A company uses Azure virtual machines (IaaS) and on-premises Windows servers. The security team needs a single solution that provides a continuous assessment of security posture, a regulatory compliance dashboard for NIST SP 800-53, and integrated threat detection for hybrid workloads (e.g., brute force attacks on SSH). Which Microsoft security solution should they use?

A.Microsoft Defender for Cloud

B.Microsoft Defender for Cloud Apps

C.Microsoft Defender for Identity

D.Microsoft Sentinel

AnswerA

Defender for Cloud offers unified CSPM and threat protection for hybrid environments, including a regulatory compliance dashboard with built-in standards like NIST SP 800-53.

Why this answer

Microsoft Defender for Cloud is the correct choice because it provides continuous assessment of security posture (via the Secure Score), a regulatory compliance dashboard with built-in standards like NIST SP 800-53, and integrated threat detection for hybrid workloads, including brute force attacks on SSH for Azure VMs and on-premises servers. It unifies these capabilities across IaaS, on-premises, and other cloud environments, making it the single solution the security team needs.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (which covers infrastructure security posture and threat detection for workloads) with Microsoft Sentinel (a SIEM), but Sentinel requires manual configuration of data connectors and workbooks to achieve the same compliance dashboard and does not provide continuous posture assessment out of the box.

How to eliminate wrong answers

Option B (Microsoft Defender for Cloud Apps) is wrong because it is a Cloud Access Security Broker (CASB) focused on shadow IT discovery, app permissions, and data protection for SaaS applications, not on infrastructure-level security posture or compliance dashboards for NIST SP 800-53. Option C (Microsoft Defender for Identity) is wrong because it is an identity-based threat detection solution that monitors on-premises Active Directory signals (e.g., Kerberos, NTLM) for attacks like pass-the-hash, not for brute force attacks on SSH or VM-level security posture. Option D (Microsoft Sentinel) is wrong because it is a Security Information and Event Management (SIEM) solution that ingests logs from multiple sources for advanced analytics and incident response, but it does not natively provide a continuous security posture assessment or a built-in regulatory compliance dashboard for NIST SP 800-53 without additional workbooks and configurations.

Practice this question →

302

MCQhard

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel. What is the most likely purpose of this query?

A.To identify successful logins after multiple failures

B.To detect privilege escalation events

C.To detect accounts that have been locked out

D.To identify potential brute-force attack attempts

AnswerD

A KQL query that aggregates and counts EventID 4625 (failed login attempts) for individual user accounts within a specific timeframe is highly effective for detecting potential brute-force attacks. A significantly elevated number of failed login attempts against a single account or a small set of accounts strongly indicates an attacker systematically trying multiple password combinations. This pattern is a hallmark of brute-force activity.

Why this answer

The query filters for Windows Event ID 4625 (failed logon) and then counts occurrences per account and source IP within a 5-minute window, keeping only those with more than 10 failures. This pattern is the classic signature of a brute-force attack, where an attacker attempts many passwords against the same account or from the same IP. Option D is correct because the query is specifically designed to identify potential brute-force attempts by aggregating failed logons.

Exam trap

The trap here is that candidates may confuse the aggregation of failed logons (Event ID 4625) with account lockout events (Event ID 4740), but the query lacks any reference to lockout status or successful logins, making brute-force detection the only logical purpose.

How to eliminate wrong answers

Option A is wrong because the query only looks at Event ID 4625 (failed logon) and does not include Event ID 4624 (successful logon) to correlate successes after failures. Option B is wrong because privilege escalation events are typically detected via Event ID 4672 (special privileges assigned to new logon) or 4688 (process creation with elevated token), not by counting failed logons. Option C is wrong because account lockouts are tracked via Event ID 4740 (account locked out), not by aggregating failed logon attempts; the query does not reference lockout events.

Practice this question →

303

MCQmedium

A security operations team needs to protect their organization's Windows 10 and Windows 11 devices from advanced persistent threats (APTs), ransomware, and fileless malware. They also require a centralized dashboard to view device security posture, investigate incidents, and perform proactive threat hunting using advanced queries. Which Microsoft security solution should they deploy?

A.Microsoft Defender for Endpoint

B.Microsoft Defender for Office 365

C.Microsoft Defender for Identity

D.Microsoft Defender for Cloud Apps

AnswerA

Microsoft Defender for Endpoint is purpose-built for comprehensive endpoint security, offering advanced capabilities like Endpoint Detection and Response (EDR), vulnerability management, and automated investigation and remediation. It provides security operations teams with the tools to proactively hunt for threats across Windows devices, respond to incidents, and maintain a strong security posture against sophisticated cyberattacks, directly addressing the need for device protection and threat hunting.

Why this answer

Microsoft Defender for Endpoint (MDE) is the correct solution because it provides endpoint detection and response (EDR) capabilities specifically designed to protect Windows 10 and Windows 11 devices against advanced persistent threats (APTs), ransomware, and fileless malware. It includes a centralized dashboard (Microsoft 365 Defender portal) for viewing device security posture, investigating incidents, and performing proactive threat hunting using advanced hunting queries based on Kusto Query Language (KQL).

Exam trap

The trap here is that candidates often confuse the scope of each Defender product, mistakenly selecting Defender for Office 365 or Defender for Identity because they see 'threat protection' in the question, but fail to recognize that the requirement specifically mentions endpoint devices (Windows 10/11) and advanced hunting queries, which are exclusive to Defender for Endpoint.

Why the other options are wrong

Microsoft Defender for Office 365 protects email and collaboration tools (Exchange, SharePoint, Teams) from threats like phishing and malware, not Windows 10/11 endpoints from APTs, ransomware, or fileless malware.

Microsoft Defender for Identity focuses on protecting on-premises Active Directory identities and detecting identity-based attacks, not on endpoint device protection against APTs, ransomware, or fileless malware.

Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that protects cloud applications, not Windows 10/11 endpoints. It does not provide device-level protection against APTs, ransomware, or fileless malware, nor does it offer a centralized dashboard for device security posture and advanced threat hunting on endpoints.

Practice this question →

304

MCQhard

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They need to prevent users from sharing credit card numbers via email, but allow sharing via Microsoft Teams messages. What should they configure?

A.Create a DLP policy scoped to Exchange Online with a block action, and a separate DLP policy scoped to Teams with an audit-only action

B.Create a single DLP policy that blocks credit card numbers in both Exchange and Teams

C.Configure an exception in the DLP policy for Teams using a rule exception

D.Use Microsoft Purview Insider Risk Management to block sharing in Teams

AnswerA

Microsoft Purview DLP policies offer granular control, allowing administrators to define distinct policies for different service locations. By creating one policy specifically scoped to Exchange Online with a "block" action and a separate policy for Microsoft Teams with an "audit-only" action, the company can precisely meet the requirement. This approach leverages DLP's ability to apply varied enforcement levels based on the communication channel, ensuring sensitive data is protected appropriately in each context.

Why this answer

Microsoft Purview DLP allows you to create separate policies scoped to different workloads. By creating a DLP policy for Exchange Online with a block action, you prevent credit card numbers from being shared via email. A separate DLP policy scoped to Microsoft Teams with an audit-only action allows sharing in Teams while still logging the activity for monitoring.

Exam trap

The trap here is that candidates assume a single DLP policy with multiple locations can have different actions per location, but in reality, the action is applied uniformly across all selected locations unless separate policies are created.

How to eliminate wrong answers

Option B is wrong because a single DLP policy scoped to both Exchange and Teams would apply the same action (block) to both workloads, which would prevent sharing in Teams as well. Option C is wrong because DLP policies do not support rule exceptions that exempt an entire workload like Teams; exceptions are typically used for specific conditions like trusted domains or IP ranges. Option D is wrong because Microsoft Purview Insider Risk Management is designed to detect and investigate risky user activities, not to enforce real-time blocking of sensitive data sharing in Teams.

Practice this question →

305

MCQhard

Your organization, Fabrikam Inc., uses Microsoft 365 E5 licenses. The security team is deploying Microsoft Purview to protect sensitive data. They need to ensure that when a user attempts to share a document containing credit card numbers with an external partner, the action is blocked and the user receives a policy tip. Additionally, the incident should be logged for investigation. You have already created a sensitivity label for credit card data and auto-labeled documents. Which Microsoft Purview feature should you configure to meet these requirements?

A.Enable Microsoft Purview Insider Risk Management to detect the sharing activity.

B.Implement Microsoft Purview Records Management with a retention label that prevents sharing.

C.Create a Data Loss Prevention (DLP) policy that applies to documents containing credit card numbers, with an action to block sharing and notify users via policy tip.

D.Configure a sensitivity label policy that blocks external sharing when the label is applied.

AnswerC

Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information such as credit card numbers across various locations. A DLP policy can be precisely configured to detect this sensitive data within documents and then automatically enforce actions like blocking external sharing. Furthermore, it can provide immediate, user-facing policy tips to educate individuals about the policy violation, making it the ideal solution for both prevention and user notification.

Why this answer

Data Loss Prevention (DLP) policies in Microsoft Purview can detect sensitive information (e.g., credit card numbers) in documents and emails, block sharing, display policy tips, and generate incident reports. Sensitivity labels alone do not enforce restrictions on sharing. Records management handles retention.

Insider risk management detects risky user activities. Audit logs record events but do not block actions.

Practice this question →

306

Multi-Selecthard

Your company uses Microsoft Purview to meet data privacy regulations. You need to discover and classify personal data stored in Azure SQL Database. Which THREE tools or features can you use?

Select 3 answers

A.Microsoft 365 compliance center

B.Azure Information Protection

C.Microsoft Purview Data Estate Insights

D.Data Classification in Azure SQL Database

E.Microsoft Purview Data Map

AnswersC, D, E

Microsoft Purview Data Estate Insights provides a comprehensive, high-level view of an organization's entire data landscape, including data sources like Azure SQL. It offers pre-built reports and metrics that highlight data classification, sensitivity label distribution, data ownership, and glossary adherence across the data estate. This enables organizations to monitor and demonstrate compliance with data privacy regulations by understanding where sensitive data resides and how it's governed.

Why this answer

Microsoft Purview Data Estate Insights (C) provides a centralized dashboard to monitor data estate health, including scanning and classification of personal data across sources like Azure SQL Database. It integrates with the Purview Data Map to track data lineage and sensitivity labels, enabling compliance with data privacy regulations.

Exam trap

The trap here is that candidates confuse Microsoft Purview's centralized data governance tools (Data Map, Data Estate Insights) with Microsoft 365 compliance center or Azure Information Protection, which are designed for different scopes and do not natively discover personal data in Azure SQL Database.

Practice this question →

307

MCQeasy

Your organization wants to automatically investigate and remediate email-based threats in Microsoft 365. Which security solution should you use?

A.Microsoft Defender for Endpoint

B.Microsoft Defender for Office 365

C.Microsoft Defender for Cloud Apps

D.Microsoft Sentinel

AnswerB

Microsoft Defender for Office 365 is specifically engineered to protect an organization from sophisticated threats in email, links, and collaboration tools like Microsoft Teams. It leverages advanced anti-phishing, anti-malware, and Safe Attachments/Safe Links technologies to detect and block threats. Crucially, it includes Automated Investigation and Response (AIR) capabilities that automatically investigate alerts, determine the scope of a threat, and take recommended or approved remediation actions for email-borne attacks, directly addressing the requirement.

Why this answer

Microsoft Defender for Office 365 is the correct solution because it is specifically designed to protect against email-based threats such as phishing, malware, and business email compromise (BEC). It provides automated investigation and remediation capabilities through features like Automated Investigation and Response (AIR) and Threat Explorer, which can automatically analyze and remediate malicious emails, attachments, and URLs in Exchange Online.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Office 365 with Microsoft Defender for Endpoint, assuming endpoint protection covers email threats, but email security is a separate workload requiring dedicated protection for Exchange Online and SharePoint Online.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Endpoint focuses on protecting endpoints (e.g., devices, servers) from threats like malware and ransomware, not on email-based threats. Option C is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that governs and protects cloud applications, not specifically email threats. Option D is wrong because Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution for enterprise-wide threat detection and response, not a dedicated email security solution.

Practice this question →

308

MCQmedium

An organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They need to ensure that when a user tries to share a document containing a credit card number externally via email, the user sees a policy tip and the email is blocked. Which DLP rule action should they configure?

A.Notify user with policy tip only

B.Block the message and notify the user with a policy tip

C.Block the message only

D.Redirect the message to the compliance admin

AnswerB

This action effectively prevents data loss by blocking the transmission of the message containing sensitive information, ensuring the policy is enforced. Simultaneously, it provides a policy tip to the user, explaining why the message was blocked and offering guidance on how to remediate the issue or comply with organizational policies. This combination both enforces security and educates the user, aligning perfectly with robust data loss prevention objectives.

Why this answer

The requirement is to both block the email and show a policy tip to the user. In Microsoft Purview DLP, the 'Block the message and notify the user with a policy tip' action enforces the block at the transport level while simultaneously displaying a customizable policy tip in Outlook or Outlook on the web, informing the user why the message was blocked. This meets the dual need of prevention and user notification.

Exam trap

The trap here is that candidates often confuse 'Notify user with policy tip only' as sufficient because it provides a warning, but they overlook the explicit requirement to block the message, which requires the combined action of blocking and notifying.

How to eliminate wrong answers

Option A is wrong because 'Notify user with policy tip only' allows the email to be sent after the user acknowledges the tip, which does not block the message as required. Option C is wrong because 'Block the message only' prevents delivery but does not show a policy tip to the user, failing the notification requirement. Option D is wrong because 'Redirect the message to the compliance admin' sends the email to an administrator for review instead of blocking it, which does not prevent the external sharing of sensitive data.

Practice this question →

309

MCQhard

A company uses Microsoft Defender for Endpoint on all workstations and Microsoft Defender for Office 365 for email protection. The security operations team wants a single console to see all incidents from both products, automatically investigate and respond to threats across endpoints and email, and integrate with Microsoft Sentinel for advanced hunting. Which Microsoft security solution should they use?

A.Microsoft 365 Defender

B.Microsoft Defender for Cloud

C.Microsoft Purview Compliance Portal

D.Microsoft Entra ID Protection

AnswerA

Microsoft 365 Defender is an Extended Detection and Response (XDR) solution that unifies security signals from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. It correlates alerts across these domains into consolidated incidents, providing a comprehensive view of attacks and enabling automated, cross-domain response actions. This integrated approach significantly enhances an organization's ability to detect, investigate, and remediate sophisticated multi-stage threats.

Why this answer

Microsoft 365 Defender is the correct solution because it provides a unified incident queue that aggregates alerts from Microsoft Defender for Endpoint and Microsoft Defender for Office 365, enabling automated investigation and response (AIR) across endpoints and email. It also natively integrates with Microsoft Sentinel for advanced hunting via the Microsoft 365 Defender connector, allowing the security operations team to correlate signals and perform cross-domain threat hunting.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (which protects cloud workloads) with Microsoft 365 Defender (which unifies endpoint, email, and identity security), leading them to select the cloud-focused option instead of the cross-workload unified solution.

Why the other options are wrong

Microsoft Defender for Cloud is designed for protecting cloud workloads (e.g., VMs, containers, SQL) across multi-cloud environments, not for unifying endpoint and email incident management or integrating with Microsoft 365 Defender's automated investigation and response.

Microsoft Purview Compliance Portal is focused on data governance, compliance, and risk management, not on unified incident management and automated response for endpoint and email threats.

Practice this question →

310

MCQeasy

A company uses Microsoft 365 and several third-party SaaS apps. The security team wants to detect when a user signs in from a remote location that is significantly far from their typical sign-in location within a very short time, indicating possible account compromise. Which Microsoft security solution should they use?

A.Microsoft Defender for Cloud Apps

B.Microsoft Defender for Identity

C.Microsoft Defender for Office 365

D.Microsoft Defender for Endpoint

AnswerA

Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing comprehensive visibility and control over both sanctioned and unsanctioned cloud applications, including Microsoft 365 and third-party SaaS. It excels at detecting anomalous user behavior through advanced analytics, such as impossible travel. This capability specifically identifies suspicious sign-ins originating from geographically disparate locations within an unusually short timeframe, directly addressing the need for detecting such anomalies across various cloud services.

Why this answer

Microsoft Defender for Cloud Apps (MDCA) provides the 'impossible travel' detection capability, which analyzes sign-in events across both Microsoft 365 and third-party SaaS apps. It uses machine learning to establish a baseline of a user's typical sign-in locations and then alerts when two sign-ins occur from geographically distant locations within a time frame that makes physical travel impossible, indicating a potential account compromise.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud Apps with Microsoft Defender for Identity, assuming identity protection covers all sign-in anomalies, but MDCA specifically handles cross-cloud app behavioral analytics like impossible travel, while Defender for Identity is limited to on-premises AD and hybrid identity threats.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Identity focuses on on-premises Active Directory and hybrid identity threats (e.g., Kerberos attacks, DCSync), not cross-SaaS sign-in anomaly detection. Option C is wrong because Microsoft Defender for Office 365 protects email and collaboration workloads (e.g., phishing, malware in attachments), not user sign-in behavior across multiple SaaS apps. Option D is wrong because Microsoft Defender for Endpoint is an endpoint detection and response (EDR) solution for devices (e.g., malware, fileless attacks), not for analyzing cloud app sign-in patterns.

Practice this question →

311

MCQeasy

Your organization wants to ensure that all external emails are automatically tagged with a disclaimer at the top of the email body. Which Microsoft Exchange Online feature should you configure?

A.Journal rule

B.Data loss prevention (DLP) policy

C.Safe Links policy

D.Mail flow rule (transport rule)

AnswerD

Mail flow rules, also known as transport rules in Exchange Online, are powerful tools that allow administrators to inspect, modify, or route email messages based on specific conditions. These rules operate at the transport layer, enabling actions such as adding disclaimers, blocking messages, encrypting content, or redirecting mail before it reaches the recipient's inbox. Applying a standardized disclaimer to all external emails is a classic and direct application of a mail flow rule's capabilities.

Why this answer

Mail flow rules (also known as transport rules) in Exchange Online allow you to inspect messages and take actions such as adding a disclaimer to the top of the email body. This rule can be scoped to apply only to external emails by using the condition 'The sender is located outside the organization'. The action 'Prepend a disclaimer' inserts the text at the beginning of the message body, meeting the requirement precisely.

Exam trap

The trap here is that candidates often confuse mail flow rules with DLP policies because both can apply conditions and actions to emails, but DLP policies cannot modify the email body with a disclaimer—they only detect and protect data.

How to eliminate wrong answers

Option A is wrong because a journal rule captures and records email communications for compliance or archival purposes, not for modifying message content like adding disclaimers. Option B is wrong because a Data Loss Prevention (DLP) policy is designed to detect and protect sensitive data (e.g., credit card numbers) and can trigger notifications or block messages, but it cannot prepend a disclaimer to the email body. Option C is wrong because a Safe Links policy protects users from malicious URLs by scanning and rewriting links in messages, not by adding disclaimers to the message body.

Practice this question →

312

MCQmedium

An organization uses Microsoft Defender for Cloud to secure its Azure workloads. They want to receive recommendations for improving the security posture of their virtual machines. What should they enable?

A.Microsoft Defender for Cloud Apps

B.Microsoft Sentinel

C.Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM)

D.Azure Policy

AnswerC

Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) continuously assesses cloud resources for misconfigurations and vulnerabilities across multi-cloud environments. It provides actionable security recommendations, prioritized by potential impact, to improve the organization's overall security posture. CSPM also includes compliance monitoring against regulatory standards and industry benchmarks, offering a unified view of security health.

Why this answer

Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) provides continuous assessment of Azure workloads, including virtual machines, against security baselines and best practices. It generates actionable recommendations to improve the security posture, such as applying missing system updates or enabling encryption. This is the correct feature for receiving VM-specific security recommendations.

Exam trap

The trap here is that candidates confuse Azure Policy (which enforces rules) with CSPM (which assesses and recommends), or they think Microsoft Sentinel (a SIEM) is needed for security recommendations, when CSPM is the dedicated posture management service.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) focused on shadow IT discovery and data protection across SaaS applications, not on providing security recommendations for Azure VMs. Option B is wrong because Microsoft Sentinel is a Security Information and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR) solution for threat detection and incident response, not a posture management tool that generates VM security recommendations. Option D is wrong because Azure Policy enforces organizational rules and compliance by applying policies (e.g., requiring a specific VM SKU), but it does not generate security posture recommendations; CSPM is the service that provides those recommendations.

Practice this question →

313

MCQmedium

An organization wants to protect against business email compromise (BEC) attacks where attackers impersonate the CEO to trick employees into transferring funds. Which Microsoft Defender for Office 365 capability should they configure to detect such impersonation?

A.Safe Attachments

B.Safe Links

C.Impersonation protection

D.Spoof intelligence

AnswerC

Impersonation protection is a critical feature within anti-phishing policies in Microsoft Defender for Office 365 specifically designed to combat Business Email Compromise (BEC) attacks. It allows administrators to define specific high-value users (e.g., executives, financial personnel) and trusted domains to monitor for impersonation attempts. The system analyzes various email headers and content attributes, such as display name, reply-to address, and sender address, to detect subtle variations that indicate an attempt to spoof a protected identity. When an impersonation is detected, the email can be quarantined, moved to junk, or have a safety tip added, directly mitigating BEC threats.

Why this answer

Impersonation protection in Defender for Office 365 is specifically designed to detect and block business email compromise (BEC) attacks where an attacker spoofs a trusted sender, such as a CEO or CFO. It uses machine learning and sender intelligence to analyze email patterns and flag messages that impersonate internal or external high-value targets, making it the correct capability for this scenario.

Exam trap

The trap here is that candidates often confuse impersonation protection (user-level) with spoof intelligence (domain-level), assuming both handle the same type of attack, but impersonation protection is the only one that detects CEO fraud by analyzing sender identity rather than just domain authentication.

How to eliminate wrong answers

Option A is wrong because Safe Attachments protects against malware by detonating attachments in a sandbox, not against impersonation-based BEC attacks. Option B is wrong because Safe Links protects users from malicious URLs in emails and Office documents by checking links at click-time, not from sender impersonation. Option D is wrong because Spoof intelligence handles domain-level spoofing (e.g., forged From addresses using similar domains) but does not cover user-level impersonation of specific individuals like a CEO.

Practice this question →

314

MCQhard

A company runs containerized applications on Azure Kubernetes Service (AKS) and stores container images in Azure Container Registry. The security team wants to automatically scan container images for vulnerabilities every time a new image is pushed to the registry and receive recommendations for remediation. Which Microsoft security solution should they enable?

A.A. Microsoft Defender for Endpoint

B.B. Microsoft Defender for Identity

C.C. Microsoft Defender for Cloud

D.D. Microsoft Defender for Office 365

AnswerC

Microsoft Defender for Cloud is the correct solution as it provides comprehensive cloud security posture management (CSPM) and cloud workload protection (CWP). Specifically, its Defender for Containers plan integrates with Azure Container Registry (ACR) and Azure Kubernetes Service (AKS) to automatically scan container images for known vulnerabilities upon push, during import, or on a recurring basis. It identifies security misconfigurations and provides actionable remediation recommendations, crucial for securing containerized applications running on Azure Kubernetes.

Why this answer

Microsoft Defender for Cloud provides integrated vulnerability assessment for container images stored in Azure Container Registry. When enabled, it automatically scans each new image pushed to the registry, identifies known vulnerabilities (using the Qualys scanner or Microsoft's own threat intelligence), and generates actionable remediation recommendations. This directly meets the security team's requirement for automated scanning and remediation guidance.

Exam trap

The trap here is that candidates confuse 'Defender for Cloud' (which covers workload protection including containers) with 'Defender for Endpoint' (which is device-focused), leading them to incorrectly select A because they think container scanning is an endpoint function.

Why the other options are wrong

Microsoft Defender for Endpoint focuses on endpoint devices (workstations, servers, mobile devices) and does not scan container images in Azure Container Registry for vulnerabilities.

Microsoft Defender for Identity focuses on detecting identity-based threats in on-premises Active Directory, not on scanning container images for vulnerabilities in Azure Container Registry.

Microsoft Defender for Office 365 protects against threats in email, Office apps, and collaboration tools, not container image vulnerability scanning in Azure Container Registry.

Practice this question →

315

MCQeasy

A security administrator is using Microsoft Defender for Cloud to improve the security posture of Azure resources. The administrator wants to view a consolidated assessment of compliance with industry standards such as CIS and NIST. Which feature should be used?

A.Regulatory compliance dashboard

B.Secure Score

C.Azure Policy

D.Microsoft Sentinel

AnswerA

The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a centralized view of an organization's compliance posture against various industry standards and regulatory benchmarks, such as CIS, NIST, and PCI DSS. It continuously assesses the environment, mapping security controls to specific requirements within these frameworks and clearly indicating which controls pass or fail. This dashboard is specifically designed to help organizations understand and improve their adherence to external regulations by offering actionable recommendations and detailed compliance reports.

Why this answer

The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a consolidated view of compliance with industry standards like CIS and NIST. It continuously assesses Azure resources against built-in compliance frameworks and displays the results in a dashboard, showing which controls are passing or failing. This directly meets the administrator's need to view a consolidated assessment of compliance with those specific standards.

Exam trap

The trap here is that candidates often confuse Secure Score (which shows overall security posture) with the Regulatory compliance dashboard (which specifically maps to industry standards), leading them to pick Secure Score when the question explicitly asks for compliance with CIS and NIST.

Why the other options are wrong

Secure Score provides a numerical rating of security posture based on security controls, but it does not offer a consolidated assessment of compliance with specific industry standards like CIS or NIST.

Azure Policy is used to enforce organizational standards and assess compliance at a resource level, but it does not provide a consolidated view of compliance with industry standards like CIS and NIST. The Regulatory compliance dashboard in Defender for Cloud is specifically designed for that purpose.

Microsoft Sentinel is a SIEM/SOAR solution for threat detection and response, not for viewing compliance assessments against industry standards like CIS and NIST.

Practice this question →

316

MCQmedium

A company uses Microsoft 365 and wants to protect users from malicious attachments in email. The security team wants a solution that detonates attachments in a sandbox environment before delivery, and only allows the email through if the attachment is deemed safe. Which Microsoft security solution should they use?

A.Microsoft Defender for Office 365

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Cloud Apps

D.Azure Firewall

AnswerA

Microsoft Defender for Office 365 is the correct solution as it provides advanced threat protection specifically for email and collaboration services within Microsoft 365. Its Safe Attachments feature proactively detonates email attachments in a secure, isolated sandbox environment before they reach user inboxes, effectively identifying and blocking malicious content, including zero-day malware. Additionally, Safe Links rewrites URLs to scan them at the time of click, further protecting users from phishing and malicious websites.

Why this answer

Microsoft Defender for Office 365 includes Safe Attachments, a feature that detonates email attachments in a virtual sandbox environment before delivery. It analyzes the attachment's behavior for malicious activity and only releases the email to the recipient's mailbox if the attachment is deemed safe, directly meeting the requirement for pre-delivery sandboxing.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Office 365 (which handles email security) with Microsoft Defender for Endpoint (which handles device security), leading them to select the wrong solution for email-specific threats.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for devices, not email attachment sandboxing. Option C is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) for controlling shadow IT and data protection across SaaS apps, not for email attachment detonation. Option D is wrong because Azure Firewall is a network-layer firewall that filters traffic based on IP/port rules, not capable of detonating email attachments in a sandbox.

Practice this question →

317

MCQmedium

A company uses Microsoft Defender for Cloud to secure its Azure resources. The security team wants to receive a single recommendation for all resources that are missing just-in-time (JIT) VM access. Which Microsoft Defender for Cloud feature should they use?

A.Regulatory compliance dashboard

B.Security recommendations

C.Inventory

D.Security alerts

AnswerB

Microsoft Defender for Cloud's security recommendations are actionable suggestions generated by continuously analyzing the security state of your Azure resources against Microsoft's security benchmarks and best practices. These recommendations, such as enabling Just-In-Time (JIT) VM access or applying adaptive application controls, directly guide users on specific steps to mitigate vulnerabilities and enhance their overall security posture. They are designed to improve the secure score and provide a prioritized list of tasks for remediation.

Why this answer

Microsoft Defender for Cloud's security recommendations feature provides a centralized list of actionable steps to improve your security posture, including a specific recommendation to enable just-in-time (JIT) VM access on all eligible virtual machines. This recommendation aggregates all resources missing JIT configuration into a single entry, allowing the security team to remediate them collectively. The other options do not aggregate missing JIT configurations into a single recommendation.

Exam trap

The trap here is that candidates confuse 'security recommendations' (proactive posture improvements) with 'security alerts' (reactive threat detections), leading them to select D because they think missing JIT is a security incident rather than a configuration gap.

How to eliminate wrong answers

Option A is wrong because the Regulatory compliance dashboard maps your Azure environment to compliance standards (e.g., SOC 2, ISO 27001) and does not provide operational recommendations like enabling JIT VM access. Option C is wrong because Inventory is a resource browser that lists all your Azure resources but does not generate or aggregate security recommendations for missing configurations. Option D is wrong because Security alerts are triggered by active threats or suspicious activities, not by the absence of a security control like JIT VM access.

Practice this question →

318

MCQhard

A company uses Azure SQL Database for a critical line-of-business application. The security team wants to enable threat protection that specifically detects and alerts on SQL injection attempts and anomalous database access patterns. Which workload protection plan should they enable within Microsoft Defender for Cloud?

A.Azure Defender for Servers

B.Azure Defender for SQL

C.Azure Defender for App Service

D.Azure Defender for Storage

AnswerB

Azure Defender for SQL is the dedicated security solution tailored for Azure SQL Database, Azure SQL Managed Instance, and SQL servers on Azure VMs or hybrid environments. It offers comprehensive vulnerability assessments to identify misconfigurations and provides advanced threat protection to detect anomalous activities, including SQL injection attacks, brute-force attempts, and suspicious access patterns. This specialized plan ensures robust security for the database layer, safeguarding sensitive data.

Why this answer

Azure Defender for SQL is the correct workload protection plan because it is specifically designed to detect and alert on SQL injection attempts and anomalous database access patterns for Azure SQL Database. It uses Microsoft's threat intelligence and machine learning to monitor database activity, providing targeted alerts for SQL-specific threats, unlike other Defender plans that focus on different resource types.

Exam trap

The trap here is that candidates may confuse Azure Defender for SQL with Azure Defender for App Service, mistakenly thinking SQL injection is a web application attack, but SQL injection targets the database layer, which is protected by the SQL-specific plan, not the App Service plan.

How to eliminate wrong answers

Option A is wrong because Azure Defender for Servers protects virtual machines and their operating systems, not Azure SQL Database, and it does not specialize in SQL injection detection. Option C is wrong because Azure Defender for App Service secures web applications and APIs, focusing on threats like DDoS or web app vulnerabilities, not database-level SQL injection. Option D is wrong because Azure Defender for Storage monitors storage accounts for anomalies like unusual access patterns or malware uploads, but it does not cover SQL databases or SQL injection attempts.

Practice this question →

319

MCQhard

A security operations center (SOC) wants to enrich their detection capabilities by automatically correlating internal network logs with external threat intelligence feeds containing known malicious IP addresses and domains. They need to ingest, normalize, and prioritize these indicators and generate alerts when matches are found. Which Microsoft security solution provides built-in capabilities for this purpose?

A.Microsoft Sentinel

B.Microsoft Defender for Cloud

C.Microsoft Defender for Endpoint

D.Microsoft 365 Defender

AnswerA

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution specifically engineered for comprehensive security operations. It offers robust capabilities for ingesting vast amounts of log data from diverse sources and natively supports integrating various external threat intelligence feeds through dedicated data connectors (e.g., TAXII, STIX, custom APIs). SOCs leverage Sentinel's analytics rules to automatically correlate these incoming threat indicators with collected log data, thereby enriching detections and enabling proactive threat hunting and response.

Why this answer

Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) solution that provides built-in capabilities to ingest logs from internal network sources, normalize them using common data models, and automatically correlate them with external threat intelligence feeds (e.g., STIX/TAXII). It can prioritize indicators based on severity and generate real-time alerts when matches are found, making it the correct choice for this SOC requirement.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel (a SIEM) with Microsoft 365 Defender (an XDR), assuming that XDR covers all security operations needs, but XDR lacks the broad log ingestion and custom threat intelligence feed integration that a SIEM provides.

How to eliminate wrong answers

Option B (Microsoft Defender for Cloud) is wrong because it is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) focused on securing cloud resources, not a SIEM for ingesting and correlating internal network logs with external threat intelligence feeds. Option C (Microsoft Defender for Endpoint) is wrong because it is an endpoint detection and response (EDR) solution that protects individual devices, not a centralized platform for ingesting diverse network logs and threat intelligence. Option D (Microsoft 365 Defender) is wrong because it is an extended detection and response (XDR) solution that correlates signals across Microsoft 365 products (e.g., email, endpoints, identities), but it lacks the broad log ingestion and custom threat intelligence feed integration capabilities of a dedicated SIEM like Sentinel.

Practice this question →

320

MCQeasy

Your company is deploying Microsoft Defender for Office 365. The security team wants to automatically remove malicious attachments from emails before they reach user inboxes. Which protection feature should be configured?

A.Anti-spam policies

B.Safe Attachments policies

C.Anti-phishing policies

D.Safe Links policies

AnswerB

Safe Attachments policies are specifically designed to protect against zero-day malware and advanced threats embedded in email attachments. This feature utilizes a cloud-based sandbox environment to detonate and analyze attachments in real-time, isolating them from the user's environment. If an attachment is deemed malicious, it is either blocked or quarantined before it can reach the recipient's inbox, preventing the execution of harmful code.

Why this answer

Safe Attachments policies in Microsoft Defender for Office 365 are specifically designed to detect and neutralize malicious attachments in email messages before they reach user inboxes. This feature uses a detonation environment to open attachments in a sandbox, analyzing their behavior for threats, and then automatically removes or replaces the attachment if it is found to be malicious.

Exam trap

The trap here is that candidates often confuse Safe Attachments with Safe Links, thinking both handle attachments, but Safe Links only protects against malicious URLs, not file attachments, while Safe Attachments is the dedicated feature for attachment-based malware protection.

How to eliminate wrong answers

Option A is wrong because anti-spam policies focus on filtering unsolicited bulk email (spam) based on sender reputation, content filters, and bulk mail thresholds, not on scanning attachments for malware. Option C is wrong because anti-phishing policies protect against deceptive messages that attempt to steal credentials or personal information, using impersonation detection and spoof intelligence, but they do not perform attachment-level malware analysis. Option D is wrong because Safe Links policies protect users from clicking on malicious URLs within emails or Office documents by checking links at time of click, not by scanning or removing attachments.

Practice this question →

321

Multi-Selecteasy

Which TWO Microsoft security solutions can be used to centrally manage security policies across hybrid environments including on-premises and cloud? (Choose TWO.)

Select 2 answers

A.Microsoft Sentinel

B.Microsoft Defender for Cloud

C.Microsoft Defender for Office 365

D.Microsoft Intune

E.Microsoft Defender for Cloud Apps

AnswersA, B

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It ingests security data from diverse sources, including Azure, other cloud providers, and on-premises infrastructure, enabling centralized threat detection, investigation, and automated response. This comprehensive capability makes it a primary tool for centralized security management across hybrid and multicloud environments.

Why this answer

Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) solution that provides centralized security analytics and threat intelligence across the entire enterprise, including on-premises and multi-cloud environments. It collects data from various sources via connectors (e.g., Azure Monitor Agent, Syslog, Windows Security Events) and allows security teams to manage policies, detect threats, and respond from a single pane of glass. This makes it a correct answer for centrally managing security policies across hybrid environments.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM/CWPP solution) with Microsoft Defender for Cloud Apps (a CASB), or mistakenly think Microsoft Defender for Office 365 covers hybrid infrastructure policies, when it only protects Microsoft 365 workloads.

Practice this question →

322

MCQhard

Your company uses Microsoft 365 Copilot to assist employees with drafting emails and documents. The security team needs to ensure that when Copilot accesses sensitive data, it respects the organization's sensitivity labels and does not expose highly confidential information to unauthorized users. What should the security team configure?

A.Configure Microsoft Defender for Cloud Apps session policies

B.Apply Microsoft Purview sensitivity labels to data and enable Copilot data protection

C.Disable Copilot for all users

D.Create a data loss prevention policy that blocks Copilot

AnswerB

Applying Microsoft Purview sensitivity labels to data is the foundational step for classifying and protecting sensitive information across Microsoft 365 applications and services. When combined with enabling Copilot data protection, this configuration ensures that Copilot respects these labels, preventing it from accessing or generating content based on data it shouldn't, or from exposing sensitive information to unauthorized users. This integration allows Copilot to operate securely within established data governance policies, leveraging AI responsibly.

Why this answer

Microsoft Purview sensitivity labels are integrated with Microsoft 365 Copilot to enforce data protection. When sensitivity labels are applied to data, Copilot respects those labels and restricts access to authorized users only. Option A is incorrect because Microsoft Defender for Cloud Apps session policies govern access to cloud apps, not Copilot's handling of labeled data.

Option C is incorrect because disabling Copilot for all users would prevent any use, not just sensitive data access. Option D is incorrect because data loss prevention policies block sharing of sensitive data but do not control Copilot's internal access to labeled content.

Practice this question →

323

MCQmedium

You are a security administrator for Contoso Ltd. The company uses Microsoft Defender XDR, Microsoft Sentinel, and Microsoft Entra ID. Recently, several users reported receiving phishing emails that bypassed the existing anti-phishing policies. The security team suspects that attackers are using sophisticated techniques to evade detection. You need to enhance the email security posture by implementing a solution that uses AI and machine learning to detect advanced phishing attempts, including those using social engineering and impersonation. Which Microsoft solution should you use?

A.Microsoft Sentinel

B.Microsoft Defender for Office 365

C.Microsoft Defender for Cloud Apps

D.Microsoft Defender for Identity

AnswerB

Microsoft Defender for Office 365 is specifically designed to protect email, collaboration, and productivity services from advanced threats like phishing, business email compromise (BEC), and malware. It employs machine learning models and detonation chambers to analyze email content, attachments, and links in real-time, identifying and blocking sophisticated phishing attempts, impersonation attacks, and zero-day exploits before they reach user inboxes. This comprehensive suite includes anti-phishing policies, Safe Attachments, and Safe Links to proactively safeguard users.

Why this answer

Microsoft Defender for Office 365 includes advanced anti-phishing capabilities with AI and machine learning, such as impersonation protection and spoof intelligence. Microsoft Sentinel is a SIEM/SOAR, not an email security solution. Defender for Cloud Apps is a CASB.

Defender for Identity identifies threats via on-premises AD signals. Microsoft Purview focuses on compliance and data governance.

Practice this question →

324

Multi-Selectmedium

Which THREE are capabilities of Microsoft Purview Data Loss Prevention (DLP)? (Choose three.)

Select 3 answers

A.Automatically classify and label data

B.Detect sensitive information in documents and emails

C.Block sharing of sensitive data with external users

D.Manage encryption keys for data at rest

E.Provide policy tips to users when they attempt to share sensitive data

AnswersB, C, E

Detecting sensitive information in documents and emails is a fundamental capability of Microsoft Purview Data Loss Prevention. DLP policies are meticulously configured to identify specific sensitive information types (SITs), such as credit card numbers, national ID numbers, or custom patterns, within content across various locations like Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. This precise detection mechanism forms the essential prerequisite for any subsequent enforcement actions, ensuring that policies target the correct data.

Why this answer

Microsoft Purview DLP is designed to detect sensitive information (e.g., credit card numbers, PII) in documents and emails by using built-in or custom sensitive information types. When a match is found, DLP can enforce policies to block sharing with external users and display policy tips to inform users of the violation, making options B, C, and E correct capabilities.

Exam trap

The trap here is that candidates confuse the automatic classification and labeling capabilities of Microsoft Purview Information Protection with the detection and enforcement actions of DLP, leading them to incorrectly select Option A as a DLP capability.

Practice this question →

325

MCQhard

A security operations center (SOC) team needs to ingest security logs from on-premises servers, Azure virtual machines, and SaaS applications like Salesforce. They want a cloud-native solution that uses machine learning to detect threats, provides a unified query language for hunting, and supports automated incident response through playbooks. Which Microsoft solution should they deploy?

A.Microsoft Defender for Cloud

B.Microsoft Sentinel

C.Microsoft 365 Defender

D.Microsoft Defender for Endpoint

AnswerB

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It is specifically designed for a Security Operations Center (SOC) team to ingest security logs from a vast array of sources, including Microsoft services, third-party applications, on-premises infrastructure, and other cloud providers. Sentinel centralizes this data for advanced threat detection using machine learning, behavioral analytics, and threat intelligence, enabling comprehensive security monitoring, hunting, and automated response playbooks.

Why this answer

Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) solution that ingests logs from on-premises servers, Azure VMs, and SaaS applications like Salesforce. It uses built-in machine learning to detect threats, offers the Kusto Query Language (KQL) for unified hunting, and supports automated incident response via playbooks built on Azure Logic Apps.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM tool) with a SIEM, or assume Microsoft 365 Defender can ingest third-party SaaS logs, but only Microsoft Sentinel provides a cloud-native SIEM with unified log ingestion, ML threat detection, and automated playbook response.

Why the other options are wrong

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and workload protection platform, not a SIEM/SOAR solution. It lacks a unified query language (KQL) for hunting across diverse data sources and does not natively support automated incident response playbooks like Sentinel.

Microsoft 365 Defender is designed to protect Microsoft 365 workloads (e.g., email, endpoints, identities) and does not natively ingest logs from on-premises servers, Azure VMs, or third-party SaaS like Salesforce, nor does it provide a unified query language (KQL) or playbook-based automated incident response.

Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for devices, not on ingesting logs from diverse sources like on-premises servers, Azure VMs, and SaaS apps, nor does it provide a unified query language (KQL) for hunting across those sources or support automated incident response playbooks.

Practice this question →

326

MCQeasy

Refer to the exhibit. You are configuring a Microsoft Entra ID group. What does the exhibit represent?

A.A dynamic security group based on department attribute.

B.A Microsoft 365 group with dynamic membership.

C.A dynamic group based on user location.

D.A static security group with assigned members.

AnswerA

The JSON clearly indicates a dynamic security group through `groupTypes` containing "Security" and "DynamicMembership". The `membershipRule` property, specifically `(user.department -eq "Sales")`, defines the criteria for automatic membership based on the user's 'department' attribute. This configuration ensures that any user whose department is "Sales" is automatically added to or removed from the group, providing efficient and attribute-driven management.

Why this answer

The exhibit shows a rule syntax of `(user.department -eq "Sales")`, which is the expression used to dynamically add or remove members based on the department attribute. This is the defining characteristic of a dynamic security group in Microsoft Entra ID, where membership is evaluated automatically when user attributes change.

Exam trap

The trap here is that candidates confuse dynamic security groups with Microsoft 365 groups, but the key differentiator is the group type (Security vs. Microsoft 365) shown in the exhibit, not the rule syntax itself.

How to eliminate wrong answers

Option B is wrong because a Microsoft 365 group with dynamic membership uses the same rule syntax but the group type is 'Microsoft 365', not 'Security'. Option C is wrong because the rule explicitly checks the `department` attribute, not `user.location` or any location-related attribute. Option D is wrong because a static security group requires manual assignment of members and does not use a membership rule expression.

Practice this question →

327

MCQmedium

Refer to the exhibit. A company has configured the above Conditional Access policy in Microsoft Entra ID. A user attempts to access Exchange Online from an untrusted location. What happens?

A.The user is granted access without MFA because the policy does not apply.

B.Access is blocked because the condition is not met.

C.The user is prompted for MFA because the policy applies to all users.

D.The user is blocked because the grant requires MFA.

AnswerA

The Conditional Access policy is specifically configured to apply *only* when a user is accessing from a "trusted location." Since the user is accessing from an *untrusted* location, the conditions of this particular policy are not met. Consequently, the policy is not enforced, and its grant controls, including the MFA requirement, are not triggered. The user is thus granted access based on default security settings or other applicable policies, without being prompted for MFA by *this* specific policy.

Why this answer

The Conditional Access policy shown in the exhibit is configured with 'Include: All users' and 'Exclude: All users'. When both include and exclude are set to 'All users', the exclusion takes precedence, effectively making the policy apply to no users. Therefore, when a user attempts to access Exchange Online from an untrusted location, the policy does not apply, and the user is granted access without MFA.

Exam trap

The trap here is that candidates assume 'Include: All users' means the policy applies to everyone, overlooking that 'Exclude: All users' negates the inclusion, making the policy effectively inactive.

How to eliminate wrong answers

Option B is wrong because the condition (untrusted location) is met, but the policy does not apply due to the exclusion overriding the inclusion, so access is not blocked. Option C is wrong because the policy does not apply to all users; the 'Exclude: All users' setting removes all users from policy enforcement, so no MFA prompt occurs. Option D is wrong because the grant control requiring MFA is never evaluated, as the policy does not apply to the user.

Practice this question →

328

MCQhard

A security operations center (SOC) receives a high volume of low-fidelity alerts from various security tools. They need a solution that can automatically correlate alerts into incidents, use built-in machine learning to reduce false positives, and provide a unified console for investigation and response across Azure, on-premises, and Microsoft 365. Which Microsoft security solution should they use?

A.Microsoft Defender for Cloud

B.Microsoft Sentinel

C.Microsoft Defender for Endpoint

D.Microsoft Defender for Cloud Apps

AnswerB

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It is specifically designed to ingest security data from virtually any source, including users, devices, applications, and infrastructure, across on-premises and multi-cloud environments. Sentinel leverages machine learning and AI to correlate high volumes of low-fidelity alerts into actionable incidents, significantly reducing noise and enabling efficient investigation and automated response within a unified platform.

Why this answer

Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) solution that ingests high-volume, low-fidelity alerts from multiple sources, correlates them into incidents using built-in analytics and machine learning, and provides a unified console for investigation and response across Azure, on-premises, and Microsoft 365. Its fusion and anomaly detection rules specifically reduce false positives by learning normal behavior patterns, making it the correct choice for this scenario.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud (a CSPM/CWPP) with a SIEM, or assume Defender for Endpoint can handle cross-environment correlation, when only Microsoft Sentinel provides the SIEM capabilities of alert aggregation, ML-based false-positive reduction, and a unified investigation console across Azure, on-premises, and Microsoft 365.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) focused on securing cloud resources and workloads, not a SIEM that correlates alerts into incidents or provides a unified SOC console across hybrid environments. Option C is wrong because Microsoft Defender for Endpoint is an endpoint detection and response (EDR) solution that protects devices and investigates endpoint-specific threats, but it does not aggregate alerts from multiple security tools or provide cross-domain incident correlation for Azure, on-premises, and Microsoft 365. Option D is wrong because Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that focuses on shadow IT discovery and data protection for SaaS applications, not a SIEM that performs high-volume alert correlation and false-positive reduction via built-in machine learning.

Practice this question →

329

MCQmedium

A company uses Azure resources, on-premises servers, and third-party cloud apps. The security team wants a single solution to collect security logs from all these sources, detect threats using advanced analytics, and automate responses to incidents. Which Microsoft security solution should they use?

A.A

B.B

C.C

D.D

AnswerC

Correct. Microsoft Sentinel is designed to ingest logs from multiple sources, provide threat detection via analytics, and automate responses.

Why this answer

A cloud-native SIEM and SOAR solution that can ingest logs from Azure resources, on-premises servers, and third-party cloud apps. It uses advanced analytics with built-in machine learning to detect threats and supports automated incident response. The other options represent different Microsoft security tools that lack the full SIEM/SOAR capabilities required for this scenario.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM tool) with a SIEM solution, failing to recognize that Sentinel is the only Microsoft service designed specifically for cross-source log aggregation, advanced threat detection, and automated incident response in a hybrid multi-cloud environment.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and workload protection platform, not a SIEM; it does not natively collect logs from on-premises servers or third-party cloud apps for unified threat detection and automated response. Option B is wrong because Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) solution focused on endpoint compliance and app policies, not on collecting security logs or performing threat detection across hybrid environments. Option D is wrong because Microsoft Purview Compliance Manager is a compliance management tool that helps assess and manage regulatory compliance, not a security log collection or threat detection solution.

Practice this question →

330

MCQeasy

A company wants to classify and label data in Microsoft SharePoint Online automatically based on content containing passport numbers. Which Microsoft Purview feature should they use?

A.Audit log

B.Data classification dashboard

C.Data loss prevention (DLP) policy

D.Auto-labeling policy

AnswerD

Auto-labeling policies, configured within Microsoft Purview, automatically apply sensitivity labels to content at rest (e.g., in SharePoint, OneDrive) or in transit (e.g., Exchange email) based on specific conditions. These conditions often include the presence of sensitive information types (SITs), keywords, or trainable classifiers, ensuring consistent and scalable data classification without requiring manual user intervention. This directly addresses the need to classify and label data automatically.

Why this answer

Auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels to documents in SharePoint Online based on sensitive information types, such as passport numbers. This enables automatic classification and labeling without manual intervention, meeting the requirement to label data based on content.

Exam trap

The trap here is that candidates often confuse DLP policies with auto-labeling, but DLP policies focus on protecting data through actions like blocking or alerting, not on automatically applying classification labels.

How to eliminate wrong answers

Option A is wrong because Audit log records user and admin activities but does not classify or label data based on content. Option B is wrong because the Data classification dashboard provides visibility into classified data but does not automatically apply labels. Option C is wrong because Data loss prevention (DLP) policies detect and protect sensitive data but do not automatically apply labels; they enforce actions like blocking or alerting.

Practice this question →

331

MCQhard

Your organization is planning to deploy Microsoft Defender for Cloud Apps to discover shadow IT. You need to ensure that logs from your network proxy servers are ingested. Which method should you use to connect the logs?

A.Log collector

B.Conditional Access App Control

C.Microsoft Sentinel data connector

D.App connector API

AnswerA

For Microsoft Defender for Cloud Apps to perform Shadow IT discovery, it requires network traffic logs from an organization's firewalls and proxies. A log collector is a lightweight agent deployed on-premises, typically on a dedicated server, that securely ingests these logs, parses them, and then forwards them to Defender for Cloud Apps. This process enables the service to analyze user activity, identify sanctioned and unsanctioned cloud applications, and assess their risk.

Why this answer

Microsoft Defender for Cloud Apps uses log collectors to ingest traffic logs from network proxy servers for shadow IT discovery. The log collector is a dedicated component that parses and uploads proxy logs (e.g., from Squid, Blue Coat, or Zscaler) to Defender for Cloud Apps for analysis. This method is specifically designed for log-based discovery of unsanctioned cloud app usage.

Exam trap

A common mistake on the SC-900 exam is confusing the App connector API (which connects to sanctioned cloud apps via their APIs for activity monitoring) with the Log collector (which ingests proxy logs for shadow IT discovery). Remember: Log collector is for log-based discovery of unsanctioned apps; App connector is for API-based monitoring of already-sanctioned apps.

How to eliminate wrong answers

Option B is wrong because Conditional Access App Control is a session-level policy enforcement feature that controls access to cloud apps in real time, not a method for ingesting proxy logs. Option C is wrong because the Microsoft Sentinel data connector is used to bring Defender for Cloud Apps alerts into Sentinel for SIEM correlation, not to ingest raw proxy logs for shadow IT discovery. Option D is wrong because the App connector API connects directly to cloud app APIs (e.g., Office 365, Salesforce) to pull activity logs, not to ingest network proxy traffic logs.

Practice this question →

332

Multi-Selectmedium

Your company uses Microsoft Defender for Endpoint. You need to configure attack surface reduction (ASR) rules. Which TWO of the following are ASR rules?

Select 2 answers

A.Block executable content from email client and webmail

B.Allow only signed executables

C.Block inbound connections from the internet

D.Block untrusted fonts

E.Block Office applications from creating child processes

AnswersA, E

This is a correct answer because "Block executable content from email client and webmail" is a specific Attack Surface Reduction (ASR) rule designed to prevent malware from being launched directly from email applications or webmail services. This rule targets common infection vectors by blocking the execution of files like .exe, .dll, or .js that originate from email clients (e.g., Outlook) or popular web browsers when accessing webmail. It helps mitigate phishing and drive-by download attacks by restricting the initial execution phase.

Why this answer

ASR rules are designed to block common attack vectors by controlling specific behaviors. 'Block executable content from email client and webmail' prevents malicious scripts or executables from running when delivered via email, which is a primary infection vector. Option E is correct because 'Block Office applications from creating child processes' stops attackers from using Office apps (like Word or Excel) to spawn malicious processes (e.g., PowerShell or cmd.exe), a classic technique for code execution.

Exam trap

The trap here is that candidates confuse ASR rules with other Windows security features like AppLocker, Windows Firewall, or Exploit Guard, leading them to select options that are valid security controls but not specifically ASR rules.

Practice this question →

333

MCQmedium

A company uses Microsoft Defender for Cloud to secure their multi-cloud environment, which includes Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). They want a unified view of security posture, continuous assessment of resources, and recommendations to improve security across all clouds. Which feature of Defender for Cloud provides this capability?

A.Cloud Security Posture Management (CSPM)

B.Cloud Workload Protection (CWP)

C.Microsoft Secure Score

D.Regulatory Compliance Dashboard

AnswerA

CSPM provides posture management, secure score, and recommendations across multi-cloud environments, meeting all requirements.

Why this answer

Cloud Security Posture Management (CSPM) is the correct feature because it provides a unified, multi-cloud view of security posture, continuously assesses resources against security benchmarks (e.g., CIS, NIST), and generates actionable recommendations to harden configurations across Azure, AWS, and GCP. This directly matches the scenario's requirement for a single pane of glass for posture management and improvement across all three clouds.

Exam trap

The trap here is that candidates confuse Cloud Security Posture Management (CSPM) with Cloud Workload Protection (CWP), mistakenly thinking that workload protection includes posture assessment, when in fact CSPM is the dedicated feature for multi-cloud posture visibility and recommendations.

How to eliminate wrong answers

Option B (Cloud Workload Protection, CWP) is wrong because CWP focuses on threat detection and advanced defenses for workloads (e.g., just-in-time VM access, file integrity monitoring), not on providing a unified posture view or continuous assessment of resource configurations. Option C (Microsoft Secure Score) is wrong because Secure Score is a metric that quantifies an organization's security posture based on Defender for Cloud recommendations, but it is not the feature that performs the continuous assessment or generates the recommendations itself. Option D (Regulatory Compliance Dashboard) is wrong because this dashboard tracks compliance against specific standards (e.g., SOC 2, PCI DSS) using built-in assessments, but it does not provide the general, unified posture view and continuous assessment of all resources across multi-cloud environments.

Practice this question →

334

MCQmedium

A security operations center (SOC) team needs a centralized platform to collect logs from firewalls, servers, and cloud applications. They want to analyze these logs to detect threats, create custom alerts, and automate response actions using playbooks. The solution should also provide threat intelligence feeds and allow for advanced hunting with Kusto Query Language (KQL). Which Microsoft security solution should the team implement?

A.Microsoft Defender for Cloud

B.Microsoft Sentinel

C.Microsoft Defender for Endpoint

D.Microsoft Purview Compliance Manager

AnswerB

Correct. Sentinel is the intended SIEM/SOAR solution for centralized log collection, threat detection, automation, and hunting with KQL.

Why this answer

Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution. It provides a centralized platform for collecting logs from diverse sources (firewalls, servers, cloud apps), enables custom alert creation, automates response via playbooks (Azure Logic Apps), integrates threat intelligence feeds, and supports advanced hunting using Kusto Query Language (KQL).

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM/CWPP tool) with a full SIEM/SOAR solution, overlooking that Sentinel is the dedicated platform for centralized log collection, custom alerts, playbook automation, and KQL-based hunting.

Why the other options are wrong

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP), not a centralized SIEM/SOAR solution. It does not provide native log collection from diverse sources, custom alert creation, playbook automation, or KQL-based advanced hunting.

Microsoft Defender for Endpoint focuses on endpoint protection and detection, not centralized log collection from firewalls, servers, and cloud apps, nor does it provide playbook automation or KQL-based advanced hunting across multiple data sources.

Microsoft Purview Compliance Manager focuses on compliance posture management and assessment, not on centralized log collection, threat detection, custom alerts, or automated response playbooks.

Practice this question →

335

MCQmedium

Your organization uses Microsoft Copilot for Security. You want to use natural language to generate a KQL query for threat hunting. What should you do?

A.Manually write the KQL query in the advanced hunting page.

B.Use the Copilot prompt bar in the Microsoft Defender portal.

C.Install the Copilot add-in for Sentinel.

D.Subscribe to Microsoft 365 Copilot.

AnswerB

Utilizing the Copilot prompt bar within the Microsoft Defender portal is the correct and intended method for leveraging Microsoft Copilot for Security to generate KQL queries. This integrated interface allows security analysts to input natural language descriptions of their threat hunting or investigation needs. Copilot then processes these prompts, translating them into accurate KQL queries that can be immediately executed in Advanced Hunting, significantly streamlining security operations and enhancing analyst productivity.

Why this answer

Microsoft Copilot for Security is integrated directly into the Microsoft Defender portal, allowing security analysts to use natural language prompts to generate KQL queries for threat hunting. The Copilot prompt bar interprets the natural language input and converts it into the appropriate KQL syntax, eliminating the need for manual query writing.

Exam trap

The trap here is that candidates may confuse Microsoft Copilot for Security with Microsoft 365 Copilot, assuming any 'Copilot' subscription will generate KQL queries, when in fact only the security-specific Copilot integrated into the Defender portal provides this capability.

How to eliminate wrong answers

Option A is wrong because manually writing KQL queries in the advanced hunting page does not leverage Copilot's natural language capabilities; it requires the user to already know KQL syntax. Option C is wrong because there is no 'Copilot add-in for Sentinel' — Microsoft Copilot for Security is a standalone service or integrated into the Defender portal, not an add-in for Azure Sentinel. Option D is wrong because subscribing to Microsoft 365 Copilot provides AI assistance for productivity apps like Word and Excel, not for security-specific tasks like generating KQL queries for threat hunting.

Practice this question →

336

MCQmedium

A company uses Microsoft Defender for Cloud to secure their Azure environment. The security team needs to check whether their resources comply with the CIS (Center for Internet Security) benchmark. How can they view their compliance status against CIS in Defender for Cloud?

A.Use the secure score recommendations and look for CIS-related controls

B.Use the Regulatory Compliance dashboard and add the CIS standard as a compliance initiative

C.Use Azure Policy initiative assignments directly from the Policy service

D.Use the vulnerability assessment solution for machines to check CIS settings

AnswerB

The Regulatory Compliance dashboard in Microsoft Defender for Cloud is specifically designed to assess and report on your organization's adherence to various industry standards and regulatory benchmarks. By adding the CIS standard as a compliance initiative, Defender for Cloud automatically maps relevant security recommendations and assessments to the specific controls within that standard, providing a consolidated view of your compliance posture. This direct integration enables comprehensive tracking and reporting against the chosen benchmark.

Why this answer

The Regulatory Compliance dashboard in Microsoft Defender for Cloud allows you to add built-in compliance standards like CIS as an initiative. Once added, the dashboard continuously assesses your Azure resources against the CIS benchmark controls and displays pass/fail status. This is the correct method because Defender for Cloud integrates with Azure Policy to evaluate compliance against regulatory standards.

Exam trap

The trap here is that candidates confuse secure score recommendations with regulatory compliance assessments, assuming that secure score covers all compliance standards, when in fact secure score is a separate metric based on security controls, not specific regulatory frameworks like CIS.

How to eliminate wrong answers

Option A is wrong because secure score recommendations are based on security best practices and built-in controls, not specific regulatory standards like CIS; they do not directly map to CIS benchmarks. Option C is wrong because Azure Policy initiative assignments from the Policy service can define compliance rules, but viewing the compliance status against CIS specifically requires the Regulatory Compliance dashboard in Defender for Cloud, which provides a pre-built view with continuous assessment and reporting. Option D is wrong because the vulnerability assessment solution for machines (e.g., Qualys or Microsoft Defender Vulnerability Management) checks for OS-level vulnerabilities and missing patches, not compliance with CIS benchmark settings across all resource types.

Practice this question →

337

MCQmedium

Your organization is deploying Microsoft Defender XDR to detect and respond to advanced threats. You need to ensure that security alerts from Microsoft Defender for Endpoint are automatically correlated with alerts from Microsoft Defender for Office 365. What should you configure?

A.Ensure that all Microsoft Defender services are onboarded to the same tenant and that the incidents feature is enabled

B.Configure a custom detection rule in Microsoft 365 Defender

C.Create an advanced hunting query to join alerts from different data sources

D.Enable Microsoft Sentinel and configure incident creation rules

AnswerA

Microsoft Defender XDR's core strength lies in its ability to automatically correlate alerts from various Defender services into unified incidents. This powerful cross-domain correlation engine requires all constituent Defender services (e.g., Defender for Endpoint, Office 365, Identity) to be onboarded within the *same* Azure Active Directory tenant. The incidents feature, which drives this correlation, is enabled by default, ensuring a holistic view of attacks and significantly reducing alert fatigue for security operations teams.

Why this answer

Microsoft Defender XDR automatically correlates alerts from different Microsoft Defender services (e.g., Defender for Endpoint and Defender for Office 365) when they are onboarded to the same tenant and the incidents feature is enabled. This built-in correlation uses the Microsoft 365 Defender backend to fuse related alerts into a single incident, providing a unified view of the attack chain without additional configuration.

Exam trap

The trap here is that candidates may think additional tools like Sentinel or custom rules are needed for correlation, but Microsoft Defender XDR provides automatic cross-service correlation by default when all services are in the same tenant and incidents are enabled.

How to eliminate wrong answers

Option B is wrong because custom detection rules in Microsoft 365 Defender are used to create custom alerts based on advanced hunting queries, not to automatically correlate existing alerts from different services. Option C is wrong because advanced hunting queries are for manually searching and analyzing raw data across tables, not for enabling automatic correlation of alerts into incidents. Option D is wrong because Microsoft Sentinel is a separate SIEM solution that requires additional licensing and configuration; it is not required for native correlation within Microsoft Defender XDR, which handles this automatically when services are in the same tenant.

Practice this question →

338

MCQeasy

Your organization uses Microsoft Purview eDiscovery to manage legal holds. A legal hold has been placed on a user’s mailbox, but the user has left the company and their mailbox has been converted to a shared mailbox. You need to ensure that the legal hold remains effective. What should you do?

A.Convert the shared mailbox back to a user mailbox to keep the hold.

B.Create a new legal hold for the shared mailbox.

C.Verify that the legal hold is still listed in the eDiscovery case for the mailbox.

D.Remove the legal hold and reapply it to the shared mailbox.

AnswerC

The hold persists after conversion.

Why this answer

When a mailbox is converted to a shared mailbox, the legal hold applied via eDiscovery remains in effect and does not need to be recreated. It is important to verify that the hold is still listed in the eDiscovery case. Option A is incorrect because converting back is unnecessary and may lose shared mailbox features.

Option B is incorrect because the hold is still active; creating a new hold is redundant. Option D is incorrect because removing and reapplying the hold is not required.

Practice this question →

339

MCQhard

Refer to the exhibit. A security analyst is reviewing a Microsoft Defender XDR alert. Which two tactics identified are most relevant? (This is a multiple-choice question asking which two tactics are shown, but the format is single answer. We need to adjust: The question asks: 'Which two tactics are identified?' The correct answer is the option listing both 'InitialAccess and LateralMovement'.)

A.LateralMovement and PrivilegeEscalation

B.LateralMovement and Exfiltration

C.InitialAccess and Persistence

D.InitialAccess and LateralMovement

AnswerD

This option is correct because the security alert explicitly details activities consistent with both the Initial Access and Lateral Movement tactics. Initial Access refers to the methods adversaries use to gain their first foothold in a network, such as through phishing or exploiting a public-facing application. Lateral Movement then describes the techniques used to navigate and expand control within the compromised environment, often involving remote services or internal spearphishing, directly aligning with the observed alert indicators.

Why this answer

The exhibit shows a Microsoft Defender XDR alert indicating that an attacker gained initial access (e.g., via a phishing link or compromised credential) and then moved laterally within the network (e.g., using remote desktop or SMB). These two stages correspond directly to the InitialAccess and LateralMovement tactics in the MITRE ATT&CK framework, which are the most relevant based on the alert details.

Exam trap

The trap here is that candidates may confuse LateralMovement with PrivilegeEscalation or Exfiltration, but the alert's focus on moving between systems (not escalating privileges or stealing data) clearly points to InitialAccess and LateralMovement as the two most relevant tactics.

How to eliminate wrong answers

Option A is wrong because PrivilegeEscalation is not indicated in the alert; the focus is on initial entry and lateral spread, not gaining higher permissions. Option B is wrong because Exfiltration involves data theft, which is not shown in the alert; the described activity is about moving between hosts, not sending data out. Option C is wrong because Persistence involves maintaining access (e.g., via scheduled tasks or registry modifications), which is not the primary tactic shown; the alert highlights the initial breach and subsequent lateral movement.

Practice this question →

340

MCQmedium

Your organization uses Microsoft Defender for Office 365. A user reports receiving a suspicious email that appears to be from their CEO asking for a wire transfer. The email passed through the spam filter. What additional protection should be enabled to detect such attacks?

A.Safe Attachments policy

B.Anti-spam policy

C.Safe Links policy

D.Impersonation protection in anti-phishing policy

AnswerD

Impersonation protection within an anti-phishing policy is specifically engineered to identify and mitigate attacks where attackers spoof a known user's display name or email address, or a trusted domain. It analyzes various email attributes, including sender display name, sender address, and domain similarity, against configured protected users and domains to detect and act upon these highly targeted phishing attempts. This direct focus on identity spoofing makes it the correct control for preventing impersonation.

Why this answer

The attack described is a business email compromise (BEC) or CEO fraud, which relies on impersonation rather than malicious links or attachments. Microsoft Defender for Office 365's anti-phishing policy includes impersonation protection that specifically detects and mitigates attempts where a sender spoofs a high-profile user (like the CEO) or domain. Enabling impersonation protection in the anti-phishing policy is the correct additional safeguard because the email passed the spam filter, indicating it was not a bulk or malware-based threat.

Exam trap

The trap here is that candidates confuse the general anti-phishing policy (which includes spoof intelligence) with the specific impersonation protection setting, or they mistakenly think Safe Links or Safe Attachments can detect social engineering attacks that contain no malicious payload.

How to eliminate wrong answers

Option A is wrong because Safe Attachments policy protects against malicious attachments by detonating them in a sandbox, but the reported email does not contain an attachment—it is a social engineering request for a wire transfer. Option B is wrong because Anti-spam policy handles bulk email and spam classification, and the email already passed the spam filter, so adjusting anti-spam settings would not address the impersonation tactic. Option C is wrong because Safe Links policy provides time-of-click protection against malicious URLs, but the email contains no link—it is a direct request for action via reply.

Practice this question →

341

Multi-Selectmedium

Which TWO are capabilities of Microsoft Defender for Cloud Apps? (Choose two.)

Select 2 answers

A.Endpoint detection and response (EDR)

B.Identity protection for user accounts

C.Data classification of on-premises files

D.Session control to monitor user activity in cloud apps

E.Cloud Discovery to identify shadow IT

AnswersD, E

Session control allows real-time monitoring and control of app sessions.

Why this answer

Microsoft Defender for Cloud Apps includes session control capabilities, which allow administrators to monitor and control user activity in real time within cloud applications. This is achieved through reverse proxy integration, enabling granular access policies and data loss prevention (DLP) actions during active sessions.

Exam trap

The trap here is that candidates confuse the broad 'security solutions' umbrella and attribute endpoint or identity features to Defender for Cloud Apps, when in fact each Microsoft security product (Defender for Endpoint, Entra ID Protection, Purview) has a distinct scope and integration point.

Practice this question →

342

MCQmedium

A company uses Microsoft 365 and Azure. They want a unified security solution that provides threat protection across email, endpoints, identities, and cloud apps, with automated investigation and response capabilities. Which Microsoft solution should they use?

A.Microsoft Defender for Cloud

B.Microsoft 365 Defender

C.Microsoft Sentinel

D.Microsoft Entra ID Protection

AnswerB

Microsoft 365 Defender is the correct solution as it provides a unified Extended Detection and Response (XDR) experience specifically tailored for the Microsoft 365 ecosystem. It automatically collects, correlates, and analyzes security signals from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This integrated approach enables cross-domain threat protection, automated investigation, and remediation across email, endpoints, identities, and cloud applications, offering a holistic view of an organization's security posture within Microsoft 365.

Why this answer

Microsoft 365 Defender is a unified pre- and post-breach enterprise defense suite that coordinates detection, prevention, investigation, and response across email, endpoints, identities, and cloud apps. It provides automated investigation and response (AIR) capabilities through its integrated components (e.g., Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps), making it the correct choice for the described requirements.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM/CWPP tool for cloud workloads) with Microsoft 365 Defender (a unified XDR solution for the Microsoft 365 ecosystem), or they mistakenly think Microsoft Sentinel (a SIEM) provides the same built-in, cross-domain automated investigation and response as Microsoft 365 Defender.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) focused on securing Azure, on-premises, and multi-cloud workloads, not a unified solution for email, endpoints, identities, and cloud apps with automated investigation and response. Option C is wrong because Microsoft Sentinel is a cloud-native SIEM/SOAR solution that ingests logs and alerts from multiple sources for threat detection and response, but it is not a unified security solution that natively provides threat protection across email, endpoints, identities, and cloud apps with built-in automated investigation and response like Microsoft 365 Defender. Option D is wrong because Microsoft Entra ID Protection is an identity protection service that detects and remediates identity-based risks (e.g., leaked credentials, anomalous sign-ins), but it does not provide threat protection across email, endpoints, or cloud apps, nor does it offer automated investigation and response across those domains.

Practice this question →

343

MCQmedium

A company uses a hybrid environment with Azure virtual machines (IaaS) and on-premises Windows servers. The security team needs a single solution that continuously assesses the security posture of these workloads, provides a regulatory compliance dashboard with actionable recommendations, and enables threat detection. Which Microsoft security solution should they use?

A.Microsoft Defender for Cloud Apps

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Cloud

D.Microsoft Sentinel

AnswerC

Microsoft Defender for Cloud is the correct solution as it provides comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWP) across Azure, on-premises, and multi-cloud environments. It continuously assesses security posture, offers a secure score, monitors regulatory compliance against various benchmarks, and delivers integrated threat detection and protection for Azure Virtual Machines and hybrid servers via Azure Arc.

Why this answer

Microsoft Defender for Cloud is the correct answer because it provides a unified security management platform that continuously assesses the security posture of both Azure VMs (IaaS) and on-premises Windows servers via Azure Arc. It offers a regulatory compliance dashboard with actionable recommendations based on built-in standards like CIS, NIST, and Azure Security Benchmark, and integrates with Microsoft Defender for Cloud's workload protection plans to enable threat detection for these hybrid workloads.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a posture management and threat protection platform) with Microsoft Sentinel (a SIEM), but the question specifically asks for a single solution that includes a compliance dashboard and continuous assessment, which is a core feature of Defender for Cloud, not Sentinel.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) focused on shadow IT discovery and data protection for SaaS applications, not on assessing the security posture or providing a compliance dashboard for IaaS VMs and on-premises servers. Option B is wrong because Microsoft Defender for Endpoint is an endpoint detection and response (EDR) solution that focuses on device-level threat detection and response, but it does not provide a regulatory compliance dashboard or continuous security posture assessment across hybrid workloads. Option D is wrong because Microsoft Sentinel is a cloud-native SIEM and SOAR solution that ingests logs and alerts for threat detection and incident response, but it is not primarily designed for continuous security posture assessment or out-of-the-box regulatory compliance dashboards; it requires custom workbooks and analytics rules for compliance reporting.

Practice this question →

344

MCQmedium

Your organization uses Microsoft Defender XDR. You need to investigate a potential lateral movement attack where a compromised user account is used to access multiple workstations. Which feature should you use to visualize the attack path?

A.Attack graph

B.Microsoft Sentinel workbooks

C.Threat analytics in Microsoft 365 Defender

D.Incident queue

AnswerA

The Attack graph in Microsoft Defender XDR specifically visualizes the full scope of an attack, including how an attacker moved laterally, which assets were impacted, and the relationships between entities. It provides a rich, interactive representation of the attack chain, making it ideal for understanding lateral movement paths and identifying potential pivot points. This feature is crucial for incident responders to trace the progression of sophisticated threats.

Why this answer

Attack graph in Microsoft Defender XDR is the correct feature because it automatically maps and visualizes the potential paths an attacker could take to move laterally across devices using compromised credentials. It correlates alerts and incidents to show the sequence of events, such as a user account authenticating to multiple workstations, enabling security teams to identify the scope and entry point of the attack.

Exam trap

The trap here is that candidates often confuse the attack graph with the incident queue or threat analytics, assuming any security dashboard can visualize attack paths, but only the attack graph provides the automated, graph-based lateral movement visualization specific to Defender XDR.

How to eliminate wrong answers

Option B is wrong because Microsoft Sentinel workbooks are customizable dashboards for querying and visualizing security data from multiple sources, but they do not automatically generate attack path visualizations specific to lateral movement within Defender XDR. Option C is wrong because Threat analytics in Microsoft 365 Defender provides intelligence reports on active threats and vulnerabilities, not a real-time graph of attack paths. Option D is wrong because the Incident queue lists all security incidents in a tabular view for triage and management, but it does not offer a visual representation of lateral movement steps.

Practice this question →

345

MCQhard

Refer to the exhibit. A Microsoft Purview DLP policy is configured in Test mode. An administrator notices that a user is still able to share a document containing a credit card number. What is the most likely reason?

A.The credit card number is not detected because low confidence threshold

B.The BlockAccess action is not supported for SharePoint Online

C.The policy is in Test mode, so actions are not enforced

D.The policy requires an administrator to approve the action

AnswerC

When a Microsoft Purview DLP policy is configured in "Test mode," it is designed to evaluate policy matches and generate incident reports without enforcing any configured actions, such as blocking access or notifying users. This mode allows administrators to assess the policy's impact and fine-tune its rules before full deployment. Consequently, any specified actions, like blocking access to a credit card number, will not be enforced while the policy remains in test mode.

Why this answer

When a Microsoft Purview DLP policy is configured in Test mode, it logs policy matches and generates alerts but does not enforce any restrictive actions such as blocking access or sharing. The administrator observed that the user could still share the document because Test mode explicitly disables action enforcement, allowing the organization to evaluate the policy's impact before moving to Enforce mode.

Exam trap

The trap here is that candidates may assume Test mode still enforces some actions (like blocking) because they confuse it with 'Test mode with policy tips' or think DLP policies always block sharing by default, but Test mode explicitly disables all enforcement actions.

How to eliminate wrong answers

Option A is wrong because the credit card number detection uses a predefined Sensitive Information Type (SIT) with a default confidence level; if the policy matched, the number was detected, and a low confidence threshold would not prevent detection—it would simply require a higher match accuracy. Option B is wrong because the BlockAccess action is fully supported for SharePoint Online in Purview DLP policies; it can block sharing or restrict access to documents containing sensitive data. Option D is wrong because the policy does not require administrator approval for actions in Test mode; administrator approval is a separate feature (e.g., using Power Automate or custom workflows) and is not a default behavior of DLP Test mode.

Practice this question →

346

MCQeasy

Your organization wants to centrally manage security policies for all devices (Windows, iOS, Android) and ensure they meet compliance requirements before accessing corporate resources. Which Microsoft solution should you use?

A.Microsoft Purview Compliance Manager

B.Microsoft Defender for Endpoint

C.Microsoft Intune

D.Microsoft Entra ID

AnswerC

Microsoft Intune is a cloud-based Unified Endpoint Management (UEM) solution specifically designed to manage and secure devices, including mobile phones, tablets, and laptops, across various operating systems. It enables organizations to centrally deploy and enforce security policies, manage application lifecycles, and configure compliance settings, ensuring all managed devices meet organizational security and operational standards. This direct device configuration and policy enforcement capability is precisely what the question asks for.

Why this answer

Microsoft Intune is the correct solution because it is a cloud-based mobile device management (MDM) and mobile application management (MAM) service that centrally manages security policies across Windows, iOS, and Android devices. It enforces compliance requirements—such as encryption, OS version, and jailbreak detection—before granting access to corporate resources, integrating with Conditional Access in Microsoft Entra ID.

Exam trap

The trap here is that candidates confuse Microsoft Entra ID's identity-based Conditional Access with the device-level policy management that Intune provides, assuming Entra ID alone can enforce device compliance without Intune.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Compliance Manager is a risk-assessment and compliance-scoring tool for regulatory frameworks (e.g., GDPR, ISO 27001), not a device management or policy enforcement solution. Option B is wrong because Microsoft Defender for Endpoint is an endpoint detection and response (EDR) and vulnerability management tool focused on threat detection and remediation, not on centrally managing device compliance policies or controlling resource access. Option D is wrong because Microsoft Entra ID is an identity and access management (IAM) service that provides authentication and authorization, but it does not directly manage device security policies or enforce device compliance; it relies on Intune for device-level controls.

Practice this question →

347

Multi-Selectmedium

Which TWO of the following are features of Microsoft Defender for Cloud? (Choose two.)

Select 2 answers

A.Data classification and labeling

B.Security Information and Event Management (SIEM)

C.Cloud Workload Protection Platform (CWPP)

D.Mobile Threat Defense (MTD)

E.Cloud Security Posture Management (CSPM)

AnswersC, E

Cloud Workload Protection Platform (CWPP) is a key feature of Microsoft Defender for Cloud. This capability provides comprehensive protection for diverse cloud workloads, including virtual machines, containers, databases, and storage, across multi-cloud and hybrid environments. Defender for Cloud offers vulnerability assessments, just-in-time access, adaptive application controls, and file integrity monitoring to secure these critical compute resources against threats.

Why this answer

Microsoft Defender for Cloud is a Cloud Workload Protection Platform (CWPP) that provides unified security management and advanced threat protection for workloads running in Azure, on-premises, and other clouds. It also includes Cloud Security Posture Management (CSPM) capabilities, which continuously assess your environment against security benchmarks (e.g., CIS, NIST) and provide actionable recommendations to improve your security posture.

Exam trap

The trap here is that candidates often confuse the SIEM and SOAR capabilities of Microsoft Sentinel with the CWPP and CSPM functions of Defender for Cloud, or they mistakenly associate data classification (Purview) with Defender for Cloud's security recommendations.

Practice this question →

348

MCQhard

A healthcare organization runs a mix of workloads on Azure (Azure VMs, SQL Database) and on-premises (Windows Servers). They must continuously assess their compliance against the HIPAA and HITRUST regulatory frameworks. They want a unified dashboard that shows their compliance score against these standards and provides step-by-step recommendations to remediate violations. Which Microsoft Defender for Cloud capability should they use?

A.Regulatory compliance dashboard

B.Secure score

C.Microsoft Defender for Cloud Apps

D.Microsoft Defender for Servers

AnswerA

The Regulatory compliance dashboard, a core feature of Microsoft Defender for Cloud, provides a centralized view to manage and track an organization's compliance posture against various regulatory standards. It allows users to add built-in standards like HIPAA and HITRUST, crucial for healthcare organizations, and continuously monitors the environment, mapping security recommendations to specific controls within these frameworks. This dashboard presents a compliance score and actionable recommendations, enabling organizations to efficiently demonstrate adherence to industry-specific regulations.

Why this answer

The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a unified view of an organization's compliance posture against specific regulatory standards like HIPAA and HITRUST. It displays a compliance score for each selected framework and offers step-by-step remediation recommendations for identified violations, directly meeting the requirement for continuous assessment and guided remediation.

Exam trap

The trap here is that candidates often confuse the Secure score (which measures general security hygiene) with the Regulatory compliance dashboard (which measures adherence to specific regulatory frameworks), leading them to select Secure score when the question explicitly asks for compliance against HIPAA and HITRUST.

How to eliminate wrong answers

Option B (Secure score) is wrong because it measures the overall security posture based on security controls and recommendations, not compliance against specific regulatory frameworks like HIPAA or HITRUST. Option C (Microsoft Defender for Cloud Apps) is wrong because it is a Cloud Access Security Broker (CASB) focused on shadow IT discovery, data protection, and threat detection across SaaS applications, not on assessing compliance against healthcare regulatory standards. Option D (Microsoft Defender for Servers) is wrong because it provides threat detection and advanced protections for server workloads, but does not include a dashboard for regulatory compliance scoring or step-by-step remediation against HIPAA or HITRUST.

Practice this question →

349

MCQhard

Contoso uses Microsoft Sentinel. They want to automate response to a high-severity incident by blocking the source IP in Azure Firewall and sending a notification to the SOC team via email. Which feature should they use?

A.Create a hunting query.

B.Create an automation rule.

C.Enable Fusion.

D.Create a workbook.

AnswerB

An automation rule in Microsoft Sentinel is the primary mechanism for orchestrating automated responses to incidents or alerts. These rules allow administrators to define conditions based on incident or alert properties, and then automatically perform actions such as suppressing false positives, assigning incidents, or, most importantly, triggering a playbook (Azure Logic App) to execute complex response workflows. This direct linkage to playbooks is precisely how Contoso can automate its incident response processes.

Why this answer

Correct: Automation rules in Microsoft Sentinel can automatically trigger playbooks (e.g., to block an IP in Azure Firewall) and send notifications based on incident creation or update, meeting the requirement. Option A (hunting query) is for proactively searching for threats, not automated response. Option C (Fusion) is a correlation engine that detects multistage attacks but does not automate actions.

Option D (workbook) is for visualization and reporting, not automation.

Practice this question →

350

Multi-Selecteasy

Your company wants to protect sensitive data in Microsoft Teams. Which two Microsoft Purview features can help prevent accidental sharing of confidential information? (Choose two.)

Select 2 answers

A.Data Loss Prevention (DLP) policies for Teams

B.Audit log search for Teams

C.eDiscovery for Teams

D.Retention policies for Teams messages

E.Sensitivity labels for Teams sites and content

AnswersA, E

DLP policies for Teams proactively identify and prevent the sharing of sensitive information, such as credit card numbers or health records, within Teams chats, channels, and files. These policies leverage sensitive information types and trainable classifiers to detect data and can automatically block sharing, notify users, or require justification before allowing the action, directly protecting against data exfiltration.

Why this answer

Data Loss Prevention (DLP) policies for Teams can detect and block sharing of sensitive information (e.g., credit card numbers, social security numbers) in Teams messages and channels, preventing accidental exposure. Sensitivity labels allow you to classify and protect Teams sites and content by applying encryption, visual markings, and access restrictions, ensuring confidential data is not shared with unauthorized users.

Exam trap

The trap here is that candidates often confuse detective controls (like audit logs and eDiscovery) with preventive controls (like DLP and sensitivity labels), leading them to select options that only record or search for data after it has been shared rather than stopping the sharing in the first place.

Practice this question →

351

MCQmedium

Your organization uses Microsoft Purview eDiscovery to manage legal cases. You need to place a hold on a user's mailbox to preserve data for an ongoing litigation. Which role do you need to assign to the eDiscovery manager?

A.Records Management

B.Information Protection

C.eDiscovery Manager (with the Legal Hold role enabled)

D.Compliance Administrator

AnswerC

The eDiscovery Manager role group includes the Legal Hold role, which allows placing holds.

Why this answer

To place a hold on a user's mailbox in Microsoft Purview eDiscovery, you need the eDiscovery Manager role group with the Legal Hold role enabled. This role specifically grants the permission to create and manage litigation holds, which preserve mailbox content for legal cases. Without the Legal Hold sub-role, an eDiscovery Manager can search and export but cannot apply holds.

Exam trap

The trap here is that candidates assume the eDiscovery Manager role alone is sufficient to place holds, but Microsoft explicitly separates the Legal Hold sub-role to enforce least privilege, so the correct answer requires both the role group and the specific sub-role enabled.

How to eliminate wrong answers

Option A is wrong because the Records Management role is focused on retention labels, retention policies, and disposition reviews, not on placing legal holds for eDiscovery cases. Option B is wrong because the Information Protection role deals with sensitivity labels, encryption, and data classification, not with eDiscovery hold functionality. Option D is wrong because the Compliance Administrator role provides broad compliance management permissions but does not include the specific Legal Hold sub-role required to place holds on mailboxes; it can manage compliance settings but not execute eDiscovery holds directly.

Practice this question →

352

MCQeasy

A company uses Azure virtual machines for a production database. The security team wants to minimize the attack surface by blocking all inbound RDP (port 3389) traffic. However, administrators occasionally need to connect for maintenance. The team needs a solution that allows administrators to request temporary access to the RDP port, which is automatically revoked after a specified time. Which Microsoft Defender for Cloud feature should they use?

A.Adaptive application controls

B.Just-in-time (JIT) VM access

C.File Integrity Monitoring (FIM)

D.Security alerts

AnswerB

Just-in-time (JIT) VM access is a crucial security feature in Azure Defender for Cloud that significantly reduces the attack surface of virtual machines. It achieves this by locking down inbound network traffic to VMs, typically via Network Security Groups (NSGs), allowing only authorized users to request temporary, time-limited access to specific ports. This access is automatically revoked after a configurable duration, ensuring that ports are only open precisely when needed, thereby minimizing exposure for production database VMs.

Why this answer

Just-in-time (JIT) VM access is the correct feature because it specifically addresses the need to block inbound RDP (port 3389) traffic by default while allowing administrators to request temporary, time-bound access. When a request is approved, JIT dynamically modifies the network security group (NSG) to open the port for a specified duration, then automatically reverts the rule to deny all inbound traffic after the time expires. This directly minimizes the attack surface by eliminating persistent open management ports.

Exam trap

The trap here is that candidates may confuse 'just-in-time VM access' with 'adaptive application controls' because both are Defender for Cloud features that involve 'control' and 'access,' but JIT specifically manages network port access while adaptive controls manage application execution.

How to eliminate wrong answers

Option A is wrong because Adaptive application controls are used to create allowlists for applications running on Azure VMs, controlling which executables can run, not for managing network port access. Option C is wrong because File Integrity Monitoring (FIM) monitors changes to critical files, registries, and system configurations, not network traffic or port access. Option D is wrong because Security alerts are notifications generated by Defender for Cloud when threats are detected, not a mechanism to grant or revoke temporary network access.

Practice this question →

353

MCQmedium

A company wants to protect its employees from phishing attacks delivered via email. The solution must analyze all URLs embedded in incoming emails in real-time. If a URL points to a known malicious site, the link should be blocked at the time of click. Additionally, the solution should sandbox URLs in attachments and provide time-of-click verification. Which Microsoft security solution should they implement?

A.Microsoft Defender for Cloud Apps

B.Microsoft Defender for Office 365

C.Microsoft Defender for Endpoint

D.Microsoft Cloud App Security

AnswerB

Correct. Defender for Office 365 includes Safe Links and Safe Attachments to protect against malicious URLs and attachments in email.

Why this answer

Microsoft Defender for Office 365 (MDO) is the correct solution because it provides Safe Links, which performs real-time URL scanning and time-of-click verification for URLs embedded in email messages and attachments. It also includes Safe Attachments, which detonates attachments in a sandbox environment to analyze embedded URLs. These capabilities directly address the requirement to block malicious links at click time and sandbox URLs in attachments.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud Apps (a CASB) with Defender for Office 365, because both have 'Defender' in the name and offer cloud security, but only Defender for Office 365 includes the specific Safe Links and Safe Attachments features required for email phishing protection.

Why the other options are wrong

Microsoft Defender for Cloud Apps focuses on shadow IT discovery and cloud app governance, not on email-level URL analysis or time-of-click verification for phishing protection.

Microsoft Defender for Endpoint focuses on endpoint devices (e.g., PCs, servers) and does not provide real-time URL analysis or sandboxing for email attachments. The question specifically requires email protection and time-of-click verification, which is outside Defender for Endpoint's scope.

Microsoft Cloud App Security (now part of Defender for Cloud Apps) is a CASB for controlling cloud app access and data, not for real-time URL analysis and sandboxing of email attachments. The question specifically requires email protection features like time-of-click verification and attachment sandboxing, which are provided by Defender for Office 365.

Practice this question →

354

MCQmedium

A company wants to discover which cloud applications are being used by employees, assess the risk of those apps, and control data sharing in sanctioned apps like Box or Dropbox. Which Microsoft security solution should they implement?

A.Microsoft Defender for Endpoint

B.Microsoft Defender for Cloud Apps

C.Microsoft Defender for Office 365

D.Microsoft Defender for Identity

AnswerB

Defender for Cloud Apps offers cloud app discovery (shadow IT), risk assessment, and the ability to apply DLP and governance policies to sanctioned and unsanctioned cloud apps.

Why this answer

Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility into shadow IT by discovering cloud app usage, assessing risk based on over 80 risk factors, and enforcing data loss prevention (DLP) policies to control data sharing in sanctioned apps like Box or Dropbox. It integrates with cloud providers via API connectors to monitor and govern data in real time.

Exam trap

The trap here is confusing the CASB functionality of Defender for Cloud Apps with the endpoint-focused or email-specific protections of other Defender products, leading candidates to pick Defender for Office 365 because it also controls data sharing, but only within Microsoft 365, not third-party apps like Box or Dropbox.

Why the other options are wrong

Microsoft Defender for Endpoint focuses on endpoint device protection (antivirus, threat detection, and response), not on discovering cloud app usage, assessing app risk, or controlling data sharing in sanctioned cloud apps like Box or Dropbox.

Microsoft Defender for Office 365 focuses on protecting email and collaboration tools like Exchange, SharePoint, and Teams from threats such as phishing and malware, not on discovering and controlling cloud app usage or assessing app risk.

Microsoft Defender for Identity focuses on detecting and investigating advanced attacks on on-premises Active Directory, not on discovering or controlling cloud app usage or data sharing in sanctioned apps like Box or Dropbox.

Practice this question →

355

MCQmedium

A company's security operations team needs to centralize security log collection from multiple sources including on-premises firewalls, AWS CloudTrail, and Azure Active Directory sign-in logs. They want to use built-in analytics to detect threats across all data sources and create automated response playbooks, such as isolating a compromised user account when a specific attack pattern is detected. Which Microsoft security solution should they deploy?

A.Microsoft Defender for Cloud

B.Microsoft Sentinel

C.Microsoft 365 Defender

D.Microsoft Defender for Cloud Apps

AnswerB

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It is explicitly designed for centralizing security data from virtually any source, including Microsoft services, on-premises infrastructure, and other cloud providers. This enables comprehensive threat detection through AI and machine learning, alongside automated responses to security incidents across the entire enterprise.

Why this answer

Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) solution that ingests logs from diverse sources (on-premises firewalls via Syslog, AWS CloudTrail via REST API, and Azure AD via diagnostic settings) and provides built-in analytics rules to detect threats across all data. It also integrates with Azure Logic Apps to create automated playbooks (e.g., isolating a compromised user account) triggered by detected attack patterns, fulfilling the requirement for centralized log collection and automated response.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel (a SIEM for multi-source log ingestion and automated response) with Microsoft 365 Defender (an XDR for Microsoft ecosystem threats), failing to recognize that only Sentinel can ingest third-party logs like on-premises firewalls and AWS CloudTrail for centralized threat detection and playbook automation.

Why the other options are wrong

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that focuses on securing cloud resources, not on centralizing security logs from multiple sources (including on-premises) with built-in SIEM analytics and automated response playbooks.

Microsoft 365 Defender is designed to protect Microsoft 365 workloads (e.g., email, endpoints, identities) and does not natively ingest third-party logs like AWS CloudTrail or on-premises firewalls, nor does it provide centralized SIEM capabilities for multi-source log collection and custom automated playbooks.

Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) focused on shadow IT discovery and controlling access to cloud apps, not a centralized SIEM/SOAR for multi-source log collection and automated threat response.

Practice this question →

356

Matchingmedium

Match each Microsoft identity service to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Cloud-based identity and access management

Directory service for Windows domain networks

Collaboration with external partners

Customer identity and access management for apps

Integration of on-premises AD with Azure AD

Why these pairings

Microsoft identity services include Azure AD (cloud IAM), Azure AD DS (managed domain services), and Azure AD B2C (customer IAM). Common confusions involve swapping descriptions of Azure AD with on-premises AD and Azure AD DS with Azure AD B2B.

Practice this question →

357

MCQhard

You are investigating an alert in Microsoft 365 Defender. The KQL query in the exhibit retrieves evidence for alert-5678. What type of entities does this query filter for?

A.Registry entities

B.Process entities

C.Network entities

D.File entities

AnswerD

This option is correct because the KQL query explicitly includes the condition `EntityType == 'File'`, which is designed to retrieve data specifically related to file system events. This filter ensures that the investigation focuses on activities such as file creation, modification, deletion, or access attempts on endpoints. Therefore, the alert evidence being examined directly corresponds to file entities within the Microsoft 365 Defender data schema, making this the appropriate choice.

Why this answer

The KQL query filters for evidence related to alert-5678 by specifying a hash value (SHA256) of a file. In Microsoft 365 Defender, file entities are uniquely identified by their hash values, such as SHA256, SHA1, or MD5. The query uses the `where` clause to match the specific file hash, confirming that the filtered entities are file entities.

Exam trap

The trap here is that candidates may confuse file hash filtering with process or network entity identification, but Microsoft 365 Defender uses distinct identifiers (SHA256 for files, PID for processes, IP/URL for network) that are explicitly tied to the entity type in the schema.

How to eliminate wrong answers

Option A is wrong because registry entities are identified by registry key paths and values, not by file hashes like SHA256. Option B is wrong because process entities are identified by process IDs (PIDs) or process names, not by file hashes. Option C is wrong because network entities are identified by IP addresses, URLs, or domain names, not by file hashes.

Practice this question →

358

MCQeasy

Your organization uses Microsoft Entra ID. You need to enforce multi-factor authentication (MFA) for all users accessing the company's financial application. Which security feature should you use?

A.Security defaults

B.Privileged Identity Management

C.Identity Protection

D.Conditional Access

AnswerD

Microsoft Entra Conditional Access is a powerful policy engine that allows organizations to enforce specific access requirements based on various conditions, including user identity, device state, location, and application being accessed. By configuring a Conditional Access policy, administrators can precisely target individual cloud applications and mandate multi-factor authentication as a grant control for access, thereby meeting the requirement to enforce MFA per application. This granular control ensures security without unnecessarily impacting all users or applications.

Why this answer

Conditional Access policies in Microsoft Entra ID allow you to enforce MFA specifically for the financial application by targeting the application in the policy. This provides granular control over authentication requirements based on conditions such as user, location, device state, and application, which is exactly what is needed to secure a specific app.

Exam trap

The trap here is that candidates confuse Identity Protection's risk-based policies with direct MFA enforcement, but Identity Protection only provides risk signals and requires Conditional Access to act on them.

How to eliminate wrong answers

Option A is wrong because Security defaults enforce MFA for all users across all applications, not just the financial application, and cannot be scoped to a single app. Option B is wrong because Privileged Identity Management (PIM) manages just-in-time access for privileged roles, not MFA enforcement for application access. Option C is wrong because Identity Protection detects risks and can trigger MFA via Conditional Access, but it does not directly enforce MFA; it provides risk signals that Conditional Access policies use.

Practice this question →

359

MCQmedium

A security team manages a hybrid environment with Azure VMs and on-premises Windows servers. They want a single dashboard that provides continuous assessment of security posture, actionable recommendations to harden configurations, and integration with Microsoft Defender for Cloud to detect threats. Which Microsoft security solution should they use?

A.Microsoft Defender for Cloud Apps

B.Microsoft Defender for Cloud

C.Microsoft Sentinel

D.Microsoft Defender for Endpoint

AnswerB

It provides a unified view of security posture across Azure, on-premises, and other clouds, with recommendations and threat detection.

Why this answer

Microsoft Defender for Cloud (MDC) is the correct solution because it provides a unified dashboard for continuous security posture assessment, actionable hardening recommendations based on the Secure Score, and native integration with Microsoft Defender for Cloud's threat detection capabilities. It supports hybrid environments, covering both Azure VMs and on-premises Windows servers via Azure Arc, and delivers the specific requirements of posture assessment, recommendations, and threat detection in a single pane of glass.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud (the posture management and CSPM tool) with Microsoft Defender for Endpoint (the EDR tool), because both have 'Defender' in the name and both provide security, but only MDC offers the single dashboard for continuous assessment and recommendations across hybrid workloads.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) focused on shadow IT discovery, data loss prevention, and app governance for SaaS applications, not on assessing the security posture of VMs or servers. Option C is wrong because Microsoft Sentinel is a Security Information and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR) solution that ingests logs for threat hunting and incident response, but it does not provide continuous posture assessment or hardening recommendations by itself. Option D is wrong because Microsoft Defender for Endpoint is an endpoint detection and response (EDR) solution that protects devices from malware and advanced threats, but it lacks the centralized posture assessment dashboard and configuration hardening recommendations for the entire hybrid infrastructure that MDC offers.

Practice this question →

360

MCQhard

Refer to the exhibit. You are reviewing a Microsoft Defender for Cloud Apps alert. Based on the evidence, which action should you take first?

A.Mark the alert as benign

B.Suspend the user account

C.Isolate the device immediately

D.Request file upload for analysis

AnswerD

Requesting a file upload for analysis is the most appropriate immediate next step for an unconfirmed file detection. This action allows security analysts to submit the suspicious file to advanced threat intelligence services, such as Microsoft Defender for Endpoint's cloud-based sandboxing or detonation chambers. These environments perform deep behavioral analysis, static analysis, and reputation checks to definitively determine if the file is malicious, benign, or potentially unwanted, providing crucial context for subsequent response actions.

Why this answer

The alert evidence shows a suspicious file upload activity, which could indicate a potential malware or data exfiltration attempt. Requesting file upload for analysis (Option D) is the correct first action because it allows Defender for Cloud Apps to perform deep content inspection and threat detection before taking any disruptive actions like suspending the user or isolating the device, ensuring that the response is proportionate and evidence-based.

Exam trap

The trap here is that candidates often jump to punitive actions like suspending the user or isolating the device, forgetting that Defender for Cloud Apps is a CASB designed for investigation and policy-based response, where the first step should always be to gather more evidence through file analysis.

How to eliminate wrong answers

Option A is wrong because marking the alert as benign would dismiss the suspicious activity without investigation, potentially allowing a real threat to persist. Option B is wrong because suspending the user account is a severe action that should only be taken after confirming malicious intent through analysis, not as a first step based solely on a file upload alert. Option C is wrong because isolating the device immediately is an extreme containment measure typically reserved for confirmed endpoint compromise, and it bypasses the need to first analyze the file to determine if it is actually malicious.

Practice this question →

361

MCQmedium

Your organization uses Microsoft Entra ID and wants to provide a single sign-on (SSO) experience for a third-party SaaS application that supports SAML 2.0. The app must also enforce multifactor authentication (MFA) for external users. What should you configure?

A.Set up SAML-based federation in Microsoft Entra ID and assign a Conditional Access policy requiring MFA

B.Add the app as a Linked Sign-On application

C.Use password-based SSO in Microsoft Entra ID

D.Configure OAuth 2.0 authorization in Microsoft Entra ID

AnswerA

SAML-based federation is the industry standard for enabling Single Sign-On (SSO) between an identity provider like Microsoft Entra ID and external enterprise applications. By configuring SAML, users authenticate once with Microsoft Entra ID and gain seamless access to the application. Subsequently, a Conditional Access policy can be applied to this specific application, mandating multi-factor authentication (MFA) to enhance security before access is granted, ensuring compliance with organizational security postures.

Why this answer

The scenario requires SAML 2.0-based federation for SSO, which Microsoft Entra ID supports natively. By assigning a Conditional Access policy that requires MFA, you enforce multifactor authentication for external users accessing the third-party SaaS application, meeting both SSO and MFA requirements.

Exam trap

The trap here is that candidates often confuse Linked Sign-On (Option B) with true federation, not realizing that Linked Sign-On merely redirects to an external login page without any identity provider integration or MFA enforcement capability.

How to eliminate wrong answers

Option B is wrong because Linked Sign-On (also known as existing SSO) simply creates a deep link to an existing sign-on page and does not provide SAML-based federation or the ability to enforce MFA via Conditional Access. Option C is wrong because password-based SSO uses credential vaulting and form-filling, which does not support SAML 2.0 federation and cannot enforce MFA through Conditional Access policies. Option D is wrong because OAuth 2.0 is an authorization protocol, not an authentication protocol for SSO; while it can be used with OpenID Connect, the question explicitly specifies SAML 2.0, making OAuth 2.0 an incorrect choice.

Practice this question →

362

MCQhard

A company's security operations center wants to detect advanced attacks targeting their on-premises Active Directory, such as Kerberos Golden Ticket attacks, pass-the-hash, and skeleton key malware. They need a solution that monitors domain controller traffic, correlates with entity behavior, and integrates with Microsoft Sentinel for incident response. Which Microsoft security solution should they deploy?

A.Microsoft Defender for Identity

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Cloud

D.Microsoft Sentinel

AnswerA

Microsoft Defender for Identity (MDI) is specifically designed to protect hybrid identity environments by monitoring on-premises Active Directory domain controllers. It leverages network traffic analysis and security event log inspection to detect sophisticated identity-based attacks, such as pass-the-hash, Golden Ticket, and reconnaissance activities. MDI's behavioral analytics engine establishes baselines for user and entity behavior, enabling it to identify anomalous activities indicative of advanced persistent threats targeting credentials and domain infrastructure. This makes it the ideal solution for a Security Operations Center (SOC) seeking to detect advanced identity-based threats within their on-premises AD.

Why this answer

Microsoft Defender for Identity (MDI) is the correct solution because it is specifically designed to monitor on-premises Active Directory traffic, including domain controller network traffic, and uses entity behavior analytics to detect advanced attacks like Kerberos Golden Ticket, pass-the-hash, and skeleton key malware. It integrates natively with Microsoft Sentinel to enable automated incident response and investigation.

Exam trap

The trap here is that candidates confuse Microsoft Sentinel as the detection tool itself, when in fact Sentinel is the aggregation and response platform, while Defender for Identity is the dedicated on-premises AD threat detection solution.

Why the other options are wrong

Microsoft Defender for Endpoint focuses on endpoint devices (workstations, servers) and does not monitor domain controller traffic or detect Active Directory-specific attacks like Golden Ticket or skeleton key.

Microsoft Defender for Cloud is designed for protecting cloud workloads (IaaS, PaaS, and hybrid) and does not monitor on-premises Active Directory traffic or detect Kerberos attacks like Golden Ticket or pass-the-hash.

Microsoft Sentinel is a SIEM/SOAR platform that ingests logs and alerts but does not natively monitor domain controller traffic or detect Active Directory attacks like Golden Ticket or skeleton key. It relies on other solutions (e.g., Defender for Identity) for such detections.

Practice this question →

363

MCQmedium

Refer to the exhibit. The JSON shows a Microsoft Purview DLP policy. A user sends an email with a credit card number to an external recipient. What will happen?

A.The email is delivered normally because TeamsChatAndChannel is false.

B.The email is delivered but an alert is generated.

C.The email is blocked and the user receives a notification.

D.The email is encrypted before delivery.

AnswerC

This statement is correct. The DLP policy is configured to apply to `Exchange` (where email resides), and its rule specifies `BlockAccess` as the action when sensitive content is detected. Furthermore, the `UserNotification` setting is enabled, ensuring that the sender receives a policy tip or notification explaining why their email was blocked, providing immediate feedback and promoting compliance.

Why this answer

The DLP policy in the exhibit has a condition that detects credit card numbers and an action set to 'BlockMessage' with 'NotifyUser' enabled. Since the policy is configured for Exchange (email) and the action blocks the message, the email is blocked and the user receives a notification. The 'TeamsChatAndChannel' property being false is irrelevant because the policy is applied to Exchange, not Teams.

Exam trap

The trap here is that candidates confuse the 'TeamsChatAndChannel' property with the overall policy applicability, assuming a false value means the entire policy is inactive, when in fact it only controls Teams scope and the Exchange action still applies.

How to eliminate wrong answers

Option A is wrong because 'TeamsChatAndChannel' being false only means the policy does not apply to Teams chat/channel messages; it does not affect Exchange email delivery, and the policy's 'BlockMessage' action overrides normal delivery. Option B is wrong because the policy action is 'BlockMessage', not 'GenerateAlert' alone; while an alert could be generated, the primary action blocks the email, so it is not delivered. Option D is wrong because the policy does not specify encryption as an action; the configured action is 'BlockMessage', not 'EncryptMessage'.

Practice this question →

364

MCQmedium

A company runs a web application in Azure that is publicly accessible. They want to protect it against large-scale distributed denial-of-service (DDoS) attacks from multiple sources. Which Azure service is specifically designed for this purpose?

A.Azure Firewall

B.Azure DDoS Protection

C.Microsoft Defender for Cloud

D.Azure Application Gateway with Web Application Firewall (WAF)

AnswerB

Azure DDoS Protection provides always-on traffic monitoring and automatic mitigation capabilities specifically designed to protect Azure resources from volumetric, protocol, and resource-layer DDoS attacks. It leverages Azure's global network scale to absorb and scrub malicious traffic at the network edge before it reaches the target application, ensuring legitimate traffic flow. This service is essential for publicly accessible applications in Azure, offering comprehensive protection against sophisticated denial-of-service threats.

Why this answer

Azure DDoS Protection is specifically designed to safeguard Azure resources against large-scale distributed denial-of-service (DDoS) attacks. It leverages the global scale of Microsoft's network to absorb and mitigate multi-gigabit attacks, providing always-on traffic monitoring and adaptive tuning. This service is the only option among the choices that is purpose-built for DDoS mitigation at the network and transport layers (L3/L4), and it also offers application-layer (L7) protection when combined with Application Gateway WAF.

Exam trap

The trap here is that candidates often confuse Azure Firewall or Application Gateway WAF as DDoS solutions, but those services handle different layers of defense—Azure Firewall for network filtering and WAF for application-layer attacks—whereas only Azure DDoS Protection is designed to absorb and mitigate large-scale volumetric attacks from multiple sources.

How to eliminate wrong answers

Option A is wrong because Azure Firewall is a stateful network firewall that filters traffic based on rules (e.g., IP addresses, ports, protocols) but does not provide dedicated DDoS mitigation; it cannot absorb volumetric attacks. Option C is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and workload protection platform that provides threat detection and security recommendations, not a DDoS mitigation service. Option D is wrong because Azure Application Gateway with WAF protects against application-layer attacks (e.g., SQL injection, cross-site scripting) but does not mitigate large-scale volumetric DDoS attacks at the network layer; it can be used in conjunction with Azure DDoS Protection but is not a standalone DDoS solution.

Practice this question →

365

MCQeasy

What is the primary purpose of Microsoft Defender for Cloud Apps?

A.Monitor network traffic

B.Manage mobile devices

C.Protect on-premises servers

D.Secure cloud applications and data

AnswerD

Microsoft Defender for Cloud's primary purpose is to provide comprehensive security posture management and threat protection across cloud environments, including Azure, AWS, and GCP. This encompasses securing cloud applications, data, virtual machines, containers, databases, and other services by identifying misconfigurations, recommending security improvements, and detecting and responding to threats. It acts as a Cloud Workload Protection Platform (CWPP) and Cloud Security Posture Management (CSPM) solution, ensuring the overall security of cloud-native assets.

Why this answer

Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility, data controls, and threat protection for cloud applications and data. Its primary purpose is to secure cloud apps (like Microsoft 365, Salesforce, or Dropbox) by enforcing policies, detecting anomalous behavior, and preventing data exfiltration, not to manage network traffic, mobile devices, or on-premises servers.

Exam trap

The trap here is that candidates may confuse Defender for Cloud Apps with a general-purpose security tool, mistakenly thinking it monitors network traffic (Option A) or protects on-premises servers (Option C), when its focus is exclusively on cloud application security and data protection.

How to eliminate wrong answers

Option A is wrong because monitoring network traffic is the primary function of network security tools like Microsoft Defender for Network or Azure Firewall, not Defender for Cloud Apps. Option B is wrong because managing mobile devices is the domain of Microsoft Intune (a Mobile Device Management/MDM solution), not a CASB. Option C is wrong because protecting on-premises servers is the role of Microsoft Defender for Servers (part of Defender for Cloud) or System Center, not a cloud app security broker.

Practice this question →

366

MCQmedium

Your organization uses Microsoft Defender for Cloud Apps. A security analyst notices anomalous file downloads from a SharePoint site by a user flagged as high risk. What should the analyst configure to automatically block such activity?

A.Configure a file policy

B.Configure an access policy

C.Configure an app permission policy

D.Configure a session policy

AnswerD

Configuring a session policy is the correct approach because these policies leverage Microsoft Defender for Cloud Apps' Conditional Access App Control to act as a reverse proxy, intercepting and inspecting user sessions in real-time. This allows administrators to apply granular, context-aware controls over user activities within cloud applications, such as blocking downloads, preventing uploads of sensitive files, or restricting copy-paste actions. Session policies are specifically designed for real-time monitoring and control of ongoing user interactions.

Why this answer

Session policies in Microsoft Defender for Cloud Apps allow real-time monitoring and control of user activities based on risk level. When a user is flagged as high risk, a session policy can be configured to automatically block anomalous file downloads from SharePoint by intercepting the session and applying actions such as block, allow, or restrict. This is the correct choice because it directly addresses the need to prevent the specific activity in real time.

Exam trap

The trap here is that candidates often confuse session policies with access policies, but access policies control entry (authentication/authorization) while session policies control behavior during an active session, which is required to block specific file downloads in real time.

How to eliminate wrong answers

Option A is wrong because file policies are designed to detect and govern data at rest or in transit using content inspection and metadata, but they do not provide real-time session-level blocking based on user risk; they typically trigger alerts or apply governance actions after the fact. Option B is wrong because access policies control authentication and authorization at the point of sign-in (e.g., requiring MFA or blocking access from untrusted locations), but they do not monitor or block specific activities like file downloads during an active session. Option C is wrong because app permission policies manage the permissions granted to third-party apps (e.g., OAuth apps) to access organizational data, not the real-time behavior of individual user sessions.

Practice this question →

367

MCQhard

A company runs critical Windows virtual machines on Azure. To reduce the attack surface, the security team wants to block all inbound RDP (port 3389) traffic from the internet by default. When a security engineer needs to connect via RDP for troubleshooting, they must request access through a portal, and the RDP port will be opened for a limited time (e.g., 4 hours) only to their source IP address. Which Microsoft security solution should they use to implement this control?

A.Microsoft Defender for Cloud's Just-in-time (JIT) VM access

B.Microsoft Defender for Cloud Apps

C.Microsoft Defender for Endpoint

D.Azure Network Security Groups (NSGs) with application security groups

AnswerA

Microsoft Defender for Cloud's Just-in-time (JIT) VM access is a crucial security feature designed to reduce the attack surface of Azure virtual machines. It achieves this by locking down inbound management ports, only opening them for specific, approved source IP addresses for a limited duration. This temporary, on-demand access significantly minimizes exposure to potential threats, aligning with zero-trust principles and enhancing overall VM security posture.

Why this answer

Microsoft Defender for Cloud's Just-in-time (JIT) VM access is the correct solution because it specifically provides time-limited, request-based opening of inbound ports (such as RDP port 3389) to approved source IP addresses, reducing the attack surface by keeping ports closed by default. This aligns directly with the requirement to block all inbound RDP from the internet by default and allow temporary access only through a portal request.

Exam trap

The trap here is that candidates may confuse network-level controls (NSGs) with a managed security service that automates temporary access, leading them to choose Option D without realizing NSGs lack the time-limited, request-based workflow that JIT provides.

How to eliminate wrong answers

Option B (Microsoft Defender for Cloud Apps) is wrong because it is a cloud access security broker (CASB) focused on controlling and monitoring user access to SaaS applications, not on managing inbound network ports to Azure VMs. Option C (Microsoft Defender for Endpoint) is wrong because it is an endpoint detection and response (EDR) solution for securing devices against malware and threats, not a network-level port management tool. Option D (Azure Network Security Groups with application security groups) is wrong because while NSGs can block or allow traffic, they do not provide time-limited, request-based just-in-time access; they require manual rule changes and do not integrate with a portal-based approval workflow.

Practice this question →

368

MCQeasy

You are a security administrator for a company that uses Microsoft 365. The compliance team needs to automatically classify and protect sensitive data such as credit card numbers in emails and documents. Which Microsoft Purview solution should you recommend?

A.Microsoft Purview Information Protection

B.Microsoft Purview Records Management

C.Microsoft Purview Insider Risk Management

D.Microsoft Purview Data Loss Prevention

AnswerA

Correct. Microsoft Purview Information Protection automatically classifies sensitive data (e.g., credit card numbers) by applying sensitivity labels and can protect data with encryption or access controls, meeting both requirements.

Why this answer

A is correct because Microsoft Purview Information Protection (formerly Azure Information Protection) provides automatic classification of sensitive data, such as credit card numbers, by applying sensitivity labels based on rules and patterns. It also offers protection through encryption or access restrictions. This solution directly addresses the compliance team's requirement for both automatic classification and protection.

Data Loss Prevention (DLP) enforces protective actions after classification but does not perform the classification itself.

Exam trap

The trap is that candidates may confuse Microsoft Purview Data Loss Prevention (DLP) with Information Protection. DLP enforces policies to prevent data loss but does not automatically classify data; Information Protection handles the actual labeling and classification. The question explicitly requires both classification and protection, making Information Protection the correct choice.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Information Protection focuses on manually or automatically applying sensitivity labels to classify and protect data, but it does not natively enforce real-time data loss prevention actions like blocking emails containing credit card numbers; DLP handles that enforcement. Option B is wrong because Microsoft Purview Records Management is designed for managing retention and disposition of records based on regulatory requirements, not for real-time detection and protection of sensitive data in transit or at rest. Option C is wrong because Microsoft Purview Insider Risk Management identifies and investigates risky user activities (e.g., data theft by insiders), but it does not automatically classify or protect sensitive data like credit card numbers in emails and documents; it focuses on user behavior analytics, not content-based protection.

Practice this question →

369

MCQeasy

Your company wants to use Microsoft Security Copilot to help analysts investigate security incidents. Which data source can Security Copilot ingest to provide contextual insights?

A.Alerts from Microsoft Defender XDR

B.Custom IoT device logs

C.Third-party threat intelligence feeds

D.On-premises firewall syslog

AnswerA

Microsoft Security Copilot is fundamentally designed to integrate natively and deeply with Microsoft's security product suite, including Microsoft Defender XDR. It directly ingests alerts, incidents, and underlying telemetry from Defender XDR across endpoints, identities, email, and cloud apps. This direct data access allows Copilot to provide real-time incident summarization, contextual analysis, and guided response actions based on high-fidelity threat detections.

Why this answer

Microsoft Security Copilot can directly ingest alerts from Microsoft Defender XDR to provide contextual insights for analysts investigating security incidents. Option B is incorrect because custom IoT device logs are not natively ingested by Security Copilot; they would typically require a SIEM or data connector. Option C is incorrect because while Security Copilot can use threat intelligence, third-party feeds are not a primary direct ingestion source.

Option D is incorrect because on-premises firewall syslog is not directly ingested; Security Copilot primarily ingests data from Microsoft security products and Azure services.

Practice this question →

370

MCQmedium

A security team wants to discover all cloud apps being used by employees, including unsanctioned personal apps like unauthorized file-sharing services. They plan to analyze firewall logs to identify traffic patterns and assess each app's risk score. Which feature of Microsoft Defender for Cloud Apps should they enable?

A.Cloud Discovery

B.App Governance

C.Information Protection

D.Conditional Access App Control

AnswerA

Cloud Discovery, a core capability within Microsoft Defender for Cloud Apps, is precisely designed to identify all cloud applications accessed by users within an organization. It achieves this by analyzing traffic logs from firewalls and proxies, providing comprehensive visibility into both sanctioned and unsanctioned "shadow IT" applications. This process generates detailed risk assessments for each discovered app, enabling security teams to understand potential vulnerabilities, compliance gaps, and usage patterns. Its primary function is comprehensive app discovery and risk assessment.

Why this answer

Cloud Discovery is the correct feature because it analyzes traffic logs (e.g., from firewalls or proxies) to identify all cloud apps in use, including unsanctioned personal apps like unauthorized file-sharing services. It then assesses each app's risk score based on over 80 risk factors, such as encryption standards and data residency, enabling the security team to discover and evaluate shadow IT.

Exam trap

The trap here is that candidates often confuse Cloud Discovery with Conditional Access App Control, mistakenly thinking that real-time session policies can also discover unsanctioned apps, but discovery requires log analysis, not policy enforcement.

How to eliminate wrong answers

Option B (App Governance) is wrong because it focuses on monitoring and managing OAuth-enabled apps that have been granted access to Microsoft 365 data, not on discovering unsanctioned cloud apps from firewall logs. Option C (Information Protection) is wrong because it deals with classifying, labeling, and protecting sensitive data (e.g., via sensitivity labels and DLP), not with discovering cloud app usage or analyzing traffic patterns. Option D (Conditional Access App Control) is wrong because it enforces real-time access policies (e.g., session controls) on sanctioned apps, but it does not perform discovery or risk assessment of unsanctioned apps from firewall logs.

Practice this question →

371

MCQeasy

A company wants to enforce conditional access policies that require multifactor authentication (MFA) for all users accessing financial apps from outside the corporate network. Which Microsoft Entra ID license is minimally required to create conditional access policies?

A.Microsoft 365 Business Basic

B.Microsoft Entra ID P2

C.Microsoft Entra ID Free

D.Microsoft Entra ID P1

AnswerD

Microsoft Entra ID P1 is the correct and minimal license required to enforce Conditional Access policies. This license tier enables organizations to define and apply robust access controls, such as requiring multi-factor authentication (MFA) for specific applications, blocking access from untrusted locations, or enforcing device compliance. It provides the essential framework for implementing a strong, adaptive access management strategy.

Why this answer

Microsoft Entra ID P1 (formerly Azure AD Premium P1) is the minimum license required to create and enforce conditional access policies. Conditional access is a premium feature that is not available in Free or Microsoft 365 Business Basic tiers, and while P2 includes additional capabilities like Identity Protection, it is not necessary for basic MFA enforcement based on location.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID P2 as the minimum because they associate it with advanced security features, but the exam specifically tests that P1 is sufficient for creating conditional access policies without the need for P2's Identity Protection or PIM capabilities.

How to eliminate wrong answers

Option A is wrong because Microsoft 365 Business Basic does not include Microsoft Entra ID P1; it only provides the Free tier of Entra ID, which lacks conditional access policy creation. Option B is wrong because Microsoft Entra ID P2 includes all P1 features plus Identity Protection and Privileged Identity Management, but it is not the minimum required for basic conditional access policies. Option C is wrong because Microsoft Entra ID Free does not support conditional access policies; it only supports basic security defaults, not customizable policies.

Practice this question →

372

MCQmedium

A company uses Microsoft Defender for Cloud Apps to protect its SaaS apps. The security team needs to detect when a user downloads more than 100 files from SharePoint Online within 10 minutes. Which policy type should they create?

A.Anomaly detection policy

B.Activity policy

C.Threat detection policy

D.Compliance policy

AnswerA

Anomaly detection policies in Microsoft Defender for Cloud Apps leverage advanced machine learning algorithms to establish a baseline of normal user and entity behavior within your cloud environment. These policies continuously monitor for significant deviations from this established baseline, such as impossible travel, unusual administrative activities, or mass downloads to an unmanaged device. By identifying these statistical anomalies, they proactively detect potential threats like compromised accounts, insider threats, or data exfiltration attempts that might otherwise go unnoticed.

Why this answer

Anomaly detection policies in Microsoft Defender for Cloud Apps use machine learning to establish a baseline of normal user behavior and then trigger alerts when deviations occur, such as a user downloading over 100 files from SharePoint Online within 10 minutes. This specific scenario—unusually high download volume in a short time—is a classic example of a behavioral anomaly that an anomaly detection policy is designed to catch, as it may indicate a data exfiltration attempt.

Exam trap

The trap here is that candidates often confuse 'activity policy' with 'anomaly detection policy,' assuming any user action-based alert is an activity policy, but activity policies require explicit, static conditions (e.g., 'download from SharePoint') and cannot dynamically detect unusual volume or frequency without additional logic.

How to eliminate wrong answers

Option B (Activity policy) is wrong because activity policies are rule-based and match specific, predefined activities (e.g., 'download file from SharePoint') but cannot natively detect anomalous volume thresholds like 'more than 100 files in 10 minutes' without custom scripting or repeated log aggregation. Option C (Threat detection policy) is wrong because threat detection policies in Defender for Cloud Apps focus on identifying known threat actors, malware, or compromised accounts using threat intelligence feeds, not on behavioral anomalies based on volume or frequency. Option D (Compliance policy) is wrong because compliance policies are used to enforce data handling standards (e.g., DLP, data classification) and do not monitor user activity patterns for anomalous behavior.

Practice this question →

373

MCQhard

A multinational company uses a hybrid infrastructure with on-premises Active Directory and Azure resources. They have deployed Microsoft Defender for Cloud to protect their Azure workloads. They now want to extend threat detection to their on-premises Active Directory by collecting security events from domain controllers to detect attacks like Golden Ticket, DCSync, and malicious Kerberos activity. The solution should integrate with Microsoft Sentinel for automated response. Which security solution should they deploy on the on-premises domain controllers?

A.Microsoft Defender for Cloud

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Identity

D.Microsoft Sentinel

AnswerC

Microsoft Defender for Identity is purpose-built to detect advanced threats targeting on-premises Active Directory environments by analyzing network traffic and Windows events from domain controllers. It deploys lightweight sensors directly on domain controllers or uses port mirroring to gain deep visibility into authentication protocols like Kerberos and NTLM. This specialized analysis allows it to identify suspicious user behavior, privilege escalation attempts, and specific attack patterns, such as Golden Ticket, Pass-the-Hash, and DCShadow, providing crucial security alerts for AD compromise. Its focus is precisely on the unique attack surface presented by Active Directory.

Why this answer

Microsoft Defender for Identity (MDI) is the correct solution because it is specifically designed to monitor on-premises Active Directory signals, including security events from domain controllers, to detect advanced identity-based attacks such as Golden Ticket, DCSync, and malicious Kerberos activity. MDI integrates natively with Microsoft Sentinel to enable automated response workflows, fulfilling the requirement for extending threat detection to on-premises AD.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM/CWPP tool) with Microsoft Defender for Identity (an AD-focused identity threat detection tool), because both names include 'Defender' and both can integrate with Sentinel, but only MDI monitors on-premises Active Directory authentication events.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud is a cloud workload protection platform (CWPP) focused on securing Azure, hybrid, and multi-cloud resources, not on-premises Active Directory domain controllers. Option B is wrong because Microsoft Defender for Endpoint is an endpoint detection and response (EDR) solution for devices like servers and workstations, not for monitoring Active Directory authentication protocols or Kerberos attacks. Option D is wrong because Microsoft Sentinel is a cloud-native SIEM/SOAR platform that ingests logs and triggers responses, but it does not deploy agents on domain controllers to collect security events; it relies on data connectors from other sources like MDI.

Practice this question →

374

MCQmedium

A security team needs to continuously assess the security posture of Azure resources, including virtual machines, storage accounts, and SQL databases. They also want to identify vulnerabilities in both Windows and Linux servers running in Azure and on-premises, and receive prioritized recommendations for remediation. Which Microsoft security solution should they use?

A.Microsoft Defender for Cloud

B.Microsoft Defender for Endpoint

C.Microsoft Sentinel

D.Microsoft Purview

AnswerA

Microsoft Defender for Cloud is the correct choice because it provides comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities. It continuously assesses the security posture of Azure, on-premises, and multi-cloud environments by identifying misconfigurations, vulnerabilities, and compliance deviations. This service offers actionable security recommendations and a secure score to proactively enhance an organization's overall security.

Why this answer

Microsoft Defender for Cloud is the correct solution because it provides continuous assessment of Azure resources (VMs, storage accounts, SQL databases) and hybrid workloads, including vulnerability scanning for Windows and Linux servers both in Azure and on-premises. It delivers prioritized remediation recommendations based on the secure score and integrated vulnerability assessment tools like Qualys or Microsoft Defender Vulnerability Management.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM and workload protection solution) with Microsoft Defender for Endpoint (an EDR solution), but the question's focus on assessing security posture of Azure resources and hybrid servers points specifically to Defender for Cloud's CSPM capabilities.

Why the other options are wrong

Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for devices, not on assessing the security posture of Azure resources like VMs, storage accounts, and SQL databases, nor does it provide prioritized remediation recommendations for cloud infrastructure.

Microsoft Sentinel is a SIEM/SOAR solution for threat detection and response across the enterprise, not a tool for continuously assessing security posture and identifying vulnerabilities in Azure resources and servers.

Microsoft Purview focuses on data governance, classification, and compliance (e.g., data loss prevention, information protection), not on assessing security posture or identifying vulnerabilities in Azure resources and servers.

Practice this question →

375

MCQmedium

Your company is deploying Microsoft Defender for Cloud Apps. You need to detect and block the use of unsanctioned cloud apps that exhibit risky behavior. Which feature should you configure?

A.Azure Information Protection labels

B.Conditional Access policies

C.Cloud Discovery

D.Data Loss Prevention (DLP) policies

AnswerC

Cloud Discovery, a core feature of Microsoft Defender for Cloud Apps, analyzes traffic logs from firewalls and proxy servers to identify all cloud applications accessed by users within an organization. It provides crucial visibility into 'shadow IT' by assessing the risk of discovered apps and can integrate with network security appliances to block access to unsanctioned or high-risk applications. This capability is fundamental for enforcing cloud app governance and reducing organizational risk.

Why this answer

Cloud Discovery is the correct feature because it analyzes traffic logs to identify unsanctioned cloud apps and assess their risk based on behavioral factors such as data upload volume, user count, and security posture. Once identified, Defender for Cloud Apps can automatically block these apps using the built-in app governance controls, enforcing policies to prevent risky app usage.

Exam trap

The trap here is that candidates often confuse Conditional Access policies (which control access to known apps) with Cloud Discovery (which identifies and blocks unknown or unsanctioned apps), missing the core requirement of detecting risky behavior in previously unrecognized cloud services.

How to eliminate wrong answers

Option A is wrong because Azure Information Protection labels classify and protect documents and emails based on sensitivity, not detect or block unsanctioned cloud apps. Option B is wrong because Conditional Access policies control access to sanctioned apps based on user, device, or location conditions, but they do not discover or block unsanctioned cloud apps. Option D is wrong because Data Loss Prevention (DLP) policies monitor and prevent unauthorized sharing of sensitive data within sanctioned apps, not detect or block unsanctioned cloud apps.

Practice this question →