Scenario practice questions

Your organization is implementing a data loss prevention (DLP) policy to prevent sensitive data from being shared via email. Users in the finance department need to send financial reports to external auditors. What should you configure?

Trap 1: Add the auditors' domains to a DLP allow list

Adding auditors' domains to a DLP allow list is not a standard or effective configuration within Microsoft Purview Data Loss Prevention. DLP policies primarily operate by inspecting content for sensitive information types and applying actions based on policy rules, rather than relying on domain-based whitelisting to bypass these content-centric controls. While mail flow rules (transport rules) in Exchange Online can utilize sender/recipient domain allow lists for email routing or processing, DLP policies are designed for granular content protection and do not typically offer a direct 'allow list' mechanism for policy exceptions based solely on external domains.

Trap 2: Assign a sensitivity label that automatically encrypts the email

Assigning a sensitivity label that automatically encrypts the email primarily focuses on data classification and protection, ensuring that the content remains secure even if it leaves the organization's control. While sensitivity labels are crucial for data governance and can enforce encryption, they do not inherently provide the 'override with justification' capability that a DLP policy offers for user-driven exceptions to sharing rules. Their function is to apply persistent protection based on content classification, not to manage conditional sharing exceptions with an audit trail for user justification.

Trap 3: Configure a DLP policy with a block action for all external sharing

Configuring a DLP policy with a block action for all external sharing would be overly restrictive and detrimental to legitimate business operations. While blocking is a powerful DLP action, applying it universally would prevent necessary collaboration with external partners, customers, and, in this scenario, auditors, hindering productivity and operational efficiency. Effective DLP strategies require granularity, allowing for specific exceptions or user overrides with justification rather than implementing a blanket ban that impedes essential business processes.

A
Add the auditors' domains to a DLP allow list
Why wrong: Adding auditors' domains to a DLP allow list is not a standard or effective configuration within Microsoft Purview Data Loss Prevention. DLP policies primarily operate by inspecting content for sensitive information types and applying actions based on policy rules, rather than relying on domain-based whitelisting to bypass these content-centric controls. While mail flow rules (transport rules) in Exchange Online can utilize sender/recipient domain allow lists for email routing or processing, DLP policies are designed for granular content protection and do not typically offer a direct 'allow list' mechanism for policy exceptions based solely on external domains.
B
Configure a DLP policy with an override option allowing users to justify the sharing
Configuring a DLP policy with an override option that allows users to justify sharing is the most appropriate solution for balancing security with legitimate business needs. This feature enables organizations to enforce strong data protection while providing a controlled mechanism for users to temporarily bypass a policy when a valid business reason exists, such as sharing specific audit-related documents externally. The justification provided by the user is logged, creating an essential audit trail for compliance and review, ensuring accountability without completely blocking necessary collaboration.
C
Assign a sensitivity label that automatically encrypts the email
Why wrong: Assigning a sensitivity label that automatically encrypts the email primarily focuses on data classification and protection, ensuring that the content remains secure even if it leaves the organization's control. While sensitivity labels are crucial for data governance and can enforce encryption, they do not inherently provide the 'override with justification' capability that a DLP policy offers for user-driven exceptions to sharing rules. Their function is to apply persistent protection based on content classification, not to manage conditional sharing exceptions with an audit trail for user justification.
D
Configure a DLP policy with a block action for all external sharing
Why wrong: Configuring a DLP policy with a block action for all external sharing would be overly restrictive and detrimental to legitimate business operations. While blocking is a powerful DLP action, applying it universally would prevent necessary collaboration with external partners, customers, and, in this scenario, auditors, hindering productivity and operational efficiency. Effective DLP strategies require granularity, allowing for specific exceptions or user overrides with justification rather than implementing a blanket ban that impedes essential business processes.

Question 2easymulti select

Which two scenarios are examples of using Microsoft Entra business-to-business (B2B) collaboration? (Choose two.)

Trap 1: An employee uses their Microsoft Entra ID to sign in to a…

This describes a standard Single Sign-On (SSO) implementation for internal employees, leveraging Microsoft Entra ID as the identity provider for third-party SaaS applications. While it uses Microsoft Entra ID for authentication, it does not involve inviting external users or managing guest accounts for cross-organizational collaboration. Instead, it streamlines access for an organization's own workforce to applications outside its direct control.

Trap 2: Two internal departments share resources within the same tenant.

Sharing resources between internal departments within the same Microsoft Entra tenant is a fundamental aspect of internal access management, not B2B collaboration. All users involved are employees of the same organization, with their identities already managed within the single Microsoft Entra directory. This process relies on internal group memberships, permissions, and access policies, without the need for external identity federation or guest accounts.

Trap 3: Customers use their Facebook accounts to sign in to a company's web…

This scenario describes Microsoft Entra B2C (Business-to-Consumer), which is designed for managing customer identities and access to consumer-facing applications. B2C allows customers to sign in using social identity providers like Facebook or by creating local accounts. This differs fundamentally from B2B, which focuses on inviting users from other organizations' directories for business collaboration, rather than managing individual consumer accounts.

A
A user from a partner organization is invited to access a SharePoint Online site.
This scenario exemplifies Microsoft Entra B2B collaboration, where an organization extends access to its internal resources, such as a SharePoint Online site, to an external user from a partner organization. By inviting the partner user, a guest account is created in the inviting organization's Microsoft Entra tenant, allowing the external user to authenticate with their existing corporate credentials and securely access the shared resource. This facilitates secure inter-organizational cooperation.
B
An employee uses their Microsoft Entra ID to sign in to a third-party SaaS application.
Why wrong: This describes a standard Single Sign-On (SSO) implementation for internal employees, leveraging Microsoft Entra ID as the identity provider for third-party SaaS applications. While it uses Microsoft Entra ID for authentication, it does not involve inviting external users or managing guest accounts for cross-organizational collaboration. Instead, it streamlines access for an organization's own workforce to applications outside its direct control.
C
Two internal departments share resources within the same tenant.
Why wrong: Sharing resources between internal departments within the same Microsoft Entra tenant is a fundamental aspect of internal access management, not B2B collaboration. All users involved are employees of the same organization, with their identities already managed within the single Microsoft Entra directory. This process relies on internal group memberships, permissions, and access policies, without the need for external identity federation or guest accounts.
D
A vendor employee uses their own work email to access a Power BI dashboard shared by your company.
This is a prime example of Microsoft Entra B2B collaboration, enabling secure sharing of specific resources like a Power BI dashboard with external vendor employees. When the vendor employee is invited, a guest user object is provisioned in the inviting company's Microsoft Entra tenant, allowing them to authenticate using their existing work email and access the shared content while maintaining the inviting organization's security policies.
E
Customers use their Facebook accounts to sign in to a company's web application.
Why wrong: This scenario describes Microsoft Entra B2C (Business-to-Consumer), which is designed for managing customer identities and access to consumer-facing applications. B2C allows customers to sign in using social identity providers like Facebook or by creating local accounts. This differs fundamentally from B2B, which focuses on inviting users from other organizations' directories for business collaboration, rather than managing individual consumer accounts.

Question 3mediummultiple choice

You find a JSON representation of a sensitivity label in a SharePoint document's metadata. The label indicates encryption is applied and access is restricted to finance@contoso.com. Based on this information, what is the effect of the label applied to the document?

Exhibit

Refer to the exhibit.

```json
{
  "properties": {
    "contentType": {
      "id": "0x010100B0C6F9B7D9F14F4A9A3B0C6F9B7D9F14"
    },
    "title": "Confidential Document",
    "labels": [
      {
        "name": "Confidential",
        "action": "encrypt",
        "protection": {
          "type": "user",
          "value": "finance@contoso.com"
        }
      }
    ]
  }
}
```

Trap 1: The document is only marked as confidential but not encrypted

This statement is incorrect because the JSON metadata clearly specifies an 'encrypt' action, which directly applies encryption to the document's content. While the document might also be visually marked as confidential through a sensitivity label or header/footer, the presence of the `encrypt` action unequivocally confirms that robust data encryption is actively applied, not merely a classification.

Trap 2: The document is encrypted and can be accessed by any user with the…

While the document is indeed encrypted, the assertion that any user with a decryption key can access it is incorrect. The JSON specifies a `protection_type` of 'user' with the `value` 'finance@contoso.com', indicating that access rights are explicitly granted only to members of that specific security group. This rights management configuration ensures that decryption is authorized solely for designated users, not universally for anyone possessing a generic key.

Trap 3: The document will be retained for a specified period

This statement is incorrect because the provided JSON metadata does not contain any fields or configurations related to document retention. For a document to be retained for a specified period, the metadata would typically include properties such as a `retention_label`, `retention_period`, or `retention_start_date`, none of which are present in this context.

A
The document is encrypted and can only be accessed by users in the finance@contoso.com group
The JSON metadata explicitly indicates an 'encrypt' action, confirming that the document's content is protected through encryption. Furthermore, the `protection_type` is set to 'user' with the specific `value` 'finance@contoso.com'. This configuration ensures that only members of the `finance@contoso.com` security group possess the necessary rights to decrypt and access the document, thereby enforcing strict access control.
B
The document is only marked as confidential but not encrypted
Why wrong: This statement is incorrect because the JSON metadata clearly specifies an 'encrypt' action, which directly applies encryption to the document's content. While the document might also be visually marked as confidential through a sensitivity label or header/footer, the presence of the `encrypt` action unequivocally confirms that robust data encryption is actively applied, not merely a classification.
C
The document is encrypted and can be accessed by any user with the decryption key
Why wrong: While the document is indeed encrypted, the assertion that any user with a decryption key can access it is incorrect. The JSON specifies a `protection_type` of 'user' with the `value` 'finance@contoso.com', indicating that access rights are explicitly granted only to members of that specific security group. This rights management configuration ensures that decryption is authorized solely for designated users, not universally for anyone possessing a generic key.
D
The document will be retained for a specified period
Why wrong: This statement is incorrect because the provided JSON metadata does not contain any fields or configurations related to document retention. For a document to be retained for a specified period, the metadata would typically include properties such as a `retention_label`, `retention_period`, or `retention_start_date`, none of which are present in this context.

Question 4hardmultiple choice

Refer to the exhibit. A Microsoft Purview administrator imported this JSON policy for automatic sensitivity labeling. After deployment, users report that emails containing German social security numbers are not being automatically labeled. What is the most likely cause?

Exhibit

{
  "name": "GDPR-PII-Protection",
  "properties": {
    "labels": [
      {
        "name": "Highly Confidential",
        "sensitivity": "high",
        "protection": {
          "encryption": true,
          "marking": "Watermark: CONFIDENTIAL"
        },
        "autoLabeling": {
          "conditions": [
            {
              "sensitiveType": "EU_Deutschland_SocialSecurityNumber",
              "confidenceLevel": "high"
            }
          ],
          "behavior": "apply"
        }
      }
    ]
  }
}

Trap 1: The sensitive info type 'EU_Deutschland_SocialSecurityNumber' is…

The sensitive information type 'EU_Deutschland_SocialSecurityNumber' is a standard, built-in sensitive information type provided by Microsoft Purview. These built-in types are universally available across all tenants and and do not require explicit definition or configuration by an administrator to be recognized. Therefore, the premise that it is not defined in the tenant is incorrect, as it's part of the default Purview classification capabilities.

Trap 2: The encryption setting prevents auto-labeling on emails.

Encryption, when configured as part of a sensitivity label, is an *effect* of applying that label, not a prerequisite or a blocker for auto-labeling. Auto-labeling policies are designed to identify sensitive content and then apply the appropriate label, which may or may not include encryption settings. Therefore, the presence or absence of an encryption setting does not inherently prevent an auto-labeling policy from functioning and applying a label to emails.

Trap 3: The label is not published to users.

While publishing a sensitivity label to users is necessary for manual application of the label by end-users in their applications, it is not strictly required for server-side auto-labeling policies to function. Auto-labeling policies operate at the service level (e.g., Exchange Online, SharePoint Online) to automatically detect and apply labels based on defined conditions, independent of whether the label is visible or available for manual selection by individual users.

A
The sensitive info type 'EU_Deutschland_SocialSecurityNumber' is not defined in the tenant.
Why wrong: The sensitive information type 'EU_Deutschland_SocialSecurityNumber' is a standard, built-in sensitive information type provided by Microsoft Purview. These built-in types are universally available across all tenants and and do not require explicit definition or configuration by an administrator to be recognized. Therefore, the premise that it is not defined in the tenant is incorrect, as it's part of the default Purview classification capabilities.
B
Auto-labeling for emails requires 'applyWithOverride' behavior, not 'apply'.
For automatic sensitivity labeling of content in Exchange Online (emails), the `behavior` parameter in the auto-labeling policy must be set to `applyWithOverride`. The `apply` behavior is typically used for SharePoint and OneDrive content, where it applies the label without allowing users to change it. However, Exchange requires `applyWithOverride` to ensure the label is applied while still permitting users to manually modify or remove it if necessary, aligning with email workflow flexibility.
C
The encryption setting prevents auto-labeling on emails.
Why wrong: Encryption, when configured as part of a sensitivity label, is an *effect* of applying that label, not a prerequisite or a blocker for auto-labeling. Auto-labeling policies are designed to identify sensitive content and then apply the appropriate label, which may or may not include encryption settings. Therefore, the presence or absence of an encryption setting does not inherently prevent an auto-labeling policy from functioning and applying a label to emails.
D
The label is not published to users.
Why wrong: While publishing a sensitivity label to users is necessary for manual application of the label by end-users in their applications, it is not strictly required for server-side auto-labeling policies to function. Auto-labeling policies operate at the service level (e.g., Exchange Online, SharePoint Online) to automatically detect and apply labels based on defined conditions, independent of whether the label is visible or available for manual selection by individual users.

Question 5easymultiple choice

A company's security policy requires that customer data must only be accessible by authorized sales representatives. Which security principle does this requirement directly enforce?

Trap 1: Integrity

Integrity, in information security, is concerned with maintaining the accuracy, consistency, and trustworthiness of data throughout its entire lifecycle. Its primary objective is to prevent unauthorized modification, alteration, or destruction of information, ensuring that data remains complete and uncorrupted. While robust access controls contribute to integrity by preventing unauthorized changes, its focus is on the state and reliability of the data itself, not on restricting initial viewing access to authorized users.

Trap 2: Availability

Availability, within the context of information security, ensures that authorized users can access systems and data when needed, without undue delay or interruption. While crucial for business operations, its primary focus is on the uptime, resilience, and responsiveness of resources, rather than the specific control mechanisms that limit access exclusively to authorized individuals. Therefore, it addresses the presence and usability of data, not the restriction of its disclosure to unauthorized parties.

Trap 3: Non-repudiation

Non-repudiation provides irrefutable proof that a specific action or event has occurred, preventing any party from denying their involvement or the authenticity of a transaction. This is often achieved through digital signatures, audit trails, and cryptographic techniques, establishing accountability for actions such as sending a message or making a purchase. However, non-repudiation does not govern or enforce who is authorized to initially access or view data; it merely confirms that an action, once performed, cannot be legitimately denied.

A
Integrity
Why wrong: Integrity, in information security, is concerned with maintaining the accuracy, consistency, and trustworthiness of data throughout its entire lifecycle. Its primary objective is to prevent unauthorized modification, alteration, or destruction of information, ensuring that data remains complete and uncorrupted. While robust access controls contribute to integrity by preventing unauthorized changes, its focus is on the state and reliability of the data itself, not on restricting initial viewing access to authorized users.
B
Availability
Why wrong: Availability, within the context of information security, ensures that authorized users can access systems and data when needed, without undue delay or interruption. While crucial for business operations, its primary focus is on the uptime, resilience, and responsiveness of resources, rather than the specific control mechanisms that limit access exclusively to authorized individuals. Therefore, it addresses the presence and usability of data, not the restriction of its disclosure to unauthorized parties.
C
Confidentiality
Confidentiality is the fundamental security principle that ensures information is not disclosed to unauthorized individuals, entities, or processes. It directly addresses the requirement of limiting access to customer data only to those who are explicitly authorized, typically through mechanisms like encryption, access control lists (ACLs), and the principle of least privilege. This principle is paramount for protecting sensitive information from unauthorized viewing or exposure, aligning perfectly with the stated security policy.
D
Non-repudiation
Why wrong: Non-repudiation provides irrefutable proof that a specific action or event has occurred, preventing any party from denying their involvement or the authenticity of a transaction. This is often achieved through digital signatures, audit trails, and cryptographic techniques, establishing accountability for actions such as sending a message or making a purchase. However, non-repudiation does not govern or enforce who is authorized to initially access or view data; it merely confirms that an action, once performed, cannot be legitimately denied.

Question 6easymultiple choice

Your organization wants to use Microsoft Entra ID to authenticate users from a partner company that uses its own identity provider. Which federation standard should you use?

Trap 1: OAuth 2.0

OAuth 2.0 is primarily an authorization framework that enables a third-party application to obtain limited access to an HTTP service on behalf of a resource owner. It focuses on delegated access to resources rather than authenticating a user directly or federating identity between distinct identity providers. While often used in conjunction with OpenID Connect for authentication, OAuth 2.0 itself does not provide identity federation capabilities for single sign-on between organizations.

Trap 2: SCIM

The System for Cross-domain Identity Management (SCIM) is an open standard designed for automating the exchange of user identity information between identity domains or cloud applications. Its primary purpose is to provision, deprovision, and update user accounts and group memberships across different systems efficiently. SCIM is not intended for authenticating users or establishing trust relationships for single sign-on between disparate identity providers, which is the core function of federation.

Trap 3: OpenID Connect

OpenID Connect (OIDC) is an authentication layer built on top of the OAuth 2.0 framework, allowing clients to verify the identity of the end-user based on the authentication performed by an Authorization Server. It provides a standardized way for applications to obtain basic profile information about the authenticated user through ID tokens. While OIDC facilitates authentication, its primary use case involves integrating applications with an identity provider, rather than enabling direct identity federation between two distinct organizational identity providers for cross-domain single sign-on.

A
OAuth 2.0
Why wrong: OAuth 2.0 is primarily an authorization framework that enables a third-party application to obtain limited access to an HTTP service on behalf of a resource owner. It focuses on delegated access to resources rather than authenticating a user directly or federating identity between distinct identity providers. While often used in conjunction with OpenID Connect for authentication, OAuth 2.0 itself does not provide identity federation capabilities for single sign-on between organizations.
B
SCIM
Why wrong: The System for Cross-domain Identity Management (SCIM) is an open standard designed for automating the exchange of user identity information between identity domains or cloud applications. Its primary purpose is to provision, deprovision, and update user accounts and group memberships across different systems efficiently. SCIM is not intended for authenticating users or establishing trust relationships for single sign-on between disparate identity providers, which is the core function of federation.
C
OpenID Connect
Why wrong: OpenID Connect (OIDC) is an authentication layer built on top of the OAuth 2.0 framework, allowing clients to verify the identity of the end-user based on the authentication performed by an Authorization Server. It provides a standardized way for applications to obtain basic profile information about the authenticated user through ID tokens. While OIDC facilitates authentication, its primary use case involves integrating applications with an identity provider, rather than enabling direct identity federation between two distinct organizational identity providers for cross-domain single sign-on.
D
SAML 2.0
Security Assertion Markup Language (SAML) 2.0 is an XML-based open standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). It enables web-based single sign-on (SSO) across different security domains by allowing an IdP to assert a user's identity to an SP securely. This protocol is specifically designed for establishing trust and federating identities between distinct organizations or systems, making it ideal for enterprise federation scenarios.

Question 7easymultiple choice

A user is unable to access a cloud app and receives a message that their sign-in was blocked by a Conditional Access policy. The admin wants to allow the user to self-remediate by meeting policy requirements. What should the admin enable?

Trap 1: Self-Service Password Reset

Self-Service Password Reset (SSPR) allows users to reset their forgotten passwords without requiring administrator intervention. While essential for regaining access due to forgotten credentials, SSPR does not provide feedback to a user regarding why their access to a cloud application was blocked by an active policy, nor does it offer guidance on how to remediate a policy-based access restriction. It addresses credential issues, not policy compliance failures.

Trap 2: Multifactor Authentication registration

Multifactor Authentication (MFA) registration is the process where users set up and enroll additional verification methods, such as a phone or authenticator app, to strengthen their sign-in security. Although MFA is frequently a requirement enforced by access policies, the registration process itself does not provide specific, user-facing feedback about *why* a cloud app access attempt was blocked by a policy, nor does it offer remediation steps beyond the act of enabling MFA if that was the sole missing requirement.

Trap 3: Identity Protection risk policies

Azure AD Identity Protection risk policies are designed to detect potential vulnerabilities affecting an organization's identities, such as compromised credentials or suspicious sign-in behaviors. These policies can automatically block access or require MFA based on detected risk levels. However, their primary function is risk detection and automated response, not to provide explicit, user-friendly feedback detailing *which* specific policy condition was violated or how to directly remediate the policy requirement that led to the access block.

A
Self-Service Password Reset
Why wrong: Self-Service Password Reset (SSPR) allows users to reset their forgotten passwords without requiring administrator intervention. While essential for regaining access due to forgotten credentials, SSPR does not provide feedback to a user regarding why their access to a cloud application was blocked by an active policy, nor does it offer guidance on how to remediate a policy-based access restriction. It addresses credential issues, not policy compliance failures.
B
Multifactor Authentication registration
Why wrong: Multifactor Authentication (MFA) registration is the process where users set up and enroll additional verification methods, such as a phone or authenticator app, to strengthen their sign-in security. Although MFA is frequently a requirement enforced by access policies, the registration process itself does not provide specific, user-facing feedback about *why* a cloud app access attempt was blocked by a policy, nor does it offer remediation steps beyond the act of enabling MFA if that was the sole missing requirement.
C
Identity Protection risk policies
Why wrong: Azure AD Identity Protection risk policies are designed to detect potential vulnerabilities affecting an organization's identities, such as compromised credentials or suspicious sign-in behaviors. These policies can automatically block access or require MFA based on detected risk levels. However, their primary function is risk detection and automated response, not to provide explicit, user-friendly feedback detailing *which* specific policy condition was violated or how to directly remediate the policy requirement that led to the access block.
D
Conditional Access policy feedback
Conditional Access policies evaluate various signals, including user, device, location, application, and real-time risk, to make granular access decisions. When a user is blocked from accessing a cloud application due to a Conditional Access policy, the system is designed to provide direct, actionable feedback. This feedback explicitly informs the user *why* access was denied (e.g., 'Your device is not compliant') and often includes clear steps or links to remediate the issue, enabling them to meet the policy requirements and gain access.

Question 8mediummulti select

A company uses Microsoft Entra ID. They need to implement a Conditional Access policy for the finance application that requires multifactor authentication (MFA) when a user accesses the app from an unmanaged device. Additionally, they want to block access if the sign-in risk level is high. Which two grant controls should they configure in the policy? (Select two.)

Trap 1: Require device to be marked as compliant

Incorrect. While this control can enforce device compliance (e.g., Intune), the scenario does not mention a need for device compliance; it only specifies unmanaged device status (which is a condition, not a grant). The requirement is for MFA from unmanaged devices, which is handled by the 'Require MFA' grant.

Trap 2: Require approved client app

This grant control specifically restricts access to only those client applications that are explicitly designated as "approved" by the organization, such as Microsoft Outlook or Teams mobile apps with Intune App Protection Policies. It does not address device compliance, sign-in risk, or the need for stronger authentication. Therefore, if the requirement is to enforce MFA from unmanaged devices or block high-risk sign-ins, this control is irrelevant as it focuses solely on the client application's identity and management status.

A
Require multi-factor authentication
This grant control mandates that users successfully complete an additional verification step, such as a phone call, text message, or authenticator app notification, before gaining access to the resource. When applied as a Conditional Access policy, it effectively elevates the authentication strength for specific conditions, like sign-ins from unmanaged devices or high-risk locations. This ensures that even if a primary credential is compromised, unauthorized access is prevented by requiring a second, distinct factor.
B
Block access
This Conditional Access grant control is the most restrictive, immediately denying any attempt to access the targeted resource or application. It is typically employed for high-risk scenarios, such as when Microsoft Entra ID Protection detects a high sign-in risk, an unfamiliar location, or a compromised credential. Implementing "Block access" ensures that potentially malicious or unauthorized access attempts are completely prevented, safeguarding sensitive data and applications from immediate threats.
C
Require device to be marked as compliant
Why wrong: Incorrect. While this control can enforce device compliance (e.g., Intune), the scenario does not mention a need for device compliance; it only specifies unmanaged device status (which is a condition, not a grant). The requirement is for MFA from unmanaged devices, which is handled by the 'Require MFA' grant.
D
Require approved client app
Why wrong: This grant control specifically restricts access to only those client applications that are explicitly designated as "approved" by the organization, such as Microsoft Outlook or Teams mobile apps with Intune App Protection Policies. It does not address device compliance, sign-in risk, or the need for stronger authentication. Therefore, if the requirement is to enforce MFA from unmanaged devices or block high-risk sign-ins, this control is irrelevant as it focuses solely on the client application's identity and management status.

Question 9easymultiple choice

A company deploys a web application on Azure virtual machines (VMs) in an Infrastructure-as-a-Service (IaaS) model. The company is responsible for managing the guest operating system, the application code, and the data stored on the VMs. According to the shared responsibility model, which of the following security responsibilities does Microsoft retain in this scenario?

Trap 1: Configuring the operating system firewall on each VM

Configuring the OS-level firewall is a customer responsibility, as the customer manages the guest OS.

Trap 2: Installing and patching the application software

The customer is responsible for managing and patching application software deployed on IaaS VMs.

Trap 3: Managing user access to the application

Identity and access management for the application is the customer's responsibility.

A
Protecting the physical datacenter and the underlying hardware
Microsoft retains responsibility for the physical security of datacenters, servers, storage, and networking hardware in all cloud models, including IaaS.
B
Configuring the operating system firewall on each VM
Why wrong: Configuring the OS-level firewall is a customer responsibility, as the customer manages the guest OS.
C
Installing and patching the application software
Why wrong: The customer is responsible for managing and patching application software deployed on IaaS VMs.
D
Managing user access to the application
Why wrong: Identity and access management for the application is the customer's responsibility.

Question 10mediummultiple choice

Your organization uses Microsoft Sentinel as a SIEM. You need to create a rule that triggers an incident when a user account is created in an Azure subscription and then logs in from an unfamiliar location within 24 hours. Which type of rule should you configure?

Trap 1: Anomaly detection rule

Anomaly detection rules in Microsoft Sentinel are primarily driven by machine learning algorithms that establish a baseline of normal behavior and then flag deviations from that baseline. These rules are designed to identify unusual activities or patterns that might indicate a threat, rather than executing custom, user-defined correlation logic across specific events over a fixed 24-hour period. They are not suitable for scenarios requiring explicit KQL queries to join and analyze events based on custom criteria.

Trap 2: Fusion rule

Fusion rules in Microsoft Sentinel leverage advanced artificial intelligence and machine learning to automatically correlate multiple low-fidelity alerts across different products into high-fidelity, actionable incidents. While powerful for detecting multi-stage attacks, Fusion is a pre-built, proprietary correlation engine focused on alerts, not raw events. It does not allow for custom KQL logic to define specific event correlations over a user-defined 24-hour period.

Trap 3: Near-real-time (NRT) rule

Near-real-time (NRT) rules are designed for rapid threat detection, running KQL queries as frequently as every minute to identify immediate threats. While they offer speed, their primary purpose is for short-duration, high-frequency checks, not for correlating events that span an entire 24-hour period. An NRT rule's 1-minute interval and typical lookback window are optimized for immediate alerts, making it inefficient and unsuitable for comprehensive daily correlation tasks requiring a broader time scope.

A
Anomaly detection rule
Why wrong: Anomaly detection rules in Microsoft Sentinel are primarily driven by machine learning algorithms that establish a baseline of normal behavior and then flag deviations from that baseline. These rules are designed to identify unusual activities or patterns that might indicate a threat, rather than executing custom, user-defined correlation logic across specific events over a fixed 24-hour period. They are not suitable for scenarios requiring explicit KQL queries to join and analyze events based on custom criteria.
B
Scheduled query rule
Scheduled query rules are the appropriate choice for correlating events over a specific time window, such as 24 hours. These rules allow security analysts to write custom Kusto Query Language (KQL) queries that can join multiple data sources, apply complex logic, and identify specific patterns or sequences of events. They can be configured to run at defined intervals (e.g., daily) and look back over a specified period, making them ideal for long-duration correlation and custom threat detection scenarios.
C
Fusion rule
Why wrong: Fusion rules in Microsoft Sentinel leverage advanced artificial intelligence and machine learning to automatically correlate multiple low-fidelity alerts across different products into high-fidelity, actionable incidents. While powerful for detecting multi-stage attacks, Fusion is a pre-built, proprietary correlation engine focused on alerts, not raw events. It does not allow for custom KQL logic to define specific event correlations over a user-defined 24-hour period.
D
Near-real-time (NRT) rule
Why wrong: Near-real-time (NRT) rules are designed for rapid threat detection, running KQL queries as frequently as every minute to identify immediate threats. While they offer speed, their primary purpose is for short-duration, high-frequency checks, not for correlating events that span an entire 24-hour period. An NRT rule's 1-minute interval and typical lookback window are optimized for immediate alerts, making it inefficient and unsuitable for comprehensive daily correlation tasks requiring a broader time scope.

Question 11mediummultiple choice

A company uses Microsoft Entra ID. Their sales team wants to use a third-party customer relationship management (CRM) application that requires the 'Sign in and read user profile' permission and also a high-risk permission to 'Read all users' full profiles'. The security team wants to allow users to request access to this application, but they want to require an administrator to review and approve the high-risk permission request before consent is granted. Which Microsoft Entra ID feature should they configure?

Trap 1: Conditional Access

Conditional Access policies enforce specific controls based on various conditions, such as user location, device compliance, sign-in risk, or application, to determine whether a user can access a resource. These policies are applied *after* an application has been granted consent and a user attempts to sign in, governing *how* and *when* access is permitted. Conditional Access does not, however, manage the initial process of requesting or granting consent for an application's required permissions.

Trap 2: Identity Protection

Microsoft Entra ID Protection is a security module focused on detecting, investigating, and remediating identity-based risks, such as suspicious sign-ins, leaked credentials, or anomalous user behavior. It leverages machine learning to identify potential threats to user identities and can trigger automated responses like multi-factor authentication enforcement or password resets. This service is entirely distinct from the process of managing user or admin consent for application permissions, as its scope is risk detection, not application authorization workflows.

Trap 3: Privileged Identity Management (PIM)

Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources within Microsoft Entra ID, Azure, and other Microsoft services by providing just-in-time (JIT) and just-enough-administration (JEA) access to privileged roles. While crucial for securing administrative functions, PIM does not facilitate or manage the process of users requesting consent for application permissions. Its focus is on elevating user roles temporarily, not on granting organizational consent for applications.

A
Admin consent workflow
The Admin consent workflow in Microsoft Entra ID allows users to request administrator approval for applications that require permissions necessitating admin consent. When a user attempts to access such an application, they are prompted to request approval, triggering a workflow where designated administrators can review the requested permissions and decide to grant or deny the organization-wide consent. This mechanism ensures that applications requiring elevated permissions are properly vetted before being authorized for use across the tenant, maintaining security and compliance.
B
Conditional Access
Why wrong: Conditional Access policies enforce specific controls based on various conditions, such as user location, device compliance, sign-in risk, or application, to determine whether a user can access a resource. These policies are applied *after* an application has been granted consent and a user attempts to sign in, governing *how* and *when* access is permitted. Conditional Access does not, however, manage the initial process of requesting or granting consent for an application's required permissions.
C
Identity Protection
Why wrong: Microsoft Entra ID Protection is a security module focused on detecting, investigating, and remediating identity-based risks, such as suspicious sign-ins, leaked credentials, or anomalous user behavior. It leverages machine learning to identify potential threats to user identities and can trigger automated responses like multi-factor authentication enforcement or password resets. This service is entirely distinct from the process of managing user or admin consent for application permissions, as its scope is risk detection, not application authorization workflows.
D
Privileged Identity Management (PIM)
Why wrong: Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources within Microsoft Entra ID, Azure, and other Microsoft services by providing just-in-time (JIT) and just-enough-administration (JEA) access to privileged roles. While crucial for securing administrative functions, PIM does not facilitate or manage the process of users requesting consent for application permissions. Its focus is on elevating user roles temporarily, not on granting organizational consent for applications.

Question 12easymultiple choice

A company uses Microsoft Entra ID (Microsoft Entra ID) for identity management. They want to automatically block sign-ins from users whose credentials have been compromised and require them to change their password before access is granted. Which Microsoft Entra ID capability should they use?

Trap 1: Conditional Access policies

Conditional Access policies are an enforcement engine that uses signals from various sources, including Microsoft Entra ID Protection, to make access decisions. While it can block access or require additional authentication based on a detected risk, Conditional Access itself does not possess the inherent capability to detect compromised credentials. It relies on upstream services like Identity Protection to provide the risk assessment before applying its access controls.

Trap 2: Privileged Identity Management (PIM)

Privileged Identity Management (PIM) focuses on managing, controlling, and monitoring access to important resources within Microsoft Entra ID, Azure, and other Microsoft services. Its primary function is to provide just-in-time and just-enough access for privileged roles, reducing the attack surface associated with standing administrative permissions. PIM is not designed to detect or prevent the compromise of standard user credentials, but rather to secure the use of high-privilege accounts.

Trap 3: Self-Service Password Reset (SSPR)

Self-Service Password Reset (SSPR) empowers users to reset their own forgotten or expired passwords without administrator intervention. While it improves user experience and reduces helpdesk calls, SSPR does not include any mechanisms for proactively detecting or blocking compromised credentials. It is a reactive tool for password management, not a security service for identifying and mitigating identity-based threats like credential compromise.

A
Microsoft Entra ID Protection
Microsoft Entra ID Protection is specifically designed to detect and remediate identity-based risks, including compromised credentials. It leverages machine learning to identify suspicious activities like leaked credentials, anomalous sign-ins, and impossible travel. Upon detection, it can automatically enforce policies such as blocking sign-ins, requiring multi-factor authentication, or prompting for a password change, thereby directly protecting against credential compromise.
B
Conditional Access policies
Why wrong: Conditional Access policies are an enforcement engine that uses signals from various sources, including Microsoft Entra ID Protection, to make access decisions. While it can block access or require additional authentication based on a detected risk, Conditional Access itself does not possess the inherent capability to detect compromised credentials. It relies on upstream services like Identity Protection to provide the risk assessment before applying its access controls.
C
Privileged Identity Management (PIM)
Why wrong: Privileged Identity Management (PIM) focuses on managing, controlling, and monitoring access to important resources within Microsoft Entra ID, Azure, and other Microsoft services. Its primary function is to provide just-in-time and just-enough access for privileged roles, reducing the attack surface associated with standing administrative permissions. PIM is not designed to detect or prevent the compromise of standard user credentials, but rather to secure the use of high-privilege accounts.
D
Self-Service Password Reset (SSPR)
Why wrong: Self-Service Password Reset (SSPR) empowers users to reset their own forgotten or expired passwords without administrator intervention. While it improves user experience and reduces helpdesk calls, SSPR does not include any mechanisms for proactively detecting or blocking compromised credentials. It is a reactive tool for password management, not a security service for identifying and mitigating identity-based threats like credential compromise.

Question 13mediummultiple choice

A legal team is handling a lawsuit and needs to gather all electronically stored information (ESI) related to a specific case from across Microsoft 365, including emails, Teams messages, and SharePoint documents. They need to place a hold on the custodians' data to prevent deletion or modification, and then collect, review, and export the data. Which Microsoft Purview solution should they use?

Trap 1: Microsoft Purview eDiscovery (Standard)

Microsoft Purview eDiscovery (Standard) offers foundational search and export capabilities for content across Microsoft 365, suitable for basic investigations or regulatory requests. However, it lacks the advanced features essential for comprehensive legal proceedings, such as the ability to identify and manage specific custodians, apply targeted legal holds, or leverage sophisticated analytics and machine learning tools for efficient document review and culling. Consequently, it is insufficient for the rigorous demands of a full-scale lawsuit requiring extensive data gathering and analysis.

Trap 2: Microsoft Purview Audit (Premium)

Microsoft Purview Audit (Premium) is primarily designed to provide detailed logging and forensic investigation capabilities for user and administrator activities within Microsoft 365 services. While invaluable for understanding security incidents, compliance breaches, or user behavior, it does not offer any functionality for placing legal holds on data to prevent modification or deletion, nor does it facilitate the collection, processing, or review of electronically stored information (ESI) for legal discovery purposes. Its focus is on activity monitoring, not data preservation or collection for litigation.

Trap 3: Microsoft Purview Data Lifecycle Management

Microsoft Purview Data Lifecycle Management (DLM) is centered on managing the retention and deletion of data throughout its lifecycle using retention policies and labels. While DLM can prevent data from being prematurely deleted and ensure compliance with retention requirements, it is not designed to implement specific, targeted legal holds for litigation. It lacks the ability to identify custodians, apply holds based on legal case requirements, or provide the advanced collection, processing, and review tools necessary for a comprehensive eDiscovery workflow.

A
Microsoft Purview eDiscovery (Premium)
Microsoft Purview eDiscovery (Premium) is the comprehensive solution specifically engineered for managing the entire electronic discovery workflow required for complex legal cases. It enables legal teams to identify specific custodians, place defensible legal holds on their data across Exchange mailboxes, SharePoint sites, OneDrive accounts, and Microsoft Teams, and then perform advanced collection, processing, review, and analysis of electronically stored information (ESI) using features like analytics and predictive coding. This robust capability ensures all relevant data is preserved and efficiently prepared for litigation.
B
Microsoft Purview eDiscovery (Standard)
Why wrong: Microsoft Purview eDiscovery (Standard) offers foundational search and export capabilities for content across Microsoft 365, suitable for basic investigations or regulatory requests. However, it lacks the advanced features essential for comprehensive legal proceedings, such as the ability to identify and manage specific custodians, apply targeted legal holds, or leverage sophisticated analytics and machine learning tools for efficient document review and culling. Consequently, it is insufficient for the rigorous demands of a full-scale lawsuit requiring extensive data gathering and analysis.
C
Microsoft Purview Audit (Premium)
Why wrong: Microsoft Purview Audit (Premium) is primarily designed to provide detailed logging and forensic investigation capabilities for user and administrator activities within Microsoft 365 services. While invaluable for understanding security incidents, compliance breaches, or user behavior, it does not offer any functionality for placing legal holds on data to prevent modification or deletion, nor does it facilitate the collection, processing, or review of electronically stored information (ESI) for legal discovery purposes. Its focus is on activity monitoring, not data preservation or collection for litigation.
D
Microsoft Purview Data Lifecycle Management
Why wrong: Microsoft Purview Data Lifecycle Management (DLM) is centered on managing the retention and deletion of data throughout its lifecycle using retention policies and labels. While DLM can prevent data from being prematurely deleted and ensure compliance with retention requirements, it is not designed to implement specific, targeted legal holds for litigation. It lacks the ability to identify custodians, apply holds based on legal case requirements, or provide the advanced collection, processing, and review tools necessary for a comprehensive eDiscovery workflow.

Question 14easymultiple choice

A user receives an encrypted email from their bank. They use their private key to decrypt the message. After reading it, they verify that the message content has not been altered during transit. Which security principle is primarily demonstrated by the verification that the content was not altered?

Trap 1: Confidentiality

Confidentiality protects information from unauthorized disclosure, ensuring that only authorized individuals can access or read sensitive data. While the email being encrypted inherently provides confidentiality by preventing unauthorized parties from reading its content, the specific action described is the user *verifying* that the message content has not been *altered*. This verification process directly addresses integrity, even though confidentiality is also present due to encryption.

Trap 2: Availability

Availability ensures that authorized users can access information and systems when needed, without undue delay or interruption. The scenario describes a user successfully receiving and interacting with an email, indicating that the email service and the message itself were available. The act of verifying the message's content for alteration does not relate to the accessibility or uptime of the system or data, but rather to its trustworthiness.

Trap 3: Non-repudiation

Non-repudiation provides irrefutable proof of an action, preventing a sender from denying they sent a message or a recipient from denying they received it. While digital signatures can provide non-repudiation by linking a message to a specific sender, the scenario's focus is on verifying the *content's state* (unchanged), not on proving the sender's identity or preventing their denial of sending the email. Therefore, verifying content alteration is distinct from non-repudiation.

A
Confidentiality
Why wrong: Confidentiality protects information from unauthorized disclosure, ensuring that only authorized individuals can access or read sensitive data. While the email being encrypted inherently provides confidentiality by preventing unauthorized parties from reading its content, the specific action described is the user *verifying* that the message content has not been *altered*. This verification process directly addresses integrity, even though confidentiality is also present due to encryption.
B
Integrity
Integrity ensures that data remains unaltered and complete during transmission or storage. When a user verifies that the content of an encrypted email from their bank has not been changed, they are confirming its integrity. This is typically achieved through cryptographic mechanisms like hashing or digital signatures, which detect any unauthorized modification, ensuring the message received is exactly what was sent.
C
Availability
Why wrong: Availability ensures that authorized users can access information and systems when needed, without undue delay or interruption. The scenario describes a user successfully receiving and interacting with an email, indicating that the email service and the message itself were available. The act of verifying the message's content for alteration does not relate to the accessibility or uptime of the system or data, but rather to its trustworthiness.
D
Non-repudiation
Why wrong: Non-repudiation provides irrefutable proof of an action, preventing a sender from denying they sent a message or a recipient from denying they received it. While digital signatures can provide non-repudiation by linking a message to a specific sender, the scenario's focus is on verifying the *content's state* (unchanged), not on proving the sender's identity or preventing their denial of sending the email. Therefore, verifying content alteration is distinct from non-repudiation.

Question 15easymultiple choice

A user logs into the company's network using their username and password. After successful login, the user attempts to open a financial report but receives an access denied message because they are not a member of the 'Finance' security group. Which security concept is best illustrated by the access denial?

Trap 1: Authentication

Authentication is the initial security step where a user or system proves their asserted identity, typically through credentials like usernames and passwords, biometrics, or certificates. Its sole purpose is to verify "who you are," confirming the legitimacy of the entity attempting to gain access. While essential for entry, authentication itself does not dictate what specific resources or actions that verified identity is allowed to perform once inside the system.

Trap 2: Accounting

Accounting, often referred to as auditing, involves systematically tracking and logging all user activities, resource consumption, and system events within a network or application. Its primary function is to create a comprehensive audit trail, enabling security administrators to review "what happened, when, and by whom." This data is crucial for forensic analysis, compliance reporting, and identifying potential security breaches, but it does not directly govern whether access is granted or denied in real-time.

Trap 3: Non-repudiation

Non-repudiation is a security service designed to provide irrefutable proof that a specific action or event occurred and originated from a particular source. It prevents an entity from successfully denying responsibility for a past action, often achieved through digital signatures or cryptographic hashing that binds an action to an identity. This concept is distinct from access control, as it focuses on accountability and trustworthiness of past actions rather than real-time access decisions.

A
Authentication
Why wrong: Authentication is the initial security step where a user or system proves their asserted identity, typically through credentials like usernames and passwords, biometrics, or certificates. Its sole purpose is to verify "who you are," confirming the legitimacy of the entity attempting to gain access. While essential for entry, authentication itself does not dictate what specific resources or actions that verified identity is allowed to perform once inside the system.
B
Authorization
Authorization is the critical security process that determines what an authenticated user or system is permitted to do or access within a network or application. Following successful authentication, authorization mechanisms evaluate a user's assigned roles, group memberships, and specific permissions against the requested resource or action. If the user lacks the necessary privileges, access is explicitly denied, directly explaining why a logged-in user might be unable to access certain resources.
C
Accounting
Why wrong: Accounting, often referred to as auditing, involves systematically tracking and logging all user activities, resource consumption, and system events within a network or application. Its primary function is to create a comprehensive audit trail, enabling security administrators to review "what happened, when, and by whom." This data is crucial for forensic analysis, compliance reporting, and identifying potential security breaches, but it does not directly govern whether access is granted or denied in real-time.
D
Non-repudiation
Why wrong: Non-repudiation is a security service designed to provide irrefutable proof that a specific action or event occurred and originated from a particular source. It prevents an entity from successfully denying responsibility for a past action, often achieved through digital signatures or cryptographic hashing that binds an action to an identity. This concept is distinct from access control, as it focuses on accountability and trustworthiness of past actions rather than real-time access decisions.

Question 16mediummultiple choice

Your organization uses Microsoft Purview to enforce data loss prevention (DLP) policies. You need to ensure that when a user attempts to share a document containing credit card numbers via email, the document is blocked and the user receives a policy tip. What should you configure in the DLP policy?

Trap 1: Set the action to 'Audit only'

Set the action to 'Audit only' [wrong]

Trap 2: Set the action to 'Block'

Set the action to 'Block' [wrong]

Trap 3: Set the action to 'Notify only'

Set the action to 'Notify only' [wrong]

A
Set the action to 'Audit only'
Why wrong: Set the action to 'Audit only' [wrong]
B
Set the action to 'Block with override'
Set the action to 'Block with override' [CORRECT]
C
Set the action to 'Block'
Why wrong: Set the action to 'Block' [wrong]
D
Set the action to 'Notify only'
Why wrong: Set the action to 'Notify only' [wrong]

Question 17easymulti select

A user scans their fingerprint to unlock a corporate laptop. After unlocking, the user attempts to open a confidential database. The system checks the user's role and grants access because the user is a member of the 'Data Analyst' group. Which two security concepts are demonstrated in this scenario?

Trap 1: Confidentiality and integrity

Incorrect. While the scenario involves a confidential database, the concepts of confidentiality (preventing unauthorized disclosure) and integrity (ensuring data accuracy and no tampering) are not explicitly demonstrated. The access control mechanism ensures only authorized users can access the database, which is related to authorization, not a direct demonstration of confidentiality or integrity.

Trap 2: Identification and non-repudiation

Incorrect. Identification refers to claiming an identity (e.g., providing a username), which is not shown here; the fingerprint is used for authentication (proof). Non-repudiation is not established because there is no evidence to prevent the user from denying the action.

Trap 3: Availability and accountability

Incorrect. Availability of the database is not tested or demonstrated, and accountability (tracking user actions) is not shown in this scenario.

A
Authentication and authorization
Correct. The fingerprint scan authenticates the user, and the role-based access check authorizes the user to open the database. These are the two security concepts demonstrated.
B
Confidentiality and integrity
Why wrong: Incorrect. While the scenario involves a confidential database, the concepts of confidentiality (preventing unauthorized disclosure) and integrity (ensuring data accuracy and no tampering) are not explicitly demonstrated. The access control mechanism ensures only authorized users can access the database, which is related to authorization, not a direct demonstration of confidentiality or integrity.
C
Identification and non-repudiation
Why wrong: Incorrect. Identification refers to claiming an identity (e.g., providing a username), which is not shown here; the fingerprint is used for authentication (proof). Non-repudiation is not established because there is no evidence to prevent the user from denying the action.
D
Availability and accountability
Why wrong: Incorrect. Availability of the database is not tested or demonstrated, and accountability (tracking user actions) is not shown in this scenario.

Question 18mediummultiple choice

An organization uses Microsoft Purview Data Loss Prevention (DLP) to prevent sensitive data from being shared externally. They need to block sharing of credit card numbers in emails and Teams messages. What should they create?

Trap 1: A retention label to retain credit card data

A retention label is designed to manage the lifecycle of data, ensuring it is kept for a specific period or deleted after a set duration to meet regulatory or organizational requirements. While crucial for data governance, retention labels do not actively scan content for sensitive information types (SITs) like credit card numbers to prevent sharing or exfiltration. Their function is data retention and deletion, not real-time data loss prevention.

Trap 2: An audit policy to log credit card sharing

An audit policy is designed to record user and administrator activities within Microsoft 365 services, creating a comprehensive log of events for compliance, security investigations, and forensic analysis. While an audit policy could log instances of credit card data being shared, its function is purely reactive—it documents what happened after the fact. It does not possess the capability to proactively detect sensitive content or block the sharing action in real-time.

Trap 3: A sensitivity label that marks credit card data

Sensitivity labels in Microsoft Purview are used to classify and apply persistent protection to sensitive content by adding visual markings (like headers, footers, or watermarks) and encryption. While a sensitivity label can indicate that data contains credit card information, the label's primary function is classification and persistent protection, not the real-time blocking of sharing actions. Blocking sharing is typically an enforcement action taken by a DLP policy, often in conjunction with or triggered by a sensitivity label, but not solely by the label itself.

A
A retention label to retain credit card data
Why wrong: A retention label is designed to manage the lifecycle of data, ensuring it is kept for a specific period or deleted after a set duration to meet regulatory or organizational requirements. While crucial for data governance, retention labels do not actively scan content for sensitive information types (SITs) like credit card numbers to prevent sharing or exfiltration. Their function is data retention and deletion, not real-time data loss prevention.
B
A DLP policy with a rule that detects credit card numbers and blocks sharing
Microsoft Purview Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and protect sensitive information across various locations, including Microsoft 365 services, endpoints, and cloud apps. A DLP policy configured with a rule to detect credit card numbers (a sensitive information type) can automatically block sharing attempts, notify users, or encrypt content, thereby preventing unauthorized data exfiltration. This directly addresses the requirement to block sharing of sensitive data.
C
An audit policy to log credit card sharing
Why wrong: An audit policy is designed to record user and administrator activities within Microsoft 365 services, creating a comprehensive log of events for compliance, security investigations, and forensic analysis. While an audit policy could log instances of credit card data being shared, its function is purely reactive—it documents what happened after the fact. It does not possess the capability to proactively detect sensitive content or block the sharing action in real-time.
D
A sensitivity label that marks credit card data
Why wrong: Sensitivity labels in Microsoft Purview are used to classify and apply persistent protection to sensitive content by adding visual markings (like headers, footers, or watermarks) and encryption. While a sensitivity label can indicate that data contains credit card information, the label's primary function is classification and persistent protection, not the real-time blocking of sharing actions. Blocking sharing is typically an enforcement action taken by a DLP policy, often in conjunction with or triggered by a sensitivity label, but not solely by the label itself.

Question 19easymultiple choice

You are designing an identity solution for a new company that will use Microsoft Entra ID. The company wants employees to use biometrics (fingerprint) on their mobile devices to sign in without typing a password. Which Microsoft Entra feature should you implement?

Trap 1: Windows Hello for Business

Windows Hello for Business is a robust credential management system designed specifically for Windows 10/11 devices, enabling strong user authentication through biometrics (face or fingerprint) or PIN. It provisions a user-specific, device-bound key or certificate for sign-in, eliminating passwords on the local device. However, it is an operating system feature integrated into Windows and does not extend its biometric capabilities directly to mobile operating systems like iOS or Android for cloud service authentication. Therefore, it cannot fulfill a requirement for mobile biometric sign-in.

Trap 2: SMS-based sign-in

SMS-based sign-in allows users to authenticate by entering their registered phone number and then receiving a one-time passcode (OTP) via text message, which they then input into the sign-in prompt. While it offers a convenient method for multi-factor authentication or even primary sign-in, this approach relies solely on possession of the registered mobile device and knowledge of the OTP. It does not incorporate or leverage any biometric verification methods such as fingerprint or facial recognition from the mobile device itself.

Trap 3: FIDO2 security keys

FIDO2 security keys are physical hardware devices that provide strong, phishing-resistant authentication by generating cryptographic credentials. These keys typically connect via USB, NFC, or Bluetooth to a device and often incorporate their own biometric sensors (e.g., fingerprint readers) or PIN pads for user verification on the key itself. While highly secure, they are external hardware tokens and do not utilize the built-in biometric capabilities of a user's mobile phone for authentication to cloud services.

A
Windows Hello for Business
Why wrong: Windows Hello for Business is a robust credential management system designed specifically for Windows 10/11 devices, enabling strong user authentication through biometrics (face or fingerprint) or PIN. It provisions a user-specific, device-bound key or certificate for sign-in, eliminating passwords on the local device. However, it is an operating system feature integrated into Windows and does not extend its biometric capabilities directly to mobile operating systems like iOS or Android for cloud service authentication. Therefore, it cannot fulfill a requirement for mobile biometric sign-in.
B
Microsoft Authenticator app (passwordless)
The Microsoft Authenticator app provides a secure and convenient passwordless sign-in experience by leveraging the biometric capabilities (fingerprint or facial recognition) inherent to the user's mobile device. When a user attempts to sign in to an Azure AD-connected application, a notification is sent to the Authenticator app, prompting for approval using the device's native biometrics. This method securely verifies the user's identity on their registered mobile device, eliminating the need to type a password and enhancing security against phishing attacks. It directly addresses the requirement for mobile biometric authentication.
C
SMS-based sign-in
Why wrong: SMS-based sign-in allows users to authenticate by entering their registered phone number and then receiving a one-time passcode (OTP) via text message, which they then input into the sign-in prompt. While it offers a convenient method for multi-factor authentication or even primary sign-in, this approach relies solely on possession of the registered mobile device and knowledge of the OTP. It does not incorporate or leverage any biometric verification methods such as fingerprint or facial recognition from the mobile device itself.
D
FIDO2 security keys
Why wrong: FIDO2 security keys are physical hardware devices that provide strong, phishing-resistant authentication by generating cryptographic credentials. These keys typically connect via USB, NFC, or Bluetooth to a device and often incorporate their own biometric sensors (e.g., fingerprint readers) or PIN pads for user verification on the key itself. While highly secure, they are external hardware tokens and do not utilize the built-in biometric capabilities of a user's mobile phone for authentication to cloud services.

Question 20mediummultiple choice

A company uses Microsoft Entra ID. They want to ensure only current employees have access to a sensitive HR application. They implement a process where group membership for the HR app is reviewed quarterly by the HR manager, and any unnecessary access is automatically removed. Which Microsoft Entra feature should they use?

Trap 1: A

Microsoft Entra Conditional Access enforces policies based on real-time conditions like user location, device compliance, or sign-in risk during an authentication attempt. Its primary function is to grant or block access, or require additional authentication, at the point of access. It does not provide a mechanism for scheduled, periodic reviews of existing group memberships or application assignments, nor does it automate the removal of access based on such reviews.

Trap 2: B

Microsoft Entra Identity Protection is a security feature focused on detecting, investigating, and remediating identity-based risks, such as compromised credentials or anomalous sign-in behaviors. It uses machine learning to identify potential threats to user identities. While crucial for security, it does not offer functionality for managing periodic access reviews of group memberships or application assignments, nor does it automate the removal of access based on a review process.

Trap 3: D

Microsoft Entra Privileged Identity Management (PIM) focuses on managing, controlling, and monitoring access to important organizational resources, primarily by providing just-in-time (JIT) and just-enough-access (JEA) for privileged roles and resources. While PIM includes access reviews for *privileged* role assignments and PIM-enabled groups, its scope is specifically privileged access, not general, periodic reviews of all group memberships or application assignments for non-privileged users.

A
A
Why wrong: Microsoft Entra Conditional Access enforces policies based on real-time conditions like user location, device compliance, or sign-in risk during an authentication attempt. Its primary function is to grant or block access, or require additional authentication, at the point of access. It does not provide a mechanism for scheduled, periodic reviews of existing group memberships or application assignments, nor does it automate the removal of access based on such reviews.
B
B
Why wrong: Microsoft Entra Identity Protection is a security feature focused on detecting, investigating, and remediating identity-based risks, such as compromised credentials or anomalous sign-in behaviors. It uses machine learning to identify potential threats to user identities. While crucial for security, it does not offer functionality for managing periodic access reviews of group memberships or application assignments, nor does it automate the removal of access based on a review process.
C
C
Microsoft Entra Access Reviews, a component of Entra ID Governance, are specifically designed to manage the lifecycle of access to resources by enabling organizations to periodically review who has access to groups, applications, or roles. This feature allows for scheduled reviews, automated notifications to reviewers, and the automatic removal of access for users who no longer require it, directly addressing the need for periodic access validation and cleanup.
D
D
Why wrong: Microsoft Entra Privileged Identity Management (PIM) focuses on managing, controlling, and monitoring access to important organizational resources, primarily by providing just-in-time (JIT) and just-enough-access (JEA) for privileged roles and resources. While PIM includes access reviews for *privileged* role assignments and PIM-enabled groups, its scope is specifically privileged access, not general, periodic reviews of all group memberships or application assignments for non-privileged users.