Topic 3

Question 1

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• With Advanced Audit in Microsoft 365, you can identify when email items were accessed
• Advanced Audit in Microsoft 365 supports the same retention period of audit logs as core auditing
• Advanced Audit in Microsoft 365 allocates customer-dedicated bandwidth for accessing audit data

Answer 1

• With Advanced Audit in Microsoft 365, you can identify when email items were accessed → Yes
• Advanced Audit in Microsoft 365 supports the same retention period of audit logs as core auditing → No
• Advanced Audit in Microsoft 365 allocates customer-dedicated bandwidth for accessing audit data → Yes

Question 2

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• Azure Active Directory (Azure AD) Identity Protection can add users to groups based on the users’ risk level
• Azure Active Directory (Azure AD) Identity Protection can detect whether user credentials were leaked to the public
• Azure Active Directory (Azure AD) Identity Protection can be used to invoke Multi-Factor Authentication based on a user’s risk level

Answer 2

• Azure Active Directory (Azure AD) Identity Protection can add users to groups based on the users’ risk level → No
• Azure Active Directory (Azure AD) Identity Protection can detect whether user credentials were leaked to the public → Yes
• Azure Active Directory (Azure AD) Identity Protection can be used to invoke Multi-Factor Authentication based on a user’s risk level → Yes

Question 3

Which Microsoft 365 compliance center feature can you use to identify all the documents on a Microsoft SharePoint Online site that contain a specific key word?

A. Audit
B. Compliance Manager
C. Content Search
D. Alerts

Answer 3

C. Content Search

Question 4

Select the answer that correctly completes the sentence.

• Azure Defender
• Microsoft Purview Compliance Portal
• The Microsoft Defender portal
• Microsoft Endpoint Manager
  ↘
  provides a central location for managing information protection, information governance, and data loss prevention (DLP) policies.

Answer 4

Microsoft Purview Compliance Portal

Question 5

Which Microsoft 365 feature can you use to restrict users from sending email messages that contain lists of customers and their associated credit card numbers?

A. retention policies
B. data loss prevention (DLP) policies
C. conditional access policies
D. information barriers

Answer 5

B. data loss prevention (DLP) policies

Question 6

Select the answer that correctly completes the sentence.

• Customer Lockbox
• Information barriers
• Privileged Access Management (PAM)
• Sensitivity labels
  ↘
  can be used to provide Microsoft Support Engineers with access to an organization’s data stored in Microsoft Exchange Online, SharePoint Online, and OneDrive for Business.

Answer 6

• Customer Lockbox

Question 7

In a Core eDiscovery workflow, what should you do before you can search for content?

A. Create an eDiscovery hold.
B. Run Express Analysis.
C. Configure attorney-client privilege detection.
D. Export and download results.

Answer 7

A. Create an eDiscovery hold.

Question 8

Which Microsoft portal provides information about how Microsoft manages privacy, compliance, and security?

A. Microsoft Service Trust Portal
B. Compliance Manager
C. Microsoft 365 compliance center
D. Microsoft Support

Answer 8

A. Microsoft Service Trust Portal

Question 9

What can you protect by using the information protection solution in the Microsoft 365 compliance center?

A. computers from zero-day exploits
B. users from phishing attempts
C. files from malware and viruses
D. sensitive data from being exposed to unauthorized users

Answer 9

D. sensitive data from being exposed to unauthorized users

Question 10

What can you specify in Microsoft 365 sensitivity labels?

A. how long files must be preserved
B. when to archive an email message
C. which watermark to add to files
D. where to store files

Answer 10

C. which watermark to add to files

Question 11

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• You can use Advanced Audit in Microsoft 365 to view billing details
• You can use Advanced Audit in Microsoft 365 to view the contents of an email message
• You can use Advanced Audit in Microsoft 365 to identify when a user uses the search bar in Outlook on the web to search for items in a mailbox

Answer 11

• You can use Advanced Audit in Microsoft 365 to view billing details → No
• You can use Advanced Audit in Microsoft 365 to view the contents of an email message → No
• You can use Advanced Audit in Microsoft 365 to identify when a user uses the search bar in Outlook on the web to search for items in a mailbox → Yes

Question 12

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• You can add a resource lock to an Azure subscription
• You can add only one resource lock to an Azure resource
• You can delete a resource group containing resources that have resource locks

Answer 12

• You can add a resource lock to an Azure subscription → Yes
• You can add only one resource lock to an Azure resource → No
• You can delete a resource group containing resources that have resource locks → No

Question 13

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• Users can apply sensitivity labels manually
• Multiple sensitivity labels can be applied to the same file
• A sensitivity label can apply a watermark to a Microsoft Word document

Answer 13

• Users can apply sensitivity labels manually → Yes
• Multiple sensitivity labels can be applied to the same file → No
• A sensitivity label can apply a watermark to a Microsoft Word document → Yes

Question 14

Which two tasks can you implement by using data loss prevention (DLP) policies in Microsoft 365?

A. Display policy tips to users who are about to violate your organization’s policies.
B. Enable disk encryption on endpoints.
C. Protect documents in Microsoft OneDrive that contain sensitive information.
D. Apply security baselines to devices.

Answer 14

A. Display policy tips to users who are about to violate your organization’s policies.
C. Protect documents in Microsoft OneDrive that contain sensitive information.

Question 15

Select the answer that correctly completes the sentence.

Compliance Manager assesses compliance data _______ for an organization.
↘
- continually
- monthly
- on-demand
- quarterly

Answer 15

continually

Question 16

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• Sensitivity labels can be used to encrypt documents
• Sensitivity labels can add headers and footers to documents
• Sensitivity labels can apply watermarks to emails

Answer 16

• Sensitivity labels can be used to encrypt documents → Yes
• Sensitivity labels can add headers and footers to documents → Yes
• Sensitivity labels can apply watermarks to emails → No

Question 17

Which Microsoft 365 compliance feature can you use to encrypt content automatically based on specific conditions?

A. Content Search
B. sensitivity labels
C. retention policies
D. eDiscovery

Answer 17

B. sensitivity labels

Question 18

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• Compliance Manager tracks only customer-managed controls
• Compliance Manager provides predefined templates for creating assessments
• Compliance Manager can help you assess whether data adheres to specific data protection standards

Answer 18

• Compliance Manager tracks only customer-managed controls → No
• Compliance Manager provides predefined templates for creating assessments → Yes
• Compliance Manager can help you assess whether data adheres to specific data protection standards → Yes

Question 19

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• You can use the insider risk management solution to detect phishing scams
• You can access the insider risk management solution from the Microsoft 365 compliance center
• You can use the insider risk management solution to detect data leaks by unhappy employees

Answer 19

• You can use the insider risk management solution to detect phishing scams → No
• You can access the insider risk management solution from the Microsoft 365 compliance center → Yes
• You can use the insider risk management solution to detect data leaks by unhappy employees → Yes

Question 20

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• Azure Policy supports automatic remediation
• Azure Policy can be used to ensure that new resources adhere to corporate standards
• Compliance evaluation in Azure Policy occurs only when a target resource is created or modified

Answer 20

• Azure Policy supports automatic remediation → Yes
• Azure Policy can be used to ensure that new resources adhere to corporate standards → Yes
• Compliance evaluation in Azure Policy occurs only when a target resource is created or modified → No

Question 21

• Same as question 155-
  Match the Microsoft 365 insider risk management workflow step to the appropriate task.

Steps
- Action
- Investigate
- Triage

Answer Area
- Review and filter alerts
- Create cases in the Case dashboard
- Send a reminder of corporate policies to users

Answer 21

Action → Send a reminder of corporate policies to users
Investigate → Create cases in the Case dashboard
Triage → Review and filter alerts

Question 22

Which two cards are available in the Microsoft 365 Defender portal?

A. Devices at risk
B. Compliance Score
C. Service Health
D. User Management
E. Users at risk

Answer 22

A. Devices at risk
E. Users at risk

Question 23

What should you use to ensure that the members of an Azure Active Directory group use multi-factor authentication (MFA) when they sign in?

A. Azure role-based access control (Azure RBAC)
B. Azure Active Directory (Azure AD) Privileged Identity Management (PIM)
C. Azure Active Directory (Azure AD) Identity Protection
D. a conditional access policy

Answer 23

D. a conditional access policy

Question 24

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• Azure Active Directory (Azure AD) Identity Protection generates risk detections once a user is authenticated
• Azure Active Directory (Azure AD) Identity Protection assigns a risk level of Low, Medium, or High to each risk event
• A user risk in Azure Active Directory (Azure AD) Identity Protection represents the probability that a given identity or account is compromised

Answer 24

• Azure Active Directory (Azure AD) Identity Protection generates risk detections once a user is authenticated → Yes
• Azure Active Directory (Azure AD) Identity Protection assigns a risk level of Low, Medium, or High to each risk event → Yes
• A user risk in Azure Active Directory (Azure AD) Identity Protection represents the probability that a given identity or account is compromised → Yes

Question 25

You need to keep a copy of all files in a Microsoft SharePoint site for one year, even if users delete the files from the site. What should you apply to the site? A. a retention policy B. an insider risk policy C. a data loss prevention (DLP) policy D. a sensitivity label policy

Answer 25

A. a retention policy

Question 26

You need to create a data loss prevention (DLP) policy. What should you use? A. the Microsoft Purview Compliance Portal B. the Microsoft Endpoint Manager admin center C. the Microsoft 365 admin center D. the Microsoft 365 Defender portal

Answer 26

A. the Microsoft Purview Compliance Portal

Question 27

What is an assessment in Compliance Manager? A. A policy initiative that includes multiple policies. B. A dictionary of words that are not allowed in company documents. C. A grouping of controls from a specific regulation, standard or policy. D. Recommended guidance to help organizations align with their corporate standards.

Answer 27

C. A grouping of controls from a specific regulation, standard or policy.

Question 28

What can you use to view the Microsoft Secure Score for Devices? A. Microsoft Defender for Cloud Apps B. Microsoft Defender for Endpoint C. Microsoft Defender for Identity D. Microsoft Defender for Office 365

Answer 28

B. Microsoft Defender for Endpoint

Question 29

Match the Microsoft Defender for Office 365 feature to the correct description. -Features- - Threat Explorer - Threat Trackers - Anti-phishing protection -Answer Area- - Provides intelligence on prevailing cybersecurity issues - Provides real-time reports to identify and analyze recent threats - Detect impersonation attempts

Answer 29

Threat Explorer → Provides real-time reports to identify and analyze recent threats Threat Trackers → Provides intelligence on prevailing cybersecurity issues Anti-phishing protection → Detect impersonation attempts Keywords: Real-time = Explorer Prevailing = Trackers Impersonation = Anti-phishing

Question 30

For each of the following statements, select Yes if the statement is true. Otherwise, select No. - Each network security group (NSG) rule must have a unique name - Network security group (NSG) default rules can be deleted - Network security group (NSG) rules can be configured to check TCP, UDP, or ICMP network protocol types

Answer 30

- Each network security group (NSG) rule must have a unique name → Yes - Network security group (NSG) default rules can be deleted → No - Network security group (NSG) rules can be configured to check TCP, UDP, or ICMP network protocol types → Yes

Question 31

Select the answer that correctly completes the sentence. When users attempt to access an application or a service, _________ controls their level of access. ↘ - administration - auditing - authentication - authorization

Answer 31

authorization you can simply memorize: authENTication = ENTER = can i go in? authoRIzation = RIGHTS = where i can then go?

Question 32

What are customers responsible for when evaluating security in a software as a service (SaaS) cloud services model? A. operating systems B. network controls C. applications D. accounts and identities

Answer 32

D. accounts and identities

Question 33

Select the answer that correctly completes the sentence. - A domain controller - Active Directory Domain Services (AD DS) - Azure Active Directory (Azure AD) Privilege Identity Management (PIM) - Federation ↘ provides single sign-on (SSO) capabilities across multiple identity providers.

Answer 33

Federation

Question 34

Select the answer that correctly completes the sentence. In an environment that has on-premises resources and cloud resources, _______ should be the primary security perimeter. ↘ - the cloud - a firewall - identity - Microsoft Defender for Cloud

Answer 34

identity

Question 35

What does Conditional Access evaluate by using Azure Active Directory (Azure AD) Identity Protection? A. user actions B. group membership C. device compliance D. user risk

Answer 35

user risk

Question 36

Which statement represents a Microsoft privacy principle? A. Microsoft manages privacy settings for its customers. B. Microsoft respects the local privacy laws that are applicable to its customers. C. Microsoft uses hosted customer email and chat data for targeted advertising. D. Microsoft does not collect any customer data.

Answer 36

B. Microsoft respects the local privacy laws that are applicable to its customers.

Question 37

Select the answer that correctly completes the sentence. - A security information and event management (SIEM) - A security orchestration automated response (SOAR) - A Trusted Automated eXchange of Indicator Information (TAXII) - An attack surface reduction (ASR) ↘ system is a tool that collects data from multiple systems, identifies correlations or anomalies, and generates alerts and incidents.

Answer 37

- A security information and event management (SIEM)

Question 38

Select the answer that correctly completes the sentence. Microsoft Sentinel _______ use Azure Logic Apps to automate and orchestrate responses to alerts. ↘ - analytic rules - hunting queries - playbooks - workbooks

Answer 38

playbooks

Question 39

Which compliance feature should you use to identify documents that are employee resumes? A. pre-trained classifiers B. Activity explorer C. eDiscovery D. Content explorer

Answer 39

A. pre-trained classifiers

Question 40

Match the pillars of Zero Trust to the appropriate requirements. -Pillars- - Data - Identities - Networks -Answer Area- - Must be segmented - Must be verified by using strong authentication - Must be classified, labeled, and encrypted based on its attributes

Answer 40

Data → Must be classified, labeled, and encrypted based on its attributes. Identities → Must be verified by using strong authentication. Networks → Must be segmented.

Question 41

Match the types of compliance score actions to the appropriate tasks. -Compliance score action- - Corrective - Detective - Preventative -Answer Area- - Use encryption to protect data at rest - Actively monitor systems to identify irregularities that might represent risks

Answer 41

Detective → Actively monitor systems to identify irregularities that might represent risks. Preventative → Use encryption to protect data at rest Protect = prevent Monitor = detect Corrective → Actively monitor systems to identify irregularities that might represent risks.

Question 42

Which pillar of identity relates to tracking the resources accessed by a user? A. authorization B. auditing C. administration D. authentication

Answer 42

B. auditing

Question 43

What can be created in Active Directory Domain Services (AD DS)? A. line-of-business (LOB) applications that require modern authentication B. computer accounts C. software as a service (SaaS) applications that require modern authentication D. mobile devices

Answer 43

B. computer accounts

Question 44

Select the answer that correctly completes the sentence. When users sign in, ________ verifies their credentials to prove their identity. ↘ - administration - auditing - authentication - authorization

Answer 44

authentication