Topic 4

Question 1

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• Authorization is used to identify the level of access to a resource
• Authentication is proving that users are who they say they are
• Authentication identifies whether you can read and write to a file

Answer 1

• Authorization is used to identify the level of access to a resource → Yes
• Authentication is proving that users are who they say they are → Yes
• Authentication identifies whether you can read and write to a file → No

Question 2

What is a function of Conditional Access session controls?

A. enforcing device compliance
B. enforcing client app compliance
C. enable limited experiences, such as blocking download of sensitive information
D. prompting multi-factor authentication (MFA)

Answer 2

C. enable limited experiences, such as blocking download of sensitive information

Question 3

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• Azure AD Identity Protection can add users to groups based on the user’s risk level
• Azure AD Identity Protection can detect whether user credentials were leaked to the public
• Azure AD Identity Protection can be used to invoke Multi-Factor Authentication based on a user’s risk level

Answer 3

• Azure AD Identity Protection can add users to groups based on the user’s risk level → No
• Azure AD Identity Protection can detect whether user credentials were leaked to the public → Yes
• Azure AD Identity Protection can be used to invoke Multi-Factor Authentication based on a user’s risk level → Yes

Question 4

What can you use to ensure that all the users in a specific group must use multi-factor authentication (MFA) to sign to Azure Active Directory (Azure AD)?

A. Azure Policy
B. a communication compliance policy
C. a Conditional Access policy
D. a user risk policy

Answer 4

C. a Conditional Access policy

Question 5

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• You can create a hybrid identity in an on-premises Active Directory that syncs to Azure AD
• User accounts created in Azure AD sync automatically to an on-premises Active Directory
• When using a hybrid model, authentication can either be done by Azure AD or by another identity provider

Answer 5

• You can create a hybrid identity in an on-premises Active Directory that syncs to Azure AD → Yes
• User accounts created in Azure AD sync automatically to an on-premises Active Directory → No
• When using a hybrid model, authentication can either be done by Azure AD or by another identity provider → Yes

Question 6

Which three authentication methods can Azure AD users use to reset their password?

A. mobile app notification
B. text message to a phone
C. security questions
D. certificate
E. picture password

Answer 6

A. mobile app notification
B. text message to a phone
C. security questions

Question 7

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• Azure AD B2C enables external users to sign in by using their preferred social or enterprise account identities
• External Azure AD B2V users are managed in the same directory as users in the Azure AD organization
• Custom branding can be applied to Azure AD B2C authentication

Answer 7

• Azure AD B2C enables external users to sign in by using their preferred social or enterprise account identities → Yes
• External Azure AD B2V users are managed in the same directory as users in the Azure AD organization → No
• Custom branding can be applied to Azure AD B2C authentication → Yes

Question 8

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• Software tokens are an example of passwordless authentication
• Windows Hello is an example of passwordless authentication
• FIDO2 security keys are an example of passwordless authentication

Answer 8

• Software tokens are an example of passwordless authentication → No
• Windows Hello is an example of passwordless authentication → Yes
• FIDO2 security keys are an example of passwordless authentication → Yes

Question 9

Which security feature is available in the free mode of Microsoft Defender for Cloud?

A. threat protection alerts
B. just-in-time (JIT) VM access to Azure virtual machines
C. vulnerability scanning of virtual machines
D. secure score

Answer 9

D. secure score

Question 10

Microsoft 365 Endpoint data loss prevention (Endpoint DLP) can be used on which operating systems?

A. Windows 10 and newer only
B. Windows 10 and newer and Android only
C. Windows 10 and newer and iOS only
D. Windows 10 and newer, Android, and iOS

Answer 10

A. Windows 10 and newer only

Question 11

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• Microsoft Defender for Cloud can detect vulnerabilities and threats for Azure Storage
• Cloud Security Posture Management (CSPM) is available for all Azure subscriptions
• Microsoft Defender for Cloud can evaluate the security of workloads deployed to Azure or on-premises

Answer 11

• Microsoft Defender for Cloud can detect vulnerabilities and threats for Azure Storage → Yes
• Cloud Security Posture Management (CSPM) is available for all Azure subscriptions → Yes
• Microsoft Defender for Cloud can evaluate the security of workloads deployed to Azure or on-premises → Yes

Question 12

Select the answer that correctly completes the sentence.

• Azure Active Directory (Azure AD) Password Protection
• Azure Bastion
• Azure Information Protection (AIP)
• Azure Key Vault
  ↘
  is a cloud service for storing application secrets.

Answer 12

Azure Key Vault

Question 13

Select the answer that correctly completes the sentence.

• Microsoft Defender for Cloud
• Azure Monitor
• Azure Security Benchmark
• Microsoft Secure Score
  ↘
  provides cloud workload protection for Azure and hybrid cloud resources.

Answer 13

Microsoft Defender for Cloud

Question 14

What is the maximum number of resources that Azure DDoS Protection Standard can protect without additional costs?

A. 50
B. 100
C. 500
D. 1000

Answer 14

B. 100

Question 15

What are two reasons to deploy multiple virtual networks instead of using just one virtual network?

A. to meet governance policies
B. to connect multiple types of resources
C. to separate the resources for budgeting
D. to isolate the resources

Answer 15

A. to meet governance policies
D. to isolate the resources

Question 16

Select the answer that correctly completes the sentence.

Microsoft Sentinel provides quick insights into data by using
↘
- Azure Logic Apps
- Azure Monitor workbook templates
- Azure Resource Graph Explorer
- playbooks

Answer 16

Azure Monitor workbook templates

Question 17

You have an Azure subscription that contains multiple resources.

You need to assess compliance and enforce standards for the existing resources.

What should you use?

A. Azure Blueprints
B. the Anomaly Detector service
C. Microsoft Sentinel
D. Azure Policy

Answer 17

D. Azure Policy

Question 18

Which Microsoft Defender for Cloud metric displays the overall security health of an Azure subscription?

A. secure score
B. resource health
C. completed controls
D. the status of recommendations

Answer 18

A. secure score

Question 19

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• You can use information barriers with Microsoft Exchange
• You can use information barriers with Microsoft SharePoint
• You can use information barriers with Microsoft Teams

Answer 19

• You can use information barriers with Microsoft Exchange → No
• You can use information barriers with Microsoft SharePoint → Yes
• You can use information barriers with Microsoft Teams → Yes

Question 20

Select the answer that correctly completes the sentence.

Insider risk management is configured from the
↘
- Microsoft 365 admin center
- Microsoft 365 compliance center (Microsoft Purview)
- Microsoft 365 Defender portal
- Microsoft Defender for Cloud Apps portal

Answer 20

Microsoft 365 compliance center (Microsoft Purview)

Question 21

You need to ensure repeatability when creating new resources in an Azure subscription.

What should you use?

A. Microsoft Sentinel
B. Azure Policy
C. Azure Batch
D. Azure Blueprints

Answer 21

D. Azure Blueprints

Question 22

What is a characteristic of a sensitivity label in Microsoft 365?

A. encrypted
B. restricted to predefined categories
C. persistent

Answer 22

C. persistent

Question 23

-Same Q as 109-

Match the Microsoft Purview Insider Risk Management workflow step to the appropriate task.

-Steps-
- Action
- Investigate
- Triage

-Answer Area-
- Review and filter alerts
- Create cases in the Case dashboard
- Send a reminder of corporate policies to users

Answer 23

Triage → Review and filter alerts
Investigate → Create cases in the Case dashboard
Action → Send a reminder of corporate policies to users

Question 24

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• Microsoft Purview provides sensitive data classification
• Microsoft Sentinel is a data lifecycle management solution
• Microsoft Purview can only discover data that is stored in Azure

Answer 24

• Microsoft Purview provides sensitive data classification → Yes
• Microsoft Sentinel is a data lifecycle management solution → No
• Microsoft Purview can only discover data that is stored in Azure → No

Question 25

Select the answer that correctly completes the sentence. - Compliance score - Microsoft Purview compliance portal reports - The Trust Center - Trust Documents ↘ measures a company's progress in completing actions that help reduce risks around data protection and regulatory standards.

Answer 25

Compliance score

Question 26

For each of the following statements, select Yes if the statement is true. Otherwise, select No. - Asymmetric encryption uses a public key and private key pair - Symmetric encryption uses a public key and private key pair - You can use decryption to retrieve original content from a content hash

Answer 26

- Asymmetric encryption uses a public key and private key pair → Yes - Symmetric encryption uses a public key and private key pair → No - You can use decryption to retrieve original content from a content hash → No

Question 27

- Same Q as 158- For each of the following statements, select Yes if the statement is true. Otherwise, select No. - Asymmetric encryption uses a public key and private key pair - Symmetric encryption uses a public key and private key pair - You can use decryption to retrieve original content from a content hash

Answer 27

- Asymmetric encryption uses a public key and private key pair → Yes - Symmetric encryption uses a public key and private key pair → No - You can use decryption to retrieve original content from a content hash → No

Question 28

Select the answer that correctly completes the sentence. Ensuring that the data you retrieve is the same as the data you stored is an example of maintaining ↘ - availability. - confidentiality. - integrity. - transparency.

Answer 28

integrity

Question 29

Select the answer that correctly completes the sentence. - Assessment - Improvement actions - Solutions - Templates ↘ track compliance with groupings of controls from a specific regulation or requirement.

Answer 29

Assessment

Question 30

For each of the following statements, select Yes if the statement is true. Otherwise, select No. - In software as a service (SaaS), applying application updates is the responsibility of the organization - In infrastructure as a service (IaaS), managing the physical network is the responsibility of the cloud provider - In all Azure cloud deployment types, managing the security of information and data is the responsibility of the organization

Answer 30

- In software as a service (SaaS), applying application updates is the responsibility of the organization → No - In infrastructure as a service (IaaS), managing the physical network is the responsibility of the cloud provider → Yes - In all Azure cloud deployment types, managing the security of information and data is the responsibility of the organization → Yes

Question 31

What should you use to associate the same identity to more than one Azure virtual machine? A. an Azure AD user account B. a user-assigned managed identity C. a system-assigned managed identity D. an Azure AD security group

Answer 31

B. a user-assigned managed identity

Question 32

For each of the following statements, select Yes if the statement is true. Otherwise, select No. - Security defaults require an Azure AD Premium license - Security defaults can be enabled for a single Azure AD user - When Security defaults are enabled, all administrators must use multi-factor authentication (MFA)

Answer 32

- Security defaults require an Azure AD Premium license → No - Security defaults can be enabled for a single Azure AD user → No - When Security defaults are enabled, all administrators must use multi-factor authentication (MFA) → Yes

Question 33

Which three forms of verification can be used with Azure AD Multi-Factor Authentication (MFA)? A. security questions B. the Microsoft Authenticator app C. SMS messages D. a smart card E. Windows Hello for Business

Answer 33

B. the Microsoft Authenticator app C. SMS messages E. Windows Hello for Business

Question 34

For each of the following statements, select Yes if the statement is true. Otherwise, select No. - An external email address can be used to authenticate self-service password reset (SSPR) - A notification to the Microsoft Authenticator app can be used to authenticate self-service password reset (SSPR) - To perform self-service password reset (SSPR), a user must already be signed in and authenticated to Azure AD

Answer 34

- An external email address can be used to authenticate self-service password reset (SSPR) → Yes - A notification to the Microsoft Authenticator app can be used to authenticate self-service password reset (SSPR) → Yes - To perform self-service password reset (SSPR), a user must already be signed in and authenticated to Azure AD → No

Question 35

Microsoft 365 Endpoint data loss prevention (Endpoint DLP) can be used on which operating systems? A. Windows 10 and newer only B. Windows 10 and newer and Android only C. Windows 10 and newer and macOS only D. Windows 10 and newer, Android, and macOS

Answer 35

C. Windows 10 and newer and macOS only

Question 36

You have an Azure subscription that contains a Log Analytics workspace. You need to onboard Microsoft Sentinel. What should you do first? A. Create a hunting query. B. Correlate alerts into incidents. C. Connect to your security sources. D. Create a custom detection rule.

Answer 36

C. Connect to your security sources.

Question 37

For each of the following statements, select Yes if the statement is true. Otherwise, select No. - Azure DDos Protection Standard protects against man-in-the-middle (MITM) attacks - Azure DDos Protection Standard is enabled by default in an Azure subscription - Azure DDos Protection Standard protects against protocol attacks

Answer 37

- Azure DDos Protection Standard protects against man-in-the-middle (MITM) attacks → No - Azure DDos Protection Standard is enabled by default in an Azure subscription → No - Azure DDos Protection Standard protects against protocol attacks → Yes

Question 38

Select the answer that correctly completes the sentence. The ________ features of Microsoft Defender for Cloud block malware and other unwanted applications, while reducing the network attack surface on Azure virtual machines. ↘ - access and application control - Cloud Security Posture Management (CSPM) - container security - vulnerability assessment

Answer 38

access and application control

Question 39

For each of the following statements, select Yes if the statement is true. Otherwise, select No. - You can use Microsoft Purview Information Barriers to detect messages that contain inappropriate language - You can use Microsoft Purview Communication Compliance to scan files stored in Microsoft SharePoint Online - You can use Microsoft Purview Communication Compliance to scan internal and external emails in Microsoft Exchange Online

Answer 39

- You can use Microsoft Purview Information Barriers to detect messages that contain inappropriate language → No - You can use Microsoft Purview Communication Compliance to scan files stored in Microsoft SharePoint Online → No - You can use Microsoft Purview Communication Compliance to scan internal and external emails in Microsoft Exchange Online → Yes

Question 40

Select the answer that correctly completes the sentence. Single sign-on (SSO) configured between multiple identity providers in an example of ↘ - federation - integration - password hash synchronization - pass-through authentication

Answer 40

federation

Question 41

You plan to move resources to the cloud. You are evaluating the use of Infrastructure as a service (IaaS), Platform as a service (PaaS), and Software as a service (SaaS) cloud models. You plan to manage only the data, user accounts, and user devices for a cloud-based app. Which cloud model will you use? A. SaaS B. PaaS C. IaaS

Answer 41

A. SaaS

Question 42

Select the answer that correctly completes the sentence. Enabling a system-assigned managed identity creates a service principal that ↘ - can be shared with multiple Azure resources - is managed separately from the resource that uses it - is tied to the lifecycle of the resource that uses it - must be registered manually with Azure AD

Answer 42

is tied to the lifecycle of the resource that uses it

Question 43

For each of the following statements, select Yes if the statement is true. Otherwise, select No. - Device identity can be stored in Azure AD - A single system-assigned managed identity can be used by multiple Azure resources - If you delete an Azure resource that has a user-assigned managed identity, the managed identity is deleted automatically

Answer 43

- Device identity can be stored in Azure AD → Yes - A single system-assigned managed identity can be used by multiple Azure resources → No - If you delete an Azure resource that has a user-assigned managed identity, the managed identity is deleted automatically → No

Question 44

Which score measures an organization’s progress in completing actions that help reduce risks associated to data protection and regulatory standards? A. Adoption Score B. Microsoft Secure Score C. Secure score in Microsoft Defender for Cloud D. Compliance score

Answer 44

D. Compliance score