Audit logs<\/span><\/li>\n<\/ol>\nCorrect Answer: 2. Conditional Access<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Microsoft Entra Conditional Access can use sign-in risk as one of the conditions when determining whether access should be granted. When integrated with Microsoft Entra ID Protection, organizations can create policies that respond to risky authentication attempts by requiring stronger authentication, blocking access, or applying another configured control. This supports a Zero Trust approach because access decisions can consider current risk rather than relying on previous authorization alone. Access reviews periodically evaluate existing permissions, Lifecycle Workflows automate identity lifecycle processes, and audit logs record directory activity. Conditional Access is therefore the appropriate capability for enforcing access restrictions based on sign-in risk.<\/span><\/p>\nQuestion 382. Which Microsoft Sentinel capability is used to search security data proactively for indicators of compromise?<\/b><\/p>\n\n- <\/b> Workbooks<\/span><\/li>\n
- <\/b> Automation rules<\/span><\/li>\n
- <\/b> Threat hunting<\/span><\/li>\n
- <\/b> Retention policies<\/span><\/li>\n<\/ol>\n
Correct Answer: 3. Threat hunting<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Microsoft Sentinel threat hunting allows security analysts to proactively search collected security data for suspicious patterns and potential indicators of compromise. Analysts can use Kusto Query Language (KQL) to investigate authentication events, endpoint activity, network information, and other telemetry for behaviors that may not have triggered an existing detection rule. Threat hunting is different from waiting for automated alerts because analysts actively investigate possible threats based on hypotheses, intelligence, or observed anomalies. Workbooks are primarily used for visualization, automation rules manage incident actions, and retention policies address information lifecycle. Therefore, threat hunting is the Sentinel capability designed for proactive investigation of potential indicators of compromise.<\/span><\/p>\nQuestion 383. Which Microsoft Purview capability helps apply encryption and access restrictions to sensitive content?<\/b><\/p>\n\n- <\/b> Sensitivity labels<\/span><\/li>\n
- <\/b> Sentinel analytics rules<\/span><\/li>\n
- <\/b> Entra audit logs<\/span><\/li>\n
- <\/b> Intune compliance policies<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. Sensitivity labels<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Microsoft Purview sensitivity labels can classify sensitive content and apply protection settings such as encryption and access restrictions when configured for those purposes. Labels help organizations establish consistent rules for handling information based on its sensitivity. They can be applied to supported documents, emails, and other content, helping users and administrators identify information that requires additional protection. Sentinel analytics rules detect security activity, Entra audit logs record directory changes, and Intune compliance policies evaluate device conditions. Therefore, sensitivity labels are the appropriate Purview capability when an organization needs to classify content and apply protection such as encryption or restricted access.<\/span><\/p>\nQuestion 384. Which Microsoft Defender solution helps identify suspicious authentication and lateral movement involving on-premises Active Directory?<\/b><\/p>\n\n- <\/b> Defender for Office 365<\/span><\/li>\n
- <\/b> Defender for Cloud Apps<\/span><\/li>\n
- <\/b> Defender for Endpoint<\/span><\/li>\n
- <\/b> Defender for Identity<\/span><\/li>\n<\/ol>\n
Correct Answer: 4. Defender for Identity<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Microsoft Defender for Identity is designed to detect and investigate identity-based threats involving on-premises Active Directory. It monitors signals associated with domain controllers and can help identify suspicious activities such as reconnaissance, credential theft, lateral movement, and other behaviors associated with compromised identities. This provides security teams with visibility into identity attacks that may otherwise be difficult to detect from endpoint or email signals alone. Defender for Office 365 protects email and collaboration workloads, Defender for Cloud Apps focuses on cloud application activity, and Defender for Endpoint focuses on endpoint threats. Defender for Identity is therefore the appropriate solution for detecting suspicious authentication and lateral movement involving Active Directory.<\/span><\/p>\nQuestion 385. Which Microsoft Intune feature can define minimum security requirements that a device must meet before being considered compliant?<\/b><\/p>\n\n- <\/b> Compliance policies<\/span><\/li>\n
- <\/b> Access reviews<\/span><\/li>\n
- <\/b> Sentinel workbooks<\/span><\/li>\n
- <\/b> Purview DLP policies<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. Compliance policies<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Microsoft Intune compliance policies define requirements that devices must satisfy to be considered compliant with organizational security standards. Administrators can configure conditions related to operating system versions, encryption, passwords, security settings, and other device characteristics. Compliance results can then be used by Microsoft Entra Conditional Access when making access decisions. This creates a connection between endpoint security posture and identity-based access control. Access reviews evaluate user permissions, Sentinel workbooks provide security visualization, and Purview DLP protects sensitive information. Therefore, Intune compliance policies are the correct capability when an organization needs to establish minimum security requirements that devices must meet before receiving access to protected resources.<\/span><\/p>\nQuestion 386. Which Microsoft Entra feature can require an administrator to provide justification when activating a privileged role?<\/b><\/p>\n\n- <\/b> PIM<\/span><\/li>\n
- <\/b> Sign-in logs<\/span><\/li>\n
- <\/b> Security defaults<\/span><\/li>\n
- <\/b> Lifecycle Workflows<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. PIM<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Microsoft Entra Privileged Identity Management can require users to provide justification when activating eligible privileged roles. This creates an additional accountability control because administrators must explain why elevated access is required before or during activation. PIM can also support approval, multifactor authentication, limited activation duration, and other controls designed to reduce standing administrative privilege. Sign-in logs provide authentication information, security defaults provide baseline identity protections, and Lifecycle Workflows automate identity lifecycle processes. Requiring justification is particularly useful for sensitive roles because it creates an auditable reason for elevation and can help security teams review whether privileged access was appropriate. Therefore, PIM is the correct solution.<\/span><\/p>\nQuestion 387. Which Microsoft Defender capability provides protection against threats delivered through malicious email attachments and links?<\/b><\/p>\n\n- <\/b> Defender for Office 365<\/span><\/li>\n
- <\/b> Defender for Identity<\/span><\/li>\n
- <\/b> Defender Vulnerability Management<\/span><\/li>\n
- <\/b> Defender for Cloud Apps<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. Defender for Office 365<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Microsoft Defender for Office 365 is designed to protect Microsoft 365 email and collaboration workloads against threats such as malicious attachments, harmful links, phishing messages, and related attacks. It provides detection and protection capabilities that help organizations identify suspicious messages and investigate potential threats. Defender for Identity is focused on identity threats involving Active Directory, Defender Vulnerability Management identifies vulnerabilities and security weaknesses, and Defender for Cloud Apps provides cloud application visibility and controls. When the primary security concern involves malicious content delivered through email, Defender for Office 365 is the most directly relevant Microsoft security solution.<\/span><\/p>\nQuestion 388. Which Microsoft Sentinel feature can trigger an automated workflow to notify an administrator when a security incident meets specific conditions?<\/b><\/p>\n\n- <\/b> Access reviews<\/span><\/li>\n
- <\/b> Playbooks<\/span><\/li>\n
- <\/b> Sensitivity labels<\/span><\/li>\n
- <\/b> Authentication strengths<\/span><\/li>\n<\/ol>\n
Correct Answer: 2. Playbooks<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Microsoft Sentinel playbooks can automate response workflows when security events or incidents require predefined actions. Playbooks are commonly built with Azure Logic Apps and can perform tasks such as sending notifications, enriching incident data, interacting with other services, or initiating response procedures. A playbook can therefore be configured to notify an administrator when an incident meets specified conditions. Access reviews manage identity permissions, sensitivity labels classify and protect information, and authentication strengths control acceptable authentication methods. Automated workflows reduce repetitive manual work and can help security teams respond consistently. Therefore, Sentinel playbooks are the appropriate capability for triggering an automated notification workflow based on a security incident.<\/span><\/p>\nQuestion 389. Which Zero Trust principle encourages organizations to operate as though a security compromise could already exist?<\/b><\/p>\n\n- <\/b> Verify explicitly<\/span><\/li>\n
- <\/b> Least privilege<\/span><\/li>\n
- <\/b> Assume breach<\/span><\/li>\n
- <\/b> Trust the network<\/span><\/li>\n<\/ol>\n
Correct Answer: 3. Assume breach<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Assume breach is one of the core Zero Trust principles and encourages organizations to design security controls with the expectation that compromise can occur. Instead of depending on a single security boundary to prevent every attack, organizations use layered controls such as segmentation, strong authentication, least privilege, monitoring, detection, and rapid response. This approach helps limit the impact of compromised accounts or devices and improves an organization’s ability to detect suspicious activity. Verify explicitly focuses on using relevant signals for access decisions, while least privilege limits permissions. Trusting the network conflicts with Zero Trust principles. Therefore, assume breach is the principle that directly reflects this security mindset.<\/span><\/p>\nQuestion 390. Which Microsoft Entra capability can review whether guest users still require access to organizational resources?<\/b><\/p>\n\n- <\/b> Access reviews<\/span><\/li>\n
- <\/b> Authentication strengths<\/span><\/li>\n
- <\/b> Sign-in logs<\/span><\/li>\n
- <\/b> Security defaults<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. Access reviews<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Microsoft Entra access reviews allow organizations to periodically evaluate whether users should continue to have access to groups, applications, and other resources. They are particularly useful for reviewing guest accounts because external users may retain access even after their original business requirement has ended. Reviewers can determine whether access should remain and can remove unnecessary permissions according to organizational processes. Authentication strengths define acceptable authentication methods, sign-in logs record authentication activity, and security defaults provide baseline security protections. Access reviews therefore provide the appropriate governance capability for periodically verifying whether guest users still require access to organizational resources.<\/span><\/p>\nQuestion 391. Which Microsoft security service can identify risky cloud applications based on organizational policies and application risk information?<\/b><\/p>\n\n- <\/b> Defender for Identity<\/span><\/li>\n
- <\/b> Defender for Cloud Apps<\/span><\/li>\n
- <\/b> Defender for Endpoint<\/span><\/li>\n
- <\/b> Defender for Office 365<\/span><\/li>\n<\/ol>\n
Correct Answer: 2. Defender for Cloud Apps<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Microsoft Defender for Cloud Apps provides visibility into cloud application usage and helps organizations assess and govern cloud applications. Security teams can discover applications, review their risk characteristics, and apply policies based on organizational requirements. This is particularly useful for managing shadow IT and identifying cloud services that may not have been formally approved. Defender for Identity focuses on Active Directory identity threats, Defender for Endpoint focuses on endpoint security, and Defender for Office 365 protects email and collaboration workloads. Therefore, Defender for Cloud Apps is the appropriate service when an organization needs to identify and manage risky cloud applications.<\/span><\/p>\nQuestion 392. Which Microsoft Defender capability helps security teams prioritize remediation of vulnerabilities based on the exposure of organizational devices?<\/b><\/p>\n\n- <\/b> Defender for Office 365<\/span><\/li>\n
- <\/b> Defender for Identity<\/span><\/li>\n
- <\/b> Defender Vulnerability Management<\/span><\/li>\n
- <\/b> Defender for Cloud Apps<\/span><\/li>\n<\/ol>\n
Correct Answer: 3. Defender Vulnerability Management<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Microsoft Defender Vulnerability Management helps organizations discover vulnerabilities, assess exposure, and prioritize remediation activities. Security teams can use vulnerability information and security recommendations to determine which weaknesses require attention and which devices or software may represent greater exposure. Prioritization helps organizations focus limited remediation resources on issues that present greater security concern instead of treating every vulnerability identically. Defender for Office 365 focuses on email threats, Defender for Identity protects against identity threats, and Defender for Cloud Apps manages cloud application security. Therefore, Defender Vulnerability Management is the most appropriate capability for prioritizing remediation of vulnerabilities across organizational devices.<\/span><\/p>\nQuestion 393. Which Microsoft Purview capability determines how long certain organizational information should be retained?<\/b><\/p>\n\n- <\/b> Sensitivity labels<\/span><\/li>\n
- <\/b> Data Loss Prevention<\/span><\/li>\n
- <\/b> Retention policies<\/span><\/li>\n
- <\/b> Access reviews<\/span><\/li>\n<\/ol>\n
Correct Answer: 3. Retention policies<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Microsoft Purview retention policies help organizations define how long supported content should be retained and how retention requirements should be applied across relevant Microsoft 365 locations. Retention requirements may be driven by business, legal, regulatory, or organizational needs. Retention policies are different from sensitivity labels, which classify and protect information, and DLP, which helps prevent inappropriate handling or sharing of sensitive data. Access reviews address identity governance rather than information lifecycle management. Therefore, retention policies are the appropriate Purview capability when the primary requirement is to establish rules governing how long organizational information should be retained.<\/span><\/p>\nQuestion 394. Which Microsoft Entra log is most useful for investigating who modified a Conditional Access-related directory configuration or other administrative setting?<\/b><\/p>\n\n- <\/b> Audit logs<\/span><\/li>\n
- <\/b> Sign-in logs<\/span><\/li>\n
- <\/b> Defender endpoint telemetry<\/span><\/li>\n
- <\/b> Sentinel workbooks<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. Audit logs<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Microsoft Entra audit logs record administrative and directory activities and can help identify changes made to users, groups, applications, policies, and other directory resources. When investigating an administrative configuration change, audit information can help determine what action occurred, when it occurred, and which identity performed the action. Sign-in logs are designed primarily for authentication activity and therefore do not provide the same directory-change context. Defender endpoint telemetry focuses on devices, while Sentinel workbooks visualize information collected from security sources. Audit logs are therefore the most appropriate starting point for investigating administrative modifications to Microsoft Entra configurations.<\/span><\/p>\nQuestion 395. Which Microsoft Entra feature can require phishing-resistant authentication for a privileged administrative application?<\/b><\/p>\n\n- <\/b> Access reviews<\/span><\/li>\n
- <\/b> Authentication strengths<\/span><\/li>\n
- <\/b> Lifecycle Workflows<\/span><\/li>\n