MS-101: Microsoft 365 Mobility and Security

1. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. You have a Microsoft 365 subscription. You discover that some external users accessed content on a Microsoft SharePoint site. You modify the SharePoint sharing policy to prevent sharing outside your organization. You need to be notified if the SharePoint sharing policy is modified in the future. Solution: From the SharePoint admin center, you modify the sharing settings. Does this meet the goal?

Yes

No

This should be covered with an alert policy from the security & compliance center https://docs.microsoft.com/en-us/microsoft-365/compliance/alert-policies?view=o365-worldwide

Explanation

This should be covered with an alert policy from the security & compliance center https://docs.microsoft.com/en-us/microsoft-365/compliance/alert-policies?view=o365-worldwide

2. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. You have a Microsoft 365 subscription. You discover that some external users accessed content on a Microsoft SharePoint site. You modify the SharePoint sharing policy to prevent sharing outside your organization. You need to be notified if the SharePoint sharing policy is modified in the future. Solution: From the Security & Compliance admin center, you create a threat management policy. Does this meet the goal?

Yes

No

This should be covered with an alert policy.

Explanation

This should be covered with an alert policy.

3. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. You are deploying Microsoft Intune. You successfully enroll Windows 10 devices in Intune. When you try to enroll an iOS device in Intune, you get an error. You need to ensure that you can enroll the iOS device in Intune. Solution: You add your user account as a device enrollment manager. Does this meet the goal?

Yes

No

You need the Apple MDM push certificate.

Explanation

You need the Apple MDM push certificate.

4. Your network contains an Active Directory domain named contoso.com that is synced to Microsoft Azure Active Directory (Azure AD). You manage Windows 10 devices by using Microsoft System Center Configuration Manager (Current Branch). You configure pilot co-management. You add a new device named Device1 to the domain. You install the Configuration Manager client on Device1. You need to ensure that you can manage Device1 by using Microsoft Intune and Configuration Manager. Solution: You create a device configuration profile from the Intune admin center. Does this meet the goal?

Yes

No

The correct answer should be that the new device needs to be added into a pilot collection in configuration manager, since the question clearly states that this scenario is a pilot co-management scenario. Reference: https://docs.microsoft.com/en-us/configmgr/comanage/tutorial-co-manage-clients

Specifically, please have a look at the section called "enable co-management in configuration manager" in the article above.

Reference: https://docs.microsoft.com/en-us/configmgr/comanage/how-to-enable

Explanation

The correct answer should be that the new device needs to be added into a pilot collection in configuration manager, since the question clearly states that this scenario is a pilot co-management scenario. Reference: https://docs.microsoft.com/en-us/configmgr/comanage/tutorial-co-manage-clients

Specifically, please have a look at the section called "enable co-management in configuration manager" in the article above.

Reference: https://docs.microsoft.com/en-us/configmgr/comanage/how-to-enable

5. Your network contains an Active Directory domain named contoso.com that is synced to Microsoft Azure Active Directory (Azure AD). You manage Windows 10 devices by using Microsoft System Center Configuration Manager (Current Branch). You configure pilot co-management. You add a new device named Device1 to the domain. You install the Configuration Manager client on Device1. You need to ensure that you can manage Device1 by using Microsoft Intune and Configuration Manager. Solution: You unjoin Device1 from the Active Directory domain.. Does this meet the goal?

Yes

No

The correct answer should be that the new device needs to be added into a pilot collection in configuration manager, since the question clearly states that this scenario is a pilot co-management scenario. Reference: https://docs.microsoft.com/en-us/configmgr/comanage/tutorial-co-manage-clients

Specifically, please have a look at the section called "enable co-management in configuration manager" in the article above.

Reference: https://docs.microsoft.com/en-us/configmgr/comanage/how-to-enable

Explanation

The correct answer should be that the new device needs to be added into a pilot collection in configuration manager, since the question clearly states that this scenario is a pilot co-management scenario. Reference: https://docs.microsoft.com/en-us/configmgr/comanage/tutorial-co-manage-clients

Specifically, please have a look at the section called "enable co-management in configuration manager" in the article above.

Reference: https://docs.microsoft.com/en-us/configmgr/comanage/how-to-enable

6. You have Windows 10 Pro devices that are joined to an Active Directory domain.You plan to create a Microsoft 365 tenant and to upgrade the devices to Windows 10 Enterprise. You are evaluating whether to deploy Windows Hello for Business for SSO to Microsoft 365 services. What are two prerequisites of the deployment? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

A: Computers that have biometric hardware features

B. Microsoft Intune enrollment

C. Microsoft Azure Active Directory (Azure AD)

D. Smartcards

E. TPM-enabled device

References:

https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs

https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base

Explanation

References:

https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs

https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base

Submit

7. Your network contains an Active Directory domain named contoso.com. All client devices run Windows 10 and are joined to the domain. You update the Windows 10 devices by using Windows Update for Business. What is the maximum amount of time you can defer Windows 10 updates? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Quality Updates: 14 days

Quality Updates: 30 days

Quality Updates: 60 days

Quality Updates: 120 days

Feature Updates: 60 days

Feature Updates: 180 days

Feature Updates: 365 days

Feature Updates: 540 days

https://docs.microsoft.com/en-us/windows/deployment/update/waas-manage-updates-wufb

Explanation

https://docs.microsoft.com/en-us/windows/deployment/update/waas-manage-updates-wufb

Submit

8. Your network contains an Active Directory domain named contoso.com that uses Microsoft System Center Configuration Manager (Current Branch). You have Windows 10 and Windows 8.1 devices. You need to ensure that you can analyze the upgrade readiness of all the Windows 8.1 devices and analyze the update compliance of all the Windows 10 devices. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Create a Microsoft Azure Log Analytics workspace

Configure all the devices to have a commercial ID

References:

https://docs.microsoft.com/en-us/windows/deployment/upgrade/upgrade-readiness-get-started

https://docs.microsoft.com/en-us/windows/deployment/update/update-compliance-get-started

Explanation

References:

https://docs.microsoft.com/en-us/windows/deployment/upgrade/upgrade-readiness-get-started

https://docs.microsoft.com/en-us/windows/deployment/update/update-compliance-get-started

Submit

9. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are deploying Microsoft Intune. You successfully enroll Windows 10 devices in Intune. When you try to enroll an iOS device in Intune, you get an error. You need to ensure that you can enroll the iOS device in Intune. Solution: You create the Mobility (MDM and MAM) settings. Does this meet the goal?

Yes

No

You require an Apple MDM push certificate setup

https://www.inthecloud247.com/how-to-start-with-ios-user-enrollment-using-microsoft-intune/

Explanation

You require an Apple MDM push certificate setup

https://www.inthecloud247.com/how-to-start-with-ios-user-enrollment-using-microsoft-intune/

10. From the Microsoft Azure Active Directory (Azure AD) Identity Protection dashboard, you view the risk events shown in the exhibit. (Click the Exhibit tab.) You need to reduce the likelihood that the sign-ins are identified at risky. What should you do?

A. From the Security & Compliance admin center, create a classification label.

B. From the Security & Compliance admin center, add the users to the Security Readers role group.

C. From the Azure Active Directory admin center, configure the trusted IPs for multi-factor authentication.

D. From the Conditional access blade in the Azure Active Directory admin center, create named locations.

References:

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition

Explanation

References:

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition

11. You plan to allow users from the engineering department to enroll their mobile device in mobile device management (MDM). The device type restrictions are configured as shown in the following table. The device limit restrictions are configured as shown in the following table. What is the effective configuration for the members of the Engineering group? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Allowed platform:Android only

Device Limit5

IOS only

10

All platforms

15

https://docs.microsoft.com/en-us/intune/enrollment-restrictions-set

https://docs.microsoft.com/en-us/intune/enrollment/enrollment-restrictions-set#change-enrollment-restriction-priority

Explanation

https://docs.microsoft.com/en-us/intune/enrollment-restrictions-set

https://docs.microsoft.com/en-us/intune/enrollment/enrollment-restrictions-set#change-enrollment-restriction-priority

Submit

12. You use Microsoft System Center Configuration Manager (Current Branch) to manage devices. Your company uses the following types of devices: ✑ Windows 10 ✑ Windows 8.1 ✑ Android ✑ iOS Which devices can be managed by using co-management?

A. Windows 10 and Windows 8.1 only

B. Windows 10, Android, and iOS only

C. Windows 10 only

D. Windows 10, Windows 8.1, Android, and iOS

https://docs.microsoft.com/en-us/configmgr/comanage/overview#prerequisites

Explanation

https://docs.microsoft.com/en-us/configmgr/comanage/overview#prerequisites

13. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are deploying Microsoft Intune. You successfully enroll Windows 10 devices in Intune. When you try to enroll an iOS device in Intune, you get an error. You need to ensure that you can enroll the iOS device in Intune. Solution: You configure the Mobility (MDM and MAM) settings. Does this meet the goal?

Yes

No

Configuring the Mobility (MDM and MAM) settings alone will not resolve the issue of enrolling an iOS device in Intune. The error could be due to various reasons such as incorrect configuration, incompatible device, or network connectivity issues. Therefore, the given solution does not meet the goal of enrolling the iOS device in Intune.

Explanation

Configuring the Mobility (MDM and MAM) settings alone will not resolve the issue of enrolling an iOS device in Intune. The error could be due to various reasons such as incorrect configuration, incompatible device, or network connectivity issues. Therefore, the given solution does not meet the goal of enrolling the iOS device in Intune.

14. Your company has 5,000 Windows 10 devices. All the devices are protected by using Windows Defender Advanced Threat Protection (ATP). You need to view which Windows Defender ATP alert events have a high severity and occurred during the last seven days. What should you use in Windows Defender ATP?

A. the threat intelligence API

B. Automated investigations

C. Threat analytics

D. Advanced hunting

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/automated-investigations

Explanation

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/automated-investigations

15. Your company uses Microsoft Cloud App Security. You plan to integrate Cloud App Security and security information and event management (SIEM).You need to deploy a SIEM agent on a server that runs Windows Server 2016. What should you do? To answer, select the appropriate settings in the answer area. NOTE: Each correct selection is worth one point.

First action to perform (select 1 out of 4) " Install Java8 "

https://docs.microsoft.com/nl-nl/cloud-app-security/siem#step-2-download-the-jar-file-and-run-it-on-your-server

Explanation

https://docs.microsoft.com/nl-nl/cloud-app-security/siem#step-2-download-the-jar-file-and-run-it-on-your-server

Submit

16. Which of the following is a key feature of Microsoft 365 Mobility that helps ensure secure access to corporate resources from mobile devices?

Conditional Access

Power Automate

SharePoint Online

Microsoft Teams

Conditional Access in Microsoft 365 is a security feature that helps organizations control how and when users access corporate resources. It allows administrators to enforce access policies based on conditions like user location, device compliance, and risk levels. This is particularly important in a mobile environment where employees access company data from various devices and locations, ensuring that only compliant and trusted devices can access sensitive information.

Explanation

Conditional Access in Microsoft 365 is a security feature that helps organizations control how and when users access corporate resources. It allows administrators to enforce access policies based on conditions like user location, device compliance, and risk levels. This is particularly important in a mobile environment where employees access company data from various devices and locations, ensuring that only compliant and trusted devices can access sensitive information.

17. From the Security & Compliance admin center, you create a retention policy named Policy1. You need to prevent all users from disabling the policy or reducing the retention period. Which command should you run? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Set-RetentionCompliancePolicy -Identity “policy1” –RestrictiveRetention $true https://docs.microsoft.com/en-us/microsoft-365/compliance/retention-policies Under locking retention policy

Set-RetentionCompliancePolicy -Identity “policy1” –RestrictiveRetention $false

locking retention policy

https://docs.microsoft.com/en-us/microsoft-365/compliance/retention-policies#locking-a-retention-policy

Explanation

locking retention policy

https://docs.microsoft.com/en-us/microsoft-365/compliance/retention-policies#locking-a-retention-policy

18. You have a Microsoft 365 subscription. You have a user named User 1. You need to ensure that User 1 can place a hold on all mailbox content. Which role should you assign to User1?

A. eDiscovery Manager from the Security & Compliance admin center

B. compliance management from the Exchange admin center

C. User management administrator from the Microsoft 365 admin center

D. Information Protection administrator from the Azure Active Directory admin center

https://docs.microsoft.com/en-us/Exchange/permissions/feature-permissions/policy-and-compliance-permissions?view=exchserver-2019

Explanation

https://docs.microsoft.com/en-us/Exchange/permissions/feature-permissions/policy-and-compliance-permissions?view=exchserver-2019

19. You have a Microsoft 365 subscription. All users are assigned a Microsoft 365 E3 license. You enable auditing for your organization. What is the maximum amount of time data will be retained in the Microsoft 365 audit log?

A. 2 years

B. 1 year

C. 30 days

D. 90 days

https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance

20. You have a Microsoft 365 subscription. From the Security & Compliance admin center, you create a content search of all the mailboxes that contain the work ProjectX. You need to export the results of the content search. What do you need to download the report?

A. a certification authority (CA) certificate

B. an export key

C. a password

D. a user certificate

https://docs.microsoft.com/en-us/office365/securitycompliance/export-search-results

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/export-search-results

21. You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com. You have three applications named App1, App2, and App3 that have the same file format. Your company uses Windows Information Protection (WIP). WIP has the following configurations: ✑ Windows Information Protection mode: Silent ✑ Protected apps: App1 ✑ Exempt apps: App2 From App1, you create a file named File1. What is the effect of the configurations? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

App1, 2, 3

App 3 only

The given configurations in Windows Information Protection (WIP) mode will have the following effects:
- App1, App2, and App3 will be protected by WIP.
- App3 will be the only app exempted from WIP protection.
Therefore, the correct answer is that App1, App2, and App3 will be affected by the configurations, and App3 will be the only app that is exempted from WIP protection.

Explanation

The given configurations in Windows Information Protection (WIP) mode will have the following effects:
- App1, App2, and App3 will be protected by WIP.
- App3 will be the only app exempted from WIP protection.
Therefore, the correct answer is that App1, App2, and App3 will be affected by the configurations, and App3 will be the only app that is exempted from WIP protection.

Submit

22. Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York.The company has the employees and devices shown in the following table. Contoso recently purchased a Microsoft 365 E5 subscription. Existing Environment - The network contains an on-premises Active Directory forest named contoso.com. The forest contains the servers shown in the following table. All servers run Windows Server 2016. All desktops and laptops run Windows 10 Enterprise and are joined to the domain. The mobile devices of the users in the Montreal and Seattle offices run Android. The mobile devices of the users in the New York office run iOS. The domain is synced to Azure Active Directory (Azure AD) and includes the users shown in the following table. The domain also includes a group named Group1. Requirements - Planned Changes - Contoso plans to implement the following changes:

Implement Microsoft 365.

Manage devices by using Microsoft Intune.

Implement Azure Advanced Threat Protection (ATP).

Every September, apply the latest feature updates to all Windows computers. Every March, apply the latest feature updates to the computers in the New York office only.

Technical Requirements - Contoso identifies the following technical requirements:

When a Windows 10 device is joined to Azure AD, the device must enroll in Intune automatically.

Dedicated support technicians must enroll all the Montreal office mobile devices in Intune.

User1 must be able to enroll all the New York office mobile devices in Intune.

Azure ATP sensors must be installed and must NOT use port mirroring.

Whenever possible, the principle of least privilege must be used.

A Microsoft Store for Business must be created.

Compliance Requirements -

Contoso identifies the following compliance requirements:

Ensure that the users in Group1 can only access Microsoft Exchange Online from devices that are enrolled in Intune and configured in accordance with the corporate policy.

Configure Windows Information Protection (WIP) for the Windows 10 devices.

Question: On which server should you install the Azure ATP sensor?

A. Server1

B. Server2

C. Server3

D. Server4

E. Server5

The Azure ATP sensor is installed directly on a domain controller to monitor the network traffic.

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-capacity-planning

Explanation

The Azure ATP sensor is installed directly on a domain controller to monitor the network traffic.

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-capacity-planning

23. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 subscription. You need to prevent users from accessing your Microsoft SharePoint Online sites unless the users are connected to your on-premises network. Solution: From the Microsoft 365 admin center, you configure the Organization profile settings. Does this meet the goal?

Yes

No

Conditional Access in SharePoint Online can be configured to use an IP Address white list to allow access.

References:

https://techcommunity.microsoft.com/t5/Microsoft-SharePoint-Blog/Conditional-Access-in-SharePoint-Online-and-OneDrive-for/ba-p/46678

Explanation

Conditional Access in SharePoint Online can be configured to use an IP Address white list to allow access.

References:

https://techcommunity.microsoft.com/t5/Microsoft-SharePoint-Blog/Conditional-Access-in-SharePoint-Online-and-OneDrive-for/ba-p/46678

24. You have a Microsoft Azure Active Directory (Azure AD) tenant. The organization needs to sign up for Microsoft Store for Business. The solution must use the principle of least privilege. Which role should you assign to the user?

A. Global administrator

B. Cloud application administrator

C. Application administrator

D. Service administrator

https://docs.microsoft.com/en-us/microsoft-store/sign-up-microsoft-store-for-business

Explanation

https://docs.microsoft.com/en-us/microsoft-store/sign-up-microsoft-store-for-business

25. You have a Microsoft 365 subscription and an on-premises Active Directory domain named contoso.com. All client computers run Windows 10 Enterprise and are joined to the domain. You need to enable Windows Defender Credential Guard on all the computers. What should you do?

A. From the Security & Compliance admin center, configure the DKIM signatures for the domain.

C. From the Security & Compliance admin center, create a device security policy.

D. From a domain controller, create a Group Policy object (GPO) that enabled the Turn On Virtualization Based Security setting.

https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage

Explanation

https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage

26. You have a Microsoft 365 subscription. Some users have iPads that are managed by your company. You plan to prevent the iPad users from copying corporate data in Microsoft Word and pasting the data into other applications. What should you create?

A. A conditional access policy.

B. A compliance policy.

C. An app protection policy.

D. An app configuration policy.

https://docs.microsoft.com/en-us/intune/app-protection-policy

Explanation

https://docs.microsoft.com/en-us/intune/app-protection-policy

27. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. You are deploying Microsoft Intune. You successfully enroll Windows 10 devices in Intune. When you try to enroll an iOS device in Intune, you get an error. You need to ensure that you can enroll the iOS device in Intune. Solution: You configure the Apple MDM Push certificate. Does this meet the goal?

Yes

No

You need the Apple MDM push certificate.

Explanation

You need the Apple MDM push certificate.

28. Your company uses Microsoft System Center Configuration Manager (Current Branch) and Microsoft Intune to co-manage devices. Which two actions can be performed only from Intune? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

A. Deploy applications to Windows 10 devices.

B. Deploy VPN profiles to iOS devices.

C. Deploy VPN profiles to Windows 10 devices.

D. Publish applications to Android devices.

References:

https://docs.microsoft.com/en-us/sccm/comanage/overview

https://docs.microsoft.com/en-us/sccm/mdm/deploy-use/create-vpn-profiles

Explanation

References:

https://docs.microsoft.com/en-us/sccm/comanage/overview

https://docs.microsoft.com/en-us/sccm/mdm/deploy-use/create-vpn-profiles

Submit

29. You configure a conditional access policy. The locations settings are configured as shown in the Locations exhibit. (Click the Locations tab.) The users and groups settings are configured as shown in the Users and Groups exhibit. (Click Users and Groups tab.) Members of the Security reader group report that they cannot sign in to Microsoft Active Directory (Azure AD) on their device while they are in the office. You need to ensure that the members of the Security reader group can sign in in to Azure AD on their device while they are in the office. The solution must use the principle of least privilege. What should you do?

A. From the conditional access policy, configure the device state.

B. From the Azure Active Directory admin center, create a custom control.

C. From the Intune admin center, create a device compliance policy.

D. From the Azure Active Directory admin center, create a named location.

References:

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition

Explanation

References:

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition

30. You have computers that run Windows 10 Enterprise and are joined to the domain.You plan to delay the installation of new Windows builds so that the IT department can test application compatibility. You need to prevent Windows from being updated for the next 30 days. Which two Group Policy settings should you configure? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

A. Select when Quality Updates are received

B. Select when Preview Builds and Feature Updates are received

C. Turn off auto-restart for updates during active hours

D. Manage preview builds

E. Automatic updates detection frequency

New build (new feature) come in as a new Preview Build and/or Feature updates. Quality updates are not introducing "new" Windows features but improving existing features (bug fixes / security patches).

https://www.windowscentral.com/whats-difference-between-quality-updates-and-feature-updates-windows-10

Explanation

New build (new feature) come in as a new Preview Build and/or Feature updates. Quality updates are not introducing "new" Windows features but improving existing features (bug fixes / security patches).

https://www.windowscentral.com/whats-difference-between-quality-updates-and-feature-updates-windows-10

Submit

31. You have a Microsoft 365 tenant. You have a line-of-business application named App1 that users access by using the My Apps portal. After some recent security breaches, you implement a conditional access policy for App1 that uses Conditional Access App Control. You need to be alerted by email if impossible travel is detected for a user of App1. The solution must ensure that alerts are generated for App1 only. What should you do?

A. From Microsoft Cloud App Security, create a Cloud Discovery anomaly detection policy.

B. From Microsoft Cloud App Security, modify the impossible travel alert policy.

C. From Microsoft Cloud App Security, create an app discovery policy.

D. From the Azure Active Directory admin center, modify the conditional access policy.

References:

https://docs.microsoft.com/en-us/cloud-app-security/cloud-discovery-anomaly-detection-policy

Explanation

References:

https://docs.microsoft.com/en-us/cloud-app-security/cloud-discovery-anomaly-detection-policy

32. Your company has a Microsoft 365 E3 subscription. All devices run Windows 10 Pro and are joined to Microsoft Azure Active Directory (Azure AD). You need to change the edition of Windows 10 to Enterprise the next time users sign in to their computer. The solution must minimize downtime for the users. What should you use?

A. Windows Autopilot

B. Windows Update

C. Subscription Activation

D. an in-place upgrade

References:

https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot

Explanation

References:

https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot

33. Your company has a Microsoft 365 subscription.You implement Microsoft Azure Information Protection. You need to automatically protect email messages that contain the word Confidential in the subject line. What should you create?

A. a mail flow rule from the Exchange admin center

B. a message trace from the Security & Compliance admin center

C. a supervision policy from the Security & Compliance admin center

D. a sharing policy from the Exchange admin center

https://docs.microsoft.com/en-us/azure/information-protection/configure-exo-rules

Explanation

https://docs.microsoft.com/en-us/azure/information-protection/configure-exo-rules

34. You have a Microsoft 365 tenant. You create a retention label as shown in the Retention Label exhibit. (Click the Retention Label tab.) You create a label policy as shown in the Label Policy Exhibit. (Click the Label Policy tab.) The label policy is configured as shown in the following table. For each of the following statements, select the statement if it is true. NOTE: Each correct selection is worth one point.

Any sent email message that contains the word ProjectX will be deleted immediately

Any sent email message that contains the workd ProjectX will be retained for six months

Users are required to manually apply a label to email messages that contain the work ProjectX

The label policy shown in the exhibit indicates that any sent email message containing the word "ProjectX" will be retained for six months. This means that the statement "Any sent email message that contains the word ProjectX will be retained for six months" is true.

Explanation

The label policy shown in the exhibit indicates that any sent email message containing the word "ProjectX" will be retained for six months. This means that the statement "Any sent email message that contains the word ProjectX will be retained for six months" is true.

35. Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York. The company has the employees and devices shown in the following table. Contoso recently purchased a Microsoft 365 E5 subscription. Existing Environment - The network contains an on-premises Active Directory forest named contoso.com. The forest contains the servers shown in the following table. All servers run Windows Server 2016. All desktops and laptops run Windows 10 Enterprise and are joined to the domain. The mobile devices of the users in the Montreal and Seattle offices run Android. The mobile devices of the users in the New York office run iOS. The domain is synced to Azure Active Directory (Azure AD) and includes the users shown in the following table. The domain also includes a group named Group1. Requirements - Planned Changes - Contoso plans to implement the following changes: Implement Microsoft 365. Manage devices by using Microsoft Intune. Implement Azure Advanced Threat Protection (ATP). Every September, apply the latest feature updates to all Windows computers. Every March, apply the latest feature updates to the computers in the New York office only. Technical Requirements - Contoso identifies the following technical requirements: When a Windows 10 device is joined to Azure AD, the device must enroll in Intune automatically. Dedicated support technicians must enroll all the Montreal office mobile devices in Intune. User1 must be able to enroll all the New York office mobile devices in Intune. Azure ATP sensors must be installed and must NOT use port mirroring. Whenever possible, the principle of least privilege must be used. A Microsoft Store for Business must be created. Compliance Requirements - Contoso identifies the following compliance requirements: Ensure that the users in Group1 can only access Microsoft Exchange Online from devices that are enrolled in Intune and configured in accordance with the corporate policy. Configure Windows Information Protection (WIP) for the Windows 10 devices.QuestionYou need to create the Microsoft Store for Business. Which user can create the store?

User2

User3

User4

User5

https://docs.microsoft.com/en-us/microsoft-store/roles-and-permissions-microsoft-store-for-business

Explanation

https://docs.microsoft.com/en-us/microsoft-store/roles-and-permissions-microsoft-store-for-business

36. You have a Microsoft 365 subscription. You need to be notified if users receive email containing a file that has a virus. What should you do?

A. From the Exchange admin center, create an in-place eDiscovery & hold.

B. From the Security & Compliance admin center, create a data governance event.

C. From the Exchange admin center, create an anti-malware policy.

D. From the Exchange admin center, create a spam filter policy.

https://docs.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/anti-spam-and-anti-malware-protection

Explanation

https://docs.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/anti-spam-and-anti-malware-protection

37. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a new Microsoft 365 subscription. You need to prevent users from sending email messages that contain Personally Identifiable Information (PII). Solution: From the Cloud App Security admin center, you create an access policy. Does this meet the goal?

Yes

No

The solution mentioned in the scenario does not meet the goal of preventing users from sending email messages that contain Personally Identifiable Information (PII). The Cloud App Security admin center is not specifically designed to create an access policy for preventing PII in email messages. Other solutions, such as implementing data loss prevention (DLP) policies in Exchange Online or using Microsoft Information Protection (MIP) labels and sensitivity labels, would be more suitable for this purpose.

Explanation

The solution mentioned in the scenario does not meet the goal of preventing users from sending email messages that contain Personally Identifiable Information (PII). The Cloud App Security admin center is not specifically designed to create an access policy for preventing PII in email messages. Other solutions, such as implementing data loss prevention (DLP) policies in Exchange Online or using Microsoft Information Protection (MIP) labels and sensitivity labels, would be more suitable for this purpose.

38. Your network contains an Active Directory domain named contoso.com that is synced to Microsoft Azure Active Directory (Azure AD). You manage Windows 10 devices by using Microsoft System Center Configuration Manager (Current Branch). You configure pilot co-management. You add a new device named Device1 to the domain. You install the Configuration Manager client on Device1. You need to ensure that you can manage Device1 by using Microsoft Intune and Configuration Manager. Solution: You add Device1 to an Active Directory group. Does this meet the goal?

Yes

No

The correct answer should be that the new device needs to be added into a pilot collection in configuration manager rather than an AD Security group, since the question clearly states that this scenario is a pilot co-management scenario. Reference: https://docs.microsoft.com/en-us/configmgr/comanage/tutorial-co-manage-clients

Specifically, please have a look at the section called "enable co-management in configuration manager" in the article above.

Reference: https://docs.microsoft.com/en-us/configmgr/comanage/how-to-enable

Explanation

The correct answer should be that the new device needs to be added into a pilot collection in configuration manager rather than an AD Security group, since the question clearly states that this scenario is a pilot co-management scenario. Reference: https://docs.microsoft.com/en-us/configmgr/comanage/tutorial-co-manage-clients

Specifically, please have a look at the section called "enable co-management in configuration manager" in the article above.

Reference: https://docs.microsoft.com/en-us/configmgr/comanage/how-to-enable

39. You have a Microsoft 365 tenant. All users are assigned the Enterprise Mobility + Security license. You need to ensure that when users join their device to Microsoft Azure Active Directory (Azure AD), the device is enrolled in Microsoft Intune automatically. What should you configure?

A. Enrollment restrictions from the Intune admin center

B. Device enrollment managers from the Intune admin center

C. MAM User scope from the Azure Active Directory admin center

D. MDM User scope from the Azure Active Directory admin center

References:

https://docs.microsoft.com/en-us/intune/windows-enroll

Explanation

References:

https://docs.microsoft.com/en-us/intune/windows-enroll

40. You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com. You have a Microsoft 365 subscription. You need to ensure that users can manage the configuration settings for all the Windows 10 devices in your organization. What should you configure?

A. the Enrollment restrictions

B. the mobile device management (MDM) authority

C. the Exchange on-premises access settings

D. the Windows enrollment settings

To ensure that users can manage the configuration settings for all the Windows 10 devices in the organization, you need to configure the mobile device management (MDM) authority. This allows users to manage and control the settings of their Windows 10 devices through the MDM solution. By setting the MDM authority to the Microsoft 365 subscription, users will have the necessary permissions and access to manage the configuration settings for all the Windows 10 devices in the organization.

Explanation

To ensure that users can manage the configuration settings for all the Windows 10 devices in the organization, you need to configure the mobile device management (MDM) authority. This allows users to manage and control the settings of their Windows 10 devices through the MDM solution. By setting the MDM authority to the Microsoft 365 subscription, users will have the necessary permissions and access to manage the configuration settings for all the Windows 10 devices in the organization.

41. You have three devices enrolled in Microsoft Intune as shown in the following table. The device compliance policies in Intune are configured as shown in the following table. The device compliance policies have the assignments shown in the following table. For each of the following statements, check the box if the statement is true. Otherwise, leave deselected. NOTE: Each correct selection is worth one point.

Device1 is marked as noncompliant after 10 days

Device2 is marked as noncompliant after 10 days

Device3 is marked as noncompliant after 10 days

Device1 is marked as noncompliant after 10 Days: Yes, because Device 1 is member of group 1 and 2, only group 2 is assigned to a policy (policy 2), policy 2 requires Bitlocker, device does not have it so the device will be marked as non compliant after 10 days.

Device2 is marked as noncompliant after 10 Days: Yes, because Device 2 is member of group 2 and 3, only policy 2 requires Bitlocker, therefore Device is marked as non compliant after 10 days.

Device3 is marked as noncompliant after 10 Days: No, because Device 3 is only a member of group 3, group 3 is assigned to Policy 3, policy 3 does not require Bitlocker, so the device will not be marked as non compliant at all, also if it was required it will be after 15 days, not 10 days.

Explanation

Device1 is marked as noncompliant after 10 Days: Yes, because Device 1 is member of group 1 and 2, only group 2 is assigned to a policy (policy 2), policy 2 requires Bitlocker, device does not have it so the device will be marked as non compliant after 10 days.

Device2 is marked as noncompliant after 10 Days: Yes, because Device 2 is member of group 2 and 3, only policy 2 requires Bitlocker, therefore Device is marked as non compliant after 10 days.

Device3 is marked as noncompliant after 10 Days: No, because Device 3 is only a member of group 3, group 3 is assigned to Policy 3, policy 3 does not require Bitlocker, so the device will not be marked as non compliant at all, also if it was required it will be after 15 days, not 10 days.

Submit

42. You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com. You need to provide a user with the ability to sign up for Microsoft Store for Business for contoso.com. The solution must use the principle of least privilege. Which role should you assign to the user?

A. Cloud application administrator

B. Application administrator

C. Global administrator

D. Service administrator

References:

https://docs.microsoft.com/en-us/microsoft-store/roles-and-permissions-microsoft-store-for-business

Explanation

References:

https://docs.microsoft.com/en-us/microsoft-store/roles-and-permissions-microsoft-store-for-business

43. From the Microsoft Azure Active Directory (Azure AD) Identity Protection dashboard, you view the risk events shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

1.To require multi-factor authentication when signing into an unfamiliar location, you must create a (sign-in risky policy)

2.To avoid generating alerts when signing in to the Montreal location, create (a named location in Azure AD)

To require multi-factor authentication when signing into an unfamiliar location, you must create a sign-in risky policy. This policy would identify and flag sign-in attempts from unfamiliar locations as risky, triggering the requirement for multi-factor authentication to provide an additional layer of security.

To avoid generating alerts when signing in to the Montreal location, you would create a named location in Azure AD. By defining Montreal as a named location, sign-ins from this location would be recognized as legitimate and not trigger any alerts or risk events.

Explanation

To require multi-factor authentication when signing into an unfamiliar location, you must create a sign-in risky policy. This policy would identify and flag sign-in attempts from unfamiliar locations as risky, triggering the requirement for multi-factor authentication to provide an additional layer of security.

To avoid generating alerts when signing in to the Montreal location, you would create a named location in Azure AD. By defining Montreal as a named location, sign-ins from this location would be recognized as legitimate and not trigger any alerts or risk events.

Submit

44.

Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York. The company has the employees and devices shown in the following table. Contoso recently purchased a Microsoft 365 E5 subscription. Existing Environment - The network contains an on-premises Active Directory forest named contoso.com. The forest contains the servers shown in the following table. All servers run Windows Server 2016. All desktops and laptops run Windows 10 Enterprise and are joined to the domain. The mobile devices of the users in the Montreal and Seattle offices run Android. The mobile devices of the users in the New York office run iOS. The domain is synced to Azure Active Directory (Azure AD) and includes the users shown in the following table. The domain also includes a group named Group1. Requirements - Planned Changes: Contoso plans to implement the following changes: Implement Microsoft 365. Manage devices by using Microsoft Intune. Implement Azure Advanced Threat Protection (ATP). Every September, apply the latest feature updates to all Windows computers. Every March, apply the latest feature updates to the computers in the New York office only. Technical Requirements: Contoso identifies the following technical requirements: When a Windows 10 device is joined to Azure AD, the device must enroll in Intune automatically. Dedicated support technicians must enroll all the Montreal office mobile devices in Intune. User1 must be able to enroll all the New York office mobile devices in Intune. Azure ATP sensors must be installed and must NOT use port mirroring. Whenever possible, the principle of least privilege must be used. A Microsoft Store for Business must be created. Compliance Requirements: Contoso identifies the following compliance requirements: Ensure that the users in Group1 can only access Microsoft Exchange Online from devices that are enrolled in Intune and configured in accordance with the corporate policy. Configure Windows Information Protection (WIP) for the Windows 10 devices. Question:- You need to meet the technical requirements and planned changes for Intune. What should you do? To answer, select the appropriate options is the answer area. NOTE: Each correct selection is worth one point.

Settings to configure in Azure AD:

Settings to configure in Intune:

Device Settings

Device compliance

Mobility (MDM & MAM)

Device configuration

Organizational relationships

Device enrollment

User settings

Mobile Device Management Authority

https://docs.microsoft.com/en-us/intune/windows-enroll

Explanation

https://docs.microsoft.com/en-us/intune/windows-enroll

Submit

45. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. You are deploying Microsoft Intune. You successfully enroll Windows 10 devices in Intune. When you try to enroll an iOS device in Intune, you get an error. You need to ensure that you can enroll the iOS device in Intune. Solution: You create an Apple Configurator enrollment profile. Does this meet the goal?

Yes

No

You need the Apple MDM push certificate.

Explanation

You need the Apple MDM push certificate.

46. You have a Microsoft 365 subscription. Your company purchases a new financial application named App1. From Cloud Discovery in Microsoft Cloud App Security, you view the Discovered apps page and discover that many applications have a low score because they are missing information about domain registration and consumer popularity. You need to prevent the missing information from affecting the score. What should you configure from the Cloud Discover settings?

A. Organization details

B. Default behavior

C. Score metrics

D. App tags

https://docs.microsoft.com/en-us/cloud-app-security/risk-score#customizing-the-risk-score

Explanation

https://docs.microsoft.com/en-us/cloud-app-security/risk-score#customizing-the-risk-score

47. You have a Microsoft 365 subscription. You need to investigate user activity in Microsoft 365, including from where users signed in, which applications were used, and increases in activity during the past month. The solution must minimize administrative effort. Which admin center should you use?

A. Azure ATP

B. Security & Compliance

C. Cloud App Security

D. Flow

https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance

If it shouln't contain application info, the answer should be B

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance

If it shouln't contain application info, the answer should be B

48. You are testing a data loss prevention (DLP) policy to protect the sharing of credit card information with external users. During testing, you discover that a user can share credit card information with external users by using email. However, the user is prevented from sharing files that contain credit card information by using Microsoft SharePoint Online. You need to prevent the user from sharing the credit card information by using email and SharePoint. What should you configure?

A. the locations of the DLP policy

B. the user overrides of the DLP policy rule

C. the status of the DLP policy

D. the conditions of the DLP policy rule

https://docs.microsoft.com/en-us/office365/securitycompliance/data-loss-prevention-policies

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/data-loss-prevention-policies

49. You have a Microsoft Office 365 subscription. You need to delegate eDiscovery tasks as shown in the following table. The solution must follow the principle of the least privilege. To which role group should you assign each user? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

User1 - eDiscovery Manager

User2 - eDiscovery Administrator

Role	Compliance Administrator	eDiscovery Manager & Administrator	Organization Management	Reviewer
Case Management
Compliance Search
Export
Hold
Preview
Review
RMS Decrypt
Search And Purge

Explanation

Role	Compliance Administrator	eDiscovery Manager & Administrator	Organization Management	Reviewer
Case Management
Compliance Search
Export
Hold
Preview
Review
RMS Decrypt
Search And Purge

Submit

50. From the Security & Compliance admin center, you create a content export as shown in the exhibit. (Click the Exhibit tab.) What will be excluded from the export?

A. a 60-MB DOCX file

B. a 5-MB MP3 file

C. a 10-MB XLSX file

D. a 5-KB RTF file

https://docs.microsoft.com/en-us/office365/securitycompliance/export-a-content-search-report

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/export-a-content-search-report

51. Overview - Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York. The company has the employees and devices shown in the following table. Contoso recently purchased a Microsoft 365 E5 subscription. Existing Environment - The network contains an on-premises Active Directory forest named contoso.com. The forest contains the servers shown in the following table. All servers run Windows Server 2016. All desktops and laptops run Windows 10 Enterprise and are joined to the domain. The mobile devices of the users in the Montreal and Seattle offices run Android. The mobile devices of the users in the New York office run iOS. The domain is synced to Azure Active Directory (Azure AD) and includes the users shown in the following table. The domain also includes a group named Group1. Requirements - Planned Changes - Contoso plans to implement the following changes: Implement Microsoft 365. Manage devices by using Microsoft Intune. Implement Azure Advanced Threat Protection (ATP). Every September, apply the latest feature updates to all Windows computers. Every March, apply the latest feature updates to the computers in the New York office only. Technical Requirements - Contoso identifies the following technical requirements: When a Windows 10 device is joined to Azure AD, the device must enroll in Intune automatically. Dedicated support technicians must enroll all the Montreal office mobile devices in Intune. User1 must be able to enroll all the New York office mobile devices in Intune. Azure ATP sensors must be installed and must NOT use port mirroring. Whenever possible, the principle of least privilege must be used. A Microsoft Store for Business must be created. Compliance Requirements - Contoso identifies the following compliance requirements: Ensure that the users in Group1 can only access Microsoft Exchange Online from devices that are enrolled in Intune and configured in accordance with the corporate policy. Configure Windows Information Protection (WIP) for the Windows 10 devices.QuestionHOTSPOT - You need to meet the Intune requirements for the Windows 10 devices. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

Mobility (MDM & MAM)

Device enrollment

User Settings

Device Compliance

https://docs.microsoft.com/en-us/intune/windows-enroll

Explanation

https://docs.microsoft.com/en-us/intune/windows-enroll

Submit

52. ADatum Corporation is an international financial services company that has 5,000 employees. ADatum has six offices: a main office in New York and five branch offices in Germany, the United Kingdom, France, Spain, and Italy. All the offices are connected to each other by using a WAN link. Each office connects directly to the Internet. Existing Environment - Current Infrastructure -

ADatum recently purchased a Microsoft 365 subscription.

All user files are migrated to Microsoft 365.

All mailboxes are hosted in Microsoft 365. The users in each office have email suffixes that include the country of the user, for example, user1@us.adatum.com or user2@uk.adatum.com.

Each office has a security information and event management (SIEM) appliance. The appliance comes from three different vendors.

ADatum uses and processes Personally Identifiable Information (PII).

Problem Statements - ADatum entered into litigation. The legal department must place a hold on all the documents of a user named User1 that are in Microsoft 365. Requirements - Business Goals -

ADatum wants to be fully compliant with all the relevant data privacy laws in the regions where is operates.

ADatum wants to minimize the cost of hardware and software whenever possible.

Technical Requirements - ADatum identifies the following technical requirements:

Centrally perform log analysis for all offices.

Aggregate all data from the SIEM appliances to a central cloud repository for later analysis.

Ensure that a SharePoint administrator can identify who accessed a specific file stored in a document library.

Provide the users in the finance department with access to Service assurance information in Microsoft Office 365.

Ensure that documents and email messages containing the PII data of European Union (EU) citizens are preserved for 10 years.

If a user attempts to download 1,000 or more files from Microsoft SharePoint Online within 30 minutes, notify a security administrator and suspend the user's user account.

A security administrator requires a report that shown which Microsoft 365 users signed in. Based on the report, the security administrator will create a policy to require multi-factor authentication when a sign-in is high risk.

Ensure that the users in the New York office can only send email messages that contain sensitive U.S. PII data to other New York office uses. Email messages must be monitored to ensure compliance.

Auditors in the New York office must have access to reports that show the sent and received email messages containing sensitive U.S. PII data.

Question: Which report should the New York office auditors view?

A. DLP incidents

B. Top Senders and Recipients

C. DLP false positives and overrides

D. DLP policy matches

https://docs.microsoft.com/en-us/office365/securitycompliance/data-loss-prevention-policies

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/data-loss-prevention-policies

53. Your company has 10 offices. The network contains an Active Directory domain named contoso.com. The domain contains 500 client computers. Each office is configured as a separate subnet. You discover that one of the offices has the following: ✑ Computers that have several preinstalled applications ✑ Computers that use nonstandard computer names ✑ Computers that have Windows 10 preinstalled ✑ Computers that are in a workgroup You must configure the computers to meet the following corporate requirements: ✑ All the computers must be joined to the domain. ✑ All the computers must have computer names that use a prefix of CONTOSO. ✑ All the computers must only have approved corporate applications installed. You need to recommend a solution to redeploy the computers. The solution must minimize the deployment time. What should you recommend?

A. a provisioning package

B. wipe and load refresh

C. Windows Autopilot

D. an in-place upgrade

By using a Provisioning, IT administrators can create a self-contained package that contains all of the configuration, settings, and apps that need to be applied to a device. Incorrect Answers: C: With Windows Autopilot the user can set up pre-configure devices without the need consult their IT administrator. D: Use the In-Place Upgrade option when you want to keep all (or at least most) existing applications.

References:

https://docs.microsoft.com/en-us/windows/deployment/windows-10-deployment-scenarios

https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot

Explanation

By using a Provisioning, IT administrators can create a self-contained package that contains all of the configuration, settings, and apps that need to be applied to a device. Incorrect Answers: C: With Windows Autopilot the user can set up pre-configure devices without the need consult their IT administrator. D: Use the In-Place Upgrade option when you want to keep all (or at least most) existing applications.

References:

https://docs.microsoft.com/en-us/windows/deployment/windows-10-deployment-scenarios

https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot

54. You have a Microsoft 365 subscription. From the Security & Compliance admin center, you create a content search of a mailbox. You need to view the content of the mail messages found by the search as quickly as possible. What should you select from the Content search settings?

A. Export report

B. Export results

C. Re-run

D. View results

There is no "˜View Results" option. You can preview results but that will only show up to 100 emails. To guarantee you're getting all results, you'll need to export them to a PST file.

References:

https://docs.microsoft.com/en-us/microsoft-365/compliance/limits-for-content-search

Explanation

There is no "˜View Results" option. You can preview results but that will only show up to 100 emails. To guarantee you're getting all results, you'll need to export them to a PST file.

References:

https://docs.microsoft.com/en-us/microsoft-365/compliance/limits-for-content-search

55. Your company has a Microsoft 365 E5 subscription. Users in the research department work with sensitive data. You need to prevent the research department users from accessing potentially unsafe websites by using hyperlinks embedded in email messages and documents. Users in other departments must not be restricted. What should you do from the Security & Compliance admin center?

A. Create a data loss prevention (DLP) policy that has a Content is shared condition.

B. Modify the default safe links policy.

C. Create a data loss prevention (DLP) policy that has a Content contains condition.

D. Create a new safe links policy.

References:

https://docs.microsoft.com/en-us/office365/securitycompliance/set-up-atp-safe-links-policies#policies-that-apply-to-specific-email-recipients

Explanation

References:

https://docs.microsoft.com/en-us/office365/securitycompliance/set-up-atp-safe-links-policies#policies-that-apply-to-specific-email-recipients

56. Your company uses Microsoft Azure Advanced Threat Protection (ATP) and Windows Defender ATP. You need to integrate Windows Defender ATP and Azure ATP. What should you do?

A. From Azure ATP, configure the notifications and reports.

B. From Azure ATP, configure the data sources.

C. From Windows Defender Security Center, configure the Machine management settings.

D. From Windows Defender Security Center, configure the General settings.

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/integrate-wd-atp

Explanation

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/integrate-wd-atp

57. The users at your company use Dropbox to store documents. The users access Dropbox by using the MyApps portal. You need to ensure that user access to Dropbox is authenticated by using a Microsoft 365 identity. The documents must be protected if the data is downloaded to an untrusted device. What should you do?

A. From the Intune admin center, configure the Conditional access settings.

B. From the Azure Active Directory admin center, configure the Organizational relationships settings.

C. From the Azure Active Directory admin center, configure the Application proxy settings.

D. From the Azure Active Directory admin center, configure the Devices settings.

not-available-via-ai

Explanation

not-available-via-ai

58. You have a Microsoft 365 subscription. You need to view the IP address from which a user synced a Microsoft SharePoint library. What should you do?

A. From the SharePoint admin center, view the usage reports.

B. From the Security & Compliance admin center, perform an audit log search.

C. From the Microsoft 365 admin center, view the usage reports.

D. From the Microsoft 365 admin center, view the properties of the user's user account.

https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance

59. HOTSPOT - You configure an anti-phishing policy as shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

The message is moving to the Deleted Items folder

Mailbox intelligence

If a message is identified as a domain impersonation: Answer> The message is moved to the deleted Items folder
To reduce the likelihood of the impersonation policy generating false positives, configure: Answer Mailbox Intelligence

Explanation

If a message is identified as a domain impersonation: Answer> The message is moved to the deleted Items folder
To reduce the likelihood of the impersonation policy generating false positives, configure: Answer Mailbox Intelligence

Submit

60. Your company has a Microsoft 365 subscription that uses an Azure Active Directory (Azure AD) tenant named contoso.com. The company purchases a cloud app named App1 that supports Microsoft Cloud App Security monitoring. You configure App1 to be available from the My Apps portal. You need to ensure that you can monitor App1 from Cloud App Security. What should you do?

A. From the Azure Active Directory admin center, create a conditional access policy.

B. From the Azure Active Directory admin center, create an app registration.

C. From the Device Management admin center, create an app protection policy.

D. From the Device Management admin center, create an app configuration policy.

https://docs.microsoft.com/en-us/cloud-app-security/proxy-deployment-any-app

Explanation

https://docs.microsoft.com/en-us/cloud-app-security/proxy-deployment-any-app

61. You have the Microsoft Azure Advanced Threat Protection (ATP) workspace shown in the Workspace exhibit. (Click the Workspace tab.) The sensors settings for the workspace are configured as shown in the Sensors exhibit. (Click the Sensors tab.) You need to ensure that Azure ATP stores data in Asia. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

1. Delete the workspace

2. Create a new workspace

3. Regenerate the acces keys

Your instance is created automatically in the data center that is geographically closest to your Azure Active Directory (Azure AD). Once created, Azure ATP instances aren't movable.

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/install-atp-step1

Explanation

Your instance is created automatically in the data center that is geographically closest to your Azure Active Directory (Azure AD). Once created, Azure ATP instances aren't movable.

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/install-atp-step1

Submit

62. You have a Microsoft 365 subscription. You configure a data loss prevention (DLP) policy. You discover that users are incorrectly marking content as false positive and bypassing the DLP policy. You need to prevent the users from bypassing the DLP policy. What should you configure?

A. incident reports

B. actions

C. exceptions

D. user overrides

https://docs.microsoft.com/en-us/office365/securitycompliance/data-loss-prevention-policies

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/data-loss-prevention-policies

63. Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York. The company has the employees and devices shown in the following table. Contoso recently purchased a Microsoft 365 E5 subscription. Existing Environment - The network contains an on-premises Active Directory forest named contoso.com. The forest contains the servers shown in the following table. All servers run Windows Server 2016. All desktops and laptops run Windows 10 Enterprise and are joined to the domain. The mobile devices of the users in the Montreal and Seattle offices run Android. The mobile devices of the users in the New York office run iOS. The domain is synced to Azure Active Directory (Azure AD) and includes the users shown in the following table. The domain also includes a group named Group1. Requirements - Planned Changes - Contoso plans to implement the following changes: Implement Microsoft 365. Manage devices by using Microsoft Intune. Implement Azure Advanced Threat Protection (ATP). Every September, apply the latest feature updates to all Windows computers. Every March, apply the latest feature updates to the computers in the New York office only. Technical Requirements - Contoso identifies the following technical requirements: When a Windows 10 device is joined to Azure AD, the device must enroll in Intune automatically. Dedicated support technicians must enroll all the Montreal office mobile devices in Intune. User1 must be able to enroll all the New York office mobile devices in Intune. Azure ATP sensors must be installed and must NOT use port mirroring. Whenever possible, the principle of least privilege must be used. A Microsoft Store for Business must be created. Compliance Requirements - Contoso identifies the following compliance requirements: Ensure that the users in Group1 can only access Microsoft Exchange Online from devices that are enrolled in Intune and configured in accordance with the corporate policy. Configure Windows Information Protection (WIP) for the Windows 10 devices.QuestionHOTSPOT - You need to configure a conditional access policy to meet the compliance requirements. You add Exchange Online as a cloud app. Which two additional settings should you configure in Policy1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Groups

Users

Users and groups

Conditions

To meet the compliance requirements, the additional settings that should be configured in Policy1 are "Users and groups" and "Conditions". By selecting "Users and groups", you can specify which users should be subject to the conditional access policy. By selecting "Conditions", you can define the specific conditions that must be met for the policy to be applied, such as device platforms, locations, or client apps.

Explanation

To meet the compliance requirements, the additional settings that should be configured in Policy1 are "Users and groups" and "Conditions". By selecting "Users and groups", you can specify which users should be subject to the conditional access policy. By selecting "Conditions", you can define the specific conditions that must be met for the policy to be applied, such as device platforms, locations, or client apps.

Submit

64. Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York. The company has the employees and devices shown in the following table. Contoso recently purchased a Microsoft 365 E5 subscription. Existing Environment - The network contains an on-premises Active Directory forest named contoso.com. The forest contains the servers shown in the following table. All servers run Windows Server 2016. All desktops and laptops run Windows 10 Enterprise and are joined to the domain. The mobile devices of the users in the Montreal and Seattle offices run Android. The mobile devices of the users in the New York office run iOS. The domain is synced to Azure Active Directory (Azure AD) and includes the users shown in the following table. The domain also includes a group named Group1. Requirements - Planned Changes - Contoso plans to implement the following changes:

Implement Microsoft 365.

Manage devices by using Microsoft Intune.

Implement Azure Advanced Threat Protection (ATP).

Every September, apply the latest feature updates to all Windows computers. Every March, apply the latest feature updates to the computers in the New York office only.

Technical Requirements - Contoso identifies the following technical requirements:

When a Windows 10 device is joined to Azure AD, the device must enroll in Intune automatically.

Dedicated support technicians must enroll all the Montreal office mobile devices in Intune.

User1 must be able to enroll all the New York office mobile devices in Intune.

Azure ATP sensors must be installed and must NOT use port mirroring.

Whenever possible, the principle of least privilege must be used.

A Microsoft Store for Business must be created.

Compliance Requirements - Contoso identifies the following compliance requirements:

Ensure that the users in Group1 can only access Microsoft Exchange Online from devices that are enrolled in Intune and configured in accordance with the corporate policy.

Configure Windows Information Protection (WIP) for the Windows 10 devices.

Question: You need to meet the compliance requirements for the Windows 10 devices. What should you create from the Intune admin center?

A. a device compliance policy

B. a device configuration profile

C. an app protection policy

D. an app configuration policy

https://docs.microsoft.com/en-us/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure

Explanation

https://docs.microsoft.com/en-us/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure

65. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 subscription. You need to prevent users from accessing your Microsoft SharePoint Online sites unless the users are connected to your on-premises network. Solution: From the Device Management admin center, you create a trusted location and a compliance policy Does this meet the goal?

Yes

No

Conditional Access in SharePoint Online can be configured to use an IP Address white list to allow access.

References:

https://techcommunity.microsoft.com/t5/Microsoft-SharePoint-Blog/Conditional-Access-in-SharePoint-Online-and-OneDrive-for/ba-p/46678

Explanation

Conditional Access in SharePoint Online can be configured to use an IP Address white list to allow access.

References:

https://techcommunity.microsoft.com/t5/Microsoft-SharePoint-Blog/Conditional-Access-in-SharePoint-Online-and-OneDrive-for/ba-p/46678

66. You have a Microsoft 365 subscription.You need to be notified if users receive email containing a file that has a virus. What should you do?

A. From the Exchange admin center, create an in-place eDiscovery & hold.

B. From the Security & Compliance admin center, create a safe attachments policy.

C. From the Security & Compliance admin center, create a data loss prevention (DLP) policy.

D. From the Security & Compliance admin center, create an alert policy.

https://docs.microsoft.com/en-us/office365/securitycompliance/alert-policies

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/alert-policies

67. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory domain named contoso.com that is synced to Microsoft Azure Active Directory (Azure AD). You manage Windows 10 devices by using Microsoft System Center Configuration Manager (Current Branch). You configure pilot co-management. You add a new device named Device1 to the domain. You install the Configuration Manager client on Device1. You need to ensure that you can manage Device1 by using Microsoft Intune and Configuration Manager. Solution: You add Device1 to a Configuration Manager device collection. Does this meet the goal?

Yes

No

To Pilot Co-Management, you must provide a Pilot Device Collection, so if this connection was clearly named in the question it would have been yes.

Explanation

To Pilot Co-Management, you must provide a Pilot Device Collection, so if this connection was clearly named in the question it would have been yes.

68. A user receives the following message when attempting to sign in to https://myapps.microsoft.com: "Your sign-in was blocked. We've detected something unusual about this sign-in. For example, you might be signing in from a new location, device, or app. Before you can continue, we need to verify your identity. Please contact your admin." Which configuration prevents the users from signing in?

A. Microsoft Azure Active Directory (Azure AD) Identity Protection policies

B. Microsoft Azure Active Directory (Azure AD) conditional access policies

C. Security & Compliance supervision policies

D. Security & Compliance data loss prevention (DLP) policies

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview

Explanation

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview

69. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 subscription. You discover that some external users accessed content on a Microsoft SharePoint site. You modify the SharePoint sharing policy to prevent sharing outside your organization. You need to be notified if the SharePoint sharing policy is modified in the future. Solution: From the Security & Compliance admin center, you create a threat management policy. Does this meet the goal?

Yes

No

From the Security & Compliance admin center, Alerts, you create a new alert policy. https://docs.microsoft.com/en-us/microsoft-365/compliance/alert-policies

Explanation

From the Security & Compliance admin center, Alerts, you create a new alert policy. https://docs.microsoft.com/en-us/microsoft-365/compliance/alert-policies

70. Your network contains an Active Directory domain named contoso.com. The domain contains the file servers shown in the following table. A file named File1.abc is stored on Server1. A file named File2.abc is stored on Server2. Three apps named App1, App2, and App3 all open files that have the .abc file extension. You implement Windows Information Protection (WIP) by using the following configurations: ✑ Exempt apps: App2 ✑ Protected apps: App1 ✑ Windows Information Protection mode: Block ✑ Network boundary: IPv4 range of: 192.168.1.1-192.168-1.255 You need to identify the apps from which you can open File1.abc. For each of the following statements, select the statement if it is true. NOTE: Each correct selection is worth one point.

You can open File1.abc in App1

You can open File1.abc in App2

You can open File1.abc in App3

https://allthingscloud.blog/windows-information-protection-with-enrollment/

Explanation

https://allthingscloud.blog/windows-information-protection-with-enrollment/

Submit

71. Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York. The company has the employees and devices shown in the following table. Contoso recently purchased a Microsoft 365 E5 subscription. Existing Environment - The network contains an on-premises Active Directory forest named contoso.com. The forest contains the servers shown in the following table. All servers run Windows Server 2016. All desktops and laptops run Windows 10 Enterprise and are joined to the domain. The mobile devices of the users in the Montreal and Seattle offices run Android. The mobile devices of the users in the New York office run iOS. The domain is synced to Azure Active Directory (Azure AD) and includes the users shown in the following table. The domain also includes a group named Group1. Requirements - Planned Changes - Contoso plans to implement the following changes: Implement Microsoft 365. Manage devices by using Microsoft Intune. Implement Azure Advanced Threat Protection (ATP). Every September, apply the latest feature updates to all Windows computers. Every March, apply the latest feature updates to the computers in the New York office only. Technical Requirements - Contoso identifies the following technical requirements: When a Windows 10 device is joined to Azure AD, the device must enroll in Intune automatically. Dedicated support technicians must enroll all the Montreal office mobile devices in Intune. User1 must be able to enroll all the New York office mobile devices in Intune. Azure ATP sensors must be installed and must NOT use port mirroring. Whenever possible, the principle of least privilege must be used. A Microsoft Store for Business must be created. Compliance Requirements - Contoso identifies the following compliance requirements: Ensure that the users in Group1 can only access Microsoft Exchange Online from devices that are enrolled in Intune and configured in accordance with the corporate policy. Configure Windows Information Protection (WIP) for the Windows 10 devices.QuestionYou need to ensure that the support technicians can meet the technical requirement for the Montreal office mobile devices. What is the minimum of dedicated support technicians required?

1

4

7

31

Device Enrollment Manager (DEM) can enroll up to 1,000 devices. Since 3,100 devices, we'll need 4 DEMs at a minimum.

https://docs.microsoft.com/en-us/intune/enrollment/device-enrollment-manager-enroll

Explanation

Device Enrollment Manager (DEM) can enroll up to 1,000 devices. Since 3,100 devices, we'll need 4 DEMs at a minimum.

https://docs.microsoft.com/en-us/intune/enrollment/device-enrollment-manager-enroll

72. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a new Microsoft 365 subscription. You need to prevent users from sending email messages that contain Personally Identifiable Information (PII). Solution: From the Exchange admin center, you create a data loss prevention (DLP) policy. Does this meet the goal?

Yes

No

Yes, creating a data loss prevention (DLP) policy from the Exchange admin center can help prevent users from sending email messages that contain Personally Identifiable Information (PII). A DLP policy allows you to define rules and conditions to automatically detect and prevent the transmission of sensitive information, such as credit card numbers, social security numbers, or other PII. By implementing this policy, you can enforce data protection and compliance within your organization, ensuring that sensitive information is not shared via email.

Explanation

Yes, creating a data loss prevention (DLP) policy from the Exchange admin center can help prevent users from sending email messages that contain Personally Identifiable Information (PII). A DLP policy allows you to define rules and conditions to automatically detect and prevent the transmission of sensitive information, such as credit card numbers, social security numbers, or other PII. By implementing this policy, you can enforce data protection and compliance within your organization, ensuring that sensitive information is not shared via email.

73. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. You have a Microsoft 365 subscription. You discover that some external users accessed content on a Microsoft SharePoint site. You modify the SharePoint sharing policy to prevent sharing outside your organization. You need to be notified if the SharePoint sharing policy is modified in the future. Solution: From the SharePoint site, you create an alert. Does this meet the goal?

Yes

No

This should be covered with an alert policy

Explanation

This should be covered with an alert policy

74. You have the Microsoft Azure Active Directory (Azure AD) users shown in the following table. Your company uses Microsoft Intune. Several devices are enrolled in Intune as shown in the following table. The device compliance policies in Intune are configured as shown in the following table. You create a conditional access policy that has the following settings: ✑ The Assignments settings are configured as follows: 1. Users and groups: Group1 2. Cloud apps: Microsoft Office 365 Exchange Online 3. Conditions: Include All device state, exclude Device marked as compliant ✑ Access controls is set to Block access. For each of the following statements, select if the statement is true. Otherwise leave deselected. NOTE: Each correct selection is worth one point.

User1 can access Microsoft Exchange Online from Device1

User1 can access Microsoft Exchange Online from Device2

User2 can access Microsoft Exchange Online from Device2.

User2 is not targeted by conditional access policy.

User1 can access Microsoft Exchange Online from Device1. Yes
User1 can access Microsoft Exchange Online from Device2. No
User2 can access Microsoft Exchange Online from Device2. Yes

Explanation

User2 is not targeted by conditional access policy.

User1 can access Microsoft Exchange Online from Device1. Yes
User1 can access Microsoft Exchange Online from Device2. No
User2 can access Microsoft Exchange Online from Device2. Yes

Submit

75. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory domain named contoso.com that is synced to Microsoft Azure Active Directory (Azure AD). You manage Windows 10 devices by using Microsoft System Center Configuration Manager (Current Branch). You configure pilot co-management.You add a new device named Device1 to the domain. You install the Configuration Manager client on Device1. You need to ensure that you can manage Device1 by using Microsoft Intune and Configuration Manager. Solution: Define a Configuration Manager device collection as the pilot collection. Add Device1 to the collection. Does this meet the goal?

Yes

No

Pilot - Only the Configuration Manager clients that are members of the Intune Auto Enrollment collection are automatically enrolled to Intune.

https://docs.microsoft.com/en-us/configmgr/comanage/how-to-enable

Explanation

Pilot - Only the Configuration Manager clients that are members of the Intune Auto Enrollment collection are automatically enrolled to Intune.

https://docs.microsoft.com/en-us/configmgr/comanage/how-to-enable

76. In Microsoft 365, you configure a data loss prevention (DLP) policy named Policy1. Policy1 detects the sharing of United States (US) bank account numbers in email messages and attachments. Policy1 is configured as shown in the exhibit. (Click the Exhibit tab.) You need to ensure that internal users can email documents that contain US bank account numbers to external users who have an email suffix of contoso.com. What should you configure?

A. an exception

B. an action

C. a condition

D. a group

Editing Policy settings > +New Rule > Exceptions

We won't apply this rule to content that matches any of these exceptions. > +Add an exception > [Dropdownbox] Except if the recipient domain is.

Explanation

Editing Policy settings > +New Rule > Exceptions

We won't apply this rule to content that matches any of these exceptions. > +Add an exception > [Dropdownbox] Except if the recipient domain is.

77. You plan to use the Security & Compliance admin center to import several PST files into Microsoft 365 mailboxes. Which three actions should you perform before you import the data? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

A. From the Exchange admin center, create a public folder.

B. Copy the PST files by using AzCopy.

C. From the Exchange admin center, assign admin roles.

D. From the Microsoft Azure portal, create a storage account that has a blob container.

E. From the Microsoft 365 admin center, deploy an add-in.

F. Create a mapping file that uses the CSV file format.

You have to be assigned the Mailbox Import Export role in Exchange Online to import PST files to Office 365 mailboxes. By default, this role isn't assigned to any role group in Exchange Online. You can add the Mailbox Import Export role to the Organization Management role group. Or you can create a role group, assign the Mailbox Import Export role, and then add yourself as a member.

https://docs.microsoft.com/en-us/office365/securitycompliance/use-network-upload-to-import-pst-files

Explanation

You have to be assigned the Mailbox Import Export role in Exchange Online to import PST files to Office 365 mailboxes. By default, this role isn't assigned to any role group in Exchange Online. You can add the Mailbox Import Export role to the Organization Management role group. Or you can create a role group, assign the Mailbox Import Export role, and then add yourself as a member.

https://docs.microsoft.com/en-us/office365/securitycompliance/use-network-upload-to-import-pst-files

Submit

78. You need to notify the manager of the human resources department when a user in the department shares a file or folder from the department's Microsoft SharePoint site. What should you do?

A. From the Security & Compliance admin center, create an alert policy.

B. From the SharePoint site, create an alert.

C. From the SharePoint admin center, modify the sharing settings.

D. From the Security & Compliance admin center, create a data loss prevention (DLP) policy.

https://docs.microsoft.com/en-us/office365/securitycompliance/create-activity-alerts

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/create-activity-alerts

79. You have a Microsoft 365 subscription. All users have their email stored in Microsoft Exchange Online. In the mailbox of a user named User1, you need to preserve a copy of all the email messages that contain the word ProjectX. What should you do?

A. From the Security & Compliance admin center, create an eDiscovery case.

B. From the Exchange admin center, create a mail flow rule.

C. From the Security & Compliance admin center, start a message trace.

D. From Microsoft Cloud App Security, create an access policy.

https://docs.microsoft.com/en-us/office365/securitycompliance/ediscovery-cases#step-2-create-a-new-case

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/ediscovery-cases#step-2-create-a-new-case

80. Overview: ADatum Corporation is an international financial services company that has 5,000 employees. ADatum has six offices: a main office in New York and five branch offices in Germany, the United Kingdom, France, Spain, and Italy. All the offices are connected to each other by using a WAN link. Each office connects directly to the Internet. Existing Environment - Current Infrastructure: ADatum recently purchased a Microsoft 365 subscription. All user files are migrated to Microsoft 365. All mailboxes are hosted in Microsoft 365. The users in each office have email suffixes that include the country of the user, for example, user1@us.adatum.com or user2@uk.adatum.com. Each office has a security information and event management (SIEM) appliance. The appliance comes from three different vendors. ADatum uses and processes Personally Identifiable Information (PII). Problem Statements: ADatum entered into litigation. The legal department must place a hold on all the documents of a user named User1 that are in Microsoft 365. Requirements - Business Goals: ADatum wants to be fully compliant with all the relevant data privacy laws in the regions where is operates. ADatum wants to minimize the cost of hardware and software whenever possible. Technical Requirements: ADatum identifies the following technical requirements:

Centrally perform log analysis for all offices.

Aggregate all data from the SIEM appliances to a central cloud repository for later analysis.

Ensure that a SharePoint administrator can identify who accessed a specific file stored in a document library.

Provide the users in the finance department with access to Service assurance information in Microsoft Office 365.

Ensure that documents and email messages containing the PII data of European Union (EU) citizens are preserved for 10 years.

If a user attempts to download 1,000 or more files from Microsoft SharePoint Online within 30 minutes, notify a security administrator and suspend the user's user account.

A security administrator requires a report that shown which Microsoft 365 users signed in. Based on the report, the security administrator will create a policy to require multi-factor authentication when a sign-in is high risk.

Ensure that the users in the New York office can only send email messages that contain sensitive U.S. PII data to other New York office uses. Email messages must be monitored to ensure compliance. Auditors in the New York office must have access to reports that show the sent and received email messages containing sensitive U.S. PII data.

Question: You need to recommend a solution for the security administrator. The solution must meet the technical requirements. What should you include in the recommendation?

A. Microsoft Azure Active Directory (Azure AD) Privileged Identity Management

B. Microsoft Azure Active Directory (Azure AD) Identity Protection

C. Microsoft Azure Active Directory (Azure AD) conditional access policies

D. Microsoft Azure Active Directory (Azure AD) authentication methods

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/untrusted-networks

Explanation

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/untrusted-networks

81. Overview - ADatum Corporation is an international financial services company that has 5,000 employees. ADatum has six offices: a main office in New York and five branch offices in Germany, the United Kingdom, France, Spain, and Italy. All the offices are connected to each other by using a WAN link. Each office connects directly to the Internet. Existing Environment - Current Infrastructure - ADatum recently purchased a Microsoft 365 subscription. All user files are migrated to Microsoft 365. All mailboxes are hosted in Microsoft 365. The users in each office have email suffixes that include the country of the user, for example, user1@us.adatum.com or user2@uk.adatum.com. Each office has a security information and event management (SIEM) appliance. The appliance comes from three different vendors. ADatum uses and processes Personally Identifiable Information (PII). Problem Statements - ADatum entered into litigation. The legal department must place a hold on all the documents of a user named User1 that are in Microsoft 365. Requirements - Business Goals -

ADatum wants to be fully compliant with all the relevant data privacy laws in the regions where is operates.

ADatum wants to minimize the cost of hardware and software whenever possible.

Technical Requirements - ADatum identifies the following technical requirements:

Centrally perform log analysis for all offices.

Aggregate all data from the SIEM appliances to a central cloud repository for later analysis.

Ensure that a SharePoint administrator can identify who accessed a specific file stored in a document library.

Provide the users in the finance department with access to Service assurance information in Microsoft Office 365.

Ensure that documents and email messages containing the PII data of European Union (EU) citizens are preserved for 10 years.

If a user attempts to download 1,000 or more files from Microsoft SharePoint Online within 30 minutes, notify a security administrator and suspend the user's user account.

A security administrator requires a report that shown which Microsoft 365 users signed in. Based on the report, the security administrator will create a policy to require multi-factor authentication when a sign-in is high risk.

Ensure that the users in the New York office can only send email messages that contain sensitive U.S. PII data to other New York office uses. Email messages must be monitored to ensure compliance. Auditors in the New York office must have access to reports that show the sent and received email messages containing sensitive U.S. PII data.

Question: You need to meet the technical requirement for large-volume document retrieval. What should you create?

A. an activity policy from Microsoft Cloud App Security

B. a data loss prevention (DLP) policy from the Security & Compliance admin center

C. a file policy from Microsoft Cloud App Security

D. an alert policy from the Security & Compliance admin center

https://docs.microsoft.com/en-us/office365/securitycompliance/activity-policies-and-alerts

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/activity-policies-and-alerts

82. ADatum Corporation is an international financial services company that has 5,000 employees. ADatum has six offices: a main office in New York and five branch offices in Germany, the United Kingdom, France, Spain, and Italy. All the offices are connected to each other by using a WAN link. Each office connects directly to the Internet. Existing Environment - Current Infrastructure -

ADatum recently purchased a Microsoft 365 subscription.

All user files are migrated to Microsoft 365.

All mailboxes are hosted in Microsoft 365. The users in each office have email suffixes that include the country of the user, for example, user1@us.adatum.com or user2@uk.adatum.com.

Each office has a security information and event management (SIEM) appliance. The appliance comes from three different vendors.

ADatum uses and processes Personally Identifiable Information (PII).

Problem Statements - ADatum entered into litigation. The legal department must place a hold on all the documents of a user named User1 that are in Microsoft 365. Requirements - Business Goals -

ADatum wants to be fully compliant with all the relevant data privacy laws in the regions where is operates.

ADatum wants to minimize the cost of hardware and software whenever possible.

Technical Requirements - ADatum identifies the following technical requirements:

Centrally perform log analysis for all offices.

Aggregate all data from the SIEM appliances to a central cloud repository for later analysis.

Ensure that a SharePoint administrator can identify who accessed a specific file stored in a document library.

Provide the users in the finance department with access to Service assurance information in Microsoft Office 365.

Ensure that documents and email messages containing the PII data of European Union (EU) citizens are preserved for 10 years.

If a user attempts to download 1,000 or more files from Microsoft SharePoint Online within 30 minutes, notify a security administrator and suspend the user's user account.

A security administrator requires a report that shown which Microsoft 365 users signed in. Based on the report, the security administrator will create a policy to require multi-factor authentication when a sign-in is high risk.

Ensure that the users in the New York office can only send email messages that contain sensitive U.S. PII data to other New York office uses. Email messages must be monitored to ensure compliance.

Auditors in the New York office must have access to reports that show the sent and received email messages containing sensitive U.S. PII data.

Question: You need to protect the U.S. PII data to meet the technical requirements. What should you create?

A. a data loss prevention (DLP) policy that contains a domain exception

B. a Security & Compliance retention policy that detects content containing sensitive data

C. a Security & Compliance alert policy that contains an activity

D. a data loss prevention (DLP) policy that contains a user override

https://docs.microsoft.com/en-us/office365/securitycompliance/retention-policies

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/retention-policies

83. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 subscription. From the Security & Compliance admin center, you create a role group named US eDiscovery Managers by copying the eDiscovery Manager role group. You need to ensure that the users in the new role group can only perform content searches of mailbox content for users in the United States. Solution: From the Security & Compliance admin center, you modify the roles of the US eDiscovery Managers role group. Does this meet the goal?

A. Yes

B. No

The given solution does not meet the goal. Modifying the roles of the US eDiscovery Managers role group does not specify that the users in the new role group can only perform content searches of mailbox content for users in the United States.

Explanation

The given solution does not meet the goal. Modifying the roles of the US eDiscovery Managers role group does not specify that the users in the new role group can only perform content searches of mailbox content for users in the United States.

84. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a new Microsoft 365 subscription. You need to prevent users from sending email messages that contain Personally Identifiable Information (PII). Solution: From the Azure portal, you create a Microsoft Azure Information Protection label and an Azure Information Protection policy. Does this meet the goal?

A. Yes

B. No

Creating a Microsoft Azure Information Protection label and an Azure Information Protection policy in the Azure portal does not meet the goal of preventing users from sending email messages that contain Personally Identifiable Information (PII). While this solution helps in classifying and protecting sensitive information, it does not specifically prevent users from sending email messages containing PII. Additional measures such as Data Loss Prevention (DLP) policies in Exchange Online or Microsoft 365 Compliance Center would be required to achieve the goal.

Explanation

Creating a Microsoft Azure Information Protection label and an Azure Information Protection policy in the Azure portal does not meet the goal of preventing users from sending email messages that contain Personally Identifiable Information (PII). While this solution helps in classifying and protecting sensitive information, it does not specifically prevent users from sending email messages containing PII. Additional measures such as Data Loss Prevention (DLP) policies in Exchange Online or Microsoft 365 Compliance Center would be required to achieve the goal.

85. Your company has a Microsoft 365 subscription. You need to identify which users performed the following privileged administration tasks: ✑ Deleted a folder from the second-stage Recycle Bin of Microsoft SharePoint ✑ Opened a mailbox of which the user was not the owner ✑ Reset a user password What should you use?

A. Microsoft Azure Activity Directory (Azure AD) audit logs

B. Security & Compliance content search

C. Microsoft Azure Activity Directory (Azure AD) sign-ins

D. Security & Compliance audit log search

https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide

Explanation

https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide

86. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 subscription. You need to prevent users from accessing your Microsoft SharePoint Online sites unless the users are connected to your on-premises network. Solution: From the Azure Active Directory admin center, you create a trusted location and a conditional access policy. Does this meet the goal?

Yes

No

The solution of creating a trusted location and a conditional access policy in the Azure Active Directory admin center can help meet the goal of preventing users from accessing Microsoft SharePoint Online sites unless they are connected to the on-premises network. By creating a trusted location, the system recognizes the on-premises network as a trusted source, allowing access only from that network. The conditional access policy further enforces this restriction by applying additional conditions or requirements for accessing the SharePoint Online sites. Therefore, this solution effectively restricts access to the sites based on the user's network connection.

Explanation

The solution of creating a trusted location and a conditional access policy in the Azure Active Directory admin center can help meet the goal of preventing users from accessing Microsoft SharePoint Online sites unless they are connected to the on-premises network. By creating a trusted location, the system recognizes the on-premises network as a trusted source, allowing access only from that network. The conditional access policy further enforces this restriction by applying additional conditions or requirements for accessing the SharePoint Online sites. Therefore, this solution effectively restricts access to the sites based on the user's network connection.

87. Your company has a Microsoft 365 subscription. You need to identify which users performed the following privileged administration tasks:

Deleted a folder from the second-stage Recycle Bin of Microsoft SharePoint

Opened a mailbox of which the user was not the owner

Reset a user password

What should you use?

A. Microsoft Azure Activity Directory (Azure AD) audit logs

B. Security & Compliance content search

C. Microsoft Azure Activity Directory (Azure AD) sign-ins

D. Security & Compliance audit log search

https://docs.microsoft.com/en-us/azure/azure-monitor/platform/activity-logs-overview

Explanation

https://docs.microsoft.com/en-us/azure/azure-monitor/platform/activity-logs-overview

88. You have several devices enrolled in Microsoft Intune. You have a Microsoft Azure Active Directory (Azure AD) tenant that includes the users shown in the following table. The device limit restrictions in Intune are configured as shown in the following table. You add User3 as a device enrollment manager in Intune. For each of the following statements, select the statement if it's true. Otherwise, leave it deselected. NOTE: Each correct selection is worth one point.

User1 can enroll a maximum of 10 devices in Intune

User2 can enroll a maximum of 10 devices in Intune

User3 can enroll an unlimited number of devices in Intune

User1 can enroll a maximum of 10 devices in Intune - No (User1 is in Group A : Policy1, can enroll 15 devices) User2 can enroll a maximum of 10 devices in Intune - Yes (User2 is in Group B: Policy2, can enroll 10 devices) User3 can enroll an unlimited number of devices in Intune - No (Device Enrolment Managers can enroll 1000 devices)

https://docs.microsoft.com/en-us/sccm/mdm/deploy-use/enroll-devices-with-device-enrollment-manager

https://docs.microsoft.com/en-us/intune/enrollment/device-enrollment-manager-enroll

Explanation

User1 can enroll a maximum of 10 devices in Intune - No (User1 is in Group A : Policy1, can enroll 15 devices) User2 can enroll a maximum of 10 devices in Intune - Yes (User2 is in Group B: Policy2, can enroll 10 devices) User3 can enroll an unlimited number of devices in Intune - No (Device Enrolment Managers can enroll 1000 devices)

https://docs.microsoft.com/en-us/sccm/mdm/deploy-use/enroll-devices-with-device-enrollment-manager

https://docs.microsoft.com/en-us/intune/enrollment/device-enrollment-manager-enroll

89. Your network contains an on-premises Active Directory domain. Your company has a security policy that prevents additional software from being installed on domain controllers. You need to monitor a domain controller by using Microsoft Azure Advanced Threat Protection (ATP). What should you do? More than one answer choice may achieve the goal. Select the BEST answer.

A. Deploy an Azure ATP sensor, and then configure port mirroring.

B. Deploy an Azure ATP sensor, and then configure detections.

C. Deploy an Azure ATP standalone sensor, and then configure detections.

D. Deploy an Azure ATP standalone sensor, and then configure port mirroring.

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/configure-port-mirroring

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/install-atp-step5

Explanation

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/configure-port-mirroring

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/install-atp-step5

90. You have three devices enrolled in Microsoft Intune as shown in the following table. The device compliance policies in Intune are configured as shown in the following table. The device compliance policies have the assignments shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Policy 1 applies to Device 3.

Policy 2 applies to Device 2

Policy 2 doesn't apply to Device 2.

Policy 1 applies to Device 1

Policy 2 also doesn't apply to Device 2 because that device is in Group 3, which is excluded from the policy. Exclusion takes precedence over inclusion in the following same group type scenarios:

Including user groups and excluding user groups Including device groups and excluding device group https://docs.microsoft.com/en-us/intune/configuration/device-profile-assign

Explanation

Policy 2 also doesn't apply to Device 2 because that device is in Group 3, which is excluded from the policy. Exclusion takes precedence over inclusion in the following same group type scenarios:

Including user groups and excluding user groups Including device groups and excluding device group https://docs.microsoft.com/en-us/intune/configuration/device-profile-assign

91. You have a Microsoft 365 subscription. You need to implement Windows Defender Advanced Threat Protection (ATP) for all the supported devices enrolled in mobile device management (MDM). What should you include in the device configuration profile? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Create a new profile with type: "Microsoft Defender ATP (Windows 10 Desktop)"

Onboard devices to configure them to communicate with Microsoft Defender ATP

http://https://docs.microsoft.com/nl-nl/intune/protect/advanced-threat-protection#create-the-device-configuration-profile

Explanation

http://https://docs.microsoft.com/nl-nl/intune/protect/advanced-threat-protection#create-the-device-configuration-profile

92. You have a Microsoft 365 tenant. You plan to create a retention policy as shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

Microsoft SharePoint files that are affected by the policy will be:[recoverable for up to seven years]

Once the policy is created:[some data may be deleted immediately]

[deleted seven years after they were created]

[data will be retained for a minimum of seven years]

[retained for only seven years from when they were created]

[users will be prevented from permanently deleting email messages for seven years]

not-available-via-ai

Explanation

not-available-via-ai

Submit

93. You have a Microsoft 365 subscription. You recently configured a Microsoft SharePoint Online tenant in the subscription. You plan to create an alert policy. You need to ensure that an alert is generated only when malware is detected in more than five documents stored in SharePoint Online during a period of 10 minutes. What should you do first

A. Enable Microsoft Office 365 Cloud App Security.

B. Deploy Windows Defender Advanced Threat Protection (Windows Defender ATP)

C. Enable Microsoft Office 365 Analytics.

https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy

Explanation

https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy

94. Your company has five security information and event management (SIEM) appliances. The traffic logs from each appliance are saved to a file share named Logs. You need to analyze the traffic logs. What should you do from Microsoft Cloud App Security?

A. Click Investigate, and then click Activity log.

B. Click Control, and then click Policies. Create a file policy.

C. Click Discover, and then click Create snapshot report.

D. Click Investigate, and then click Files.

https://docs.microsoft.com/en-us/cloud-app-security/create-snapshot-cloud-discovery-reports#log-format

Explanation

https://docs.microsoft.com/en-us/cloud-app-security/create-snapshot-cloud-discovery-reports#log-format

95. Your company has a Microsoft 365 subscription. The subscription contains 500 devices that run Windows 10 and 100 devices that run iOS. You need to create Microsoft Intune device configuration profiles to meet the following requirements: ✑ Configure Wi-Fi connectivity to a secured network named ContosoNet. ✑ Require passwords of at least six characters to lock the devices. What is the minimum number of device configuration profiles that you should create?

4

2

1

https://docs.microsoft.com/en-us/intune/configuration/wi-fi-settings-configure

Correct answer is 4. Configuration Profiles are not cross-platform, and W-Fi settings are contained within their own Profile.

Explanation

https://docs.microsoft.com/en-us/intune/configuration/wi-fi-settings-configure

Correct answer is 4. Configuration Profiles are not cross-platform, and W-Fi settings are contained within their own Profile.

96. Your network contains an on-premises Active Directory domain named contoso.com. The domain contains 1,000 Windows 10 devices. You perform a proof of concept (PoC) deployment of Windows Defender Advanced Threat Protection (ATP) for 10 test devices. During the onboarding process, you configure Windows Defender ATP-related data to be stored in the United States. You plan to onboard all the devices to Windows Defender ATP. You need to store the Windows Defender ATP data in Europe. What should you first?

A. Create a workspace.

B. Onboard a new device.

C. Delete the workspace.

D. Offboard the test devices.

not-available-via-ai

Explanation

not-available-via-ai

97. ADatum Corporation is an international financial services company that has 5,000 employees. ADatum has six offices: a main office in New York and five branch offices in Germany, the United Kingdom, France, Spain, and Italy. All the offices are connected to each other by using a WAN link. Each office connects directly to the Internet. Existing Environment - Current Infrastructure -

ADatum recently purchased a Microsoft 365 subscription.

All user files are migrated to Microsoft 365.

All mailboxes are hosted in Microsoft 365. The users in each office have email suffixes that include the country of the user, for example, user1@us.adatum.com or user2@uk.adatum.com.

Each office has a security information and event management (SIEM) appliance. The appliance comes from three different vendors.

ADatum uses and processes Personally Identifiable Information (PII).

Problem Statements - ADatum entered into litigation. The legal department must place a hold on all the documents of a user named User1 that are in Microsoft 365. Requirements - Business Goals -

ADatum wants to be fully compliant with all the relevant data privacy laws in the regions where is operates.

ADatum wants to minimize the cost of hardware and software whenever possible.

Technical Requirements - ADatum identifies the following technical requirements:

Centrally perform log analysis for all offices.

Aggregate all data from the SIEM appliances to a central cloud repository for later analysis.

Ensure that a SharePoint administrator can identify who accessed a specific file stored in a document library.

Provide the users in the finance department with access to Service assurance information in Microsoft Office 365.

Ensure that documents and email messages containing the PII data of European Union (EU) citizens are preserved for 10 years.

If a user attempts to download 1,000 or more files from Microsoft SharePoint Online within 30 minutes, notify a security administrator and suspend the user's user account.

A security administrator requires a report that shown which Microsoft 365 users signed in. Based on the report, the security administrator will create a policy to require multi-factor authentication when a sign-in is high risk.

Ensure that the users in the New York office can only send email messages that contain sensitive U.S. PII data to other New York office uses. Email messages must be monitored to ensure compliance.

Auditors in the New York office must have access to reports that show the sent and received email messages containing sensitive U.S. PII data.

Question: You need to meet the technical requirement for the EU PII data. What should you create?

A. a data loss prevention (DLP) policy from the Security & Compliance admin center

B. a data loss prevention (DLP) policy from the Exchange admin center

C. a retention policy from the Exchange admin center

D. a retention policy from the Security & Compliance admin center

https://docs.microsoft.com/en-us/office365/securitycompliance/retention-policies

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/retention-policies

98. You have a Microsoft 365 subscription. You plan to enable Microsoft Azure Information Protection. You need to ensure that only the members of a group named PilotUsers can protect content. What should you do?

A. Run the Add-AadrmRoleBasedAdministrator cmdlet.

B. Create an Azure Information Protection policy.

C. Configure the protection activation status for Azure Information Protection.

D. Run the Set-AadrmOnboardingControlPolicy cmdlet.

If you don't want all users to be able to protect documents and emails immediately by using Azure Rights Management, you can configure user onboarding controls by using the Set-AadrmOnboardingControlPolicy

References:

https://docs.microsoft.com/en-us/powershell/module/aadrm/set-aadrmonboardingcontrolpolicy?view=azureipps

https://docs.microsoft.com/en-us/azure/information-protection/activate-service

Explanation

If you don't want all users to be able to protect documents and emails immediately by using Azure Rights Management, you can configure user onboarding controls by using the Set-AadrmOnboardingControlPolicy

References:

https://docs.microsoft.com/en-us/powershell/module/aadrm/set-aadrmonboardingcontrolpolicy?view=azureipps

https://docs.microsoft.com/en-us/azure/information-protection/activate-service

99. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 subscription. From the Security & Compliance admin center, you create a role group named US eDiscovery Managers by copying the eDiscovery Manager role group. You need to ensure that the users in the new role group can only perform content searches of mailbox content for users in the United States. Solution: From Windows PowerShell, you run the New-AzureRmRoleAssignment cmdlet with the appropriate parameters. Does this meet the goal?

A. Yes

B. No

https://docs.microsoft.com/en-us/powershell/module/azurerm.resources/new-azurermroleassignment?view=azurermps-6.13.0

Explanation

https://docs.microsoft.com/en-us/powershell/module/azurerm.resources/new-azurermroleassignment?view=azurermps-6.13.0

100. You have a Microsoft 365 subscription. You need to be notified if users receive email containing a file that has a virus. What should you do?

A. From the Exchange admin center, create an in-place eDiscovery & hold.

B. From the Security & Compliance admin center, create a data governance event.

C. From the Exchange admin center, create an anti-malware policy.

D. From the Security & Compliance admin center, create a safe attachments policy.

E. From the Security & Compliance admin center, create a data loss prevention (DLP) policy.

F. From the Exchange admin center, create a mail flow rule.

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-atp-safe-attachments-policies

Explanation

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-atp-safe-attachments-policies

101. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 subscription. From the Security & Compliance admin center, you create a role group named US eDiscovery Managers by copying the eDiscovery Manager role group. You need to ensure that the users in the new role group can only perform content searches of mailbox content for users in the United States. Solution: From Windows PowerShell, you run the New-ComplianceSecurityFilter cmdlet with the appropriate parameters. Does this meet the goal?

A. Yes

B. No

https://docs.microsoft.com/en-us/office365/securitycompliance/permissions-filtering-for-content-search

https://docs.microsoft.com/en-us/powershell/module/exchange/policy-and-compliance-content-search/new-compliancesecurityfilter?view=exchange-ps

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/permissions-filtering-for-content-search

https://docs.microsoft.com/en-us/powershell/module/exchange/policy-and-compliance-content-search/new-compliancesecurityfilter?view=exchange-ps

102. You create a Microsoft 365 subscription. You need to create a deployment plan for Microsoft Azure Advanced Threat Protection (ATP). Which five actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

1.Enter Credential

2.Create workspace

3.Download Azure ATP sensor

4.Install sensor

Configure the sensor settings

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/install-atp-step1

Explanation

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/install-atp-step1

Submit

103. You have a Microsoft 365 subscription. You are configuring permissions for Security & Compliance. You need to ensure that the users can perform the tasks shown in the following table. The solution must use the principle of least privilege. To which role should you assign each user? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

User1: Security Reader

User2: Compliance Administrator

User1: Security Administrator

User2: Security Operator

https://docs.microsoft.com/nl-nl/microsoft-365/security/office-365-security/permissions-in-the-security-and-compliance-center#mapping-of-role-groups-to-assigned-roles

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/download-existing-reports

Explanation

https://docs.microsoft.com/nl-nl/microsoft-365/security/office-365-security/permissions-in-the-security-and-compliance-center#mapping-of-role-groups-to-assigned-roles

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/download-existing-reports

Submit

104. Your company has a Microsoft 365 subscription that uses an Azure Active Directory (Azure AD) tenant named contoso.com. A user named User1 is a member of a dynamic group named Group1. User1 reports that he cannot access documents shared to Group1. You discover that User1 is no longer a member of Group1. You suspect that an administrator made a change that caused User1 to be removed from Group1. You need to identify which administrator made the change. Which audit log activity should you search in the Security & Compliance admin center?

A. Azure AD group administration activities "Removed member from group"

B. User administration activities "Updated user"

C. Azure AD group administration activities "Updated group"

To identify which administrator made the change that caused User1 to be removed from Group1, you should search for the audit log activity "User administration activities - Updated user" in the Security & Compliance admin center. This activity log will provide information about any changes made to user accounts, including updates to group memberships. By reviewing this log, you can determine which administrator made the change that removed User1 from Group1.

Explanation

To identify which administrator made the change that caused User1 to be removed from Group1, you should search for the audit log activity "User administration activities - Updated user" in the Security & Compliance admin center. This activity log will provide information about any changes made to user accounts, including updates to group memberships. By reviewing this log, you can determine which administrator made the change that removed User1 from Group1.

105. You deploy Microsoft Azure Information Protection. You need to ensure that a security administrator named SecAdmin1 can always read and inspect data protected by Azure Rights Management (Azure RMS). What should you do?

A. From the Security & Compliance admin center, add User1 to the eDiscovery Manager role group.

B. From the Azure Active Directory admin center, add User1 to the Security Reader role group.

C. From the Security & Compliance admin center, add User1 to the Compliance Administrator role group.

D. From Windows PowerShell, enable the super user feature and assign the role to SecAdmin1.

https://docs.microsoft.com/en-us/azure/information-protection/configure-super-users

Explanation

https://docs.microsoft.com/en-us/azure/information-protection/configure-super-users

106. Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York. The company has the employees and devices shown in the following table. Contoso recently purchased a Microsoft 365 E5 subscription. Existing Environment - The network contains an on-premises Active Directory forest named contoso.com. The forest contains the servers shown in the following table. All servers run Windows Server 2016. All desktops and laptops run Windows 10 Enterprise and are joined to the domain. The mobile devices of the users in the Montreal and Seattle offices run Android. The mobile devices of the users in the New York office run iOS. The domain is synced to Azure Active Directory (Azure AD) and includes the users shown in the following table. The domain also includes a group named Group1. Requirements - Planned Changes: Contoso plans to implement the following changes: Implement Microsoft 365. Manage devices by using Microsoft Intune. Implement Azure Advanced Threat Protection (ATP). Every September, apply the latest feature updates to all Windows computers. Every March, apply the latest feature updates to the computers in the New York office only. Technical Requirements: Contoso identifies the following technical requirements: When a Windows 10 device is joined to Azure AD, the device must enroll in Intune automatically. Dedicated support technicians must enroll all the Montreal office mobile devices in Intune. User1 must be able to enroll all the New York office mobile devices in Intune. Azure ATP sensors must be installed and must NOT use port mirroring. Whenever possible, the principle of least privilege must be used. A Microsoft Store for Business must be created. Compliance Requirements: Contoso identifies the following compliance requirements: Ensure that the users in Group1 can only access Microsoft Exchange Online from devices that are enrolled in Intune and configured in accordance with the corporate policy. Configure Windows Information Protection (WIP) for the Windows 10 devices. Question: You need to ensure that User1 can enroll the devices to meet the technical requirements. What should you do?

A. From the Azure Active Directory admin center, assign User1 the Cloud device administrator role.

B. From the Azure Active Directory admin center, configure the Maximum number of devices per user setting.

C. From the Intune admin center, add User1 as a device enrollment manager.

D. From the Intune admin center, configure the Enrollment restrictions.

https://docs.microsoft.com/en-us/sccm/mdm/deploy-use/enroll-devices-with-device-enrollment-manager

Explanation

https://docs.microsoft.com/en-us/sccm/mdm/deploy-use/enroll-devices-with-device-enrollment-manager

107. You create a new Microsoft 365 subscription and assign Microsoft 365 E3 licenses to 100 users. From the Security & Compliance admin center, you enable auditing. You are planning the auditing strategy. Which three activities will be audited by default? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

A. An administrator creates a new Microsoft SharePoint site collection.

B. An administrator creates a new mail flow rule.

C. A user shares a Microsoft SharePoint folder with an external user.

D. A user delegates permissions to their mailbox.

E. A user purges messages from their mailbox.

https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance?redirectSourcePath=%252farticle%252f0d4d0f35- 390b-4518-800e-0c7ec95e946c

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance?redirectSourcePath=%252farticle%252f0d4d0f35- 390b-4518-800e-0c7ec95e946c

Submit

108. You have a Microsoft 365 subscription. You plan to enable Microsoft Azure Information Protection. You need to ensure that only the members of a group named PilotUsers can protect content. What should you do?

A. From the AADRM PowerShell module, run the Set-AadrmOnboardingControlPolicy cmdlet.

B. From Azure Information Protection, create a policy.

C. From the AADRM PowerShell module, run the Set-AadrmRoleBasedAdministrator cmdlet.

D. From Azure Information Protection, configure the protection activation status.

Explanation: If you don't want all users to be able to protect documents and emails immediately by using Azure Rights Management, you can configure user onboarding controls by using the Set-AadrmOnboardingControlPolicy.

https://blogs.technet.microsoft.com/kemckinn/2018/05/17/creating-labels-for-azure-information-protection/

Explanation

Explanation: If you don't want all users to be able to protect documents and emails immediately by using Azure Rights Management, you can configure user onboarding controls by using the Set-AadrmOnboardingControlPolicy.

https://blogs.technet.microsoft.com/kemckinn/2018/05/17/creating-labels-for-azure-information-protection/

109. You have a Microsoft 365 subscription that contains a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com. In the tenant, you create a user named User1. You need to ensure that User1 can publish retention labels from the Security & Compliance admin center. The solution must use the principle of least privilege. To which role group should you add User1?

A. Security Administrator

B. Records Management

C. Compliance Administrator

D. eDiscovery Manager

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/permissions-in-the-security-and-compliance-center?view=o365-worldwide

Explanation

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/permissions-in-the-security-and-compliance-center?view=o365-worldwide

110. Your company uses on-premises Windows Server File Classification Infrastructure (FCI). Some documents on the on-premises file servers are classified as Confidential. You migrate the files from the on-premises file servers to Microsoft SharePoint Online. You need to ensure that you can implement data loss prevention (DLP) policies for the uploaded file based on the Confidential classification. What should you do first?

A. From the SharePoint admin center, configure hybrid search.

B. From the SharePoint admin center, create a managed property.

C. From the Security & Compliance Center PowerShell, run the New-DataClassification cmdlet.

D. From the Security & Compliance Center PowerShell, run the New-DlpComplianceRule cmdlet.

https://docs.microsoft.com/en-us/microsoft-365/compliance/protect-documents-that-have-fci-or-other-properties#before-you-create-the-dlp-policy

Explanation

https://docs.microsoft.com/en-us/microsoft-365/compliance/protect-documents-that-have-fci-or-other-properties#before-you-create-the-dlp-policy

111. Your network contains an Active Directory domain named contoso.com. The domain contains 100 Windows 8.1 devices. You plan to deploy a custom Windows 10 Enterprise image to the Windows 8.1 devices. You need to recommend a Windows 10 deployment method. What should you recommend?

A. A provisioning package

B. An in-place upgrade

C. A Wipe and load refresh

D. Windows Autopilot

The question specifies a custom image. In place upgrade cannot do custom images. Also, for provisioning packages Win 10 is a prerequisite. Hence, that cannot be the correct answer.

Explanation

The question specifies a custom image. In place upgrade cannot do custom images. Also, for provisioning packages Win 10 is a prerequisite. Hence, that cannot be the correct answer.

112. ADatum Corporation is an international financial services company that has 5,000 employees. ADatum has six offices: a main office in New York and five branch offices in Germany, the United Kingdom, France, Spain, and Italy. All the offices are connected to each other by using a WAN link. Each office connects directly to the Internet. Existing Environment - Current Infrastructure -

ADatum recently purchased a Microsoft 365 subscription.

All user files are migrated to Microsoft 365.

All mailboxes are hosted in Microsoft 365. The users in each office have email suffixes that include the country of the user, for example, user1@us.adatum.com or user2@uk.adatum.com.

Each office has a security information and event management (SIEM) appliance. The appliance comes from three different vendors.

ADatum uses and processes Personally Identifiable Information (PII).

Problem Statements - ADatum entered into litigation. The legal department must place a hold on all the documents of a user named User1 that are in Microsoft 365. Requirements - Business Goals -

ADatum wants to be fully compliant with all the relevant data privacy laws in the regions where is operates.

ADatum wants to minimize the cost of hardware and software whenever possible.

Technical Requirements - ADatum identifies the following technical requirements:

Centrally perform log analysis for all offices.

Aggregate all data from the SIEM appliances to a central cloud repository for later analysis.

Ensure that a SharePoint administrator can identify who accessed a specific file stored in a document library.

Provide the users in the finance department with access to Service assurance information in Microsoft Office 365.

Ensure that documents and email messages containing the PII data of European Union (EU) citizens are preserved for 10 years.

If a user attempts to download 1,000 or more files from Microsoft SharePoint Online within 30 minutes, notify a security administrator and suspend the user's user account.

A security administrator requires a report that shown which Microsoft 365 users signed in. Based on the report, the security administrator will create a policy to require multi-factor authentication when a sign-in is high risk.

Ensure that the users in the New York office can only send email messages that contain sensitive U.S. PII data to other New York office uses. Email messages must be monitored to ensure compliance.

Auditors in the New York office must have access to reports that show the sent and received email messages containing sensitive U.S. PII data.

Question: You need to meet the requirement for the legal department. Which three actions should you perform in sequence from the Security & Compliance admin center? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

1) Assign Security & Compliance Permissions for eDiscovery

2) Create an eDiscovery Case

3) Add Users to the eDiscovery Case

4) Place Existing Content on Legal Hold

5) Create and Run a Content Search

https://www.sherweb.com/blog/ediscovery-office-365/

Explanation

https://www.sherweb.com/blog/ediscovery-office-365/

Submit

113. You implement Microsoft Azure Advanced Threat Protection (Azure ATP). You have an Azure ATP sensor configured as shown in the following exhibit. How long after the Azure ATP cloud service is updated will the sensor update?

A. 1 hour

B. 12 hours

C. 48 hours

D. 7 days

E. 24 hours

This has been extended to 72 hours

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/sensor-update

Explanation

This has been extended to 72 hours

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/sensor-update

114. HOTSPOT - Your company is based in the United Kingdom (UK). Users frequently handle data that contains Personally Identifiable Information (PII). You create a data loss prevention (DLP) policy that applies to users inside and outside the company. The policy is configured as shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

Allowed

Blocked without warning

Blocked, but the user can override the policy

If a user attempts to upload a document to a Microsoft SharePoint site, and the document contains one UK passport number, the document will be allowed. This is because the DLP policy is configured to only block documents that contain more than one UK passport number.

If a user attempts to email 100 UK passport numbers to a user in the same company, the email message will be blocked without warning. This is because the DLP policy is configured to block any email message that contains UK passport numbers, regardless of the quantity. However, the user has the ability to override the policy and send the email if needed.

Explanation

If a user attempts to upload a document to a Microsoft SharePoint site, and the document contains one UK passport number, the document will be allowed. This is because the DLP policy is configured to only block documents that contain more than one UK passport number.

If a user attempts to email 100 UK passport numbers to a user in the same company, the email message will be blocked without warning. This is because the DLP policy is configured to block any email message that contains UK passport numbers, regardless of the quantity. However, the user has the ability to override the policy and send the email if needed.

Submit

115. You purchase a new Microsoft 365 subscription.You create 100 users who are assigned Microsoft 365 E3 licenses. From the Security & Compliance admin center, you enable auditing. Six months later, a manager sends you an email message asking the following questions: ✑ Question 1: Who created a team named Team 1 14 days ago? ✑ Question 2: Who signed in to the mailbox of User 1 30 days ago? ✑ Question 3: Who changed the site collection administrators of a site 60 days ago? For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

An Audit Log search from Security and Compliance Admin center will provide answer to question 1

An Audit Log search from Security and Compliance Admin center will provide answer to question 2

An Audit Log search from Security and Compliance Admin center will provide answer to question 3

https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide

Although mailbox audit logging on by default is enabled for all organizations, only users with E5 licenses will return mailbox audit log events in audit log searches in the Security & Compliance Center or via the Office 365 Management Activity API by default.

To retrieve mailbox audit log entries for users without E5 licenses, you can:

Use audit log searches in the Security & Compliance Center or via the Office 365 Management Activity API after you've manually enabled mailbox auditing on the individual mailboxes.

Use the following cmdlets in Exchange Online PowerShell:
- Search-MailboxAuditLog to search the mailbox audit log for specific users.
- New-MailboxAuditLogSearch to search the mailbox audit log for specific users and to have the results sent via email to specified recipients.

Explanation

https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide

Although mailbox audit logging on by default is enabled for all organizations, only users with E5 licenses will return mailbox audit log events in audit log searches in the Security & Compliance Center or via the Office 365 Management Activity API by default.

To retrieve mailbox audit log entries for users without E5 licenses, you can:

Use audit log searches in the Security & Compliance Center or via the Office 365 Management Activity API after you've manually enabled mailbox auditing on the individual mailboxes.

Use the following cmdlets in Exchange Online PowerShell:
- Search-MailboxAuditLog to search the mailbox audit log for specific users.
- New-MailboxAuditLogSearch to search the mailbox audit log for specific users and to have the results sent via email to specified recipients.

Submit

116. You have a Microsoft 365 subscription that contains all the user data. You plan to create the retention policy shown in the Locations exhibit. (Click the Locations tab.) You configure the Advanced retention settings as shown in the Retention exhibit. (Click the Retention tab.) The locations specified in the policy include the groups shown in the following table. For each of the following statements, select the statement if it is true. NOTE: Each correct selection is worth one point.

The first statement is false because it states that any file stored in Microsoft SharePoint group library by a user in the Legal365 group will be stored for five years and then deleted, but the retention policy only applies to email messages, not files.

The second statement is true because it aligns with the configured retention settings. Any email message that contains the word "takeover" and is sent by a user in the LegalTeam group will be deleted automatically after five years.

The third statement is also true because it states that if a new user is added to the Legal Team group next week and the user sends an email message containing the word "takeover," the message will be deleted automatically after five years, which is consistent with the retention policy.

Explanation

The first statement is false because it states that any file stored in Microsoft SharePoint group library by a user in the Legal365 group will be stored for five years and then deleted, but the retention policy only applies to email messages, not files.

The second statement is true because it aligns with the configured retention settings. Any email message that contains the word "takeover" and is sent by a user in the LegalTeam group will be deleted automatically after five years.

The third statement is also true because it states that if a new user is added to the Legal Team group next week and the user sends an email message containing the word "takeover," the message will be deleted automatically after five years, which is consistent with the retention policy.

Submit

117. Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York. The company has the employees and devices shown in the following table. Contoso recently purchased a Microsoft 365 E5 subscription. Existing Environment - The network contains an on-premises Active Directory forest named contoso.com. The forest contains the servers shown in the following table. All servers run Windows Server 2016. All desktops and laptops run Windows 10 Enterprise and are joined to the domain. The mobile devices of the users in the Montreal and Seattle offices run Android. The mobile devices of the users in the New York office run iOS. The domain is synced to Azure Active Directory (Azure AD) and includes the users shown in the following table. The domain also includes a group named Group1. Requirements - Planned Changes - Contoso plans to implement the following changes: Implement Microsoft 365. Manage devices by using Microsoft Intune. Implement Azure Advanced Threat Protection (ATP). Every September, apply the latest feature updates to all Windows computers. Every March, apply the latest feature updates to the computers in the New York office only. Technical Requirements - Contoso identifies the following technical requirements: When a Windows 10 device is joined to Azure AD, the device must enroll in Intune automatically. Dedicated support technicians must enroll all the Montreal office mobile devices in Intune. User1 must be able to enroll all the New York office mobile devices in Intune. Azure ATP sensors must be installed and must NOT use port mirroring. Whenever possible, the principle of least privilege must be used. A Microsoft Store for Business must be created. Compliance Requirements: - Ensure that the users in Group1 can only access Microsoft Exchange Online from devices that are enrolled in Intune and configured in accordance with the corporate policy. - Configure Windows Information Protection (WIP) for the Windows 10 devices. Question- As of March, how long will the computers in each office remain supported by Microsoft? NOTE: Each correct selection is worth one point.

Seattle:

New York:

6 months

18 months

24 months

30 months

5 years

https://www.windowscentral.com/whats-difference-between-quality-updates-and-feature-updates-windows-10

https://support.microsoft.com/en-gb/help/13853/windows-lifecycle-fact-sheet

March Feature Updates: Serviced for 18 months from release date September Feature Updates: Serviced for 30 months from release date

Explanation

https://www.windowscentral.com/whats-difference-between-quality-updates-and-feature-updates-windows-10

https://support.microsoft.com/en-gb/help/13853/windows-lifecycle-fact-sheet

March Feature Updates: Serviced for 18 months from release date September Feature Updates: Serviced for 30 months from release date

Submit

118. You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com. Your company implements Windows Information Protection (WIP). You need to modify which users and applications are affected by WIP. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

To modify which users are affected by, WIP, configure:- AzureAD App reg

To modify which app are affected by WIP, configure:- App conf policy

- AzureAD devices setttings

- App protection policy

-The MAM user scope

- Compliance policy

-The MDM authority

- Device conf. profiles

https://docs.microsoft.com/en-us/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure

Explanation

https://docs.microsoft.com/en-us/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure

Submit

119. Your company uses Windows Defender Advanced Threat Protection (ATP). Windows Defender ATP includes the machine groups shown in the following table. You onboard a computer named computer1 to Windows Defender ATP as shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/machine-groups#manage-machine-groups

Explanation

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/machine-groups#manage-machine-groups

120. Your company has a Microsoft 365 tenant. The company sells products online and processes credit card information. You need to be notified if a file stored in Microsoft SharePoint Online contains credit card information. The file must be removed automatically from its current location until an administrator can review its contents. What should you use?

A. a Security & Compliance data loss prevention (DLP) policy

B. a Microsoft Cloud App Security access policy

C. a Security & Compliance retention policy

D. a Microsoft Cloud App Security file policy

https://docs.microsoft.com/en-us/cloud-app-security/use-case-admin-quarantine#set-up-admin-quarantine

Explanation

https://docs.microsoft.com/en-us/cloud-app-security/use-case-admin-quarantine#set-up-admin-quarantine

121. You have three devices enrolled in Microsoft Intune as shown in the following table. The device compliance policies in Intune are configured as shown in the following table. The device compliance policies have the assignments shown in the following table. For each of the following statements, select the statement if it is true. Otherwise don't select. NOTE: Each correct selection is worth one point.

Device 1 is compliant

Device 2 is compliant

Device 3 is compliant

Based on the information provided in the tables, all three devices have a "Compliant" status in the device compliance policies. Therefore, the statement "Device 1 is compliant, Device 2 is compliant, Device 3 is compliant" is true.

Explanation

Based on the information provided in the tables, all three devices have a "Compliant" status in the device compliance policies. Therefore, the statement "Device 1 is compliant, Device 2 is compliant, Device 3 is compliant" is true.

Submit

122. You have a Microsoft 365 subscription. You have the devices shown in the following table. You need to onboard the devices to Windows Defender Advanced Threat Protection (ATP). The solution must avoid installing software on the devices whenever possible. Which onboarding method should you use for each operating system? To answer, drag the appropriate methods to the correct operating systems. Each method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

Windows 8.1

Windows 10

Windows Server 2016

Domain Controller

Submit

123. You have a Microsoft Azure Activity Directory (Azure AD) tenant contains the users shown in the following table. Group3 is a member of Group1. Your company uses Windows Defender Advanced Threat Protection (ATP). Windows Defender ATP contains the roles shown in the following table. Windows Defender ATP contains the device groups shown in the following table. For each of the following statements, select the statement if it is true. Otherwise, don't select. NOTE: Each correct selection is worth one point.

User1 can view Device1 in Windows Defender Security Center.

User2 can sign in to Windows Defender Security Center.

User3 can view Device1 in Windows Defender Security Center.

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group

Explanation

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group

Submit

124. You have a document in Microsoft OneDrive that is encrypted by using Microsoft Azure Information Protection as shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

If you copy the file to your local computer, you:[cannot open the document]

If you email the document to user outside your organization, the user:[cannot open the document]

[can open the document indefinitely]

[can open the document for up to 7 days]

[can open the document for up to 30 days]

When you copy the encrypted document to your local computer, you cannot open it because the encryption is tied to the Azure Information Protection service. However, when you email the document to a user outside your organization, they cannot open the document initially because they do not have access to the Azure Information Protection service. But, if they are granted access, they can open the document for up to 30 days.

Explanation

When you copy the encrypted document to your local computer, you cannot open it because the encryption is tied to the Azure Information Protection service. However, when you email the document to a user outside your organization, they cannot open the document initially because they do not have access to the Azure Information Protection service. But, if they are granted access, they can open the document for up to 30 days.

Submit

125. ADatum Corporation is an international financial services company that has 5,000 employees. ADatum has six offices: a main office in New York and five branch offices in Germany, the United Kingdom, France, Spain, and Italy. All the offices are connected to each other by using a WAN link. Each office connects directly to the Internet. Existing Environment - Current Infrastructure -

ADatum recently purchased a Microsoft 365 subscription.

All user files are migrated to Microsoft 365.

All mailboxes are hosted in Microsoft 365. The users in each office have email suffixes that include the country of the user, for example, user1@us.adatum.com or user2@uk.adatum.com.

Each office has a security information and event management (SIEM) appliance. The appliance comes from three different vendors.

ADatum uses and processes Personally Identifiable Information (PII).

Problem Statements - ADatum entered into litigation. The legal department must place a hold on all the documents of a user named User1 that are in Microsoft 365. Requirements - Business Goals -

ADatum wants to be fully compliant with all the relevant data privacy laws in the regions where is operates.

ADatum wants to minimize the cost of hardware and software whenever possible.

Technical Requirements - ADatum identifies the following technical requirements:

Centrally perform log analysis for all offices.

Aggregate all data from the SIEM appliances to a central cloud repository for later analysis.

Ensure that a SharePoint administrator can identify who accessed a specific file stored in a document library.

Provide the users in the finance department with access to Service assurance information in Microsoft Office 365.

Ensure that documents and email messages containing the PII data of European Union (EU) citizens are preserved for 10 years.

If a user attempts to download 1,000 or more files from Microsoft SharePoint Online within 30 minutes, notify a security administrator and suspend the user's user account.

A security administrator requires a report that shown which Microsoft 365 users signed in. Based on the report, the security administrator will create a policy to require multi-factor authentication when a sign-in is high risk.

Ensure that the users in the New York office can only send email messages that contain sensitive U.S. PII data to other New York office uses. Email messages must be monitored to ensure compliance.

Auditors in the New York office must have access to reports that show the sent and received email messages containing sensitive U.S. PII data.

Question: You need to meet the technical requirement for the SharePoint administrator. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

From the security & compliance admin center, perform a search by using:

Filter by:

Audit log

Activity

Data governance events

Detail

DLP policy matches

Item

User agent

https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance#step-3-filter-the-search-results

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance#step-3-filter-the-search-results

Submit

126. You have a Microsoft Azure Activity Directory (Azure AD) tenant contains the users shown in the following table. Group3 is a member of Group1. Your company uses Windows Defender Advanced Threat Protection (ATP). Windows Defender ATP contains the roles shown in the following table. Windows Defender ATP contains the device groups shown in the following table. For each of the following statements, select the statement if it is true. NOTE: Each correct selection is worth one point.

User1 can view Device1 in Windows Defender Security Center

User2 can sign in to Windows Defender Security Center

User3 can view Device1 in WIndows Defender Center

User1 can run an antivirus scan on Device2

User2 can collect an investigation package from Device2

User3 can isolate Device1

User1 can view Device1 in Windows Defender Security Center because User1 is a member of Group1, which has access to view Device1 in Windows Defender ATP. User2 can sign in to Windows Defender Security Center because User2 is a member of Group2, which has the necessary role to sign in to Windows Defender ATP. User3 can view Device1 in Windows Defender Security Center because User3 is a member of Group3, which is a member of Group1 and therefore has access to view Device1.

Explanation

User1 can view Device1 in Windows Defender Security Center because User1 is a member of Group1, which has access to view Device1 in Windows Defender ATP. User2 can sign in to Windows Defender Security Center because User2 is a member of Group2, which has the necessary role to sign in to Windows Defender ATP. User3 can view Device1 in Windows Defender Security Center because User3 is a member of Group3, which is a member of Group1 and therefore has access to view Device1.

Submit

127. ADatum Corporation is an international financial services company that has 5,000 employees. ADatum has six offices: a main office in New York and five branch offices in Germany, the United Kingdom, France, Spain, and Italy. All the offices are connected to each other by using a WAN link. Each office connects directly to the Internet. Existing Environment - Current Infrastructure -

ADatum recently purchased a Microsoft 365 subscription.

All user files are migrated to Microsoft 365.

All mailboxes are hosted in Microsoft 365. The users in each office have email suffixes that include the country of the user, for example, user1@us.adatum.com or user2@uk.adatum.com.

Each office has a security information and event management (SIEM) appliance. The appliance comes from three different vendors.

ADatum uses and processes Personally Identifiable Information (PII).

Problem Statements - ADatum entered into litigation. The legal department must place a hold on all the documents of a user named User1 that are in Microsoft 365. Requirements - Business Goals -

ADatum wants to be fully compliant with all the relevant data privacy laws in the regions where is operates.

ADatum wants to minimize the cost of hardware and software whenever possible.

Technical Requirements - ADatum identifies the following technical requirements:

Centrally perform log analysis for all offices.

Aggregate all data from the SIEM appliances to a central cloud repository for later analysis.

Ensure that a SharePoint administrator can identify who accessed a specific file stored in a document library.

Provide the users in the finance department with access to Service assurance information in Microsoft Office 365.

Ensure that documents and email messages containing the PII data of European Union (EU) citizens are preserved for 10 years.

If a user attempts to download 1,000 or more files from Microsoft SharePoint Online within 30 minutes, notify a security administrator and suspend the user's user account.

A security administrator requires a report that shown which Microsoft 365 users signed in. Based on the report, the security administrator will create a policy to require multi-factor authentication when a sign-in is high risk.

Ensure that the users in the New York office can only send email messages that contain sensitive U.S. PII data to other New York office uses. Email messages must be monitored to ensure compliance.

Auditors in the New York office must have access to reports that show the sent and received email messages containing sensitive U.S. PII data.

Question: You need to meet the technical requirement for log analysis. What is the minimum number of data sources and log collectors you should create from Microsoft Cloud App Security? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Minimum number of data sources:

Minimum number of log collectors:

1

3

6

https://docs.microsoft.com/en-us/cloud-app-security/discovery-docker

Explanation

https://docs.microsoft.com/en-us/cloud-app-security/discovery-docker

Submit

129. You have a Microsoft 365 subscription.You have a group named Support. Users in the Support group frequently send email messages to external users. The manager of the Support group wants to randomly review messages that contain attachments. You need to provide the manager with the ability to review messages that contain attachments sent from the Support group users to external users. The manager must have access to only 10 percent of the messages. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

A label policy

A message trace

A retention policy

An eDiscovery case

A Supervisor policy

Myanalytics

An alert policy

Outlook Web app

MyAnalytics

https://docs.microsoft.com/en-us/office365/securitycompliance/supervision-policies

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/supervision-policies

Submit

MS-101: Microsoft 365 Mobility and Security

2.

What first name or nickname would you like us to use?

10. From the Microsoft Azure Active Directory (Azure AD) Identity Protection dashboard, you view the risk events shown in the exhibit. (Click the Exhibit tab.) You need to reduce the likelihood that the sign-ins are identified at risky. What should you do?

12. You use Microsoft System Center Configuration Manager (Current Branch) to manage devices. Your company uses the following types of devices: ✑ Windows 10 ✑ Windows 8.1 ✑ Android ✑ iOS Which devices can be managed by using co-management?

14. Your company has 5,000 Windows 10 devices. All the devices are protected by using Windows Defender Advanced Threat Protection (ATP). You need to view which Windows Defender ATP alert events have a high severity and occurred during the last seven days. What should you use in Windows Defender ATP?

16. Which of the following is a key feature of Microsoft 365 Mobility that helps ensure secure access to corporate resources from mobile devices?

18. You have a Microsoft 365 subscription. You have a user named User 1. You need to ensure that User 1 can place a hold on all mailbox content. Which role should you assign to User1?

19. You have a Microsoft 365 subscription. All users are assigned a Microsoft 365 E3 license. You enable auditing for your organization. What is the maximum amount of time data will be retained in the Microsoft 365 audit log?

20. You have a Microsoft 365 subscription. From the Security & Compliance admin center, you create a content search of all the mailboxes that contain the work ProjectX. You need to export the results of the content search. What do you need to download the report?

24. You have a Microsoft Azure Active Directory (Azure AD) tenant. The organization needs to sign up for Microsoft Store for Business. The solution must use the principle of least privilege. Which role should you assign to the user?

25. You have a Microsoft 365 subscription and an on-premises Active Directory domain named contoso.com. All client computers run Windows 10 Enterprise and are joined to the domain. You need to enable Windows Defender Credential Guard on all the computers. What should you do?

26. You have a Microsoft 365 subscription. Some users have iPads that are managed by your company. You plan to prevent the iPad users from copying corporate data in Microsoft Word and pasting the data into other applications. What should you create?

28. Your company uses Microsoft System Center Configuration Manager (Current Branch) and Microsoft Intune to co-manage devices. Which two actions can be performed only from Intune? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

33. Your company has a Microsoft 365 subscription.You implement Microsoft Azure Information Protection. You need to automatically protect email messages that contain the word Confidential in the subject line. What should you create?

36. You have a Microsoft 365 subscription. You need to be notified if users receive email containing a file that has a virus. What should you do?

39. You have a Microsoft 365 tenant. All users are assigned the Enterprise Mobility + Security license. You need to ensure that when users join their device to Microsoft Azure Active Directory (Azure AD), the device is enrolled in Microsoft Intune automatically. What should you configure?

40. You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com. You have a Microsoft 365 subscription. You need to ensure that users can manage the configuration settings for all the Windows 10 devices in your organization. What should you configure?

42. You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com. You need to provide a user with the ability to sign up for Microsoft Store for Business for contoso.com. The solution must use the principle of least privilege. Which role should you assign to the user?

47. You have a Microsoft 365 subscription. You need to investigate user activity in Microsoft 365, including from where users signed in, which applications were used, and increases in activity during the past month. The solution must minimize administrative effort. Which admin center should you use?

50. From the Security & Compliance admin center, you create a content export as shown in the exhibit. (Click the Exhibit tab.) What will be excluded from the export?

54. You have a Microsoft 365 subscription. From the Security & Compliance admin center, you create a content search of a mailbox. You need to view the content of the mail messages found by the search as quickly as possible. What should you select from the Content search settings?

56. Your company uses Microsoft Azure Advanced Threat Protection (ATP) and Windows Defender ATP. You need to integrate Windows Defender ATP and Azure ATP. What should you do?

58. You have a Microsoft 365 subscription. You need to view the IP address from which a user synced a Microsoft SharePoint library. What should you do?

59. HOTSPOT - You configure an anti-phishing policy as shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

62. You have a Microsoft 365 subscription. You configure a data loss prevention (DLP) policy. You discover that users are incorrectly marking content as false positive and bypassing the DLP policy. You need to prevent the users from bypassing the DLP policy. What should you configure?

66. You have a Microsoft 365 subscription.You need to be notified if users receive email containing a file that has a virus. What should you do?

77. You plan to use the Security & Compliance admin center to import several PST files into Microsoft 365 mailboxes. Which three actions should you perform before you import the data? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

78. You need to notify the manager of the human resources department when a user in the department shares a file or folder from the department's Microsoft SharePoint site. What should you do?

79. You have a Microsoft 365 subscription. All users have their email stored in Microsoft Exchange Online. In the mailbox of a user named User1, you need to preserve a copy of all the email messages that contain the word ProjectX. What should you do?

92. You have a Microsoft 365 tenant. You plan to create a retention policy as shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

94. Your company has five security information and event management (SIEM) appliances. The traffic logs from each appliance are saved to a file share named Logs. You need to analyze the traffic logs. What should you do from Microsoft Cloud App Security?

98. You have a Microsoft 365 subscription. You plan to enable Microsoft Azure Information Protection. You need to ensure that only the members of a group named PilotUsers can protect content. What should you do?

100. You have a Microsoft 365 subscription. You need to be notified if users receive email containing a file that has a virus. What should you do?

105. You deploy Microsoft Azure Information Protection. You need to ensure that a security administrator named SecAdmin1 can always read and inspect data protected by Azure Rights Management (Azure RMS). What should you do?

108. You have a Microsoft 365 subscription. You plan to enable Microsoft Azure Information Protection. You need to ensure that only the members of a group named PilotUsers can protect content. What should you do?

111. Your network contains an Active Directory domain named contoso.com. The domain contains 100 Windows 8.1 devices. You plan to deploy a custom Windows 10 Enterprise image to the Windows 8.1 devices. You need to recommend a Windows 10 deployment method. What should you recommend?

113. You implement Microsoft Azure Advanced Threat Protection (Azure ATP). You have an Azure ATP sensor configured as shown in the following exhibit. How long after the Azure ATP cloud service is updated will the sensor update?

128. Of which groups are Computer1 and Computer2 members? To answer, select the appropriate options in the answer area.

MS-101: Microsoft 365 Mobility and Security

2.

What first name or nickname would you like us to use?

10. From the Microsoft Azure Active Directory (Azure AD) Identity Protection dashboard, you view the risk events shown in the exhibit. (Click the Exhibit tab.) You need to reduce the likelihood that the sign-ins are identified at risky. What should you do?

12. You use Microsoft System Center Configuration Manager (Current Branch) to manage devices. Your company uses the following types of devices: ✑ Windows 10 ✑ Windows 8.1 ✑ Android ✑ iOS Which devices can be managed by using co-management?

16. Which of the following is a key feature of Microsoft 365 Mobility that helps ensure secure access to corporate resources from mobile devices?

18. You have a Microsoft 365 subscription. You have a user named User 1. You need to ensure that User 1 can place a hold on all mailbox content. Which role should you assign to User1?

19. You have a Microsoft 365 subscription. All users are assigned a Microsoft 365 E3 license. You enable auditing for your organization. What is the maximum amount of time data will be retained in the Microsoft 365 audit log?

20. You have a Microsoft 365 subscription. From the Security & Compliance admin center, you create a content search of all the mailboxes that contain the work ProjectX. You need to export the results of the content search. What do you need to download the report?

24. You have a Microsoft Azure Active Directory (Azure AD) tenant. The organization needs to sign up for Microsoft Store for Business. The solution must use the principle of least privilege. Which role should you assign to the user?​​​​​​

25. You have a Microsoft 365 subscription and an on-premises Active Directory domain named contoso.com. All client computers run Windows 10 Enterprise and are joined to the domain. You need to enable Windows Defender Credential Guard on all the computers. What should you do?

26. You have a Microsoft 365 subscription. Some users have iPads that are managed by your company. You plan to prevent the iPad users from copying corporate data in Microsoft Word and pasting the data into other applications. What should you create?​​​​​

28. Your company uses Microsoft System Center Configuration Manager (Current Branch) and Microsoft Intune to co-manage devices. Which two actions can be performed only from Intune? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

33. Your company has a Microsoft 365 subscription.You implement Microsoft Azure Information Protection. You need to automatically protect email messages that contain the word Confidential in the subject line. What should you create?

36. You have a Microsoft 365 subscription. You need to be notified if users receive email containing a file that has a virus. What should you do?

39. You have a Microsoft 365 tenant. All users are assigned the Enterprise Mobility + Security license. You need to ensure that when users join their device to Microsoft Azure Active Directory (Azure AD), the device is enrolled in Microsoft Intune automatically. What should you configure?

40. You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com. You have a Microsoft 365 subscription. You need to ensure that users can manage the configuration settings for all the Windows 10 devices in your organization. What should you configure?

42. You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com. You need to provide a user with the ability to sign up for Microsoft Store for Business for contoso.com. The solution must use the principle of least privilege. Which role should you assign to the user?

50. From the Security & Compliance admin center, you create a content export as shown in the exhibit. (Click the Exhibit tab.) What will be excluded from the export?

54. You have a Microsoft 365 subscription. From the Security & Compliance admin center, you create a content search of a mailbox. You need to view the content of the mail messages found by the search as quickly as possible. What should you select from the Content search settings?

56. Your company uses Microsoft Azure Advanced Threat Protection (ATP) and Windows Defender ATP. You need to integrate Windows Defender ATP and Azure ATP. What should you do?

58. You have a Microsoft 365 subscription. You need to view the IP address from which a user synced a Microsoft SharePoint library. What should you do?

59. HOTSPOT - You configure an anti-phishing policy as shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

62. You have a Microsoft 365 subscription. You configure a data loss prevention (DLP) policy. You discover that users are incorrectly marking content as false positive and bypassing the DLP policy. You need to prevent the users from bypassing the DLP policy. What should you configure?

66. You have a Microsoft 365 subscription.You need to be notified if users receive email containing a file that has a virus. What should you do?​​​​​​

77. You plan to use the Security & Compliance admin center to import several PST files into Microsoft 365 mailboxes. Which three actions should you perform before you import the data? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

78. You need to notify the manager of the human resources department when a user in the department shares a file or folder from the department's Microsoft SharePoint site. What should you do?

79. You have a Microsoft 365 subscription. All users have their email stored in Microsoft Exchange Online. In the mailbox of a user named User1, you need to preserve a copy of all the email messages that contain the word ProjectX. What should you do?

92. You have a Microsoft 365 tenant. You plan to create a retention policy as shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

94. Your company has five security information and event management (SIEM) appliances. The traffic logs from each appliance are saved to a file share named Logs. You need to analyze the traffic logs. What should you do from Microsoft Cloud App Security?

98. You have a Microsoft 365 subscription. You plan to enable Microsoft Azure Information Protection. You need to ensure that only the members of a group named PilotUsers can protect content. What should you do?​​​​​

100. You have a Microsoft 365 subscription. You need to be notified if users receive email containing a file that has a virus. What should you do?

105. You deploy Microsoft Azure Information Protection. You need to ensure that a security administrator named SecAdmin1 can always read and inspect data protected by Azure Rights Management (Azure RMS). What should you do?

108. You have a Microsoft 365 subscription. You plan to enable Microsoft Azure Information Protection. You need to ensure that only the members of a group named PilotUsers can protect content. What should you do?

111. Your network contains an Active Directory domain named contoso.com. The domain contains 100 Windows 8.1 devices. You plan to deploy a custom Windows 10 Enterprise image to the Windows 8.1 devices. You need to recommend a Windows 10 deployment method. What should you recommend?

113. You implement Microsoft Azure Advanced Threat Protection (Azure ATP). You have an Azure ATP sensor configured as shown in the following exhibit. How long after the Azure ATP cloud service is updated will the sensor update?

128. Of which groups are Computer1 and Computer2 members? To answer, select the appropriate options in the answer area.

24. You have a Microsoft Azure Active Directory (Azure AD) tenant. The organization needs to sign up for Microsoft Store for Business. The solution must use the principle of least privilege. Which role should you assign to the user?

26. You have a Microsoft 365 subscription. Some users have iPads that are managed by your company. You plan to prevent the iPad users from copying corporate data in Microsoft Word and pasting the data into other applications. What should you create?

66. You have a Microsoft 365 subscription.You need to be notified if users receive email containing a file that has a virus. What should you do?

98. You have a Microsoft 365 subscription. You plan to enable Microsoft Azure Information Protection. You need to ensure that only the members of a group named PilotUsers can protect content. What should you do?