Page: 1
/ 23
Total 348 questions
You have a hybrid deployment of Azure Active Directory (Azure AD) that contains two users named User1 and User2.
You need to assign Role Based Access Control (RBAC) roles to User1 and User2 to meet the following requirements:
✑ Use the principle of least privilege.
✑ Enable User1 to view sync errors by using Azure AD Connect Health.
✑ Enable User2 to configure Azure Active Directory Connect Health Settings.
Which two roles should you assign? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. The Monitoring Reader role in Azure AD Connect Health to User1
- B. The Security reader role in Azure AD to User1
- C. The Reports reader role in Azure AD to User1
- D. The Contributor role in Azure AD Connect Health to User2
- E. The Monitoring Contributor role in Azure AD Connect Health to User2
- F. The Security operator role in Azure AD to User2
Answer : AE
A: The Monitoring Reader can read all monitoring data (metrics, logs, etc.).
Note: Assign the Monitoring reader role to the Azure Active Directory application on the subscription, resource group or resource you want to monitor.
E: Monitoring Contributor can read all monitoring data and edit monitoring settings.
Incorrect:
Not B: Security Reader can view permissions for Security Center. Can view recommendations, alerts, a security policy, and security states, but cannot make changes
Not D: Contributor grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries.
Reference:
https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
You have a Microsoft 365 subscription that contains a user named User1.
You need to assign User1 permissions to search Microsoft Office 365 audit logs.
What should you use?
- A. the Azure Active Directory admin center
- B. the Exchange admin center
- C. the Microsoft 365 Defender portal
- D. the Microsoft 365 Compliance center
Answer : B
To give a user the ability to search the audit log with the minimum level of privileges, you can create a custom role group in Exchange Online, add the View-Only
Audit Logs or Audit Logs role, and then add the user as a member of the new role group.
Incorrect:
Not D: If you assign a user the View-Only Audit Logs or Audit Logs role on the Permissions page in the compliance portal, they won't be able to search the audit log. You have to assign the permissions in Exchange Online. This is because the underlying cmdlet used to search the audit log is an Exchange Online cmdlet.
You can also use the Exchange admin center (EAC).
Reference:
https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance
You have a Microsoft 365 tenant that has modern authentication enabled.
You have Windows 10, MacOS, Android, and iOS devices that are managed by using Microsoft Endpoint Manager.
Some users have older email client applications that use Basic authentication to connect to Microsoft Exchange Online.
You need to implement a solution to meet the following security requirements:
✑ Allow users to connect to Exchange Online only by using email client applications that support modern authentication protocols based on OAuth 2.0.
✑ Block connections to Exchange Online by any email client applications that do NOT support modern authentication.
What should you implement?
- A. a conditional access policy in Azure Active Directory (Azure AD)
- B. an application control profile in Microsoft Endpoint Manager
- C. a compliance policy in Microsoft Endpoint Manager
- D. an OAuth app policy in Microsoft Defender for Cloud Apps
Answer : A
Block clients that don't support multi-factor with a Conditional Access policy.
Note: Clients that do not use modern authentication can bypass Conditional Access policies, so it's important to block these.
Incorrect:
Not D: OAuth app policies enable you to investigate which permissions each app requested and which users authorized them for Office 365, Google Workspace, and Salesforce. You're also able to mark these permissions as approved or banned.
Reference:
https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/identity-access-policies
HOTSPOT -
You have a Microsoft 365 E5 subscription linked to an Azure Active Directory (Azure AD) tenant. The tenant contains a user named User1 and multiple Windows
10 devices. The devices are Azure AD joined and protected by using BitLocker Drive Encryption (BitLocker).
You need to ensure that User1 can perform the following actions:
✑ View BitLocker recovery keys.
✑ Configure the usage location for the users in the tenant.
The solution must use the principle of least privilege.
Which two roles should you assign to User1 in the Microsoft 365 admin center? To answer, select the appropriate roles in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Answer :
Box 1: Helpdesk admin -
View BitLocker recovery keys.
Helpdesk Admins can read bitlocker metadata and key on devices
Note: One of the following should be enough:
Global admins -
Intune Service Administrators -
Security Administrators -
Security Readers -
Helpdesk Admins -
Box 2: User Administrator -
Configure the usage location for the users in the tenant.
The User Administrator can manage all aspects of users and groups, including resetting passwords for limited admins.
The User Administrator cam manage all user properties including User Principal Name
Update (FIDO) device keys -
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference
HOTSPOT -
Your on-premises network contains an Active Directory domain that syncs to Azure Active Directory (Azure AD) by using Azure AD Connect. The functional level of the domain is Windows Server 2019.
You need to deploy Windows Hello for Business. The solution must meet the following requirements:
✑ Ensure that users can access Microsoft 365 services and on-premises resources.
✑ Minimize administrative effort.
How should you deploy Windows Hello for Business and which type of trust should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Answer :
Box 1: Hybrid -
Hybrid environments are distributed systems that enable organizations to use on-premises and Azure-based identities and resources.
Box 2: Certificate -
The Windows Hello for Business deployment depends on an enterprise public key infrastructure as trust anchor for authentication. Domain controllers for hybrid deployments need a certificate in order for Windows devices to trust the domain controller.
Reference:
https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs
HOTSPOT -
You have a Microsoft 365 E5 subscription.
You need to create a role-assignable group. The solution must ensure that you can nest the group.
How should you configure the group? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Answer :
Box 1: Security only -
You can add an existing Security group to another existing Security group (also known as nested groups), creating a member group (subgroup) and a parent group. The member group inherits the attributes and properties of the parent group, saving you configuration time.
Incorrect:
Not supported:
Adding Security groups to Microsoft 365 groups.
Adding Microsoft 365 groups to Security groups or other Microsoft 365 groups.
Box 2: Assigned only -
The membership type for role-assignable groups must be Assigned and can't be an Azure AD dynamic group.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-groups-membership-azure-portal
HOTSPOT -
You create device groups in Microsoft Defender for Endpoint as shown in the following table.
You onboard three devices to Microsoft Defender for Endpoint as shown in the following table.
After the devices are onboarded, you perform the following actions:
✑ Add a tag named Tag1 to Device1.
✑ Rename Computer3 as Device3.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Answer :
Box 1: No -
The Group1 membership rule 'Name Start with Device' applies to Device1.
However, the higher ranked Group2 membership rule 'Tag Equals Tag1' also applies to Device1, and overrules the lower ranked rule.
Note: Specify the matching rule that determines which device group belongs to the group based on the device name, domain, tags, and OS platform. If a device is also matched to other groups, it's added only to the highest ranked device group.
Box 2: No -
The Group1 membership rule 'Name Start with Device' applies Device2.
No other rule applies.
Box 3: Yes -
The Group3 rule applies for Computer3.
Reference:
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/machine-groups
You have a Microsoft 365 E5 subscription that contains 100 users. Each user has a computer that runs Windows 10 and either an Android mobile device or an iOS mobile device. All the devices are registered with Azure Active Directory (Azure AD).
You enable passwordless authentication for all the users.
You need to ensure that the users can sign in to the subscription by using passwordless authentication.
What should you instruct the users to do on their mobile device first?
- A. Install a device certificate.
- B. Install a user certificate.
- C. Install the Microsoft Authenticator app.
- D. Register for self-service password reset (SSPR).
Answer : C
The Authenticator App turns any iOS or Android phone into a strong, passwordless credential.
Note: Microsoft Authenticator App
You can allow your employee's phone to become a passwordless authentication method. You may already be using the Microsoft Authenticator App as a convenient multi-factor authentication option in addition to a password. You can also use the Authenticator App as a passwordless option.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-passwordless
You have a Microsoft 365 E5 subscription that contains the users shown in the following table.
You enable the authentication methods registration campaign and configure the Microsoft Authenticator method for Group1.
Which users will be prompted to configure authentication during sign in?
- A. User1 only
- B. User2 only
- C. User2 and User3 only
- D. User1 and User2 only
- E. User2 and User3 only
- F. User1, User2, and User3 only
Answer : D
You can nudge users to set up Microsoft Authenticator during sign-in. Users will go through their regular sign-in, perform multifactor authentication as usual, and then be prompted to set up Microsoft Authenticator. You can include or exclude users or groups to control who gets nudged to set up the app. This allows targeted campaigns to move users from less secure authentication methods to Microsoft Authenticator.
Incorrect:
Not C, Not E, Not F: Not User3 since the user must not have already set up Microsoft Authenticator for push notifications on their account.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-registration-campaign
HOTSPOT -
You have a Microsoft 365 subscription that contains three users named User1, User2, and User3.
You have the named locations shown in the following table.
You configure an Azure Multi-Factor Authentication (MFA) trusted IP address range of 192.168.1.0/27.
You have the Conditional Access policies shown in the following table.
The users have the IP addresses shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Answer :
Box 1: No -
User1 has IP address 192.168.1.16, which is in DC named location. DC is not trusted.
CA1 applies. Access will not be granted.
Box 2: No -
User2 has IP address 192.168.2.16, which is in NY named location. NY is trusted. However, CA2 blocks Microsoft Planner NY access.
Box 3: No -
User3 is in LA. LA is not trusted.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policies
Your network contains an on-premises Active Directory domain. The domain contains a domain controller named DC1.
You have a Microsoft 365 E5 subscription.
You install the Microsoft Defender for Identity sensor on DC1.
You need to configure enhanced threat detection in Defender for Identity. The solution must ensure that the following events are collected from DC1:
✑ 4726 - User Account Deleted
✑ 4728 - Member Added to Global Security Group
✑ 4776 - Domain Controller Attempted to Validate Credentials for an Account (NTLM)
What should you do on DC1?
- A. Install the Azure Monitor agent.
- B. Install System Monitor (SYSMON).
- C. Configure the Windows Event Collector service.
- D. Configure the Advanced Audit Policy Configuration policy.
Answer : D
Windows Event logs -
Defender for Identity detection relies on specific Windows Event logs that the sensor parses from your domain controllers. For the correct events to be audited and included in the Windows Event log, your domain controllers require accurate Advanced Audit Policy settings.
For the correct events to be audited and included in the Windows Event Log, your domain controllers require accurate Advanced Audit Policy settings. Incorrect
Advanced Audit Policy settings can lead to the required events not being recorded in the Event Log and result in incomplete Defender for Identity coverage.
Note: Relevant Windows Events -
For Active Directory Federation Services (AD FS) events
1202 - The Federation Service validated a new credential
1203 - The Federation Service failed to validate a new credential
4624 - An account was successfully logged on
4625 - An account failed to log on
For other events -
1644 - LDAP search
4662 - An operation was performed on an object
4726 - User Account Deleted
4728 - Member Added to Global Security Group
4729 - Member Removed from Global Security Group
4730 - Global Security Group Deleted
4732 - Member Added to Local Security Group
4733 - Member Removed from Local Security Group
4741 - Computer Account Added
4743 - Computer Account Deleted
4753 - Global Distribution Group Deleted
4756 - Member Added to Universal Security Group
4757 - Member Removed from Universal Security Group
4758 - Universal Security Group Deleted
4763 - Universal Distribution Group Deleted
4776 - Domain Controller Attempted to Validate Credentials for an Account (NTLM)
7045 - New Service Installed
8004 - NTLM Authentication
Reference:
https://docs.microsoft.com/en-us/defender-for-identity/prerequisites https://docs.microsoft.com/en-us/defender-for-identity/configure-windows-event-collection
You have a Microsoft 365 E5 subscription that uses Azure Active Directory (Azure AD) Privileged Identity Management (PIM).
A user named User1 is eligible for the User Account Administrator role.
You need User1 to request to activate the User Account Administrator role.
From where should User1 request to activate the role?
- A. the My Access portal
- B. the Microsoft 365 Defender portal
- C. the Microsoft 365 admin center
- D. the Azure Active Directory admin center
Answer : A
Activate a role -
When you need to assume an Azure AD role, you can request activation by opening My roles in Privileged Identity Management.
1. Sign in to the Azure portal.
2. Open Azure AD Privileged Identity Management
3. Select My roles, and then select Azure AD roles to see a list of your eligible Azure AD roles.
4. My roles page showing roles you can activate
5. In the Azure AD roles list, find the role you want to activate.
6. Azure AD roles - My eligible roles list
7. Select Activate to open the Activate pane.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-activate-role
You have a Microsoft 365 E5 subscription.
You need to enable support for sensitivity labels in Microsoft SharePoint Online.
What should you use?
- A. the SharePoint admin center
- B. the Microsoft 365 admin center
- C. the Microsoft 365 Compliance center
- D. the Azure Active Directory admin center
Answer : C
Use the Microsoft Purview compliance portal to enable support for sensitivity labels
This option is the easiest way to enable sensitivity labels for SharePoint and OneDrive, but you must sign in as a global administrator for your tenant.
1. Sign in to the Microsoft Purview compliance portal as a global administrator, and navigate to Solutions > Information protection > Labels
2. If you see a message to turn on the ability to process content in Office online files, select Turn on now:
Reference:
https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-sharepoint-onedrive-files
HOTSPOT -
You have a Microsoft 365 tenant.
A conditional access policy is configured for the tenant as shown in the Policy exhibit. (Click the Policy tab.)
The User Administrator role is configured as shown in the Role setting exhibit. (Click the Role setting tab.)
The User Administrator role has the assignments shown in the Assignments exhibit. (Click the Assignments tab.)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Answer :
Box 1: Yes -
In this scenario the User Administrator role is require justification on active assignment.
Require justification -
You can require that users enter a business justification when they activate. To require justification, check the Require justification on active assignment box or the
Require justification on activation box.
Box 2: Yes -
Activation maximum duration is 8 hours.
Box 3: Yes -
Require multifactor authentication
Privileged Identity Management provides enforcement of Azure AD Multi-Factor Authentication on activation and on active assignment.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-change-default-settings
HOTSPOT -
Your company has a Microsoft 365 E5 subscription and a hybrid Azure Active Directory named contoso.com.
Contoso.com includes the following users:
You configure Password protection for Contoso.com as shown in the following exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Answer :
Box 1: Yes -
Note: The following considerations and limitations apply to the custom banned password list:
The custom banned password list can contain up to 1000 terms.
The custom banned password list is case-insensitive.
The custom banned password list considers common character substitution, such as "o" and "0", or "a" and "@".
The minimum string length is four characters, and the maximum is 16 characters.
Box 2: Yes -
The $ character is OK when it used instead of an S.
Box 3: No -
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-configure-custom-password-protection