HOTSPOT
-
You have a Microsoft 365 E5 subscription that contains two Microsoft SharePoint Online sites named Site1 and Site2.
You have the documents shown in the following table.
You create a data loss prevention (DLP) policy named DLP1 that has the advanced DLP rule as shown in the exhibit. (Click the Exhibit tab.)
You apply DLP1 to Site1.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Document1: No
Document2: No
Document3: Yes
Explanation: The rule matches if Group1 OR Group2 is satisfied. Group1 requires both 1–5 credit card numbers and 1–2 SWIFT codes. Group2 requires at least 10 credit card numbers. The policy is scoped only to Site1. Document1 fails Group1 because it has 3 SWIFT codes and fails Group2. Document2 is on Site2, so the policy does not apply. Document3 is on Site1 and satisfies Group2 with 15 credit card numbers.
Question 12
You have a Microsoft 365 E5 subscription.
You are implementing Microsoft Defender XDR.
You need to ensure that you can view attack paths in Microsoft Security Exposure Management.
What should you do first?
A. Add an advanced hunting query.
B. Tag users, groups, and devices as sensitive.
C. Define critical assets.
D. Tag users and devices as honeytokens.
Show Answer
Correct Answer: C
Explanation: Attack paths in Microsoft Security Exposure Management are generated starting from defined critical assets. Defining critical assets is the prerequisite for identifying and visualizing potential attack paths to those high-value targets. Advanced hunting queries, sensitive tags, and honeytokens provide other capabilities but are not the initial requirement to enable attack path views.
Question 13
You have a Microsoft 365 subscription that contains a user named User1.
You need to ensure that User1 can gather and summarize a custom set of data from signals in the Microsoft Defender XDR environment. The solution must NOT require that User1 have KQL knowledge.
What should you do in Microsoft Defender XDR?
A. From Advanced hunting, create a new query in the query editor.
B. From Cloud Discovery, create a report.
C. From API Explorer, create a query.
D. From Advanced hunting, create a new query in the query builder.
Show Answer
Correct Answer: D
Explanation: Advanced hunting includes a guided query builder mode that allows users to gather and summarize custom data from Microsoft Defender XDR signals without writing KQL. The query editor is intended for KQL-based advanced hunting, while Cloud Discovery reports and API Explorer do not satisfy the requirement for custom hunting without KQL knowledge.
Question 14
Overview -
Fabrikam, Inc. is an electronics company that produces consumer products. Fabrikam has 10,000 employees worldwide.
Fabrikam has a main office in London and branch offices in major cities in Europe, Asia, and the United States.
Existing Environment -
Active Directory Environment -
The network contains an Active Directory forest named fabrikam.com. The forest contains all the identities used for user and computer authentication. Each department is represented by a top-level organizational unit (OU) that contains several child OUs for user accounts and computer accounts.
All users authenticate to on-premises applications by signing in to their device by using a UPN format of
.
Fabrikam does NOT plan to implement identity federation.
Network Infrastructure -
Each office has a high-speed connection to the Internet.
Each office contains two domain controllers. All domain controllers are configured as DNS servers.
The public zone for fabrikam.com is managed by an external DNS server.
All users connect to an on-premises Microsoft Exchange Server 2016 organization. The users access their email by using Outlook Anywhere, Outlook on the web, or the Microsoft Outlook app for iOS. All the Exchange servers have the latest cumulative updates installed.
All shared company documents are stored on a Microsoft SharePoint Server farm.
Requirements -
Planned Changes -
Fabrikam plans to implement a Microsoft 365 Enterprise subscription and move all email and shared documents to the subscription.
Fabrikam plans to implement two pilot projects:
• Project1: During Project1, the mailboxes of 100 users in the sales department will be moved to Microsoft 365.
• Project2: After the successful completion of Project1, Microsoft Teams will be enabled in Microsoft 365 for the sales department users.
Fabrikam plans to create a group named UserLicenses that will manage the allocation of all Microsoft 365 bulk licenses.
Technical Requirements -
Fabrikam identifies the following technical requirements:
• All users must be able to exchange email messages successfully during Project1 by using their current email address.
• Users must be able to authenticate to cloud services if Active Directory becomes unavailable.
• A user named User1 must be able to view all DLP reports from the Microsoft Purview compliance portal.
• Microsoft 365 Apps for enterprise applications must be installed from a network share only.
• Disruptions to email access must be minimized.
Application Requirements -
Fabrikam identifies the following application requirements:
• An on-premises web application named App1 must allow users to complete their expense reports online. App1 must be available to users from the My Apps portal.
• The installation of feature updates for Microsoft 365 Apps for enterprise must be minimized.
Security Requirements -
Fabrikam identifies the following security requirements:
• After the planned migration to Microsoft 365, all users must continue to authenticate to their mailbox and to SharePoint sites by using their UPN.
• The membership of the UserLicenses group must be validated monthly. Unused user accounts must be removed from the group automatically.
• After the planned migration to Microsoft 365, all users must be signed in to on-premises and cloud-based applications automatically.
• The principle of least privilege must be used.
You are evaluating the required processes for Project1.
You need to recommend which DNS record must be created while adding a domain name to the tenant for the project.
Which DNS record should you recommend?
A. name server (NS)
B. host (A)
C. mail exchanger (MX)
D. host information (HINFO)
Show Answer
Correct Answer: C
Explanation: For an Exchange hybrid migration (moving a pilot group of mailboxes to Microsoft 365 while keeping mail flow working), the Microsoft 365 tenant domain setup requires creating DNS records. Among the provided options, the required record is the MX record, which is used for mail routing. TXT is commonly used for domain verification, but it is not an available option. NS, A, and HINFO are not the appropriate choice for this requirement.
Question 15
You have a Microsoft 365 tenant.
You plan to manage incidents in the tenant by using the Microsoft Defender XDR.
Which Microsoft service source will appear on the Incidents page of the Microsoft Defender portal?
A. Azure Web Application Firewall
B. Microsoft Sentinel
C. Microsoft Defender for Cloud Apps
D. Microsoft Purview
Show Answer
Correct Answer: C
Explanation: The Microsoft Defender XDR Incidents page aggregates incidents from integrated Microsoft security products, including Microsoft Defender for Cloud Apps. Azure Web Application Firewall and Microsoft Purview are not incident sources in Defender XDR, and Microsoft Sentinel is a separate SIEM that can consume Defender incidents rather than appearing as a Defender XDR incident source.
Question 16
You have a Microsoft 365 subscription that contains a Microsoft Entra tenant named contoso.com. The tenant includes a user named User1.
You plan to use Microsoft Entra ID Protection.
You need to ensure that User1 can review the list in Microsoft Entra ID Protection of users flagged for risk. The solution must use the principle of least privilege.
To which role should you add User1?
A. Compliance Administrator
B. User Administrator
C. Security Administrator
D. Global Administrator
Show Answer
Correct Answer: C
Explanation: The Security Administrator role can access and manage Microsoft Entra ID Protection, including reviewing risky users. Global Administrator also has access but grants broader permissions than necessary, violating least privilege. User Administrator and Compliance Administrator do not have the required Identity Protection access.
Question 17
Your network contains an Active Directory domain named adatum.com that is synced to a Microsoft Entra tenant.
The domain contains 100 user accounts.
The city attribute for all the users is set to the city where the user resides.
You need to modify the value of the city attribute to the three-letter airport code of each city.
What should you do?
A. From Azure Cloud Shell, run the Get-ADUser and Set-ADUser cmdlets.
B. From Azure Cloud Shell, run the Get-MsolUser and Set-Msoluser cmdlets.
C. From Windows PowerShell on a domain controller, run the Get-MgUser and Update-MgUser cmdlets.
D. From Active Directory Administrative Center, select the Active Directory users, and then modify the Properties settings.
Show Answer
Correct Answer: D
Explanation: Because the users are synchronized from on-premises Active Directory, the city attribute is authoritative on-premises and must be changed there. Azure Cloud Shell cannot run the on-premises Active Directory cmdlets, MSOnline cmdlets cannot modify synchronized attributes, and Microsoft Graph cannot update on-premises mastered synchronized attributes. Active Directory Administrative Center allows bulk editing of the on-premises user properties.
Question 18
You have a Microsoft 365 tenant -
You plan to manage incidents in the tenant by using the Microsoft Defender XDR.
Which Microsoft service source will appear on the Incidents page of the Microsoft Defender portal?
A. Azure Information Protection
B. Microsoft Defender for Identity
C. Azure Web Application Firewall
D. Microsoft Sentinel
Show Answer
Correct Answer: B
Explanation: The Microsoft Defender portal (Microsoft Defender XDR) aggregates incidents from integrated Defender products, including Microsoft Defender for Identity. Azure Information Protection and Azure Web Application Firewall are not incident sources on the Defender XDR Incidents page, and Microsoft Sentinel is a separate SIEM that can integrate with Defender rather than appearing as a Defender XDR service source.
Question 19
Overview -
Fabrikam, Inc. is an electronics company that produces consumer products. Fabrikam has 10,000 employees worldwide.
Fabrikam has a main office in London and branch offices in major cities in Europe, Asia, and the United States.
Existing Environment -
Active Directory Environment -
The network contains an Active Directory forest named fabrikam.com. The forest contains all the identities used for user and computer authentication. Each department is represented by a top-level organizational unit (OU) that contains several child OUs for user accounts and computer accounts.
All users authenticate to on-premises applications by signing in to their device by using a UPN format of
.
Fabrikam does NOT plan to implement identity federation.
Network Infrastructure -
Each office has a high-speed connection to the Internet.
Each office contains two domain controllers. All domain controllers are configured as DNS servers.
The public zone for fabrikam.com is managed by an external DNS server.
All users connect to an on-premises Microsoft Exchange Server 2016 organization. The users access their email by using Outlook Anywhere, Outlook on the web, or the Microsoft Outlook app for iOS. All the Exchange servers have the latest cumulative updates installed.
All shared company documents are stored on a Microsoft SharePoint Server farm.
Requirements -
Planned Changes -
Fabrikam plans to implement a Microsoft 365 Enterprise subscription and move all email and shared documents to the subscription.
Fabrikam plans to implement two pilot projects:
• Project1: During Project1, the mailboxes of 100 users in the sales department will be moved to Microsoft 365.
• Project2: After the successful completion of Project1, Microsoft Teams will be enabled in Microsoft 365 for the sales department users.
Fabrikam plans to create a group named UserLicenses that will manage the allocation of all Microsoft 365 bulk licenses.
Technical Requirements -
Fabrikam identifies the following technical requirements:
• All users must be able to exchange email messages successfully during Project1 by using their current email address.
• Users must be able to authenticate to cloud services if Active Directory becomes unavailable.
• A user named User1 must be able to view all DLP reports from the Microsoft Purview compliance portal.
• Microsoft 365 Apps for enterprise applications must be installed from a network share only.
• Disruptions to email access must be minimized.
Application Requirements -
Fabrikam identifies the following application requirements:
• An on-premises web application named App1 must allow users to complete their expense reports online. App1 must be available to users from the My Apps portal.
• The installation of feature updates for Microsoft 365 Apps for enterprise must be minimized.
Security Requirements -
Fabrikam identifies the following security requirements:
• After the planned migration to Microsoft 365, all users must continue to authenticate to their mailbox and to SharePoint sites by using their UPN.
• The membership of the UserLicenses group must be validated monthly. Unused user accounts must be removed from the group automatically.
• After the planned migration to Microsoft 365, all users must be signed in to on-premises and cloud-based applications automatically.
• The principle of least privilege must be used.
You are evaluating the required processes for Project1.
You need to recommend which DNS record must be created while adding a domain name for the project.
Which DNS record should you recommend?
A. host (AAAA)
B. name server (NS)
C. mail exchanger (MX)
D. host (A)
Show Answer
Correct Answer: C
Explanation: For an Exchange hybrid migration (Project1), after adding the custom domain to Microsoft 365, an MX record is created/updated as part of domain configuration to enable mail flow and domain validation scenarios. During hybrid coexistence, mail routing relies on the MX configuration so users continue using the same email addresses with minimal disruption. NS, A, and AAAA records are not the required record for this step.
Question 20
HOTSPOT
-
You have a Microsoft 365 E5 subscription that contains the groups shown in the following table.
You need to create a contact named Contact1 and add Contact1 to a group.
Which two portals can you use to create Contact1, and to which groups can you add Contact1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Portals: Microsoft 365 admin center and Exchange admin center
Groups: Group2 only
Explanation: Mail contacts are created in Exchange or Microsoft 365 admin center. Mail contacts can be members of distribution groups, but Microsoft 365 groups use user/guest identities rather than mail contact objects, and security groups do not use mail contacts as members for this scenario.
$19
Get all 430 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
