You have Microsoft 365 E5 subscription that contains the identities shown in the following table.
You create a shared mailbox named Shared1.
Which identities can you add to Shared1 as a member?
A. User1 only
B. User1 and Group1 only
C. User1 and Group2 only
D. User1 and Group3 only
E. User1, Group2, and Group3 only
Show Answer
Correct Answer: C
Explanation: A shared mailbox can have individual users and mail-enabled security groups added as members. Group2 is a mail-enabled security group; Group1 is a Microsoft 365 group and Group3 is a distribution group, so neither is eligible.
Question 5
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory forest.
You deploy Microsoft 365.
You plan to implement directory synchronization.
You need to recommend a security solution for the synchronized identities. The solution must meet the following requirements:
• Users must be able to authenticate successfully to Microsoft 365 services if Active Directory becomes unavailable.
• User passwords must be 10 characters or more.
Solution: Implement password hash synchronization and configure password protection in the Azure AD tenant.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Password hash synchronization allows users to authenticate to Microsoft 365 even if on-premises Active Directory is unavailable. However, Azure AD password protection does not enforce a 10-character minimum for synchronized users; their password requirements are governed by the on-premises Active Directory policy. Therefore, the solution does not meet both requirements.
Question 5
You have a Microsoft 365 subscription that contains the users shown in the following table.
You plan to use Microsoft 365 Backup.
Which users can enable Microsoft 365 Backup?
A. Admin1 only
B. Admin3 only
C. Admin1 and Admin3 only
D. Admin1, Admin2 and Admin3 only
E. Admin1, Admin2, Admin3, and Admin4
Show Answer
Correct Answer: C
Explanation: Admin1 is a Global Administrator and Admin3 is a SharePoint Administrator; either role can enable Microsoft 365 Backup. The Exchange Administrator and Compliance Administrator roles do not grant that enablement permission.
Question 6
You have a Microsoft 365 E5 subscription and use Microsoft Purview. The subscription contains the devices shown in the following table.
All the devices are onboarded to Microsoft Defender for Endpoint.
You plan to deploy Endpoint data loss prevention (Endpoint DLP) policies.
Which devices can be protected by using the DLP policies?
A. Device1 only
B. Device1 and Device2 only
C. Device1, Device2, and Device 3 only
D. Device1, Device3, and Device 4 only
E. Device1, Device2, Device3, and Device4
Show Answer
Correct Answer: B
Explanation: Endpoint DLP supports onboarded Windows 10/11 devices and supported macOS versions. It does not support Android or Linux devices for Endpoint DLP, so Device1 and Device2 can be protected.
Question 6
You have a Microsoft 365 E5 subscription that is linked to an Azure AD tenant named contoso.com.
You purchase 100 Microsoft 365 Business Voice add-on licenses.
You need to ensure that the members of a group named Voice are assigned a Microsoft 365 Business Voice add-on license automatically.
What should you do?
A. From the Licenses page of the Microsoft 365 admin center, assign the licenses.
B. From the Microsoft Entra admin center, modify the settings of the Voice group.
C. From the Microsoft 365 admin center, modify the settings of the Voice group.
Show Answer
Correct Answer: A
Explanation: In the Microsoft 365 admin center, go to **Billing > Licenses**, select the Business Voice license, and assign it to the **Voice** group. Group-based licensing then assigns the license automatically to the group’s members.
Question 6
Your network contains an on-premises Active Directory Domain Services (AD DS) forest.
You have a Microsoft Entra tenant.
You implement Microsoft Entra Connect Sync.
The synchronization fails to complete.
You review the logs and discover the following error message: "We found an issue with the service account that is used to run Microsoft Entra Connect Sync".
You need to ensure that the synchronization completes successfully. The solution must minimize administrative effort.
What should you do?
A. From the Microsoft Entra admin center, reset the password of the Microsoft Entra Connect Sync account.
B. From PowerShell, run the Repair-AADCloudSyncToolsAccount cmdlet.
C. From Active Directory Users and Computers, reset the password or the ADSync service account.
D. From PowerShell, run the Set-ADSyncScheduler cmdlet.
Show Answer
Correct Answer: C
Explanation: The error indicates a problem with the on-premises service account used to run Microsoft Entra Connect Sync (the ADSync service account). Resetting or repairing that service account in Active Directory is the appropriate fix. The Repair-AADCloudSyncToolsAccount cmdlet applies to Microsoft Entra Cloud Sync, not Entra Connect Sync. Resetting the cloud sync account in Entra does not address the local service account, and Set-ADSyncScheduler only configures scheduling, not service account authentication.
Question 7
You have a Microsoft 365 subscription that includes Microsoft Defender XDR.
From the Microsoft Defender portal, you review the Microsoft Secure Score improvement actions shown in the following table.
You plan to update the status of the improvement actions as shown in the following table.
How many points will the Secure Score increase after the update?
A. 0
B. 4
C. 7
D. 13
E. 16
Show Answer
Correct Answer: B
Explanation: Only the action marked “Resolved through third party” earns points: it awards 4 points. “Risk accepted” and “Planned” do not add Secure Score points, so the increase is 4 points.
Question 7
Your on-premises network contains an Active Directory Domain Services (AD DS) domain.
You have a Microsoft 365 E5 subscription.
You plan to implement Microsoft Entra Connect Sync and use Microsoft Entra ID Protection.
You need to configure Microsoft Entra Connect Sync to ensure that Microsoft Entra ID Protection can detect leaked credentials.
What should you select?
A. Password writeback
B. Password Hash Synchronization
C. Configure Hybrid Microsoft Entra join
D. Pass-through authentication
E. Enable single sign-on
Show Answer
Correct Answer: B
Explanation: Microsoft Entra ID Protection's leaked credentials detection for hybrid identities requires Password Hash Synchronization (PHS). Entra Connect synchronizes a hash of the on-premises password hash to Microsoft Entra ID, enabling Microsoft to compare it against known compromised credentials. Password writeback is for resetting passwords from the cloud to on-premises, pass-through authentication and seamless SSO do not provide the password hash needed for leaked credential detection, and Hybrid Entra join is unrelated.
Question 8
Your network contains an on-premises Active Directory domain named contoso.com. The domain contains 1,000 Windows 10 devices.
You perform a proof of concept (PoC) deployment of Microsoft Defender for Endpoint for 10 test devices. During the onboarding process, you configure Microsoft Defender for Endpoint-related data to be stored in the United States.
You plan to onboard all the devices to Microsoft Defender for Endpoint.
You need to store the Microsoft Defender for Endpoint data in Europe.
What should you do first?
A. Delete the workspace.
B. Create a workspace.
C. Onboard a new device.
D. Offboard the test devices.
Show Answer
Correct Answer: D
Explanation: Offboard the 10 test devices first. They are currently reporting to the Defender for Endpoint tenant configured for the United States; offboarding them is the first step before changing the deployment and onboarding devices for the required European data location. Creating or deleting a Log Analytics workspace does not change the Defender for Endpoint tenant’s data location.
Question 8
You have a Microsoft 365 E5 subscription that contains a user named User1.
You create an anti-phishing policy named Policy1 that has the following settings:
• Include these users, groups and domains: User1
• Phishing email threshold: 3 - More Aggressive
User1 receives the email messages shown in the following table.
Which messages are phishing email?
A. Mail4 only
B. Mail3 and Mail4 only
C. Mail2, Mail3, and Mail4 only
D. Mail1, Mail2, Mail3, and Mail4
Show Answer
Correct Answer: C
Explanation: A phishing threshold of 3 (More Aggressive) treats messages with medium or high phishing confidence as if they had very high confidence. Mail2 (medium), Mail3 (high), and Mail4 (very high) are therefore phishing; Mail1 (low) is not.
$19
Get all 431 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
