HOTSPOT
-
You have a Microsoft 365 E5 subscription that contains the devices shown in the following table.
All the devices are onboarded to Microsoft Defender for Endpoint.
You plan to use Microsoft Defender Vulnerability Management to meet the following requirements:
• Detect operating system vulnerabilities.
• Perform a configuration assessment of the operating system.
Which devices support each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Detect operating system vulnerabilities: Device1, Device2, and Device3
Perform a configuration assessment of the operating system: Device1 only
Explanation: Microsoft Defender Vulnerability Management detects OS vulnerabilities across supported Windows, Android, and iOS devices onboarded to Defender for Endpoint. OS configuration assessment is supported for Windows devices, not Android or iOS.
Question 9
You have a Microsoft 365 E5 subscription. The subscription contains a Microsoft SharePoint Online site named Site1.
Site1 contains the following files:
• File.docx
• ImportantFile.docx
• File_Important.docx
From Microsoft Defender Cloud Apps, you create a file policy named Policy that has the filter shown in the following exhibit.
To which files will Policy1 apply?
A. ImportantFile.docx and File_Important.docx only
B. File.docx only
C. File_Important.docx only
D. ImportantFile.docx only
E. File.docx, ImportantFile.docx, and File_Important.docx
Show Answer
Correct Answer: C
Explanation: The filter requires the file name to contain both words, “important” and “File.” Words are matched as separate tokens: the underscore in File_Important.docx separates them, while ImportantFile.docx has them joined into one word. File.docx lacks “important,” so only File_Important.docx matches.
Question 9
HOTSPOT
-
You have a Microsoft 365 subscription that contains two groups named Group1 and Group2. The subscription contains the users shown in the following table.
The users are directly assigned licenses as shown in the following table.
The groups are assigned licenses as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
Yes
Yes
Explanation: A disabled service in one license assignment does not block the same service from another direct or group-based assignment. User1 has a direct E5 with Planner enabled. User2 receives E5 from both groups, and Group2 enables Planner. User3 has a direct E5 with Planner disabled but also inherits an enabled E5 from Group2, so Planner is enabled.
Question 10
You have a Microsoft 365 E5 subscription that contains a user named User1.
You create an outbound anti-spam policy named Policy1 as shown in the following exhibit.
You assign Policy1 to User1.
What is the maximum number of email messages that User1 can send in a 24-hour period?
A. 30
B. 720
C. 1000
D. 1030
Show Answer
Correct Answer: B
Explanation: The policy allows up to 10 external and 20 internal recipients per hour. If User1 sends one message to each recipient without exceeding either hourly limit, the maximum over 24 hours is (10 + 20) × 24 = 720 messages. The 1,000-recipient daily limit is higher.
Sources:
https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-configure
Question 10
You have a Microsoft 365 subscription.
You create a Microsoft Defender Threat Intelligence (Defender TI) project named Project1.
You need to add artifacts to Project1.
Which type of artifact can you add to Project1?
A. Microsoft SharePoint Online sites
B. network segments
C. IP addresses
D. Microsoft Entra users
Show Answer
Correct Answer: C
Explanation: Microsoft Defender Threat Intelligence projects are used to organize and track threat intelligence artifacts such as IP addresses, domains, and hosts. Among the options provided, only IP addresses are supported project artifacts. SharePoint Online sites, network segments, and Microsoft Entra users are not supported artifact types for Defender TI projects.
Question 11
You have a Microsoft 365 E5 subscription and use Microsoft Defender for Cloud Apps.
From Policy management, you open Information protection as shown in the following exhibit.
Which type of policy can you create?
A. session policy
B. activity policy
C. OAuth app policy
D. access policy
E. file policy
Show Answer
Correct Answer: E
Explanation: The Information protection tab in Microsoft Defender for Cloud Apps is used to create file policies, which inspect and govern files in connected cloud apps.
Question 11
HOTSPOT
-
You have a Microsoft 365 E5 subscription that contains two Microsoft SharePoint Online sites named Site1 and Site2.
You have the documents shown in the following table.
You create a data loss prevention (DLP) policy named DLP1 that has the advanced DLP rule as shown in the exhibit. (Click the Exhibit tab.)
You apply DLP1 to Site1.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Document1: No
Document2: No
Document3: Yes
Explanation: The rule matches if Group1 OR Group2 is satisfied. Group1 requires both 1–5 credit card numbers and 1–2 SWIFT codes. Group2 requires at least 10 credit card numbers. The policy is scoped only to Site1. Document1 fails Group1 because it has 3 SWIFT codes and fails Group2. Document2 is on Site2, so the policy does not apply. Document3 is on Site1 and satisfies Group2 with 15 credit card numbers.
Question 12
You have a Microsoft 365 E5 subscription.
You create the users shown in the following table.
You plan to use Microsoft Entra ID Protection.
Which users will be added automatically to the User at risk detected alerts list?
A. Admin1 only
B. Admin2 only
C. Admin1 and Admin2 only
D. Admin1 and Admin3 only
E. Admin1, Admin2, and Admin3
Show Answer
Correct Answer: D
Explanation: Admin1 (Security Administrator) and Admin3 (Security Reader) are automatically included in the User at risk detected alerts list. Admin2, assigned the Security Operator role, is not.
Question 12
You have a Microsoft 365 E5 subscription.
You are implementing Microsoft Defender XDR.
You need to ensure that you can view attack paths in Microsoft Security Exposure Management.
What should you do first?
A. Add an advanced hunting query.
B. Tag users, groups, and devices as sensitive.
C. Define critical assets.
D. Tag users and devices as honeytokens.
Show Answer
Correct Answer: C
Explanation: Attack paths in Microsoft Security Exposure Management are generated starting from defined critical assets. Defining critical assets is the prerequisite for identifying and visualizing potential attack paths to those high-value targets. Advanced hunting queries, sensitive tags, and honeytokens provide other capabilities but are not the initial requirement to enable attack path views.
Question 13
You have a Microsoft 365 E5 subscription.
You are creating a data loss prevention (DLP) policy applied to the locations as shown in the following exhibit.
Which condition can you use in the DLP rules of the policy?
A. sensitive info types
B. sensitivity labels
C. keywords
D. content search queries
Show Answer
Correct Answer: A
Explanation: Sensitive information types can be used as DLP rule conditions across the selected locations. Sensitivity-label and keyword conditions aren’t supported across all of them, and content search queries are not DLP rule conditions.
$19
Get all 431 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.