Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft 365 E5 subscription.
You are implementing Microsoft Defender for Cloud Apps.
You need to ensure that you can create OAuth app policies.
Solution: You configure Conditional Access app control.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Conditional Access App Control (session control) is used for real-time monitoring and control of user sessions in cloud apps. It does not enable or affect OAuth app discovery or OAuth app policies in Microsoft Defender for Cloud Apps. To create OAuth app policies, the tenant must be connected (for example, Microsoft 365 connected app) so Defender for Cloud Apps can ingest OAuth authorization data. Therefore, configuring Conditional Access app control alone does not meet the goal.
Question 48
HOTSPOT
-
You have a Microsoft 365 E5 subscription and use Microsoft Defender for Cloud Apps.
You need to create a file policy to generate an alert when a file is shared with a domain named fabrikam.com.
How should you complete the filter for the policy? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Collaborators → Any from domain → contains fabrikam.com
Access level → equals Public (Internet), Public, External
Explanation: Filtering on collaborators from a specific external domain detects files shared with fabrikam.com, and limiting the access level to public/external ensures alerts trigger only when the file is actually shared outside the organization.
Question 49
HOTSPOT
-
You have an on-premises server named Server1 that runs Windows Server. Server1 is used to access a software as a service (SaaS) app named App1.
You have a Microsoft 365 E5 subscription and use Microsoft Defender for Cloud Apps, Microsoft Defender XDR, Microsoft Defender for Endpoint, and Microsoft Defender for Identity. You configure Cloud Discovery for App1 and Server1.
You need to meet the following requirements:
• Tag Server1 as a high-value device.
• Ensure that an alert is triggered when App1 is accessed.
What should you do for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Create a critical asset classification in Microsoft Defender XDR.
Add an indicator for IP addresses to Defender for Endpoint.
Explanation: High-value devices are defined by creating a critical asset classification in Microsoft Defender XDR. To trigger alerts when the SaaS app is accessed from the on-premises server discovered via Cloud Discovery, you must add the app’s IP addresses as indicators in Defender for Endpoint, which generates alerts on access.
Question 50
You have a Microsoft 365 subscription that includes Microsoft Defender XDR.
From the Microsoft Defender portal, you review the Microsoft Secure Score improvement actions shown in the following table.
You plan to update the status of the improvement actions as shown in the following table.
How many points will the Secure Score increase after the update?
A. 0
B. 4
C. 7
D. 13
E. 16
Show Answer
Correct Answer: B
Explanation: Only one of the listed status updates contributes to Secure Score. Marking an action as Risk accepted removes it from scope but awards no points, and setting an action to Planned also awards no points. Resolving an action through a third party grants the full score for that action, which in this case is 4 points. Therefore, the Secure Score increases by 4 points.
Question 51
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint.
All the devices in your organization are onboarded to Microsoft Defender for Endpoint.
You need to ensure that an alert is generated if malicious activity was detected on a device during the last 24 hours.
What should you do?
A. From the Microsoft Defender portal, create an alert suppression rule and assign an alert.
B. From the Microsoft Purview compliance portal, create an audit log search.
C. From the Microsoft Purview compliance portal, create a data loss prevention (DLP) policy.
D. From the Microsoft Defender portal, create an Advanced hunting query and a detection rule.
Show Answer
Correct Answer: D
Explanation: To generate an alert when malicious activity is detected within a specific time window, you must create a custom detection. In Microsoft Defender for Endpoint, this is done by writing an Advanced Hunting query and turning it into a detection rule, which evaluates activity (such as the last 24 hours) and raises alerts automatically. Alert suppression rules only suppress existing alerts, and Purview audit logs or DLP policies do not generate Defender for Endpoint security alerts.
Question 52
You have a Microsoft 365 E5 subscription and use Microsoft Defender for Cloud Apps.
You are reviewing the activity log of the subscription.
You need to ensure that events originating from the on-premises network are categorized automatically as Administrative.
What should you create?
A. a critical asset classification
B. an indicator for IP addresses
C. an IP address range
D. a named location
Show Answer
Correct Answer: C
Explanation: In Microsoft Defender for Cloud Apps, automatic categorization of activities (such as marking them as Administrative) is done by defining IP address ranges and assigning them a Category. IP address ranges support categories like Administrative, Corporate, VPN, Cloud Provider, and Risky. Named locations belong to Microsoft Entra ID and do not provide an Administrative category for Defender for Cloud Apps activity logs.
Question 53
You have a Microsoft 365 tenant.
You plan to manage incidents in the tenant by using the Microsoft Defender XDR.
Which Microsoft service source will appear on the Incidents page of the Microsoft Defender portal?
A. Microsoft Purview
B. Azure Arc
C. Microsoft Defender for Cloud
D. Microsoft Defender for Identity
Show Answer
Correct Answer: D
Explanation: The Incidents page in Microsoft Defender XDR aggregates incidents from integrated Microsoft 365 security workloads. Microsoft Defender for Identity is a Microsoft 365–related service whose alerts and incidents appear directly in the Defender portal. Microsoft Defender for Cloud primarily targets Azure and hybrid cloud resources rather than Microsoft 365 tenant incidents, making D the correct choice.
Question 54
DRAG DROP
-
You have a Microsoft 365 E5 subscription that contains two security groups named Group1 and Group2.
You need to recommend an authentication solution to meet the following requirements:
• Administrators must be able to generate a time-limited code to allow the members of Group1 to authenticate without using their password.
• The members of Group2 must be able to authenticate by confirming a two-digit code on their mobile device.
Which authentication method should you recommend for each group? To answer, drag the appropriate methods to the correct groups. Each method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Group1:
A Temporary Access Pass
Group2:
Microsoft Authenticator
Explanation: A Temporary Access Pass allows administrators to generate a time-limited code so users can sign in without a password. Microsoft Authenticator supports number matching, where users authenticate by confirming a two-digit code on their mobile device.
Question 56
You have an on-premises server named Server1 that runs Windows Server.
You have a Microsoft 365 E5 subscription and use Microsoft Defender for Cloud Apps.
You plan to configure Cloud Discovery and enable automatic log upload.
You need to ensure that you can run the log collector on Server1.
What should you install on Server1?
A. the Microsoft Graph PowerShell SDK
B. .NET Framework 4.8
C. Docker
D. the Azure Connected Machine agent
Show Answer
Correct Answer: C
Explanation: Microsoft Defender for Cloud Apps Cloud Discovery uses a log collector that is provided and deployed as a Docker container. To run the log collector on an on‑premises Windows Server, Docker must be installed. .NET Framework, Microsoft Graph PowerShell, and the Azure Connected Machine agent are not required for running the Defender for Cloud Apps log collector.
Question 57
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft 365 E5 subscription.
You integrate Microsoft Defender for Endpoint with Microsoft Intune.
You need to ensure that devices automatically onboard to Defender for Endpoint when they are enrolled in Intune.
Solution: You create a compliance policy.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Creating a compliance policy does not onboard devices to Microsoft Defender for Endpoint. Automatic onboarding from Intune requires enabling the Defender for Endpoint integration and configuring onboarding through Endpoint security or device configuration profiles. Compliance policies are only used to evaluate device compliance, not to deploy or enable Defender for Endpoint.
$19
Get all 417 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
