You have a Microsoft 365 E5 subscription.
You need to create a mail-enabled contact.
Which portal should you use?
A. the Microsoft Defender portal
B. the SharePoint admin center
C. the Microsoft Purview portal
D. the Exchange admin center
Show Answer
Correct Answer: D
Explanation: Mail-enabled contacts are Exchange recipient objects and are created and managed in the Exchange admin center under Recipients > Contacts. The Defender, Purview, and SharePoint admin portals do not manage Exchange mail contacts.
Question 36
You have a Microsoft 365 E5 subscription that has published sensitivity labels shown in the following exhibit.
Which labels can users apply to content?
A. Label1, Label2, and Label5 only
B. Label3, Label4, and Label6 only
C. Label1, Label3, Label4, and Label6 only
D. Label1, Label2, Label3, Label4, Label5, and Label6
Show Answer
Correct Answer: C
Explanation: Label2 and Label5 are parent labels with sublabels, so users can select them to view their sublabels but cannot apply them to content. Label1 is standalone, while Label3, Label4, and Label6 are sublabels that users can apply.
Question 37
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an on-premises Active Directory domain named contoso.com. The domain contains the users shown in the following table.
The domain syncs to an Azure AD tenant named contoso.com as shown in the exhibit. (Click the Exhibit tab.)
User2 fails to authenticate to Azure AD when signing in as
.
You need to ensure that User2 can access the resources in Azure AD.
Solution: From the on-premises Active Directory domain, you set the UPN suffix for User2 to @contoso.com. You instruct User2 to sign in as
.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Yes. After the on-premises UPN suffix is changed to @contoso.com and the change synchronizes, User2 can sign in using the updated contoso.com UPN, which matches the tenant’s domain.
Question 38
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an on-premises Active Directory domain named contoso.com. The domain contains the users shown in the following table.
The domain syncs to an Azure AD tenant named contoso.com as shown in the exhibit. (Click the Exhibit tab.)
User2 fails to authenticate to Azure AD when signing in as
.
You need to ensure that User2 can access the resources in Azure AD.
Solution: From the Microsoft Entra admin center, you assign User2 the Security Reader role. You instruct User2 to sign in as
.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: No. Assigning Security Reader grants permissions after sign-in; it does not fix an authentication problem. User2’s on-premises UPN suffix is fabrikam.com, which is not shown as a verified domain in the contoso.com tenant. The sign-in UPN must be made valid for the tenant—for example, add and verify fabrikam.com or update User2’s UPN suffix to contoso.com.
Question 38
HOTSPOT
-
You have a Microsoft 365 E5 tenant that connects to Microsoft Defender for Endpoint.
You have devices enrolled in Microsoft Intune as shown in the following table.
You plan to use risk levels in Microsoft Defender for Endpoint to identify whether a device is compliant. Noncompliant devices must be blocked from accessing corporate resources.
You need to identify which devices can be onboarded to Microsoft Defender for Endpoint, and which Endpoint security policies must be configured.
What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Devices that can be onboarded: Device1, Device2, and Device3
Endpoint security policies: Device configuration profile, device compliance policy, and conditional access policy
Explanation: Microsoft Defender for Endpoint supports Windows, iOS, and Android onboarding. To enforce access based on Defender risk, onboard devices (configuration profile), evaluate device risk in a compliance policy, and require compliant devices through Conditional Access.
Question 39
You have an Azure AD tenant and a Microsoft 365 E5 subscription. The tenant contains the users shown in the following table.
You plan to implement Microsoft Defender for Endpoint.
You verify that role-based access control (RBAC) is turned on in Microsoft Defender for Endpoint.
You need to identify which user can view security incidents from the Microsoft 365 Defender portal.
Which user should you identify?
A. User1
B. User2
C. User3
D. User4
Show Answer
Correct Answer: A
Explanation: User1 has the Microsoft Entra Security Administrator role. When Defender for Endpoint RBAC is enabled, Security Administrators retain access through the Defender for Endpoint Global Administrator role. A Security Reader’s read-only access does not automatically carry over after RBAC is enabled; they must be assigned a Defender role.
Question 39
You have a Microsoft 365 E5 subscription and use Microsoft Defender for Endpoint. The subscription contains Windows 11 devices.
You need to recommend a solution to prevent antivirus and real-time protection on the devices from being modified or disabled.
What should you include in the recommendation?
A. Enforcement scope
B. tamper protection
C. Auto remediation
D. endpoint detection and response (EDR) in block mode
E. Live Response
Show Answer
Correct Answer: B
Explanation: Tamper protection in Microsoft Defender for Endpoint prevents security settings such as Microsoft Defender Antivirus, real-time protection, and other critical protections from being disabled or modified by users or malware. The other options do not specifically prevent changes to antivirus and real-time protection settings.
Question 40
You have a Microsoft 365 E5 subscription that contains the groups shown in the following table.
You plan to publish a sensitivity label named Label1.
To which groups can you publish Label1?
A. Group1 only
B. Group1 and Group2 only
C. Group1 and Group4 only
D. Group1, Group2, and Group3 only
E. Group1, Group2, Group3, and Group4
Show Answer
Correct Answer: D
Explanation: Sensitivity-label publishing policies can target Microsoft 365 groups, distribution groups, and mail-enabled security groups. A regular security group without mail enabled isn't supported. Therefore, Label1 can be published to Group1, Group2, and Group3 only.
Question 40
HOTSPOT
-
You have a Microsoft 365 E5 subscription.
You configure a new data loss prevention (DLP) policy named Policy1 that detects when sensitive content is shared externally.
Policy1 has the DLP rule shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: available to both internal and external users
no
Explanation: The rule shown has no configured action (only user notifications), so matching files are not blocked or restricted. The sensitive info condition is configured for 1–9 instances; a file with 18 credit card numbers does not match that threshold, so the rule does not trigger and no notification emails are sent.
Question 41
You have a hybrid deployment of Microsoft 365 that contains the users shown in the following table.
Azure AD Connect has the following settings:
Password Hash Sync: Enabled -
Pass-through authentication: Enabled
You need to identify which users will be able to authenticate by using Azure AD if connectivity between on-premises Active Directory and the internet is lost.
Which users should you identify?
A. none
B. User1 only
C. User1 and User2 only
D. User1, User2, and User3
Show Answer
Correct Answer: B
Explanation: User1 is cloud-only, so Azure AD can authenticate them without connectivity to on-premises AD. Users 2 and 3 are synchronized from AD DS and use pass-through authentication. Although password hash synchronization is enabled, it does not automatically take over when pass-through authentication is unavailable, so those users cannot authenticate this way without changing the configuration.
$19
Get all 431 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
