HOTSPOT
-
You have four Azure subscriptions named Sub1, Sub2, Sub3, and Sub4. Each subscription has a unique Microsoft Entra tenant that is linked to a Microsoft 365 subscription. Sub1 contains a user named User1.
You plan to implement Microsoft Sentinel.
You need to ensure that User1 can monitor Microsoft Entra ID events and Microsoft 365 events for Sub2, Sub3, and Sub4 by using Microsoft Sentinel. The solution must minimize administrative effort.
What is the minimum number of Microsoft Sentinel workspaces you should create, and which Azure service should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Number of workspaces: 3
Service: Azure Lighthouse
Explanation: Microsoft Sentinel can collect Microsoft Entra ID and Microsoft 365 data only within the same Entra tenant as the workspace. Since Sub2, Sub3, and Sub4 each have a different Entra tenant, each requires its own Sentinel workspace. Azure Lighthouse is used to grant User1 centralized cross-tenant access with minimal administrative effort.
Question 127
HOTSPOT
-
Your company, named Contoso, Ltd., has a Microsoft Entra tenant named contoso.com. Contoso has a partner company named Fabrikam, Inc. that has a Microsoft Entra tenant named fabrikam.com.
You need to ensure that helpdesk users at Fabrikam can reset passwords for specific users at Contoso. The solution must meet the following requirements:
• Follow the principle of least privilege.
• Minimize administrative effort.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Directory Readers
An administrative unit
Password Administrator
Explanation: Directory Readers allows basic visibility into Contoso users without elevated admin rights.
Administrative units scope the role to only specific Contoso users, meeting least privilege.
Password Administrator is the minimum role that permits password resets for users.
Question 128
HOTSPOT
-
You have an Azure subscription that contains a Microsoft Sentinel workspace named MSW1. MSW11 includes 50 scheduled analytics rules.
You need to design a security orchestration automated response (SOAR) solution by using Microsoft Sentinel playbooks. The solution must meet the following requirements:
• Ensure that expiration dates can be configured when a playbook runs.
• Minimize the administrative effort required to configure individual analytics rules.
What should you use to invoke the playbooks, and which type of Microsoft Sentinel trigger should you use? To answer, select the options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: Automation rules can invoke playbooks centrally across many analytics rules, reducing per-rule configuration. Incident-based triggers support configurable conditions such as timing and expiration, enabling controlled and scalable SOAR execution.
Question 129
You have a Microsoft 365 subscription.
You have an Azure subscription.
You need to implement a Microsoft Purview communication compliance solution for Microsoft Teams and Yammer. The solution must meet the following requirements:
• Assign compliance policies to Microsoft 365 groups based on custom Microsoft Exchange Online attributes.
• Minimize the number of compliance policies.
• Minimize administrative effort.
What should you include in the solution?
A. Microsoft Purview Information Protection
B. Microsoft 365 Defender user tags
C. adaptive scopes
D. administrative units
Show Answer
Correct Answer: C
Explanation: Adaptive scopes allow Microsoft Purview compliance policies to be dynamically assigned to Microsoft 365 groups based on attributes such as custom Microsoft Exchange Online attributes. This enables targeting Teams and Yammer communications without creating many separate policies, thereby minimizing the number of policies and reducing ongoing administrative effort.
Question 130
DRAG DROP
-
You need to design a solution to accelerate a Zero Trust security implementation. The solution must be based on the Zero Trust Rapid Modernization Plan (RaMP).
Which three initiatives should you include in the solution, and in which order should you implement the initiatives? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Explicitly validate trust for all access requests.
Apply provisions for ransomware recovery readiness.
Classify and protect data.
Explanation: Zero Trust RaMP accelerates adoption by first enforcing identity-based access decisions, then ensuring organizational resilience against ransomware, and finally protecting sensitive data through classification and controls.
Question 131
You have an Azure subscription.
You plan to deploy enterprise-scale landing zones based on the Microsoft Cloud Adoption Framework for Azure. The deployment will include a single-platform landing zone for all shared services and three application landing zones that will each host a different Azure application.
You need to recommend which resource to deploy to each landing zone. The solution must meet the Cloud Adoption Framework best-practice recommendations for enterprise-scale landing zones.
What should you recommend?
A. an Azure firewall
B. an Azure virtual network gateway
C. an Azure Private DNS zone
D. an Azure key vault
Show Answer
Correct Answer: D
Explanation: In the Cloud Adoption Framework enterprise-scale architecture, both platform and application landing zones are expected to include application-level security and secret management. Azure Key Vault is recommended per application/landing zone to store secrets, keys, and certificates with isolation boundaries. Network-centric resources like Azure Firewall and Virtual Network Gateway belong in the connectivity (platform) subscription only, not every landing zone, and Private DNS zones are typically centralized rather than duplicated per landing zone. Therefore, Azure Key Vault is the correct resource to deploy to each landing zone.
Question 132
You have a Microsoft Entra tenant that syncs with an Active Directory Domain Services (AD DS) domain.
You have an on-premises datacenter that contains 100 servers. The servers run Windows Server and are backed up by using Microsoft Azure Backup Server (MABS).
You are designing a recovery solution for ransomware attacks. The solution follows Microsoft Security Best Practices.
You need to ensure that a compromised local administrator account cannot be used to stop scheduled backups.
What should you do?
A. From Azure Backup, configure multi-user authorization by using Resource Guard.
B. From Microsoft Entra Privileged Identity Management (PIM), create a role assignment for the Backup Contributor role.
C. From Microsoft Azure Backup Setup, register MABS with a Recovery Services vault.
D. From a Recovery Services vault, generate a security PIN for critical operations.
Show Answer
Correct Answer: A
Explanation: To prevent a compromised local administrator account from stopping or modifying backups, Microsoft Security Best Practices recommend enabling Multi-User Authorization (MUA). In Azure Backup, this is implemented by configuring Resource Guard. Resource Guard enforces that critical backup operations (such as disabling backups or deleting backup data) require approval from an additional, separate security principal, so a single compromised admin account cannot perform these actions alone. The other options do not provide this protection against admin-level compromise.
Question 133
You have a Microsoft Entra tenant that contains 10 Windows 11 devices and two groups named Group1 and Group2. The Windows 11 devices are joined to the Microsoft Entra tenant and are managed by using Microsoft Intune.
You are designing a privileged access strategy based on the rapid modernization plan (RaMP). The strategy will include the following configurations:
• Each user in Group1 will be assigned a Windows 11 device that will be configured as a privileged access device.
• The Security Administrator role will be mapped to the privileged access security level.
• The users in Group1 will be assigned the Security Administrator role.
• The users in Group2 will manage the privileged access devices.
You need to configure the local Administrators group for each privileged access device. The solution must follow the principle of least privilege.
What should you include in the solution?
A. Only add Group2 to the local Administrators group.
B. Configure Windows Local Administrator Password Solution (Windows LAPS) in legacy Microsoft LAPS emulation mode.
C. Add Group2 to the local Administrators group. Add the user that is assigned the Security Administrator role to the local Administrators group of the user's assigned privileged access device.
Show Answer
Correct Answer: A
Explanation: Under the Rapid Modernization Plan (RaMP) / Privileged Access Workstation (PAW) guidance, users who perform privileged cloud roles (such as Security Administrator) should not have local administrator rights on their privileged access devices. Their elevation occurs in the cloud control plane, not on the endpoint. To follow least privilege, only the operators who manage and maintain the privileged access devices themselves (Group2) should be local administrators. Adding Group1 users as local admins would unnecessarily expand attack surface and violate PAW best practices.
Question 134
HOTSPOT
-
You have an Azure subscription that contains multiple apps. The apps are managed by using continuous integration and continuous deployment (CCD) pipelines in Azure DevOps.
You need to recommend DevSecOps controls for the Commit the code and the Build and test CI/CD process stages based on the Microsoft Cloud Adoption Framework for Azure.
Which testing method should you recommend for each stage? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Commit the code:
Static application security testing (SAST)
Build and test:
Dynamic application security testing (DAST)
Explanation: In the Microsoft Cloud Adoption Framework DevSecOps model, SAST is performed early at code commit to detect vulnerabilities in source code before compilation. DAST is applied during the build and test stage to evaluate the running application for security issues from an external perspective.
Question 135
Your on-premises network contains an Active Directory Domain Services (AD DS) domain and a hybrid deployment between a Microsoft Exchange Server 2019 organization and an Exchange Online tenant. The AD DS domain contains a group named Group1. Group1 is a member of the Organization Management role group for the Exchange deployment.
You have a Microsoft 365 E5 subscription that uses Microsoft Defender.
You have an Azure subscription that uses Microsoft Sentinel.
You need to recommend a solution to ensure that Group1 is marked as a sensitive group and that any changes made to Group1 raises an alert in Microsoft Sentinel. The solution must minimize administrative effort.
What should you include in the recommendation?
A. Microsoft Defender for Identity
B. Microsoft Entra ID Protection
C. Microsoft Entra Privileged Identity Management (PIM)
D. Microsoft Defender for Office 365
Show Answer
Correct Answer: A
Explanation: Group1 is an on‑premises Active Directory security group used in a hybrid Exchange deployment. Microsoft Defender for Identity can mark on‑prem AD groups as sensitive, monitor them for changes (such as membership or permission changes), and generate alerts. These alerts can be streamed natively into Microsoft Sentinel with minimal configuration. Other options focus on cloud identities or Office 365 workloads and do not provide native monitoring of on‑prem AD group changes.
$19
Get all 316 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
