You have an Azure subscription that is linked to a Microsoft Entra tenant.
You plan deploy an enterprise application named App1. App1 requires LDAP to look up attributes related to Microsoft Entra users.
You need to recommend a solution to support the LDAP requirement.
What should you recommend?
A. Configure a Conditional Access policy that has a trusted network location.
B. Deploy Microsoft Entra Private Access.
C. Deploy Microsoft Entra Domain Services.
D. Implement pass-through authentication.
Show Answer
Correct Answer: C
Explanation: App1 requires LDAP to query user attributes. Microsoft Entra ID itself does not expose a traditional LDAP interface. Microsoft Entra Domain Services provides managed domain controllers that support LDAP/LDAPS and synchronize users from Microsoft Entra ID, enabling LDAP-based applications without deploying and managing your own AD DS. The other options do not provide LDAP functionality.
Question 22
HOTSPOT
-
Your company has offices in 10 countries.
You have a Microsoft 365 subscription that contains 1,000 users. Each user is assigned a Microsoft 365 E5 license.
You plan to deploy a compliance assessment solution. The solution must meet the following requirements:
• Ensure that compliance is assessed based on the regulations of the country of each office.
• Provide improvement action guidance to ensure compliance of the subscription.
You need to recommend the service that should be used to perform the assessments, and identify additional costs that will be incurred.
What should you recommend and what should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Use:
Microsoft Purview Compliance Manager
Additional costs:
Licenses for premium regulatory templates
Explanation: Microsoft Purview Compliance Manager assesses compliance against country- and region-specific regulations and provides actionable improvement guidance. With Microsoft 365 E5, the base service is included, but many country-specific regulatory assessments require premium regulatory templates, which incur additional licensing costs.
Question 23
HOTSPOT
-
You have a Microsoft Entra tenant named contoso.com that syncs with an Active Directory Domain Services (AD DS) domain named corp.contoso.com The domain contains 100 devices that have the following configurations:
• Hybrid joined
• Enrolled in Microsoft Intune
• Disabled built-in local administrator account
• Contain a local user account named User1 that is a member of the local administrators group
You need to recommend a solution that meets the following requirements:
• Ensures that the Directory Services Restore Mode (DSRM) credentials of each domain controller are backed up to the AD DS database
• Ensures that the password of User1 changes automatically every 60 days
• Ensures that the credentials of User1 are stored in an encrypted store
• Prevents the User1 password from being changed manually
• Whenever possible, stores all credentials in contoso.com
• Minimizes administrative effort
What should you include in the recommendation? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: For the User1 credentials:
Windows Local Administrator Password Solution (Windows LAPS)
For the DSRM credentials:
Windows Local Administrator Password Solution (Windows LAPS)
Explanation: Windows LAPS automatically rotates local account passwords, prevents manual changes, and stores them encrypted in AD DS or Microsoft Entra ID, minimizing admin effort. It also supports backing up DSRM passwords for domain controllers into AD DS, meeting all security and storage requirements.
Question 23
You have a Microsoft 365 subscription that uses Microsoft Purview.
You need to recommend a solution that will provide guidance on how to ensure that Personally Identifiable Information (PII) in the subscription adheres to local privacy regulations. The solution must minimize administrative effort.
Which Microsoft Purview solution should you include in the recommendation?
A. Data Loss Prevention
B. Information Protection
C. Insider Risk Management
D. Compliance Manager
Show Answer
Correct Answer: D
Explanation: Microsoft Purview Compliance Manager provides built-in assessments, regulatory templates, and actionable guidance to help ensure PII handling aligns with local privacy regulations while minimizing administrative effort through automated scoring and recommendations.
Question 24
HOTSPOT
-
You have a Microsoft Entra tenant. The tenant contains a security group named Group1. Group1 contains the members of your company's IT support team.
You have an Azure subscription. The subscription contains 800 Windows devices that are Microsoft Entra joined and 200 Windows devices that are Microsoft Entra registered.
You have 200 standalone macOS devices.
You deploy 10 Windows devices that are Microsoft Entra joined and have the Microsoft Entra ExtensionAttribute1 value set to SecureWorkstation.
You need to recommend a Conditional Access solution that meets the following requirements:
• Only allows access to Microsoft Entra resources from devices that run Windows 10 or Windows 11
• Restricts Windows Azure Service Management API access to the following users:
o The members of Group1
o Users that authenticate by using multifactor authentication (MFA)
o Users that connect from a device that has the SecureWorkstation ExtensionAttribute1
The solution must minimize the number of required policies and maximize security.
What should include in the recommendation? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Identity type:
Service principal
Signal source:
Device platform
Explanation: Access to the Windows Azure Service Management API is controlled via a workload (cloud app/service principal). Evaluating Windows 10/11 and the SecureWorkstation ExtensionAttribute1 requires device-based conditions, which are provided by the Device platform signal source.
Question 24
HOTSPOT
-
You have an Azure subscription.
You enable the Defender Cloud Security Posture Management (CSPM) plan.
You need to optimize the security posture of the subscription by implementing Microsoft Defender for Cloud secure score recommendations.
Which security policy should you enable, and which factors will have a direct impact on the secure score? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: With Defender CSPM enabled, the Azure CSPM security policy drives secure score improvements. The secure score is directly influenced by implemented recommendations, their risk-based prioritization, and whether affected resources are classified as critical assets.
Question 25
HOTSPOT
-
You have an Azure subscription that contains Azure App Service apps. The apps have the following characteristics:
• The apps are deployed by using continuous integration and continuous deployment (CI/CD) pipelines in Azure DevOps.
• The apps are deployed to a test environment first, and then to a production environment.
• The source code for the apps is stored in Azure Repos.
You plan to implement DevSecOps controls based on the Microsoft Cloud Adoption Framework for Azure.
You need to recommend testing controls to meet the following requirements:
• All the source code must be tested for security vulnerabilities in Azure Repos before deploying the apps.
• Once the apps are deployed to the test environment, they must be tested for security vulnerabilities.
Which testing method should you recommend for each stage? To answer, select the options in the answer area.
NOTE: Each correct answer is worth one point.
Show Answer
Correct Answer: Pre-deployment:
Static application security testing (SAST)
Post-deployment to the test environment:
Dynamic application security testing (DAST)
Explanation: SAST analyzes source code in Azure Repos for vulnerabilities before deployment. DAST tests the running application in the test environment to identify runtime and configuration-related security issues.
Question 26
HOTSPOT
-
You have an Azure subscription that contains multiple apps. The apps are deployed by using continuous integration and continuous delivery (CI/CD) pipelines in Azure DevOps.
You need to integrate static application security testing (SAST) and security smoke testing into the pipelines based on Microsoft Cloud Adoption Framework for Azure principles.
At which stage of the CI/CID process should each type of test be integrated? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: SAST: Build and test
Security smoke testing: Go to production
Explanation: SAST is integrated early in the pipeline during the build and test stage to detect code vulnerabilities as soon as possible. Security smoke testing is performed after deployment, just before or as part of going to production, to validate basic security controls in the running environment.
Question 27
You have a Microsoft 365 E5 subscription. The subscription contains 500 devices that run Windows 11 Pro and are enrolled in Microsoft Intune.
You need to evaluate the use of Microsoft Defender Vulnerability Management to provide recommended configuration changes for the devices.
Which Endpoint security settings should you use to review the recommended changes?
A. Security tasks
B. Attack surface reduction
C. End point detection and response
D. Device compliance
Show Answer
Correct Answer: A
Explanation: Microsoft Defender Vulnerability Management surfaces recommended configuration changes as **Security tasks**. These tasks are integrated into Intune under Endpoint security and allow admins to review, accept, and track remediation actions based on Defender for Endpoint vulnerability assessments.
Question 28
HOTSPOT
-
You have a Microsoft 365 E5 subscription. The subscription contains 1,000 devices that run Windows 11 Pro and are enrolled in Microsoft Intune.
You need to recommend a Microsoft Defender for Cloud Apps solution that meets the following requirements:
• When a user downloads a file from Microsoft SharePoint Online, a label must be applied to the file in real time based on the file’s contents.
• Only users that use Intune-compliant devices must be able to sign in to Dropbox.
Which type of policy should you recommend for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Session policy
Access policy
Explanation: Session policies use Conditional Access App Control to inspect and control downloads in real time and can apply labels based on file content. Access policies integrate with Microsoft Entra Conditional Access to allow or block app sign-in based on device compliance (Intune-compliant devices).
$19
Get all 316 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
