HOTSPOT
-
You have a Microsoft 365 E5 subscription that has a Conditional Access policy named Policy1.
You need to perform the following actions:
• Create a Conditional Access App Control custom policy named Custom1.
• Configure Policy1 to use Custom1.
What should you use co create Custom1, and in which settings of Policy1 should you enable Conditional Access App Control? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Microsoft Defender portal
Session
Explanation: Conditional Access App Control custom policies are created in Microsoft Defender for Cloud Apps (Microsoft Defender portal). In the Conditional Access policy, App Control is enabled under Session controls (Use Conditional Access App Control) to apply the custom policy.
Question 50
You have a Microsoft 365 E5 subscription that contains a device named Device1.
From the Microsoft Defender portal, you discover that an alert was triggered for Device1.
From the Device inventory page, you isolate Device1.
You need to collect a list of installed programs on Device1.
What should you do?
A. Run an advanced hunting query against the DeviceProcessEvents table.
B. Run an advanced hunting query against the DeviceTvmSoftwareInventory table.
C. Initiate an automated investigation and view the results in the Action center.
D. Initiate a live response session and run the processes command.
Show Answer
Correct Answer: B
Explanation: The DeviceTvmSoftwareInventory table in Advanced Hunting provides a detailed inventory of software installed on devices, including name, version, and publisher. This is the correct way to collect a list of installed programs from the Microsoft Defender portal, even when the device is isolated.
Question 52
HOTSPOT
-
You have an Azure subscription that uses Microsoft Defender for Cloud.
You need to use an Azure Resource Manager (ARM) template to create a workflow automation that will trigger a logic app when specific alerts are received by Microsoft Defender for Cloud.
How should you complete the template? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Microsoft.Logic
Explanation: Workflow automations in Microsoft Defender for Cloud reference an existing Logic App. In ARM templates, Logic Apps are defined under the Microsoft.Logic/workflows resource provider, so the logicAppResourceId must use Microsoft.Logic.
Question 53
HOTSPOT
-
You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named contoso.com. Contoso.com contains a user named User1. Sub1 contains a Microsoft Sentinel workspace.
You provision a Microsoft Copilot for Security capacity.
You need to ensure that User1 can use Copilot for Security to perform the following tasks:
• Update the data sharing and feedback options.
• Investigate Microsoft Sentinel incidents.
The solution must follow the principle of least privilege.
Which role should you assign to User1 for each task? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Update the data sharing and feedback options:
Security Administrator
Investigate Microsoft Sentinel incidents:
Microsoft Sentinel Responder
Explanation: Security Administrator inherits the Copilot owner capabilities required to manage Copilot for Security data sharing and feedback settings without requiring Global Administrator.
Microsoft Sentinel Responder provides the necessary permissions to investigate and respond to Sentinel incidents, aligning with least-privilege requirements.
Question 54
HOTSPOT
-
You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains two Azure key vaults named KV1 and KV2 that use Azure role-based access control (Azure RBAC).
The subscription contains the users shown in the following table.
KV1 contains a secret named Secret1. KV2 contains a secret named Secret2.
Which users can read the values of each secret? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Secret1:
User1 and User3 only
Secret2:
User1 only
Explanation: Key Vault Administrator at subscription scope can read secrets in all vaults (KV1, KV2). Key Vault Reader has no data-plane access to secret values. Key Vault Secrets User can read secrets only at the assigned vault scope (KV1), not KV2.
Question 55
You have a Microsoft 365 E5 subscription that contains the users shown in the following table.
You configure Microsoft Entra Internet Access.
Which users can manage Microsoft Entra Internet Access?
A. User1 only
B. User2 only
C. User3 only
D. User1 and User2 only
E. User1, User2 and User3
Show Answer
Correct Answer: D
Explanation: Microsoft Entra Internet Access is managed by specific roles such as Global Secure Access Administrator or Global Administrator. A Privileged Role Administrator cannot directly manage Internet Access settings but can assign the required roles. Based on the typical role mapping in such questions, User1 (Global Administrator) and User2 (Global Secure Access Administrator) can manage Microsoft Entra Internet Access, while User3 cannot.
Question 56
HOTSPOT
-
You have an Azure subscription named Sub1 that contains an Azure key vault named Vault1 and an Azure Automation account named Automation1.
You need to ensure that Automation1 can access Vault1. The solution1 must meet the following requirements:
• Ensure that if Automation1 is deleted, the permissions granted for Vault1 will be removed automatically.
• Ensure that runbooks created in Automation1 can read secret values stored in Vault1.
• Follow the principle of least privilege.
What should you configure for Automation1, and which built-in role should Automation1 use to access Vault1? To answer, select the appropriate options in the answer area.
NOTE: Each correct answer is worth one point.
Show Answer
Correct Answer: A system-assigned managed identity
Key Vault Secrets User
Explanation: A system-assigned managed identity is tied to the lifecycle of the Automation account, so its permissions are removed automatically when the account is deleted. Granting the Key Vault Secrets User role allows runbooks to read secret values only, satisfying least-privilege access without unnecessary permissions.
Question 57
You have a Microsoft 365 E5 subscription.
You need to configure Microsoft Defender XDR automatic attack disruption to use signals generated by Microsoft Defender for Cloud Apps.
Which two actions should you perform for Defender for Cloud Apps in the Microsoft Defender portal? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Enable the Microsoft 365 connector.
B. Add a log collector for automatic log upload.
C. Turn on app governance.
D. Deploy Cloud Discovery user enrichment.
E. From Information protection, enable file monitoring.
Show Answer
Correct Answer: A, C
Explanation: To allow Microsoft Defender XDR automatic attack disruption to use signals from Microsoft Defender for Cloud Apps, Defender for Cloud Apps must be properly connected and able to analyze SaaS activity. Enabling the Microsoft 365 connector integrates Defender for Cloud Apps with Microsoft 365 workloads so relevant signals are available. Turning on App Governance enables deep visibility and monitoring of OAuth apps and their behavior, which is required for generating the attack signals consumed by automatic attack disruption. Other options, such as log collectors, Cloud Discovery enrichment, or file monitoring, are not prerequisites for this scenario.
Question 58
HOTSPOT
-
Your on-premises network contains a Hyper-V cluster. The cluster contains the virtual machines shown in the following table.
You have a Microsoft Sentinel workspace named SW1.
You have a data collection rule (DCR) that has the following configurations:
• Name: DCR1
• Destination: SW1
• Platform type: All
• Data collection endpoint: None
• Data source: Windows event logs, Linux syslog
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
Yes
No
Explanation: On‑prem machines must be Azure Arc–enabled to be added as resources to a DCR. The Azure Monitor Agent (AMA) is required for data collection and is installed automatically when a DCR is associated with an Arc‑enabled machine.
Server1: No Azure Arc → cannot be added to DCR, legacy agent is insufficient.
Server2: Azure Arc installed → can be added; AMA can be installed via DCR to collect specific Windows events.
Server3: No Azure Arc → AMA alone cannot send syslog via DCR.
Question 59
HOTSPOT
-
You have an on-premises Linux server that runs a background process named App1 and has the Azure Connected Machine agent installed.
You have a Microsoft Sentinel workspace named WS1.
You need to configure a data collection rule (DCR) named DCR1 that will use the Syslog via AMA connector to collect messages related to App1. The solution must meet the following requirements:
• Only collect messages that have a priority level of critical.
• Minimize the volume of data collected.
Which facility and log level should you configure for DCR1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: To minimize data volume, select the narrowest facility and the highest severity. LOG_AUTH limits collection to authentication-related syslog messages, and LOG_EMERG collects only the most severe events, resulting in the smallest possible dataset while meeting the critical-severity requirement.
$19
Get all 370 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
