You have a Microsoft 365 E5 subscription that contains the users shown in the following table.
You configure Microsoft Entra Internet Access.
Which users can manage Microsoft Entra Internet Access?
A. User1 only
B. User2 only
C. User3 only
D. User1 and User2 only
E. User1, User2 and User3
Show Answer
Correct Answer: D
Explanation: Microsoft Entra Internet Access can be managed by users assigned the Global Secure Access Administrator role and by Global Administrators. A Privileged Role Administrator can assign roles but does not directly manage Microsoft Entra Internet Access. Therefore, the users holding the Global Secure Access Administrator and Global Administrator roles can manage the service.
Question 76
HOTSPOT
-
You have an Azure subscription named Sub1 that contains an Azure key vault named Vault1 and an Azure Automation account named Automation1.
You need to ensure that Automation1 can access Vault1. The solution1 must meet the following requirements:
• Ensure that if Automation1 is deleted, the permissions granted for Vault1 will be removed automatically.
• Ensure that runbooks created in Automation1 can read secret values stored in Vault1.
• Follow the principle of least privilege.
What should you configure for Automation1, and which built-in role should Automation1 use to access Vault1? To answer, select the appropriate options in the answer area.
NOTE: Each correct answer is worth one point.
Show Answer
Correct Answer: A system-assigned managed identity
Key Vault Secrets User
Explanation: A system-assigned managed identity is tied to the Automation account lifecycle, so deleting the Automation account removes the identity and its permissions. The Key Vault Secrets User role provides the least-privileged access required to read secret values from Key Vault.
Question 78
HOTSPOT
-
Your on-premises network contains a Hyper-V cluster. The cluster contains the virtual machines shown in the following table.
You have a Microsoft Sentinel workspace named SW1.
You have a data collection rule (DCR) that has the following configurations:
• Name: DCR1
• Destination: SW1
• Platform type: All
• Data collection endpoint: None
• Data source: Windows event logs, Linux syslog
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Server1: No
Server2: No
Server3: No
Explanation: For on-premises machines, Data Collection Rules target Azure resources (typically Azure Arc-enabled servers) and data collection requires the Azure Monitor Agent (AMA). Machines without Azure Arc can't be added as DCR resources, and machines without AMA can't collect/send the configured logs.
Question 79
HOTSPOT
-
You have an on-premises Linux server that runs a background process named App1 and has the Azure Connected Machine agent installed.
You have a Microsoft Sentinel workspace named WS1.
You need to configure a data collection rule (DCR) named DCR1 that will use the Syslog via AMA connector to collect messages related to App1. The solution must meet the following requirements:
• Only collect messages that have a priority level of critical.
• Minimize the volume of data collected.
Which facility and log level should you configure for DCR1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: A background application is typically logged under the DAEMON facility. With Syslog via AMA, the configured log level acts as a minimum severity threshold (collecting that severity and more severe). Since LOG_CRIT is not available, LOG_ERR is the closest option that still includes critical messages while minimizing additional data.
Question 80
You have a Microsoft 365 subscription that uses Microsoft Copilot for Security.
You create a promptbook named Book1.
For Book1, you need to create a prompt that contains an input named IncidentID.
How should you format IncidentID?
A.
B. ##IncidentID##
C. [IncidentID]
D. $IncidentID$
Show Answer
Correct Answer: A
Explanation: In Microsoft Copilot for Security promptbooks, required input variables are specified using angle brackets. Therefore the input named IncidentID should be formatted as <IncidentID>. The other placeholder styles (##IncidentID##, [IncidentID], and $IncidentID$) are not the documented promptbook input syntax.
Question 81
You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1.
You need to enable Microsoft Defender for Cloud Apps session control for Site1.
Which type of policy should you create first?
A. access
B. session
C. app governance
D. Conditional Access
Show Answer
Correct Answer: D
Explanation: Microsoft Defender for Cloud Apps session control is enabled by integrating with Microsoft Entra Conditional Access. The first step is to create a Conditional Access policy that routes SharePoint Online sessions through Conditional Access App Control. After that, session policies can be created and applied within Defender for Cloud Apps.
Question 82
You have a Microsoft 365 E5 subscription.
You need to search the Microsoft Purview audit log by using PowerShell on a Windows device.
What should you do first?
A. Install the Microsoft Graph PowerShell module.
B. Enable PowerShell remoting.
C. Install the Microsoft Exchange Online PowerShell module.
D. Modify the TrustedHosts list.
Show Answer
Correct Answer: C
Explanation: The Search-UnifiedAuditLog cmdlet used to query the Microsoft Purview unified audit log is provided through the Exchange Online PowerShell module. Before you can connect and run the audit log search, you must install the Exchange Online PowerShell module. PowerShell remoting and TrustedHosts configuration are not required for this scenario, and the Microsoft Graph PowerShell module does not provide the Search-UnifiedAuditLog cmdlet.
Question 83
You have a Microsoft 365 E5 subscription that contains a database server named DB1. DB1 is onboarded to Microsoft Defender XDR.
You need to ensure that DB1 appears on the attack surface map.
What should you configure?
A. an asset rule
B. a critical asset rule
C. a sensitive entity tag
D. a honeytoken entity tag
Show Answer
Correct Answer: B
Explanation: Attack surface map in Microsoft Defender XDR uses critical assets to prioritize and visualize important devices. Configuring a critical asset rule marks DB1 as a critical asset so it appears appropriately on the attack surface map. Sensitive entity tags are a Defender for Identity feature and require that capability; the question only states the server is onboarded to Defender XDR.
Question 84
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft 365 subscription.
You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.
All Windows devices are onboarded to Microsoft Defender for Endpoint.
You need to ensure that the devices are protected from malicious artifacts that were undetected by the third-party antivirus product.
Solution: You enable Live Response.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Live Response is an investigation and manual remediation feature in Microsoft Defender for Endpoint. It does not provide automatic protection against malicious artifacts missed by a third-party antivirus. To automatically block threats when Microsoft Defender Antivirus is in passive mode, the relevant capability is EDR in block mode, not Live Response.
Question 85
You have a Microsoft 365 E5 subscription that contains a user named User1. The subscription uses Microsoft 365 Copilot for Security. Copilot for Security uses the Sentinel plugin.
User1 is assigned the Copilot Contributor role.
During an investigation, User1 submits a prompt and receives a notification that Copilot for Security cannot respond to requests because the security compute unit (SCU) usage is nearing the provisioned capacity limit.
You need to ensure that User1 can use Copilot for Security to generate a successful response.
What should User1 do?
A. Wait one hour and resubmit the prompt.
B. Update the provisioned SCUs.
C. Run the Microsoft Sentinel Optimization Workbook.
D. Open a second Copilot for Security session and submit the prompt.
Show Answer
Correct Answer: A
Explanation: The notification indicates that the provisioned Security Compute Unit (SCU) capacity is nearing its hourly limit. A Copilot Contributor cannot manage or increase SCU capacity; that requires Azure capacity owner/contributor or Security Copilot owner permissions. Since the question asks what User1 should do, the only action User1 can take to successfully resubmit is to wait until the next hourly capacity window and then resubmit the prompt. Running the Sentinel Optimization Workbook or opening another session does not increase available SCU capacity.
$19
Get all 383 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
