Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft 365 subscription.
You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.
You need to ensure that the devices are protected from malicious artifacts that were undetected by the third-party antivirus product.
Solution: You configure endpoint detection and response (EDR) in block mode.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Yes. When a third-party antivirus is installed, Microsoft Defender Antivirus runs in passive mode and does not provide primary real-time protection. However, enabling Endpoint Detection and Response (EDR) in block mode allows Microsoft Defender for Endpoint to detect and automatically block or remediate malicious artifacts that were missed by the third-party antivirus. This directly meets the goal of protecting the devices from undetected malicious artifacts.
Question 81
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft 365 subscription.
You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.
You need to ensure that the devices are protected from malicious artifacts that were undetected by the third-party antivirus product.
Solution: You configure Controlled folder access.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Controlled folder access is a Microsoft Defender Antivirus feature that relies on Defender being active. In this scenario, Defender Antivirus is in passive mode because a third-party antivirus is installed. As a result, controlled folder access will not provide protection against malicious artifacts missed by the third-party product. Therefore, this solution does not meet the stated goal.
Question 82
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft 365 subscription.
You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.
You need to ensure that the devices are protected from malicious artifacts that were undetected by the third-party antivirus product.
Solution: You enable automated investigation and response (AIR).
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: No. Enabling Automated Investigation and Response (AIR) alone does not meet the goal. With Microsoft Defender Antivirus running in passive mode, it does not actively scan or block threats. AIR depends on detection capabilities from Defender Antivirus or Microsoft Defender for Endpoint. To protect against malicious artifacts missed by the third-party antivirus, features like EDR in block mode are required. Therefore, AIR by itself is insufficient.
Question 83
You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security.
You start a Copilot for Security session and enter five prompts that each provide responses.
You need to create a promptbook that will use the prompts but will NOT contain the responses. The solution must minimize administrative effort.
What should you do?
A. Select each prompt, and then select Create promptbook.
B. Create a new promptbook and include each prompt.
C. Enter a new prompt that has the following input: Create a promptbook from my session prompts.
D. Share the session, and then select Create promptbook.
Show Answer
Correct Answer: A
Explanation: Copilot for Security supports creating a promptbook directly from an existing session by selecting the prompts you want and choosing **Create promptbook**. This action captures only the prompts (not the responses) and avoids recreating them manually, which minimizes administrative effort. Sharing a session or issuing a natural language command does not provide a built-in way to generate a promptbook.
Question 84
You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security.
You plan to run the following code to create a custom Copilot for Security plugin.
You need to specify a format and complete the code segment.
Which format should you use for the
variable?
A. API
B. GPT
C. KQL
D. SQL
Show Answer
Correct Answer: C
Explanation: When creating a custom Copilot for Security plugin, the variable that defines the skill format must align with supported plugin skill types. For Copilot for Security, custom skills are authored using either GPT or KQL, and KQL is required when the code segment represents queries against Microsoft security data sources. API and SQL formats are not valid for this scenario, making KQL the correct choice.
Question 85
You have a Microsoft 365 subscription that uses Microsoft Defender XDR.
You discover that when Microsoft Defender for Endpoint generates alerts for a commonly used executable file, it causes alert fatigue.
You need to tune the alerts.
Which two actions can an alert tuning rule perform for the alerts? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. delete
B. hide
C. resolve
D. merge
E. assign
Show Answer
Correct Answer: B, C
Explanation: In Microsoft Defender XDR, alert tuning rules can automatically take actions on matching alerts. The supported actions include hiding alerts to reduce noise and automatically resolving alerts that are known to be benign. Alert tuning rules cannot delete, merge, or assign alerts.
Question 86
You have a Microsoft 365 subscription that uses Microsoft Defender XDR.
You are investigating an incident.
You need to review the incident tasks that were performed. The solution must include a query that will display the incidents in a workbook, and then display the tasks of each incident in another grid.
Which table should you target in the query?
A. SecurityIncident
B. SecurityEvent
C. SentinelAudit
D. SecurityAlert
Show Answer
Correct Answer: A
Explanation: To review incidents and their associated tasks in Microsoft Defender XDR using a workbook with multiple grids, you must query the **SecurityIncident** table. This table contains incident-level data and related entities, including incident tasks, and supports workbook scenarios where one grid lists incidents and another shows tasks per incident. The other tables (SecurityEvent, SentinelAudit, SecurityAlert) do not store incident task details.
Question 87
You have a Microsoft 365 subscription that uses Microsoft Defender XDR.
You need to implement deception rules. The solution must ensure that you can limit the scope of the rules.
What should you create first?
A. device groups
B. device tags
C. honeytoken entity tags
D. sensitive entity tags
Show Answer
Correct Answer: B
Explanation: In Microsoft Defender XDR, deception rules are scoped using device tags, not device groups. When configuring deception rules, you select device tags to limit which devices the deception artifacts apply to. Therefore, device tags must be created first to control the scope.
Question 88
You have a Microsoft 365 subscription that uses Microsoft Purview.
Your company has a project named Project1.
You need to identify all the email messages that have the word Project1 in the subject line. The solution must search only the mailboxes of users that worked on Project1.
What should you do?
A. Perform a user data search.
B. Create a records management disposition.
C. Perform an audit search.
D. Perform a content search.
Show Answer
Correct Answer: D
Explanation: Microsoft Purview Content search is designed to search email content. It allows you to target specific mailboxes (only users who worked on Project1) and use a query to find messages with "Project1" in the subject line. Audit search tracks activities, records disposition manages retention, and "user data search" is not a valid Purview feature.
Question 89
HOTSPOT
-
You need to build a KQL query in a Microsoft Sentinel workspace. The query must return the SecurityEvent record for accounts that have the last record with an EventID value of 4624.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Dropdown 1:
| where EventID == 4624
Dropdown 2:
| summarize arg_max(TimeGenerated, *) by Account
Explanation: First determine the most recent event per Account using arg_max(TimeGenerated,*). Then filter those results to keep only accounts whose latest SecurityEvent has EventID 4624 (successful logon).
$19
Get all 370 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
