Test Flashcards

Your company's Microsoft 365 subscription is your responsibility. The corporation implements a security policy requiring DLP incident reports to be provided to legal department users automatically. You must set up the reports to be distributed as frequently as possible via email. Which of the following options should you choose?

Answer: Weekly

When configuring Data Loss Prevention (DLP) incident reports in Microsoft 365 to be automatically provided to users via email, the most frequent distribution option available is weekly. While DLP incidents can be monitored in real-time within the compliance center, the scheduled email reports for these incidents are typically limited to a weekly cadence.

You used the Security & Compliance admin center to upload a number of archive PST files to Microsoft 365 earlier. You discover that the PST files have been removed from Microsoft 365 45 days later when you try to run an import job for them. Which of the following is the amount of days Microsoft 365 keeps PST files before automatically deleting them?

Answer: 30 days

When PST files are uploaded to Microsoft 365 for import, they are temporarily stored in a secure Azure Storage location. Microsoft 365 automatically deletes these uploaded PST files from this storage location after a period of 30 days. Therefore, if an import job is not initiated or completed within 30 days of the upload, the files will be removed, requiring re-upload if needed.

You are a subscriber to Microsoft 365 E5. When users attempt to access Microsoft SharePoint Online resources, you must guarantee that they are prompted for multi-factor authentication (MFA). When attempting to access other Microsoft 365 services, users should not be requested for MFA. What are your options?

Answer: Create a conditional access policy in the Azure Active Directory admin center

To enforce multi-factor authentication (MFA) specifically for access to Microsoft SharePoint Online resources while allowing access to other Microsoft 365 services without MFA, you should create a Conditional Access policy. These policies, configured in the Azure Active Directory admin center, allow granular control over access based on conditions like the target application, user group, or device state, enabling you to apply MFA only when SharePoint Online is accessed.

You're a subscriber to Microsoft 365. In the subscription, you recently configured a Microsoft SharePoint Online tenant. You intend to create a policy for alerts. You must guarantee that an alert is generated only if malware is found in more than five SharePoint Online documents in a 10-minute period. What should you start with?

Answer: Deploy Windows Defender Advanced Threat Protection (Windows Defender ATP)

To generate an alert when malware is found in more than five SharePoint Online documents within a 10-minute period, you need advanced threat protection capabilities for your cloud services. Deploying Windows Defender Advanced Threat Protection (now Microsoft Defender for Endpoint, which integrates with Microsoft Defender for Office 365) provides the necessary security intelligence and alerting mechanisms to detect and respond to such specific malware threats within SharePoint Online.

You're a subscriber to Microsoft 365. A data loss prevention (DLP) policy is set up. Users are wrongly tagging content as false positive, allowing the DLP policy to be bypassed. You must prevent users from circumventing the DLP policy. What should you set up?

Answer: user overrides

To prevent users from circumventing a Data Loss Prevention (DLP) policy by wrongly tagging content as a false positive, you need to manage the 'user overrides' setting within the DLP policy. User overrides allow users to bypass a policy if they provide a justification. By configuring or disabling these overrides, you can control whether users have the ability to bypass the DLP policy, thereby preventing unauthorized circumvention.

Contoso.com is an on-premises Active Directory domain on your network. There are 1,000 Windows 10 devices on the domain. You deploy Windows Defender Advanced Threat Protection (ATP) for 10 test devices as a proof of concept (PoC). You configure Windows Defender ATP-related data to be stored in the United States during the onboarding process. In Europe, you want to connect all devices to Windows Defender ATP data. What should you start with?

Answer: Offboard the test devices

The data storage location for Microsoft Defender for Endpoint (formerly Windows Defender ATP) is chosen during the initial onboarding of the tenant. To change this location from the United States to Europe, all currently onboarded devices must first be offboarded from the service. After offboarding, you can then re-onboard the devices, and during this process, you will be prompted to select the desired new data storage location for your organization.

TPT Limited has one Active Directory domain and two Microsoft Azure Active Directory (Azure AD) tenants on its network. TPT Limited's administrator, Robert, is working on directory synchronization for both Azure AD tenants. Some Active Directory users will be present in each tenant. What should the solution for the next directory synchronization contain?

Answer: Deploy two Azure AD Connect servers, and then utilize organizational unit (OU)-based filtering to filter the users for each tenant.

When synchronizing a single on-premises Active Directory domain with two separate Azure AD tenants, Microsoft's recommended architecture is to deploy two distinct Azure AD Connect servers. Each server should be configured to synchronize with one specific Azure AD tenant. To ensure that only the correct users are synchronized to each tenant, organizational unit (OU)-based filtering should be utilized on each Azure AD Connect server.

TPT Limited has a Microsoft 365 subscription and a testpreptraining.com Azure Active Directory (Azure AD) tenant with Azure AD Identity Protection enabled. The tenant has a user named User1 who should be able to check the list of users who have been flagged for risk in Azure AD Identity Protection. <br? According to the concept of least privilege, which role should be provided to User1?

Answer: Security reader

To allow User1 to check the list of users flagged for risk in Azure AD Identity Protection while adhering to the principle of least privilege, the Security Reader role should be assigned. This role provides read-only access to security-related information, including identity protection reports and risk detections, without granting any permissions to modify settings or user accounts.

You're a Microsoft 365 subscriber. App1 is a line-of-business application that users can access through the My Apps site. You utilize Conditional Access App Control to set a conditional access policy for App1 after some recent security breaches. If App1 detects impossible travel for a user, you must be notified via email. The solution must ensure that only App1 generates alerts. What are your options?

Answer: Modify the impossible travel alert policy in Microsoft Cloud App Security.

To receive email notifications specifically when App1 detects an 'impossible travel' anomaly, and to ensure alerts only originate from App1, you need to modify the existing impossible travel alert policy within Microsoft Cloud App Security (MCAS). MCAS is responsible for monitoring cloud app activities and has built-in anomaly detection policies that can be configured to generate alerts and send notifications based on specific applications or conditions.