MS-102 Security & Compliance 4

Question 1

Which Microsoft 365 feature allows an admin to query raw event data across endpoints, emails, and identities using Kusto Query Language (KQL)?

Accepted Answer

Advanced Hunting

Answer

Advanced Hunting in Microsoft 365 Defender uses KQL to query up to 30 days of raw telemetry across all protected workloads.

Question 2

An admin wants to ensure that high-risk sign-ins require additional verification automatically. Which Azure AD feature should be configured?

Accepted Answer

Identity Protection risk-based Conditional Access policy

Answer

Azure AD Identity Protection can evaluate sign-in risk level and trigger Conditional Access policies requiring MFA or blocking access for high-risk logins.

Question 3

What is the function of Microsoft Purview Compliance Manager?

Accepted Answer

Provides risk assessments and improvement actions for regulatory compliance

Answer

Compliance Manager assesses the tenant against regulatory frameworks and provides a compliance score with actionable improvement recommendations.

Question 4

A Microsoft 365 admin receives an alert that a user account may be compromised. Which Microsoft 365 Defender action can directly force a password reset and revoke sessions?

Accepted Answer

Remediate user via Identity investigation actions

Answer

In Microsoft 365 Defender, identity investigation actions allow admins to force password resets and revoke active sessions for compromised accounts.

Question 5

Which Microsoft Purview capability monitors employee emails and Teams messages for policy violations such as harassment or regulatory misconduct?

Accepted Answer

Communication Compliance

Answer

Communication Compliance reviews messages against configured policies to detect inappropriate language, sensitive data sharing, or regulatory violations.

(MS-102) Microsoft 365 Administrator Expert Practice Test

(MS-102) Microsoft 365 Administrator Expert Practice Test

MS-102 Security & Compliance 4