Test Flashcards

In a Microsoft 365 subscription, you can set up various Advanced Threat Protection (ATP) rules. In the Threat management dashboard, you must allow a user named User1 to see ATP reports. Which role gives User1 the permissions he or she needs?

Answer: Security reader

The Security reader role in Microsoft 365 is specifically designed to allow users to view security-related reports and alerts, including those from Advanced Threat Protection (ATP). This role provides read-only access to security dashboards and reports without granting permissions to modify settings or take actions. It's ideal for users who need to monitor security posture without administrative privileges.

You're a subscriber to Microsoft 365. You must ensure that multi-factor authentication (MFA) is enabled by default for all users with the Exchange administrator role. What method should you employ in order to reach your objective?

Answer: Microsoft Azure Active Directory (Azure AD) Privileged Identity Management

Azure AD Privileged Identity Management (PIM) is the correct tool to ensure that multi-factor authentication (MFA) is enabled by default for users with administrative roles like Exchange administrator. PIM allows administrators to enforce MFA for role activation, requiring users to complete an MFA challenge before they can assume a privileged role. This significantly strengthens the security of high-impact accounts.

You must satisfy User9's technological criteria. What are your options?

Answer: Assign the Global administrator role to User9

The Global administrator role in Microsoft 365 grants the highest level of permissions across all Microsoft 365 services and features. If User9 needs to satisfy broad technological requirements, implying extensive administrative control, assigning the Global administrator role would provide the necessary access. However, this role should be assigned with extreme caution due to its wide-ranging privileges.

In the MFA configuration, which IP address space should you use?

Answer: 192.168.16.0/20

When configuring trusted IPs for MFA, internal network ranges are often excluded from MFA prompts for convenience. The IP address space 192.168.16.0/20 is a private IP range commonly used for internal corporate networks. This range allows for a significant number of hosts (4096 addresses), making it suitable for defining a corporate network segment where MFA trusted IPs might be applied.

You must offer a solution for the user administrators that satisfies the auditing security criteria. Which blade from the Azure Active Directory admin center should you recommend?

Answer: Sign-ins

The 'Sign-ins' blade in the Azure Active Directory admin center is essential for auditing security criteria related to user administrators. It provides a comprehensive log of all sign-in activities, including successful and failed attempts, location, device information, and applied Conditional Access policies. This data is crucial for monitoring administrator activity, detecting suspicious behavior, and ensuring compliance with security policies.

Microsoft 365 Defender is enabled on your Microsoft 365 E5 subscription. You intend to deploy App1, a third-party app that will receive Microsoft 365 Defender alarm data. To send the alarm data to App1, what format will Microsoft 365 Defender use?

Answer: JSON

Microsoft 365 Defender (formerly Azure ATP) typically uses JSON (JavaScript Object Notation) format when integrating with third-party applications for sending alarm data. JSON is a lightweight and human-readable data interchange format widely used in web services and APIs. Its structured nature makes it easy for applications to parse and process security alerts and information.

Microsoft 365 is a subscription that your firm owns. Users are not allowed to enroll personal devices in mobile device management, according to the corporation (MDM). Personal iOS devices are used by users in the sales department. You must guarantee that sales department users can access Power BI data in your tenant using the Microsoft Power BI app on iOS devices. Users should not be able to back up the app's data to iCloud. What should you come up with?

Answer: an app protection policy in Microsoft Intune

An app protection policy in Microsoft Intune (Mobile Application Management, MAM) is the ideal solution for this scenario. It allows organizations to protect corporate data within specific applications, even on personal devices not enrolled in MDM. These policies can enforce restrictions like preventing data backup to iCloud, restricting copy/paste, and requiring a PIN for app access, without managing the entire device.

You're a subscriber to Microsoft 365 E5. To identify documents stored in Microsoft SharePomt Online that contain private information, you must use Microsoft Cloud App Security. What should you include in your Cloud App Security strategy?

Answer: a data source and an app discovery policy

To identify documents containing private information in SharePoint Online using Microsoft Cloud App Security, you first need to integrate SharePoint as a connected app, which acts as a data source. While file policies are directly responsible for scanning content, an 'app discovery policy' in a broader sense contributes to the overall strategy by ensuring Cloud App Security is actively monitoring and understanding the usage patterns of sanctioned applications like SharePoint, alongside connecting it as a data source.

You have a Microsoft 365 subscription and an Azure Active Directory (Azure AD) tenant named contoso.com. The Microsoft SharePoint Newsfeed is used by all users on contoso.com. You must ensure that all of your users are using Yammer.com. What are your options?

Answer: From the SharePoint admin center, modify the Enterprise Social Collaboration settings

To ensure all users are using Yammer.com instead of the SharePoint Newsfeed, you need to configure the Enterprise Social Collaboration settings within the SharePoint admin center. This setting allows administrators to specify Yammer as the default social experience for SharePoint, effectively replacing the native Newsfeed functionality. This directs users to Yammer for social interactions and collaboration.