Topic 1

Question 1

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• All Azure Active Directory (Azure AD) license editions include the same features
• You can manage an Azure Active Directory (Azure AD) tenant by using the Azure portal
• You must deploy Azure virtual machines to host an Azure Active Directory (Azure AD) tenant

Answer 1

• All Azure Active Directory (Azure AD) license editions include the same features → No
• You can manage an Azure Active Directory (Azure AD) tenant by using the Azure portal → Yes
• You must deploy Azure virtual machines to host an Azure Active Directory (Azure AD) tenant → No

Question 2

Select the answer that correctly completes the sentence.

• Azure Blueprints
• Azure Policy
• The Microsoft Cloud Adoption Framework for Azure
• A resource lock
  ↓
  provides best practices from Microsoft employees, partners, and customers, including tools and guidance to assist in an Azure deployment.

Answer 2

The Microsoft Cloud Adoption Framework for Azure

Question 3

Select the answer that correctly completes the sentence.

• Customer Lockbox
• Data loss prevention (DLP)
• eDiscovery
• A resource lock
  ↓
  is used to identify, hold, and export electronic information that might be used in an investigation.

Answer 3

eDiscovery

Question 4

Select the answer that correctly completes the sentence.

You can manage Microsoft Intune by using the
↓
- Azure Active Directory admin center
- Microsoft 365 compliance center
- Microsoft 365 Defender portal
- Microsoft Endpoint Manager admin center

Answer 4

Microsoft Endpoint Manager admin center

Question 5

Select the answer that correctly completes the sentence.

Federation is used to establish ______ between organizations.
↓
- multi-factor authentication (MFA)
- a trust relationship
- user account synchronization
- a VPN connection

Answer 5

a trust relationship

Question 6

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• Applying system updates increases an organization’s secure score in Microsoft Defender for Cloud
• The secure score in Microsoft Defender for Cloud can evaluate resources across multiple Azure subscriptions
• Enabling multi-factor authentication (MFA) increases an organization’s secure score in Microsoft Defender for Cloud

Answer 6

• Applying system updates increases an organization’s secure score in Microsoft Defender for Cloud → Yes
• The secure score in Microsoft Defender for Cloud can evaluate resources across multiple Azure subscriptions → Yes
• Enabling multi-factor authentication (MFA) increases an organization’s secure score in Microsoft Defender for Cloud → Yes

Question 7

Which score measures an organization’s progress in completing actions that help reduce risks associated to data protection and regulatory standards?

A. Microsoft Secure Score
B. Productivity Score
C. Secure score in Azure Security Center
D. Compliance score

Answer 7

D. Compliance score

Question 8

What do you use to provide real-time integration between Azure Sentinel and another security source?

A. Azure AD Connect
B. a Log Analytics workspace
C. Azure Information Protection
D. a connector

Answer 8

D. a connector

Question 9

Which Microsoft portal provides information about how Microsoft cloud services comply with regulatory standard, such as International Organization for
Standardization (ISO)?

A. the Microsoft Endpoint Manager admin center
B. Azure Cost Management + Billing
C. Microsoft Service Trust Portal
D. the Azure Active Directory admin center

Answer 9

C. Microsoft Service Trust Portal

Question 10

In the shared responsibility model for an Azure deployment, what is Microsoft solely responsible for managing?

A. the management of mobile devices
B. the permissions for the user data stored in Azure
C. the creation and management of user accounts
D. the management of the physical hardware

Answer 10

D. the management of the physical hardware

Question 11

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• Verify explicitly is one of the guiding principles of Zero Trust
• Assume breach is one of the guiding principles of Zero Trust
• The Zero Trust security model assumes that a firewall secures the internal network from external threats

Answer 11

• Verify explicitly is one of the guiding principles of Zero Trust → Yes
• Assume breach is one of the guiding principles of Zero Trust → Yes
• The Zero Trust security model assumes that a firewall secures the internal network from external threats → No

Question 12

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• Control is a key privacy principle of Microsoft
• Transparency is a key privacy principle of Microsoft
• Shared responsibility is a key privacy principle of Microsoft

Answer 12

• Control is a key privacy principle of Microsoft → Yes
• Transparency is a key privacy principle of Microsoft → Yes
• Shared responsibility is a key privacy principle of Microsoft → No

Question 13

Select the answer that correctly completes the sentence.

• Archiving
• Compressing
• Deduplicating
• Encrypting
  ↓
  a file makes the data in the file readable and usable to viewers that have the appropriate key.

Answer 13

Encrypting

Question 14

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• Digitally signing a document requires a private key
• Verifying the authenticity of a digitally signed document requires the public key of the signer
• Verifying the authenticity of a digitally signed document requires the private key of the signer

Answer 14

• Digitally signing a document requires a private key → Yes
• Verifying the authenticity of a digitally signed document requires the public key of the signer → Yes
• Verifying the authenticity of a digitally signed document requires the private key of the signer → No

Question 15

Select the answer that correctly completes the sentence.

When users sign in to the Azure portal, they are first
↓
- assigned permissions
- authenticated
- authorized
- resolved

Answer 15

authenticated

Question 16

Select the answer that correctly completes the sentence.

• Authentication
• Authorization
• Federation
• Single sign-on (SSO)
  ↓
  is the process of identifying whether a signed-in user can access a specific resource.

Answer 16

Authorization

Question 17

Select the answer that correctly completes the sentence.

• Active Directory Domain Services (AD DS)
• Active Directory forest trusts
• Azure Active Directory (Azure AD) business-to-business (B2B)
• Azure Active Directory business-to-consumer B2C (Azure AD B2C)
  ↓
  enables collaboration with business partners from external organizations such as suppliers, partners, and vendors. External users appear as guest users in the directory.

Answer 17

Azure Active Directory (Azure AD) business-to-business (B2B)

Question 18

In the Microsoft Cloud Adoption Framework for Azure, which two phases are addressed before the Ready phase?

A. Plan
B. Manage
C. Adopt
D. Govern
E. Define Strategy

Answer 18

A. Plan
E. Define Strategy

Question 19

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• In software as a service (SaaS), applying service packs to applications is the responsibility of the organization
• In infrastructure as a service (IaaS), managing the physical network is the responsibility of the cloud provider
• In all Azure cloud deployment types, managing the security of information and data is the responsibility of the organization

Answer 19

• In software as a service (SaaS), applying service packs to applications is the responsibility of the organization → No
• In infrastructure as a service (IaaS), managing the physical network is the responsibility of the cloud provider → Yes
• In all Azure cloud deployment types, managing the security of information and data is the responsibility of the organization → Yes

Question 20

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

• Azure AD Connect can be used to implement hybrid identity
• Hybrid identity requires the implementation of two Microsoft 365 tenants
• Authentication of hybrid identifies requires the synchronization of Active Directory Domain Services (AD DS) and Azure Active Directory (Azure AD)

Answer 20

• Azure AD Connect can be used to implement hybrid identity → Yes
• Hybrid identity requires the implementation of two Microsoft 365 tenants → No
• Authentication of hybrid identifies requires the synchronization of Active Directory Domain Services (AD DS) and Azure Active Directory (Azure AD) → Yes

Question 21

Select the answer that correctly completes the sentence.

• Azure Application Insights
• Azure Network Watcher
• Log Analytics workspaces
• Security baselines for Azure
  ↓
  provides benchmark recommendations and guidance for protecting Azure services

Answer 21

Security baselines for Azure

Question 22

What is an example of encryption at rest?

A. encrypting communications by using a site-to-site VPN
B. encrypting a virtual machine disk
C. accessing a website by using an encrypted HTTPS connection
D. sending an encrypted email

Answer 22

B. encrypting a virtual machine disk

Question 23

Which three statements accurately describe the guiding principles of Zero Trust?

A. Define the perimeter by physical locations.
B. Use identity as the primary security boundary.
C. Always verify the permissions of a user explicitly.
D. Always assume that the user system can be breached.
E. Use the network as the primary security boundary.

Answer 23

B. Use identity as the primary security boundary.
C. Always verify the permissions of a user explicitly.
D. Always assume that the user system can be breached.

Question 24

Which service should you use to view your Azure secure score?

• Alerts
• Application Insights
• Subscriptions
• Policy
• Azure AD Connect Health
• Security Center
• Advisor
• Monitor

Answer 24

Security Center

Question 25

You are evaluating the compliance score in Compliance Manager. Match the compliance score action subcategories to the appropriate actions. Action Subcategories - Corrective - Detective - Preventative Answer Area - Encrypt data at rest - Perform a system access audit - Make configuration changes in response to a security incident

Answer 25

- Preventative → Encrypt data at rest - Detective → Perform a system access audit - Corrective → Make configuration changes in response to a security incident

Question 26

Select the answer that correctly completes the sentence. Compliance Manager can be directly accessed from the ↓ - Microsoft 365 admin center - Microsoft 365 Defender portal - Microsoft 365 Compliance Center (Microsoft Purview) - Microsoft Support portal

Answer 26

Microsoft 365 Compliance Center (Microsoft Purview)

Question 27

For each of the following statements, select Yes if the statement is true. Otherwise, select No. - Enabling multi-factor authentication (MFA) increases the Microsoft Secure Score - A higher Microsoft Secure Score means a lower identified risk level in the Microsoft 365 - Microsoft Secure Score measures progress in completing actions based on controls that include key regulations and standards for data protection and governance

Answer 27

- Enabling multi-factor authentication (MFA) increases the Microsoft Secure Score → Yes - A higher Microsoft Secure Score means a lower identified risk level in the Microsoft 365 → Yes - Microsoft Secure Score measures progress in completing actions based on controls that include key regulations and standards for data protection and governance → No

Question 28

What can you use to provide a user with a two-hour window to complete an administrative task in Azure? A. Azure Active Directory (Azure AD) Privileged Identity Management (PIM) B. Azure Multi-Factor Authentication (MFA) C. Azure Active Directory (Azure AD) Identity Protection D. conditional access policies

Answer 28

A. Azure Active Directory (Azure AD) Privileged Identity Management (PIM)

Question 29

In a hybrid identity model, what can you use to sync identities between Active Directory Domain Services (AD DS) and Azure Active Directory (Azure AD)? A. Active Directory Federation Services (AD FS) B. Microsoft Sentinel C. Azure AD Connect D. Azure AD Privileged Identity Management (PIM)

Answer 29

C. Azure AD Connect

Question 30

For each of the following statements, select Yes if the statement is true. Otherwise, select No. - You can create custom roles in Azure Active Directory (Azure AD) - Global administrator is a role in Azure Active Directory (Azure AD) - An Azure Active Directory (Azure AD) user can be assigned only one role

Answer 30

- You can create custom roles in Azure Active Directory (Azure AD) → Yes - Global administrator is a role in Azure Active Directory (Azure AD) → Yes - An Azure Active Directory (Azure AD) user can be assigned only one role → No

Question 31

For each of the following statements, select Yes if the statement is true. Otherwise, select No. - Azure Active Directory (Azure AD) is deployed to an on-premises environment - Azure Active Directory (Azure AD) is provided as part of a Microsoft 365 subscription - Azure Active Directory (Azure AD) is an identity and access management service

Answer 31

- Azure Active Directory (Azure AD) is deployed to an on-premises environment → No - Azure Active Directory (Azure AD) is provided as part of a Microsoft 365 subscription → Yes - Azure Active Directory (Azure AD) is an identity and access management service → Yes

Question 32

Select the answer that correctly completes the sentence. With Windows Hello for Business, a user's biometric data used for authentication ↓ - is stored on an external device. - is stored on a local device only. - is stored in Azure Active Directory (Azure AD). - is replicated to all the devices designated by the user.

Answer 32

is stored on a local device only.

Question 33

What is the purpose of Azure Active Directory (Azure AD) Password Protection? A. to control how often users must change their passwords B. to identify devices to which users can sign in without using multi-factor authentication (MFA) C. to encrypt a password by using globally recognized encryption standards D. to prevent users from using specific words in their passwords

Answer 33

D. to prevent users from using specific words in their passwords

Question 34

Which Azure Active Directory (Azure AD) feature can you use to evaluate group membership and automatically remove users that no longer require membership in a group? A. access reviews B. managed identities C. conditional access policies D. Azure AD Identity Protection

Answer 34

A. access reviews

Question 35

Select the answer that correctly completes the sentence. - Multi-factor authentication (MFA) - Pass-through authentication - Password writeback - Single sign-on (SSO) ↓ requires additional verification, such as a verification code sent to a mobile phone.

Answer 35

Multi-factor authentication (MFA)

Question 36

For each of the following statements, select Yes if the statement is true. Otherwise, select No. - Conditional access policies can use the device state as a signal - Conditional access policies apply before first-factor authentication is complete - Conditional access policies can trigger multi-factor authentication (MFA) if a user attempts to access a specific application

Answer 36

- Conditional access policies can use the device state as a signal → Yes - Conditional access policies apply before first-factor authentication is complete → No - Conditional access policies can trigger multi-factor authentication (MFA) if a user attempts to access a specific application → Yes

Question 37

Select the answer that correctly completes the sentence. - Microsoft Defender for Cloud Apps - Microsoft Defender for Endpoint - Microsoft Defender for Identity - Microsoft Defender for Office 365 ↓ is a cloud-based solution that leverages on-premises Active Directory signals to identify, detect, and investigate advanced threats.

Answer 37

Microsoft Defender for Identity

Question 38

Select the answer that correctly completes the sentence. Microsoft Defender for Identity can identify advanced threats from ________ signals. ↓ - Azure Active Directory (Azure AD) - Azure AD Connect - on-premises Active Directory Domain Services (AD DS)

Answer 38

on-premises Active Directory Domain Services (AD DS)

Question 39

Select the answer that correctly completes the sentence. Azure Active Directory (Azure AD) is _________ used for authentication and authorization. ↓ - an extended detection and response (XDR) system - an identity provider - a management group - a security information and event management (SIEM) system

Answer 39

an identity provider

Question 40

Which Azure Active Directory (Azure AD) feature can you use to provide just-in-time (JIT) access to manage Azure resources? A. conditional access policies B. Azure AD Identity Protection C. Azure AD Privileged Identity Management (PIM) D. authentication method policies

Answer 40

C. Azure AD Privileged Identity Management (PIM)

Question 41

Which three authentication methods can be used by Azure Multi-Factor Authentication (MFA)? A. text message (SMS) B. Microsoft Authenticator app C. email verification D. phone call E. security question

Answer 41

A. text message (SMS) B. Microsoft Authenticator app D. phone call

Question 42

Which Microsoft 365 feature can you use to restrict communication and the sharing of information between members of two departments at your organization? A. sensitivity label policies B. Customer Lockbox C. information barriers D. Privileged Access Management (PAM)

Answer 42

C. information barriers

Question 43

For each of the following statements, select Yes if the statement is true. Otherwise, select No. - Conditional access policies always enforce the use of multi-factor authentication (MFA) - Conditional access policies can be used to block access to an application based on the location of the user - Conditional access policies only affect users who have Azure Active Directory (Azure AD)-joined devices

Answer 43

- Conditional access policies always enforce the use of multi-factor authentication (MFA) → No - Conditional access policies can be used to block access to an application based on the location of the user → Yes - Conditional access policies only affect users who have Azure Active Directory (Azure AD)-joined devices → No

Question 44

For each of the following statements, select Yes if the statement is true. Otherwise, select No. - Conditional access policies can be applied to global administrators - Conditional access policies are evaluated before a user is authenticated - Conditional access policies can use a device platform, such as Android or iOS, as a signal

Answer 44

- Conditional access policies can be applied to global administrators → Yes - Conditional access policies are evaluated before a user is authenticated → No - Conditional access policies can use a device platform, such as Android or iOS, as a signal → Yes