- (Exam Topic 4)
Your company has a Microsoft 365 subscription that uses an Azure Active Directory (Azure AD) tenant named contoso.com.
A user named User1 is a member of a dynamic group named Group1. User1 reports that he cannot access documents shared to Group1. You discover that User1 is no longer a member of Group1.
You suspect that an administrator made a change that caused User1 to be removed from Group1. You need to identify which administrator made the change.
Which audit log activity should you search in the Security & Compliance admin center?

1. A. Azure AD group administration activities – Removed member from group
2. B. User administration activities – Updated user
3. C. Azure AD group administration activities – Updated group

Correct Answer: C

- (Exam Topic 4)
You have a Microsoft Azure Active Directory (Azure AD) tenant named Contoso.com. You create a Microsoft Defender for identity instance Contoso.
The tenant contains the users shown in the following table.

You need to modify the configuration of the Defender for identify sensors.
Solutions: You instruct User3 to modify the Defender for identity sensor configuration. Does this meet the goal?

1. A. Yes
2. B. No

Correct Answer: A

- (Exam Topic 4)
You have a Microsoft 365 tenant
You have a line-of-business application named App1 that users access by using the My Apps portal.
After some recent security breaches, you implement a conditional access policy for App1 that uses Conditional Access App Control,
You need to be alerted by email if impossible travel is detected for a user of Appl. The solution must ensure that alerts are generated for App1 only.
What should you do?

1. A. From Microsoft Cloud App Security, create a Cloud Discovery anomaly detection policy.
2. B. From Microsoft Cloud App Security, modify the impossible travel alert policy.
3. C. From Microsoft Cloud App Security, create an app discovery policy.
4. D. From the Azure Active Directory admin center, modify the conditional access policy.

Correct Answer: B
References:
https://docs.microsoft.com/en-us/cloud-app-security/cloud-discovery-anomaly-detection-policy

- (Exam Topic 4)
HOTSPOT
You have a Microsoft 365 tenant named contoso.com. The tenant contains the users shown in the following table.

You have the eDiscovery cases shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Solution:
References:
https://docs.microsoft.com/en-us/microsoft-365/compliance/assign-ediscovery-permissions

Does this meet the goal?

1. A. Yes
2. B. No

Correct Answer: A

- (Exam Topic 4)
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are deploying Microsoft Intune.
You successfully enroll Windows 10 devices in Intune.
When you try to enroll an iOS device in Intune, you get an error. You need to ensure that you can enroll the iOS device in Intune. Solution: You create the Mobility (MDM and MAM) settings. Does this meet the goal?

1. A. Yes
2. B. No

Correct Answer: B