- (Exam Topic 4)
You have a hybrid Microsoft 365 environment. All computers run Windows 10 and are managed by using Microsoft Intune.
You need to create a Microsoft Azure Active Directory (Azure AD) conditional access policy that will allow only Windows 10 computers marked as compliant to establish a VPN connection to the on-premises network.
What should you do first?

1. A. From the Azure Active Directory admin center, create a new certificate
2. B. Enable Application Proxy in Azure AD
3. C. From Active Directory Administrative Center, create a Dynamic Access Control policy
4. D. From the Azure Active Directory admin center, configure authentication methods

Correct Answer: A
Reference:
https://docs.microsoft.com/en-us/windows-server/remote/remote-access/vpn/ad-ca-vpn-connectivitywindows10

- (Exam Topic 4)
You have a Microsoft 365 E5 subscription that contains a user named Used.
You need to ensure that User! can use the Microsoft 365 compliance center to search audit logs and identify which users were added to Microsoft 365 role groups. The solution must use the principle of least privilege.
To which role group should you add User1?

1. A. Security Reader
2. B. View-Only Organization Management
3. C. Organization Management
4. D. Compliance Management

Correct Answer: C

- (Exam Topic 4)
You have a Microsoft 365 subscription.
You create and run a content search from the Security & Compliance admin center. You need to download the results of the content search.
What should you obtain first?

1. A. an export key
2. B. a password
3. C. a certificate
4. D. a pin

Correct Answer: A
References:
https://docs.microsoft.com/en-us/office365/securitycompliance/export-search-results

- (Exam Topic 2)
You need to configure threat detection for Active Directory. The solution must meet the security requirements.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Solution:


Does this meet the goal?

1. A. Yes
2. B. No

Correct Answer: A

- (Exam Topic 4)
You have a hybrid Microsoft 365 deployment that contains the Windows 10 devices shown in the following table.

You assign a Microsoft Endpoint Manager disk encryption policy that automatically and silently enables BitLocker Drive Encryption (BitLocker) on all the devices.
Which devices will have BitLocker enabled?

1. A. Device 1, Device2, and Device3
2. B. Device2 only
3. C. Device1 and Device2 only
4. D. Device2 and Device3 only

Correct Answer: B
To silently enable BitLocker, the device must be Azure AD Joined or Hybrid Azure AD Joined and the device must contain TPM (Trusted Platform Module) 2.0.
Reference:
https://docs.microsoft.com/en-us/mem/intune/protect/encrypt-devices