- (Exam Topic 4)
You have a Microsoft 365 subscription that contains 20 data loss prevention (DLP) policies. You need to identify the following:
• Rules that are applied without Triggering a policy alert
• The top 10 files that have matched DLP policies
• Alerts that are miscategorized
Which report should you use for each requirement? To answer, drag the appropriate reports to the correct requirements. Each report may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

Solution:


Does this meet the goal?

1. A. Yes
2. B. No

Correct Answer: A

- (Exam Topic 2)
You need to implement Windows Defender ATP to meet the security requirements. What should you do?

1. A. Configure port mirroring
2. B. Create the ForceDefenderPassiveMode registry setting
3. C. Download and install the Microsoft Monitoring Agent
4. D. Run WindowsDefenderATPOnboardingScript.cmd

Correct Answer: C

- (Exam Topic 4)
Note: This question is part of series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have a Microsoft 365 E5 subscription that is associated to a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com.
You use Active Directory Federation Services (AD FS) to federate on-premises Active Directory and the tenant. Azure AD Connect has the following settings:
Source Anchor: objectGUID
Password Hash Synchronization: Disabled
Password writeback: Disabled
Directory extension attribute sync: Disabled
Azure AD app and attribute filtering: Disabled
Exchange hybrid deployment: Disabled
User writeback: Disabled
You need to ensure that you can use leaked credentials detection in Azure AD Identity Protection. Solution: You modify the Password Hash Synchronization settings.
Does that meet the goal?

1. A. Yes
2. B. No

Correct Answer: A
References:
https://docs.microsoft.com/en-us/azure/security/azure-ad-secure-steps

- (Exam Topic 4)
You have several Conditional Access policies that block noncompliant devices from connecting to services. You need to identify which devices are blocked by which policies.
What should you use?

1. A. the Device compliance report in the Microsoft Endpoint Manager admin center
2. B. the Device compliance trends report in the Microsoft Endpoint Manager admin center
3. C. Activity log in the Cloud App Security admin center
4. D. the Conditional Access Insights and Reporting workbook in the Azure Active Directory admin center

Correct Answer: D
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-insights-re

- (Exam Topic 4)
You have a hybrid Azure Active Directory (Azure AD) tenant that has pass- through authentication enabled. You plan to implement Azure AD identity Protection and enable the user risk policy.
You need to configure the environment to support the user risk policy.

1. A. Enable password hash synchronization.
2. B. Configure a conditional access policy.
3. C. Enforce the multi-factor authentication (MFA) registration policy.
4. D. Enable the sign-in risk policy.

Correct Answer: C