- (Exam Topic 4)
You have a Microsoft 365 E5 subscription that has Microsoft 365 Defender enabled.
You plan to deploy a third-party app named App1 that will receive alert data from Microsoft 365 Defender. Which format will Microsoft 365 Defender use to send the alert data to App1?

1. A. JSON
2. B. ZIP
3. C. XML
4. D. CSV

Correct Answer: A

Reference:
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/alerts?view=o365-worldwide

- (Exam Topic 4)
You have a Microsoft 365 tenant.
From the Azure Active Directory admin center, you review the Risky sign-ins report as shown in the following exhibit.

You need to ensure that you can see additional details including the risk level and the risk detection type. What should you do?

1. A. Purchase Microsoft 365 Enterprise E5 licenses.
2. B. Activate an instance of Microsoft Defender for Identity.
3. C. Configure Diagnostic settings in Azure Active Directory (Azure AD).
4. D. Deploy Azure Sentinel and add a Microsoft Office 365 connector.

Correct Answer: A

- (Exam Topic 4)
You plan to deploy a new Microsoft 365 Subscription that will contain 500 users.
You need to ensure that the following actions are performed the users sign in to the subscription
Evaluate the users' risk level based on their location and travel.
Require high-risk users to sign in by using Azure Multi-Factor Authentication (Azure MFA).
The solution must minimize cost.
Which license should you assign to each user?

1. A. Microsoft 365 Business Premium
2. B. Microsoft 365 E3
3. C. Enterprise Mobility + Security E3
4. D. Microsoft 365 ES

Correct Answer: A

- (Exam Topic 4)
You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the following table.

You register devices in contoso.com as shown in the following table.

You create app protection policies in Intune as shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Solution:
References:
https://docs.microsoft.com/en-us/intune/apps/app-protection-policy

Does this meet the goal?

1. A. Yes
2. B. No

Correct Answer: A

- (Exam Topic 4)
You have a Microsoft 365 E5 subscription that contains a user named User1.
The Azure Active Directory (Azure AD) Identity Protection risky users report identifies User1. For User1. you select Confirm user compromised.
User1 can still sign in.
You need to prevent User1 from signing in. The solution must minimize the impact on users at a lower risk level.
Solution: You configure the user risk policy to block access when the user risk level is medium and higher. Does this meet the goal?

1. A. Yes
2. B. No

Correct Answer: B