Microsoft 365 Administrator396 questions across 40 pages are complete and free, with no account or card.
396 questions in this bank
Free access · progress saved on this device
You have a Microsoft 365 E5 subscription that has Microsoft Defender for Endpoint integrated with Microsoft Intune. Devices are onboarded by using Microsoft Defender for Endpoint. You plan to block devices based on the results of the machine risk score calculated by Microsoft Defender for Endpoint. What should you create first?
Answer: B
HOTSPOT - You have a Microsoft 365 E5 subscription. You need to configure threat protection for Microsoft 365 to meet the following requirements: • Limit a user named User1 from sending more than 30 email messages per day. • Prevent the delivery of a specific file based on the file hash. Which two threat policies should you configure in Microsoft Defender for Office 365? To answer, select the appropriate threat policies in the answer area. NOTE: Each correct selection is worth one point.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
Answers seem to be correct. 1. Using anti-spam policies, you can set-up an outbound anti-spam policy limiting the amount of e-mails a user is allowed to send (per day). 2. Tenant allow/block list feature allows you to add a file based on its hash.
Source: Adapted from community discussion — Vaerox
You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365. A Built-in protection preset security policy is applied to the subscription. Which two policy types will be applied by the Built-in protection policy? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Answer: BC
HOTSPOT - You have a Microsoft 365 E5 subscription that contains the users shown in the following table.
The subscription has the following two anti-spam policies: • Name: AntiSpam1 • Priority: 0 • Include these users, groups and domains • Users: User3 • Groups: Group1 • Exclude these users, groups and domains • Groups: Group2 • Message limits • Set a daily message limit: 100 • Name: AntiSpam2 • Priority: 1 • Include these users, groups and domains • Users: User1 • Groups: Group2 • Exclude these users, groups and domains • Groups: Group3 • Message limits • Set a daily message limit: 50 For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
Answer is Correct : Multiple different types of exceptions aren't additive; they're inclusive. The policy isn't applied only if those recipients that match all of the specified recipient filters. For example, you configure a recipient filter exception with the following values: Users: romain@contoso.com Groups: Executives The policy isn't applied to romain@contoso.com only if he's also a member of the Executives group. If he's not a member of the group, then the policy still applies to him. https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/preset-security-policies?view=o365-worldwide#use-the-microsoft-365-defender-portal-to-add-exclusions-to-the-built-in-protection-preset-security-policy
Source: Adapted from community discussion — Milad666
You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Office 365. You have the policies shown in the following table.
All the policies are configured to send malicious email messages to quarantine. Which policies support a customized quarantine retention period?
Answer: A
You have a Microsoft 365 E5 subscription. Your company’s Microsoft Secure Score recommends the actions shown in the following exhibit.
You select Create Safe Links policies for email messages and change Status to Risk accepted in the Status & action plan settings. How does the change affect the Secure Score?
Answer: A
Risk accepted - Security should always be balanced with usability, and not every recommendation will work for your environment. When that is the case, you can choose to accept the risk, or the remaining risk, and not enact the recommended action. You won't be given any points for this status. You can view this action in history or undo it at any time.
Source: Adapted from community discussion — BestSumy
DRAG DROP - You have a Microsoft 365 E5 subscription that contains the devices shown in the following table.
You need to onboard the devices to Microsoft Defender for Endpoint. The solution must minimize administrative effort. What should you use to onboard each type of device? To answer, drag the appropriate onboarding methods to the correct device types. Each onboarding method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
I don`t understand how someone can agree with the given answer. Do your study before you post something. Integration with Microsoft Defender for Cloud is designed for Windows Servers and has nothing to do with BYOD. First answer = Intune Second answer = Local Script Remember this: Devices enrolled = Intune Devices not enrolled = Local Script
Source: Adapted from community discussion — aleksdj
You have a Microsoft 365 E5 subscription. You onboard all devices to Microsoft Defender for Endpoint. You need to use Defender for Endpoint to block access to a malicious website at www.contoso.com. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct answer is worth one point.
Answer: BD
HOTSPOT - You have a Microsoft 365 E5 subscription that contains the devices shown in the following table.
At 08:00, you create an incident notification rule that has the following configurations: • Name: Notification1 • Notification settings • Notify on alert severity: Low • Device group scope: All (3) • Details: First notification per incident • Recipients: User1@contoso.com, User2@contoso.com At 08:02, you create an incident notification rule that has the following configurations: • Name: Notification2 • Notification settings • Notify on alert severity: Low, Medium • Device group scope: DeviceGroup1, DeviceGroup2 • Recipients: User1@contoso.com In Microsoft 365 Defender, alerts are logged as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
Statements: 1. User1@contoso.com will receive two incident notification emails for the alert at 8:05 - NO Notification1 is configured to send the first notification per incident. Since this is the first notification for Activity1, User1 will receive one email for the alert at 08:05. They will not receive a second email for the same alert. 2. User2@contoso.com will receive an incident notification email for the alert at 8:07 - NO Since Notification1 is set to send only the first notification per incident, and Activity1 already triggered a notification at 08:05, User2 will not receive an additional notification for the alert at 08:07. 3. User1@contoso.com will receive an incident notification email for the alert at 8:20 - NO Notification1 applies only to Low severity alerts, and Notification2 applies only to Low and Medium severity alerts. The alert at 08:20 has a high severity, so User1 will not receive a notification for this alert.
Source: Adapted from community discussion — Tr619899
HOTSPOT - You have Microsoft 365 subscription. You create an alert policy as shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
ups sorry, the second option should be 12 The policy triggers when there are 20 activities within 120 min (2 hours) So every 2 hours, the policy checks and if there are more than 20 activities, it sends 1 alert. Since we have 24hours/day, the policy can send a maximum of 1alert/2hours or 12alerts/24hours.
Source: Adapted from community discussion — Casticod
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
MS-102 practice, question 91. 396 questions available.
Version 1.0.0. How we source questions