MS-102 practice questions 231–240

1. Question 231 · 396 in bank

   You have a Microsoft 365 E5 subscription that includes Microsoft Intune. You manage all iOS devices by using Intune. You plan to protect corporate-owned iOS devices by using Microsoft Defender for Endpoint. You configure a connection between Intune and Defender for Endpoint. You need to onboard the devices to Defender for Endpoint. What should you do?

   • ADownload an onboarding package.
   • BCreate an app protection policy.
   • CEnable Microsoft Defender for Cloud.
   • DAdd an app to Intune.

   Show answer

   Answer: D

   Explanation

   This is correct, devices are enrolled in Intune Mobile Device Management (MDM). https://learn.microsoft.com/en-us/defender-endpoint/ios-install#add-ios-store-app Watch out for a similar question in Microsoft's practice assessment. That one is about unenrolled iOS devices (not MDM but MAM). That would be an App Protection Policy. https://learn.microsoft.com/en-us/defender-endpoint/ios-install-unmanaged#configure-microsoft-defender-for-endpoint-risk-signals-in-app-protection-policy-mam

   Source: Adapted from community discussion — JohnDoe47

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 232 · 396 in bank

   You have a Microsoft 365 E5 subscription and use Microsoft Defender for Cloud Apps. You register a cloud app named App1 in Microsoft Entra ID. You need to create an access policy for App1. What should you do first?

   • ADeploy Conditional Access App Control to App1.
   • BCreate an app tag for App1.
   • CAdd a security information and event management (SIEM) agent to Defender for Cloud Apps.
   • DConfigure an app connector to Defender for Cloud Apps.

   Show answer

   Answer: D

   Explanation

   To create an access policy for a registered app like App1 in Microsoft Defender for Cloud Apps, you need to first establish integration between the app and Defender for Cloud Apps. This is achieved by configuring an app connector. App connector: This enables Microsoft Defender for Cloud Apps to monitor and manage the app's activities. It integrates the app with Defender for Cloud Apps to provide visibility and enforce policies. After the app connector is configured, you can proceed to create access policies or other governance actions.

   Source: Adapted from community discussion — Vince_MCT

   References

   • Microsoft Learn

   Next question

3. Question 233 · 396 in bank

   HOTSPOT - You have an Azure AD tenant named contoso.com that contains the users shown in the following table.

   

   Multi-factor authentication (MFA) is configured to use 131.107.5.0/24 as trusted IPs. The tenant contains the named locations shown in the following table.

   

   You create a conditional access policy that has the following configurations: Users or workload identities assignments: All users Cloud apps or actions assignment: App1 Conditions: Include all trusted locations Grant access: Require multi-factor authentication For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Y: User is in trusted location from CA policy Y: User is in trusted location from CA policy N: Trusted IPs in the MFA settings containts a list of IPs that MFA can be skipped from. https://c7solutions.com/2022/07/what-is-multifactor-authentication-trusted-ips

   Source: Adapted from community discussion — Haso

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 234 · 396 in bank

   You have a Microsoft 365 E5 subscription and use Microsoft Defender for Cloud Apps. From Policy management, you open Information protection as shown in the following exhibit.

   

   Which type of policy can you create?

   • Asession policy
   • Bactivity policy
   • COAuth app policy
   • Daccess policy
   • Efile policy

   Show answer

   Answer: E

   References

   • Microsoft Learn

   Next question

5. Question 235 · 396 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains three users named User1, User2, and User3. You use Microsoft Entra ID Protection. You configure the Users at risk detected alerts setting to send an alert when a user risk level of low or above is detected. Users are assigned the risk levels shown in the following table.

   

   By the end of the day, how many alerts were generated for User1, and how many alerts were generated for User2 and User3? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-notifications#users-at-risk-detected-email To prevent an overload of e-mails, you only receive one email within a 5-second time period. If multiple users move to the specified risk level during the same 5-second time period, we aggregate the data and send one e-mail for all of them. User1: 3 User2 and User3: 4

   Source: Adapted from community discussion — JohnDoe47

   References

   • Microsoft Learn

   

   Next question

6. Question 236 · 396 in bank

   You have a Microsoft 365 E5 subscription. You plan to implement a data loss prevention (DLP) strategy by using Microsoft Purview. You need to recommend a classification method for a DLP condition. The classification method must automatically recognize document types based on existing documents in Microsoft SharePoint Online. What should you recommend?

   • Asensitive information types (SITs)
   • Bsensitivity labels
   • Ctrainable classifiers
   • Dexact data match (EDM) classifiers

   Show answer

   Answer: C

   Explanation

   Trainable classifiers in Microsoft Purview are tools that can automatically identify document types by learning from patterns in existing documents. They're especially helpful when dealing with diverse or unstructured content, like the documents you have stored in SharePoint Online, where predefined rules might not be enough.

   Source: Adapted from community discussion — Vince_MCT

   References

   • Microsoft Learn

   Next question

7. Question 237 · 396 in bank

   You have a Microsoft 365 E5 subscription and use Microsoft Defender for Endpoint. You integrate Microsoft Defender for Endpoint with Microsoft Intune. From Microsoft Defender Vulnerability Management, you review the top security recommendations and discover a recommendation to update Microsoft Edge (Chromium) to a later version. You need to ensure that a security task is added to Intune to address the recommendation. What should you do?

   • AFrom the Microsoft Intune admin center, configure Windows Autopatch.
   • BFrom the Microsoft Intune admin center, configure a security baseline.
   • CFrom the Microsoft Defender portal, select Request remediation.
   • DFrom the Microsoft Defender portal add an incident notification rule.

   Show answer

   Answer: C

   References

   • Microsoft Learn

   Next question

8. Question 238 · 396 in bank

   HOTSPOT - You have an Azure subscription. You have a Microsoft 365 E5 subscription. You are licensed to use Microsoft Defender XDR. You need to monitor activities from suspicious IP addresses and unusual administrative activities in Azure. What should you use to monitor the activities, and what should you use to integrate Azure with Microsoft Defender XDR? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Activities from suspicious IP addresses: Data connector To guard against suspicious IP addresses, employ Microsoft Sentinel’s data connector in concert with threat intelligence tools. This integration, joined with Microsoft Defender XDR, ensures alerts flow seamlessly when suspicious IPs arise. Additionally, Sentinel’s Threat Intelligence and Indicators enrich understanding, revealing origins and identities of these addresses. Microsoft Sentinel Threat Intelligence and Indicators: https://learn.microsoft.com/en-us/azure/sentinel/understand-threat-intelligence#view-your-geolocation-and-whois-data-enrichments-public-preview Microsoft Defender XDR integration with Microsoft Sentinel: https://learn.microsoft.com/en-us/azure/sentinel/microsoft-365-defender-sentinel-integration?tabs=azure-portal * * * * * * * * * * * * Monitor unusual administrative activities in Azure: Microsoft Defender for Identity Microsoft Defender for Identity: https://learn.microsoft.com/en-us/defender-for-identity/what-is#identify-suspicious-activities-across-the-cyber-attack-kill-chain

   Source: Adapted from community discussion — Dr_Lawrence

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 239 · 396 in bank

   You have a Microsoft 365 E5 subscription and use Microsoft Defender for Cloud Apps. The subscription contains users that have Windows 11 devices. You need to use the Cloud Discovery snapshot report to analyze cloud app usage on the devices. What should you do before generating a report?

   • ACreate an activity policy.
   • BDeploy the Azure Monitor Agent on the devices.
   • CExport traffic logs from firewalls and proxies.
   • DCreate an app discovery policy.

   Show answer

   Answer: C

   References

   • Microsoft Learn

   Next question

10. Question 240 · 396 in bank

    DRAG DROP - You have a Microsoft 365 E5 subscription and use Microsoft Defender for Cloud Apps. You need to configure Cloud Discovery to generate a report that identifies top potential risks and provides a workflow to mitigate and manage the risks. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    It's important to upload a log manually and let Microsoft Defender for Cloud Apps parse it before trying to use the automatic log collector. So, configure automatic log upload is last.

    Source: Adapted from community discussion — Xive

    References

    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

MS-102 practice, question 231. 396 questions available.