Topic 2 Multiple Choice Questions

You con gure several Microsoft Defender for O ce 365 policies in a Microsoft 365 subscription.

You need to allow a user named User1 to view Microsoft Defender for O ce 365 reports in the Threat management dashboard.

Which role provides User1 with the required role permissions?

• A. Security reader

• B. Compliance administrator

• C. Information Protection administrator

• D. Exchange administrator

You have a Microsoft 365 Enterprise E5 subscription.

You use Microsoft Defender for Endpoint.

You plan to use Microsoft 365 Attack simulator.

What is a prerequisite for running Attack simulator?

• A. Enable multi-factor authentication (MFA).

• B. Configure Microsoft Defender for Office 365.

• C. Create a Conditional Access App Control policy for accessing Microsoft 365.

• D. Integrate Microsoft 365 Threat Intelligence and Microsoft Defender for Endpoint.

You have a Microsoft 365 E5 subscription and a hybrid Microsoft Exchange Server organization.

Each member of a group named Executive has an on-premises mailbox. Only the Executive group members have multi-factor authentication (MFA)

enabled. Each member of a group named Research has a mailbox in Exchange Online.

You need to use Microsoft Office 365 Attack simulator to model a spear-phishing attack that targets the Research group members.

What should you do first?

• A. From the Microsoft Defender for Identity portal, con gure the primary workspace settings.

• B. From the Microsoft Azure portal, configure the user risk policy settings in Azure AD Identity Protection.

• C. Enable MFA for the Research group members.

• D. Migrate the Executive group members to Exchange Online.

You have a Microsoft 365 E5 subscription.

You implement Microsoft Defender for Office 365 safe attachments policies for all users.

User reports that email messages containing attachments take longer than expected to be received.

You need to reduce the amount of time it takes to receive email messages that contain attachments. The solution must ensure that all

attachments are scanned for malware. Attachments that have malware must be blocked.

What should you do?

• A. Set the action to Block

• B. Add an exception

• C. Add a condition

• D. Set the action to Dynamic Delivery

You plan to implement Microsoft Defender for Identity for the domain.

You install a Microsoft Defender for Identity standalone sensor on Server1.

You need to monitor the domain by using Microsoft Defender for Identity.

What should you do?

• A. Configure port mirroring for Server1.

• B. Install the Microsoft Monitoring Agent on DC1.

• C. Install the Microsoft Monitoring Agent on Server1.

• D. Configure port mirroring for DC1.

An administrator plans to deploy several Azure Advanced Threat Protection (ATP) sensors.

You need to provide the administrator with the Azure information required to deploy the sensors.

What information should you provide?

• A. an Azure Active Directory Authentication Library (ADAL) token

• B. the public key

• C. the access key

• D. the URL of the Azure ATP admin center

You have a Microsoft 365 tenant.

You have 500 computers that run Windows 10.

You plan to monitor the computers by using Microsoft Defender for Endpoint after the computers are enrolled in Microsoft Intune.

You need to ensure that the computers connect to Microsoft Defender for Endpoint.

What should you do in Microsoft Endpoint Manager admin center?

• A. Configure an enrollment restriction

• B. Create a device configuration profile

• C. Create a conditional access policy

• D. Create a Windows Autopilot deployment profile

You plan to use Microsoft 365 Attack Simulator.

You need to identify the users against which you can use Attack Simulator.

Which users should you identify?

• A. User3 only

• B. User1, User2, User3, and User4

• C. User3 and User4 only

• D. User1 and User3 only

You con gure several Advanced Threat Protection (ATP) policies in a Microsoft 365 subscription.

You need to allow a user named User1 to view ATP reports in the Threat management dashboard.

Which role provides User1 with the required role permissions?

• A. Security administrators

• B. Exchange administrator

• C. Compliance administrator

• D. Message center reader

You integrate Microsoft Defender ATP and Endpoint Manager.

You plan to evaluate the Microsoft Defender ATP risk level for the devices.

You need to identify which devices can be evaluated.

Which devices should you identify?

• A. Device1 and Device2 only

• B. Device1 only

• C. Device1 and Device3 only

• D. Device1, Device2 and Device3