You can manage an Azure Active Directory (Azure AD) tenant by using the Azure portal.

You must deploy Azure virtual machines to host an Azure Active Directory (Azure AD) tenant.

Applying system updates increases an organization's secure score in Microsoft Defender for Cloud.

The secure score in Microsoft Defender for Cloud can evaluate resources across multiple Azure subscriptions.

Enabling multi-factor authentication (MFA) increases an organization's secure score in Microsoft Defender for Cloud.

Verify explicitly is one of the guiding principles of Zero Trust.

Assume breach is one of the guiding principles of Zero Trust.

The Zero Trust security model assumes that a firewall secures the internal network from external threats.

Control is a key privacy principle of Microsoft.

Transparency is a key privacy principle of Microsoft.

Shared responsibility is a key privacy principle of Microsoft.

Digitally signing a document requires a private key.

Verifying the authenticity of a digitally signed document requires the public key of the signer.

Verifying the authenticity of a digitally signed document requires the private key of the signer.

In software as a service (SaaS), applying service packs to applications is the responsibility of the organization.

In infrastructure as a service (IaaS), managing the physical network is the responsibility of the cloud provider.

In all Azure cloud deployment types, managing the security of information and data is the responsibility of the organization.

Azure AD Connect can be used to implement hybrid identity.

Hybrid identity requires the implementation of two Microsoft 365 tenants.

Authentication of hybrid identities requires the synchronization of Active Directory Domain Services (AD DS) and Azure Active Directory (Azure AD).

Enabling multi-factor authentication (MFA) increases the Microsoft Secure Score.

A higher Microsoft Secure Score means a lower identified risk level in the Microsoft 365 tenant.

Microsoft Secure Score measures progress in completing actions based on controls that include key regulations and standards for data protection and governance.

You can create custom roles in Azure Active Directory (Azure AD).

Global administrator is a role in Azure Active Directory (Azure AD).

An Azure Active Directory (Azure AD) user can be assigned only one role.

Azure Active Directory (Azure AD) is deployed to an on-premises environment.

Azure Active Directory (Azure AD) is provided as part of a Microsoft 365 subscription.

Azure Active Directory (Azure AD) is an identity and access management service.

Conditional access policies can use the device state as a signal.

Conditional access policies apply before first-factor authentication is complete.

Conditional access policies can trigger multi-factor authentication (MFA) if a user attempts to access a specific application.

Conditional access policies always enforce the use of multi-factor authentication (MFA).

Conditional access policies can be used to block access to an application based on the location of the user.

Conditional access policies only affect users who have Azure Active Directory (Azure AD)-joined devices.

Conditional access policies can be applied to global administrators.

Conditional access policies are evaluated before a user is authenticated.

Conditional access policies can use a device platform, such as Android or iOS, as a signal.

Global administrators are exempt from conditional access policies.

A conditional access policy can add users to Azure Active Directory (Azure AD) roles.

Conditional access policies can force the use of multi-factor authentication (MFA) to access cloud apps.

Windows Hello for Business can use the Microsoft Authenticator app as an authentication method.

Windows Hello for Business can use a PIN code as an authentication method.

Windows Hello for Business authentication information syncs across all the devices registered by a user.

Azure Defender can detect vulnerabilities and threats for Azure Storage.

Cloud Security Posture Management (CSPM) is available for all Azure subscriptions.

Azure Security Center can evaluate the security of workloads deployed to Azure or on-premises.

An Azure subscription can be associated to multiple Azure Active Directory (Azure AD) tenants.

You can change the Azure Active Directory (Azure AD) tenant to which an Azure subscription is associated.

When an Azure subscription expires, the associated Azure Active Directory (Azure AD) tenant is deleted automatically.

Network security groups (NSGs) can deny inbound traffic from the internet.

Network security groups (NSGs) can deny outbound traffic to the internet.

Network security groups (NSGs) can filter traffic based on IP address, protocol, and port.

Microsoft Intune can be used to manage Android devices.

Microsoft Intune can be used to provision Azure subscriptions.

Microsoft Intune can be used to manage organization-owned devices and personal devices.

You can create one Azure Bastion per virtual network.

Azure Bastion provides secure user connections by using RDP.

Azure Bastion provides a secure connection to an Azure virtual machine by using the Azure portal.

Microsoft Defender for Endpoint can protect Android devices.

Microsoft Defender for Endpoint can protect Azure virtual machines that run Windows.

Microsoft Defender for Endpoint can protect Microsoft SharePoint Online sites and content from viruses.

Microsoft Secure Score in the Microsoft 365 security center can provide recommendations for Microsoft Cloud App Security.

From the Microsoft 365 Defender portal, you can view how your Microsoft Secure Score compares to the score of organizations like yours.

Microsoft Secure Score in the Microsoft 365 Defender portal gives you points if you address the improvement action by using a third-party application or software.

Microsoft Sentinel data connectors support only Microsoft services.

You can use Azure Monitor workbooks to monitor data collected by Microsoft Sentinel.

Hunting provides you with the ability to identify security threats before an alert is triggered.

With Advanced Audit in Microsoft 365, you can identify when email items were accessed.

Advanced Audit in Microsoft 365 supports the same retention period of audit logs as core auditing.