6.3. Practice Questions
💡 First Principle: These mixed-topic questions mirror the exam's actual format and rationale style — practicing here forces you to apply concepts across domains in a single sitting, exactly as the real exam will, rather than testing each domain in isolation.
Q1. A company wants to ensure that even if an attacker steals a valid employee's password, they cannot access company resources without an additional verification step. Which capability should they enable? A) Federation B) Multifactor authentication C) Hashing D) Records management
Correct: B. MFA specifically requires a second, independent factor beyond the password, so a stolen password alone is insufficient to gain access.
Q2. Which statement correctly distinguishes CSPM from cloud workload protection? A) CSPM detects active attacks; workload protection finds misconfigurations B) CSPM finds misconfigurations; workload protection detects active threats to running resources C) They are the same capability under two names D) CSPM only applies to on-premises resources
Correct: B. CSPM is about posture/configuration; workload protection defends resources during active threats — different questions, different timing.
Q3. An administrator needs a user to have Global Administrator privileges only for a two-hour maintenance window, with the assignment automatically expiring afterward. Which capability fits? A) Conditional Access B) Entra ID Protection C) Privileged Identity Management D) Access reviews
Correct: C. PIM provides just-in-time, time-bound activation of eligible privileged roles — exactly this scenario.
Q4. A document needs to be protected so that even if emailed outside the company, its encryption and access restrictions remain in force. Which capability provides this? A) Retention label B) Sensitivity label C) DLP policy D) Compliance score
Correct: B. Sensitivity labels travel with the content and enforce protection like encryption regardless of where the file ends up.
Q5. Which Defender product specifically monitors on-premises Active Directory signals for lateral movement and domain-dominance attempts? A) Defender for Cloud Apps B) Defender for Office 365 C) Defender for Identity D) Defender for Endpoint
Correct: C. Defender for Identity is purpose-built for on-premises AD signal analysis, distinct from cloud SaaS (Cloud Apps), email (Office 365), or device (Endpoint) protection.
Q6. An organization needs to preserve all emails and documents related to an active lawsuit so nothing can be deleted while the case is open. Which capability should they use first? A) Audit B) eDiscovery legal hold C) Insider risk management D) Retention policy
Correct: B. Legal hold, part of eDiscovery, specifically preserves content from deletion during an active case — the necessary first step before search and review.
Q7. A security team wants raw alerts from dozens of connected data sources automatically correlated into a smaller number of investigable incidents, with automated playbooks available to respond. Which service are they describing? A) Microsoft Defender for Cloud B) Microsoft Purview C) Microsoft Sentinel D) Microsoft Entra ID Governance
Correct: C. Correlating raw signals into incidents (SIEM) and automating response via playbooks (SOAR) together describe Microsoft Sentinel specifically.
Q8. Which best describes the relationship between Microsoft Entra roles and Azure RBAC? A) They are the same system with two names B) Entra roles govern Entra ID/M365 administration; Azure RBAC governs access to Azure resources — two separate, parallel systems C) Azure RBAC replaced Entra roles D) Entra roles only apply to guest users
Correct: B. These are two distinct role-based systems governing different scopes, both appearing on the exam.
