Q01 - Question
A company supports hybrid work. Employees access Microsoft 365 from office networks, home networks, and personal devices. The security lead wants the access strategy to align with the Zero Trust security model. Which approach should the security lead use?
Domain: Identify the core features and objects of Microsoft 365 services (30–35%) Type: Single choice
- A. Trust users who sign in from inside the corporate firewall, and verify only users who sign in from outside it.
- B. Deploy a single Zero Trust product to replace the existing identity, endpoint, and data controls.
- C. Treat every user, device, and application as untrusted by default, regardless of location.
- D. Trust managed devices by default, and verify only personal devices.
C is correct.
Explanation: Zero Trust operates on the principle that no user, device, or application is trusted by default, regardless of location. This matters in hybrid work because users access resources from many devices and locations, often outside the corporate firewall.
A is incorrect: Trusting users because they are inside the corporate firewall is the traditional perimeter-based model. Zero Trust does not treat internal networks as trustworthy.
B is incorrect: Zero Trust is not a single product. It is a strategy that spans identity, endpoints, data, applications, infrastructure, and networks.
D is incorrect: Zero Trust does not trust any device by default. Every access request must be verified.
Q02 - Question
A project manager drafts a plan to implement Zero Trust in Microsoft 365. The draft plan schedules one configuration sprint and then closes the project. You need to recommend a change so the plan aligns with how Zero Trust is implemented. What should you recommend?
Domain: Identify the core features and objects of Microsoft 365 services (30–35%) Type: Single choice
- A. Assess the current environment, apply layered controls, and refine policies over time.
- B. Complete the configuration in one sprint, and then close the project to reduce operational overhead.
- C. Enable one security feature that covers the full Zero Trust implementation.
- D. Use a standard implementation strategy without considering the organization's risk profile or regulatory requirements.
A is correct.
Explanation: Implementing Zero Trust in Microsoft 365 is a continuous process. You assess your current environment, apply layered controls, and refine policies over time. It also requires coordination across teams and continuous monitoring.
B is incorrect: Zero Trust is not a one-time configuration. A plan that ends after one sprint does not include continuous monitoring or iterative refinement.
C is incorrect: Zero Trust is not a single product or feature. It requires layered controls.
D is incorrect: Tailor the implementation strategy to your organization's risk profile, regulatory requirements, and operational needs.
Q03 - Question
A security team investigates a business email compromise attempt. Analysts review email, endpoint, and identity data separately, so each analyst sees only part of the attack. The team wants to understand the benefit of the integrated threat protection tools in Microsoft 365. Which benefit addresses this problem?
Domain: Identify the core features and objects of Microsoft 365 services (30–35%) Type: Single choice
- A. The tools focus on malware and spam, so analysts can ignore identity-based attacks.
- B. The tools protect email only, so analysts must investigate endpoints and identities with separate processes.
- C. The tools remove the need for security teams to investigate and respond to threats.
- D. The tools work together to detect, investigate, and respond to threats across email, endpoints, identities, and applications, so the team can see the full picture.
D is correct.
Explanation: Microsoft 365 brings together tools that work together to detect, investigate, and respond to threats across email, endpoints, identities, and applications. This approach helps security teams see the full picture instead of isolated fragments.
A is incorrect: Threats are not limited to malware or spam. Attackers also use phishing, business email compromise, credential theft, and lateral movement.
B is incorrect: The threat protection tools cover email, endpoints, identities, and applications, not only email.
C is incorrect: The tools support security teams as they detect, investigate, and respond to threats. They do not remove the need for security teams.
Q04 - Question
A new employee signs in to Microsoft 365, and the sign-in is verified. The administrator now needs to make sure the employee can access only the email, files, and apps required for the job. Which process should the administrator configure?
Domain: Identify the core features and objects of Microsoft 365 services (30–35%) Type: Single choice
- A. Authentication
- B. Authorization
- C. Single sign-on (SSO)
- D. Identity
B is correct.
Explanation: Authorization governs what users are permitted to access and do within Microsoft 365. It grants or restricts access to resources such as email, files, apps, and administrative settings. Use it so users have access only to the tools and data they need to do their job.
A is incorrect: Authentication proves that users are who they say they are. In this scenario, the sign-in is already verified.
C is incorrect: Single sign-on (SSO) relates to how users sign in. It does not define which resources a user is permitted to access.
D is incorrect: Identity answers who is trying to access Microsoft 365. It does not determine what that user is allowed to do.
Q05 - Question
An organization plans to monitor its Microsoft 365 identity environment proactively with audit logs. The administrator needs visibility into user and admin activities. Which two outcomes does this monitoring support? Each correct answer presents a complete solution.
Domain: Identify the core features and objects of Microsoft 365 services (30–35%) Type: Multiple choice
- A. It replaces the need to authenticate users.
- B. It helps the organization detect suspicious behavior.
- C. It grants just-in-time privileged access to sensitive roles.
- D. It helps the organization meet compliance requirements.
B and D are correct.
Explanation: Proactive monitoring through audit logs provides visibility into user and admin activities. This visibility helps organizations detect suspicious behavior and meet compliance requirements.
A is incorrect: Audit logs record activity. They do not verify who a user is, so authentication is still required.
C is incorrect: Audit logs provide visibility into activity. They do not grant just-in-time privileged access. That access is a function of Privileged Identity Management (PIM).
Q06 - Question
An IT team is writing a deployment plan. The plan must list the foundational service components of the Microsoft 365 ecosystem. Which two services should the team list as core service components? Each correct answer presents part of the solution.
Domain: Identify the core features and objects of Microsoft 365 services (30–35%) Type: Multiple choice
- A. Exchange Online
- B. Microsoft Intune
- C. OneDrive
- D. Microsoft Purview
A and C are correct.
Explanation: The foundational components of Microsoft 365 are Exchange Online, Microsoft Teams, SharePoint Online, OneDrive, and Microsoft Copilot. Exchange Online and OneDrive are both in this group.
B is incorrect: Microsoft Intune is a tool that admins use to configure baseline policies, such as device access. It isn't listed as a core service component.
D is incorrect: Microsoft Purview is a tool that admins use to configure baseline policies, such as content protection. It isn't listed as a core service component.
Q07 - Question
A new administrator needs one web-based portal to manage users, services, configurations, and health across the organization's Microsoft 365 tenant. Which tool should the administrator use?
Domain: Identify the core features and objects of Microsoft 365 services (30–35%) Type: Single choice
- A. Microsoft Purview
- B. Microsoft Intune
- C. SharePoint Online
- D. Microsoft 365 admin center
D is correct.
Explanation: The Microsoft 365 admin center is the central hub for managing users, services, configurations, and health in your Microsoft 365 environment. It's a web-based portal at https://admin.microsoft.com, and it provides a unified interface for managing your tenant.
A is incorrect: Microsoft Purview is a tool for configuring baseline policies, such as content protection. It isn't the unified interface for managing users and tenant health.
B is incorrect: Microsoft Intune is a tool for configuring baseline policies, such as device access. It isn't the central hub for managing users, services, and health.
C is incorrect: SharePoint Online is a collaboration and content management service. It isn't the portal for managing the tenant.
Q08 - Question
A company is planning the initial setup of the Microsoft 365 services that support workplace communication, collaboration, and content management. Which set of services should the plan include?
Domain: Identify the core features and objects of Microsoft 365 services (30–35%) Type: Single choice
- A. Microsoft Entra, Microsoft Purview, and Microsoft Intune
- B. Exchange Online, Microsoft Teams, and SharePoint Online
- C. Microsoft 365 admin center, OneDrive, and Microsoft Copilot
- D. Microsoft Intune, OneDrive, and Microsoft Teams
B is correct.
Explanation: Exchange Online, Teams, and SharePoint Online form the backbone of workplace communication, collaboration, and content management. Their initial setup prepares the organization for secure, efficient, and scalable operations.
A is incorrect: Microsoft Entra, Microsoft Purview, and Microsoft Intune are tools for configuring baseline security and compliance policies. They aren't the core collaboration services.
C is incorrect: The Microsoft 365 admin center is a management portal, not a collaboration service. OneDrive and Microsoft Copilot aren't listed as the core collaboration services in this group.
D is incorrect: Microsoft Intune is a policy tool, not a collaboration service. This set also leaves out Exchange Online and SharePoint Online.
Q09 - Question
An administrator must configure baseline policies for device access, conditional access, and content protection across Exchange Online, SharePoint Online, and Microsoft Teams. Which set of tools should the administrator use?
Domain: Identify the core features and objects of Microsoft 365 services (30–35%) Type: Single choice
- A. Exchange Online, SharePoint Online, and Microsoft Teams
- B. Microsoft 365 admin center, OneDrive, and Microsoft Copilot
- C. Microsoft Entra, Microsoft Purview, and Microsoft Intune
- D. Microsoft Teams, Microsoft Purview, and OneDrive
C is correct.
Explanation: Microsoft Entra, Microsoft Purview, and Microsoft Intune are the primary tools that Microsoft 365 admins use to configure baseline policies for device access, conditional access, and content protection.
A is incorrect: Exchange Online, SharePoint Online, and Microsoft Teams are the services that the policies apply to. They aren't the tools that you use to define the policies.
B is incorrect: These items aren't the primary tools for baseline security and compliance policies. OneDrive and Microsoft Copilot are core service components.
D is incorrect: This set includes Microsoft Purview, but it leaves out Microsoft Entra and Microsoft Intune. Microsoft Teams and OneDrive are collaboration services, not policy tools.
Q10 - Question
An organization uses Role-Based Access Control (RBAC) to delegate Microsoft 365 administration. A new administrator will manage one specific set of tasks. How should the organization assign permissions to this administrator?
Domain: Identify the core features and objects of Microsoft 365 services (30–35%) Type: Single choice
- A. Grant only the permissions that the administrator needs to perform the assigned tasks.
- B. Grant the same broad permissions to every administrator to simplify management.
- C. Grant all permissions first, and then remove permissions after a review period.
- D. Grant permissions for every service in the tenant in case the administrator's tasks change later.
A is correct.
Explanation: RBAC in Microsoft 365 is built on the principle of least privilege. Grant each administrator only the permissions needed to perform their specific tasks.
B is incorrect: Broad permissions for every administrator don't follow least privilege. RBAC limits each administrator to the access their role requires.
C is incorrect: Starting with all permissions gives the administrator more access than needed. Least privilege grants only the necessary access from the start.
D is incorrect: Permissions for possible future tasks go beyond what the administrator needs now. This approach doesn't follow least privilege.