Question 1

You need to receive a security alert when a user attempts to sign in from a location that was never used by the other users in your organization to sign in.
Which anomaly detection policy should you use?

Options :

A : Impossible travel

B : Activity from anonymous IP addresses

C : Activity from infrequent country

D : Malware detection

Answer: C

Question 2

You have a Microsoft 365 subscription.

You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft

Defender Antivirus in passive mode. You need to ensure that the devices are protected from

malicious artifacts that were undetected by the third-party antivirus product. Solution: You configure

Controlled folder access. Does this meet the goal?

Options :

A : Yes

B : No

Answer: B

Question 3

You have a Microsoft Sentinel workspace.

You need to prevent a built-in Advance Security information Model (ASIM) parse from being updated automatically.

What are two ways to achieve this goal? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

Options :

A : Redeploy the built-in parse and specify a CallerContext parameter of any and a SourceSpecificParse parameter of any.

B : Create a hunting query that references the built-in parse.

C : Redeploy the built-in parse and specify a CallerContext parameter of built-in.

D : Build a custom unify parse and include the build- parse version

E : Create an analytics rule that includes the built-in parse

Answer: A,D

Question 4

You have a Microsoft 365 subscription.

You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft

Defender Antivirus in passive mode. You need to ensure that the devices are protected from

malicious artifacts that were undetected by the third-party antivirus product Solution: You enable

automated investigation and response (AIR) Does this meet the goal?

Options :

A : Yes

B : No

Answer: A

Question 5

You have a Microsoft 365 subscription that contains the following resources:

• 100 users that are assigned a Microsoft 365 E5 license

• 100 Windows 11 devices that are joined to the Microsoft Entra tenant

The users access their Microsoft Exchange Online mailbox by using Outlook on the web.

You need to ensure that if a user account is compromised, the Outlook on the web session token can be revoked. What should you configure?

Options :

A : security defaults in Microsoft Entra

B : Microsoft Entra Verified ID

C : a Conditional Access policy in Microsoft Entra

D : Microsoft Entra ID Protection

Answer: C