MS-900 Quiz 03

This question-requires that you evaluate the underlined text to determine if it is correct. You use Microsoft Intune for device management. You must determine how many devices run each operating system. You must launch Intune and navigate to the Mobile Apps blade. Select the correct answer if the underlined text does not make the statement correct. Select "No change is needed" if the underlined text makes the statement correct.

• A. Device configuration

• B. Device compliance

• C. No change is needed

• D. Devices

Answer explanation

The underlined text is not correct. To determine how many devices run each operating system, you must launch Intune and navigate to the Devices blade, not the Mobile Apps blade.

Therefore, the correct answer is D. Devices.

The reason the correct answer is D. Devices is that the Mobile Apps blade in Intune is used to manage mobile applications, while the Devices blade is used to manage devices, including their operating systems. By navigating to the Devices blade, you can view the devices enrolled in Intune and their corresponding operating systems, allowing you to determine how many devices run each operating system.

You are the Microsoft 365 administrator for a company. You need to ensure that users receive a warning message if they select links in emails that might be unsafe. What should you do?

• A. Use Windows PowerShell to install the latest antimalware engine updates

• B. Enable Microsoft Office 365 Advanced Threat Protection

• C. Use the Microsoft Exchange Admin Center to configure a new spam-filter policy

• D. Use the Microsoft Exchange Admin Center to create a new antimalware policy

Answer explanation

To ensure that users receive a warning message if they select links in emails that might be unsafe, you should enable Microsoft Office 365 Advanced Threat Protection (ATP).

ATP provides additional protection against advanced threats, such as phishing and malware, by analyzing links in emails and identifying potential threats. If a link is identified as unsafe, ATP can display a warning message to users, helping to prevent them from inadvertently clicking on malicious links.

Therefore, the correct answer is B. Enable Microsoft Office 365 Advanced Threat Protection.

Option A (Use Windows PowerShell to install the latest antimalware engine updates) is not relevant to the question, as it relates to updating antimalware definitions on a device, not protecting users from unsafe links in emails.

Option C (Use the Microsoft Exchange Admin Center to configure a new spam-filter policy) and option D (Use the Microsoft Exchange Admin Center to create a new antimalware policy) are related to email filtering and malware protection, but they do not specifically address the issue of warning users about unsafe links in emails.

A business acquaintance from another company sends you a document that is encrypted by Azure Information Protection (AIP). You are unable to open the document because the user account cannot be authenticated by the company's Azure Active Directory. You need to access the document. What should you do?

• A. Implement Azure Rights Management (RMS) for individuals for the user account.

• B. Implement Information Rights Management (IRM) for the Office application.

• C. Upgrade your account to include AIP for Office 365.

Answer explanation

To access an encrypted document that is protected by Azure Information Protection (AIP) but cannot be opened due to authentication issues with the user account, you should implement Azure Rights Management (RMS) for individuals for the user account.

Azure RMS for individuals allows external users to access AIP-protected documents that are shared with them, without requiring an Azure AD account or any additional configuration on the part of the document owner. This can be useful when sharing sensitive information with external parties who do not have an Azure AD account or access to your organization's resources.

Therefore, the correct answer is A. Implement Azure Rights Management (RMS) for individuals for the user account.

Option B (Implement Information Rights Management (IRM) for the Office application) is not directly related to AIP and may not provide a solution to the authentication issue with the user account.

Option C (Upgrade your account to include AIP for Office 365) is not relevant to the question, as it does not address the issue of authentication and access to the encrypted document.

A company deploys Microsoft Azure AD. You enable multi-factor authentication. You need to inform users about the multi-factor authentication methods that they can use. Which of the following methods is NOT a valid multi-factor authentication method in Microsoft 365?

• A. Receive an automated call on the desk phone that includes a verification code

• B. Insert a small card in to a desktop computer and provide a PIN code when prompted

• C. Receive a call on a mobile phone and select the pound sign (#) when prompted

• D. Receive an SMS text message that includes a verification code

Answer explanation

Option B (Insert a small card in to a desktop computer and provide a PIN code when prompted) is not a valid multi-factor authentication method in Microsoft 365.

The other options listed are all valid multi-factor authentication methods in Microsoft 365:

A. Receive an automated call on the desk phone that includes a verification code C. Receive a call on a mobile phone and select the pound sign (#) when prompted D. Receive an SMS text message that includes a verification code

These are all examples of different types of authentication factors, including something you have (a phone or physical card), something you know (a PIN), and something you are (biometric information).

Therefore, the correct answer is B. Insert a small card in to a desktop computer and provide a PIN code when prompted.

You are a Microsoft 365 administrator for a company. Several users report that they receive emails which have a PDF attachment. The PDF attachment launches malicious code. You need to remove the message from inboxes and disable the PDF threat if an affected document is opened. Which feature should you implement?

• A. Microsoft Exchange Admin Center block lists

• B. Sender Policy Framework

• C. Advanced Threat Protection anti-phishing

• D. zero-hour auto purge

• E. DKIM signed messages with mail flow rules

Answer explanation

To remove the message from inboxes and disable the PDF threat if an affected document is opened, you should implement Advanced Threat Protection (ATP) anti-phishing.

ATP anti-phishing is a feature that helps protect users against malicious emails, including emails with malicious attachments, links, or content. When an email is identified as a phishing attempt, ATP can automatically remove the message from inboxes and replace the attachment with a placeholder that warns the user not to open the attachment.

In this scenario, the PDF attachment launches malicious code, which makes ATP anti-phishing a good option for removing the message from inboxes and disabling the PDF threat if an affected document is opened.

Therefore, the correct answer is C. Advanced Threat Protection anti-phishing.

Option A (Microsoft Exchange Admin Center block lists) is a feature that can be used to block or allow specific senders or domains based on a set of criteria. However, it is not specifically designed to address PDF threats.

Option B (Sender Policy Framework) is an email validation system that helps prevent email spam by verifying the sender's IP address against a list of authorized IP addresses. It is not designed to address PDF threats.

Option D (zero-hour auto purge) is a feature that allows administrators to remove messages from mailboxes based on specific criteria, such as keywords or attachment types. However, it does not offer the same level of protection as ATP anti-phishing.

Option E (DKIM signed messages with mail flow rules) is a feature that enables domain owners to associate a domain name with an email message. It can be used to verify the authenticity of email messages and protect against phishing attacks, but it does not specifically address PDF threats.

You are the Microsoft 365 administrator for a company. All staff must use Microsoft Outlook to access corporate email. When users access Outlook on mobile devices, they must use a PIN to open the application. You need to implement a Microsoft Intune policy to enforce the security requirements. Which policy should you use?

• A. device compliance

• B. device configuration

• C. app protection

• D. app configuration

Answer explanation

To enforce the security requirements that all staff must use Microsoft Outlook to access corporate email and must use a PIN to open the application when accessing Outlook on mobile devices, you should use the Microsoft Intune app protection policy.

The app protection policy (also known as MAM, or Mobile Application Management) is designed to secure the corporate data on mobile devices without requiring device enrollment. It allows you to define policies for specific applications, such as Outlook, to control the way users access and use corporate data.

To enforce the requirement that users must use Outlook to access corporate email, you can configure the app protection policy to block access to other email applications. To enforce the requirement that users must use a PIN to open the application, you can configure the policy to require a PIN to access Outlook on mobile devices.

Therefore, the correct answer is C. app protection.

A company deploys Exchange Online and SharePoint Online. You must audit and assessment reports for the Microsoft 365 cloud services that the company uses. You need to provide the required documents. Which Microsoft site should you use to obtain this information?

• A. Compliance Manager

• B. Service Trust Portal

• C. Office 365 Security and Compliance Center

• D. Azure portal

Answer explanation

To obtain audit and assessment reports for the Microsoft 365 cloud services that the company uses, you should use the Service Trust Portal.

The Service Trust Portal is a Microsoft website that provides customers with access to audit reports, compliance guides, and other documents related to the security, privacy, and compliance of Microsoft cloud services. It includes reports such as SOC 2 and ISO 27001/27018, which are commonly requested by auditors and regulators.

Therefore, the correct answer is B. Service Trust Portal.

A company is planning to use Microsoft 365 Defender. The company needs to protect Windows 10 client computers from malicious viruses. The company also needs to identify unauthorized cloud apps that are used by end users. You need to identify the Microsoft 365 Defender solutions that meet the requirements. Which two solutions should you choose? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

• A. Microsoft Defender for Identity

• B. Microsoft Defender for Endpoint

• C. Microsoft Defender for Office 365

• D. Microsoft Cloud App Security

Answer explanation

To protect Windows 10 client computers from malicious viruses, the appropriate Microsoft 365 Defender solution is Microsoft Defender for Endpoint. This solution provides endpoint protection and advanced threat detection for Windows 10 devices. It uses machine learning and behavioral analysis to detect and block advanced attacks in real-time.

To identify unauthorized cloud apps that are used by end users, the appropriate Microsoft 365 Defender solution is Microsoft Cloud App Security. This solution provides visibility into the cloud apps that are being used in an organization and helps to identify and remediate risky apps. It can also enforce policies to control access to cloud apps and data.

Therefore, the correct answers are B. Microsoft Defender for Endpoint and D. Microsoft Cloud App Security.

A company has Microsoft 365. The company needs to secure their environment. They start by identifying the highest risks to security according to Microsoft. You need to identify the security changes that are recommended by Microsoft 365. Which tool should you choose?

• A. Microsoft Intune

• B. Microsoft Secure Score

• C. Azure Information Protection scanner

• D. Advanced Threat Analytics

Answer explanation

B. Microsoft Secure Score. Microsoft Secure Score is a security analytics tool that provides visibility of the security posture of a company's Microsoft 365 environment. It assesses the organization's security posture and provides recommendations to improve it.

A company uses Microsoft 365. The company wants users to be prompted for additional verification when they access a federated third-party application. However, users must not be prompted for additional verification when they access Microsoft Outlook. You need to identify a solution that meets the requirements. Which solution should you choose?

• A. Conditional Access

• B. Multi-factor authentication (MFA)

• C. Active Directory Federation Services (AD FS)

• D. Self-service password reset (SSPR)

Answer explanation

The question is asking for a solution to implement additional verification when accessing a federated third-party application but not for Microsoft Outlook. This is commonly referred to as step-up authentication. To achieve this requirement, the best solution is to use Conditional Access. Conditional Access is a feature in Microsoft 365 that allows administrators to enforce policies that dictate access to resources based on certain criteria, such as user location, device type, and risk level. In this scenario, a Conditional Access policy can be created that requires additional verification for federated third-party applications but exempts Microsoft Outlook. This policy can be based on the application used, and can require additional authentication factors such as MFA, biometric authentication, or a one-time password.