Topic 2: Mix Questions
You have a Microsoft 36S ES subscription that contains two Windows devices named
Devicel1and Device2 Device1 has the default browser set to Microsoft Edge. Devke2 has
the default browser set to Google Chrome.
You need to ensure that Microsoft Purview insider risk management can collect signals
when a user copies files to a USB device by using their default browser.
What should you deploy to each device? To answer, select the appropriate options in the
answer area.
NOTE: Each correct selection is worth one point.
You have a Microsoft 365 E5 subscription.
You need to identify documents that contain patent application numbers containing the
letters PA followed by eight digits, for example, PA 12345678. The solution must minimize
administrative effort.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You have a Microsoft 365 E5 tenant that contains a user named User1. User1 is assigned the Compliance Administrator role. User1 cannot view the regular expression in the IP Address sensitive info type. You need to ensure that User! can view the regular expression. What should you do?
A. Assign Used to the Reviewer role group
B. Create a copy of the IP Address sensitive info type and instruct User1 to edit the copy.
C. Instruct User1 to use the Test function on the sensitive info type.
D. Assign User1 the Global Reader role.
You have Microsoft 365 E5 subscription.
You create two alert policies named Policy1 and Policy2 that will be triggered at the times
shown in the following table.
How many alerts will be added to the Microsoft Purview portal?
A. 2
B. 3
C. 4
D. 5
E. 6
Explanation:
In Microsoft Purview, when multiple alert policies trigger alerts, duplicate alerts within a
short period (typically 5 minutes) may be suppressed to avoid redundancy.
Step-by-step Analysis:
HOTSPOT
You have a Microsoft 365 E5 subscription that contains the users shown in the following
table.
HOTSPOT
You have a Microsoft 365 E5 subscription that uses Microsoft Purview.
You need ensure that an incident will be generated when a user visits a phishing website.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You have a Microsoft $65 subscription.
You plan to retain the following audit log record types and activities for the next three years.
• Copilotlnteraction: All activities selected (1/1)
o Interacted with Copilot
• Compliance DLP endpoint: All activities selected {2/2)
o Matched DIP rule
o Removed Dl P rule from document
• AzureActiveDirectory 2 of 25 activities selected (2/25)
o Reset user password o Changed user password
What is the minimum number of audit retention policies you should create to retain only the
selected record types and activities?
A. 1
B. 2
C. 3
D. 5
Note: This question is part of a series of questions that present the same scenario. Each
question in the series contains a unique solution that might meet the stated goals. Some
question sets might have more than one correct solution, while others might not have a
correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result,
these questions will not appear in the review screen.
You recently discovered that the developers at your company emailed Azure Storage
Account keys in plain text to third parties.
You need to ensure that when Azure Storage Account keys are emailed, the emails are
encrypted.
Solution: You create a data loss prevention (DLP) policy that has only the Exchange email
location selected.
Does this meet the goal?
A. Yes
B. No
Explanation:
To ensure Azure Storage Account keys are encrypted when sent via email, you need a
Data Loss Prevention (DLP) policy that detects Azure Storage Account keys using a sensitive information type and automatically encrypts emails containing these keys.
A DLP policy with Exchange email as the only location meets this requirement because it
identifies sensitive data in email messages and it applies protection actions, such as
encryption, blocking, or alerts.
HOTSPOT
You have a Microsoft 365 E5 subscription that contains two Microsoft 365 groups named
Group1 and Group2. Both groups use the following resources:
A group mailbox
Microsoft Teams channel messages
A Microsoft SharePoint Online teams site
You create the objects shown in the following table.
Note: This question is part of a series of questions that present the same scenario. Each
question in the series contains a unique solution that might meet the stated goals. Some
question sets might have more than one correct solution, while others might not have a
correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result,
these questions will not appear in the review screen.
You have a Microsoft 365 subscription.
You have a user named User1. Several users have full access to the mailbox of User1.
Some email messages sent to User1 appear to have been read and deleted before the
user viewed them.
When you search the audit log in the Microsoft Purview portal to identify who signed in to
the mailbox of User1, the results are blank.
You need to ensure that you can view future sign-ins to the mailbox of User1.
Solution: You run the Set-Mailbox -Identity "User1" -AuditEnabled $true command.
Does that meet the goal?
A. Yes
B. No
Explanation:
To track who accesses User1’s mailbox, you need to enable mailbox auditing for User1. By
default, Exchange mailbox auditing is not enabled per mailbox (even though it is enabled
tenant-wide).
The Set-Mailbox -Identity "User1" -AuditEnabled $true command enables audit logging for
mailbox actions like:
Read emails
Delete emails
Send emails as User1
Access by delegated users
Once enabled, you can search for future sign-ins and actions in the Microsoft Purview audit
logs.
HOTSPOT
You have a Microsoft 365 E5 subscription that contains the device configurations shown in
the following table.
You have a Microsoft J65 E5 subscription. You plan to implement retention policies for Microsoft Teams. Which item types can be retained?
A. voice memos from the Teams mobile client
B. embedded images
C. code snippets
Page 3 out of 11 Pages |
Previous |