Visit here for our full Microsoft SC-401 exam dumps and practice test questions.
Question 141
Which Microsoft 365 feature enables automated classification and labeling of sensitive information to enforce encryption and retention policies?
A Microsoft Teams Compliance Center
B Sensitivity Labels in Microsoft Purview
C Azure Information Protection Scanner
D Microsoft Endpoint Manager
Answer: B
Explanation:
A Microsoft Teams Compliance Center provides auditing, reporting, and compliance monitoring for collaboration activities within Teams, including chats, channels, meetings, and files. Administrators can search and export content for compliance investigations, set retention policies at a high level, and monitor potential security risks. However, it does not automatically classify or label content, nor does it enforce encryption or retention at the document or email level. Teams Compliance Center is more of a monitoring and management tool rather than a content protection tool.
B Sensitivity Labels in Microsoft Purview are designed to automatically classify and protect sensitive information across Microsoft 365 services such as SharePoint, OneDrive, Teams, and Exchange. Labels can detect specific types of data, including financial records, personally identifiable information (PII), health records, trade secrets, or proprietary business content. Once applied, labels can enforce encryption, restrict access to authorized users, and trigger retention policies for compliance with regulatory frameworks such as GDPR, HIPAA, and ISO 27001. Automated labeling eliminates the risk of human error, ensures uniform policy enforcement, and prevents accidental exposure of sensitive content. Labels integrate seamlessly with Data Loss Prevention (DLP) policies, preventing unauthorized sharing and maintaining comprehensive audit trails for compliance reporting. Organizations can monitor label application and policy effectiveness via reporting dashboards, providing insights into sensitive content usage, retention status, and sharing activities. Sensitivity Labels support a centralized governance strategy across all Microsoft 365 services, ensuring data is consistently classified, securely stored, and properly retained, while also allowing end-users to collaborate without compromising security.
C Azure Information Protection Scanner can identify sensitive data in on-premises file repositories and apply labels, but it lacks real-time classification and labeling capabilities for cloud-based Microsoft 365 content. It cannot enforce automatic encryption or retention policies in the cloud.
D Microsoft Endpoint Manager is primarily for managing devices, applications, and compliance settings. While it supports device-level security policies and integration with Conditional Access, it does not provide automated content classification, labeling, or encryption for emails and documents in Microsoft 365.
Question 142
Which feature can prevent users from copying organizational data to personal apps on unmanaged devices?
A Microsoft Defender Antivirus Policies
B Conditional Access App Protection Policies
C Azure AD Access Reviews
D Microsoft Purview DLP Policies
Answer: B
Explanation:
A Microsoft Defender Antivirus protects endpoints from malware, ransomware, and viruses. While it ensures device-level security, it does not enforce application-level restrictions on data usage or prevent users from copying, pasting, or saving organizational content to personal or unauthorized applications.
B Conditional Access App Protection Policies provide a robust solution for controlling how organizational data is accessed and used on managed and unmanaged devices. Policies enforce restrictions such as preventing copy, paste, save, and print actions outside approved applications. Administrators can require devices to meet compliance standards, enforce multi-factor authentication, and apply session controls based on risk levels or user behavior. App Protection Policies integrate with Conditional Access, creating a dynamic, real-time enforcement model that balances security with user productivity. For example, a user accessing corporate email from a personal device can read messages but will be unable to copy content into unauthorized apps. The policies also integrate with Sensitivity Labels and DLP rules, ensuring consistent protection across Microsoft 365 services. Reporting and auditing capabilities allow administrators to monitor compliance, track potential violations, and evaluate the effectiveness of policies. This layered approach ensures that organizational data remains secure in BYOD or remote work scenarios, supporting zero-trust security principles and maintaining regulatory compliance with standards such as GDPR, HIPAA, and internal corporate policies. App Protection Policies help mitigate insider threats, accidental leaks, and unauthorized sharing while enabling users to work flexibly without compromising security.
C Azure AD Access Reviews are primarily designed to validate user permissions on a periodic basis. While they help ensure least-privilege access, they do not control application-level actions or prevent data from being copied to unauthorized apps.
D Microsoft Purview DLP can detect and block sensitive content from being shared outside authorized boundaries but does not provide real-time app-level enforcement for unmanaged devices.
Question 143
Which Microsoft 365 tool provides actionable alerts for unusual sign-ins or potentially compromised accounts?
A Microsoft Defender for Identity
B Azure AD Identity Protection
C Microsoft Purview Audit Logs
D Microsoft 365 Security Score
Answer: B
Explanation:
A Microsoft Defender for Identity monitors on-premises Active Directory for suspicious activities such as lateral movement, privilege escalation, and reconnaissance. It provides real-time alerts for on-premises environments but does not monitor cloud-based Microsoft 365 sign-ins or provide automated remediation for risky accounts.
B Azure AD Identity Protection is a cloud-based tool designed to detect risky sign-ins and compromised accounts within Microsoft 365. It evaluates sign-in patterns, device information, location anomalies, and user behavior to assign risk levels. When a risky sign-in is detected, Identity Protection can trigger automated responses, such as enforcing multi-factor authentication, requiring a password reset, or blocking access entirely. It integrates with Conditional Access to implement dynamic, risk-based access policies, ensuring that users with suspicious activity cannot access sensitive resources until their risk is mitigated. The solution provides dashboards, reporting, and alerts that allow administrators to track high-risk users, analyze trends, and take proactive actions. Automated monitoring reduces the need for manual oversight and strengthens overall security posture. Identity Protection is essential for maintaining zero-trust principles, minimizing account compromise risks, and ensuring compliance with regulatory frameworks such as GDPR, HIPAA, and ISO standards. By leveraging this tool, organizations can maintain secure access to Microsoft 365 resources while protecting sensitive information and reducing operational risk.
C Microsoft Purview Audit Logs capture user and administrative activity but do not provide real-time risk assessment or automated remediation for compromised accounts.
D Microsoft 365 Security Score evaluates an organization’s overall security posture and provides recommendations but does not detect or respond to risky sign-ins in real time.
Question 144
Which Microsoft 365 solution helps prevent accidental sharing of sensitive information in Microsoft Teams chats and files?
A Microsoft Purview Data Loss Prevention (DLP)
B Microsoft Defender Antivirus
C Azure AD Identity Protection
D Microsoft 365 Security Score
Answer: A
Explanation:
- Microsoft Purview DLP is designed to proactively prevent accidental or unauthorized sharing of sensitive information across Microsoft 365 services, including Teams chats, channel messages, emails, OneDrive, SharePoint, and file attachments. DLP policies can detect a wide range of sensitive information types, such as financial records, personally identifiable information (PII), health data protected under HIPAA, or confidential corporate content. Administrators can configure policies to automatically block sharing with unauthorized recipients, alert users before they send sensitive content, or log events for auditing and compliance purposes. DLP integrates seamlessly with Sensitivity Labels to ensure that content protection is consistent across all collaboration platforms, and it supports both predefined and custom data types tailored to an organization’s unique needs. Policies can initially be run in audit mode to monitor activity and assess risk before enforcing restrictions, allowing administrators to fine-tune rules without disrupting user productivity. Detailed reporting and dashboards provide visibility into policy violations, user behavior, and potential compliance risks, giving security teams actionable insights. By implementing DLP, organizations reduce the likelihood of data leakage, maintain regulatory compliance with standards such as GDPR, HIPAA, and ISO, and ensure that sensitive information remains protected while employees can continue to collaborate efficiently and securely.
- Microsoft Defender Antivirus focuses primarily on endpoint protection, detecting and mitigating malware, ransomware, and viruses across Windows, macOS, and mobile devices. While it is highly effective at protecting devices from malicious threats, Defender Antivirus does not monitor or prevent the accidental sharing of sensitive content within Microsoft 365 collaboration platforms such as Teams, SharePoint, or OneDrive. Its primary function is to safeguard endpoints rather than enforce content-level security or compliance policies.
- Azure AD Identity Protection continuously monitors user accounts, sign-ins, and suspicious activity to detect high-risk or potentially compromised accounts. When risks are detected, Identity Protection can automatically enforce remediation actions, such as requiring multi-factor authentication (MFA), forcing password resets, or temporarily blocking access. Although this helps protect accounts from unauthorized access and supports zero-trust security, it does not control or restrict the sharing of sensitive content in Teams, emails, or other collaboration tools. Its focus is identity and account risk management rather than content protection.
- Microsoft 365 Security Score provides an overall assessment of an organization’s security posture, analyzing configurations, user behavior, and compliance with security best practices. It identifies potential vulnerabilities and recommends actions to improve security across Microsoft 365 services. However, Security Score does not actively enforce DLP policies or prevent the sharing of sensitive information. It serves as a monitoring and advisory tool rather than a proactive content protection solution, helping administrators understand risks and prioritize security improvements without directly controlling user actions.
Question 145
Which feature in Microsoft 365 allows administrators to review user access and remove unnecessary permissions periodically?
A Azure AD Access Reviews
B Microsoft Purview Audit Logs
C Conditional Access Policies
D Microsoft 365 Security Score
Answer: A
Explanation:
A Azure AD Access Reviews provide a systematic way to validate user access to Microsoft 365 groups, applications, and resources. Administrators can schedule reviews periodically or set up automated processes to require managers or resource owners to approve or deny access. Access Reviews ensure adherence to the principle of least privilege, minimizing the risk of over-privileged accounts that could be exploited by malicious actors. Reviews can include recommendations for automated removal of access when unnecessary, reducing administrative overhead and maintaining security hygiene. The system also generates audit logs and reports, which are critical for demonstrating regulatory compliance and providing evidence during audits. Organizations that implement Access Reviews benefit from continuous governance over access rights, reducing insider threats and ensuring sensitive resources are only accessible to authorized personnel. This process is particularly valuable in large or dynamic environments where users frequently change roles or depart from the organization. By combining Access Reviews with Conditional Access and other identity protection tools, administrators can maintain a secure, well-governed Microsoft 365 environment.
B Microsoft Purview Audit Logs record user activities but do not enable active removal of access rights.
C Conditional Access Policies enforce access rules but do not validate existing user access periodically.
D Microsoft 365 Security Score evaluates overall security posture but does not directly manage user permissions or review access rights.
Question 146
Which Microsoft 365 feature allows administrators to enforce multi-factor authentication (MFA) based on user risk or location?
A Microsoft Purview DLP
B Conditional Access Policies
C Azure AD Identity Protection
D Microsoft 365 Security Score
Answer: B
Explanation:
A Microsoft Purview DLP focuses on protecting sensitive content but does not manage authentication requirements or enforce MFA.
B Conditional Access Policies provide organizations the ability to enforce MFA dynamically based on contextual signals such as user risk level, device compliance, location, or application being accessed. Administrators can define granular policies to require MFA when a sign-in is detected from an unfamiliar location, a non-compliant device, or a high-risk user account. Conditional Access integrates with Azure AD Identity Protection, enabling risk-based access enforcement automatically. This approach supports zero-trust security by continuously evaluating conditions before granting access, ensuring only verified and compliant users access sensitive resources. Policies can also block access for unmanaged devices or require additional verification when connecting from external networks. Conditional Access reports provide visibility into policy effectiveness, MFA compliance, and unusual sign-in activity, enabling administrators to fine-tune access controls and mitigate security risks. Organizations leveraging Conditional Access reduce the likelihood of compromised accounts, protect sensitive information, and comply with regulatory standards such as GDPR, HIPAA, and ISO. By combining real-time risk evaluation with adaptive authentication, Conditional Access balances security and productivity, providing a proactive security model that addresses evolving threats while supporting remote and hybrid work scenarios.
C Azure AD Identity Protection detects risky sign-ins and can integrate with Conditional Access, but by itself it does not enforce MFA across all policies.
D Microsoft 365 Security Score assesses overall security posture and provides recommendations, but it cannot enforce MFA or conditional access rules.
Question 147
Which Microsoft 365 tool helps protect sensitive documents by applying encryption and access restrictions automatically?
A Microsoft Endpoint Manager
B Sensitivity Labels in Microsoft Purview
C Microsoft Purview Audit Logs
D Microsoft Defender Antivirus
Answer: B
Explanation:
A Microsoft Endpoint Manager manages devices and applications but does not apply encryption or access restrictions directly to documents or emails.
B Sensitivity Labels in Microsoft Purview allow administrators to classify and protect documents and emails automatically. Labels can trigger encryption, restrict access to specific users or groups, prevent copying or printing, and enforce retention policies. They integrate with DLP and Conditional Access for comprehensive data protection. For example, a document labeled as “Confidential” can only be opened by authorized personnel, ensuring sensitive business information remains secure even if shared externally. Sensitivity Labels provide visibility into content usage through reporting and audit logs, helping organizations maintain regulatory compliance with GDPR, HIPAA, and other standards. Automated labeling ensures consistent enforcement across Microsoft 365 services, reducing the risk of accidental exposure. By applying encryption and access restrictions automatically, Sensitivity Labels balance security with productivity, allowing employees to collaborate while safeguarding critical organizational data. They are particularly effective in hybrid and cloud-first environments where sensitive data may be accessed from multiple devices and locations.
C Microsoft Purview Audit Logs record document access but do not actively protect files.
D Microsoft Defender Antivirus protects devices from malware but does not apply encryption or access restrictions to documents.
Question 148
Which feature allows organizations to block access to Microsoft 365 resources from non-compliant devices?
A Microsoft Purview DLP
B Conditional Access Policies
C Azure AD Access Reviews
D Microsoft 365 Security Score
Answer: B
Explanation:
A Microsoft Purview DLP focuses on content protection but does not restrict device access.
B Conditional Access Policies enforce access control based on device compliance, user identity, location, and risk. Integration with Microsoft Endpoint Manager allows administrators to block access for non-compliant devices automatically. For example, if a user attempts to access SharePoint from an unmanaged laptop, the policy can block access or require the device to be compliant first. Policies can be tailored by risk level or location, supporting zero-trust principles. Administrators receive reports and alerts to monitor policy enforcement and compliance. Conditional Access ensures that only verified, secure, and compliant devices can access sensitive resources, reducing the risk of data breaches and maintaining regulatory compliance.
C Azure AD Access Reviews validate user permissions periodically but do not block access based on device compliance.
D Microsoft 365 Security Score provides security recommendations but cannot enforce real-time access restrictions.
Question 149
Which Microsoft 365 solution provides advanced threat protection for emails and Teams messages, including malicious attachments and unsafe links?
A Microsoft Purview DLP
B Microsoft Defender for Office 365
C Azure AD Identity Protection
D Microsoft 365 Security Score
Answer: B
Explanation:
A Microsoft Purview DLP detects sensitive content but does not protect against malicious emails or unsafe links.
B Microsoft Defender for Office 365 provides advanced threat protection for Exchange, Teams, and other Microsoft 365 services. It includes Safe Attachments, which scans email attachments for malware, and Safe Links, which checks URLs in real time to prevent phishing attacks. Defender for Office 365 can automatically quarantine malicious content, notify administrators, and provide reporting for investigation. Policies can be configured to alert users, block delivery, or remove malicious content after delivery. Integration with Microsoft 365 security tools allows centralized incident response and threat investigation. Automated remediation reduces the risk of malware or phishing attacks reaching end-users, maintaining productivity and protecting organizational data. Defender for Office 365 also supports compliance with regulatory frameworks such as GDPR, HIPAA, and FINRA, providing auditable evidence of threat detection and remediation.
C Azure AD Identity Protection protects accounts but does not secure content within emails or Teams.
D Microsoft 365 Security Score assesses security posture but does not actively prevent threats.
Question 150
Which Microsoft 365 feature enables organizations to track user activity and generate audit reports for regulatory compliance?
A Microsoft Purview Audit Logs
B Microsoft Defender for Office 365
C Azure AD Identity Protection
D Microsoft 365 Security Score
Answer: A
Explanation:
A Microsoft Purview Audit Logs provide a comprehensive logging mechanism to track user and administrative activity across Microsoft 365 services, including Exchange, SharePoint, Teams, and OneDrive. Organizations can generate reports on file access, sharing events, mailbox activity, login attempts, and policy changes. These logs are essential for compliance with regulatory frameworks such as GDPR, HIPAA, SOX, and ISO standards. Administrators can search, filter, and export audit data to analyze trends, investigate suspicious activity, and produce evidence for internal audits or legal requests. Audit Logs can also be integrated with Security Information and Event Management (SIEM) tools for centralized monitoring and advanced analytics. While they do not directly prevent security threats or enforce protection policies, they provide critical visibility into how organizational resources are accessed and used, supporting accountability and governance.
B Microsoft Defender for Office 365 provides threat protection for email and collaboration tools but does not provide detailed logs for all user activity.
C Azure AD Identity Protection monitors risky sign-ins and user accounts but focuses on identity risk rather than general activity auditing.
D Microsoft 365 Security Score assesses overall security posture and provides recommendations but does not log specific user actions or generate detailed audit reports.
By using Audit Logs, organizations maintain oversight of their Microsoft 365 environment, detect policy violations or anomalies, and support regulatory compliance through comprehensive reporting and evidence-based governance.
Question 151
Which Microsoft 365 tool helps enforce encryption and restrict document access based on user roles?
A Microsoft Endpoint Manager
B Sensitivity Labels in Microsoft Purview
C Microsoft Purview Audit Logs
D Microsoft Defender Antivirus
Answer: B
Explanation:
A Microsoft Endpoint Manager focuses on managing devices and compliance, not on document-level protection.
B Sensitivity Labels in Microsoft Purview enable organizations to classify documents and emails and enforce encryption, access restrictions, and usage rights based on user roles. Labels can prevent unauthorized users from opening, editing, copying, or printing sensitive content. They integrate with DLP and Conditional Access to provide layered protection. For instance, documents labeled as “Confidential” can be restricted to certain teams or departments, automatically enforcing policies regardless of where the file is stored or shared. Sensitivity Labels provide reporting to track content protection, supporting compliance with GDPR, HIPAA, and other regulatory standards. Automated labeling ensures consistent protection and reduces the risk of accidental exposure. By applying encryption and role-based restrictions, organizations can balance collaboration and security, allowing authorized users to access sensitive data safely while preventing unauthorized access.
C Microsoft Purview Audit Logs track activity but do not enforce encryption or access restrictions.
D Microsoft Defender Antivirus protects devices from malware but does not control document access or usage policies.
Question 152
Which Microsoft 365 feature allows administrators to block access from unmanaged or non-compliant devices?
A Microsoft Purview DLP
B Conditional Access Policies
C Azure AD Access Reviews
D Microsoft 365 Security Score
Answer: B
Explanation:
- Microsoft Purview DLP focuses on protecting sensitive content across Microsoft 365 services by identifying and controlling the sharing of confidential information such as financial data, personally identifiable information (PII), and proprietary business content. While it effectively prevents accidental data leaks and enforces compliance policies, DLP does not block access at the device level or control whether a user can access resources from unmanaged or non-compliant devices. Its primary function is content inspection and protection, not device management.
- Conditional Access Policies enforce access rules based on factors such as device compliance, location, user identity, and risk levels. When integrated with Microsoft Endpoint Manager, administrators can automatically block access for unmanaged or non-compliant devices. For example, if a user attempts to access SharePoint from a personal laptop that does not meet required compliance standards, access can be denied until the device is properly secured. Conditional Access supports zero-trust principles by continuously evaluating access conditions and applying restrictions dynamically. Administrators can generate reports on blocked access attempts, device compliance, and overall policy effectiveness, enabling proactive management of security risks and helping maintain regulatory compliance.
- Azure AD Access Reviews provide a structured mechanism to periodically validate user permissions across groups, applications, and resources. While they ensure adherence to least-privilege principles and reduce risks from over-permissioned accounts, Access Reviews do not block real-time access to resources. Their primary role is governance and auditing rather than immediate access enforcement.
- Microsoft 365 Security Score evaluates an organization’s overall security posture and recommends improvements to enhance protection. While it identifies potential vulnerabilities and best practices, Security Score cannot directly enforce access restrictions or block devices. It is a monitoring and advisory tool rather than an active enforcement solution.
Question 153
Which Microsoft 365 solution protects email and Teams messages from phishing, malware, and unsafe links?
A Microsoft Purview DLP
B Microsoft Defender for Office 365
C Azure AD Identity Protection
D Microsoft 365 Security Score
Answer: B
Explanation:
- Microsoft Purview DLP detects sensitive content across Microsoft 365 services, including emails, documents, and collaboration tools. It can identify financial data, personally identifiable information (PII), health records, and other confidential business information. While DLP effectively prevents accidental data leakage and enforces compliance policies, it does not protect against phishing attacks, malware, or unsafe links. Its primary focus is on content inspection and policy enforcement rather than active threat mitigation.
- Microsoft Defender for Office 365 provides advanced threat protection across Exchange, Teams, and other Microsoft 365 services. Key features include Safe Attachments, which scans email attachments for malware before they reach end users, and Safe Links, which evaluates URLs in real time to block phishing or malicious sites. Defender for Office 365 can automatically quarantine harmful emails, alert administrators to suspicious activity, and generate detailed reports for investigation and compliance. Integration with Microsoft 365 security tools enables centralized incident response, automated remediation, and threat analysis. By preventing malware and unsafe links from reaching users, organizations maintain productivity while reducing security risk. Compliance reporting also supports frameworks such as GDPR, HIPAA, and ISO standards. This solution proactively safeguards communication channels, ensuring sensitive information remains protected from advanced threats.
- Azure AD Identity Protection continuously monitors user accounts, sign-ins, and behavior to detect high-risk or potentially compromised accounts. While it enforces risk-based policies and automated remediation actions, it does not secure messages, attachments, or collaboration content from malware or phishing threats.
- Microsoft 365 Security Score evaluates an organization’s overall security posture and provides recommendations to improve it. Although it highlights vulnerabilities and suggests best practices, Security Score does not provide active protection against phishing, malware, or unsafe links.
Question 154
Which feature in Microsoft 365 monitors risky sign-ins and can automatically remediate compromised accounts?
A Azure AD Identity Protection
B Microsoft Purview Audit Logs
C Microsoft 365 Security Score
D Microsoft Defender for Identity
Answer: A
Explanation:
- Azure AD Identity Protection continuously monitors user sign-ins, account behavior, and potential security risks to identify compromised or high-risk accounts. When risks are detected, it can automatically trigger remediation actions such as requiring multi-factor authentication (MFA), enforcing password resets, or temporarily blocking access to protect sensitive resources. By integrating with Conditional Access, Identity Protection enables dynamic, risk-based policies that enforce zero-trust principles, allowing organizations to respond proactively to suspicious activity. Dashboards and reports provide administrators with insights into risky users, policy effectiveness, and security trends. Automated remediation helps reduce response time, mitigates the potential impact of compromised accounts, and supports compliance with regulatory standards including GDPR, HIPAA, and ISO frameworks, while minimizing disruption for low-risk users.
- Microsoft Purview Audit Logs capture detailed records of user and administrator activities across Microsoft 365 services. While they provide visibility and tracking for security and compliance purposes, Audit Logs do not automatically detect risks or remediate compromised accounts.
- Microsoft 365 Security Score evaluates the organization’s overall security posture and provides actionable recommendations to improve security. However, it cannot perform real-time remediation or take direct actions to protect high-risk accounts.
- Microsoft Defender for Identity monitors on-premises Active Directory environments for suspicious behavior, compromised credentials, or lateral movement. While it helps detect identity-based threats within hybrid environments, it does not actively remediate or protect cloud-based sign-ins in Microsoft 365.
Question 155
Which Microsoft 365 tool allows periodic review and removal of unnecessary user access to resources?
A Azure AD Access Reviews
B Microsoft Purview Audit Logs
C Conditional Access Policies
D Microsoft 365 Security Score
Answer: A
Explanation:
- Azure AD Access Reviews allow administrators to schedule periodic and automated reviews of user access to groups, applications, and resources. Designated reviewers or managers can approve, deny, or remove access based on current business needs, ensuring adherence to least-privilege principles and minimizing the risk of over-privileged accounts. Every decision is logged in audit trails, providing documentation and evidence to support compliance during regulatory audits. Access Reviews are particularly valuable in large or dynamic organizations where users frequently change roles, teams, or responsibilities, ensuring that sensitive resources remain accessible only to authorized personnel. When integrated with Conditional Access and Sensitivity Labels, Access Reviews help enforce comprehensive security policies, combining access governance with data protection. By systematically evaluating and removing unnecessary permissions, organizations reduce insider risk, maintain governance, and support regulatory compliance frameworks such as GDPR, HIPAA, and ISO standards.
- Microsoft Purview Audit Logs capture detailed records of user and administrator actions across Microsoft 365 services, including access changes, file modifications, and policy enforcement events. While Audit Logs provide excellent visibility and reporting capabilities for compliance and security investigations, they do not actively remove or modify user access. Administrators can use the logs to identify potential issues or audit past actions but must take manual or separate automated actions to enforce changes.
- Conditional Access Policies enforce access conditions for users based on criteria such as device compliance, network location, user risk level, or application sensitivity. These policies ensure that only compliant and verified devices or accounts can access critical resources. However, Conditional Access does not perform periodic validation of existing permissions or automatically revoke access when no longer required. It is primarily a preventative control rather than a governance tool for ongoing access reviews.
- Microsoft 365 Security Score evaluates an organization’s overall security posture by analyzing configurations, user behavior, and adherence to security best practices. It provides recommendations and actionable guidance to improve security but does not directly manage or review user access. Security Score is a monitoring and advisory tool rather than an active access governance mechanism.
Question 156
Which Microsoft 365 feature helps prevent unauthorized sharing of sensitive content outside the organization?
A Microsoft Defender Antivirus
B Microsoft Purview Data Loss Prevention (DLP)
C Azure AD Identity Protection
D Microsoft 365 Security Score
Answer: B
Explanation:
- Microsoft Defender Antivirus protects endpoints by detecting and mitigating malware, ransomware, and other malicious threats. While essential for endpoint security, Defender Antivirus does not monitor, classify, or prevent the sharing of sensitive content within Microsoft 365 services.
- Microsoft Purview Data Loss Prevention (DLP) is designed to proactively prevent the unauthorized sharing of sensitive information across Microsoft 365 services, including Exchange, Teams, OneDrive, and SharePoint. DLP policies can detect a wide range of sensitive data types, such as credit card numbers, Social Security numbers, health records, or confidential business documents. Administrators can configure rules to block sharing, notify users of potential policy violations, or log incidents for review and auditing purposes. DLP integrates with Sensitivity Labels to maintain consistent protection across emails, documents, and collaboration platforms. Policies can also be applied in audit mode to monitor user behavior before enforcement, allowing administrators to refine rules without disrupting workflow. Reporting dashboards provide insights into policy violations, user behavior, and compliance risks, giving organizations the visibility they need to manage sensitive data effectively. By implementing DLP, organizations reduce accidental data leakage, maintain regulatory compliance with standards such as GDPR and HIPAA, and ensure that sensitive information is only accessed by authorized personnel. DLP provides a proactive security layer, controlling data sharing rather than relying solely on reactive measures, and supports secure collaboration in hybrid and remote work environments.
- Azure AD Identity Protection continuously monitors user accounts, sign-ins, and behavior to identify high-risk accounts or suspicious activity. While it can enforce actions such as requiring MFA or blocking access to risky accounts, it does not prevent the external sharing of sensitive content.
- Microsoft 365 Security Score evaluates an organization’s overall security posture, identifies risks, and provides recommended actions to improve security. However, it does not actively enforce data protection or prevent unauthorized sharing of sensitive information.
Question 157
Which Microsoft 365 tool automatically applies classification and protection to documents based on content type?
A Microsoft Endpoint Manager
B Sensitivity Labels in Microsoft Purview
C Microsoft Purview Audit Logs
D Microsoft Defender Antivirus
Answer: B
Explanation:
- Microsoft Endpoint Manager provides centralized management of devices, including Windows, macOS, iOS, and Android endpoints. It enforces compliance policies, manages software updates, and monitors device health to ensure organizational security standards are met. However, Endpoint Manager does not classify or protect documents or emails based on their content—its focus is device and configuration management rather than data protection.
- Sensitivity Labels in Microsoft Purview enable automatic classification and protection of documents and emails according to their content. Labels can detect sensitive information such as personally identifiable information (PII), financial records, health data, or proprietary business content, and enforce policies such as encryption, access restrictions, and usage limitations automatically. When integrated with Data Loss Prevention (DLP) and Conditional Access, Sensitivity Labels provide comprehensive protection, preventing unauthorized access or external sharing. Reporting tools give administrators visibility into label usage, document access, and enforcement compliance. Automated labeling reduces human error and ensures consistent application of organizational security policies. For example, a document labeled “Confidential” is encrypted and accessible only to authorized personnel, ensuring that sensitive content remains protected. Sensitivity Labels support compliance with regulatory frameworks such as GDPR, HIPAA, and ISO standards by enforcing strict controls over sensitive information. This approach allows secure collaboration, enabling employees to work efficiently without compromising data security, while administrators maintain oversight and control over sensitive content.
- Microsoft Purview Audit Logs provide detailed tracking of user and administrator activities across Microsoft 365 services. While they offer valuable visibility for auditing and compliance, Audit Logs do not apply automatic classification or protection to documents.
- Microsoft Defender Antivirus protects endpoints by detecting and mitigating malware, ransomware, and other threats. While essential for endpoint security, it does not classify documents or enforce document-level security policies.
Question 158
Which Microsoft 365 feature allows administrators to require multi-factor authentication for high-risk users automatically?
A Conditional Access Policies
B Azure AD Identity Protection
C Microsoft Purview DLP
D Microsoft 365 Security Score
Answer: B
Explanation:
- Conditional Access Policies enforce access requirements based on conditions such as user location, device compliance, application sensitivity, or network context. While they can require multi-factor authentication (MFA) or block access under certain conditions, Conditional Access policies do not automatically assess user risk on their own—they act only when configured conditions are triggered.
- Azure AD Identity Protection continuously evaluates user sign-ins, account behavior, and risk indicators to identify potentially compromised or high-risk accounts. When a risk is detected, Identity Protection can automatically take actions such as requiring MFA, forcing a password reset, or temporarily blocking access until the issue is remediated. It integrates seamlessly with Conditional Access to enforce dynamic, risk-based policies, ensuring that accounts exhibiting suspicious activity are addressed proactively. Administrators have access to detailed reports and dashboards showing risky accounts, MFA enforcement, and security trends, providing insight into organizational security posture. By automatically requiring MFA for high-risk users, organizations strengthen zero-trust security, protect sensitive resources, and maintain compliance with regulatory standards such as GDPR, HIPAA, and ISO frameworks. This approach balances strong security controls with minimal disruption for low-risk users, delivering an effective identity protection strategy.
- Microsoft Purview Data Loss Prevention (DLP) protects sensitive information by controlling how data is shared across Microsoft 365 services. While it prevents accidental data leakage, DLP does not enforce MFA or respond to high-risk account behavior.
- Microsoft 365 Security Score assesses an organization’s security posture and provides recommendations to improve it. While it highlights risks and suggests actions, it cannot automatically enforce MFA or remediate risky accounts.
Question 159
Which Microsoft 365 tool enables administrators to review who has access to resources and remove unneeded permissions?
A Azure AD Access Reviews
B Microsoft Purview Audit Logs
C Conditional Access Policies
D Microsoft 365 Security Score
Answer: A
Explanation:
- Azure AD Access Reviews provide a structured and automated method for validating user access to Microsoft 365 resources, including security groups, SharePoint sites, Teams, and applications. Administrators or delegated reviewers can approve, deny, or remove user access based on current business requirements and organizational policies. Access Reviews can be scheduled periodically or automated to occur when specific conditions are met, ensuring ongoing adherence to the least-privilege principle and reducing security risks from over-permissioned accounts. Every decision is logged in audit trails, providing documentation to support regulatory compliance, internal audits, and governance requirements. This capability is especially valuable in large, dynamic organizations where employees frequently change roles, teams, or responsibilities, ensuring that sensitive resources remain accessible only to authorized personnel. When integrated with Conditional Access policies and Sensitivity Labels, Access Reviews enhance overall security by combining proactive access management with data protection measures. By systematically reviewing and removing unnecessary permissions, organizations can minimize insider threats, maintain governance, and meet compliance obligations with frameworks such as GDPR, HIPAA, and ISO standards.
- Microsoft Purview Audit Logs capture detailed records of user and administrator activities across Microsoft 365 services, including access changes and content interactions. While they provide valuable visibility and reporting for compliance and security investigations, Audit Logs do not actively revoke or modify user permissions.
- Conditional Access Policies enforce security requirements, such as requiring multi-factor authentication or restricting access based on device compliance or location. However, Conditional Access does not perform periodic reviews of existing permissions or remove outdated access.
- Microsoft 365 Security Score evaluates an organization’s overall security posture and provides recommendations to improve it. Although it identifies potential risks and best practices, it does not actively manage or revoke user access to resources.
Question 160
Which Microsoft 365 feature prevents accidental exposure of sensitive information when sharing files externally?
A Microsoft Purview Data Loss Prevention (DLP)
B Sensitivity Labels in Microsoft Purview
C Conditional Access Policies
D Microsoft 365 Security Score
Answer: A
Explanation:
- Microsoft Purview Data Loss Prevention (DLP) actively monitors and protects sensitive information across Microsoft 365 services such as Exchange, Teams, OneDrive, and SharePoint. When users attempt to share sensitive content externally, DLP policies can automatically block the sharing action, notify users of potential policy violations, or log the incident for auditing and compliance purposes. DLP integrates seamlessly with Sensitivity Labels, ensuring consistent protection rules are applied across emails, documents, and collaboration platforms. It supports both predefined sensitive data types—like financial records, personally identifiable information (PII), health data under HIPAA, or custom proprietary business information—and allows organizations to define their own sensitive content rules. Comprehensive audit and reporting dashboards provide administrators with visibility into policy effectiveness, user behavior, and potential security risks. By proactively controlling external data sharing, DLP minimizes the risk of accidental data leakage, enforces regulatory compliance with standards such as GDPR, HIPAA, and other industry-specific frameworks, and enables secure collaboration both internally and with external stakeholders. Ultimately, Microsoft Purview DLP allows employees to work efficiently while ensuring sensitive information remains protected throughout the organization.
- Sensitivity Labels are used to classify and protect content based on its sensitivity level. Labels can enforce encryption, apply access restrictions, or mark content for retention. However, on their own, Sensitivity Labels do not actively block real-time external sharing of content unless they are integrated with DLP policies.
- Conditional Access Policies control user access to resources based on conditions such as device compliance, location, or risk level. While they can prevent unauthorized access to Microsoft 365 resources, they cannot detect or prevent accidental exposure of sensitive content that a user attempts to share externally.
- Microsoft 365 Security Score provides organizations with a measurement of their overall security posture, along with recommendations to improve it. While it highlights areas for improvement and encourages best practices, it does not actively enforce content protection or control sharing of sensitive information in real time.
