Identify the Core Security Features of Microsoft 365 Services AB-900 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company has a security team that needs to access the Microsoft 365 Defender portal. Only members of the 'Security Operations' group should be allowed, and access should be granted only when they are actively responding to an incident. You need to implement the least-privilege approach. What should you do?

   • AAssign the Global Administrator role to the Security Operations group permanently.
   • BCreate a Conditional Access policy that requires the user to be a member of the Security Operations group and use PIM for time-bound role activation.
   • CAdd each security team member individually to the Security Operations group and assign the Security Reader role permanently.
   • DUse a shared account for the security team and enable MFA.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   An organization uses Microsoft Entra ID with a free license. They want to implement Conditional Access policies to block legacy authentication and require MFA for all users. However, they discover that Conditional Access is not available in their license. What should you do to achieve the security goals?

   • AImplement MFA per-user and manually block legacy authentication.
   • BUse the Microsoft 365 admin center to block legacy authentication.
   • CUse security defaults to enable MFA and block legacy authentication.
   • DUpgrade to Microsoft Entra ID P1 or P2 license.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What type of information can you find in the Microsoft Purview audit log?

   • ARecords of who created, edited, or deleted files in SharePoint Online
   • BThe current password hash of each user
   • CThe network traffic between users and Microsoft 365
   • DThe CPU usage of each user's device
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company wants to ensure that no user permanently holds the Global Administrator role. They have Microsoft Entra ID P2. What should they configure?

   • AUse Azure AD administrative units to restrict the role's scope.
   • BCreate a Conditional Access policy that blocks the Global Administrator role.
   • CEnable security defaults to require MFA for admins.
   • DUse Privileged Identity Management to require activation for the Global Administrator role and set the role assignment to eligible.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A user reports that they are prompted for MFA on a new device, but they are unable to complete the prompt because their phone is not receiving the verification code. The user has previously registered for MFA. You need to help the user sign in. What should you do?

   • AReset the user's password and require them to re-register for MFA.
   • BCheck the user's sign-in logs for risky sign-in events.
   • CReview the user's authentication methods in Microsoft Entra ID to see if they have another method, such as the Microsoft Authenticator app or a phone call.
   • DDisable MFA for the user temporarily.
   Reveal Solution Discussion Select an answer first