Microsoft Microsoft Certifications MS-101 Questions & Answers

• Question 121:

  Your company makes use of Microsoft Defender Advanced Threat Protection (ATP) to protect thousands of Windows 10 devices.

  You want to display Microsoft Defender ATP alert events. The events must be filtered by high severity. The events should also have happened in the last week.

  Which of the following actions should you take?

  A. You should make use of the threat intelligence API in Microsoft Defender ATP.

  B. You should make use of Automated investigations in Microsoft Defender ATP.

  C. You should make use of the System Event log.

  D. You should make use of Azure Analytics.

  Correct Answer: B

  References:

  https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/investigate- alerts-windows-defender-advanced-threat-protection

  https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated- investigations-windows-defender-advanced-threat-protection

• Question 122:

  You need to consider the underlined segment to establish whether it is accurate.

  Your company has an Azure Active Directory (Azure AD) tenant that has a Microsoft 365 subscription.

  The company recently acquired a cloud app named that supports Microsoft Cloud App Security monitoring.

  The app can be accessed via the My Apps portal.

  to make sure that the app can be monitored from Cloud App Security, you must create a conditional access policy via the Azure Active Directory admin center.

  Select "No adjustment required" if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.

  A. No adjustment required.

  B. a DLP policy

  C. an app protection policy

  D. a label policy

  Correct Answer: A

• Question 123:

  Your company has a Microsoft 365 subscription. They also have an on-premises Active Directory domain that includes Windows 10 Enterprise domain-joined computers.

  You want to make sure that Microsoft Defender Credential Guard is enabled on all the computers. You have accessed a domain controller, and created a Group Policy object (GPO).

  Which of the following is the action you should take NEXT?

  A. You should set the Restrict delegation of credentials to remote servers setting to Disabled.

  B. You should set the Restrict delegation of credentials to remote servers setting to Enabled.

  C. You should set the Turn On Virtualization Based Security setting to Disabled.

  D. You should set the Turn On Virtualization Based Security setting to Enabled.

  Correct Answer: D

  Reference: https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard- manage

• Question 124:

  You need to consider the underlined segment to establish whether it is accurate.

  Your company has a Microsoft Azure Active Directory (Azure AD) tenant.

  To sign up for Microsoft Store for Business with minimum privileges required, you need the Global administrator role.

  Select "No adjustment required" if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.

  A. No adjustment required.

  B. Billing account owner

  C. Basic purchaser

  D. Service administrator

  Correct Answer: A

  References: https://docs.microsoft.com/en-us/microsoft-store/sign-up-microsoft-store-for-business

• Question 125:

  You need to consider the underlined segment to establish whether it is accurate.

  Your company has a Microsoft 365 subscription.

  To receive a notification when users receive email that includes infected files, you create an app protection policy.

  Select "No adjustment required" if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.

  A. No adjustment required.

  B. a threat management policy

  C. a data loss prevention (DLP) policy

  D. an alert policy

  Correct Answer: D

  Reference: https://docs.microsoft.com/en-us/office365/securitycompliance/alert-policies

• Question 126:

  Your company has a Microsoft 365 subscription in which you have just configured a Microsoft SharePoint Online tenant.

  You are preparing to create an alert policy that only produces an alert when malware is discovered in 6 or more documents stored in SharePoint Online over a 10-minute cycle.

  Which of the following is the action you should perform initially?

  A. You should enable Microsoft Office 365 Cloud App Security.

  B. You should deploy Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)

  C. You should create a data loss prevention (DLP) policy.

  D. You should upgrade the Microsoft 365 subscription.

  Correct Answer: B

• Question 127:

  Your company has recently acquired a Microsoft 365 subscription.

  You have been tasked with logging all mailbox folder permission modifications a user who has a mailbox in Microsoft Exchange Online.

  You are making use of the Set-Mailbox cmdlet.

  Which of the following is the parameter you should use?

  A. -AuditAdmin

  B. -AuditDelegate

  C. -AuditEnabled

  D. -AuditLog

  Correct Answer: C

  References: https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/set-mailbox?view=exchange-ps

• Question 128:

  Your company has a Microsoft 365 subscription.

  User email is stored in Microsoft Exchange Online.

  You have been instructed to keep a copy of all email messages that includes a specific word in the mailbox of a specified user.

  Which of the following actions should you take from the Security and Compliance admin center?

  A. You should create a label and a label policy.

  B. You should create a mail flow rule.

  C. You should configure an in-place hold.

  D. You should configure a retention policy.

  Correct Answer: A

  References: https://docs.microsoft.com/en-us/azure/information-protection/configure-policy-classification

• Question 129:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Company users store documents using Dropbox Business, which they access Dropbox Business via the MyApps portal.

  You want to make sure that Microsoft 365 identity is used to authenticate user access to Dropbox Business. Also, in the event that information is downloaded to an untrusted device, the information needs to be protected. Which of the following actions should you take via the Azure Active Directory admin center?

  A. You should configure an app protection policy.

  B. You should configure the device settings.

  C. You should configure application proxy settings.

  D. You should configure device configuration policy.

  Correct Answer: C

  Azure Active Directory's Application Proxy provides secure remote access to on-premises web applications. After a single sign-on to Azure AD, users can access both cloud and on-premises applications through an external URL or an internal application portal.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/application-proxy

• Question 130:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your Microsoft 365 subscription includes five

  Windows 8.1, five Windows 10, and five Windows Server 2016 devices.

  The devices must be onboarded to Microsoft Defender Advanced Threat Protection (ATP) without having to install software on the devices if possible.

  You want to onboard the Windows 10 devices.

  Solution: You run a local script.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  References:

  https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/configure- endpoints-windows-defender-advanced-threat-protection