HOTSPOT (Drag and Drop is not supported)Select the answer that correctly completes the sentence.Hot Area:
Answer(s): A
Box: Microsoft Defender XDRMicrosoft Defender XDR is a unified, AI-driven extended detection and response platform that protects digital environments by integrating security across endpoints, identities, emails, and apps. It automatically correlates security signals into incident graphs to detect, investigate, and remediate advanced threats like ransomware, acting as a "central security brain" for faster response.Key components of Microsoft Defender XDR include:Unified Protection: Covers endpoints, cloud apps, email, and identity in one portal.AI-Powered Automation: Uses automatic action and AI to remediate impacted assets (e.g., isolating compromised devices) and disrupt attacks, according to Microsoft Learn.Threat Intelligence: Provides full attack chain visibility by linking alerts and behavioral data.Proactive Hunting: Enables security teams to use Kusto Query Language (KQL) for custom threat searching.Integration with Microsoft Security Copilot: Empowers analysts with natural language threat hunting
https://learn.microsoft.com/en-us/defender-xdr/microsoft-365-defender
HOTSPOT (Drag and Drop is not supported)You open the Microsoft Entra admin center as shown in the following exhibit.Use the drop-down menus to select the answer choice that completes the statement based on the information presented in the graphic.Hot Area:
Box: Require multifactor authentication for administrative roles Require multifactor authentication for administrative roles has a score and will improve the score with 10 points.Incorrect:* Do not expire passwordsThe Do not expire passwords already has a score of.* Use least privileged administrative rolesThe Use least privileged administrative roles already has a score of.* Enable policy to block legacy authenticationThe Enable policy to block legacy authentication has a score of 0.73/8.
What can you use to block a user account automatically when a risky sigh-in is detected?
Answer(s): B
Microsoft Entra ID Protection (formerly Azure AD Identity Protection) is the correct tool to automatically block user accounts or trigger remediation (like forcing a password change) based on detected risky sign-ins or user risk levels. It uses AI to evaluate risk and integrates with Conditional Access to enforce security policies in real- time.How it WorksMicrosoft Entra ID Protection generates risk signals that act as the "brain," while Conditional Access acts as the "muscle" to enforce the actual block.Sign-in Risk Policy: Evaluates the probability that a specific authentication request is unauthorized (e.g., coming from an anonymous IP or an unfamiliar location).User Risk Policy: Identifies the likelihood that a user's account has been fully compromised (e.g., credentials leaked on the dark web).
https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-risk-based-sspr-mfa
HOTSPOT (Drag and Drop is not supported)Your organization has a Microsoft 365 subscription.A user named John is assigned an admin role as shown in the following exhibit.Use the drop-down menus to select the answer choice that completes the statement based on the information presented in the graphic.Hot Area:
Box: view all the content in Microsoft SharePoint sitesJohn can ________________.The Global Reader role in Microsoft 365 provides read-only access to organizational settings, reports, and data across most services, including Microsoft SharePoint. While they can view content, Global Readers cannot edit data, create new content, or manage SharePoint sites, adhering to the principle of least privilege.Key Aspects of Global Reader in SharePoint:Read-Only Access: Global Readers can read content in SharePoint sites but cannot make changes.Visibility: They can view reports and settings, allowing them to read data in SharePoint, OneDrive, and Teams.Limitations: This role is intended for monitoring and auditing, not administration. Unlike a Global Admin or SharePoint Administrator, a Global Reader cannot create sites, modify user permissions, or manage site structure.
https://learn.microsoft.com/en-us/defender-office-365/scc-permissions
HOTSPOT (Drag and Drop is not supported)For each of the following statements, select Yes if the statement is true. Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Box 1: YesYes - You can use a Microsoft Entra security group to assign permissions to Microsoft Entra ID resources.Microsoft Entra security groups can assign permissions to Entra ID resources, apps, and roles. Using role- assignable groups (requiring P1/P2 licenses), administrators can assign Microsoft Entra roles, such as Application Administrator, to a group rather than individual users, streamlining access management and auditing.Box 2: YesYes - You can use a Microsoft Entra security group to assign Microsoft 365 licenses.Using a Microsoft Entra security group to assign Microsoft 365 licenses is a best practice, known as group- based licensing. It automates license management, ensuring members automatically receive licenses when added to a group and have them removed when leaving, which reduces manual errors.Box 3: YesYes - You can use a Microsoft Entra security group to assign permissions to Microsoft Exchange mailboxes.You can use a Microsoft Entra security group to assign permissions to Microsoft Exchange mailboxes, but with a critical technical requirement: the group must be mail-enabled.While standard security groups are used for general access control in Entra ID, Exchange Online typically requires groups to be Mail-Enabled Security Groups to be recognized as valid security principals for mailbox delegation.
https://o365reports.com/how-to-use-role-assignable-groups-in-entra-id-for-secure-role-management/ https://www.adamfowlerit.com/2018/09/exchange-online-mail-enabled-security-groups
Box: adding a public DNS recordWhen you need to add a domain to a Microsoft 365 subscription, you must verify the domain by _______________.To verify domain ownership in Microsoft 365, you must add a specific public DNS record provided by the Microsoft 365 admin center. This process ensures that only the actual owner can link a custom domain to the subscription.Verification Record OptionsYou can typically choose between two types of DNS records for verification:TXT Record (Recommended): This is the most common method. It does not affect any existing services like email or website hosting. The record value typically follows the format MS=msXXXXXXXX.MX Record: This can be used if your DNS provider does not support TXT records. If you use this, you must set the priority to a high value (like 32767) so it does not interfere with your current email delivery.
https://community.spiceworks.com/t/add-domain-and-create-users-to-office365-without-changing-dns/312341
Box 1: NoNo - Zero Trust requires an Azure subscription.Zero Trust is a security strategy, not a specific product or service, and therefore does not inherently require an Azure subscription. It is a conceptual framework based on three core principles: verify explicitly, use least privileged access, and assume breach.Box 2: YesYes - Zero Trust is a security strategy, not a specific product.Zero Trust is a security strategy, not a specific product or service.Box 3: NoNo - From the Microsoft 365 admin center, you can enable Zero Trust for your organization.Zero Trust in Microsoft 365 is enabled by implementing recommended identity and device access policies-- such as multi-factor authentication (MFA) and conditional access--primarily through the Microsoft Entra ID and Microsoft Endpoint Manager portals, rather than a single button in the admin center. It requires enforcing strict verification for all users, devices, and applications.
https://learn.microsoft.com/en-us/security/zero-trust/azure-infrastructure-virtual-machines https://learn.microsoft.com/en-us/security/zero-trust/microsoft-365-zero-trust
Which statement accurately describes authorization in Microsoft 365?
Answer(s): C
In Microsoft 365, authorization is the process that determines what an identity is allowed to do once it has been verified.Authorization in Microsoft 365 is the process of verifying what actions (read, write, delete) a validated identity is permitted to perform on a resource, crucial for security. It follows authentication and uses mechanisms like role-based access control (RBAC), Conditional Access, and scopes to manage access for users and applications, often powered by Microsoft Entra ID.
https://learn.microsoft.com/en-us/entra/identity-platform/authentication-vs-authorization
Post your Comments and Discuss Microsoft AB-900 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AB-900 content, but please register or login to continue.