QUESTION: 80 Exam Topic: 2 - Question Set 2

You have a Microsoft 365 subscription.
You recently con gured a Microsoft SharePoint Online tenant in the subscription.
You plan to create an alert policy.
You need to ensure that an alert is generated only when malware is detected in more than ve documents stored in SharePoint Online during a period of 10 minutes.
What should you do rst?

Enable Microsoft O ce 365 Cloud App Security.
Deploy Windows Defender Advanced Threat Protection (Windows Defender ATP).
Enable Microsoft O ce 365 Analytics.

Answer(s): B

Explanation:

An alert policy consists of a set of rules and conditions that de ne the user or admin activity that generates an alert, a list of users who trigger the alert if they perform the activity, and a threshold that de nes how many times the activity has to occur before an alert is triggered.
In this question, we would use the Malware detected in le activity in the alert settings then con gure the threshold (5 detections) and the time window (10 minutes).
The ability to con gure alert policies based on a threshold or based on unusual activity requires Advanced Threat Protection (ATP).

Reference:

https://docs.microsoft.com/en-us/microsoft-365/compliance/alert-policies

Reveal Solution Next Question

QUESTION: 81 Exam Topic: 2 - Question Set 2

From the Microsoft Azure Active Directory (Azure AD) Identity Protection dashboard, you view the risk events shown in the exhibit.

You need to reduce the likelihood that the sign-ins are identi ed as risky.
What should you do?

From the Security & Compliance admin center, add the users to the Security Readers role group.
From the Conditional access blade in the Azure Active Directory admin center, create named locations.
From the Azure Active Directory admin center, con gure the trusted IPs for multi-factor authentication.
From the Security & Compliance admin center, create a classi cation label.

Answer(s): B

Explanation:

A named location can be con gured as a trusted location. Typically, trusted locations are network areas that are controlled by your IT department. In addition to
Conditional Access, trusted named locations are also used by Azure Identity Protection and Azure AD security reports to reduce false positives for risky sign-ins.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition

Reveal Solution Next Question

QUESTION: 82 Exam Topic: 2 - Question Set 2

DRAG DROP (Drag and Drop is not supported)
You have a Microsoft 365 subscription.
You have the devices shown in the following table.

You need to onboard the devices to Windows Defender Advanced Threat Protection (ATP). The solution must avoid installing software on the devices whenever possible.
Which onboarding method should you use for each operating system? To answer, drag the appropriate methods to the correct operating systems. Each method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1:
To onboard down-level Windows client endpoints to Microsoft Defender ATP, you'll need to:
Con gure and update System Center Endpoint Protection clients.
Install and con gure Microsoft Monitoring Agent (MMA) to report sensor data to Microsoft Defender ATP Box 2:
For Windows 10 clients, the following deployment tools and methods are supported:

Group Policy
System Center Con guration Manager
Mobile Device Management (including Microsoft Intune)

Local script
Box 3:
Windows Server 2016 can be onboarded by using Azure Security Centre. When you add servers in the Security Centre, the Microsoft Monitoring Agent is installed on the servers.

Reference:

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced- threat-protection https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/con gure-endpoints-windows- defender-advanced-threat-protection https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/con gure- server-endpoints-windows-defender-advanced-threat- protection

Reveal Solution Next Question

QUESTION: 83 Exam Topic: 2 - Question Set 2

HOTSPOT (Drag and Drop is not supported)
You have a Microsoft 365 subscription.
You need to implement Windows Defender Advanced Threat Protection (ATP) for all the supported devices enrolled devices enrolled on mobile device management (MDM).
What should you include in the device con guration pro le? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

See Explanation section for answer.

Answer(s): A

Explanation:

You can integrate Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) with Microsoft Intune as a Mobile Threat Defense solution.
Integration can help you prevent security breaches and limit the impact of breaches within an organization. Microsoft Defender ATP works with devices that run
Windows 10 or later.
When you establish a connection from Intune to Microsoft Defender ATP, Intune receives a Microsoft Defender ATP onboarding con guration package from
Microsoft Defender ATP. This package is deployed to devices by using a device con guration pro le.

Reference:

https://docs.microsoft.com/en-us/intune/advanced-threat-protection

Reveal Solution Next Question

Free MS-100 Exam Braindumps

QUESTION: 80 Exam Topic: 2 - Question Set 2

Explanation:

Reference:

QUESTION: 81 Exam Topic: 2 - Question Set 2

Explanation:

Reference:

QUESTION: 82 Exam Topic: 2 - Question Set 2

Explanation:

Reference:

QUESTION: 83 Exam Topic: 2 - Question Set 2

Explanation:

Reference: