Microsoft MS-102 Exam Dumps, Practice Test Questions

App discovery risk and actual usage evidence were not evaluated. would fit a different circumstance involving: A manager asks which shadow SaaS application poses the greatest risk to the business. Here the actual symptom is: The analyst treats an aggregated policy alert as proof of an exact user click without viewing the event.

The Cloud Discovery data collection excludes roaming endpoint traffic. is a plausible failure in another case: Remote users' SaaS traffic is absent because only office firewall logs are ingested. It does not explain the current incident: The analyst treats an aggregated policy alert as proof of an exact user click without viewing the event.

Policy assignment was mistaken for successful device-side application. would fit a different circumstance involving: A Defender endpoint configuration appears deployed, but the devices are still in an unsafe state. Here the actual symptom is: The analyst treats an aggregated policy alert as proof of an exact user click without viewing the event.

Apply an Unsanctioned tag to the discovered app with appropriate enforcement integration. can be useful when a company wants to mark an investigated cloud app as prohibited for corporate use. However, it does not specifically achieve: The discovered-app report reflects cloud usage from off-network endpoints.

Use Defender for Cloud Apps OAuth application governance and consent review features where supported. addresses another administrative need: Security needs to identify cloud applications receiving broad OAuth permissions from employees. This question instead requires the outcome: The discovered-app report reflects cloud usage from off-network endpoints.

Create a well-scoped advanced-hunting query to identify the defined anomaly in available telemetry. can be useful when an SOC wants repeatable analysis of unusual data exfiltration event patterns rather than manual clicking for each alert. However, it does not specifically achieve: The discovered-app report reflects cloud usage from off-network endpoints.

Connect the Microsoft 365 service with appropriate permissions in the app connectors area. is directed at a separate task: Security wants Microsoft Defender for Cloud Apps to access supported Microsoft 365 activity using an application connector. It does not produce the required configuration outcome: The discovered-app report reflects cloud usage from off-network endpoints.

Set the discovered app as unsanctioned and integrate supported blocking controls. implements a different mechanism for: A company wants to mark an investigated cloud app as prohibited for corporate use. It does not configure the mechanism needed here: Use supported endpoint-derived discovery telemetry rather than relying solely on a headquarters proxy.

Review the recommended improvement actions and assign accountable owners for applicable controls. is directed at a separate task: A chief information security officer wants a prioritized view of actionable security posture recommendations. It does not produce the required configuration outcome: The discovered-app report reflects cloud usage from off-network endpoints.

A qualifying login pattern creates a Cloud Apps policy alert. would assess a different control. In this case it does not rule out the specific failure: Remote users' SaaS traffic is absent because only office firewall logs are ingested.

The team identifies both the policy condition and the user action that triggered it. is evidence of another system state: Investigators must differentiate cloud app file-sharing policy alerts from raw individual user activities. The acceptance evidence here instead is: The discovered-app report reflects cloud usage from off-network endpoints.

A previously delivered harmful message is remediated according to available protection. would assess a different control. In this case it does not rule out the specific failure: Remote users' SaaS traffic is absent because only office firewall logs are ingested.

The app was not formally marked unsanctioned in Cloud Apps policy workflow. would fit a different circumstance involving: A company wants to mark an investigated cloud app as prohibited for corporate use. Here the actual symptom is: Remote users' SaaS traffic is absent because only office firewall logs are ingested.

The Microsoft 365 app connector was not fully authorized or enabled. is a plausible failure in another case: Microsoft 365 app activities never arrive in Cloud Apps after an incomplete connector wizard. It does not explain the current incident: Remote users' SaaS traffic is absent because only office firewall logs are ingested.

Related alerts were not correlated and triaged through the shared Defender XDR incident. would fit a different circumstance involving: A suspicious sign-in and an endpoint malware alert refer to the same compromised employee. Here the actual symptom is: Remote users' SaaS traffic is absent because only office firewall logs are ingested.

Use labeling activity evidence and appropriate audit history in Microsoft Purview. can be useful when a data protection officer wants to prove that a label was changed by an employee on a certain day. However, it does not specifically achieve: Test content matching the intended identifier is detected while unrelated strings are not.

Use Microsoft Purview retention labels and retention policies according to item-specific lifecycle requirements. addresses another administrative need: An HR department must retain employee-related records for a designated period to meet its policy. This question instead requires the outcome: Test content matching the intended identifier is detected while unrelated strings are not.

Apply Purview DLP to eligible OneDrive accounts for specific sensitive data patterns. can be useful when employees store sensitive customer files in OneDrive and the organization wants targeted sharing protection. However, it does not specifically achieve: Test content matching the intended identifier is detected while unrelated strings are not.

Publish a sensitivity label policy specifying the approved default label for the department. is directed at a separate task: The company needs a default sensitivity label for new Office documents in a controlled department. It does not produce the required configuration outcome: Test content matching the intended identifier is detected while unrelated strings are not.

Create the appropriate retention label and publish it to the intended SharePoint or OneDrive location. implements a different mechanism for: An HR department must retain employee-related records for a designated period to meet its policy. It does not configure the mechanism needed here: Create a custom sensitive information type using a supported regular-expression pattern and confidence evidence.

Configure an eligible Purview DLP policy for Power BI with supported conditions and actions. is directed at a separate task: A managed Power BI environment should alert when regulated data in supported artifacts violates a compliance rule. It does not produce the required configuration outcome: Test content matching the intended identifier is detected while unrelated strings are not.

The Internal label appears in eligible Office labeling interfaces. would assess a different control. In this case it does not rule out the specific failure: The custom detector flags arbitrary numbers without the required employee identifier structure.

A document can have the planned classification protection and lifecycle obligations. is evidence of another system state: An administrator wants to distinguish file sensitivity labeling from organizational content-retention requirements. The acceptance evidence here instead is: Test content matching the intended identifier is detected while unrelated strings are not.

An in-scope Teams message with regulated data triggers the expected response. would assess a different control. In this case it does not rule out the specific failure: The custom detector flags arbitrary numbers without the required employee identifier structure.

The retention start trigger does not match the records schedule. would fit a different circumstance involving: A legal group must distinguish a retention period that starts on creation from one based on a later event. Here the actual symptom is: The custom detector flags arbitrary numbers without the required employee identifier structure.

The published label policy lacks the default label or targets the wrong users. is a plausible failure in another case: New files in the department remain unlabeled despite an approved default policy. It does not explain the current incident: The custom detector flags arbitrary numbers without the required employee identifier structure.

The DLP policy never included the OneDrive location. would fit a different circumstance involving: Employees store sensitive customer files in OneDrive and the organization wants targeted sharing protection. Here the actual symptom is: The custom detector flags arbitrary numbers without the required employee identifier structure.

Use Microsoft Purview retention labels and retention policies according to item-specific lifecycle requirements. can be useful when an HR department must retain employee-related records for a designated period to meet its policy. However, it does not specifically achieve: Documents containing protected code words produce the intended sensitive-information match.

Use labeling activity evidence and appropriate audit history in Microsoft Purview. addresses another administrative need: A data protection officer wants to prove that a label was changed by an employee on a certain day. This question instead requires the outcome: Documents containing protected code words produce the intended sensitive-information match.

Configure Purview DLP for supported Teams chat and channel messages. can be useful when a company wants DLP to apply to sensitive messages sent through supported Microsoft Teams chats. However, it does not specifically achieve: Documents containing protected code words produce the intended sensitive-information match.

Create a retention label policy that makes approved labels available to the target location. is directed at a separate task: A records manager wants an employee to manually choose a retention classification on eligible documents. It does not produce the required configuration outcome: Documents containing protected code words produce the intended sensitive-information match.

Query the relevant Activity explorer labeling event or audit record with identity and time filters. implements a different mechanism for: A data protection officer wants to prove that a label was changed by an employee on a certain day. It does not configure the mechanism needed here: Use a sensitive information type with a curated keyword list where appropriate.

Configure the rule's policy tip text and notification scope. is directed at a separate task: A DLP policy detects genuine sensitive material but should inform employees why an action was blocked. It does not produce the required configuration outcome: Documents containing protected code words produce the intended sensitive-information match.