Practice Test #2

Correct answer: D. Encrypting. Encrypting a file converts readable plaintext into unreadable ciphertext using an encryption algorithm and a cryptographic key. Only viewers (users, services, or applications) that have the appropriate key (and permission to use it) can decrypt the file and make the data readable and usable again. This directly matches the sentence’s wording: “readable and usable to viewers that have the appropriate key.” Why the other options are wrong: - A. Archiving: Typically bundles files and/or moves them to long-term storage (for retention, backup, or compliance). Archived data may still be readable without any key unless it is also encrypted. - B. Compressing: Reduces file size by encoding data more efficiently. Compressed files are still readable by anyone who can decompress them; no cryptographic key is inherently required. - C. Deduplicating: Eliminates duplicate data blocks to save storage. It changes how data is stored, not who can read it. Exam tip: if a question mentions “key,” “ciphertext,” “decrypt,” or “only authorized viewers can read,” it’s pointing to encryption.

Yes. You can create custom roles in Azure Active Directory (Microsoft Entra ID). These are commonly referred to as custom directory roles. They allow you to define a role with a specific set of permissions (directory-level permissions) rather than relying only on built-in roles like User Administrator or Security Administrator. This supports least privilege by granting only the exact permissions required for a job function. Why “No” is incorrect: Entra ID is not limited to only built-in roles. While many organizations start with built-in roles, custom roles are available to meet more granular administrative needs. Note the common exam trap: don’t confuse Entra ID custom directory roles with Azure RBAC custom roles. Both exist, but they apply to different scopes (directory vs Azure resources). The statement is still true because it explicitly says “in Azure AD.”

Yes. Global administrator is a role in Azure Active Directory (Microsoft Entra ID). It is the highest-privileged directory role and has broad permissions across the tenant, including managing users, groups, app registrations, and many tenant-wide settings. Because of its power, best practice is to minimize the number of Global administrators, use dedicated admin accounts, and protect them with strong authentication (MFA) and privileged access controls. Why “No” is incorrect: Global administrator is one of the most fundamental built-in Entra ID roles and is frequently referenced in Microsoft identity documentation and exam objectives. Another common confusion is with Azure subscription roles (Owner/Contributor), but Global administrator is specifically a directory role, not an Azure resource RBAC role.

No. An Azure AD (Microsoft Entra ID) user can be assigned multiple roles. Role assignments are not limited to a single role per user. For example, a user could be both a User Administrator and an Application Administrator, or hold additional roles for security and compliance operations. This flexibility supports real-world operational needs but must be governed carefully to avoid excessive privilege. Why “Yes” is incorrect: Entra ID role-based access is designed to be additive. Limiting users to only one role would be impractical and would force organizations into overly broad roles. From a security best-practice perspective, you should still follow least privilege and separation of duties, but the platform capability absolutely allows multiple role assignments (directly or via group-based role assignment where supported).

Correct answer: B. With Windows Hello for Business, a user’s biometric data (the biometric template) is stored on the local device only. The biometric is used as a local gesture to unlock a cryptographic key (typically protected by the TPM). Azure AD/Entra ID does not receive or store the biometric template; it only has the associated public key information needed to validate authentication. Why the others are wrong: A is incorrect because WHfB does not store biometric data on an external device as the standard model; the template is kept on the device where enrollment occurred. C is incorrect because Azure AD does not store biometric templates; storing biometrics centrally would increase privacy and breach risk. D is incorrect because biometric templates are not replicated across a user’s devices. Each device has its own local biometric enrollment and its own key material registration.

Correct answer: B. an identity provider. Azure Active Directory (Azure AD), now branded as Microsoft Entra ID, is Microsoft’s cloud identity provider (IdP) and identity and access management service. It performs authentication (validating credentials and sign-in) and supports authorization by issuing security tokens (for example, OAuth 2.0/OpenID Connect/SAML tokens) containing claims that applications and Azure services use to grant access. It also integrates with Conditional Access, MFA, and RBAC to enforce access decisions. Why the others are wrong: A (XDR system): XDR (e.g., Microsoft Defender XDR) correlates and responds to threats across endpoints, identities, email, and apps; it is not the service that authenticates users. C (management group): Management groups are an Azure governance hierarchy for organizing subscriptions and applying policy/RBAC at scale; they don’t provide authentication. D (SIEM system): SIEM (e.g., Microsoft Sentinel) collects and analyzes logs/events for security monitoring and incident response; it doesn’t act as the IdP for sign-in and token issuance.

Correct answer: D. Incidents. In Microsoft 365 Defender, an incident is the primary container used to group and correlate multiple alerts that are determined to be part of the same attack or campaign. The incident view provides an aggregated “attack story,” showing related alerts, affected entities (users/devices/mailboxes), evidence, severity, and recommended remediation steps. This is exactly what the prompt describes: “an aggregation of alerts that relate to the same attack.” Why the others are wrong: - A. Reports: Reports provide dashboards and analytics (trends, volumes, security posture) but do not serve as the operational aggregation object for related alerts. - B. Hunting: Advanced hunting is for proactive investigation using queries (KQL) across telemetry; it helps you discover suspicious activity but does not automatically aggregate alerts into a single case. - C. Attack simulator: Used for simulated attacks (for example, phishing simulations) to train users and assess readiness, not for correlating real alerts from an active attack.