Question 730 A simulated phishing campaign targets employees handling regulated personal data. What should the campaign designer avoid? Providing postcampaign awareness materials Using controlled mock sign-in pages with no real credential collection Collecting real employee passwords or sensitive information as training evidence Configuring defined participants and time windows Explanation Correct Answer C:Simulation should measure behavior without exposing secrets. Incorrect Answers A:Education supports the training program. B:Safe simulations are appropriate. D:Scope control is a proper safeguard.
Question 731 Security confirms a reported message is benign marketing and reports the false positive. What should be documented? The organization should disable Safe Links entirely User reporting should be disabled permanently All future marketing mail is safe regardless of sender Evidence for benign classification and any narrow policy correction required Explanation Correct Answer D:Documented disposition improves tuning and trust. Incorrect Answers A:Broad control removal is unrelated to one verdict. B:One false alarm does not invalidate reports. C:Other messages can still be malicious.
Question 732 A security manager assumes every Microsoft 365 tenant includes attack simulation training. What should be validated? Only the number of Outlook mail folders Only the default company domain alias Only the users' Teams device compliance status Relevant Defender for Office 365 entitlements and campaign permissions Explanation Correct Answer D:Availability depends on licensed features and authorized roles. Incorrect Answers A:Folder count does not grant simulation licensing. B:Domain naming is not an entitlement. C:Device compliance does not grant simulation rights.
Question 733 A user was restricted from sending following an attack; their password was reset but a malicious inbox rule remains. What should responders verify before allowing mail again? Remove persistence, review sign-ins and confirm outbound risk is contained Delete the attacker-delivered message but retain the unauthorized inbox rule Unblock immediately because the password changed Delete all anti-spam policy rules to avoid reblock Explanation Correct Answer A:Password reset alone may leave abuse mechanisms. Incorrect Answers B:Removing one message cannot remove mailbox-rule persistence or verify that outbound abuse and unauthorized sessions are contained. C:Other compromise artifacts can remain. D:Protection removal creates risk.
Question 734 A newly acquired brand begins sending through Microsoft 365, but existing anti-phishing user protection names only the old brand. What should be reviewed? Assume protections automatically cover every new external domain Disable impersonation alerts during migration Change all mailboxes to a shared mailbox type Domain and VIP protection scope for the added brand and applicable recipients Explanation Correct Answer D:Acquisitions can introduce uncovered identities and domains. Incorrect Answers A:Configuration scope should be verified. B:A migration is a heightened spoofing risk. C:Mailbox type does not update policy targets.
Question 735 Users report sent messages they never composed after a phishing campaign. What should security correlate? Only the company's DKIM selector CNAME values Only Defender for Endpoint vulnerability list Only recipients' spam folder counts Outbound message traces, mailbox audit events and suspicious account sign-ins Explanation Correct Answer D:Multi-source evidence helps distinguish compromise from misconfiguration. Incorrect Answers A:Signing configuration alone cannot establish account misuse. B:Potential CVEs cannot prove mailbox sending activity. C:Junk volume does not show who originated the messages.
Question 736 An organization centrally manages Windows laptops in Intune and wants Defender for Endpoint telemetry. Which onboarding approach should be evaluated? Configure Defender Antivirus policies through Intune but omit the distinct supported Microsoft Defender for Endpoint device onboarding settings Push an Intune attack surface reduction policy to the laptops and assume those protections alone enroll the devices for Defender for Endpoint telemetry Grant users Defender portal access and enable device inventory views without actually delivering Defender for Endpoint onboarding configuration through Intune Deploy supported Defender for Endpoint onboarding policy through Intune Explanation Correct Answer D:The management platform can configure enrolled devices at scale. Incorrect Answers A:Antivirus policy management does not itself guarantee enrollment of the endpoint sensor and telemetry into Defender for Endpoint. B:ASR controls manage attack prevention but are not a substitute for the product's supported onboarding workflow and sensor registration. C:Portal visibility or user roles cannot generate endpoint telemetry for devices whose Defender sensor was never onboarded.
Question 737 A production Windows Server is not managed by Intune but must report endpoint threat data. What should admins select? Assume Windows Server is covered by a user's Office license Apply a Purview data-retention label to the server object instead of checking supported server licensing and endpoint onboarding coverage A supported Defender for Endpoint server onboarding route and required licensing Enroll the server as a mail contact Explanation Correct Answer C:Server onboarding methods can differ from managed laptops. Incorrect Answers A:User productivity licensing may not include server protection. B:Retention labels preserve data and do not establish Defender for Endpoint eligibility or server sensor protection. D:Contact objects do not install endpoint sensors.
Question 738 An endpoint reports onboarded but has never transmitted sensor events. Which evidence should be checked? Sensor status, connectivity, diagnostic onboarding test and service health Only its last Office activation time Review only the latest antivirus signature timestamp without inspecting sensor connectivity Check the onboarding status alone and assume an enrolled device is already sending endpoint telemetry Explanation Correct Answer A:Enrollment alone is not proof of telemetry flow. Incorrect Answers B:Office licensing is not endpoint sensor state. C:Up-to-date intelligence can coexist with a broken or disconnected Defender for Endpoint sensor. D:An onboarded status is not sufficient proof that the sensor communicates and emits expected device events.
Question 739 A retired laptop continues appearing in Defender inventory after asset disposal. What should be assessed? Change the user's mail alias Turn off all security reporting tenant-wide Delete the entire tenant to clear inventory Supported offboarding and device inventory lifecycle, including retention timing Explanation Correct Answer D:Historical device records may remain after sensor removal. Incorrect Answers A:Aliases do not offboard endpoint sensors. B:Global visibility loss is disproportionate. C:Tenant deletion is not device cleanup.
Question 740 Users frequently execute scripts downloaded from untrusted email attachments. Which feature family can block risky process behaviors? Supported Defender attack surface reduction rules with staged policy targeting Only Secure Score reporting without enforcement Block sender domains in Exchange but leave locally downloaded script execution rules unchanged Only Microsoft 365 usage statistics Explanation Correct Answer A:ASR rules can prevent selected risky execution patterns. Incorrect Answers B:Posture reports cannot block individual processes. C:Mail controls can limit one delivery route, while endpoint attack surface reduction directly addresses untrusted script behavior. D:Adoption reports do not control process execution.
