Task 4.1: Evaluate solutions for securing Microsoft 365

• AData access governance reports to find sites with potentially overshared or sensitive content

  Correct

  These reports help you discover overshared or sensitive sites so you can fix access.

• BGranting Copilot its own service account with read access to every site so that answers stay consistent

  Incorrect

  A broad service account adds a powerful standing identity and does nothing about the content that's already overshared.

• CAssigning Copilot licenses only to the employees who have completed the bank's data-handling training

  Incorrect

  Training doesn't change the sharing settings, so the overshared sites stay exactly as exposed.

• DRestricted Content Discovery on the sensitive sites while permissions are reviewed

  Correct

  It limits discovery of those sites' content in organization-wide search and Copilot responses as a temporary control.

• EWeekly reviews of Purview Audit records for Copilot activity

  Incorrect

  Audit records show what happened after the fact; they don't reduce what Copilot can surface from overshared sites.

Overshared content becomes discoverable through Copilot. Data access governance reports in SharePoint help find potentially overshared or sensitive sites, and Restricted Content Discovery temporarily limits discovery of content from specific sites in organization-wide search and Copilot responses while permissions are reviewed.

• AKeep the custom policies and review them yearly

  Incorrect

  Custom policies are what drift from recommendations.

• BThe Strict preset policy for executives and approvers, and Standard for everyone else

  Correct

  Preset policies apply Microsoft's recommended settings, with Strict for high-value targets.

• CTag the executives and approvers as priority accounts and keep the custom policies unchanged

  Incorrect

  Priority account tagging adds visibility and targeted protection, but the custom policies would keep drifting from Microsoft's recommendations.

• DAllow all mail from the executives' own domains with a tenant allow list entry, so that internal messages are never delayed by scanning

  Incorrect

  Allow entries bypass filtering and help spoofing succeed.

Preset security policies in Defender for Office 365 apply Microsoft's recommended settings for anti-spam, anti-malware, anti-phishing, Safe Links and Safe Attachments. The Standard preset suits most users, while the Strict preset is more aggressive and suits high-value targets such as priority accounts.

• ADefender CSPM, with environment connectors that bring the Salesforce and ServiceNow tenants into Defender for Cloud

  Incorrect

  Defender CSPM covers Azure, AWS and GCP, DevOps platforms and some external registries; it doesn't assess the security configuration of SaaS apps.

• BSaaS security posture management, with Security recommendations turned on for each app connector

  Correct

  SSPM in Defender for Cloud Apps assesses the security configuration of apps connected by supporting app connectors, Salesforce and ServiceNow among them, and sends benchmark-based recommendations with implementation steps to the Defender portal.

• CCloud Discovery, with the cloud app catalog's risk scores for Salesforce and ServiceNow reviewed every month

  Incorrect

  Catalog risk scores rate an app and its vendor on general, security, compliance and legal factors; they don't assess how the company's own tenant is configured.

• DConditional Access app control session policies for the administrators of both apps

  Incorrect

  Session policies monitor and control user sessions in real time; they don't assess the apps' configuration against benchmarks or give remediation steps.

SaaS security posture management (SSPM) in Microsoft Defender for Cloud Apps provides security configuration assessments for SaaS apps. Once an app is connected with an app connector that supports SSPM, such as Salesforce or ServiceNow, turning on Security recommendations for the instance sends recommendations based on Microsoft benchmarks, each with an implementation guide, to Microsoft Security Exposure Management. Defender CSPM covers cloud infrastructure and DevOps environments, catalog risk scores rate apps in general, and session policies control live sessions.

• AIntune configuration profiles alone

  Incorrect

  Configuration profiles set settings but don't gate access on their own.

• BIntune compliance policies, plus Conditional Access requiring a compliant device

  Correct

  Compliance policies evaluate device health, and Conditional Access uses the compliance state to allow or block access.

• CA Conditional Access policy that requires MFA only, combined with a monthly reminder to users to update and encrypt their laptops

  Incorrect

  MFA checks the user, not the device's health.

• DApp protection policies on the laptops

  Incorrect

  App protection policies target mobile apps, not full device health on laptops.

Intune compliance policies set rules, such as encryption, minimum OS version and device risk from Defender for Endpoint, that devices must meet. Conditional Access can then require a device to be marked compliant before granting access to apps and data.

• AEncrypts all outgoing email to external recipients

  Incorrect

  Encryption is a different feature.

• BChecks URLs when a user clicks them

  Correct

  Safe Links provides time-of-click verification of URLs.

• CBlocks all external email

  Incorrect

  Safe Links doesn't block external mail.

• DBacks up mailboxes daily

  Incorrect

  That isn't a Safe Links feature.

Safe Links in Defender for Office 365 provides URL scanning and rewriting of inbound messages and time-of-click verification of URLs in email and Office apps.

• ASafe Attachments and Safe Links policies

  Incorrect

  Safe Attachments and Safe Links are Defender for Office 365 Plan 1 capabilities.

• BDefender for Cloud Apps session policies

  Incorrect

  Session policies control cloud app sessions through a proxy; they don't filter mail.

• CAttack simulation training campaigns

  Incorrect

  Attack simulation training is a Defender for Office 365 Plan 2 capability.

• DThe built-in security features for all cloud mailboxes

  Correct

  Every organization with cloud mailboxes gets built-in protection against spam, malware, phishing and other email threats.

Microsoft 365 includes built-in security features for all cloud mailboxes, which protect against spam, malware, phishing and other email threats, such as anti-malware, anti-spam and anti-phishing (spoofing) protection. They're the bottom of the protection ladder; Defender for Office 365 Plan 1 adds capabilities such as Safe Attachments and Safe Links, and Plan 2 adds attack simulation training, investigation and automation.

• ASafe Links time-of-click protection

  Incorrect

  Safe Links checks URLs at click time; it doesn't remove messages that were already delivered.

• BAttack simulation training

  Incorrect

  That trains users with simulated attacks.

• CZero-hour auto purge (ZAP)

  Correct

  ZAP retroactively acts on delivered messages found to be malicious.

• DPreset security policies

  Incorrect

  Presets apply recommended settings.

Zero-hour auto purge (ZAP) detects and neutralizes malicious phishing, spam or malware messages that have already been delivered to Exchange Online mailboxes.

• AEvery file in the tenant

  Incorrect

  Copilot respects permissions.

• BOnly files the user created in OneDrive

  Incorrect

  Shared content the user can view is also used.

• CContent the user can already view

  Correct

  Copilot surfaces only data the individual user can access.

• DOnly public internet content

  Incorrect

  Copilot uses organizational data within permissions too.

Microsoft Copilot only surfaces organizational data to which individual users have at least view permissions, so permission models in services such as SharePoint determine what Copilot can use. Microsoft 365 Copilot is now named Microsoft Copilot.