Correct Answer:

Explanation:
Legal: Files & other data assets; Research: Groups & sites
Microsoft Purview sensitivity labels support multiple scopes that determine which resources the labels can protect and which protection settings administrators can configure.
First selection: Files & other data assets.
The legal department requires document-level protection for Microsoft Word files stored in SharePoint and distributed to external counsel.
The Files & other data assets scope supports sensitivity labels that apply encryption and content markings directly to supported documents.
Because the protection is associated with the document itself, configured encryption and markings can remain with the file when it is downloaded or shared outside its original SharePoint location.
Second selection: Groups & sites.
The research department requires collaboration-level protection for a Microsoft Teams environment.
The Groups & sites scope supports sensitivity labels applied to Microsoft Teams, Microsoft 365 groups, and SharePoint sites. These labels can configure privacy settings, guest access restrictions, external sharing controls, and access restrictions for unmanaged devices.
The Emails scope is intended for email protection, while the Meetings scope controls supported meeting and chat protection capabilities.
Technical consideration: Groups & sites labels do not automatically encrypt every document stored within the associated container. Additionally, restrictions for unmanaged devices require the supporting Microsoft Entra Conditional Access configuration.
Therefore, Files & other data assets is appropriate for Legal, while Groups & sites is appropriate for Research.
Microsoft References:
https://learn.microsoft.com/en-us/purview/sensitivity-labels
https://learn.microsoft.com/en-us/purview/sensitivity-labels-teams-groups-sites

Correct Answer:

Explanation:
Report: Explorer (Threat Explorer); View on the Email entity page: Timeline Microsoft Defender for Office 365 provides Threat Explorer for investigating malicious and suspicious email messages. The Email entity page supplies detailed information about individual messages, including their delivery and post-delivery events.
First selection: Explorer (Threat Explorer).
Threat Explorer enables security analysts to search for email messages using properties such as subject, sender, recipient, detection technology, and delivery status.
The analyst can open Threat Explorer in the Microsoft Defender portal, select the relevant email view, and filter messages by the subject provided in the phishing report. Matching messages can then be examined individually.
Second selection: Timeline.
After identifying the suspicious message, the administrator can open its Email entity page and select the Timeline view.
The Timeline view displays the chronological history of message delivery and subsequent actions. It includes original delivery events, changes caused by Zero-hour Auto Purge (ZAP), quarantine actions, and other recorded message events.
This information enables the administrator to determine where the message was originally delivered and what actions occurred afterward.
Threat Explorer is therefore the correct investigation tool for locating messages by subject, while the Timeline view provides the required delivery and post-delivery history.
Microsoft References:
https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about
https://learn.microsoft.com/en-us/defender-office-365/mdo-email-entity-page

Correct Answer: D  🗳️

Explanation: Only visible for ITPassLeader members. You can sign-up / login (it's free).

Correct Answer:

Explanation:
Microsoft Entra ID supports soft deletion of Microsoft 365 groups, retaining their directory objects and associated service resources for a defined recovery period.
First selection: Group3 only.
The original examination answer reflects the established Microsoft 365 group restoration capability.
Microsoft 365 groups can be restored with their membership, Exchange mailbox, SharePoint site, calendar, and supported associated resources.
Traditional distribution groups and mail-enabled security groups do not use the same Microsoft Entra Microsoft 365 group soft-delete recovery workflow.
Second selection: 30 days.
Microsoft maintains deleted Microsoft 365 groups in a recoverable state for 30 days. Administrators can restore them during that period by using the Microsoft Entra admin center or supported PowerShell commands.
Current Microsoft documentation correction: Microsoft now also supports restoration of cloud security groups through a public-preview capability. Therefore, Group1 may also be recoverable if it is a cloud security group in a supported tenant.
The exhibit identifies Group1 only as Security and does not specify whether it is cloud-managed or synchronized from Active Directory.
As a result, Group3 only is the intended historical answer, but it is no longer unconditionally correct under current Microsoft documentation. The 30-day retention period remains correct.
Microsoft References:
https://learn.microsoft.com/en-us/entra/identity/users/groups-restore-deleted
https://learn.microsoft.com/en-us/microsoft-365/admin/create-groups/restore-deleted-group