Correct Answer:

Explanation:
Compliance Manager tracks only customer-managed controls. No
Compliance Manager provides predefined templates for creating assessments. Yes Compliance Manager can help you assess whether data adheres to specific data protection standards. No Microsoft Purview Compliance Manager is described as a feature that "helps you manage your organization's compliance requirements" by giving you assessments, improvement actions, and a compliance score that
"measures your progress in completing recommended actions" aligned to regulations and standards. The service does not track only customer-managed controls; Microsoft's documentation clarifies that Compliance Manager includes "Microsoft-managed controls and customer-managed controls," and it tracks both within each assessment to show overall posture. It also provides prebuilt (predefined) assessment templates for common regulations and industry standards so organizations can "create assessments from templates" such as GDPR, ISO/IEC 27001, and the Data Protection Baseline.
Importantly, Compliance Manager evaluates control implementation and improvement actions mapped to requirements; it does not scan or classify individual data to determine whether specific data items "adhere" to a standard. Instead, it helps you assess organizational compliance posture by tracking the status of controls, assigning actions, and recording evidence. Thus:
"Tracks only customer-managed controls" # No (it tracks Microsoft-managed and customer-managed).
"Provides predefined templates for creating assessments" # Yes (prebuilt templates are a core feature).
"Helps you assess whether data adheres to specific data protection standards" # No (it measures control
/compliance posture, not data-level adherence).
Box 1: No
Compliance Manager tracks Microsoft managed controls, customer-managed controls, and shared controls.
Box 2: Yes
Box 3: Yes
Reference:
https://docs.microsoft.com/en-us/microsoft-365/compliance/compliance-manager?view=o365-worldwide

Correct Answer:

Explanation:
multi-factor authentication (MFA)
In Microsoft Entra ID (formerly Azure AD), Security defaults are a baseline of recommended identity protections that, when turned on, automatically apply tenant-wide. Microsoft's guidance explains that security defaults "help protect your organization with preconfigured security settings" and specifically require that "all users register for Azure AD Multi-Factor Authentication." When enabled, the defaults enforce MFA challenges for users and admins during risky or sensitive operations, and they block legacy authentication protocols that can't satisfy modern MFA requirements. Microsoft further notes that security defaults "provide basic identity s ecurity mechanisms... such as requiring multi-factor authentication for all users and administrators." These controls are designed to raise the overall security posture without custom policy design, which is ideal for small and medium organizations or any tenant that hasn't yet implemented Conditional Access. Therefore, when you enable security defaults, MFA is enabled for all Azure AD users, driving strong authentication as the default and reducing account-takeover risk stemming from password-only sign-ins.

Correct Answer:

Correct Answer:

Explanation:

Microsoft describes hybrid identity as integrating on-premises Active Directory with Microsoft Entra ID (Azure AD) so that "your on-premises identities are synchronized to Azure AD" for a single identity across cloud and on-prem apps. In this model, directory objects (users, groups, and selected attributes) flow from on- premises AD to Azure AD using Azure AD Connect or Cloud Sync; this is the canonical direction for provisioning in hybrid environments. Microsoft further explains that while certain writeback features (such as password writeback, device or group writeback scenarios) are supported, cloud-created users do not automatically sync down to on-premises AD; account provisioning remains authoritative on-prem unless you deploy specific, limited writeback features-there is no default "user account creation from Azure AD to AD DS." For authentication, Microsoft states that hybrid identity supports cloud authentication (Password Hash Synchronization or Pass-through Authentication) where Azure AD performs the sign-in, or federation with another identity provider (e.g., AD FS or a third-party IdP) where that provider validates credentials and issues tokens to Azure AD. These statements align with Microsoft's SCI guidance on hybrid identity: on-prem to cloud sync is standard; automatic reverse user sync is not; and authentication can be handled by Azure AD or a federated IdP depending on the chosen sign-in method.

Correct Answer:

Explanation:

Microsoft defines Information Barriers (IB) as policies that "restrict communication and collaboration between specific users or groups" to meet regulatory or conflict-of-interest requirements. In Microsoft 365, IB enforcement is provided across collaboration workloads-most notably Microsoft Teams and, with IB v2, SharePoint and OneDrive-so that users placed in segments that shouldn't interact are prevented from chatting, meeting, or sharing files with one another. The service "controls who can communicate and collaborate with whom" and applies those controls to Teams chats/channels and SharePoint/OneDrive sites and files so that segment boundaries are honored when users attempt to share or access content.
By contrast, Exchange Online email is not a supported enforcement surface for Information Barriers; IB does not block or route mail. Email restrictions are handled with other capabilities (for example, mail flow rules), not IB. Therefore, in alignment with Microsoft's SCI guidance: IB does work with Microsoft Teams and with Microsoft SharePoint/OneDrive, but it does not provide policy enforcement for Exchange email.