Explanation:

The correct selections are No, Yes, No . Microsoft defines Zero Trust as a security strategy and explicitly states that it isn't a product or a service . Instead, it is an approach based on principles such as verify explicitly , use least privilege access , and assume breach . That makes statement 2 true.
Statement 1 is false because Zero Trust does not require an Azure subscription. Microsoft provides Zero Trust guidance across many environments, including Microsoft 365, Copilot, Azure, and hybrid scenarios. It is a strategy that can be implemented with different technologies and is not dependent on owning Azure specifically.
Statement 3 is also false because there is no single switch in the Microsoft 365 admin center to "enable Zero Trust" for an organization. Microsoft's documentation presents Zero Trust as a set of policies, configurations, and deployment steps across services such as Microsoft Entra, Intune, Defender, and Microsoft 365 workloads, not as one admin-center toggle.
Top of Form
Bottom of Form

The correct answers are A and D because Microsoft Entra Identity Secure Score is based on identity security recommendations, and Microsoft Learn specifically lists recommendations such as "Designate more than one Global Administrator" and "Do not expire passwords." That means the number of global administrators in the tenant and whether password expiration is disabled directly influence the Identity Secure Score. Microsoft also notes that the score measures how closely an organization aligns with Microsoft's recommended identity security best practices.
Option B is incorrect because SharePoint site permissions are related to SharePoint and Microsoft 365 workload permissions, not to the Entra identity-focused scoring model. Option C is incorrect because user location may be evaluated in Conditional Access and Zero Trust scenarios, but it is not itself listed as a direct Identity Secure Score factor in the Microsoft Entra recommendations referenced by Microsoft Learn. Identity Secure Score is driven by tracked identity recommendations and security configurations, not by simple geographic placement of users.

Explanation:
The correct selections are No, Yes, Yes . Microsoft documents that the Audit page in the Microsoft Defender portal can be used to search the unified audit log for user and admin actions in the organization.
Microsoft also states that audit log search in the Defender portal is the same as audit log search in the Microsoft Purview portal , which means both portals can be used to review administrative actions taken in Microsoft 365.
Microsoft further explains that Microsoft Purview Audit enables organizations to search for audit records of activities that users and admins perform across Microsoft services, making it a correct tool for this requirement.
By contrast, Search & intelligence in the Microsoft 365 admin center is not the feature used to investigate administrator actions through the unified audit log. It is not Microsoft's documented audit search tool for this purpose. Therefore, for this hotspot the right answers are No for Search & intelligence, Yes for Audit in Microsoft Defender, and Yes for Audit in Microsoft Purview.

The correct answer is D. Data Lifecycle Management . Microsoft Learn states that Microsoft Purview retention policies and retention labels, managed under Data Lifecycle Management , support three core outcomes: retain-only , delete-only , and retain and then delete . The requirement in this question is exact:
keep email for seven years and then permanently delete it. That is a textbook retain and then delete retention configuration, which Microsoft documents as part of Purview's retention capabilities. Microsoft also recommends using Microsoft 365 retention policies and labels for retaining and deleting emails rather than relying on older Exchange-only approaches in most modern compliance scenarios.
The other options do not meet the requirement. Information Protection focuses on labeling and protecting sensitive information. Insider Risk Management is used to detect and investigate risky user behavior. Data Loss Prevention helps prevent inappropriate sharing or exfiltration of sensitive data. None of those are designed to enforce a timed seven-year retention period followed by automatic permanent deletion. The Microsoft Purview solution explicitly built for that lifecycle requirement is Data Lifecycle Management .