Microsoft guidance describes Azure Blueprints as the native way to stamp out governed environments consistently across tenants and subscriptions. Microsoft states: "Azure Blueprints enables cloud architects and central information technology groups to define a repeatable set of Azure resources that implements and adheres to an organization's standards, patterns, and requirements." It further explains that "Blueprints make it possible to package artifacts, such as role assignments, policy assignments, ARM templates, and resource groups, into a single blueprint definition that can be assigned to your subscriptions." This is precisely what's required when you need to deploy Azure resources across multiple subscriptions in a consistent manner-you define a blueprint (with policies, RBAC, templates, and resource groups) and assign it to one or more subscriptions to get uniform, compliant deployments. While services like Microsoft Defender for Cloud and Azure Policy help assess and enforce security and compliance, Blueprints orchestrate multi-artifact deployment and governance at scale from day one of an environment's lifecycle, ensuring standardization and repeatability across subscriptions.

Explanation:

Microsoft explains that Conditional Access (CA) evaluates signals and then enforces access decisions using grant and session controls: "Conditional Access policies are enforced after first-factor authentication is completed" and are used to "make access control decisions." CA policies target users and groups-including administrators-unless explicitly excluded. Microsoft guidance recommends excluding only break-glass accounts: "Customers with Azure AD roles such as Global administrator should have at least one emergency access account excluded from policies." This means admins are not exempt by default; they are in scope unless you configure exclusions.
CA does not manage directory role assignments; that is handled by role assignment and Privileged Identity Management (PIM). CA's grant controls focus on access conditions: "Grant access... Require multi-factor authentication" and Microsoft lists a common baseline: "Require multi-factor authentication for all users." Therefore, CA can require MFA to access cloud apps, but it cannot add users to Azure AD roles.
These statements from Microsoft's SCI materials confirm the outcomes: Admins are not inherently exempt (No), CA cannot assign roles (No), and CA can force MFA for app access (Yes).

Explanation:

In the Microsoft 365 security center (now Microsoft 365 Defender), incidents are used to triage and investigate threats across the tenant. Microsoft's security documentation explains that "an incident is a collection of related alerts" that are automatically correlated to give analysts a single, end-to-end view of an attack. Within each incident, the portal surfaces impacted assets such as devices, users, mailboxes, and applications, enabling responders to quickly identify which endpoints are affected by a given alert and to take response actions (isolate device, collect investigation package, run AV scan, etc.). This design allows security teams to move beyond individual alerts and instead work a consolidated investigation that lists affected devices in the incident's Evidence & Response/Assets sections, complete with alert timelines and device details.
By comparison, Secure Score measures the organization's security posture and recommendations; policies are configuration/enforcement objects (e.g., Defender or compliance policies) and are not the investigative view for alerts; classifications relate to information protection labeling rather than alert investigation. Therefore, to identify devices that are affected by an alert, you use the Incidents experience in Microsoft 365 Defender, where correlated alerts show the devices involved alongside the entities and evidence connected to the threat.
Reference:
https://docs.microsoft.com/en-us/microsoft-365/security/defender/incidents-overview?view=o365-worldwide

In Microsoft's Security, Compliance, and Identity guidance, Data Loss Prevention (DLP) is configured from the compliance portal (formerly called the Microsoft 365 Compliance Center, now Microsoft Purview compliance portal). Microsoft's documentation states that DLP is administered from the compliance experience: "Use data loss prevention (DLP) policies in the Microsoft Purview compliance portal to help identify, monitor, and automatically protect sensitive items" across Microsoft 365 workloads. It further specifies where you create policies: "To create a DLP policy, go to the Microsoft Purview compliance portal
> Data loss prevention > Policies and choose Create policy." The portal provides policy templates, locations, and rules that "help prevent the inadvertent sharing of sensitive information" and enable "policy tips and automatic remediation actions" (such as restricting access, auditing, or blocking).
By contrast, the Microsoft 365 admin center is for tenant administration and licensing, not DLP policy authoring. The Microsoft Endpoint Manager admin center (Intune) manages device and app protection policies, not Microsoft 365 DLP policies. The Microsoft 365 Defender portal surfaces security alerts and investigations but does not host the creation workflow for DLP policies. Therefore, when the requirement is to create a DLP policy, Microsoft directs administrators to the Microsoft 365 Compliance center (Microsoft Purview compliance portal) where the DLP solutions and policy creation wizard reside.

Explanation:

In Microsoft identity and access management terminology, federation refers to the establishment of a trust relationship between identity providers, which enables single sign-on (SSO) across different organizations or platforms.
According to the Microsoft Security, Compliance, and Identity (SCI) learning path, particularly in the SC-900 and SC-300 certifications, the following definition is provided:
"Federation is a means of establishing trust between two identity systems. This trust allows users from one domain to access resources in another domain without needing to authenticate again, typically using SAML, WS-Federation, or OAuth protocols." This concept is essential in cross-organization SSO scenarios, such as enabling users from one enterprise (or identity provider) to authenticate with services hosted in another, using existing credentials.
SCI documentation further states:
"Single sign-on (SSO) between multiple identity providers is enabled through federation protocols, which delegate authentication and allow token-based identity propagation across systems." The other options are not accurate in this context:
Integration is a vague term and not specific to SSO configuration.
Password hash synchronization and pass-through authentication are Azure AD authentication methods used for hybrid identity with on-premises AD, not for federating with external identity providers.
# Therefore, SSO configured between multiple identity providers is best classified as an example of federation.