HIEPIC.COM : 1984-2024

Just passed with 800.

SSRP

• Writes-back required P1 or P2 License
• Two authentication methods required for AAD admin role
• Does not need to register least one mobile device (more than 1 way instead of mobile)
• Has to be turned on before to enforce

MD ATP > CAS = MD ATP PORTAL

WD ATP > ATP = Azure Portal

PIM

Acronyms:

Roles that allow view and manage assignments in Azure resource roles in PIM

SUB-RES

1. Subscriber Reviewer
2. Resource Administrator

Security Admin / Reader and PIM cannot view assignment by default to Azure Resources roles

Four actions you perform in sequence to enable customer lockbox.

ASP-CLA

1. Sign into Admin.portal.com
2. Select Security and Protection
3. Select Customer Lockbox
4. Ensure Approval is set to On

Three actions to enable Microsoft Defender ATP settings in SCC Dash

1. Open Microsoft Defender Security Center
2. Select Settings, General, Advanced Features
3. Turn on Office 365 Threat Intelligence Conncetion

DATIC

• Defender
• Advance
• Threat Intelligence Connection

Four actions to provide personal data and providing copy to user.

1. Assign eDiscovery permissions to potential case members
2. Create DSR case
3. Run the search query
4. Export the data

ACRE

1. Assign
2. Create
3. Run
4. Export

Four actions to protection SPO with Cloud App Security (CAS) Conditional Access App Control (CAAC).

1. In Azure Portal, Create Conditional Access Policy
2. Set a policy to enforce Conditional Access App Control requirements
3. In CAS Portal (CASP), create session
4. Set Policy to block document print from non-corporate locations

AP,CAP,CAAC, CASP

• AP,CAP : Azure Portal, Conditional Access Policy
• CAAC: Conditional Access App Control
• CA(S)(P): CAS Portal (Session) (Policy)

Five actions to create schedule in Office 365 SCC to receive malware reports

1. Sign into protection.office.com
2. Go Reports & Dashboard
3. Select Malware detected in email report icon
4. Create schedule
5. Create schedule and then Finish

P,RD,M, Create , Create , Finish
(PR,DM)

• P, protection.office.com
• RD, Report & Dashboard
• M, Malware
• Create Schedule
• Create Schedule
• Finish

Four actions to temporary unblock MFA request.

1. Sign into work account at https://portal.azure.com
2. Browse Azure Active Directory and Security
3. Go MFA and select Block/Unblock
4. Add, populate the replication group, user, and reason field, and click Ok.

PAAS,MBAR

• PA, portal.azure.com
• AS, active directory > security
• MB, MFA > Block/Unblock
• AR, Add user + Reason

Logs:

Security:
Application Logs: view Azure AD Connect events.

Labels:

Creating a Data Subject Request (DSR)

1. Create a Data Subject Request (DSR) case.

2. View the results.

3. Export the results.

4. Download the results. (Export and download are not the same. Export uploads search results to Azure Storage in preparation for downloading)

Records:

• “Records are disposed of after their stated retention period is past.”
  
• Mark the content as a record as part of the label settings, and always have proof of disposition when content is deleted at the end of its retention period. Source: https://docs.microsoft.com/en-us/microsoft-365/compliance/retention?view=o365-worldwide

SCC contains permission roles such as:  eDiscovery Manager

Principles of retention: –

1. Retention wins over deletion
2. Longest retention period wins
3. Explicit inclusion wins over implicit inclusion
4. Shortest deletion period wins

From Microsoft Azure Active Directory (Azure AD), you create a security group named Group1. You add 10 users to Group1.
You need to apply app enforced restrictions to the members of Group1 when they connect to Microsoft Exchange Online from non-compliant devices, regardless of their location.

• • From Azure portal, create conditional access policy and configure:
  • Users and groups”, cloud apps and session settings”.
  • From Exchange Online Remote Powershell session, run:
  • New-OwaMailbox Police and Set-OWAMailboxPolicy

• How long after the Azure ATP cloud service is updated will Sensor1 be updated? 72Hrs

Setup Azure Advanced Threat Protection (ATP) and VPN

Configure an Accounting Provider : 1813

To Configure RADIUS Accounting on the VPN system, Perform the following steps on your RRAS server.

1. Open the Routing and Remote Access console.
2. Right-click the server name and click Properties.
3. In the Security tab, under Accounting provider, select RADIUS Accounting and click Configure.

To enable VPN integration, make sure you set the following parameters:

1. Open port UDP 1813 on your Azure ATP sensors and/or Azure ATP standalone sensors.

Microsoft Office 365 Attack simulator

• Your organization has Office 365 Threat Intelligence, with Attack simulator visible in the Security & Compliance Center (go to Threat management > Attack simulator)
• Your organization’s email is hosted in Exchange Online. (Attack simulator is not available for on-premises email servers.)
• You are a GA
• Your organization is using Multi-factor authentication for Office 365 users

Sign-in activity reports in the Azure Active Directory portal

Where to view which users have used an authenticator app to access SharePoint Online

1. AAD-> Monitoring -> Sign-ins
   1. WHO: GA, Security Admins, Security Reader, Global Reader, Report Reader, SELF
2. Enterprise applications blade of the Azure Active Directory admin center, view the sign-ins

Microsoft Defender for Office 365 (Office 365, ATP)

• Who gets access to ATP reports: Security & Compliance Center by going to Reports > Dashboard ?
  • Organization Management
  • Security Administrator
  • Security Operator
  • Security Reader

Azure Active Directory (Azure AD) Privileged Identity Management (PIM)

• If no specific/selected approvers are selected, PIM admin or GA will become the default approvers.
• Privileged Role Administrator (default) can approve ALL activations
• GAs are not PIM admins (except for the first one who enabled PIM) and that you have to exclusively assign permissions.
• Only the Privileged Role Admins and the Global Admin who created it (who automatically becomes a PRA) are able to accept requests from eligible users.

Roles

0 – Security : No Data
1 –  Basic : App installation / Updates
2 – Enhanced: Logs
3 – Full: Verbose Logs

S – Spam/Malware : 30 Days
M –
F – Mail Flow :

Azure AD Identity Protection (AIP) – MFA

MFA Registration (Azure AD P2 feature)

MFA is disabled. If User1 is part of a enforced group and exclusion group.  Exclusion wins.
MFA is disabled. If User2 is part of a enforced group.  User2 will be prompted for MFA.

\

Correct! User1: can access without MFA User is in Group2 which is excluded from policy, exclusion wins

User2: will be prompted for MFA Identity Protection or Conditional Access MFA setting override per-User MFA settings

UNC, Local, and Sharepoint

Cloud Access Security Portal > AIP Integration