Free Microsoft SC-300 Practice Questions

Correct answer: A. Set-MsolCompanySettings

Set-MsolCompanySettings is the correct cmdlet to manage organizational settings in Azure AD, including self-service sign-up policies. This cmdlet allows you to disable self-service sign-up for specific domains, preventing users from creating accounts via self-service registration for Microsoft 365 services.

Why the other options are wrong

• B. Set-MsolDomainFederationSettings configures federation settings for a domain, not self-service sign-up restrictions.
• C. Update-MsolfederatedDomain is used to update federated domain properties, not to control self-service sign-up.
• D. Set-MsolDomain manages domain properties but does not control self-service sign-up policies.

Correct answer: C. the Licenses blade in the Azure Active Directory admin center

The Licenses blade in the Azure AD admin center provides the least administrative effort for bulk license operations. After assigning E5 licenses to users via group-based licensing, you can use the Licenses blade to efficiently remove the E3 licenses from all 2,500 users simultaneously without manual per-user operations.

Why the other options are wrong

• A. The Identity Governance blade is designed for access reviews and entitlement management, not bulk license removal.
• B. Set-AzureAdUser cmdlet would require scripting and individual user operations, requiring more administrative effort than using the admin center.
• D. Set-WindowsProductKey is a local Windows management cmdlet unrelated to Microsoft 365 license management.

Correct answer: A, B. email address; redirection URL

When creating bulk B2B collaboration invitations in Azure AD, you must include the email address of the invited user and a redirection URL that specifies where the invited user should be directed after accepting the invitation. These two parameters are mandatory for the bulk invite process to function properly.

Why the other options are wrong

• C. Username is not a required parameter for B2B bulk invites; Azure AD uses the email address as the primary identifier.
• D. A shared key is not part of the B2B bulk invite process.
• E. Password is not a parameter for B2B invites; invited users set their own credentials upon acceptance.

Correct answer: B. No

Password writeback synchronizes password changes from Azure AD back to on-premises Active Directory. However, it does not affect the authentication behavior of disabled accounts. The 30-minute delay occurs due to token caching and synchronization intervals, which password writeback does not address. This solution does not meet the goal.

Why the other options are wrong

• A. Password writeback is unrelated to preventing authentication of disabled accounts; it only handles password synchronization direction.

Correct answer: A. Yes

Pass-through authentication validates user credentials directly against on-premises Active Directory for every sign-in attempt. When a user account is disabled in Active Directory, pass-through authentication immediately rejects authentication requests since it checks the actual on-premises account status in real-time, eliminating the 30-minute delay caused by token caching.

Why the other options are wrong

• B. Pass-through authentication directly validates against on-premises AD in real-time, which meets the requirement of immediate prevention of authentication for disabled accounts.

Correct answer: B. No

Conditional access policies control whether users can access applications based on conditions, but they cannot directly validate real-time account status in on-premises Active Directory. The 30-minute delay stems from token caching in Azure AD, which conditional access policies cannot override. This solution does not address the root cause of the authentication delay.

Why the other options are wrong

• A. Conditional access policies operate on Azure AD tokens and cached identity information, not on real-time on-premises account status checks.

Correct answer: D. Create a guest user account in contoso.com.

To provide a contractor using an external email (user1@outlook.com) access to an Azure AD enterprise application while maintaining their external identity, you must create a guest user account in the contoso.com tenant. This allows the contractor to authenticate as their external identity while being part of the organization's directory for application access.

Why the other options are wrong

• A. New-AzADUser creates native Azure AD user accounts, not guest accounts for external identities.
• B. External collaboration settings control guest invitation policies but do not provision access; you still need to create the guest account.
• C. Configuring a WS-Fed identity provider is used for federated authentication scenarios, not for adding individual guest users.

Correct answer: C. Create an inbound synchronization rule for the Active Directory Domain Services connector.

To prevent synchronization of users based on an attribute value (extensionAttribute15 set to NoSync), you must create an inbound synchronization rule for the Active Directory Domain Services connector. This rule filters objects during the import phase from on-premises AD, preventing users with this attribute value from being synchronized to Azure AD.

Why the other options are wrong

• A. An inbound rule for the Azure AD connector operates on data flowing into Azure AD, not filtering source data from Active Directory.
• B. A Full Import run profile performs import operations but does not create filtering rules; rules must be configured separately.
• D. An Export run profile handles data flowing from Azure AD to on-premises, not filtering incoming synchronization from AD.

Correct answer: B. No

Azure AD Password Protection is used to enforce custom password policies and block weak passwords; it does not address the 30-minute authentication delay when an on-premises Active Directory user account is disabled. The delay occurs due to Azure AD Connect sync intervals and token caching. To immediately prevent authentication, you would need to configure Azure AD Connect to sync more frequently or implement conditional access policies that check real-time account status, not password protection.

Why the other options are wrong

• A. Password Protection does not control account disable synchronization timing or immediate authentication prevention.

Correct answer: C. a linked subscription

To ensure External Identities pricing is based on monthly active users (MAU), you must link an Azure subscription to your Azure AD tenant. This linked subscription enables MAU-based billing, which charges based on the number of unique users authenticating in a calendar month. Without a linked subscription, External Identities may use different billing models or be unavailable.

Why the other options are wrong

• A. User flows define authentication behavior but do not configure billing models.
• B. Terms of use are for compliance and acceptance tracking, not billing configuration.
• D. Access reviews are for governance and compliance, not billing setup.

Correct answer: A. an access package

An access package in Azure AD Entitlement Management is designed to provide time-bound access to resources like SharePoint sites. It allows you to define who can access Site1 (Group1 members), for how long (90 days), and automates the entire lifecycle including expiration, minimizing administrative effort through automatic provisioning and deprovisioning.

Why the other options are wrong

• B. Access reviews are for auditing and confirming access, not for granting time-limited access.
• C. Lifecycle workflows are for managing user lifecycle events like onboarding and offboarding, not resource access duration.
• D. Conditional Access policies control authentication conditions and risk management, not time-limited resource access assignment.

Correct answer: C. the Set-MgUserLicense cmdlet

The Set-MgUserLicense cmdlet is the appropriate PowerShell command for removing licenses from multiple users efficiently. This cmdlet allows batch removal of the E3 licenses from all 2,500 users with a single script, representing the least administrative effort through automation.

Why the other options are wrong

• A. Identity Governance blade handles access reviews and entitlement management, not direct license removal operations.
• B. Update-MgGroup cmdlet modifies group properties and group-based license assignments, but Set-MgUserLicense is the more direct method for removing individual user licenses.
• D. Administrative units blade is for organizing users under administrative scope, not for managing individual user license assignments.

Correct answer: A. the Set-MgUserLicense cmdlet

The Set-MgUserLicense cmdlet is the most direct and efficient PowerShell method for removing licenses from individual users at scale. This cmdlet allows you to programmatically remove the E3 licenses from all 2,500 users with minimal administrative overhead through a single automated script execution.

Why the other options are wrong

• B. Identity Governance blade is for access reviews and entitlement management, not bulk license removal.
• C. The Groups blade manages group membership and group-based license assignments, not removal of individual user licenses that are already assigned.
• D. Update-MgGroup cmdlet modifies group properties, not individual user license assignments or removals.

Correct answer: C. accountEnabled, displayName, userPrincipalName, and passwordProfile

When bulk creating users in Azure AD via template upload, the required properties are accountEnabled, displayName, userPrincipalName, and passwordProfile. These properties are mandatory to create a functional user account that can sign in and authenticate to Azure AD services. The displayName identifies the user, userPrincipalName serves as the unique identifier, accountEnabled sets the account status, and passwordProfile defines the password.

Why the other options are wrong

• A. identityIssuer is not a standard required property for bulk user creation; usageLocation is optional.
• B. givenName and surname are optional; the required set must include displayName and passwordProfile.
• D. usageLocation is optional for licensing but not required for basic user creation; this set lacks displayName which is required.

Correct answer: D. the Licenses blade in the Azure Active Directory admin center

The Licenses blade in the Azure Active Directory admin center is the least administratively effortful way to remove individual user licenses in bulk. While group-based licensing assigned the E5 licenses to all users via the group, removing the E3 licenses from 2,500 individual users is most efficiently done through the Licenses blade where you can bulk-manage user licenses without needing PowerShell commands or other administrative tools.

Why the other options are wrong

• A. The Groups blade is for managing group membership and group-level licensing, not for removing individual user licenses in bulk.
• B. Using Set-AzureAdUser cmdlet would require scripting and more administrative effort than using the Licenses blade GUI.
• C. The Identity Governance blade handles access reviews and entitlement management, not license removal.

Correct answer: D. Ensure that the virtual machines can access https://enterpriseregistration.windows.net.

Virtual machines must be able to reach https://enterpriseregistration.windows.net to register with Azure AD and retrieve the necessary certificates and metadata for authentication. Without network connectivity to this endpoint, the sign-in process cannot complete. Deleting device registrations and revoking tokens are remediation steps after connectivity is established, and SSH client support is unrelated to Azure AD sign-in.

Why the other options are wrong

• A. Deleting device registrations would require sign-in to work first; this is a remediation step, not the root cause or first action.
• B. Revoking primary refresh tokens is a remediation step after connectivity issues are resolved.
• C. SSH client support is irrelevant to Azure AD sign-in on Windows Server virtual machines.

Correct answer: A. Create an access policy.

An access policy in Microsoft Defender for Cloud Apps can block or restrict user sign-in to connected cloud applications (like Yammer) based on risk conditions including location. This is the direct mechanism for preventing access from high-risk locations. Activity policies monitor behavior, unsanctioning an app removes it from oversight, and anomaly detection policies detect suspicious behavior rather than enforcing access restrictions.

Why the other options are wrong

• B. Activity policies monitor and alert on user activities but don't prevent access based on location risk.
• C. Unsanctioning Yammer would remove it from protection entirely, the opposite of the requirement.
• D. Anomaly detection policies detect unusual activity patterns but don't enforce access restrictions based on location risk.

Correct answer: A. a verification code from the Microsoft Authenticator app

A verification code generated by the Microsoft Authenticator app is the only method that works in the described scenario. The code is generated locally on the laptop's installed authenticator app using time-based algorithms and does not require any network connectivity to generate. Users can simply read the code from the app and enter it for authentication.

Why the other options are wrong

• B. Security questions are not a primary MFA method and require administrative setup.
• C. Voice calls require mobile phone connectivity, which is explicitly unavailable in the scenario.
• D. SMS requires mobile phone connectivity, which is explicitly unavailable in the scenario.

Correct answer: A. Windows Hello for Business

Windows Hello for Business uses a credential bound to the laptop and unlocked with a PIN or biometric, which satisfies multifactor authentication. It works over the laptop's wired internet connection with no need for a phone signal. That makes it usable from the remote locations.

Why the other options are wrong

• B. An app password is a legacy workaround for apps that cannot do MFA, not an MFA method.
• C. Security questions are only allowed for self-service password reset, not as an MFA method.
• D. Email one-time passcodes are allowed for SSPR, not as an MFA method for sign-in.

Correct answer: D. a verification code from the Microsoft Authenticator app

When users are in remote locations with wired internet but no Wi-Fi or mobile connectivity, they can use time-based verification codes generated by the Microsoft Authenticator app. These codes are generated locally on the device and do not require real-time network communication, making them available offline. The verification code is displayed on the app and can be entered to complete authentication.

Why the other options are wrong

• A. Push notifications require mobile connectivity or Wi-Fi, which is not available in the scenario.
• B. Email requires internet access on the laptop, but the scenario implies lack of connectivity for mobile methods.
• C. Security questions are typically used for password reset, not primary MFA, and may not be configured for all users.

Correct answer: D. FIDO2 tokens

FIDO2 tokens are hardware security keys that provide MFA without requiring biometric identification, mobile phones, or internet-connected apps. They are ideal for shared call center environments where users cannot have phones and computers are not configured for biometric identification. Users simply connect the token via USB to authenticate.

Why the other options are wrong

• A. A named network location would restrict access but does not provide MFA capability.
• B. Microsoft Authenticator app requires a mobile phone, which is prohibited in the call center.
• C. Windows Hello for Business requires biometric identification, which the call center computers do not support.

Correct answer: C. From the Identity Governance blade, modify the Entitlement management settings.

To enable User1 to create new catalogs and add resources to owned catalogs in Azure AD, you must modify the Entitlement management settings from the Identity Governance blade. This setting grants users the ability to create and manage catalogs within the entitlement management system, controlling access packages and resource provisioning.

Why the other options are wrong

• A. Groups administrator role controls group management, not entitlement management catalog creation.
• B. Service support administrator role handles support ticket management and service health, not catalog creation.
• D. Roles and administrators for the General catalog would assign administrative permissions within an existing catalog, not grant the ability to create new catalogs.

Correct answer: B. Create an access package.

Access packages in Azure AD Entitlement Management allow automatic approval of access requests based on group membership and can include automatic access reviews that remove access after a specified period (such as 30 days). Conditional Access policies don't manage access requests, PIM is for privileged role management, and Defender for Cloud Apps policies don't handle SharePoint site access provisioning.

Why the other options are wrong

• A. Conditional Access policies control authentication and device compliance, not access request approval and removal workflows.
• C. PIM role settings manage privileged role activation and assignment, not SharePoint site access requests.
• D. Defender for Cloud Apps policies monitor and enforce cloud app security, not SharePoint access provisioning and automatic removal.

Correct answer: A. 2

In entitlement management, one access package can contain multiple assignment policies, one for each group of identities that needs different request and approval settings. Create one package for Site1 with a policy that lets Group3 request and requires approval by Group5. Create a second package for Site1 and Team1 with two policies: one for Group1 that requires approval by Group2, and one for Group4 that requires approval by Group5. Two access packages therefore meet every requirement.

Why the other options are wrong

• B. Three packages are more than needed because Group1 and Group4 can share one Site1 and Team1 package by using separate policies with different approvers.
• C. Four packages are more than needed because approval differences are handled by policies inside a package, not by extra packages.
• D. Five packages are more than needed because only two distinct resource combinations exist, Site1 alone and Site1 with Team1.

Correct answer: C. the Set-MgUserLicense cmdlet

The Set-MgUserLicense cmdlet is the appropriate PowerShell command to remove individual user licenses in bulk. This cmdlet allows you to specify users and remove the E3 license assignment programmatically, which is the least administratively effortful approach for 2,500 users compared to manual portal operations.

Why the other options are wrong

• A. Set-WindowsProductKey is for Windows operating system product keys, not Microsoft 365 licenses.
• B. Update-MgGroup cmdlet modifies group properties, not individual user license assignments.
• D. Update-MgUser updates user object properties but is not the primary cmdlet for license management.

Correct answer: D. Assign an Azure role to VM1.

To enable a system-assigned managed identity to access Key Vault secrets, you must assign an appropriate Azure role to the managed identity. The 'Key Vault Secrets User' or similar role must be assigned to VM1's system-assigned managed identity, granting it permission to retrieve secrets from Vault1. This is the first and most critical step to minimize administrative effort since the managed identity is already enabled on the VM.

Why the other options are wrong

• A. Resource access settings are not the primary mechanism for granting secret retrieval permissions.
• B. The permissions model selection is less relevant than assigning the proper role.
• C. Adding a user-assigned managed identity is unnecessary when the system-assigned identity is already available and functional.

Correct answer: A. Yes

The Fraud alert settings in MFA allow users to report suspicious MFA prompts they did not initiate by selecting the 'Deny' or 'Report fraud' option in the Microsoft Authenticator app. When users report fraud through this feature, Azure AD can automatically block or flag that user's account, preventing further unauthorized access attempts. This directly addresses the requirement to automatically respond when users report unsolicited MFA requests.

Why the other options are wrong

• B. Fraud alert settings are specifically designed to handle exactly this scenario of unauthorized MFA prompts.

Correct answer: D. Collaboration restrictions

Collaboration restrictions (formerly called B2B collaboration restrictions) in Entra ID allow you to create an allowlist or denylist of external domains for guest invitations. Since you can invite from fabrikam.com but not adatum.com, adatum.com is likely on a restriction list or not on an allowlist. Configuring collaboration restrictions to allow adatum.com will resolve the issue.

Why the other options are wrong

• A. Guest invite settings control who can invite guests (user roles/permissions) and whether external users can invite, not which domains are permitted.
• B. Verifiable credentials are used for identity verification and attestation, not for controlling domain-based guest invitations.
• C. Named locations are used in Conditional Access policies to define IP address ranges and countries, not to control B2B guest invitations by domain.

Correct answer: C. Create a guest user account in contoso.com

To allow a contractor with an outlook.com email address to access applications in a Microsoft Entra tenant, they must be added as a guest user to the contoso.com tenant. Guest user accounts enable external identities to authenticate with their own credentials (user1@outlook.com) while gaining access to organizational resources.

Why the other options are wrong

• A. External collaboration settings control guest invitation policies but do not create the guest account itself.
• B. New-MgUser creates internal users, not guest accounts for external contractors.
• D. Adding a custom domain would not help authenticate an outlook.com account; guest accounts are the appropriate solution.

Correct answer: D. Create a custom role and assign the role to Admin1.

A custom role is the solution that minimizes administrative effort while precisely meeting the requirements. The Helpdesk Administrator role is a built-in role that grants broader permissions than needed and would not align exactly with the specific tasks required. A custom role can be created with only the specific permissions for creating and managing service requests, reading and configuring service health, and creating and managing support tickets.

Why the other options are wrong

• A. Administrative units are used to scope role permissions by organizational unit, not to create specific permission sets for the stated tasks.
• B. Azure AD PIM is for elevating privileges and managing eligible role assignments, not for granting specific functional permissions.
• C. Helpdesk Administrator is too broad and grants more permissions than the specific tasks listed, making it less efficient.

Correct answer: B. a system-assigned managed identity

A system-assigned managed identity is automatically created with the Automation account and automatically deleted when the account is deleted, ensuring permissions are cleaned up without manual intervention. This minimizes administrative effort compared to certificates or client secrets which require manual lifecycle management.

Why the other options are wrong

• A. Client secrets require manual rotation and cleanup when the Automation account is deleted.
• C. Certificates require manual management, renewal, and cleanup, increasing administrative effort.
• D. User-assigned managed identities persist after the Automation account is deleted and require manual cleanup of permissions.

Correct answer: A. an email to an address outside your organization

For Azure AD self-service password reset, valid authentication methods include email addresses (both organizational and external), mobile app notifications, mobile app codes, and security questions. Email to an address outside the organization is a fully supported SSPR method. Smartcards are not supported for SSPR. FIDO2 security tokens and Microsoft Teams chat are not standard SSPR authentication methods in Azure AD.

Why the other options are wrong

• B. Smartcards are not a supported authentication method for SSPR in Azure AD.
• C. FIDO2 security tokens are not a standard supported method for SSPR authentication.
• D. Microsoft Teams chat is not a supported SSPR authentication method.

Correct answer: B. No

Account lockout settings in MFA are designed to lock accounts after multiple failed authentication attempts, not to automatically block users who report receiving unsolicited MFA prompts. This feature prevents brute force attacks but does not address the specific scenario of blocking users based on their reports of unauthorized MFA requests. A more sophisticated solution like fraud alerts or conditional access policies would be needed.

Why the other options are wrong

• A. Account lockout settings respond to failed login attempts, not to user reports of fraudulent MFA prompts.

Correct answer: B. 2

A minimum of 2 role assignments achieves all requirements: First, assign Reader role at the subscription level to allow viewing all resources. Second, assign a custom role or Contributor at the subscription level for VM restart capability combined with a scoped assignment (Contributor on RG1 only) for creating VMs and storage accounts in RG1. Alternatively, Reader at subscription scope plus a custom role scoped to RG1 for create operations satisfies all four tasks with 2 assignments.

Why the other options are wrong

• A. A single role cannot satisfy all requirements because resource creation must be scoped to RG1 only while viewing and VM restart must be at subscription level.
• C. Three assignments are more than the minimum needed when roles are properly scoped.
• D. Four assignments exceed the minimum necessary to accomplish these tasks.

Correct answer: B. When completed

The 'When completed' settings in an access review allow you to configure automatic actions upon review completion or expiration. This is where you specify that if reviewers don't respond, guest users should be automatically removed from the groups. This ensures compliance without requiring manual administrator intervention if reviews are not completed.

Why the other options are wrong

• A. Scheduling settings control the review frequency and timing, not automatic remediation actions.
• C. General settings contain basic review metadata like name and description, not auto-remediation logic.
• D. Reviewers settings specify who reviews access, not what happens if reviews are not completed.

Correct answer: B. Password protection

Password protection is the correct setting to configure smart lockout with a specific failed sign-in threshold. Password protection policies in Azure AD admin center allow administrators to set smart lockout thresholds that automatically lock accounts after a specified number of failed authentication attempts, protecting against brute force attacks.

Why the other options are wrong

• A. Authentication strengths are used to define required authentication methods, not for configuring lockout thresholds.
• C. User risk policy is used to enforce actions based on detected user risk levels, not for smart lockout configuration.
• D. Sign-in risk policy addresses risky sign-in events, not account lockout from failed authentication attempts.

Correct answer: A. Update-MgOrganization

The Update-MgOrganization cmdlet is used to configure organizational settings in Azure AD, including the ability to restrict self-service sign-up for specific domains. This cmdlet allows you to disable self-service sign-up for the contoso.com domain, preventing users from creating self-signed accounts in the Azure AD tenant.

Why the other options are wrong

• B. Update-MgPolicyPermissionGrantPolicyExclude manages consent policy exceptions, not self-service sign-up restrictions.
• C. Update-MgDomain manages domain properties and verifications, not self-service sign-up policies.
• D. Update-MgDomainFederationConfiguration manages federation settings between domains, not self-service sign-up controls.

Correct answer: A. a conditional access policy in Azure AD

To block Basic authentication and enforce Modern authentication for Exchange Online clients, you must implement a Conditional Access policy in Azure AD. This policy can specifically target Exchange Online and require Modern authentication protocols, blocking any clients attempting to use Basic authentication. Conditional Access provides the granular control needed to enforce authentication protocol requirements at the tenant level.

Why the other options are wrong

• B. Intune compliance policies manage device compliance and enrollment, not email client authentication protocols.
• C. Defender for Cloud Apps OAuth policies manage app permissions and risk, not Exchange client authentication methods.
• D. Intune application control profiles are for managing app behavior on enrolled devices, not Exchange Online authentication protocols.

Correct answer: C. MicrosoftAuthorization/roleAssignments/write for Sub1

To onboard a subscription to Permissions Management with least privilege, User1 needs the Microsoft.Authorization/roleAssignments/write permission scoped specifically to Sub1. This permission allows the necessary role assignment operations for onboarding while limiting the grant to the specific subscription. Scoping to the management group level would violate the principle of least privilege, and read-only permissions are insufficient for onboarding tasks.

Why the other options are wrong

• A. Read-only permissions are insufficient to perform the write operations required for onboarding.
• B. Granting permissions at the management group level violates the principle of least privilege; they should be scoped to the specific subscription.
• D. Read-only permissions at the management group level are even broader in scope and still insufficient for onboarding operations.

Correct answer: C. 90 days

Risky user activity logs in Microsoft Entra are retained for 90 days. This is the standard retention period for risk detection data in Azure AD/Entra, allowing organizations to maintain historical context for security investigations while managing storage costs.

Why the other options are wrong

• A. 30 days is too short for the standard retention period of risk data.
• B. 60 days is less than the actual 90-day retention period.
• D. 180 days exceeds the standard retention period for risky user activity logs.

Correct answer: D. Microsoft Entra threat intelligence

Microsoft Entra threat intelligence is classified as a user risk detection type. This risk detection identifies compromised credentials based on Microsoft's threat intelligence sources, signaling potential user account compromise.

Why the other options are wrong

• A. Password spray is a sign-in risk, not a user risk.
• B. Anonymous IP address is a sign-in risk, not a user risk.
• C. Unfamiliar sign-in properties is a sign-in risk, not a user risk.

Correct answer: B. user-assigned managed identities and Azure Key Vault

User-assigned managed identities enable virtual machines to authenticate to Azure resources without storing credentials in code, while Azure Key Vault securely stores secrets. This combination meets all requirements: secure secret storage, no credentials in code, Microsoft Entra authentication for Azure resources, and minimal administrative overhead since managed identities are Azure-native.

Why the other options are wrong

• A. Storage Service Encryption only encrypts data at rest and does not provide authentication or secret management capabilities.
• C. User accounts require credential storage and management, violating the requirement that credentials not be stored in App1 code.
• D. Storage Service Encryption does not provide secret management or authentication solutions for third-party APIs.

Correct answer: C. a client apps condition

The client apps condition in conditional access policies allows filtering based on the authentication protocol used. This condition can specifically target and block legacy authentication methods like SMTP, IMAP, and POP, which do not support modern authentication flows and conditional access.

Why the other options are wrong

• A. Cloud apps or actions condition filters by application, not by authentication method type.
• B. User risk condition assesses the risk level of a user's account, not the authentication protocol.
• D. Sign-in risk condition evaluates the risk of the sign-in event itself, not whether legacy authentication is being used.

Correct answer: D. User administrator

The User Administrator role has permissions to manage license assignments and reset user passwords. This role can create and manage users, reset passwords, manage licenses, and invalidate refresh tokens. While Helpdesk Administrator can reset passwords, it cannot manage license assignments. License Administrator can only manage license assignments but not reset passwords.

Why the other options are wrong

• A. Helpdesk Administrator can reset passwords but cannot manage license assignments.
• B. Billing Administrator manages subscription billing and purchases, not user licenses or passwords.
• C. License Administrator can only manage license assignments, not reset user passwords.

Correct answer: C. Windows Hello for Business

Windows Hello for Business uses a key or certificate bound to the laptop and unlocked with a PIN or biometric, which counts as strong multifactor authentication. It needs only the laptop and its wired internet connection, with no phone signal. That makes it usable from the remote locations.

Why the other options are wrong

• A. An Authenticator push notification needs the phone to have data connectivity, which is unavailable at the remote locations.
• B. An app password is a legacy workaround for apps that cannot do MFA, not an MFA method.
• D. SMS requires mobile phone connectivity, which is unavailable at the remote locations.

Correct answer: A. Yes

Microsoft documentation sets out the roles needed to work with Identity Secure Score improvement actions: viewing an action needs at least the Service Support Administrator role, and updating the status of an action needs at least the SharePoint Administrator role. The least privileged roles by task list also names SharePoint Administrator for updating an Identity Secure Score improvement action. Assigning SharePoint Administrator to User1 therefore lets User1 update the status of the improvement actions, so the solution meets the goal.

Why the other options are wrong

• B. SharePoint Administrator is the documented minimum role for updating the status of an Identity Secure Score improvement action, so this assignment does give User1 the access the goal needs.

Correct answer: A. Microsoft Authenticator

When a new Azure AD tenant is deployed, Microsoft Authenticator is the default MFA method enabled. It supports multiple authentication modes including passwordless sign-in, push notifications, and OTP generation, making it the preferred default authentication method for modern Azure AD deployments.

Why the other options are wrong

• B. SMS is not enabled by default in new Azure AD tenants.
• C. Voice calls are not enabled by default in new Azure AD tenants.
• D. Email OTP is not enabled by default in new Azure AD tenants.

Correct answer: D. Azure AD threat intelligence

Azure AD threat intelligence is classified as a user risk detection type. It represents risks identified through Microsoft's threat intelligence that directly indicate compromised user accounts. The other options (impossible travel, anonymous IP, malicious IP) are all sign-in risk detections, not user risk detections. User risk detections indicate that a user account itself has been compromised, while sign-in risk detections indicate that a specific sign-in event is suspicious.

Why the other options are wrong

• A. Impossible travel is a sign-in risk detection, not a user risk detection.
• B. Anonymous IP address is a sign-in risk detection, not a user risk detection.
• C. Malicious IP address is a sign-in risk detection, not a user risk detection.

Correct answer: C. a mobile app notification

Mobile app notification is a valid SSPR authentication method. Users can register the Microsoft Authenticator app and use push notifications to their mobile device to complete password reset verification.

Why the other options are wrong

• A. Windows Hello PIN is not a supported SSPR authentication method.
• B. Smartcards are not supported as SSPR authentication methods in Microsoft Entra.
• D. Email to addresses outside the organization is not a supported SSPR method.

Correct answer: B. No

Configuring Notifications settings for MFA allows administrators to set up alerts and notification preferences, but does not provide automatic blocking of users. The Notifications settings control how and when users are informed about MFA activities, not whether they are blocked. To automatically block users reporting unsolicited MFA prompts, a different approach involving fraud detection or conditional access would be required.

Why the other options are wrong

• A. Notifications settings only configure how alerts are delivered, not automatic user blocking mechanisms.

Correct answer: B. a mobile app code

Mobile app code is a valid SSPR authentication method in Azure AD. When users register for SSPR, they can use the Microsoft Authenticator app to generate time-based verification codes, which they can enter during password reset. This is one of the supported modern authentication methods for self-service password reset.

Why the other options are wrong

• A. Smartcards are not supported for SSPR in Azure AD.
• C. While mobile app notifications are used for multi-factor authentication, they are not a standard SSPR password reset method.
• D. Sending email to addresses outside the organization is not a secure standard SSPR method; SSPR typically uses organization-controlled communication channels.

Correct answer: B. Windows Hello for Business

Windows Hello for Business is the only MFA method that works in the described scenario. Since users have wired internet access on their Windows 10 laptops but no mobile connectivity, they cannot use SMS, voice calls, or app notifications that require mobile networks. Windows Hello for Business operates locally on the device using biometric or PIN authentication, requiring only the Windows device itself.

Why the other options are wrong

• A. SMS requires mobile phone connectivity, which is not available in remote locations.
• C. Voice calls require mobile phone connectivity, which is not available in the remote locations.
• D. Authenticator app notifications require mobile connectivity for delivery, which users lack in remote locations.

Correct answer: B. the Licenses blade in the Azure Active Directory admin center

The Licenses blade in the Azure Active Directory admin center is the least administratively effortful method to remove individual user licenses in bulk. This centralized interface allows direct management and removal of user licenses without requiring PowerShell scripting or other complex administrative procedures.

Why the other options are wrong

• A. Update-MgGroup cmdlet is used for group management, not for removing individual user licenses.
• C. Set-WindowsProductKey cmdlet is for Windows licensing, not Microsoft 365 or Azure AD license management.
• D. Administrative units are used to scope administrative roles, not to manage license assignment or removal.

Correct answer: B. Traffic forwarding

The Traffic forwarding blade in the Microsoft Entra admin center is used to enable the Private access profile. This blade contains the configuration settings necessary to set up traffic forwarding rules and enable private access functionality for on-premises applications published through Microsoft Entra Private Access.

Why the other options are wrong

• A. Remote networks is used for configuring remote network connections, not for enabling the Private access profile.
• C. Security profiles is not the correct blade for Private access profile configuration.
• D. Connectors is used for managing connectors but not specifically for enabling the Private access profile itself.

Correct answer: D. leaked credentials

Leaked credentials is classified as a user risk in Microsoft Entra's risk detection system. This detection type indicates that a user's credentials have been exposed in a data breach or similar incident, representing a direct risk to the user's account security.

Why the other options are wrong

• A. Impossible travel is classified as a sign-in risk, not a user risk.
• B. Anonymous IP address is classified as a sign-in risk.
• C. Atypical travel is classified as a sign-in risk, not a user risk.

Correct answer: A. the Conditional Access What If tool

The Conditional Access What If tool is specifically designed to test conditional access policies under hypothetical scenarios. It allows you to simulate sign-in conditions including risk levels, locations, and other signals to see how your policies would apply without actually affecting real users. This tool is the proper way to validate policy behavior before full deployment.

Why the other options are wrong

• B. Sign-in logs show historical data but do not allow you to test policies under hypothetical future conditions.
• C. Microsoft Defender for Cloud Apps activity logs monitor actual activity but are not designed for conditional access policy testing.
• D. Access reviews are used for periodic validation of access permissions, not for testing conditional access policies.

Correct answer: A. Enable Global Secure Access signaling.

To ensure users can only access resources when the Global Secure Access client is connected, you must first enable Global Secure Access signaling. This allows the system to detect and enforce the presence of the Global Secure Access client. While remote networks and named locations are part of the broader configuration, signaling is the foundational step that enables device enforcement. Tenant restrictions alone do not enforce client connectivity requirements.

Why the other options are wrong

• B. Tagging for tenant restrictions controls which tenants can be accessed, but does not enforce Global Secure Access client connectivity.
• C. Named locations define network locations but do not enforce device client connectivity requirements.
• D. While remote networks are used in Global Secure Access, enabling signaling must occur first to enforce client connectivity.

Correct answer: A, B, C. Windows Hello for Business; an FIDO2 security key; certificate-based authentication (multi-factor)

Windows Hello for Business, FIDO2 security keys, and certificate-based authentication (multi-factor) are all phishing-resistant authentication methods. These methods use cryptographic mechanisms that are resistant to phishing attacks because they rely on possession factors and/or biometrics rather than secrets that can be intercepted. The other methods (voice call, SMS, email OTP, and single-factor certificates) are not considered phishing-resistant.

Why the other options are wrong

• D. Voice call is vulnerable to social engineering and phishing attacks.
• E. SMS is vulnerable to interception and SIM swapping attacks.
• F. Email OTP can be intercepted or exploited through phishing.
• G. Certificate-based authentication (single-factor) lacks the multi-factor requirement for phishing resistance.
• H. Microsoft Authenticator, while useful, is not inherently phishing-resistant in all configurations and lacks cryptographic binding.

Correct answer: A. Run the New-AzureADMSInvitation cmdlet.

The New-AzureADMSInvitation cmdlet is used to invite external users (such as contractors with @outlook.com accounts) to an Azure AD tenant and provide them access to enterprise applications. This cmdlet generates an invitation that allows the contractor to authenticate with their external credentials (user1@outlook.com) while gaining access to App1.

Why the other options are wrong

• B. External collaboration settings control policies for invitations but do not directly provision the guest user access.
• C. WS-Fed identity providers are for federated authentication scenarios, not for inviting external users with personal credentials.
• D. Azure AD Connect is for synchronizing on-premises Active Directory to Azure AD, not for adding external guest users.

Correct answer: A. a system-assigned managed identity

A system-assigned managed identity is the optimal solution for this scenario. It is automatically created and managed by Azure for the App Service, requires no credential management by administrators, and can be granted access to Azure SQL Database through Azure AD integration. This meets both requirements: credentials are isolated to App1 and administrative effort is minimized with no manual credential rotation needed.

Why the other options are wrong

• B. An Azure AD user account would require administrative management and credential sharing, increasing administrative effort.
• C. A SQL Server account requires manual credential management and rotation, increasing administrative overhead.
• D. While a user-assigned managed identity could work, it requires more administrative effort to create and manage compared to a system-assigned identity.

Correct answer: D. a verification code from the Microsoft Authenticator app

A verification code from the Microsoft Authenticator app generates time-based one-time passwords offline on the device, requiring only that the laptop has the app installed, no mobile connectivity or internet connection needed for the code generation itself. SMS requires mobile connectivity, email requires internet on the phone, and security questions are not a modern MFA method in this context.

Why the other options are wrong

• A. SMS requires active mobile phone connectivity which the users do not have in remote locations.
• B. Email authentication requires the mobile device to have internet connectivity to receive and verify the email.
• C. Security questions are legacy authentication methods and are not a standard modern MFA method for this scenario.

Correct answer: B. No

The Block/unblock users settings allow administrators to manually block or unblock specific users from MFA, but this is a manual process. The requirement is to block users automatically when they report an MFA request they did not initiate. This setting requires administrative action and cannot respond automatically to user reports without additional automation or monitoring systems in place.

Why the other options are wrong

• A. Block/unblock is a manual administrative action, not an automatic response to reported fraudulent MFA prompts.

Correct answer: C. User3

The Storage Blob Data Reader role supports attribute-based access control (ABAC) because it can be combined with conditions based on resource attributes, such as blob index tags or container properties. ABAC support is available for data plane roles in services like Azure Storage, allowing fine-grained access decisions based on resource attributes rather than just role assignment.

Why the other options are wrong

• A. Reader is a built-in role that does not support attribute-based conditions.
• B. Contributor is a built-in role that does not support attribute-based conditions.
• D. Virtual Machine Contributor is a built-in role that does not support attribute-based conditions.

Correct answer: A, B. the Microsoft Authenticator app; FIDO2 security keys

Both Microsoft Authenticator app and FIDO2 security keys enable passwordless, multi-factor out-of-band authentication for Azure VMs using Microsoft Entra credentials. Microsoft Authenticator provides app-based approval notifications, while FIDO2 keys provide hardware-based cryptographic authentication. Both prevent password-based sign-in while meeting the multi-factor requirement.

Why the other options are wrong

• C. Temporary Access Pass is a time-limited credential, not a passwordless multi-factor method suitable for permanent VM access.
• D. SMS does not prevent password sign-in; it's a secondary factor that can supplement passwords.
• E. Windows Hello for Business is for Windows devices, not Linux.

Correct answer: C. Modify the Intranet Zone settings.

To enable Azure AD Seamless Single Sign-On on Windows 10 domain-joined computers, you must modify the Intranet Zone settings in Internet Explorer/Microsoft Edge to allow automatic logon using the user's domain credentials. This configuration allows the Seamless SSO authentication agent to transparently authenticate users without prompting for credentials when accessing cloud resources.

Why the other options are wrong

• A. Sign-in options in Settings control local Windows authentication methods, not Azure AD Seamless SSO cloud authentication.
• B. Enterprise State Roaming synchronizes user settings and data across devices but does not enable Seamless SSO functionality.
• D. The Azure AD Connect Authentication Agent is installed server-side to support Seamless SSO, not on individual Windows 10 clients.

Correct answer: C. Configure the Company branding settings.

Company branding settings in the Microsoft Entra admin center allow you to customize the sign-in experience, including language-specific sign-in forms. You can configure localized branding that displays the Spanish sign-in form when users access from Microsoft Edge with their browser language set to Spanish. This is the direct mechanism for controlling localized authentication UI.

Why the other options are wrong

• A. Usage location is a user property for licensing and feature availability, not for UI localization.
• B. Global Secure Access Session management controls session behavior and security, not language-based sign-in form presentation.
• D. Conditional Access policies control access permissions and authentication requirements, not UI localization.

Correct answer: D. Run the New-MgInvitation cmdlet.

The New-MgInvitation cmdlet (Microsoft Graph API equivalent to New-AzureADMSInvitation) is used to invite external users to a Microsoft Entra tenant and provide them access to enterprise applications. This cmdlet allows the contractor to authenticate as user1@outlook.com and grants them access to App1 as a guest user.

Why the other options are wrong

• A. Microsoft Entra Connect sync is for synchronizing on-premises Active Directory, not for inviting external guest users.
• B. Adding a custom domain name allows the tenant to use a custom domain but does not provision guest user access for external contractors.
• C. Application Proxy extends on-premises applications to cloud access but does not directly provision guest user access for external identities.

Correct answer: D. the Set-MsolUserLicense cmdlet

The E3 licenses were assigned directly to each user, so the Groups blade cannot remove them. A script using Set-MsolUserLicense with the -RemoveLicenses parameter can remove the E3 license from all 2,500 users in one pass. This is the least effort way to clear the direct assignments.

Why the other options are wrong

• A. The Groups blade manages group-based license assignments and cannot remove licenses assigned directly to users.
• B. Set-AzureADGroup changes group properties and does not remove user licenses.
• C. Identity Governance handles access reviews and entitlement management, not license removal.

Correct answer: D. an email to an address outside your organization

The SSPR email method sends a code to an alternate email address outside the organization, so a locked-out user can still receive it. It is available when only one method is required to reset.

Why the other options are wrong

• A. A mobile app notification is only available for SSPR when two methods are required to reset.
• B. FIDO2 security keys are not a supported SSPR verification method.
• C. Microsoft Teams chat is not an SSPR verification method.

Correct answer: A. External collaboration settings

External collaboration settings is the correct configuration location for controlling which external domains can be invited as guests to an Azure AD tenant. This setting allows administrators to create allow or deny lists of external domains, restricting guest invitations to only approved organizations.

Why the other options are wrong

• B. All identity providers configures authentication methods, not guest domain restrictions.
• C. Cross-tenant access settings manages access policies between different Azure AD tenants, not guest domain restrictions.
• D. Linked subscriptions is not a valid Azure AD configuration setting for guest access control.

Correct answer: B. No

Conditional access policies cannot prevent disabled accounts from authenticating immediately. The 30-minute delay occurs due to Azure AD's token caching and synchronization mechanisms. To immediately prevent authentication, you would need to use Azure AD Connect's password hash sync with immediate sync cycles or implement sign-in frequency policies, but conditional access policies themselves don't address the root cause of disabled account authentication delays.

Correct answer: C. an OAuth app policy

An OAuth app policy is used to monitor and control third-party applications that access resources in your Microsoft 365 subscription through OAuth authentication. This policy type allows you to set governance rules for apps requesting permissions and accessing tenant resources.

Why the other options are wrong

• A. An access policy manages user access conditions but is not specifically designed for third-party app monitoring.
• B. An app permission policy is not a standard policy type in Defender for Cloud Apps.
• D. An endpoint protection policy manages device security, not third-party app access.

Correct answer: B. No

The Block/unblock users settings for MFA are manual administrative controls that block or unblock specific users from using MFA, not an automated mechanism to block users when they report unwanted MFA prompts. To automatically block users from unauthorized MFA attempts, you would need to use Conditional Access policies with sign-in risk detection or implement anomalous behavior rules, not the basic user blocking feature.

Why the other options are wrong

• A. The Block/unblock users setting is a manual administrative tool, not an automated response to reported unauthorized MFA requests.

Correct answer: A. Disable Security defaults.

Disabling Security defaults is the first step required to implement conditional access policies. Security defaults and conditional access policies are mutually exclusive, when Security defaults are enabled, conditional access policies cannot be created or applied. Disabling Security defaults allows organizations to implement granular conditional access policies tailored to their specific requirements.

Why the other options are wrong

• B. Password protection configuration is not a prerequisite for conditional access policies.
• C. MFA registration policy is separate from the conditional access setup requirement.
• D. User consent settings do not need to be disabled as a first step for conditional access implementation.

Correct answer: D. Privileged Role Administrator

Access reviews for Microsoft Entra roles are created through Privileged Identity Management. Creating them requires the Privileged Role Administrator or Global Administrator role. Privileged Role Administrator is the least privileged of these.

Why the other options are wrong

• A. Identity Governance Administrator can create access reviews for groups and apps, but not for Microsoft Entra roles.
• B. User Access Administrator is an Azure resource role and cannot create access reviews for Microsoft Entra roles.
• C. User Administrator manages users and groups and cannot create access reviews for Microsoft Entra roles.

Correct answer: B. Create an access review.

Creating an access review is the correct approach to ensure User1 is notified every three months to validate guest membership of Group1. Access reviews allow owners to periodically review and certify guest member access, with configurable recurrence intervals including quarterly schedules.

Why the other options are wrong

• A. External collaboration settings controls which external domains can be invited as guests, not membership validation reviews.
• C. Access packages are for entitlement management and self-service access requests, not for periodic membership validation.
• D. Group expiration policy sets when groups expire, not for regular membership validation by owners.

Correct answer: A. an email to an address outside your organization

The SSPR email method sends a code to an alternate email address, which should be outside the organization because a locked-out user may not be able to reach their work mailbox. It is available when only one method is required to reset.

Why the other options are wrong

• B. A mobile app notification is only available for SSPR when two methods are required to reset.
• C. Smart cards are not a supported SSPR verification method.
• D. An address in the organization is not appropriate, because a locked-out user cannot reach that mailbox.

Correct answer: B. No

The User Administrator role does not have permissions to update Identity Secure Score improvement actions. The Security Administrator role is specifically required for this task. User Administrator is limited to user and group management and lacks the security-related permissions needed for Identity Secure Score updates.

Correct answer: A. Enable admin consent requests for the tenant.

To allow users to request admin consent for applications while following the principle of least privilege, you must first enable admin consent requests at the tenant level. This feature allows users to submit consent requests to designated reviewers rather than granting permissions directly, maintaining security governance while providing necessary access capabilities.

Why the other options are wrong

• B. Designating a reviewer is the second step; you must enable admin consent requests first.
• C. Granting admin consent directly to the app bypasses the request workflow and violates least privilege.
• D. Conditional Access policies do not enable the admin consent request workflow.

Correct answer: B. Helpdesk administrator

The Helpdesk administrator role is the least privileged role that can reset passwords and manage authentication methods for non-administrative users. While the Privileged authentication administrator has broader permissions, the Helpdesk administrator role is more aligned with the principle of least privilege for the specific task of password resets and session invalidation without granting excessive security permissions.

Why the other options are wrong

• A. Authentication administrator cannot invalidate sessions, which is required.
• C. Privileged authentication administrator has excessive permissions beyond the requirement, violating least privilege.
• D. Security operator role does not have password reset or session invalidation capabilities.

Correct answer: A. a verification code from the Microsoft Authenticator app

A verification code generated by the Microsoft Authenticator app works offline because the app generates time-based one-time passwords (TOTP) locally on the device without requiring network connectivity. SMS requires mobile connectivity, app passwords are legacy and not recommended, and notifications require internet connectivity to the phone.

Why the other options are wrong

• B. SMS requires mobile phone connectivity which the users lack in the remote location.
• C. App passwords are a legacy authentication method not suitable for modern MFA implementations.
• D. Notifications through Microsoft Authenticator require internet connectivity to deliver the push notification to the mobile device.

Correct answer: D. the Licenses blade in the Microsoft Entra admin center

The Licenses blade in the Microsoft Entra admin center allows bulk removal of licenses based on group assignments. Since E5 licenses are assigned to a group containing all users, the system can automatically detect and remove the conflicting E3 licenses with minimal administrative effort. This is the least effort approach compared to scripting or cmdlet-based approaches for 2,500 users.

Why the other options are wrong

• A. Update-MgGroup cmdlet is for modifying group properties, not managing user licenses.
• B. Set-WindowsProductKey cmdlet is for configuring Windows product keys, not Microsoft 365 licenses.
• C. Set-MgUserLicense cmdlet would require scripting and processing 2,500 individual users, representing more effort than the portal solution.

Correct answer: A. the Licenses blade in the Microsoft Entra admin center

The Licenses blade in the Microsoft Entra admin center provides a UI-based interface to manage user licenses at scale. Once users inherit E5 licenses through group assignment, you can use the Licenses blade to remove the individual E3 licenses with minimal administrative effort, allowing the system to handle bulk operations through the portal interface.

Why the other options are wrong

• B. Administrative units blade is for organizing and delegating administrative scope over groups of users, not for license management.
• C. Identity Governance blade handles access reviews and entitlement management, not license assignment or removal.
• D. The Update-MgUser cmdlet requires scripting and coding effort, making it less efficient than a portal UI for this task.

Correct answer: C. From the Microsoft Entra admin center, create a Conditional Access policy.

Before creating a Defender for Cloud Apps session policy, you must first set up a Conditional Access policy in Microsoft Entra admin center. The Conditional Access policy is the prerequisite that enables session control for Cloud Apps policies to function properly.

Why the other options are wrong

• A. User monitoring is not a prerequisite for creating session policies.
• B. App onboarding/maintenance is not the first step required for session policy creation.
• D. Creating a continuous report does not establish the foundation needed for session policies.

Correct answer: C. From Users and groups, add HRUsers.

App3 is not visible to HRUsers because they have not been assigned to it. Even though App3 is part of the HR Apps collection and is enabled for sign-in with user assignment required, the specific users in the HRUsers group must be explicitly assigned to App3 in order to see it in their My Apps portal. Adding HRUsers to App3's Users and groups section will make it visible.

Why the other options are wrong

• A. Configuring a sign-on method does not affect visibility; the app is already enabled for sign-in.
• B. User consent permissions relate to API permissions and data access, not app visibility.
• D. Changing User assignment required to No would make the app visible to all users, not just the intended HRUsers group.

Correct answer: C. Modify the Local intranet Zone settings.

Azure AD Seamless SSO requires modifying the Local intranet Zone settings to add the Azure AD tenant's internal domain (typically *.microsoftonline.com or the internal domain). This allows Windows 10 computers to perform Kerberos authentication transparently without additional prompts. The Local intranet Zone setting enables the browser and Windows to automatically send credentials for seamless authentication.

Why the other options are wrong

• A. Sign-in options in Settings app controls local sign-in behavior, not cloud-based SSO configuration.
• B. Enterprise State Roaming is for syncing user settings across devices, not for enabling Seamless SSO.
• D. The Azure AD Connect Authentication Agent is installed on servers running Azure AD Connect, not on individual Windows 10 client computers.

Correct answer: B. Configure a traffic forwarding profile.

After deploying the Global Secure Access client, the next step is to configure a traffic forwarding profile. This profile directs traffic to the appropriate resources and defines which connections should route through the secure access infrastructure for private access to App1.

Why the other options are wrong

• A. Remote networks are for connecting branch offices or remote sites, not for private app access in this scenario.
• C. Private network connectors are used for hybrid scenarios but traffic forwarding profile is the appropriate next configuration step.
• D. Application security groups are Azure networking constructs not directly related to Global Secure Access configuration steps.

Correct answer: B. Windows Hello for Business

Windows Hello for Business uses a credential bound to the laptop and unlocked with a PIN or biometric, which satisfies multifactor authentication. It works over the laptop's wired internet connection with no need for a phone signal. That makes it usable from the remote locations.

Why the other options are wrong

• A. Voice calls need phone connectivity, which is unavailable at the remote locations.
• C. Email one-time passcodes are allowed for SSPR, not as an MFA method for sign-in.
• D. Security questions are only allowed for self-service password reset, not as an MFA method.

Correct answer: B. No

The Security Operator role cannot update the status of Identity Secure Score improvement actions. The Security Operator role can only read security information and view reports but cannot make changes to improvement actions. To update Identity Secure Score improvement actions, a higher privilege role such as Security Administrator is required.

Why the other options are wrong

• A. This is incorrect because Security Operator lacks the write permissions needed to update improvement action status.

Correct answer: D. pass-through authentication

Pass-through authentication (PTA) is the authentication method that enforces on-premises AD DS account lockout policies on Microsoft Entra sign-in attempts. PTA validates passwords directly against on-premises Active Directory, allowing lockout policies to apply to cloud sign-ins.

Why the other options are wrong

• A. Seamless SSO provides single sign-on functionality but does not enforce account lockout policies.
• B. Cloud Sync is for directory synchronization and does not directly apply lockout policies to sign-ins.
• C. Password hash synchronization does not validate against on-premises policies and cannot enforce account lockouts.

Correct answer: C. Create a guest user account in contoso.com.

Creating a guest user account allows an external user with credentials from user1@outlook.com to access the enterprise application App1 within the contoso.com tenant while maintaining their external identity. This is the standard method for providing external contractor access in Microsoft Entra.

Why the other options are wrong

• A. Adding a custom domain does not enable external user access or guest capabilities.
• B. External collaboration settings control guest policies but do not directly grant access to an application.
• D. WS-Fed identity providers are for federated authentication scenarios, not for guest user access with external email credentials.

Correct answer: A. Windows Hello for Business

Windows Hello for Business uses a credential bound to the laptop and unlocked with a PIN or biometric, which satisfies multifactor authentication. It works over the laptop's wired internet connection with no need for a phone signal. That makes it usable from the remote locations.

Why the other options are wrong

• B. An app password is a legacy workaround for apps that cannot do MFA, not an MFA method.
• C. An Authenticator push notification needs the phone to have data connectivity, which is unavailable at the remote locations.
• D. Security questions are only allowed for self-service password reset, not as an MFA method.

Correct answer: C. 169.254.169.254

App1 must use the IP address 169.254.169.254, which is the Azure Instance Metadata Service (IMDS) endpoint. This is the standard link-local address reserved for metadata services on Azure VMs. Applications request managed identity tokens by calling the token endpoint at this address, regardless of the VM's private or public IP configuration.

Why the other options are wrong

• A. The public IP address is used for external communication but not for internal metadata service requests.
• B. 127.0.0.1 is localhost and would only work if a local token service is running, which is not the standard approach.
• D. The private IP address is used for VM networking but not for managed identity token requests.

Correct answer: B. an Azure AD conditional access policy that has session controls configured

An Azure AD conditional access policy with session controls can differentiate between Azure AD-joined (company-owned) and Azure AD-registered (user-owned) devices and apply restrictions only to user-owned computers. Session controls like app enforced restrictions can prevent file downloads and syncing on non-compliant devices while allowing full access on managed devices.

Why the other options are wrong

• A. Microsoft Cloud App Security activity policies with governance actions are for monitoring and managing activities post-authentication, not for preventing downloads based on device ownership.
• C. Client apps conditions filter by app type but cannot distinguish between device ownership or management status.
• D. App discovery policies monitor app usage but are not designed to enforce download restrictions.

Correct answer: A. a sign-in risk policy

A sign-in risk policy in Azure AD/Microsoft Entra detects when users sign in from unusual locations like anonymous IP addresses and can trigger MFA as a remediation action. User risk policies evaluate the user account itself rather than the sign-in event, and MFA registration policies control MFA enrollment, neither of which addresses sign-in from anonymous IPs.

Why the other options are wrong

• B. User risk policies assess compromised user accounts, not the sign-in location or IP address characteristics.
• C. MFA registration policies control when users must register for MFA, not when MFA is required during sign-in from specific locations.

Correct answer: B. Billing Administrator

The Billing Administrator role has the minimum permissions needed to purchase licenses for an Azure subscription. This role can manage billing and purchases without the excessive permissions of Global Administrator, and it's more appropriate than Permissions Management Administrator (which manages permissions, not licensing) or User Access Administrator (which manages role assignments).

Why the other options are wrong

• A. Global Administrator grants far more permissions than necessary, violating the principle of least privilege.
• C. Permissions Management Administrator manages permissions and policies, not license purchases.
• D. User Access Administrator manages role assignments and access control, not license procurement.

Correct answer: B. Create a guest user account in contoso.com.

Creating a guest user account in the contoso.com tenant allows the contractor to authenticate using their external user1@outlook.com credentials while being added as a guest to the directory. This enables access to App1 while maintaining the external identity requirement.

Why the other options are wrong

• A. Microsoft Entra Connect sync is for synchronizing on-premises identities, not for providing guest access to external contractors.
• C. External collaboration settings control guest invitation policies but do not directly grant access to applications.
• D. The New-MgUser cmdlet creates member accounts in the tenant, not guest accounts with external identities.

Correct answer: C. a mobile app code

A mobile app code (verification code from the Microsoft Authenticator app) is a valid authentication method for self-service password reset. This method generates time-based codes that can be used to verify a user's identity during the password reset process. It is one of the standard SSPR methods supported by Azure AD.

Why the other options are wrong

• A. Microsoft Teams chat is not a supported SSPR authentication method.
• B. Mobile app notification requires real-time connectivity and is not a standard SSPR method.
• D. FIDO2 security keys are supported for sign-in but are not commonly listed as a standard SSPR method in typical configurations.

Correct answer: B. No

The Exchange Administrator role does not have permissions to update Identity Secure Score improvement actions. The Security Administrator role is required for managing and updating Identity Secure Score. Exchange Administrator is limited to Exchange Online management and cannot access security score features.

Correct answer: D. Set Enable guest self-service sign up via user flows to Yes.

Before adding Facebook or other social identity providers to Microsoft Entra, you must first enable guest self-service sign-up via user flows. This prerequisite allows external users to authenticate using social identities and complete the sign-up process.

Why the other options are wrong

• A. Custom domains are not required for adding social identity providers.
• B. WS-Fed identity providers are for federated enterprise authentication, not social providers like Facebook.
• C. SAML identity providers are for enterprise federation, not for social identity provider integration.

Correct answer: A. Update-MgPolicyAuthorizationPolicy

Update-MgPolicyAuthorizationPolicy is used to modify the authorization policy in Microsoft Entra, including settings that control whether users can self-register or create accounts through self-service sign-up. This is the correct cmdlet to prevent self-signed users from creating accounts in the tenant.

Why the other options are wrong

• B. Update-MgDomain manages domain settings but not self-service sign-up policies.
• C. Update-MgPolicyPermissionGrantPolicyExclude manages consent policy exclusions, not sign-up policies.
• D. Update-MgDomainFederationConfiguration manages federation settings, not self-service sign-up controls.

Correct answer: D. system-assigned managed identity

A system-assigned managed identity is the correct choice for enabling Microsoft Entra login on a VM and accessing Azure resources within the same subscription. The system-assigned identity is created and managed by Azure automatically, and it can be granted RBAC permissions to access Sub1 resources. This is simpler than user-assigned managed identity for this scenario.

Why the other options are wrong

• A. A Microsoft Entra user account is not an identity type for VMs; it's for people.
• B. While user-assigned managed identity could work, system-assigned is more appropriate and simpler for a single VM in one subscription.
• C. Azure Automation account is used for runbook execution and automation workflows, not for VM authentication.

Correct answer: C, E. a one-time passcode email; the Microsoft Authenticator app

During combined registration in interrupt mode, users can register with one-time passcode via email (C) and the Microsoft Authenticator app (E). These methods are supported for initial combined registration as they provide accessible ways for new users to complete both MFA and SSPR registration simultaneously without requiring pre-existing authentication infrastructure.

Why the other options are wrong

• A. FIDO2 security keys are not available during the initial combined registration interrupt process.
• B. Hardware tokens are not supported for combined registration in interrupt mode.
• D. Windows Hello for Business requires pre-existing Windows device configuration and is not available for initial combined registration interrupt.

Correct answer: C. Grant

To require users to accept Terms of Use in a Conditional Access policy, you must configure the Grant controls. The Grant section is where you specify access requirements such as requiring users to accept terms of use, requiring MFA, or requiring compliant devices. The ToU requirement is applied as a grant control that users must satisfy to gain access.

Why the other options are wrong

• A. Conditions define when the policy applies but do not specify what users must do to gain access.
• B. Session controls manage how access is used after authentication but do not enforce ToU acceptance.
• D. Target resources specify which resources the policy applies to, not what users must do to access them.

Correct answer: C. Run the New-MgInvitation cmdlet.

The New-MgInvitation cmdlet is the correct PowerShell method to invite an external user (user1@outlook.com) as a guest to the contoso.com tenant, enabling them to access App1 while authenticating with their external credentials.

Why the other options are wrong

• A. New-MgUser creates member accounts in the tenant, not guest accounts for external users.
• B. Adding a custom domain does not enable external user access or guest capabilities.
• D. Microsoft Entra Connect sync synchronizes on-premises identities, not for inviting external guest users.

Correct answer: B. Run the New-MgInvitation cmdlet.

The New-MgInvitation cmdlet is used to invite external users (guest users) to an Azure AD tenant. This allows a contractor with user1@outlook.com credentials to be invited as a guest user and then granted access to App1. The invitation process enables external authentication while maintaining organizational control over access.

Why the other options are wrong

• A. New-MgUser creates internal users in the tenant, not external guest users with external identities.
• C. External collaboration settings control whether invitations are allowed, but don't create the invitation itself.
• D. Azure AD Connect sync is for synchronizing on-premises AD to cloud, not for inviting external users.

Correct answer: D. Application administrator

The Application Administrator role allows users to register applications, manage application proxy settings, and control application ownership assignments. This role provides the specific permissions needed while adhering to least privilege, it grants only application-related permissions without broader administrative access that other roles would provide.

Why the other options are wrong

• A. Application Developer cannot manage application proxy settings or prevent users from being added as app owners.
• B. Cloud Application Administrator lacks the granular control over app registration and ownership that Application Administrator provides.
• C. Service Support Administrator is too broad and provides helpdesk support permissions not related to application management requirements.

Correct answer: A. the Set-MsolUserLicense cmdlet

The Set-MsolUserLicense cmdlet is the most efficient method for removing licenses from 2,500 users in bulk. This PowerShell cmdlet allows batch operations to remove the Enterprise E3 licenses from multiple users programmatically with minimal administrative effort, whereas manual removal or other methods would be time-consuming.

Why the other options are wrong

• B. Set-AzureADGroup modifies group properties, not user license assignments.
• C. Set-WindowsProductKey is unrelated to Microsoft 365 license management.
• D. Administrative units are for organizing user management but don't provide license removal functionality.

Correct answer: B. a mobile app code

When SSPR requires only one method, the Microsoft Authenticator verification code is available, while the app notification is only offered when two methods are required. A mobile app code is therefore a valid method with these settings.

Why the other options are wrong

• A. FIDO2 security keys are not a supported SSPR verification method.
• C. Microsoft Teams chat is not an SSPR verification method.
• D. A Windows Hello PIN is not an SSPR verification method.

Correct answer: B. sign-in logs

Sign-in logs in Azure AD/Microsoft Entra directly record authentication attempts and failures with detailed error messages, providing the fastest and most direct way to identify why a user cannot access a service. This minimizes administrative effort by showing the exact error code and reason without requiring additional investigation. Log Analytics requires custom queries, audit logs don't capture sign-in errors, and provisioning logs track user and group provisioning, not portal access.

Why the other options are wrong

• A. Log Analytics requires configuring custom queries and is more complex than reviewing sign-in logs directly.
• C. Audit logs track administrative changes and user actions but don't capture sign-in failures or portal access errors.
• D. Provisioning logs track user and group provisioning events in applications, not portal authentication attempts.

Correct answer: C. Network Policy Server (NPS)

Network Policy Server (NPS) acts as a RADIUS server that can integrate Azure MFA with legacy VPN systems. The NPS extension allows the on-premises VPN server to perform authentication against Azure AD while applying Azure MFA policies, enabling MFA for VPN connections without requiring the VPN server to directly support Azure MFA.

Why the other options are wrong

• A. Azure AD Application Proxy is for publishing on-premises web applications, not for VPN authentication.
• B. Azure AD Password Protection proxy protects against password spray attacks but does not provide MFA for VPN.
• D. Pass-through authentication proxy handles authentication validation but is not designed for VPN MFA integration.