100 Free SC-300 Practice Questions and Answers
100 questions for the SC-300 exam, each answer explained. Watch it here, try the questions yourself, or read the transcript.
Questions in this video
Tap an answer to see why it is right or wrong. Tap it again to reset.
Question 1 Play from 00:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Remote networks are for connecting branch offices or remote sites, not for private app access in this scenario.
Right, B is the answer.
Why B is right
After deploying the Global Secure Access client, the next step is to configure a traffic forwarding profile. This profile directs traffic to the appropriate resources and defines which connections should route through the secure access infrastructure for private access to App1.
Not this one. Try another answer.
Why C is wrong
Private network connectors are used for hybrid scenarios but traffic forwarding profile is the appropriate next configuration step.
Not this one. Try another answer.
Why D is wrong
Application security groups are Azure networking constructs not directly related to Global Secure Access configuration steps.
Question 2 Play from 01:58
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Cloud App Security access policies control access to specific cloud applications, not enforcing organization-wide terms of use for all resources.
Not this one. Try another answer.
Why B is wrong
Endpoint Manager terms and conditions are for device compliance and management, not for controlling access to tenant resources based on ToU acceptance.
Right, C is the answer.
Why C is right
A Conditional Access policy in Azure AD is the appropriate tool to enforce that users accept terms of use before accessing tenant resources. You can configure a Conditional Access policy with the 'Terms of use' grant control that requires acceptance as a condition for access, and deny access to those who don't accept.
Not this one. Try another answer.
Why D is wrong
Compliance policies in Endpoint Manager enforce device configuration requirements, not acceptance of organizational terms of use for resource access.
Question 3 Play from 04:03
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Access packages are used in entitlement management for granting access to resources, not for enforcing ToU at sign-in.
Right, B is the answer.
Why B is right
To prompt users to accept a terms of use agreement when they sign in, you must create a Conditional Access policy that enforces the terms of use grant control. Conditional Access policies provide the mechanism to apply ToU acceptance requirements based on conditions and user attributes during the sign-in flow.
Not this one. Try another answer.
Why C is wrong
Lifecycle workflows automate user provisioning and deprovisioning tasks, not sign-in prompts for ToU acceptance.
Not this one. Try another answer.
Why D is wrong
Authentication methods configure how users authenticate (MFA, passwordless, etc.), not terms of use acceptance requirements.
Question 4 Play from 05:51
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
Selecting 'Require justification on activation' (A) enforces accountability by requiring users to provide a reason when activating the User administrator role. Setting all assignments to 'Active' (E) removes the just-in-time activation requirement, making the role continuously available, which aligns with typical technical requirements for critical administrative roles that need constant availability.
Not this one. Try another answer.
Why B is wrong
Requiring ticket information is useful for audit trails but not typically specified as a core requirement for this scenario.
Not this one. Try another answer.
Why C is wrong
Modifying expiration settings controls how long assignments remain valid but is not indicated as a requirement here.
Not this one. Try another answer.
Why D is wrong
Setting all assignments to Eligible would require activation each time, contradicting the need for persistent access indicated by the requirement to set them Active.
Right, E is one of the answers.
Why E is right
Selecting 'Require justification on activation' (A) enforces accountability by requiring users to provide a reason when activating the User administrator role. Setting all assignments to 'Active' (E) removes the just-in-time activation requirement, making the role continuously available, which aligns with typical technical requirements for critical administrative roles that need constant availability.
Question 5 Play from 07:54
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Access packages are used for entitlement management and identity governance, not for configuring MFA requirements.
Right, B is the answer.
Why B is right
Before implementing protected actions with phishing-resistant MFA, you must first configure an authentication strength for the tenant to define which MFA methods are considered phishing-resistant. Authentication strengths define the specific credential requirements (such as Windows Hello, FIDO2 keys, or certificate-based authentication) that qualify as phishing-resistant. Once this is configured, you can then reference it in Conditional Access policies to enforce these requirements on protected actions.
Not this one. Try another answer.
Why C is wrong
Authentication context is used within Conditional Access policies to reference specific authentication strength requirements, but the strength itself must be configured first.
Not this one. Try another answer.
Why D is wrong
Creating a Conditional Access policy comes after configuring the authentication strength, as the policy will reference the strength configuration.
Question 6 Play from 10:02
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Admin consent settings control the overall approval workflow but do not classify permission risk levels.
Right, B is the answer.
Why B is right
Permission classifications define which permissions are considered high-risk versus low-risk in Microsoft Entra. By modifying permission classifications, you can designate certain permissions as high-privilege, which combined with user consent settings, allows you to prevent consent to high-privilege requests while permitting consent to low-risk ones.
Not this one. Try another answer.
Why C is wrong
User consent settings determine whether users can consent at all, but permission classifications must be set first to distinguish risk levels.
Not this one. Try another answer.
Why D is wrong
App registrations are where permissions are requested, but the risk classification system is managed separately.
Question 7 Play from 11:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Access policies are used for blocking or allowing access based on risk, not for enabling session control.
Not this one. Try another answer.
Why B is wrong
App governance policies manage app permissions and behavior, not session control prerequisites.
Not this one. Try another answer.
Why C is wrong
Session policies are created after the Conditional Access policy prerequisite is in place to enable session control.
Right, D is the answer.
Why D is right
To enable session control for SharePoint Online in Defender for Cloud Apps, you must first create a Conditional Access policy. Conditional Access serves as the prerequisite that routes sessions through Defender for Cloud Apps, enabling session control policies to function properly.
Question 8 Play from 13:31
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Password hash synchronization in Azure AD Connect enables Azure AD to detect compromised credentials by comparing password hashes against known leaked credential databases. This is the primary mechanism for meeting authentication requirements related to leaked credentials, allowing Azure AD to identify and flag accounts with passwords found in breach databases.
Not this one. Try another answer.
Why B is wrong
Azure AD Password Protection enforces strong password policies but does not detect already-leaked credentials.
Not this one. Try another answer.
Why C is wrong
Authentication method policies control how users authenticate but do not address leaked credential detection.
Not this one. Try another answer.
Why D is wrong
Federation with PingFederate is an identity provider integration that does not specifically address leaked credential detection.
Question 9 Play from 15:27
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
After registering an enterprise application and configuring SSO, the next step to meet the requirement that users request access before using corporate applications is to configure Self-service application access. This enables the Self-service access management feature where users can request access to the application, and designated approvers can review and approve or deny those requests.
Not this one. Try another answer.
Why B is wrong
Provisioning is used for automated user and group provisioning to the application, not for implementing access request workflows.
Not this one. Try another answer.
Why C is wrong
Application proxy is used for providing secure remote access to on-premises applications, not for managing access requests.
Not this one. Try another answer.
Why D is wrong
Roles and administrators is for assigning admin roles, not for configuring user access request functionality.
Question 10 Play from 17:25
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Conditions define when the policy applies but do not specify what users must do to gain access.
Not this one. Try another answer.
Why B is wrong
Session controls manage how access is used after authentication but do not enforce ToU acceptance.
Right, C is the answer.
Why C is right
To require users to accept Terms of Use in a Conditional Access policy, you must configure the Grant controls. The Grant section is where you specify access requirements such as requiring users to accept terms of use, requiring MFA, or requiring compliant devices. The ToU requirement is applied as a grant control that users must satisfy to gain access.
Not this one. Try another answer.
Why D is wrong
Target resources specify which resources the policy applies to, not what users must do to access them.
Show all 100 questionsShow fewer questions
Question 11 Play from 19:14
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
14 days is shorter than the standard retention period for Azure AD P1.
Right, B is the answer.
Why B is right
Azure AD P1 tenants retain sign-in logs for 30 days by default. This is the standard retention period for sign-in events in Azure AD, allowing administrators to investigate recent authentication activities within this timeframe.
Not this one. Try another answer.
Why C is wrong
90 days is the retention period for Azure AD P2 Premium tenants, not P1.
Not this one. Try another answer.
Why D is wrong
365 days exceeds the standard retention period; extended retention requires integration with Log Analytics or other storage solutions.
Question 12 Play from 20:57
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Tenant restrictions require modern authentication to function properly. Configuring Outlook 2013 clients to use modern authentication is the prerequisite step that minimizes administrative effort compared to upgrading all clients. Outlook 2013 can support modern authentication when enabled, avoiding the need for wholesale client upgrades. This allows the legacy clients to work with tenant restrictions policies while maintaining compatibility.
Not this one. Try another answer.
Why B is wrong
Upgrading all clients is more administratively burdensome than enabling modern authentication.
Not this one. Try another answer.
Why C is wrong
Organization Sharing in Exchange is unrelated to tenant restrictions implementation.
Not this one. Try another answer.
Why D is wrong
Upgrading to Outlook 2019 is unnecessary if modern authentication can be enabled on 2013.
Question 13 Play from 23:07
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
30 days is too short for the standard retention period of risk data.
Not this one. Try another answer.
Why B is wrong
60 days is less than the actual 90-day retention period.
Right, C is the answer.
Why C is right
Risky user activity logs in Microsoft Entra are retained for 90 days. This is the standard retention period for risk detection data in Azure AD/Entra, allowing organizations to maintain historical context for security investigations while managing storage costs.
Not this one. Try another answer.
Why D is wrong
180 days exceeds the standard retention period for risky user activity logs.
Question 14 Play from 24:34
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Seamless SSO provides single sign-on functionality but does not enforce account lockout policies.
Not this one. Try another answer.
Why B is wrong
Cloud Sync is for directory synchronization and does not directly apply lockout policies to sign-ins.
Not this one. Try another answer.
Why C is wrong
Password hash synchronization does not validate against on-premises policies and cannot enforce account lockouts.
Right, D is the answer.
Why D is right
Pass-through authentication (PTA) is the authentication method that enforces on-premises AD DS account lockout policies on Microsoft Entra sign-in attempts. PTA validates passwords directly against on-premises Active Directory, allowing lockout policies to apply to cloud sign-ins.
Question 15 Play from 26:29
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Cloud apps or actions condition filters by application, not by authentication method type.
Not this one. Try another answer.
Why B is wrong
User risk condition assesses the risk level of a user's account, not the authentication protocol.
Right, C is the answer.
Why C is right
The client apps condition in conditional access policies allows filtering based on the authentication protocol used. This condition can specifically target and block legacy authentication methods like SMTP, IMAP, and POP, which do not support modern authentication flows and conditional access.
Not this one. Try another answer.
Why D is wrong
Sign-in risk condition evaluates the risk of the sign-in event itself, not whether legacy authentication is being used.
Question 16 Play from 28:15
• Ensure that User1 can use the User Administrator role without approval.
• Ensure that User2 can use the User Administrator role once User3 has approved the role request of User2. What should you create first?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Role assignments must be created first in Privileged Identity Management to establish which users are eligible for the User Administrator role and define the activation requirements for each user. User1 requires an assignment with no approval, while User2 requires an assignment configured for approval by User3. These assignments are the foundational objects that PIM uses to enforce access control and approval workflows.
Not this one. Try another answer.
Why B is wrong
Administrative units are for scoping management permissions but are not required for JIT access or approval workflows in PIM.
Not this one. Try another answer.
Why C is wrong
Security groups could be used for organizing users but are not the mechanism for configuring PIM role activation requirements.
Not this one. Try another answer.
Why D is wrong
Conditional Access policies control authentication factors and sign-in conditions but do not configure PIM role activation approval workflows.
Question 17 Play from 30:27
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Company branding configures the visual appearance of Azure AD sign-in pages and does not relate to audit logging.
Right, B is the answer.
Why B is right
Diagnostics settings in Azure AD must be configured to send audit logs and sign-in logs to a Log Analytics workspace. This enables centralized monitoring and auditing by routing Azure AD activity data to the workspace where it can be queried, analyzed, and retained according to compliance requirements.
Not this one. Try another answer.
Why C is wrong
External Identities settings manage guest user access and B2B collaboration, not audit logging.
Not this one. Try another answer.
Why D is wrong
App registrations define applications in Azure AD but do not configure where audit data is sent.
Question 18 Play from 32:03
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A web content filtering policy must be created first to define which categories of websites (such as those containing 'gambling' in the URL) should be blocked. This policy is then referenced within the Global Secure Access security profile, which can subsequently be applied via Conditional Access policies. Web content filtering policies are the foundational configuration for URL-based blocking in Global Secure Access.
Not this one. Try another answer.
Why B is wrong
Named locations are used for geographic or IP-based access conditions in Conditional Access, not for URL content filtering.
Not this one. Try another answer.
Why C is wrong
Adaptive Access settings configure dynamic risk-based policies but are not the primary mechanism for URL filtering.
Not this one. Try another answer.
Why D is wrong
Network security groups are Azure networking controls and are not part of the Global Secure Access web filtering configuration.
Question 19 Play from 34:03
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
While Defender for Cloud Apps is related, app governance is specifically configured through Microsoft 365 Defender.
Not this one. Try another answer.
Why B is wrong
The Microsoft 365 admin center is for general tenant administration but not the portal for app governance configuration.
Right, C is the answer.
Why C is right
App governance is a feature integrated into Microsoft 365 Defender. The Microsoft 365 Defender portal is where you enable and configure app governance integration when you have the app governance add-on license, as it provides centralized governance and compliance monitoring for applications across the Microsoft ecosystem.
Not this one. Try another answer.
Why D is wrong
The Azure Active Directory admin center focuses on identity management, not app governance features.
Not this one. Try another answer.
Why E is wrong
Microsoft Purview compliance portal handles data governance and compliance; app governance is managed in Microsoft 365 Defender.
Question 20 Play from 36:05
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The cloud app catalog in Microsoft 365 Defender portal provides detailed information about discovered applications, including their authentication requirements. By reviewing the cloud app catalog, you can identify which applications do not require user authentication, as this information is documented in the app properties. The catalog displays security scores and authentication details for each discovered app, enabling you to assess authentication requirements across your environment.
Not this one. Try another answer.
Why B is wrong
Creating an OAuth policy reviews OAuth-related alerts but does not specifically identify apps that don't require user authentication.
Not this one. Try another answer.
Why C is wrong
A snapshot Cloud Discovery report shows app usage statistics but not authentication requirement details.
Not this one. Try another answer.
Why D is wrong
A discovered app query is used for investigating specific apps but is not the primary method for identifying apps without authentication requirements.
Question 21 Play from 38:14
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Management groups are used for organizing Azure subscriptions and resources, not for scoping Azure AD user management permissions.
Right, B is the answer.
Why B is right
Administrative units in Azure AD allow you to delegate administrative permissions to manage users within a specific organizational unit without granting broader tenant-wide permissions. This is the primary feature designed to scope administrative access to specific departments or groups of users.
Not this one. Try another answer.
Why C is wrong
Resource groups organize Azure resources and have no relevance to Azure AD user management or departmental access control.
Not this one. Try another answer.
Why D is wrong
Microsoft 365 groups are for collaboration and communication, not for delegating administrative permissions to manage specific user populations.
Question 22 Play from 40:12
• Identify the number of failed sign-ins.
• Identify the success rate of sign-ins.
• Minimize administrative effort. What should you use?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Sign-in logs show individual events but require manual analysis to calculate success rates and aggregate failure counts.
Not this one. Try another answer.
Why B is wrong
Access reviews manage user access permissions, not sign-in activity analysis.
Not this one. Try another answer.
Why C is wrong
Audit logs track administrative changes and consent events, not application sign-in success/failure metrics.
Right, D is the answer.
Why D is right
Usage & insights provides comprehensive analytics for application sign-in activity including success rates, failed sign-in counts, and trend analysis. This dashboard is specifically designed to review sign-in metrics for applications and minimizes administrative effort by providing pre-built analytics.
Question 23 Play from 41:54
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
While Conditional Access policies are needed, app-enforced restrictions are not the specific requirement; App Control is needed.
Not this one. Try another answer.
Why B is wrong
Token configuration is not a prerequisite for creating Cloud Apps access policies.
Not this one. Try another answer.
Why C is wrong
Adding API permissions is not required before creating a Cloud Apps access policy.
Right, D is the answer.
Why D is right
Before creating a Microsoft Defender for Cloud Apps access policy, you must first configure a Conditional Access policy with Conditional Access App Control enabled. This prerequisite integration allows Defender for Cloud Apps to enforce access policies by intercepting sessions and applying the configured controls.
Question 24 Play from 43:49
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Update-MgGroup cmdlet is for modifying group properties, not managing user licenses.
Not this one. Try another answer.
Why B is wrong
Set-WindowsProductKey cmdlet is for configuring Windows product keys, not Microsoft 365 licenses.
Not this one. Try another answer.
Why C is wrong
Set-MgUserLicense cmdlet would require scripting and processing 2,500 individual users, representing more effort than the portal solution.
Right, D is the answer.
Why D is right
The Licenses blade in the Microsoft Entra admin center allows bulk removal of licenses based on group assignments. Since E5 licenses are assigned to a group containing all users, the system can automatically detect and remove the conflicting E3 licenses with minimal administrative effort. This is the least effort approach compared to scripting or cmdlet-based approaches for 2,500 users.
Question 25 Play from 45:59
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
identityIssuer is not a standard required property for bulk user creation; usageLocation is optional.
Not this one. Try another answer.
Why B is wrong
givenName and surname are optional; the required set must include displayName and passwordProfile.
Right, C is the answer.
Why C is right
When bulk creating users in Azure AD via template upload, the required properties are accountEnabled, displayName, userPrincipalName, and passwordProfile. These properties are mandatory to create a functional user account that can sign in and authenticate to Azure AD services. The displayName identifies the user, userPrincipalName serves as the unique identifier, accountEnabled sets the account status, and passwordProfile defines the password.
Not this one. Try another answer.
Why D is wrong
usageLocation is optional for licensing but not required for basic user creation; this set lacks displayName which is required.
Question 26 Play from 48:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Terms and conditions in Intune are for device management compliance, not for controlling access to tenant resources based on terms acceptance.
Not this one. Try another answer.
Why B is wrong
Defender for Cloud Apps access policies control access to cloud applications, not core tenant resource access based on terms of use.
Right, C is the answer.
Why C is right
To enforce acceptance of terms of use and conditionally grant or deny access based on acceptance, you must configure a Conditional Access policy in Microsoft Entra ID. Conditional Access allows you to require users to accept terms of use before accessing tenant resources.
Not this one. Try another answer.
Why D is wrong
Compliance policies in Intune enforce device compliance requirements but do not enforce terms of use acceptance for resource access.
Question 27 Play from 50:09
• An Azure Active Directory (Azure AD) tenant that has an Azure Active Directory Premium P2 license
• A Microsoft SharePoint Online site named Site1
• A Microsoft Teams team named Team1 You need to create an entitlement management workflow to manage Site1 and Team1. What should you do first?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
App registration is used for application authentication, not for entitlement management workflows.
Not this one. Try another answer.
Why B is wrong
Administrative units are for delegating management scope, not for setting up entitlement management.
Not this one. Try another answer.
Why C is wrong
Access packages are created after a catalog exists; you cannot create them without a catalog first.
Right, D is the answer.
Why D is right
Before creating access packages in entitlement management, you must first create a catalog. A catalog is a container for access packages and is a prerequisite for managing resources like SharePoint sites and Teams teams. The catalog organizes and controls which resources can be included in access packages.
Question 28 Play from 52:01
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The User Access Administrator role should be assigned to the Permissions Management service principal. This role allows the service principal to manage role assignments and assess permissions across resources while following the principle of least privilege. It grants the necessary permissions to monitor and audit privilege assignments without providing full administrative control like Owner or Contributor roles would.
Not this one. Try another answer.
Why B is wrong
Contributor role grants too many permissions beyond what is needed for monitoring and right-sizing roles.
Not this one. Try another answer.
Why C is wrong
Reader role is insufficient as it only allows viewing permissions, not implementing the right-size role changes.
Not this one. Try another answer.
Why D is wrong
Owner role grants excessive permissions far beyond the principle of least privilege requirements for this function.
Question 29 Play from 53:49
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Cloud Discovery anomaly detection policy is used to detect suspicious application behaviors, not to implement approval workflows for new apps.
Right, B is the answer.
Why B is right
Configuring Admin consent settings in the Microsoft Entra admin center allows you to implement an approval process for enterprise applications. This setting controls whether users can consent to apps and whether admin approval is required, directly implementing the approval workflow needed for new application deployments.
Not this one. Try another answer.
Why C is wrong
App connectors are used to integrate specific SaaS applications with Microsoft Defender for Cloud Apps, not to control application approval processes.
Not this one. Try another answer.
Why D is wrong
Access reviews are used to periodically review user access assignments, not to implement approval processes for new application registrations.
Question 30 Play from 55:58
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
User flows define authentication behavior but do not configure billing models.
Not this one. Try another answer.
Why B is wrong
Terms of use are for compliance and acceptance tracking, not billing configuration.
Right, C is the answer.
Why C is right
To ensure External Identities pricing is based on monthly active users (MAU), you must link an Azure subscription to your Azure AD tenant. This linked subscription enables MAU-based billing, which charges based on the number of unique users authenticating in a calendar month. Without a linked subscription, External Identities may use different billing models or be unavailable.
Not this one. Try another answer.
Why D is wrong
Access reviews are for governance and compliance, not billing setup.
Question 31 Play from 57:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Private IP address ranges cannot be reliably used for named locations in cloud-based Conditional Access because private IPs are not routable on the internet.
Right, B is the answer.
Why B is right
Named locations with public IP address ranges are used to define geographic or network-based locations for Conditional Access policies. The Boston office would be configured with its public-facing IP range so that MFA policies can be applied based on connection location, allowing conditional access rules to recognize when users connect from the office versus other locations.
Not this one. Try another answer.
Why C is wrong
Trusted IPs are a legacy feature primarily for on-premises MFA server and are not the modern approach for location-based Conditional Access.
Not this one. Try another answer.
Why D is wrong
Trusted IPs with private IP ranges would not work for cloud-based conditional access policies.
Question 32 Play from 59:40
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A Microsoft Entra user account is not an identity type for VMs; it's for people.
Not this one. Try another answer.
Why B is wrong
While user-assigned managed identity could work, system-assigned is more appropriate and simpler for a single VM in one subscription.
Not this one. Try another answer.
Why C is wrong
Azure Automation account is used for runbook execution and automation workflows, not for VM authentication.
Right, D is the answer.
Why D is right
A system-assigned managed identity is the correct choice for enabling Microsoft Entra login on a VM and accessing Azure resources within the same subscription. The system-assigned identity is created and managed by Azure automatically, and it can be granted RBAC permissions to access Sub1 resources. This is simpler than user-assigned managed identity for this scenario.
Question 33 Play from 1:01:34
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
External collaboration settings is the correct configuration location for controlling which external domains can be invited as guests to an Azure AD tenant. This setting allows administrators to create allow or deny lists of external domains, restricting guest invitations to only approved organizations.
Not this one. Try another answer.
Why B is wrong
All identity providers configures authentication methods, not guest domain restrictions.
Not this one. Try another answer.
Why C is wrong
Cross-tenant access settings manages access policies between different Azure AD tenants, not guest domain restrictions.
Not this one. Try another answer.
Why D is wrong
Linked subscriptions is not a valid Azure AD configuration setting for guest access control.
Question 34 Play from 1:03:11
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Key Vault Secrets User grants permission to get and use secrets but is broader than needed for metadata-only read access.
Not this one. Try another answer.
Why B is wrong
Key Vault Crypto User grants cryptographic operation permissions which exceed the requirement to only read metadata.
Right, C is the answer.
Why C is right
Key Vault Reader is the least privileged role that allows reading metadata of certificates, keys, and secrets without granting any management or cryptographic operation capabilities. It aligns perfectly with the principle of least privilege for read-only metadata access.
Not this one. Try another answer.
Why D is wrong
Key Vault Crypto Officer is an administrative role with far too many permissions for the stated requirement.
Question 35 Play from 1:04:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Data protection settings configure encryption and retention, not identity-based access control.
Not this one. Try another answer.
Why B is wrong
Shared access signatures (SAS) provide temporary token-based access, not managed identity-based access.
Right, C is the answer.
Why C is right
The Access control (IAM) settings in Azure portal is where you assign roles to the system-assigned managed identity of WebApp1, allowing it to read and write files to storage1. Through IAM configuration, you grant the appropriate role (such as Storage Blob Data Contributor) to the managed identity, enabling secure access to the storage account without storing credentials. This is the standard Azure method for configuring identity-based access to storage resources.
Not this one. Try another answer.
Why D is wrong
File share settings manage file-level configurations but not identity permissions.
Not this one. Try another answer.
Why E is wrong
Access keys are storage account credentials and should be avoided when managed identities are available.
Question 36 Play from 1:07:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Microsoft Defender for Cloud Apps portal is for cloud application security, not PIM role activation.
Not this one. Try another answer.
Why B is wrong
The Microsoft 365 admin center manages Microsoft 365 services but not Azure AD role activation.
Right, C is the answer.
Why C is right
The Azure Active Directory admin center is where you activate eligible Azure AD roles through Privileged Identity Management (PIM). This is where User1 would activate the Application Administrator role to configure the application proxy connector group.
Not this one. Try another answer.
Why D is wrong
Microsoft 365 Defender portal focuses on security threats and incidents, not role activation.
Question 37 Play from 1:08:54
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure AD Application Proxy is for publishing on-premises web applications, not for VPN authentication.
Not this one. Try another answer.
Why B is wrong
Azure AD Password Protection proxy protects against password spray attacks but does not provide MFA for VPN.
Right, C is the answer.
Why C is right
Network Policy Server (NPS) acts as a RADIUS server that can integrate Azure MFA with legacy VPN systems. The NPS extension allows the on-premises VPN server to perform authentication against Azure AD while applying Azure MFA policies, enabling MFA for VPN connections without requiring the VPN server to directly support Azure MFA.
Not this one. Try another answer.
Why D is wrong
Pass-through authentication proxy handles authentication validation but is not designed for VPN MFA integration.
Question 38 Play from 1:11:04
• Azure
• Alibaba Cloud
• Amazon Web Services (AWS)
• Google Cloud Platform (GCP) You configure an Azure subscription to use Microsoft Entra Permissions Management to manage the permissions in Azure only. Which additional cloud platforms can be managed by using Permissions Management?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This excludes GCP, which is supported by Permissions Management.
Not this one. Try another answer.
Why B is wrong
This includes Alibaba Cloud, which is not supported by Permissions Management.
Not this one. Try another answer.
Why C is wrong
This includes Alibaba Cloud which is unsupported and excludes AWS which is supported.
Right, D is the answer.
Why D is right
Microsoft Entra Permissions Management supports Azure, AWS, and GCP for managing permissions and identifying privilege risks. It does not currently support Alibaba Cloud. Since the subscription already uses Permissions Management for Azure, the additional cloud platforms that can be managed are AWS and GCP.
Not this one. Try another answer.
Why E is wrong
This includes Alibaba Cloud, which is not supported by Permissions Management.
Question 39 Play from 1:13:11
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
08:00 on Sunday is 5 days later and exceeds the 24-hour request retention window.
Not this one. Try another answer.
Why B is wrong
08:00 on Thursday is 2 days later and exceeds the 24-hour request retention window.
Right, C is the answer.
Why C is right
In Privileged Identity Management, activation requests that require approval are automatically deleted after 24 hours if no approver has responded. Since User1 submitted the request at 08:00 on Tuesday, it will be deleted at 08:00 on Wednesday, which is exactly 24 hours later. This is the default PIM request retention policy.
Not this one. Try another answer.
Why D is wrong
20:00 on Tuesday is only 12 hours later and does not account for the full 24-hour retention period.
Question 40 Play from 1:15:05
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Executable name is relevant for desktop applications, not web apps.
Not this one. Try another answer.
Why B is wrong
Bundle ID is specific to iOS applications.
Not this one. Try another answer.
Why C is wrong
Package name is specific to Android applications.
Right, D is the answer.
Why D is right
When registering a .NET web app with Azure AD, the redirect URI is the critical configuration parameter. It specifies where Azure AD should send the user after authentication, allowing the app to receive and process the authentication response. The redirect URI must be registered before the app can authenticate users.
Question 41 Play from 1:16:35
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
App1 can use both certificates and secrets as credentials to authenticate with App2. These are the two standard credential types for app-to-app authentication in Microsoft Entra. Certificates provide a more secure option using public key infrastructure, while client secrets are simpler string-based credentials. Both methods enable App1 to obtain access tokens and securely communicate with App2 without user interaction.
Not this one. Try another answer.
Why B is wrong
Managed identities are used within Azure for resource authentication, not for cross-tenant app-to-app scenarios between partner organizations.
Right, C is one of the answers.
Why C is right
App1 can use both certificates and secrets as credentials to authenticate with App2. These are the two standard credential types for app-to-app authentication in Microsoft Entra. Certificates provide a more secure option using public key infrastructure, while client secrets are simpler string-based credentials. Both methods enable App1 to obtain access tokens and securely communicate with App2 without user interaction.
Not this one. Try another answer.
Why D is wrong
User accounts are for user authentication, not app-to-app authentication between applications.
Not this one. Try another answer.
Why E is wrong
One-time passwords are a user authentication mechanism, not a credential type for application authentication.
Question 42 Play from 1:18:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Microsoft 365 groups are for collaboration and resource sharing, not for scoping administrative permissions.
Right, B is the answer.
Why B is right
Administrative units in Microsoft Entra allow you to delegate administrative roles with a scoped boundary, such as a specific department. By creating an administrative unit for the marketing department and assigning User1 an administrative role scoped to that unit, you can grant User1 permissions to manage only users in the marketing department. This provides the necessary scope limitation.
Not this one. Try another answer.
Why C is wrong
Management groups are Azure constructs for organizing subscriptions, not for scoping Entra ID administrative roles.
Not this one. Try another answer.
Why D is wrong
Resource groups are Azure constructs for organizing cloud resources, not for scoping Entra ID administrative permissions.
Question 43 Play from 1:20:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Modifying user consent settings does not establish the governance framework needed to track delegated access assignments.
Right, B is the answer.
Why B is right
In Azure AD Identity Governance, you must first create a catalog to organize and manage access packages and track application access assignments. A catalog is the container for access packages and serves as the foundation for delegation of access governance responsibilities. Once a catalog exists, programs and other governance structures can be built within it to manage delegated access assignments.
Not this one. Try another answer.
Why C is wrong
Creating a program requires a catalog to exist first; the catalog is the prerequisite step.
Not this one. Try another answer.
Why D is wrong
Modifying admin consent request settings does not directly track application access assignments or establish delegation governance.
Question 44 Play from 1:22:21
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Continuous access evaluation settings manage real-time session validation but do not control guest invitation policies.
Not this one. Try another answer.
Why B is wrong
Conditional Access policies enforce authentication and access controls but do not govern the guest invitation process itself.
Not this one. Try another answer.
Why C is wrong
Access reviews settings manage periodic access reviews but do not configure guest invitation policies or restrictions.
Right, D is the answer.
Why D is right
Modifying the External collaboration settings in Azure AD allows control over guest user invitations, including who can invite guests, which external domains are allowed or blocked, and invitation restrictions. These settings directly govern guest invitation behavior and resolve issues related to how external users are invited to the tenant.
Question 45 Play from 1:24:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Access reviews are for periodic recertification of user access to resources, not for sign-in risk remediation.
Not this one. Try another answer.
Why B is wrong
Azure AD Password Protection helps prevent weak password usage but does not directly enable sign-in risk remediation without blocking.
Not this one. Try another answer.
Why C is wrong
Self-service password reset is useful for account recovery but does not serve as a primary mechanism for sign-in risk remediation in Identity Protection policies.
Right, D is the answer.
Why D is right
To implement a sign-in risk remediation policy without blocking users, you must first implement MFA for all users. MFA allows Identity Protection to enforce step-up authentication when risky sign-in behavior is detected, remedying the risk without outright blocking access. This enables a remediation workflow where users can verify their identity through MFA rather than being denied access, which aligns with the 'without blocking user access' requirement.
Question 46 Play from 1:26:21
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Conditional Access with app protection policy requirement does not grant User1 permissions to create Defender for Cloud Apps session policies.
Not this one. Try another answer.
Why B is wrong
While Conditional Access App Control is related to session policies, assigning the proper role is the first necessary action.
Not this one. Try another answer.
Why C is wrong
The Cloud Application Administrator role manages cloud applications but does not specifically grant Defender for Cloud Apps session policy creation permissions.
Right, D is the answer.
Why D is right
To allow User1 to create Microsoft Defender for Cloud Apps session policies, the Cloud App Security Administrator role must be assigned. While the Security Administrator role provides broad security management capabilities, the Cloud App Security Administrator role is the specific role designed to grant access to Defender for Cloud Apps features, including session policy creation. This role provides the necessary permissions without requiring Conditional Access policy configuration as a prerequisite.
Question 47 Play from 1:28:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Tags are metadata but don't organize apps into portal-visible categories.
Right, B is the answer.
Why B is right
Collections in the My Apps portal allow administrators to group related applications into organized categories that users can access. This is the specific feature designed for grouping apps by business function or department. Tags are metadata labels but don't create portal groupings, naming policies control user naming conventions, and dynamic groups are for user membership, not app organization.
Not this one. Try another answer.
Why C is wrong
Naming policies control how users or objects are named, not app grouping.
Not this one. Try another answer.
Why D is wrong
Dynamic groups organize users based on attributes, not apps in the portal.
Question 48 Play from 1:30:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Remote networks is used for configuring remote network connections, not for enabling the Private access profile.
Right, B is the answer.
Why B is right
The Traffic forwarding blade in the Microsoft Entra admin center is used to enable the Private access profile. This blade contains the configuration settings necessary to set up traffic forwarding rules and enable private access functionality for on-premises applications published through Microsoft Entra Private Access.
Not this one. Try another answer.
Why C is wrong
Security profiles is not the correct blade for Private access profile configuration.
Not this one. Try another answer.
Why D is wrong
Connectors is used for managing connectors but not specifically for enabling the Private access profile itself.
Question 49 Play from 1:31:52
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A Dynamic User security group allows you to automatically assign licenses to users based on membership criteria (such as department or other attributes). When new ADatum users are added with matching attributes, they are automatically added to the dynamic group and receive licenses through group-based licensing, minimizing manual administration of license allocation.
Not this one. Try another answer.
Why B is wrong
Distribution groups are for email and collaboration but do not support group-based licensing.
Not this one. Try another answer.
Why C is wrong
An organizational unit (OU) is an on-premises Active Directory object and is not used for cloud license allocation in Microsoft Entra.
Not this one. Try another answer.
Why D is wrong
Administrative units are used to scope administrative roles and permissions, not for license allocation.
Question 50 Play from 1:33:32
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Enterprise application collections are used for organizing and managing apps, not for controlling consent based on permission impact levels.
Not this one. Try another answer.
Why B is wrong
Access reviews are used to periodically review user or group access assignments, not to control initial app consent permissions.
Not this one. Try another answer.
Why C is wrong
Access packages are used in entitlement management to bundle resources for access requests, not for restricting app consent permissions.
Right, D is the answer.
Why D is right
Permission classifications in Azure AD allow administrators to define the impact level of permissions (low, medium, high impact). By configuring permission classifications, you can restrict user consent to only apps requesting low-impact permissions, which directly addresses the requirement to limit consent to low-impact permission requests from verified publishers.
Question 51 Play from 1:35:26
• User1: Reader
• User2: Contributor
• User3: Storage Blob Data Reader
• User4: Virtual Machine Contributor You are evaluating the use of attribute-based access control (ABAC). Which user's role will support the use of ABAC?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Reader is a built-in role that does not support attribute-based conditions.
Not this one. Try another answer.
Why B is wrong
Contributor is a built-in role that does not support attribute-based conditions.
Right, C is the answer.
Why C is right
The Storage Blob Data Reader role supports attribute-based access control (ABAC) because it can be combined with conditions based on resource attributes, such as blob index tags or container properties. ABAC support is available for data plane roles in services like Azure Storage, allowing fine-grained access decisions based on resource attributes rather than just role assignment.
Not this one. Try another answer.
Why D is wrong
Virtual Machine Contributor is a built-in role that does not support attribute-based conditions.
Question 52 Play from 1:37:23
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Access packages are for managing entitlement requests and assignments, not for periodic access reviews and blocking.
Not this one. Try another answer.
Why B is wrong
Access packages manage user entitlements, not access review and blocking capabilities.
Not this one. Try another answer.
Why C is wrong
While group-based access reviews can target guest users, an application-based review is more appropriate for reviewing specific application (Exchange admin center) access and enforcing blocks.
Right, D is the answer.
Why D is right
An application-based access review targeting guest users allows you to review access to a specific application (Exchange admin center in this case) at scheduled intervals (monthly) and block or remove access as needed. This is more granular than group-based reviews and is specifically designed for reviewing application-level access for external users.
Question 53 Play from 1:39:28
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
January 14 is only 14 days after deletion; the recovery window extends to 30 days.
Right, B is the answer.
Why B is right
Deleted applications in Microsoft Entra ID can be restored within 30 days of deletion. Since App1 was deleted on January 1, the last day for restoration would be January 30 (30 days later), giving administrators a full month to recover the deleted app.
Not this one. Try another answer.
Why C is wrong
March 30 extends beyond the standard 30-day recovery period for deleted apps.
Not this one. Try another answer.
Why D is wrong
June 30 is far beyond the 30-day retention window for deleted applications.
Question 54 Play from 1:41:07
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
FIDO2 security keys are not available during the initial combined registration interrupt process.
Not this one. Try another answer.
Why B is wrong
Hardware tokens are not supported for combined registration in interrupt mode.
Right, C is one of the answers.
Why C is right
During combined registration in interrupt mode, users can register with one-time passcode via email (C) and the Microsoft Authenticator app (E). These methods are supported for initial combined registration as they provide accessible ways for new users to complete both MFA and SSPR registration simultaneously without requiring pre-existing authentication infrastructure.
Not this one. Try another answer.
Why D is wrong
Windows Hello for Business requires pre-existing Windows device configuration and is not available for initial combined registration interrupt.
Right, E is one of the answers.
Why E is right
During combined registration in interrupt mode, users can register with one-time passcode via email (C) and the Microsoft Authenticator app (E). These methods are supported for initial combined registration as they provide accessible ways for new users to complete both MFA and SSPR registration simultaneously without requiring pre-existing authentication infrastructure.
Question 55 Play from 1:43:11
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
To enable on-premises devices to access the internet through Global Secure Access, you must create a remote network in the Microsoft Entra admin center. A remote network represents the on-premises location and allows the Global Secure Access service to route traffic from those devices through the secure access gateway.
Not this one. Try another answer.
Why B is wrong
Named locations are used for Conditional Access policies based on network location, not for configuring Global Secure Access device connectivity.
Not this one. Try another answer.
Why C is wrong
Access packages are used for entitlement management to grant access to resources, not for configuring Global Secure Access.
Not this one. Try another answer.
Why D is wrong
Deploying the Global Secure Access client is necessary but happens after creating the remote network; the network configuration must be established first in the admin center.
Question 56 Play from 1:45:08
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Autopilot rules in Entra Permissions Management enable automated detection and remediation of unused permissions based on defined criteria like the 90-day inactivity threshold. This directly addresses the requirement to automatically identify and remove unused permissions while minimizing administrative effort. Autopilot rules run on a schedule and can automatically revoke permissions meeting the specified conditions.
Not this one. Try another answer.
Why B is wrong
Permissions analytics reports provide visibility into permission usage but do not automate the removal of unused permissions.
Not this one. Try another answer.
Why C is wrong
Reviewing Service principals in Entra Insights provides visibility but requires manual intervention to remove permissions.
Not this one. Try another answer.
Why D is wrong
Audit queries are for reviewing historical activity and compliance, not for automating permission removal.
Question 57 Play from 1:47:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
14 days is insufficient; Azure AD provides a longer recovery window.
Right, B is the answer.
Why B is right
Deleted app registrations in Azure AD can be restored within 30 days from the deletion date. After 30 days, the deleted app registration is permanently removed and cannot be recovered. This recovery window allows administrators time to restore accidentally deleted app registrations before permanent loss occurs.
Not this one. Try another answer.
Why C is wrong
60 days exceeds the actual 30-day recovery period for deleted apps.
Not this one. Try another answer.
Why D is wrong
180 days far exceeds the actual recovery window available for deleted app registrations.
Question 58 Play from 1:48:50
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure resources in PIM is for managing eligibility on Azure subscription and resource roles, not Azure AD directory roles.
Not this one. Try another answer.
Why B is wrong
Privileged access groups is a separate PIM feature for managing group membership, not for reviewing role eligibility.
Not this one. Try another answer.
Why C is wrong
Review access is a feature for conducting access reviews but is not the primary blade for identifying role eligibility.
Right, D is the answer.
Why D is right
The Azure AD roles blade in Privileged Identity Management is where you manage and review role assignments and eligibility for Azure AD directory roles, including identifying which users are eligible for the Cloud Application Administrator role.
Question 59 Play from 1:50:31
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure Key Vault is used for certificate management after trust is established, not as the first step.
Right, B is the answer.
Why B is right
To implement certificate-based authentication in Azure AD using on-premises CA certificates, you must first add the certification authority to the Microsoft Entra ID tenant. This establishes the trust relationship and allows Azure AD to validate certificates issued by CA1. This configuration step must occur before users can authenticate using those certificates.
Not this one. Try another answer.
Why C is wrong
Auto-enrollment is a Group Policy setting for certificate distribution to devices, not the first step for Azure AD integration.
Not this one. Try another answer.
Why D is wrong
Windows Hello for Business is an alternative authentication method, not prerequisite for certificate-based authentication setup.
Question 60 Play from 1:52:43
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Selecting 'Customize synchronization options' in the Azure AD Connect wizard allows configuration of which objects, attributes, and organizational units are synchronized from on-premises Active Directory to Azure AD. This provides the granular control needed to meet specific synchronization requirements for ADatum users.
Not this one. Try another answer.
Why B is wrong
Set-ADSyncScheduler configures the sync schedule frequency but does not define which users are synchronized.
Not this one. Try another answer.
Why C is wrong
Start-ADSyncSyncCycle manually triggers an immediate sync cycle but does not configure which users should be synchronized.
Not this one. Try another answer.
Why D is wrong
Changing user sign-in method modifies authentication mechanism (password sync, pass-through auth, federation) but does not configure which users are synced.
Question 61 Play from 1:54:47
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
OAuth 2.0 is an authentication protocol for authorization, not a user provisioning standard.
Not this one. Try another answer.
Why B is wrong
WS-Fed is a federation protocol for authentication, not designed for automatic user provisioning.
Right, C is the answer.
Why C is right
SCIM 2.0 (System for Cross-domain Identity Management) is the industry standard specification for automatic user provisioning and deprovisioning. SaaS applications that support SCIM 2.0 can automatically synchronize user accounts between Azure AD and the application without manual intervention.
Not this one. Try another answer.
Why D is wrong
LDAP 3 is a directory protocol but is not the standard for SaaS automatic provisioning; SCIM 2.0 is the modern standard.
Question 62 Play from 1:56:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Conditional Access policies control authentication conditions but don't automatically remove access based on inactivity.
Not this one. Try another answer.
Why B is wrong
Compliance policies manage device and application compliance requirements, not user access removal based on usage.
Not this one. Try another answer.
Why C is wrong
Guest access reviews are for reviewing all guest access generally, not specifically for application usage patterns.
Right, D is the answer.
Why D is right
An access review for application access is the appropriate solution for managing guest user access based on usage patterns. Access reviews allow you to automatically review and remove access for users who haven't accessed the application in a specified period (30 days), minimizing manual administrative effort while ensuring security.
Question 63 Play from 1:58:30
• Private IP address: 172.16.1.5
• Public IP address: 108.143.161.25
• System-assigned managed identity status: On You install an app named App1 on VM1. You need to configure App1 to request a managed identity app-only access token. Which IP address should App1 use for the request?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The public IP address is used for external communication but not for internal metadata service requests.
Not this one. Try another answer.
Why B is wrong
127.0.0.1 is localhost and would only work if a local token service is running, which is not the standard approach.
Right, C is the answer.
Why C is right
App1 must use the IP address 169.254.169.254, which is the Azure Instance Metadata Service (IMDS) endpoint. This is the standard link-local address reserved for metadata services on Azure VMs. Applications request managed identity tokens by calling the token endpoint at this address, regardless of the VM's private or public IP configuration.
Not this one. Try another answer.
Why D is wrong
The private IP address is used for VM networking but not for managed identity token requests.
Question 64 Play from 2:00:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Policy sets in Microsoft Endpoint Manager manage device and app compliance but are not the primary mechanism for integrating an app with Azure AD.
Not this one. Try another answer.
Why B is wrong
App configuration policies manage app settings and behavior on endpoints but do not integrate the app with Azure AD for authentication.
Right, C is the answer.
Why C is right
An app registration in Azure AD is required to integrate an application with Azure AD for authentication, authorization, and access management. This registration allows App1 to use Azure AD as an identity provider and enables enforcement of security policies, MFA, and Conditional Access rules for the application.
Not this one. Try another answer.
Why D is wrong
Azure AD Application Proxy is for publishing on-premises applications through Azure AD; it is not required for integrating a cloud application with Azure AD.
Question 65 Play from 2:02:44
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Helpdesk Administrator can reset passwords but cannot manage license assignments.
Not this one. Try another answer.
Why B is wrong
Billing Administrator manages subscription billing and purchases, not user licenses or passwords.
Not this one. Try another answer.
Why C is wrong
License Administrator can only manage license assignments, not reset user passwords.
Right, D is the answer.
Why D is right
The User Administrator role has permissions to manage license assignments and reset user passwords. This role can create and manage users, reset passwords, manage licenses, and invalidate refresh tokens. While Helpdesk Administrator can reset passwords, it cannot manage license assignments. License Administrator can only manage license assignments but not reset passwords.
Question 66 Play from 2:04:19
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Activity policies detect actions after they occur, they don't prevent them in real-time.
Not this one. Try another answer.
Why B is wrong
Access policies grant or deny overall access, not control specific actions within sessions.
Not this one. Try another answer.
Why C is wrong
File policies are based on file properties and content scanning, not user actions like printing.
Right, D is the answer.
Why D is right
A session policy in Microsoft Defender for Cloud Apps enforces real-time controls on user sessions, including preventing specific actions like printing. Session policies intercept and monitor sessions to block activities such as printing, downloading, or copying based on session context and risk. Activity policies monitor after-the-fact actions, file policies focus on file content and properties, and access policies block or allow access entirely rather than controlling actions within a session.
Question 67 Play from 2:06:13
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An access policy manages user access conditions but is not specifically designed for third-party app monitoring.
Not this one. Try another answer.
Why B is wrong
An app permission policy is not a standard policy type in Defender for Cloud Apps.
Right, C is the answer.
Why C is right
An OAuth app policy is used to monitor and control third-party applications that access resources in your Microsoft 365 subscription through OAuth authentication. This policy type allows you to set governance rules for apps requesting permissions and accessing tenant resources.
Not this one. Try another answer.
Why D is wrong
An endpoint protection policy manages device security, not third-party app access.
Question 68 Play from 2:07:54
• Require users to register when signing in: Yes
• Number of methods required to reset: 1 What is a valid authentication method available to users?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
FIDO2 security keys are not a supported SSPR verification method.
Right, B is the answer.
Why B is right
When SSPR requires only one method, the Microsoft Authenticator verification code is available, while the app notification is only offered when two methods are required. A mobile app code is therefore a valid method with these settings.
Not this one. Try another answer.
Why C is wrong
Microsoft Teams chat is not an SSPR verification method.
Not this one. Try another answer.
Why D is wrong
A Windows Hello PIN is not an SSPR verification method.
Question 69 Play from 2:09:28
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
To detect multi-staged attacks in Microsoft Sentinel, you must customize the rule logic to correlate multiple events across different stages of an attack chain. This requires modifying detection rules to include conditions that identify patterns spanning multiple steps rather than single events. Customized rule logic enables Sentinel to recognize sophisticated attacks that unfold over time and across different data sources.
Not this one. Try another answer.
Why B is wrong
Workbooks are visualization and reporting tools, not detection mechanisms for multi-staged attacks.
Not this one. Try another answer.
Why C is wrong
Data connectors bring data into Sentinel but do not configure attack detection logic.
Not this one. Try another answer.
Why D is wrong
Playbooks automate response actions after detection, not the initial detection of multi-staged attacks.
Question 70 Play from 2:11:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Managed Application Contributor is a subscription-level role for managing managed applications in Azure, not for registering applications in Azure AD.
Right, B is the answer.
Why B is right
The Application Developer role in Azure AD is the least privileged role that allows users to register applications. This role specifically permits app registration without granting broader administrative permissions like the Cloud Application Administrator role would. Since the tenant setting prevents users from self-registering applications, assigning the Application Developer role is the targeted solution.
Not this one. Try another answer.
Why C is wrong
Cloud Application Administrator is too broad and grants more permissions than necessary, violating the principle of least privilege.
Not this one. Try another answer.
Why D is wrong
App Configuration Data Owner is a subscription-level role for managing app configuration data, not for registering applications in Azure AD.
Question 71 Play from 2:13:27
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Archiving to a storage account stores logs for long-term retention but does not provide the real-time querying capability that workbooks require.
Not this one. Try another answer.
Why B is wrong
Sending to a partner solution is for integrating with third-party monitoring tools, not for powering Microsoft Entra workbooks.
Not this one. Try another answer.
Why C is wrong
Streaming to an event hub is for real-time event processing but is not the standard destination for workbook-based monitoring and analytics.
Right, D is the answer.
Why D is right
Microsoft Entra workbooks require diagnostic logs to be sent to a Log Analytics workspace. This destination allows the workbooks to query and analyze identity activity data from the logs.
Question 72 Play from 2:15:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Custom domains are not required for adding social identity providers.
Not this one. Try another answer.
Why B is wrong
WS-Fed identity providers are for federated enterprise authentication, not social providers like Facebook.
Not this one. Try another answer.
Why C is wrong
SAML identity providers are for enterprise federation, not for social identity provider integration.
Right, D is the answer.
Why D is right
Before adding Facebook or other social identity providers to Microsoft Entra, you must first enable guest self-service sign-up via user flows. This prerequisite allows external users to authenticate using social identities and complete the sign-up process.
Question 73 Play from 2:16:58
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Impossible travel is a sign-in risk detection, not a user risk detection.
Not this one. Try another answer.
Why B is wrong
Anonymous IP address is a sign-in risk detection, not a user risk detection.
Not this one. Try another answer.
Why C is wrong
Malicious IP address is a sign-in risk detection, not a user risk detection.
Right, D is the answer.
Why D is right
Azure AD threat intelligence is classified as a user risk detection type. It represents risks identified through Microsoft's threat intelligence that directly indicate compromised user accounts. The other options (impossible travel, anonymous IP, malicious IP) are all sign-in risk detections, not user risk detections. User risk detections indicate that a user account itself has been compromised, while sign-in risk detections indicate that a specific sign-in event is suspicious.
Question 74 Play from 2:18:43
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Resource access settings are not the primary mechanism for granting secret retrieval permissions.
Not this one. Try another answer.
Why B is wrong
The permissions model selection is less relevant than assigning the proper role.
Not this one. Try another answer.
Why C is wrong
Adding a user-assigned managed identity is unnecessary when the system-assigned identity is already available and functional.
Right, D is the answer.
Why D is right
To enable a system-assigned managed identity to access Key Vault secrets, you must assign an appropriate Azure role to the managed identity. The 'Key Vault Secrets User' or similar role must be assigned to VM1's system-assigned managed identity, granting it permission to retrieve secrets from Vault1. This is the first and most critical step to minimize administrative effort since the managed identity is already enabled on the VM.
Question 75 Play from 2:20:48
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Sign-in risk policies address authentication risk scoring, not continuous access evaluation configuration.
Not this one. Try another answer.
Why B is wrong
Access reviews are used for periodic user access certification and attestation, not for configuring continuous real-time access evaluation.
Right, C is the answer.
Why C is right
Continuous access evaluation (CAE) in Microsoft Entra is configured through Conditional Access policies. CAE enables real-time assessment of access conditions and can revoke tokens based on critical events and policy evaluation. While you can scope Conditional Access policies to specific roles like Application Administrator through assignment conditions, the mechanism for configuring CAE itself is the Conditional Access policy framework, which allows you to define when and how continuous evaluation occurs for app sign-ins.
Not this one. Try another answer.
Why D is wrong
Admin consent settings control application permissions and consent workflows, not continuous access evaluation for sign-ins.
Question 76 Play from 2:22:51
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Certificates require manual creation, distribution, and renewal management, increasing administrative overhead.
Not this one. Try another answer.
Why B is wrong
SAS tokens are temporary and must be managed, rotated, and renewed manually, creating ongoing administrative burden.
Right, C is the answer.
Why C is right
Managed identity is the best solution for allowing Azure VMs to authenticate to Azure SQL Managed Instance without storing credentials. It minimizes administrative effort by eliminating the need to manage passwords or connection strings, providing automatic credential management and token rotation through Azure's built-in identity system.
Not this one. Try another answer.
Why D is wrong
Microsoft Entra user accounts require password management and do not provide the seamless authentication that managed identities offer for Azure resources.
Question 77 Play from 2:24:47
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
External collaboration settings controls which external domains can be invited as guests, not membership validation reviews.
Right, B is the answer.
Why B is right
Creating an access review is the correct approach to ensure User1 is notified every three months to validate guest membership of Group1. Access reviews allow owners to periodically review and certify guest member access, with configurable recurrence intervals including quarterly schedules.
Not this one. Try another answer.
Why C is wrong
Access packages are for entitlement management and self-service access requests, not for periodic membership validation.
Not this one. Try another answer.
Why D is wrong
Group expiration policy sets when groups expire, not for regular membership validation by owners.
Question 78 Play from 2:26:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Access reviews are used to periodically verify that role assignments are still appropriate but do not modify the role's activation and usage settings.
Not this one. Try another answer.
Why B is wrong
Administrative units scope management capabilities to specific user groups but do not modify the role's settings or activation requirements.
Not this one. Try another answer.
Why C is wrong
Modifying active assignments changes who currently holds the role but does not alter the role's configuration or activation requirements.
Right, D is the answer.
Why D is right
Modifying role settings allows configuration of activation requirements, approval workflows, duration limits, and other governance controls for the User administrator role. Role settings govern how the role can be activated and used, directly addressing technical requirements for managing the role's behavior and constraints.
Question 79 Play from 2:28:22
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
To integrate Azure AD audit logs with Azure Monitor and view them in a Log Analytics workspace, you must first configure Diagnostics settings for Azure AD. This setting controls where Azure AD logs are sent, including to Log Analytics workspaces.
Not this one. Try another answer.
Why B is wrong
Update-MgOrganization cmdlet is for modifying organizational properties, not for configuring diagnostic log routing.
Not this one. Try another answer.
Why C is wrong
Update-MgDomain cmdlet is for managing domain properties, not for setting up audit log streaming.
Not this one. Try another answer.
Why D is wrong
Creating an Azure AD workbook would be done after diagnostics settings are configured to view the logs that are being collected.
Question 80 Play from 2:30:14
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Usage location is a user property for licensing and feature availability, not for UI localization.
Not this one. Try another answer.
Why B is wrong
Global Secure Access Session management controls session behavior and security, not language-based sign-in form presentation.
Right, C is the answer.
Why C is right
Company branding settings in the Microsoft Entra admin center allow you to customize the sign-in experience, including language-specific sign-in forms. You can configure localized branding that displays the Spanish sign-in form when users access from Microsoft Edge with their browser language set to Spanish. This is the direct mechanism for controlling localized authentication UI.
Not this one. Try another answer.
Why D is wrong
Conditional Access policies control access permissions and authentication requirements, not UI localization.
Question 81 Play from 2:32:14
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
.ipa is the file extension for iOS applications, not macOS.
Not this one. Try another answer.
Why B is wrong
.apk is the file extension for Android applications, not macOS.
Not this one. Try another answer.
Why C is wrong
.intunewin is used for Win32 applications on Windows devices, not for macOS deployment.
Right, D is the answer.
Why D is right
The .pkg file extension is the standard macOS installer package format. When deploying the Global Secure Access client to macOS devices through Intune, you must upload the client in .pkg format, as this is the native package format for macOS applications.
Question 82 Play from 2:34:00
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
To ensure users can only access resources when the Global Secure Access client is connected, you must first enable Global Secure Access signaling. This allows the system to detect and enforce the presence of the Global Secure Access client. While remote networks and named locations are part of the broader configuration, signaling is the foundational step that enables device enforcement. Tenant restrictions alone do not enforce client connectivity requirements.
Not this one. Try another answer.
Why B is wrong
Tagging for tenant restrictions controls which tenants can be accessed, but does not enforce Global Secure Access client connectivity.
Not this one. Try another answer.
Why C is wrong
Named locations define network locations but do not enforce device client connectivity requirements.
Not this one. Try another answer.
Why D is wrong
While remote networks are used in Global Secure Access, enabling signaling must occur first to enforce client connectivity.
Question 83 Play from 2:35:59
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Microsoft 365 Defender portal is used for security threat management, not role administration.
Not this one. Try another answer.
Why B is wrong
Microsoft 365 admin center manages general Microsoft 365 settings and user management, not Azure AD role activation.
Not this one. Try another answer.
Why C is wrong
Microsoft Intune admin center manages mobile device and application management, not Azure AD roles.
Right, D is the answer.
Why D is right
The Azure Active Directory admin center is the correct portal for managing Microsoft Entra ID (Azure AD) roles, including activating eligible roles like Application Administrator. This is where Privileged Identity Management (PIM) functionality is accessed to activate roles for users. The other portals handle different aspects of Microsoft 365 administration but are not the primary location for role activation.
Question 84 Play from 2:37:58
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
To bypass connections to www.microsoft.com from Global Secure Access, you need to configure the Internet access profile. This profile controls which internet destinations are routed through Global Secure Access, and adding www.microsoft.com to the bypass list ensures traffic to that site is excluded from the Global Secure Access path.
Not this one. Try another answer.
Why B is wrong
The Microsoft traffic profile is specifically for routing Microsoft 365 services and wouldn't be the primary profile for configuring general website bypasses.
Not this one. Try another answer.
Why C is wrong
While the Internet access profile is correct, the Microsoft traffic profile is not necessary for this bypass configuration.
Not this one. Try another answer.
Why D is wrong
The Private access profile is for corporate private applications and is not relevant to bypassing public internet destinations like www.microsoft.com.
Question 85 Play from 2:40:11
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Global Secure Access manages network and application access, not privileged account risk evaluation.
Right, B is the answer.
Why B is right
Privileged Identity Management (PIM) is specifically designed to evaluate, monitor, and remediate risks associated with highly privileged accounts across Azure subscriptions and Microsoft Entra ID. It provides just-in-time access, access reviews, and role-based risk assessment while minimizing administrative overhead through automated workflows and built-in governance controls.
Not this one. Try another answer.
Why C is wrong
Permissions Management focuses on least-privilege access analysis but is not the primary tool for evaluating highly privileged account risks.
Not this one. Try another answer.
Why D is wrong
Verified ID manages identity verification and credentials, not privileged account risk assessment.
Question 86 Play from 2:42:09
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
User monitoring is not a prerequisite for creating session policies.
Not this one. Try another answer.
Why B is wrong
App onboarding/maintenance is not the first step required for session policy creation.
Right, C is the answer.
Why C is right
Before creating a Defender for Cloud Apps session policy, you must first set up a Conditional Access policy in Microsoft Entra admin center. The Conditional Access policy is the prerequisite that enables session control for Cloud Apps policies to function properly.
Not this one. Try another answer.
Why D is wrong
Creating a continuous report does not establish the foundation needed for session policies.
Question 87 Play from 2:44:02
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Sign-in logs record authentication attempts, not terms of use acceptance/decline actions.
Not this one. Try another answer.
Why B is wrong
Usage and Insights reports provide usage statistics but don't track individual terms acceptance decisions.
Not this one. Try another answer.
Why C is wrong
Provisioning logs track user provisioning and synchronization activities, not terms of use acceptance.
Right, D is the answer.
Why D is right
Audit logs track acceptance or rejection of terms of use by users. When users accept or decline Terms1, these actions are recorded in the Azure AD audit logs, which provide a comprehensive record of who accepted or declined the terms and when.
Question 88 Play from 2:45:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Authentication strengths are used to define required authentication methods, not for configuring lockout thresholds.
Right, B is the answer.
Why B is right
Password protection is the correct setting to configure smart lockout with a specific failed sign-in threshold. Password protection policies in Azure AD admin center allow administrators to set smart lockout thresholds that automatically lock accounts after a specified number of failed authentication attempts, protecting against brute force attacks.
Not this one. Try another answer.
Why C is wrong
User risk policy is used to enforce actions based on detected user risk levels, not for smart lockout configuration.
Not this one. Try another answer.
Why D is wrong
Sign-in risk policy addresses risky sign-in events, not account lockout from failed authentication attempts.
Question 89 Play from 2:47:34
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
An access policy in Microsoft Defender for Cloud Apps can block or restrict user sign-in to connected cloud applications (like Yammer) based on risk conditions including location. This is the direct mechanism for preventing access from high-risk locations. Activity policies monitor behavior, unsanctioning an app removes it from oversight, and anomaly detection policies detect suspicious behavior rather than enforcing access restrictions.
Not this one. Try another answer.
Why B is wrong
Activity policies monitor and alert on user activities but don't prevent access based on location risk.
Not this one. Try another answer.
Why C is wrong
Unsanctioning Yammer would remove it from protection entirely, the opposite of the requirement.
Not this one. Try another answer.
Why D is wrong
Anomaly detection policies detect unusual activity patterns but don't enforce access restrictions based on location risk.
Question 90 Play from 2:49:34
• View all resources.
• Restart virtual machines.
• Create virtual machines in RG1 only.
• Create storage accounts in RG1 only. What is the minimum number of role-based access control (RBAC) role assignments required?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A single role cannot satisfy all requirements because resource creation must be scoped to RG1 only while viewing and VM restart must be at subscription level.
Right, B is the answer.
Why B is right
A minimum of 2 role assignments achieves all requirements: First, assign Reader role at the subscription level to allow viewing all resources. Second, assign a custom role or Contributor at the subscription level for VM restart capability combined with a scoped assignment (Contributor on RG1 only) for creating VMs and storage accounts in RG1. Alternatively, Reader at subscription scope plus a custom role scoped to RG1 for create operations satisfies all four tasks with 2 assignments.
Not this one. Try another answer.
Why C is wrong
Three assignments are more than the minimum needed when roles are properly scoped.
Not this one. Try another answer.
Why D is wrong
Four assignments exceed the minimum necessary to accomplish these tasks.
Question 91 Play from 2:51:42
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Log Analytics requires configuring custom queries and is more complex than reviewing sign-in logs directly.
Right, B is the answer.
Why B is right
Sign-in logs in Azure AD/Microsoft Entra directly record authentication attempts and failures with detailed error messages, providing the fastest and most direct way to identify why a user cannot access a service. This minimizes administrative effort by showing the exact error code and reason without requiring additional investigation. Log Analytics requires custom queries, audit logs don't capture sign-in errors, and provisioning logs track user and group provisioning, not portal access.
Not this one. Try another answer.
Why C is wrong
Audit logs track administrative changes and user actions but don't capture sign-in failures or portal access errors.
Not this one. Try another answer.
Why D is wrong
Provisioning logs track user and group provisioning events in applications, not portal authentication attempts.
Question 92 Play from 2:53:35
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Microsoft Sentinel is a security information and event management tool, not designed for privilege assessment across cloud platforms.
Not this one. Try another answer.
Why B is wrong
Microsoft Entra ID Protection focuses on identity risks within Azure AD, not multi-cloud privilege assessment.
Not this one. Try another answer.
Why C is wrong
Microsoft Defender for Cloud Apps is primarily for SaaS application security, not for assessing privilege assignments across cloud platforms.
Right, D is the answer.
Why D is right
Microsoft Entra Permissions Management is the solution designed to assess privilege-related risks across multiple cloud platforms including Azure, AWS, and GCP. It provides unified visibility into permission assignments and identifies over-privileged accounts across all three platforms while minimizing administrative effort through automated analysis and recommendations.
Question 93 Play from 2:55:35
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
CSV format is less suitable for complex nested data structures and SIEM integration compared to JSON.
Not this one. Try another answer.
Why B is wrong
Sign-in logs record authentication events but do not capture changes to conditional access policies themselves.
Right, C is the answer.
Why C is right
Changes to conditional access policies are recorded in Azure AD audit logs. To export these logs for use in a third-party SIEM system, audit logs in JSON format should be used, as JSON provides structured data that SIEM systems can parse and analyze effectively.
Not this one. Try another answer.
Why D is wrong
Sign-in logs in JSON format record sign-in events, not policy configuration changes.
Question 94 Play from 2:57:28
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
While HTML can be used in web contexts, Microsoft Entra ToU specifically requires PDF format for uploaded documents.
Not this one. Try another answer.
Why B is wrong
RTF (Rich Text Format) is not supported for Terms of Use uploads in Microsoft Entra.
Right, C is the answer.
Why C is right
Microsoft Entra Terms of Use requires documents to be uploaded in PDF format. PDF ensures consistent formatting and rendering across different devices and browsers, making it the standard format for official compliance documents in Microsoft Entra.
Not this one. Try another answer.
Why D is wrong
DOCX (Word documents) are not supported for Terms of Use uploads; PDF is the required format.
Question 95 Play from 2:59:02
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Disabling Security defaults is the first step required to implement conditional access policies. Security defaults and conditional access policies are mutually exclusive-when Security defaults are enabled, conditional access policies cannot be created or applied. Disabling Security defaults allows organizations to implement granular conditional access policies tailored to their specific requirements.
Not this one. Try another answer.
Why B is wrong
Password protection configuration is not a prerequisite for conditional access policies.
Not this one. Try another answer.
Why C is wrong
MFA registration policy is separate from the conditional access setup requirement.
Not this one. Try another answer.
Why D is wrong
User consent settings do not need to be disabled as a first step for conditional access implementation.
Question 96 Play from 3:00:59
• A user signs in from another country.
• A user triggers a sign-in risk. What should you use to complete the test?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The Conditional Access What If tool is specifically designed to test conditional access policies under hypothetical scenarios. It allows you to simulate sign-in conditions including risk levels, locations, and other signals to see how your policies would apply without actually affecting real users. This tool is the proper way to validate policy behavior before full deployment.
Not this one. Try another answer.
Why B is wrong
Sign-in logs show historical data but do not allow you to test policies under hypothetical future conditions.
Not this one. Try another answer.
Why C is wrong
Microsoft Defender for Cloud Apps activity logs monitor actual activity but are not designed for conditional access policy testing.
Not this one. Try another answer.
Why D is wrong
Access reviews are used for periodic validation of access permissions, not for testing conditional access policies.
Question 97 Play from 3:02:58
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The Permissions Management Administrator role is the least privileged role that grants the specific permissions needed to onboard subscriptions to Microsoft Entra Permissions Management. This role follows the principle of least privilege by providing only the permissions necessary for Permissions Management administration without the broad permissions of Global Administrator.
Not this one. Try another answer.
Why B is wrong
Global Administrator has excessive permissions beyond what is needed for Permissions Management onboarding.
Not this one. Try another answer.
Why C is wrong
Security Administrator has permissions focused on security features but not the specific permissions needed for Permissions Management onboarding.
Not this one. Try another answer.
Why D is wrong
Application Administrator manages applications and service principals but lacks the specific permissions for Permissions Management onboarding.
Question 98 Play from 3:05:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
App connectors in Defender for Cloud Apps are for monitoring existing apps, not implementing approval processes.
Not this one. Try another answer.
Why B is wrong
Access reviews are for auditing and recertifying existing access rights, not for approving new application additions.
Not this one. Try another answer.
Why C is wrong
App detection policies in Defender are for identifying and controlling discovered apps, not implementing administrative approval workflows.
Right, D is the answer.
Why D is right
Admin consent settings in Microsoft Entra allow administrators to implement an approval workflow for new enterprise applications. This setting controls whether users can consent to app requests and requires admin review, creating a formal approval process for new applications added to the tenant.
Question 99 Play from 3:06:58
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
While Global Administrator can be managed, Security Administrator is also a role that PIM can manage.
Right, B is the answer.
Why B is right
Azure AD PIM can manage Global Administrator and Security Administrator roles. These are the primary Azure AD directory roles for which PIM supports eligible and active assignments with approval workflows and time-based activation.
Not this one. Try another answer.
Why C is wrong
Security Contributor is not a role that can be managed through PIM's role management features.
Not this one. Try another answer.
Why D is wrong
Account Administrator is not an Azure AD directory role, and Security Contributor is not PIM-manageable.
Question 100 Play from 3:08:45
• Ensure that any permissions granted to Automation1 are removed when the account is deleted.
• Minimize administrative effort. What should you use?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Client secrets require manual rotation and cleanup when the Automation account is deleted.
Right, B is the answer.
Why B is right
A system-assigned managed identity is automatically created with the Automation account and automatically deleted when the account is deleted, ensuring permissions are cleaned up without manual intervention. This minimizes administrative effort compared to certificates or client secrets which require manual lifecycle management.
Not this one. Try another answer.
Why C is wrong
Certificates require manual management, renewal, and cleanup, increasing administrative effort.
Not this one. Try another answer.
Why D is wrong
User-assigned managed identities persist after the Automation account is deleted and require manual cleanup of permissions.
Transcript
Play from 00:00 Question 1. You have a Microsoft 365 subscription. You have an Azure subscription that contains an Azure App Service web app named App1. You have multiple devices that run Windows and are enrolled in Microsoft Intune. You deploy the Global Secure Access client to the devices by using Intune. You need to configure private access to App1. What should you do next? Here are the options. Option A. Create a remote network. Option B. Configure a traffic forwarding profile. Option C. Deploy a private network connector. Option D. Create an application security group. Pause the video now if you want time to think about the answer.
The correct answer is B. Configure a traffic forwarding profile. After deploying the Global Secure Access client, the next step is to configure a traffic forwarding profile. This profile directs traffic to the appropriate resources and defines which connections should route through the secure access infrastructure for private access to App1. Now, why are the other options incorrect? Option A is incorrect. Remote networks are for connecting branch offices or remote sites, not for private app access in this scenario. Option C is incorrect. Private network connectors are used for hybrid scenarios but traffic forwarding profile is the appropriate next configuration step. Option D is incorrect. Application security groups are Azure networking constructs not directly related to Global Secure Access configuration steps. Therefore, B, Configure a traffic forwarding profile, is the correct answer.
Play from 01:58 Question 2. You have a Microsoft 365 tenant. In Azure Active Directory (Azure AD), you configure the terms of use. You need to ensure that only users who accept the terms of use can access the resources in the tenant. Other users must be denied access. What should you configure? Here are the options. Option A. an access policy in Microsoft Cloud App Security. Option B. Terms and conditions in Microsoft Endpoint Manager. Option C. a conditional access policy in Azure AD. Option D. a compliance policy in Microsoft Endpoint Manager. Pause the video now if you want time to think about the answer.
The correct answer is C. a conditional access policy in Azure AD. A Conditional Access policy in Azure AD is the appropriate tool to enforce that users accept terms of use before accessing tenant resources. You can configure a Conditional Access policy with the 'Terms of use' grant control that requires acceptance as a condition for access, and deny access to those who don't accept. Now, why are the other options incorrect? Option A is incorrect. Cloud App Security access policies control access to specific cloud applications, not enforcing organization-wide terms of use for all resources. Option B is incorrect. Endpoint Manager terms and conditions are for device compliance and management, not for controlling access to tenant resources based on ToU acceptance. Option D is incorrect. Compliance policies in Endpoint Manager enforce device configuration requirements, not acceptance of organizational terms of use for resource access. Therefore, C, a conditional access policy in Azure AD, is the correct answer.
Play from 04:03 Question 3. You have a Microsoft 365 E5 subscription. You need to ensure that users are prompted to accept a custom terms of use (ToU) agreement when they sign in to the subscription. What should you configure? Here are the options. Option A. an access package. Option B. a Conditional Access policy. Option C. a lifecycle workflow. Option D. an authentication method. Pause the video now if you want time to think about the answer.
The correct answer is B. a Conditional Access policy. To prompt users to accept a terms of use agreement when they sign in, you must create a Conditional Access policy that enforces the terms of use grant control. Conditional Access policies provide the mechanism to apply ToU acceptance requirements based on conditions and user attributes during the sign-in flow. Now, why are the other options incorrect? Option A is incorrect. Access packages are used in entitlement management for granting access to resources, not for enforcing ToU at sign-in. Option C is incorrect. Lifecycle workflows automate user provisioning and deprovisioning tasks, not sign-in prompts for ToU acceptance. Option D is incorrect. Authentication methods configure how users authenticate (MFA, passwordless, etc.), not terms of use acceptance requirements. Therefore, B, a Conditional Access policy, is the correct answer.
Show full transcriptShow less
Play from 05:51 Question 4. You need to modify the settings of the User administrator role to meet the technical requirements. Which two actions should you perform for the role? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. Select Require justification on activation. Option B. Select Require ticket information on activation. Option C. Modify the Expire eligible assignments after setting. Option D. Set all assignments to Eligible. Option E. Set all assignments to Active. Pause the video now if you want time to think about the answer.
The correct answers are A. Select Require justification on activation, and E. Set all assignments to Active. Selecting 'Require justification on activation' (A) enforces accountability by requiring users to provide a reason when activating the User administrator role. Setting all assignments to 'Active' (E) removes the just-in-time activation requirement, making the role continuously available, which aligns with typical technical requirements for critical administrative roles that need constant availability. Now, why are the other options incorrect? Option B is incorrect. Requiring ticket information is useful for audit trails but not typically specified as a core requirement for this scenario. Option C is incorrect. Modifying expiration settings controls how long assignments remain valid but is not indicated as a requirement here. Option D is incorrect. Setting all assignments to Eligible would require activation each time, contradicting the need for persistent access indicated by the requirement to set them Active. Therefore, A and E are the correct answers.
Play from 07:54 Question 5. You have a Microsoft Entra tenant. You need to configure protected actions to require privileged users to use phishing-resistant multifactor authentication (MFA). What should you do first? Here are the options. Option A. Create an access package. Option B. Configure an authentication strength for the tenant. Option C. Add an authentication context. Option D. Create a Conditional Access policy. Pause the video now if you want time to think about the answer.
The correct answer is B. Configure an authentication strength for the tenant. Before implementing protected actions with phishing-resistant MFA, you must first configure an authentication strength for the tenant to define which MFA methods are considered phishing-resistant. Authentication strengths define the specific credential requirements (such as Windows Hello, FIDO2 keys, or certificate-based authentication) that qualify as phishing-resistant. Once this is configured, you can then reference it in Conditional Access policies to enforce these requirements on protected actions. Now, why are the other options incorrect? Option A is incorrect. Access packages are used for entitlement management and identity governance, not for configuring MFA requirements. Option C is incorrect. Authentication context is used within Conditional Access policies to reference specific authentication strength requirements, but the strength itself must be configured first. Option D is incorrect. Creating a Conditional Access policy comes after configuring the authentication strength, as the policy will reference the strength configuration. Therefore, B, Configure an authentication strength for the tenant, is the correct answer.
Play from 10:02 Question 6. You have a Microsoft Entra tenant. You need to ensure that users are prevented from consenting to high-privilege permission requests for enterprise applications. The solution must ensure that the users can consent to low-risk permission requests. What should you modify first? Here are the options. Option A. Admin consent settings. Option B. Permission classifications. Option C. User consent settings. Option D. App registrations. Pause the video now if you want time to think about the answer.
The correct answer is B. Permission classifications. Permission classifications define which permissions are considered high-risk versus low-risk in Microsoft Entra. By modifying permission classifications, you can designate certain permissions as high-privilege, which combined with user consent settings, allows you to prevent consent to high-privilege requests while permitting consent to low-risk ones. Now, why are the other options incorrect? Option A is incorrect. Admin consent settings control the overall approval workflow but do not classify permission risk levels. Option C is incorrect. User consent settings determine whether users can consent at all, but permission classifications must be set first to distinguish risk levels. Option D is incorrect. App registrations are where permissions are requested, but the risk classification system is managed separately. Therefore, B, Permission classifications, is the correct answer.
Play from 11:52 Question 7. You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1. You need to enable Microsoft Defender for Cloud Apps session control for Site1. Which type of policy should you create first? Here are the options. Option A. access. Option B. app governance. Option C. session. Option D. Conditional Access. Pause the video now if you want time to think about the answer.
The correct answer is D. Conditional Access. To enable session control for SharePoint Online in Defender for Cloud Apps, you must first create a Conditional Access policy. Conditional Access serves as the prerequisite that routes sessions through Defender for Cloud Apps, enabling session control policies to function properly. Now, why are the other options incorrect? Option A is incorrect. Access policies are used for blocking or allowing access based on risk, not for enabling session control. Option B is incorrect. App governance policies manage app permissions and behavior, not session control prerequisites. Option C is incorrect. Session policies are created after the Conditional Access policy prerequisite is in place to enable session control. Therefore, D, Conditional Access, is the correct answer.
Play from 13:31 Question 8. You need to meet the authentication requirements for leaked credentials. What should you do? Here are the options. Option A. Enable password hash synchronization in Azure AD Connect. Option B. Configure Azure AD Password Protection. Option C. Configure an authentication method policy in Azure AD. Option D. Enable federation with PingFederate in Azure AD Connect. Pause the video now if you want time to think about the answer.
The correct answer is A. Enable password hash synchronization in Azure AD Connect. Password hash synchronization in Azure AD Connect enables Azure AD to detect compromised credentials by comparing password hashes against known leaked credential databases. This is the primary mechanism for meeting authentication requirements related to leaked credentials, allowing Azure AD to identify and flag accounts with passwords found in breach databases. Now, why are the other options incorrect? Option B is incorrect. Azure AD Password Protection enforces strong password policies but does not detect already-leaked credentials. Option C is incorrect. Authentication method policies control how users authenticate but do not address leaked credential detection. Option D is incorrect. Federation with PingFederate is an identity provider integration that does not specifically address leaked credential detection. Therefore, A, Enable password hash synchronization in Azure AD Connect, is the correct answer.
Play from 15:27 Question 9. Your company requires that users request access before they can access corporate applications. You register a new enterprise application named MyApp1 in Azure Active Directory (Azure AD) and configure single sign-on (SSO) for MyApp1. Which settings should you configure next for MyApp1? Here are the options. Option A. Self-service. Option B. Provisioning. Option C. Application proxy. Option D. Roles and administrators. Pause the video now if you want time to think about the answer.
The correct answer is A. Self-service. After registering an enterprise application and configuring SSO, the next step to meet the requirement that users request access before using corporate applications is to configure Self-service application access. This enables the Self-service access management feature where users can request access to the application, and designated approvers can review and approve or deny those requests. Now, why are the other options incorrect? Option B is incorrect. Provisioning is used for automated user and group provisioning to the application, not for implementing access request workflows. Option C is incorrect. Application proxy is used for providing secure remote access to on-premises applications, not for managing access requests. Option D is incorrect. Roles and administrators is for assigning admin roles, not for configuring user access request functionality. Therefore, A, Self-service, is the correct answer.
Play from 17:25 Question 10. You have a Microsoft Entra tenant that contains a terms of use (ToU) named Terms1. You create a Conditional Access policy named Policy1 to deploy Terms1. You need to configure Policy1 to require users to accept Terms1. Which settings should you configure for Policy1? Here are the options. Option A. Conditions. Option B. Session. Option C. Grant. Option D. Target resources. Pause the video now if you want time to think about the answer.
The correct answer is C. Grant. To require users to accept Terms of Use in a Conditional Access policy, you must configure the Grant controls. The Grant section is where you specify access requirements such as requiring users to accept terms of use, requiring MFA, or requiring compliant devices. The ToU requirement is applied as a grant control that users must satisfy to gain access. Now, why are the other options incorrect? Option A is incorrect. Conditions define when the policy applies but do not specify what users must do to gain access. Option B is incorrect. Session controls manage how access is used after authentication but do not enforce ToU acceptance. Option D is incorrect. Target resources specify which resources the policy applies to, not what users must do to access them. Therefore, C, Grant, is the correct answer.
Play from 19:14 Question 11. You have an Azure Active Directory (Azure AD) P1 tenant. You need to review the Azure AD sign-in logs to investigate sign-ins that occurred in the past. For how long does Azure AD store events in the sign-in logs? Here are the options. Option A. 14 days. Option B. 30 days. Option C. 90 days. Option D. 365 days. Pause the video now if you want time to think about the answer.
The correct answer is B. 30 days. Azure AD P1 tenants retain sign-in logs for 30 days by default. This is the standard retention period for sign-in events in Azure AD, allowing administrators to investigate recent authentication activities within this timeframe. Now, why are the other options incorrect? Option A is incorrect. 14 days is shorter than the standard retention period for Azure AD P1. Option C is incorrect. 90 days is the retention period for Azure AD P2 Premium tenants, not P1. Option D is incorrect. 365 days exceeds the standard retention period; extended retention requires integration with Log Analytics or other storage solutions. Therefore, B, 30 days, is the correct answer.
Play from 20:57 Question 12. You have a Microsoft 365 subscription. The subscription contains users that use Microsoft Outlook 2016 and Outlook 2013 clients. You need to implement tenant restrictions. The solution must minimize administrative effort. What should you do first? Here are the options. Option A. Configure the Outlook 2013 clients to use modern authentication. Option B. Upgrade the Outlook 2013 clients to Outlook 2016. Option C. From the Exchange admin center, configure Organization Sharing. Option D. Upgrade all the Outlook clients to Outlook 2019. Pause the video now if you want time to think about the answer.
The correct answer is A. Configure the Outlook 2013 clients to use modern authentication. Tenant restrictions require modern authentication to function properly. Configuring Outlook 2013 clients to use modern authentication is the prerequisite step that minimizes administrative effort compared to upgrading all clients. Outlook 2013 can support modern authentication when enabled, avoiding the need for wholesale client upgrades. This allows the legacy clients to work with tenant restrictions policies while maintaining compatibility. Now, why are the other options incorrect? Option B is incorrect. Upgrading all clients is more administratively burdensome than enabling modern authentication. Option C is incorrect. Organization Sharing in Exchange is unrelated to tenant restrictions implementation. Option D is incorrect. Upgrading to Outlook 2019 is unnecessary if modern authentication can be enabled on 2013. Therefore, A, Configure the Outlook 2013 clients to use modern authentication, is the correct answer.
Play from 23:07 Question 13. You have a Microsoft Entra tenant. You need to query risky user activity for the tenant. How long will the logs of risky user activity be retained? Here are the options. Option A. 30 days. Option B. 60 days. Option C. 90 days. Option D. 180 days. Pause the video now if you want time to think about the answer.
The correct answer is C. 90 days. Risky user activity logs in Microsoft Entra are retained for 90 days. This is the standard retention period for risk detection data in Azure AD/Entra, allowing organizations to maintain historical context for security investigations while managing storage costs. Now, why are the other options incorrect? Option A is incorrect. 30 days is too short for the standard retention period of risk data. Option B is incorrect. 60 days is less than the actual 90-day retention period. Option D is incorrect. 180 days exceeds the standard retention period for risky user activity logs. Therefore, C, 90 days, is the correct answer.
Play from 24:34 Question 14. Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs user accounts with a Microsoft 365 E5 subscription. You need to ensure that on-premises account lockout policies are applied to Microsoft Entra sign-ins. What should you configure? Here are the options. Option A. Azure Active Directory Seamless Single Sign-on (Azure AD Seamless SSO). Option B. Microsoft Entra Cloud Sync. Option C. password hash synchronization. Option D. pass-through authentication. Pause the video now if you want time to think about the answer.
The correct answer is D. pass-through authentication. Pass-through authentication (PTA) is the authentication method that enforces on-premises AD DS account lockout policies on Microsoft Entra sign-in attempts. PTA validates passwords directly against on-premises Active Directory, allowing lockout policies to apply to cloud sign-ins. Now, why are the other options incorrect? Option A is incorrect. Seamless SSO provides single sign-on functionality but does not enforce account lockout policies. Option B is incorrect. Cloud Sync is for directory synchronization and does not directly apply lockout policies to sign-ins. Option C is incorrect. Password hash synchronization does not validate against on-premises policies and cannot enforce account lockouts. Therefore, D, pass-through authentication, is the correct answer.
Play from 26:29 Question 15. You have an Azure Active Directory (Azure AD) tenant named contoso.com. All users who run applications registered in Azure AD are subject to conditional access policies. You need to prevent the users from using legacy authentication. What should you include in the conditional access policies to filter out legacy authentication attempts? Here are the options. Option A. a cloud apps or actions condition. Option B. a user risk condition. Option C. a client apps condition. Option D. a sign-in risk condition. Pause the video now if you want time to think about the answer.
The correct answer is C. a client apps condition. The client apps condition in conditional access policies allows filtering based on the authentication protocol used. This condition can specifically target and block legacy authentication methods like SMTP, IMAP, and POP, which do not support modern authentication flows and conditional access. Now, why are the other options incorrect? Option A is incorrect. Cloud apps or actions condition filters by application, not by authentication method type. Option B is incorrect. User risk condition assesses the risk level of a user's account, not the authentication protocol. Option D is incorrect. Sign-in risk condition evaluates the risk of the sign-in event itself, not whether legacy authentication is being used. Therefore, C, a client apps condition, is the correct answer.
Play from 28:15 Question 16. You have a Microsoft Entra tenant that contains three users named User1, User2, and User3. You need to configure just-in-time (JIT) access to admin roles by using Privileged Identity Management (PIM). The solution must meet the following requirements: • Ensure that User1 can use the User Administrator role without approval. • Ensure that User2 can use the User Administrator role once User3 has approved the role request of User2. What should you create first? Here are the options. Option A. role assignments. Option B. administrative units. Option C. security groups. Option D. Conditional Access policies. Pause the video now if you want time to think about the answer.
The correct answer is A. role assignments. Role assignments must be created first in Privileged Identity Management to establish which users are eligible for the User Administrator role and define the activation requirements for each user. User1 requires an assignment with no approval, while User2 requires an assignment configured for approval by User3. These assignments are the foundational objects that PIM uses to enforce access control and approval workflows. Now, why are the other options incorrect? Option B is incorrect. Administrative units are for scoping management permissions but are not required for JIT access or approval workflows in PIM. Option C is incorrect. Security groups could be used for organizing users but are not the mechanism for configuring PIM role activation requirements. Option D is incorrect. Conditional Access policies control authentication factors and sign-in conditions but do not configure PIM role activation approval workflows. Therefore, A, role assignments, is the correct answer.
Play from 30:27 Question 17. You create a Log Analytics workspace. You need to implement the technical requirements for auditing. What should you configure in Azure AD? Here are the options. Option A. Company branding. Option B. Diagnostics settings. Option C. External Identities. Option D. App registrations. Pause the video now if you want time to think about the answer.
The correct answer is B. Diagnostics settings. Diagnostics settings in Azure AD must be configured to send audit logs and sign-in logs to a Log Analytics workspace. This enables centralized monitoring and auditing by routing Azure AD activity data to the workspace where it can be queried, analyzed, and retained according to compliance requirements. Now, why are the other options incorrect? Option A is incorrect. Company branding configures the visual appearance of Azure AD sign-in pages and does not relate to audit logging. Option C is incorrect. External Identities settings manage guest user access and B2B collaboration, not audit logging. Option D is incorrect. App registrations define applications in Azure AD but do not configure where audit data is sent. Therefore, B, Diagnostics settings, is the correct answer.
Play from 32:03 Question 18. You have a Microsoft 365 subscription. You need to create a Conditional Access policy that will use a Global Secure Access security profile. The solution must ensure that users are prevented from accessing websites that include the word gambling in the URL. What should you do first? Here are the options. Option A. Create a web content filtering policy. Option B. Create a named location. Option C. Configure the Adaptive Access settings. Option D. Create a network security group (NSG). Pause the video now if you want time to think about the answer.
The correct answer is A. Create a web content filtering policy. A web content filtering policy must be created first to define which categories of websites (such as those containing 'gambling' in the URL) should be blocked. This policy is then referenced within the Global Secure Access security profile, which can subsequently be applied via Conditional Access policies. Web content filtering policies are the foundational configuration for URL-based blocking in Global Secure Access. Now, why are the other options incorrect? Option B is incorrect. Named locations are used for geographic or IP-based access conditions in Conditional Access, not for URL content filtering. Option C is incorrect. Adaptive Access settings configure dynamic risk-based policies but are not the primary mechanism for URL filtering. Option D is incorrect. Network security groups are Azure networking controls and are not part of the Global Secure Access web filtering configuration. Therefore, A, Create a web content filtering policy, is the correct answer.
Play from 34:03 Question 19. You have a Microsoft 365 E5 subscription. You purchase the app governance add-on license. You need to enable app governance integration. Which portal should you use? Here are the options. Option A. the Microsoft Defender for Cloud Apps portal. Option B. the Microsoft 365 admin center. Option C. Microsoft 365 Defender. Option D. the Azure Active Directory admin center. Option E. the Microsoft Purview compliance portal. Pause the video now if you want time to think about the answer.
The correct answer is C. Microsoft 365 Defender. App governance is a feature integrated into Microsoft 365 Defender. The Microsoft 365 Defender portal is where you enable and configure app governance integration when you have the app governance add-on license, as it provides centralized governance and compliance monitoring for applications across the Microsoft ecosystem. Now, why are the other options incorrect? Option A is incorrect. While Defender for Cloud Apps is related, app governance is specifically configured through Microsoft 365 Defender. Option B is incorrect. The Microsoft 365 admin center is for general tenant administration but not the portal for app governance configuration. Option D is incorrect. The Azure Active Directory admin center focuses on identity management, not app governance features. Option E is incorrect. Microsoft Purview compliance portal handles data governance and compliance; app governance is managed in Microsoft 365 Defender. Therefore, C, Microsoft 365 Defender, is the correct answer.
Play from 36:05 Question 20. You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Cloud Apps. You plan to increase app security for the subscription. You need to identify which apps do NOT require user authentication. What should you do in the Microsoft 365 Defender portal? Here are the options. Option A. Review the cloud app catalog. Option B. Create an OAuth policy and review alerts. Option C. Create a snapshot Cloud Discovery report. Option D. Create a discovered app query. Pause the video now if you want time to think about the answer.
The correct answer is A. Review the cloud app catalog. The cloud app catalog in Microsoft 365 Defender portal provides detailed information about discovered applications, including their authentication requirements. By reviewing the cloud app catalog, you can identify which applications do not require user authentication, as this information is documented in the app properties. The catalog displays security scores and authentication details for each discovered app, enabling you to assess authentication requirements across your environment. Now, why are the other options incorrect? Option B is incorrect. Creating an OAuth policy reviews OAuth-related alerts but does not specifically identify apps that don't require user authentication. Option C is incorrect. A snapshot Cloud Discovery report shows app usage statistics but not authentication requirement details. Option D is incorrect. A discovered app query is used for investigating specific apps but is not the primary method for identifying apps without authentication requirements. Therefore, A, Review the cloud app catalog, is the correct answer.
Play from 38:14 Question 21. Your company has an Azure AD tenant that contains a user named User1. The company has two departments named marketing and finance. You need to grant permissions to User1 to manage only the users in the marketing department. The solution must ensure that User1 does NOT have permissions to manage the users in the finance department. What should you create first? Here are the options. Option A. a management group. Option B. an administrative unit. Option C. a resource group. Option D. a Microsoft 365 group. Pause the video now if you want time to think about the answer.
The correct answer is B. an administrative unit. Administrative units in Azure AD allow you to delegate administrative permissions to manage users within a specific organizational unit without granting broader tenant-wide permissions. This is the primary feature designed to scope administrative access to specific departments or groups of users. Now, why are the other options incorrect? Option A is incorrect. Management groups are used for organizing Azure subscriptions and resources, not for scoping Azure AD user management permissions. Option C is incorrect. Resource groups organize Azure resources and have no relevance to Azure AD user management or departmental access control. Option D is incorrect. Microsoft 365 groups are for collaboration and communication, not for delegating administrative permissions to manage specific user populations. Therefore, B, an administrative unit, is the correct answer.
Play from 40:12 Question 22. You have an Azure subscription that contains a registered app named App1. You need to review the sign-in activity for App1. The solution must meet the following requirements: • Identify the number of failed sign-ins. • Identify the success rate of sign-ins. • Minimize administrative effort. What should you use? Here are the options. Option A. Sign-in logs. Option B. Access reviews. Option C. Audit logs. Option D. Usage & insights. Pause the video now if you want time to think about the answer.
The correct answer is D. Usage & insights. Usage & insights provides comprehensive analytics for application sign-in activity including success rates, failed sign-in counts, and trend analysis. This dashboard is specifically designed to review sign-in metrics for applications and minimizes administrative effort by providing pre-built analytics. Now, why are the other options incorrect? Option A is incorrect. Sign-in logs show individual events but require manual analysis to calculate success rates and aggregate failure counts. Option B is incorrect. Access reviews manage user access permissions, not sign-in activity analysis. Option C is incorrect. Audit logs track administrative changes and consent events, not application sign-in success/failure metrics. Therefore, D, Usage & insights, is the correct answer.
Play from 41:54 Question 23. Your company purchases a new Microsoft 365 E5 subscription and an app named App1. You need to create a Microsoft Defender for Cloud Apps access policy for App1. What should you do you first? Here are the options. Option A. Configure a Conditional Access policy to use app-enforced restrictions. Option B. Configure a Token configuration for App1. Option C. Add an API permission for App1. Option D. Configure a Conditional Access policy to use Conditional Access App Control. Pause the video now if you want time to think about the answer.
The correct answer is D. Configure a Conditional Access policy to use Conditional Access App Control. Before creating a Microsoft Defender for Cloud Apps access policy, you must first configure a Conditional Access policy with Conditional Access App Control enabled. This prerequisite integration allows Defender for Cloud Apps to enforce access policies by intercepting sessions and applying the configured controls. Now, why are the other options incorrect? Option A is incorrect. While Conditional Access policies are needed, app-enforced restrictions are not the specific requirement; App Control is needed. Option B is incorrect. Token configuration is not a prerequisite for creating Cloud Apps access policies. Option C is incorrect. Adding API permissions is not required before creating a Cloud Apps access policy. Therefore, D, Configure a Conditional Access policy to use Conditional Access App Control, is the correct answer.
Play from 43:49 Question 24. You have 2,500 users who are assigned Microsoft 365 E3 licenses. The licenses are assigned to individual users. You assign Microsoft 365 E5 licenses to a group that includes all users. You need to remove the Microsoft 365 E3 licenses from the users by using the least amount of administrative effort. What should you use? Here are the options. Option A. the Update-MgGroup cmdlet. Option B. the Set-WindowsProductKey cmdlet. Option C. the Set-MgUserLicense cmdlet. Option D. the Licenses blade in the Microsoft Entra admin center. Pause the video now if you want time to think about the answer.
The correct answer is D. the Licenses blade in the Microsoft Entra admin center. The Licenses blade in the Microsoft Entra admin center allows bulk removal of licenses based on group assignments. Since E5 licenses are assigned to a group containing all users, the system can automatically detect and remove the conflicting E3 licenses with minimal administrative effort. This is the least effort approach compared to scripting or cmdlet-based approaches for 2,500 users. Now, why are the other options incorrect? Option A is incorrect. Update-MgGroup cmdlet is for modifying group properties, not managing user licenses. Option B is incorrect. Set-WindowsProductKey cmdlet is for configuring Windows product keys, not Microsoft 365 licenses. Option C is incorrect. Set-MgUserLicense cmdlet would require scripting and processing 2,500 individual users, representing more effort than the portal solution. Therefore, D, the Licenses blade in the Microsoft Entra admin center, is the correct answer.
Play from 45:59 Question 25. You have an Azure Active Directory (Azure AD) Azure AD tenant. You need to bulk create 25 new user accounts by uploading a template file. Which properties are required in the template file? Here are the options. Option A. displayName, identityIssuer, usageLocation, and userType. Option B. accountEnabled, givenName, surname, and userPrincipalName. Option C. accountEnabled, displayName, userPrincipalName, and passwordProfile. Option D. accountEnabled, passwordProfile, usageLocation, and userPrincipalName. Pause the video now if you want time to think about the answer.
The correct answer is C. accountEnabled, displayName, userPrincipalName, and passwordProfile. When bulk creating users in Azure AD via template upload, the required properties are accountEnabled, displayName, userPrincipalName, and passwordProfile. These properties are mandatory to create a functional user account that can sign in and authenticate to Azure AD services. The displayName identifies the user, userPrincipalName serves as the unique identifier, accountEnabled sets the account status, and passwordProfile defines the password. Now, why are the other options incorrect? Option A is incorrect. identityIssuer is not a standard required property for bulk user creation; usageLocation is optional. Option B is incorrect. givenName and surname are optional; the required set must include displayName and passwordProfile. Option D is incorrect. usageLocation is optional for licensing but not required for basic user creation; this set lacks displayName which is required. Therefore, C, accountEnabled, displayName, userPrincipalName, and passwordProfile, is the correct answer.
Play from 48:08 Question 26. You have a Microsoft 365 tenant. In Microsoft Entra ID, you configure the terms of use. You need to ensure that only users who accept the terms of use can access the resources in the tenant. Other users must be denied access. What should you configure? Here are the options. Option A. Terms and conditions in Microsoft Intune. Option B. an access policy in Microsoft Defender for Cloud Apps. Option C. a conditional access policy in Microsoft Entra ID. Option D. a compliance policy in Microsoft Intune. Pause the video now if you want time to think about the answer.
The correct answer is C. a conditional access policy in Microsoft Entra ID. To enforce acceptance of terms of use and conditionally grant or deny access based on acceptance, you must configure a Conditional Access policy in Microsoft Entra ID. Conditional Access allows you to require users to accept terms of use before accessing tenant resources. Now, why are the other options incorrect? Option A is incorrect. Terms and conditions in Intune are for device management compliance, not for controlling access to tenant resources based on terms acceptance. Option B is incorrect. Defender for Cloud Apps access policies control access to cloud applications, not core tenant resource access based on terms of use. Option D is incorrect. Compliance policies in Intune enforce device compliance requirements but do not enforce terms of use acceptance for resource access. Therefore, C, a conditional access policy in Microsoft Entra ID, is the correct answer.
Play from 50:09 Question 27. You have a Microsoft 365 subscription that contains the following: • An Azure Active Directory (Azure AD) tenant that has an Azure Active Directory Premium P2 license • A Microsoft SharePoint Online site named Site1 • A Microsoft Teams team named Team1 You need to create an entitlement management workflow to manage Site1 and Team1. What should you do first? Here are the options. Option A. Configure an app registration. Option B. Create an Administrative unit. Option C. Create an access package. Option D. Create a catalog. Pause the video now if you want time to think about the answer.
The correct answer is D. Create a catalog. Before creating access packages in entitlement management, you must first create a catalog. A catalog is a container for access packages and is a prerequisite for managing resources like SharePoint sites and Teams teams. The catalog organizes and controls which resources can be included in access packages. Now, why are the other options incorrect? Option A is incorrect. App registration is used for application authentication, not for entitlement management workflows. Option B is incorrect. Administrative units are for delegating management scope, not for setting up entitlement management. Option C is incorrect. Access packages are created after a catalog exists; you cannot create them without a catalog first. Therefore, D, Create a catalog, is the correct answer.
Play from 52:01 Question 28. You have an Azure subscription. You need to use Microsoft Entra Permissions Management to automatically monitor permissions and create and implement right-size roles. The solution must follow the principle of least privilege. Which role should you assign to the service principal of Permissions Management? Here are the options. Option A. User Access Administrator. Option B. Contributor. Option C. Reader. Option D. Owner. Pause the video now if you want time to think about the answer.
The correct answer is A. User Access Administrator. The User Access Administrator role should be assigned to the Permissions Management service principal. This role allows the service principal to manage role assignments and assess permissions across resources while following the principle of least privilege. It grants the necessary permissions to monitor and audit privilege assignments without providing full administrative control like Owner or Contributor roles would. Now, why are the other options incorrect? Option B is incorrect. Contributor role grants too many permissions beyond what is needed for monitoring and right-sizing roles. Option C is incorrect. Reader role is insufficient as it only allows viewing permissions, not implementing the right-size role changes. Option D is incorrect. Owner role grants excessive permissions far beyond the principle of least privilege requirements for this function. Therefore, A, User Access Administrator, is the correct answer.
Play from 53:49 Question 29. You have an Azure AD tenant. You discover that a large number of new apps were added to the tenant. You need to implement an approval process for new enterprise applications. What should you do? Here are the options. Option A. From the Microsoft Defender for Cloud Apps portal, create a Cloud Discovery anomaly detection policy. Option B. From the Microsoft Entra admin center, configure the Admin consent settings. Option C. From the Microsoft Defender for Cloud Apps portal, configure an app connector. Option D. From the Microsoft Entra admin center, configure an access review. Pause the video now if you want time to think about the answer.
The correct answer is B. From the Microsoft Entra admin center, configure the Admin consent settings. Configuring Admin consent settings in the Microsoft Entra admin center allows you to implement an approval process for enterprise applications. This setting controls whether users can consent to apps and whether admin approval is required, directly implementing the approval workflow needed for new application deployments. Now, why are the other options incorrect? Option A is incorrect. Cloud Discovery anomaly detection policy is used to detect suspicious application behaviors, not to implement approval workflows for new apps. Option C is incorrect. App connectors are used to integrate specific SaaS applications with Microsoft Defender for Cloud Apps, not to control application approval processes. Option D is incorrect. Access reviews are used to periodically review user access assignments, not to implement approval processes for new application registrations. Therefore, B, From the Microsoft Entra admin center, configure the Admin consent settings, is the correct answer.
Play from 55:58 Question 30. You have an Azure Active Directory (Azure AD) tenant named contoso.com. You need to ensure that Azure AD External Identities pricing is based on monthly active users (MAU). What should you configure? Here are the options. Option A. a user flow. Option B. the terms of use. Option C. a linked subscription. Option D. an access review. Pause the video now if you want time to think about the answer.
The correct answer is C. a linked subscription. To ensure External Identities pricing is based on monthly active users (MAU), you must link an Azure subscription to your Azure AD tenant. This linked subscription enables MAU-based billing, which charges based on the number of unique users authenticating in a calendar month. Without a linked subscription, External Identities may use different billing models or be unavailable. Now, why are the other options incorrect? Option A is incorrect. User flows define authentication behavior but do not configure billing models. Option B is incorrect. Terms of use are for compliance and acceptance tracking, not billing configuration. Option D is incorrect. Access reviews are for governance and compliance, not billing setup. Therefore, C, a linked subscription, is the correct answer.
Play from 57:39 Question 31. You need to configure the MFA settings for users who connect from the Boston office. The solution must meet the authentication requirements and the access requirements. What should you include in the configuration? Here are the options. Option A. named locations that have a private IP address range. Option B. named locations that have a public IP address range. Option C. trusted IPs that have a public IP address range. Option D. trusted IPs that have a private IP address range. Pause the video now if you want time to think about the answer.
The correct answer is B. named locations that have a public IP address range. Named locations with public IP address ranges are used to define geographic or network-based locations for Conditional Access policies. The Boston office would be configured with its public-facing IP range so that MFA policies can be applied based on connection location, allowing conditional access rules to recognize when users connect from the office versus other locations. Now, why are the other options incorrect? Option A is incorrect. Private IP address ranges cannot be reliably used for named locations in cloud-based Conditional Access because private IPs are not routable on the internet. Option C is incorrect. Trusted IPs are a legacy feature primarily for on-premises MFA server and are not the modern approach for location-based Conditional Access. Option D is incorrect. Trusted IPs with private IP ranges would not work for cloud-based conditional access policies. Therefore, B, named locations that have a public IP address range, is the correct answer.
Play from 59:40 Question 32. You have an Azure subscription named Sub1 that contains a virtual machine named VM1. You need to enable Microsoft Entra login for VM1 and configure VM1 to access the resources in Sub1. Which type of identity should you assign to VM1? Here are the options. Option A. Microsoft Entra user account. Option B. user-assigned managed identity. Option C. Azure Automation account. Option D. system-assigned managed identity. Pause the video now if you want time to think about the answer.
The correct answer is D. system-assigned managed identity. A system-assigned managed identity is the correct choice for enabling Microsoft Entra login on a VM and accessing Azure resources within the same subscription. The system-assigned identity is created and managed by Azure automatically, and it can be granted RBAC permissions to access Sub1 resources. This is simpler than user-assigned managed identity for this scenario. Now, why are the other options incorrect? Option A is incorrect. A Microsoft Entra user account is not an identity type for VMs; it's for people. Option B is incorrect. While user-assigned managed identity could work, system-assigned is more appropriate and simpler for a single VM in one subscription. Option C is incorrect. Azure Automation account is used for runbook execution and automation workflows, not for VM authentication. Therefore, D, system-assigned managed identity, is the correct answer.
Play from 1:01:34 Question 33. You have an Azure AD tenant. You need to ensure that only users from specific external domains can be invited as guests to the tenant. Which settings should you configure? Here are the options. Option A. External collaboration settings. Option B. All identity providers. Option C. Cross-tenant access settings. Option D. Linked subscriptions. Pause the video now if you want time to think about the answer.
The correct answer is A. External collaboration settings. External collaboration settings is the correct configuration location for controlling which external domains can be invited as guests to an Azure AD tenant. This setting allows administrators to create allow or deny lists of external domains, restricting guest invitations to only approved organizations. Now, why are the other options incorrect? Option B is incorrect. All identity providers configures authentication methods, not guest domain restrictions. Option C is incorrect. Cross-tenant access settings manages access policies between different Azure AD tenants, not guest domain restrictions. Option D is incorrect. Linked subscriptions is not a valid Azure AD configuration setting for guest access control. Therefore, A, External collaboration settings, is the correct answer.
Play from 1:03:11 Question 34. You have an Azure subscription that contains a user named User1 and an Azure key vault named Vault1. You need to ensure that User1 can read the metadata of certificates, keys, and secrets stored in Vault1. The solution must follow the principle of least privilege. Which role should you assign to User1? Here are the options. Option A. Key Vault Secrets User. Option B. Key Vault Crypto User. Option C. Key Vault Reader. Option D. Key Vault Crypto Officer. Pause the video now if you want time to think about the answer.
The correct answer is C. Key Vault Reader. Key Vault Reader is the least privileged role that allows reading metadata of certificates, keys, and secrets without granting any management or cryptographic operation capabilities. It aligns perfectly with the principle of least privilege for read-only metadata access. Now, why are the other options incorrect? Option A is incorrect. Key Vault Secrets User grants permission to get and use secrets but is broader than needed for metadata-only read access. Option B is incorrect. Key Vault Crypto User grants cryptographic operation permissions which exceed the requirement to only read metadata. Option D is incorrect. Key Vault Crypto Officer is an administrative role with far too many permissions for the stated requirement. Therefore, C, Key Vault Reader, is the correct answer.
Play from 1:04:56 Question 35. You have an Azure subscription that contains a storage account named storage1 and a web app named WebApp1. WebApp1 uses a systemassigned managed identity. You need to ensure that WebApp1 can read and write files to storage1 by using the system-assigned managed identity. What should you configure for storage1 in the Azure portal? Here are the options. Option A. data protection. Option B. a shared access signature (SAS). Option C. the Access control (IAM) settings. Option D. the File share settings. Option E. access keys. Pause the video now if you want time to think about the answer.
The correct answer is C. the Access control (IAM) settings. The Access control (IAM) settings in Azure portal is where you assign roles to the system-assigned managed identity of WebApp1, allowing it to read and write files to storage1. Through IAM configuration, you grant the appropriate role (such as Storage Blob Data Contributor) to the managed identity, enabling secure access to the storage account without storing credentials. This is the standard Azure method for configuring identity-based access to storage resources. Now, why are the other options incorrect? Option A is incorrect. Data protection settings configure encryption and retention, not identity-based access control. Option B is incorrect. Shared access signatures (SAS) provide temporary token-based access, not managed identity-based access. Option D is incorrect. File share settings manage file-level configurations but not identity permissions. Option E is incorrect. Access keys are storage account credentials and should be avoided when managed identities are available. Therefore, C, the Access control (IAM) settings, is the correct answer.
Play from 1:07:08 Question 36. You have a Microsoft 365 E5 subscription that contains a user named User1. User is eligible for the Application administrator role. User1 needs to configure a new connector group for an application proxy. What should you use to activate the role for User1? Here are the options. Option A. the Microsoft Defender for Cloud Apps portal. Option B. the Microsoft 365 admin center. Option C. the Azure Active Directory admin center. Option D. the Microsoft 365 Defender portal. Pause the video now if you want time to think about the answer.
The correct answer is C. the Azure Active Directory admin center. The Azure Active Directory admin center is where you activate eligible Azure AD roles through Privileged Identity Management (PIM). This is where User1 would activate the Application Administrator role to configure the application proxy connector group. Now, why are the other options incorrect? Option A is incorrect. Microsoft Defender for Cloud Apps portal is for cloud application security, not PIM role activation. Option B is incorrect. The Microsoft 365 admin center manages Microsoft 365 services but not Azure AD role activation. Option D is incorrect. Microsoft 365 Defender portal focuses on security threats and incidents, not role activation. Therefore, C, the Azure Active Directory admin center, is the correct answer.
Play from 1:08:54 Question 37. You have an Active Directory domain that syncs to an Azure Active Directory (Azure AD) tenant. The on-premises network contains a VPN server that authenticates to the on-premises Active Directory domain. The VPN server does NOT support Azure MultiFactor Authentication (MFA). You need to recommend a solution to provide Azure MFA for VPN connections. What should you include in the recommendation? Here are the options. Option A. Azure AD Application Proxy. Option B. an Azure AD Password Protection proxy. Option C. Network Policy Server (NPS). Option D. a pass-through authentication proxy. Pause the video now if you want time to think about the answer.
The correct answer is C. Network Policy Server (NPS). Network Policy Server (NPS) acts as a RADIUS server that can integrate Azure MFA with legacy VPN systems. The NPS extension allows the on-premises VPN server to perform authentication against Azure AD while applying Azure MFA policies, enabling MFA for VPN connections without requiring the VPN server to directly support Azure MFA. Now, why are the other options incorrect? Option A is incorrect. Azure AD Application Proxy is for publishing on-premises web applications, not for VPN authentication. Option B is incorrect. Azure AD Password Protection proxy protects against password spray attacks but does not provide MFA for VPN. Option D is incorrect. Pass-through authentication proxy handles authentication validation but is not designed for VPN MFA integration. Therefore, C, Network Policy Server (NPS), is the correct answer.
Play from 1:11:04 Question 38. You have accounts for the following cloud platforms: • Azure • Alibaba Cloud • Amazon Web Services (AWS) • Google Cloud Platform (GCP) You configure an Azure subscription to use Microsoft Entra Permissions Management to manage the permissions in Azure only. Which additional cloud platforms can be managed by using Permissions Management? Here are the options. Option A. AWS only. Option B. Alibaba Cloud and AWS only. Option C. Alibaba Cloud and GCP only. Option D. AWS and GCP only. Option E. Alibaba Cloud, AWS, and GCP. Pause the video now if you want time to think about the answer.
The correct answer is D. AWS and GCP only. Microsoft Entra Permissions Management supports Azure, AWS, and GCP for managing permissions and identifying privilege risks. It does not currently support Alibaba Cloud. Since the subscription already uses Permissions Management for Azure, the additional cloud platforms that can be managed are AWS and GCP. Now, why are the other options incorrect? Option A is incorrect. This excludes GCP, which is supported by Permissions Management. Option B is incorrect. This includes Alibaba Cloud, which is not supported by Permissions Management. Option C is incorrect. This includes Alibaba Cloud which is unsupported and excludes AWS which is supported. Option E is incorrect. This includes Alibaba Cloud, which is not supported by Permissions Management. Therefore, D, AWS and GCP only, is the correct answer.
Play from 1:13:11 Question 39. You have a Microsoft Entra tenant that contains a user named User1 and uses Privileged Identity Management (PIM). At 08:00 on Tuesday, User1 requests the activation of a Microsoft Entra role that requires approval. You need to identify when the request will be deleted automatically if an approver has NOT responded. What should you identify? Here are the options. Option A. 08:00 on Sunday. Option B. 08:00 on Thursday. Option C. 08:00 on Wednesday. Option D. 20:00 on Tuesday. Pause the video now if you want time to think about the answer.
The correct answer is C. 08:00 on Wednesday. In Privileged Identity Management, activation requests that require approval are automatically deleted after 24 hours if no approver has responded. Since User1 submitted the request at 08:00 on Tuesday, it will be deleted at 08:00 on Wednesday, which is exactly 24 hours later. This is the default PIM request retention policy. Now, why are the other options incorrect? Option A is incorrect. 08:00 on Sunday is 5 days later and exceeds the 24-hour request retention window. Option B is incorrect. 08:00 on Thursday is 2 days later and exceeds the 24-hour request retention window. Option D is incorrect. 20:00 on Tuesday is only 12 hours later and does not account for the full 24-hour retention period. Therefore, C, 08:00 on Wednesday, is the correct answer.
Play from 1:15:05 Question 40. You have an Azure AD tenant and a .NET web app named App1. You need to register App1 for Azure AD authentication. What should you configure for App1? Here are the options. Option A. the executable name. Option B. the bundle ID. Option C. the package name. Option D. the redirect URI. Pause the video now if you want time to think about the answer.
The correct answer is D. the redirect URI. When registering a .NET web app with Azure AD, the redirect URI is the critical configuration parameter. It specifies where Azure AD should send the user after authentication, allowing the app to receive and process the authentication response. The redirect URI must be registered before the app can authenticate users. Now, why are the other options incorrect? Option A is incorrect. Executable name is relevant for desktop applications, not web apps. Option B is incorrect. Bundle ID is specific to iOS applications. Option C is incorrect. Package name is specific to Android applications. Therefore, D, the redirect URI, is the correct answer.
Play from 1:16:35 Question 41. You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains a registered app named App1. You have a partner organization that has a Microsoft Entra tenant. The tenant contains a registered app named App2. You need to ensure that App1 can access App2. Which two types of credentials can App1 use? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. certificate. Option B. managed identity. Option C. secret. Option D. user account. Option E. one-time password. Pause the video now if you want time to think about the answer.
The correct answers are A. certificate, and C. secret. App1 can use both certificates and secrets as credentials to authenticate with App2. These are the two standard credential types for app-to-app authentication in Microsoft Entra. Certificates provide a more secure option using public key infrastructure, while client secrets are simpler string-based credentials. Both methods enable App1 to obtain access tokens and securely communicate with App2 without user interaction. Now, why are the other options incorrect? Option B is incorrect. Managed identities are used within Azure for resource authentication, not for cross-tenant app-to-app scenarios between partner organizations. Option D is incorrect. User accounts are for user authentication, not app-to-app authentication between applications. Option E is incorrect. One-time passwords are a user authentication mechanism, not a credential type for application authentication. Therefore, A and C are the correct answers.
Play from 1:18:39 Question 42. Your company has a Microsoft Entra tenant that contains a user named User1. The company has two departments named marketing and finance. You need to grant permissions to User1 to manage only the users in the marketing department. What should you create first? Here are the options. Option A. a Microsoft 365 group. Option B. an administrative unit. Option C. a management group. Option D. a resource group. Pause the video now if you want time to think about the answer.
The correct answer is B. an administrative unit. Administrative units in Microsoft Entra allow you to delegate administrative roles with a scoped boundary, such as a specific department. By creating an administrative unit for the marketing department and assigning User1 an administrative role scoped to that unit, you can grant User1 permissions to manage only users in the marketing department. This provides the necessary scope limitation. Now, why are the other options incorrect? Option A is incorrect. Microsoft 365 groups are for collaboration and resource sharing, not for scoping administrative permissions. Option C is incorrect. Management groups are Azure constructs for organizing subscriptions, not for scoping Entra ID administrative roles. Option D is incorrect. Resource groups are Azure constructs for organizing cloud resources, not for scoping Entra ID administrative permissions. Therefore, B, an administrative unit, is the correct answer.
Play from 1:20:30 Question 43. You need to track application access assignments by using Identity Governance. The solution must meet the delegation requirements. What should you do first? Here are the options. Option A. Modify the User consent settings for the enterprise applications. Option B. Create a catalog. Option C. Create a program. Option D. Modify the Admin consent requests settings for the enterprise applications. Pause the video now if you want time to think about the answer.
The correct answer is B. Create a catalog. In Azure AD Identity Governance, you must first create a catalog to organize and manage access packages and track application access assignments. A catalog is the container for access packages and serves as the foundation for delegation of access governance responsibilities. Once a catalog exists, programs and other governance structures can be built within it to manage delegated access assignments. Now, why are the other options incorrect? Option A is incorrect. Modifying user consent settings does not establish the governance framework needed to track delegated access assignments. Option C is incorrect. Creating a program requires a catalog to exist first; the catalog is the prerequisite step. Option D is incorrect. Modifying admin consent request settings does not directly track application access assignments or establish delegation governance. Therefore, B, Create a catalog, is the correct answer.
Play from 1:22:21 Question 44. You need to resolve the issue of the guest user invitations. What should you do for the Azure AD tenant? Here are the options. Option A. Configure the Continuous access evaluation settings. Option B. Configure a Conditional Access policy. Option C. Configure the Access reviews settings. Option D. Modify the External collaboration settings. Pause the video now if you want time to think about the answer.
The correct answer is D. Modify the External collaboration settings. Modifying the External collaboration settings in Azure AD allows control over guest user invitations, including who can invite guests, which external domains are allowed or blocked, and invitation restrictions. These settings directly govern guest invitation behavior and resolve issues related to how external users are invited to the tenant. Now, why are the other options incorrect? Option A is incorrect. Continuous access evaluation settings manage real-time session validation but do not control guest invitation policies. Option B is incorrect. Conditional Access policies enforce authentication and access controls but do not govern the guest invitation process itself. Option C is incorrect. Access reviews settings manage periodic access reviews but do not configure guest invitation policies or restrictions. Therefore, D, Modify the External collaboration settings, is the correct answer.
Play from 1:24:08 Question 45. You have an Azure Active Directory (Azure AD) tenant named contoso.com that has Azure AD Identity Protection enabled. You need to implement a sign-in risk remediation policy without blocking user access. What should you do first? Here are the options. Option A. Configure access reviews in Azure AD. Option B. Enforce Azure AD Password Protection. Option C. Configure self-service password reset (SSPR) for all users. Option D. Implement multi-factor authentication (MFA) for all users. Pause the video now if you want time to think about the answer.
The correct answer is D. Implement multi-factor authentication (MFA) for all users. To implement a sign-in risk remediation policy without blocking users, you must first implement MFA for all users. MFA allows Identity Protection to enforce step-up authentication when risky sign-in behavior is detected, remedying the risk without outright blocking access. This enables a remediation workflow where users can verify their identity through MFA rather than being denied access, which aligns with the 'without blocking user access' requirement. Now, why are the other options incorrect? Option A is incorrect. Access reviews are for periodic recertification of user access to resources, not for sign-in risk remediation. Option B is incorrect. Azure AD Password Protection helps prevent weak password usage but does not directly enable sign-in risk remediation without blocking. Option C is incorrect. Self-service password reset is useful for account recovery but does not serve as a primary mechanism for sign-in risk remediation in Identity Protection policies. Therefore, D, Implement multi-factor authentication (MFA) for all users, is the correct answer.
Play from 1:26:21 Question 46. Your company purchases a Microsoft 365 E5 subscription. A user named User1 is assigned the Security Administrator role. You need to ensure that User1 can create Microsoft Defender for Cloud Apps session policies. What should you do first? Here are the options. Option A. Create a Conditional Access policy and select Require app protection policy. Option B. Create a Conditional Access policy and select Use Conditional Access App Control. Option C. Assign the Cloud Application Administrator role to User1. Option D. Assign the Cloud App Security Administrator role to User1. Pause the video now if you want time to think about the answer.
The correct answer is D. Assign the Cloud App Security Administrator role to User1. To allow User1 to create Microsoft Defender for Cloud Apps session policies, the Cloud App Security Administrator role must be assigned. While the Security Administrator role provides broad security management capabilities, the Cloud App Security Administrator role is the specific role designed to grant access to Defender for Cloud Apps features, including session policy creation. This role provides the necessary permissions without requiring Conditional Access policy configuration as a prerequisite. Now, why are the other options incorrect? Option A is incorrect. Conditional Access with app protection policy requirement does not grant User1 permissions to create Defender for Cloud Apps session policies. Option B is incorrect. While Conditional Access App Control is related to session policies, assigning the proper role is the first necessary action. Option C is incorrect. The Cloud Application Administrator role manages cloud applications but does not specifically grant Defender for Cloud Apps session policy creation permissions. Therefore, D, Assign the Cloud App Security Administrator role to User1, is the correct answer.
Play from 1:28:37 Question 47. You have an Azure Active Directory (Azure AD) tenant that contains cloud-based enterprise apps. You need to group related apps into categories in the My Apps portal. What should you create? Here are the options. Option A. tags. Option B. collections. Option C. naming policies. Option D. dynamic groups. Pause the video now if you want time to think about the answer.
The correct answer is B. collections. Collections in the My Apps portal allow administrators to group related applications into organized categories that users can access. This is the specific feature designed for grouping apps by business function or department. Tags are metadata labels but don't create portal groupings, naming policies control user naming conventions, and dynamic groups are for user membership, not app organization. Now, why are the other options incorrect? Option A is incorrect. Tags are metadata but don't organize apps into portal-visible categories. Option C is incorrect. Naming policies control how users or objects are named, not app grouping. Option D is incorrect. Dynamic groups organize users based on attributes, not apps in the portal. Therefore, B, collections, is the correct answer.
Play from 1:30:12 Question 48. You have an on-premises app named App1. You have a Microsoft Entra tenant. You plan to publish App1 by using Microsoft Entra Private Access. You need to enable the Private access profile. Which blade should you use in the Microsoft Entra admin center? Here are the options. Option A. Remote networks. Option B. Traffic forwarding. Option C. Security profiles. Option D. Connectors. Pause the video now if you want time to think about the answer.
The correct answer is B. Traffic forwarding. The Traffic forwarding blade in the Microsoft Entra admin center is used to enable the Private access profile. This blade contains the configuration settings necessary to set up traffic forwarding rules and enable private access functionality for on-premises applications published through Microsoft Entra Private Access. Now, why are the other options incorrect? Option A is incorrect. Remote networks is used for configuring remote network connections, not for enabling the Private access profile. Option C is incorrect. Security profiles is not the correct blade for Private access profile configuration. Option D is incorrect. Connectors is used for managing connectors but not specifically for enabling the Private access profile itself. Therefore, B, Traffic forwarding, is the correct answer.
Play from 1:31:52 Question 49. You need to allocate licenses to the new users from ADatum. The solution must meet the technical requirements. Which type of object should you create? Here are the options. Option A. a Dynamic User security group. Option B. a distribution group. Option C. an OU. Option D. an administrative unit. Pause the video now if you want time to think about the answer.
The correct answer is A. a Dynamic User security group. A Dynamic User security group allows you to automatically assign licenses to users based on membership criteria (such as department or other attributes). When new ADatum users are added with matching attributes, they are automatically added to the dynamic group and receive licenses through group-based licensing, minimizing manual administration of license allocation. Now, why are the other options incorrect? Option B is incorrect. Distribution groups are for email and collaboration but do not support group-based licensing. Option C is incorrect. An organizational unit (OU) is an on-premises Active Directory object and is not used for cloud license allocation in Microsoft Entra. Option D is incorrect. Administrative units are used to scope administrative roles and permissions, not for license allocation. Therefore, A, a Dynamic User security group, is the correct answer.
Play from 1:33:32 Question 50. You have an Azure AD tenant. You configure User consent settings to allow users to provide consent to apps from verified publishers. You need to ensure that the users can only provide consent to apps that require low impact permissions. What should you do? Here are the options. Option A. Create an enterprise application collection. Option B. Create an access review. Option C. Create an access package. Option D. Configure permission classifications. Pause the video now if you want time to think about the answer.
The correct answer is D. Configure permission classifications. Permission classifications in Azure AD allow administrators to define the impact level of permissions (low, medium, high impact). By configuring permission classifications, you can restrict user consent to only apps requesting low-impact permissions, which directly addresses the requirement to limit consent to low-impact permission requests from verified publishers. Now, why are the other options incorrect? Option A is incorrect. Enterprise application collections are used for organizing and managing apps, not for controlling consent based on permission impact levels. Option B is incorrect. Access reviews are used to periodically review user or group access assignments, not to control initial app consent permissions. Option C is incorrect. Access packages are used in entitlement management to bundle resources for access requests, not for restricting app consent permissions. Therefore, D, Configure permission classifications, is the correct answer.
Play from 1:35:26 Question 51. You have an Azure subscription that contains a resource group named RG1 and four users named User1, User2, User3, and User4. You plan to assign the users the following roles for RG1: • User1: Reader • User2: Contributor • User3: Storage Blob Data Reader • User4: Virtual Machine Contributor You are evaluating the use of attribute-based access control (ABAC). Which user's role will support the use of ABAC? Here are the options. Option A. User1. Option B. User2. Option C. User3. Option D. User4. Pause the video now if you want time to think about the answer.
The correct answer is C. User3. The Storage Blob Data Reader role supports attribute-based access control (ABAC) because it can be combined with conditions based on resource attributes, such as blob index tags or container properties. ABAC support is available for data plane roles in services like Azure Storage, allowing fine-grained access decisions based on resource attributes rather than just role assignment. Now, why are the other options incorrect? Option A is incorrect. Reader is a built-in role that does not support attribute-based conditions. Option B is incorrect. Contributor is a built-in role that does not support attribute-based conditions. Option D is incorrect. Virtual Machine Contributor is a built-in role that does not support attribute-based conditions. Therefore, C, User3, is the correct answer.
Play from 1:37:23 Question 52. You have a Microsoft 365 tenant. The Sign-ins activity report shows that an external contractor signed in to the Exchange admin center. You need to review access to the Exchange admin center at the end of each month and block sign-ins if required. What should you create? Here are the options. Option A. an access package that targets users outside your directory. Option B. an access package that targets users in your directory. Option C. a group-based access review that targets guest users. Option D. an application-based access review that targets guest users. Pause the video now if you want time to think about the answer.
The correct answer is D. an application-based access review that targets guest users. An application-based access review targeting guest users allows you to review access to a specific application (Exchange admin center in this case) at scheduled intervals (monthly) and block or remove access as needed. This is more granular than group-based reviews and is specifically designed for reviewing application-level access for external users. Now, why are the other options incorrect? Option A is incorrect. Access packages are for managing entitlement requests and assignments, not for periodic access reviews and blocking. Option B is incorrect. Access packages manage user entitlements, not access review and blocking capabilities. Option C is incorrect. While group-based access reviews can target guest users, an application-based review is more appropriate for reviewing specific application (Exchange admin center) access and enforcing blocks. Therefore, D, an application-based access review that targets guest users, is the correct answer.
Play from 1:39:28 Question 53. You have a Microsoft Entra ID P2 tenant named contoso.com that contains a registered app named App1. On January 1, App1 was deleted. You need to restore App1. What is the last day on which you can restore App1? Here are the options. Option A. January 14. Option B. January 30. Option C. March 30. Option D. June 30. Pause the video now if you want time to think about the answer.
The correct answer is B. January 30. Deleted applications in Microsoft Entra ID can be restored within 30 days of deletion. Since App1 was deleted on January 1, the last day for restoration would be January 30 (30 days later), giving administrators a full month to recover the deleted app. Now, why are the other options incorrect? Option A is incorrect. January 14 is only 14 days after deletion; the recovery window extends to 30 days. Option C is incorrect. March 30 extends beyond the standard 30-day recovery period for deleted apps. Option D is incorrect. June 30 is far beyond the 30-day retention window for deleted applications. Therefore, B, January 30, is the correct answer.
Play from 1:41:07 Question 54. You have an Azure AD tenant that has multi-factor authentication (MFA) enforced and self-service password reset (SSPR) enabled. You enable combined registration in interrupt mode. You create a new user named User1. Which two authentication methods can User1 use to complete the combined registration process? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. a FIDO2 security key. Option B. a hardware token. Option C. a one-time passcode email. Option D. Windows Hello for Business. Option E. the Microsoft Authenticator app. Pause the video now if you want time to think about the answer.
The correct answers are C. a one-time passcode email, and E. the Microsoft Authenticator app. During combined registration in interrupt mode, users can register with one-time passcode via email (C) and the Microsoft Authenticator app (E). These methods are supported for initial combined registration as they provide accessible ways for new users to complete both MFA and SSPR registration simultaneously without requiring pre-existing authentication infrastructure. Now, why are the other options incorrect? Option A is incorrect. FIDO2 security keys are not available during the initial combined registration interrupt process. Option B is incorrect. Hardware tokens are not supported for combined registration in interrupt mode. Option D is incorrect. Windows Hello for Business requires pre-existing Windows device configuration and is not available for initial combined registration interrupt. Therefore, C and E are the correct answers.
Play from 1:43:11 Question 55. You have multiple on-premises devices that run either Windows or Linux. You have a Microsoft 365 E5 subscription. You configure Microsoft Entra Internet Access. You need to ensure that all the on-premises devices access the internet by using Global Secure Access. What should you do in the Microsoft Entra admin center? Here are the options. Option A. Create a remote network. Option B. Create a named location. Option C. Create an access package. Option D. Deploy the Global Secure Access client. Pause the video now if you want time to think about the answer.
The correct answer is A. Create a remote network. To enable on-premises devices to access the internet through Global Secure Access, you must create a remote network in the Microsoft Entra admin center. A remote network represents the on-premises location and allows the Global Secure Access service to route traffic from those devices through the secure access gateway. Now, why are the other options incorrect? Option B is incorrect. Named locations are used for Conditional Access policies based on network location, not for configuring Global Secure Access device connectivity. Option C is incorrect. Access packages are used for entitlement management to grant access to resources, not for configuring Global Secure Access. Option D is incorrect. Deploying the Global Secure Access client is necessary but happens after creating the remote network; the network configuration must be established first in the admin center. Therefore, A, Create a remote network, is the correct answer.
Play from 1:45:08 Question 56. You have a Microsoft 365 subscription that is onboarded to Microsoft Entra Permissions Management. You need to identify managed identities that are assigned permissions and remove any permissions that have been unused for 90 days. The solution must minimize administrative effort. What should you do in the Entra Permissions Management portal? Here are the options. Option A. Configure an Autopilot rule. Option B. Schedule a Permissions analytics report. Option C. From Microsoft Entra Insights, review Service principals with privileged role assignments. Option D. Run an audit query. Pause the video now if you want time to think about the answer.
The correct answer is A. Configure an Autopilot rule. Autopilot rules in Entra Permissions Management enable automated detection and remediation of unused permissions based on defined criteria like the 90-day inactivity threshold. This directly addresses the requirement to automatically identify and remove unused permissions while minimizing administrative effort. Autopilot rules run on a schedule and can automatically revoke permissions meeting the specified conditions. Now, why are the other options incorrect? Option B is incorrect. Permissions analytics reports provide visibility into permission usage but do not automate the removal of unused permissions. Option C is incorrect. Reviewing Service principals in Entra Insights provides visibility but requires manual intervention to remove permissions. Option D is incorrect. Audit queries are for reviewing historical activity and compliance, not for automating permission removal. Therefore, A, Configure an Autopilot rule, is the correct answer.
Play from 1:47:12 Question 57. You have an Azure AD tenant that contains a user named User1 and a registered app named App1. User1 deletes the app registration of App1. You need to restore the app registration. What is the maximum number of days you have to restore the app registration from when it was deleted? Here are the options. Option A. 14. Option B. 30. Option C. 60. Option D. 180. Pause the video now if you want time to think about the answer.
The correct answer is B. 30. Deleted app registrations in Azure AD can be restored within 30 days from the deletion date. After 30 days, the deleted app registration is permanently removed and cannot be recovered. This recovery window allows administrators time to restore accidentally deleted app registrations before permanent loss occurs. Now, why are the other options incorrect? Option A is incorrect. 14 days is insufficient; Azure AD provides a longer recovery window. Option C is incorrect. 60 days exceeds the actual 30-day recovery period for deleted apps. Option D is incorrect. 180 days far exceeds the actual recovery window available for deleted app registrations. Therefore, B, 30, is the correct answer.
Play from 1:48:50 Question 58. You have an Azure subscription that uses Azure AD Privileged Identity Management (PIM). You need to identify users that are eligible for the Cloud Application Administrator role. Which blade in the Privileged Identity Management settings should you use? Here are the options. Option A. Azure resources. Option B. Privileged access groups. Option C. Review access. Option D. Azure AD roles. Pause the video now if you want time to think about the answer.
The correct answer is D. Azure AD roles. The Azure AD roles blade in Privileged Identity Management is where you manage and review role assignments and eligibility for Azure AD directory roles, including identifying which users are eligible for the Cloud Application Administrator role. Now, why are the other options incorrect? Option A is incorrect. Azure resources in PIM is for managing eligibility on Azure subscription and resource roles, not Azure AD directory roles. Option B is incorrect. Privileged access groups is a separate PIM feature for managing group membership, not for reviewing role eligibility. Option C is incorrect. Review access is a feature for conducting access reviews but is not the primary blade for identifying role eligibility. Therefore, D, Azure AD roles, is the correct answer.
Play from 1:50:31 Question 59. Your on-premises network contains an Active Directory Domain Services (AD DS) domain and a certification authority (CA) named CA1. You have an Azure AD tenant. You need to implement certificate-based authentication in Azure AD. The solution must ensure that users can sign in by using certificates issued by CA1. What should you do first? Here are the options. Option A. Deploy an Azure key vault. Option B. Add CA1 as a Certificate Authority to the Microsoft Entra ID tenant. Option C. Enable auto-enrollment for CA1. Option D. Deploy Windows Hello for Business. Pause the video now if you want time to think about the answer.
The correct answer is B. Add CA1 as a Certificate Authority to the Microsoft Entra ID tenant. To implement certificate-based authentication in Azure AD using on-premises CA certificates, you must first add the certification authority to the Microsoft Entra ID tenant. This establishes the trust relationship and allows Azure AD to validate certificates issued by CA1. This configuration step must occur before users can authenticate using those certificates. Now, why are the other options incorrect? Option A is incorrect. Azure Key Vault is used for certificate management after trust is established, not as the first step. Option C is incorrect. Auto-enrollment is a Group Policy setting for certificate distribution to devices, not the first step for Azure AD integration. Option D is incorrect. Windows Hello for Business is an alternative authentication method, not prerequisite for certificate-based authentication setup. Therefore, B, Add CA1 as a Certificate Authority to the Microsoft Entra ID tenant, is the correct answer.
Play from 1:52:43 Question 60. You need to sync the ADatum users. The solution must meet the technical requirements. What should you do? Here are the options. Option A. From the Microsoft Azure Active Directory Connect wizard, select Customize synchronization options. Option B. From PowerShell, run Set-ADSyncScheduler. Option C. From PowerShell, run Start-ADSyncSyncCycle. Option D. From the Microsoft Azure Active Directory Connect wizard, select Change user sign-in. Pause the video now if you want time to think about the answer.
The correct answer is A. From the Microsoft Azure Active Directory Connect wizard, select Customize synchronization options. Selecting 'Customize synchronization options' in the Azure AD Connect wizard allows configuration of which objects, attributes, and organizational units are synchronized from on-premises Active Directory to Azure AD. This provides the granular control needed to meet specific synchronization requirements for ADatum users. Now, why are the other options incorrect? Option B is incorrect. Set-ADSyncScheduler configures the sync schedule frequency but does not define which users are synchronized. Option C is incorrect. Start-ADSyncSyncCycle manually triggers an immediate sync cycle but does not configure which users should be synchronized. Option D is incorrect. Changing user sign-in method modifies authentication mechanism (password sync, pass-through auth, federation) but does not configure which users are synced. Therefore, A, From the Microsoft Azure Active Directory Connect wizard, select Customize synchronization options, is the correct answer.
Play from 1:54:47 Question 61. You have an Azure subscription. You are evaluating enterprise software as a service (SaaS) apps. You need to ensure that the apps support automatic provisioning of Azure AD users. Which specification should the apps support? Here are the options. Option A. OAuth 2.0. Option B. WS-Fed. Option C. SCIM 2.0. Option D. LDAP 3. Pause the video now if you want time to think about the answer.
The correct answer is C. SCIM 2.0. SCIM 2.0 (System for Cross-domain Identity Management) is the industry standard specification for automatic user provisioning and deprovisioning. SaaS applications that support SCIM 2.0 can automatically synchronize user accounts between Azure AD and the application without manual intervention. Now, why are the other options incorrect? Option A is incorrect. OAuth 2.0 is an authentication protocol for authorization, not a user provisioning standard. Option B is incorrect. WS-Fed is a federation protocol for authentication, not designed for automatic user provisioning. Option D is incorrect. LDAP 3 is a directory protocol but is not the standard for SaaS automatic provisioning; SCIM 2.0 is the modern standard. Therefore, C, SCIM 2.0, is the correct answer.
Play from 1:56:37 Question 62. You have a Microsoft 365 E5 subscription that contains a web app named App1. Guest users are regularly granted access to App1. You need to ensure that the guest users that have NOT accessed App1 during the past 30 days have their access removed. The solution must minimize administrative effort. What should you configure? Here are the options. Option A. a Conditional Access policy. Option B. a compliance policy. Option C. a guest access review. Option D. an access review for application access. Pause the video now if you want time to think about the answer.
The correct answer is D. an access review for application access. An access review for application access is the appropriate solution for managing guest user access based on usage patterns. Access reviews allow you to automatically review and remove access for users who haven't accessed the application in a specified period (30 days), minimizing manual administrative effort while ensuring security. Now, why are the other options incorrect? Option A is incorrect. Conditional Access policies control authentication conditions but don't automatically remove access based on inactivity. Option B is incorrect. Compliance policies manage device and application compliance requirements, not user access removal based on usage. Option C is incorrect. Guest access reviews are for reviewing all guest access generally, not specifically for application usage patterns. Therefore, D, an access review for application access, is the correct answer.
Play from 1:58:30 Question 63. You have an Azure subscription that contains a virtual machine named VM1. VM1 has the following configurations: • Private IP address: 172.16.1.5 • Public IP address: 108.143.161.25 • System-assigned managed identity status: On You install an app named App1 on VM1. You need to configure App1 to request a managed identity app-only access token. Which IP address should App1 use for the request? Here are the options. Option A. 108.143.161.25. Option B. 127.0.0.1. Option C. 169.254.169.254. Option D. 172.16.1.5. Pause the video now if you want time to think about the answer.
The correct answer is C. 169.254.169.254. App1 must use the IP address 169.254.169.254, which is the Azure Instance Metadata Service (IMDS) endpoint. This is the standard link-local address reserved for metadata services on Azure VMs. Applications request managed identity tokens by calling the token endpoint at this address, regardless of the VM's private or public IP configuration. Now, why are the other options incorrect? Option A is incorrect. The public IP address is used for external communication but not for internal metadata service requests. Option B is incorrect. 127.0.0.1 is localhost and would only work if a local token service is running, which is not the standard approach. Option D is incorrect. The private IP address is used for VM networking but not for managed identity token requests. Therefore, C, 169.254.169.254, is the correct answer.
Play from 2:00:56 Question 64. You need to meet the planned changes and technical requirements for App1. What should you implement? Here are the options. Option A. a policy set in Microsoft Endpoint Manager. Option B. an app configuration policy in Microsoft Endpoint Manager. Option C. an app registration in Azure AD. Option D. Azure AD Application Proxy. Pause the video now if you want time to think about the answer.
The correct answer is C. an app registration in Azure AD. An app registration in Azure AD is required to integrate an application with Azure AD for authentication, authorization, and access management. This registration allows App1 to use Azure AD as an identity provider and enables enforcement of security policies, MFA, and Conditional Access rules for the application. Now, why are the other options incorrect? Option A is incorrect. Policy sets in Microsoft Endpoint Manager manage device and app compliance but are not the primary mechanism for integrating an app with Azure AD. Option B is incorrect. App configuration policies manage app settings and behavior on endpoints but do not integrate the app with Azure AD for authentication. Option D is incorrect. Azure AD Application Proxy is for publishing on-premises applications through Azure AD; it is not required for integrating a cloud application with Azure AD. Therefore, C, an app registration in Azure AD, is the correct answer.
Play from 2:02:44 Question 65. You have an Azure AD tenant that contains a user named User1. User1 needs to manage license assignments and reset user passwords. Which role should you assign to User1? Here are the options. Option A. Helpdesk administrator. Option B. Billing administrator. Option C. License administrator. Option D. User administrator. Pause the video now if you want time to think about the answer.
The correct answer is D. User administrator. The User Administrator role has permissions to manage license assignments and reset user passwords. This role can create and manage users, reset passwords, manage licenses, and invalidate refresh tokens. While Helpdesk Administrator can reset passwords, it cannot manage license assignments. License Administrator can only manage license assignments but not reset passwords. Now, why are the other options incorrect? Option A is incorrect. Helpdesk Administrator can reset passwords but cannot manage license assignments. Option B is incorrect. Billing Administrator manages subscription billing and purchases, not user licenses or passwords. Option C is incorrect. License Administrator can only manage license assignments, not reset user passwords. Therefore, D, User administrator, is the correct answer.
Play from 2:04:19 Question 66. You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1. Site1 hosts PDF files. You need to prevent users from printing the files directly from Site1. Which type of policy should you create in the Microsoft Defender for Cloud Apps portal? Here are the options. Option A. activity policy. Option B. access policy. Option C. file policy. Option D. session policy. Pause the video now if you want time to think about the answer.
The correct answer is D. session policy. A session policy in Microsoft Defender for Cloud Apps enforces real-time controls on user sessions, including preventing specific actions like printing. Session policies intercept and monitor sessions to block activities such as printing, downloading, or copying based on session context and risk. Activity policies monitor after-the-fact actions, file policies focus on file content and properties, and access policies block or allow access entirely rather than controlling actions within a session. Now, why are the other options incorrect? Option A is incorrect. Activity policies detect actions after they occur, they don't prevent them in real-time. Option B is incorrect. Access policies grant or deny overall access, not control specific actions within sessions. Option C is incorrect. File policies are based on file properties and content scanning, not user actions like printing. Therefore, D, session policy, is the correct answer.
Play from 2:06:13 Question 67. You have a Microsoft 365 subscription that uses Microsoft Defender for Cloud Apps. You have multiple third-party apps that access the resources in the subscription. You need to monitor the access of the third-party apps. What should you create? Here are the options. Option A. an access policy. Option B. an app permission policy. Option C. an OAuth app policy. Option D. an endpoint protection policy. Pause the video now if you want time to think about the answer.
The correct answer is C. an OAuth app policy. An OAuth app policy is used to monitor and control third-party applications that access resources in your Microsoft 365 subscription through OAuth authentication. This policy type allows you to set governance rules for apps requesting permissions and accessing tenant resources. Now, why are the other options incorrect? Option A is incorrect. An access policy manages user access conditions but is not specifically designed for third-party app monitoring. Option B is incorrect. An app permission policy is not a standard policy type in Defender for Cloud Apps. Option D is incorrect. An endpoint protection policy manages device security, not third-party app access. Therefore, C, an OAuth app policy, is the correct answer.
Play from 2:07:54 Question 68. You have an Azure AD Tenant. You configure self-service password reset (SSPR) by using the following settings: • Require users to register when signing in: Yes • Number of methods required to reset: 1 What is a valid authentication method available to users? Here are the options. Option A. an FIDO2 security token. Option B. a mobile app code. Option C. a Microsoft Teams chat. Option D. a Windows Hello PIN. Pause the video now if you want time to think about the answer.
The correct answer is B. a mobile app code. When SSPR requires only one method, the Microsoft Authenticator verification code is available, while the app notification is only offered when two methods are required. A mobile app code is therefore a valid method with these settings. Now, why are the other options incorrect? Option A is incorrect. FIDO2 security keys are not a supported SSPR verification method. Option C is incorrect. Microsoft Teams chat is not an SSPR verification method. Option D is incorrect. A Windows Hello PIN is not an SSPR verification method. Therefore, B, a mobile app code, is the correct answer.
Play from 2:09:28 Question 69. You need to configure the detection of multi-staged attacks to meet the monitoring requirements. What should you do? Here are the options. Option A. Customize the Microsoft Sentinel rule logic. Option B. Create a workbook. Option C. Add Microsoft Sentinel data connectors. Option D. Add an Microsoft Sentinel playbook. Pause the video now if you want time to think about the answer.
The correct answer is A. Customize the Microsoft Sentinel rule logic. To detect multi-staged attacks in Microsoft Sentinel, you must customize the rule logic to correlate multiple events across different stages of an attack chain. This requires modifying detection rules to include conditions that identify patterns spanning multiple steps rather than single events. Customized rule logic enables Sentinel to recognize sophisticated attacks that unfold over time and across different data sources. Now, why are the other options incorrect? Option B is incorrect. Workbooks are visualization and reporting tools, not detection mechanisms for multi-staged attacks. Option C is incorrect. Data connectors bring data into Sentinel but do not configure attack detection logic. Option D is incorrect. Playbooks automate response actions after detection, not the initial detection of multi-staged attacks. Therefore, A, Customize the Microsoft Sentinel rule logic, is the correct answer.
Play from 2:11:15 Question 70. You have an Azure Active Directory (Azure AD) tenant. For the tenant, Users can register applications is set to No. A user named Admin1 must deploy a new cloud app named App1. You need to ensure that Admin1 can register App1 in Azure AD. The solution must use the principle of least privilege. Which role should you assign to Admin1? Here are the options. Option A. Managed Application Contributor for Subscription1. Option B. Application developer in Azure AD. Option C. Cloud application administrator in Azure AD. Option D. App Configuration Data Owner for Subscription1. Pause the video now if you want time to think about the answer.
The correct answer is B. Application developer in Azure AD. The Application Developer role in Azure AD is the least privileged role that allows users to register applications. This role specifically permits app registration without granting broader administrative permissions like the Cloud Application Administrator role would. Since the tenant setting prevents users from self-registering applications, assigning the Application Developer role is the targeted solution. Now, why are the other options incorrect? Option A is incorrect. Managed Application Contributor is a subscription-level role for managing managed applications in Azure, not for registering applications in Azure AD. Option C is incorrect. Cloud Application Administrator is too broad and grants more permissions than necessary, violating the principle of least privilege. Option D is incorrect. App Configuration Data Owner is a subscription-level role for managing app configuration data, not for registering applications in Azure AD. Therefore, B, Application developer in Azure AD, is the correct answer.
Play from 2:13:27 Question 71. You have a Microsoft Entra tenant. You need to use Microsoft Entra workbooks to monitor identity activity. To what should you set Destination details in the Diagnostic settings? Here are the options. Option A. Archive to a storage account. Option B. Send to partner solution. Option C. Stream to an event hub. Option D. Send to Log Analytics workspace. Pause the video now if you want time to think about the answer.
The correct answer is D. Send to Log Analytics workspace. Microsoft Entra workbooks require diagnostic logs to be sent to a Log Analytics workspace. This destination allows the workbooks to query and analyze identity activity data from the logs. Now, why are the other options incorrect? Option A is incorrect. Archiving to a storage account stores logs for long-term retention but does not provide the real-time querying capability that workbooks require. Option B is incorrect. Sending to a partner solution is for integrating with third-party monitoring tools, not for powering Microsoft Entra workbooks. Option C is incorrect. Streaming to an event hub is for real-time event processing but is not the standard destination for workbook-based monitoring and analytics. Therefore, D, Send to Log Analytics workspace, is the correct answer.
Play from 2:15:12 Question 72. You have a Microsoft Entra tenant. You need to add the Facebook social identity provider to the tenant. What should you do first? Here are the options. Option A. Add a custom domain. Option B. Add a WS-Fed identity provider. Option C. Add a SAML identity provider. Option D. Set Enable guest self-service sign up via user flows to Yes. Pause the video now if you want time to think about the answer.
The correct answer is D. Set Enable guest self-service sign up via user flows to Yes. Before adding Facebook or other social identity providers to Microsoft Entra, you must first enable guest self-service sign-up via user flows. This prerequisite allows external users to authenticate using social identities and complete the sign-up process. Now, why are the other options incorrect? Option A is incorrect. Custom domains are not required for adding social identity providers. Option B is incorrect. WS-Fed identity providers are for federated enterprise authentication, not social providers like Facebook. Option C is incorrect. SAML identity providers are for enterprise federation, not for social identity provider integration. Therefore, D, Set Enable guest self-service sign up via user flows to Yes, is the correct answer.
Play from 2:16:58 Question 73. You have an Azure Active Directory (Azure AD) tenant. You open the risk detections report. Which risk detection type is classified as a user risk? Here are the options. Option A. impossible travel. Option B. anonymous IP address. Option C. malicious IP address. Option D. Azure AD threat intelligence. Pause the video now if you want time to think about the answer.
The correct answer is D. Azure AD threat intelligence. Azure AD threat intelligence is classified as a user risk detection type. It represents risks identified through Microsoft's threat intelligence that directly indicate compromised user accounts. The other options (impossible travel, anonymous IP, malicious IP) are all sign-in risk detections, not user risk detections. User risk detections indicate that a user account itself has been compromised, while sign-in risk detections indicate that a specific sign-in event is suspicious. Now, why are the other options incorrect? Option A is incorrect. Impossible travel is a sign-in risk detection, not a user risk detection. Option B is incorrect. Anonymous IP address is a sign-in risk detection, not a user risk detection. Option C is incorrect. Malicious IP address is a sign-in risk detection, not a user risk detection. Therefore, D, Azure AD threat intelligence, is the correct answer.
Play from 2:18:43 Question 74. You have an Azure subscription that contains a virtual machine named VM1 and an Azure key vault named Vault1. VM1 has a system-assigned managed identity. You need to ensure that VM1 can retrieve the values of secrets stored in Vault1. The solution must minimize administrative effort. What should you do first? Here are the options. Option A. Configure the Resource access settings for Vault1. Option B. Configure the permissions model for Vault1. Option C. Add a user-assigned managed identity to VM1. Option D. Assign an Azure role to VM1. Pause the video now if you want time to think about the answer.
The correct answer is D. Assign an Azure role to VM1. To enable a system-assigned managed identity to access Key Vault secrets, you must assign an appropriate Azure role to the managed identity. The 'Key Vault Secrets User' or similar role must be assigned to VM1's system-assigned managed identity, granting it permission to retrieve secrets from Vault1. This is the first and most critical step to minimize administrative effort since the managed identity is already enabled on the VM. Now, why are the other options incorrect? Option A is incorrect. Resource access settings are not the primary mechanism for granting secret retrieval permissions. Option B is incorrect. The permissions model selection is less relevant than assigning the proper role. Option C is incorrect. Adding a user-assigned managed identity is unnecessary when the system-assigned identity is already available and functional. Therefore, D, Assign an Azure role to VM1, is the correct answer.
Play from 2:20:48 Question 75. You have a Microsoft Entra tenant. You need to configure continuous access evaluation for app sign-ins and assign the configuration to users that are assigned the Application Administrator role. What should you configure? Here are the options. Option A. a sign-in risk policy. Option B. an access review. Option C. a Conditional Access policy. Option D. the Admin consent settings. Pause the video now if you want time to think about the answer.
The correct answer is C. a Conditional Access policy. Continuous access evaluation (CAE) in Microsoft Entra is configured through Conditional Access policies. CAE enables real-time assessment of access conditions and can revoke tokens based on critical events and policy evaluation. While you can scope Conditional Access policies to specific roles like Application Administrator through assignment conditions, the mechanism for configuring CAE itself is the Conditional Access policy framework, which allows you to define when and how continuous evaluation occurs for app sign-ins. Now, why are the other options incorrect? Option A is incorrect. Sign-in risk policies address authentication risk scoring, not continuous access evaluation configuration. Option B is incorrect. Access reviews are used for periodic user access certification and attestation, not for configuring continuous real-time access evaluation. Option D is incorrect. Admin consent settings control application permissions and consent workflows, not continuous access evaluation for sign-ins. Therefore, C, a Conditional Access policy, is the correct answer.
Play from 2:22:51 Question 76. You have an Azure subscription that contains two virtual machines named VM1 and VM2 and an Azure SQL managed instance named SQL1. You need to ensure that VM1 and VM2 can retrieve data from SQL1. The solution must minimize administrative effort. What should you create first? Here are the options. Option A. a certificate. Option B. a shared access signature (SAS) token. Option C. a managed identity. Option D. a Microsoft Entra user account. Pause the video now if you want time to think about the answer.
The correct answer is C. a managed identity. Managed identity is the best solution for allowing Azure VMs to authenticate to Azure SQL Managed Instance without storing credentials. It minimizes administrative effort by eliminating the need to manage passwords or connection strings, providing automatic credential management and token rotation through Azure's built-in identity system. Now, why are the other options incorrect? Option A is incorrect. Certificates require manual creation, distribution, and renewal management, increasing administrative overhead. Option B is incorrect. SAS tokens are temporary and must be managed, rotated, and renewed manually, creating ongoing administrative burden. Option D is incorrect. Microsoft Entra user accounts require password management and do not provide the seamless authentication that managed identities offer for Azure resources. Therefore, C, a managed identity, is the correct answer.
Play from 2:24:47 Question 77. You have an Azure AD tenant that contains a user named User1 and a Microsoft 365 group named Group1. User1 is the owner of Group1. You need to ensure that User1 is notified every three months to validate the guest membership of Group1. What should you do? Here are the options. Option A. Configure the External collaboration settings. Option B. Create an access review. Option C. Configure an access package. Option D. Create a group expiration policy. Pause the video now if you want time to think about the answer.
The correct answer is B. Create an access review. Creating an access review is the correct approach to ensure User1 is notified every three months to validate guest membership of Group1. Access reviews allow owners to periodically review and certify guest member access, with configurable recurrence intervals including quarterly schedules. Now, why are the other options incorrect? Option A is incorrect. External collaboration settings controls which external domains can be invited as guests, not membership validation reviews. Option C is incorrect. Access packages are for entitlement management and self-service access requests, not for periodic membership validation. Option D is incorrect. Group expiration policy sets when groups expire, not for regular membership validation by owners. Therefore, B, Create an access review, is the correct answer.
Play from 2:26:39 Question 78. You need to meet the planned changes for the User administrator role. What should you do? Here are the options. Option A. Create an access review. Option B. Create an administrative unit. Option C. Modify Active assignments. Option D. Modify Role settings. Pause the video now if you want time to think about the answer.
The correct answer is D. Modify Role settings. Modifying role settings allows configuration of activation requirements, approval workflows, duration limits, and other governance controls for the User administrator role. Role settings govern how the role can be activated and used, directly addressing technical requirements for managing the role's behavior and constraints. Now, why are the other options incorrect? Option A is incorrect. Access reviews are used to periodically verify that role assignments are still appropriate but do not modify the role's activation and usage settings. Option B is incorrect. Administrative units scope management capabilities to specific user groups but do not modify the role's settings or activation requirements. Option C is incorrect. Modifying active assignments changes who currently holds the role but does not alter the role's configuration or activation requirements. Therefore, D, Modify Role settings, is the correct answer.
Play from 2:28:22 Question 79. You have an Azure AD Premium P2 tenant. You create a Log Analytics workspace. You need to ensure that you can view Azure AD audit log information by using Azure Monitor. What should you do first? Here are the options. Option A. Modify the Diagnostics settings for Azure AD. Option B. Run the Update-MgOrganization cmdlet. Option C. Run the Update-MgDomain cmdlet. Option D. Create an Azure AD workbook. Pause the video now if you want time to think about the answer.
The correct answer is A. Modify the Diagnostics settings for Azure AD. To integrate Azure AD audit logs with Azure Monitor and view them in a Log Analytics workspace, you must first configure Diagnostics settings for Azure AD. This setting controls where Azure AD logs are sent, including to Log Analytics workspaces. Now, why are the other options incorrect? Option B is incorrect. Update-MgOrganization cmdlet is for modifying organizational properties, not for configuring diagnostic log routing. Option C is incorrect. Update-MgDomain cmdlet is for managing domain properties, not for setting up audit log streaming. Option D is incorrect. Creating an Azure AD workbook would be done after diagnostics settings are configured to view the logs that are being collected. Therefore, A, Modify the Diagnostics settings for Azure AD, is the correct answer.
Play from 2:30:14 Question 80. You have a Microsoft 365 subscription. You need to ensure that when users access the Microsoft 365 portal from Microsoft Edge and have their browser language set to Spanish, they are presented with a Spanish sign-in form. What should you do in the Microsoft Entra admin center? Here are the options. Option A. From Settings for the users, configure the Usage location setting. Option B. From Global Secure Access, configure the Session management settings. Option C. Configure the Company branding settings. Option D. Create a Conditional Access policy. Pause the video now if you want time to think about the answer.
The correct answer is C. Configure the Company branding settings. Company branding settings in the Microsoft Entra admin center allow you to customize the sign-in experience, including language-specific sign-in forms. You can configure localized branding that displays the Spanish sign-in form when users access from Microsoft Edge with their browser language set to Spanish. This is the direct mechanism for controlling localized authentication UI. Now, why are the other options incorrect? Option A is incorrect. Usage location is a user property for licensing and feature availability, not for UI localization. Option B is incorrect. Global Secure Access Session management controls session behavior and security, not language-based sign-in form presentation. Option D is incorrect. Conditional Access policies control access permissions and authentication requirements, not UI localization. Therefore, C, Configure the Company branding settings, is the correct answer.
Play from 2:32:14 Question 81. You have a Microsoft Entra tenant. You have 500 devices that run either Windows 11, macOS, iOS, or Android and are enrolled in Microsoft Intune. You plan to deploy the Global Secure Access client. From the Microsoft Entra admin center, you download the Global Secure Access client for each operating system. You need to deploy the client to the macOS devices by using Intune. Which file extension should you use when uploading the client to Intune? Here are the options. Option A. .ipa. Option B. .apk. Option C. .intunewin. Option D. .pkg. Pause the video now if you want time to think about the answer.
The correct answer is D. .pkg. The .pkg file extension is the standard macOS installer package format. When deploying the Global Secure Access client to macOS devices through Intune, you must upload the client in .pkg format, as this is the native package format for macOS applications. Now, why are the other options incorrect? Option A is incorrect. .ipa is the file extension for iOS applications, not macOS. Option B is incorrect. .apk is the file extension for Android applications, not macOS. Option C is incorrect. .intunewin is used for Win32 applications on Windows devices, not for macOS deployment. Therefore, D, .pkg, is the correct answer.
Play from 2:34:00 Question 82. You have a Microsoft 365 E5 subscription. You need to ensure that users can only access resources in the subscription from a device that has the Global Secure Access client connected. What should you do first? Here are the options. Option A. Enable Global Secure Access signaling. Option B. Enable tagging to enforce tenant restrictions. Option C. Create a named location. Option D. Create a remote network. Pause the video now if you want time to think about the answer.
The correct answer is A. Enable Global Secure Access signaling. To ensure users can only access resources when the Global Secure Access client is connected, you must first enable Global Secure Access signaling. This allows the system to detect and enforce the presence of the Global Secure Access client. While remote networks and named locations are part of the broader configuration, signaling is the foundational step that enables device enforcement. Tenant restrictions alone do not enforce client connectivity requirements. Now, why are the other options incorrect? Option B is incorrect. Tagging for tenant restrictions controls which tenants can be accessed, but does not enforce Global Secure Access client connectivity. Option C is incorrect. Named locations define network locations but do not enforce device client connectivity requirements. Option D is incorrect. While remote networks are used in Global Secure Access, enabling signaling must occur first to enforce client connectivity. Therefore, A, Enable Global Secure Access signaling, is the correct answer.
Play from 2:35:59 Question 83. You have a Microsoft 365 E5 subscription that contains a user named User1. User1 is eligible for the Application Administrator role. User1 needs to configure a new connector group for an application proxy. What should you use to activate the role for User1? Here are the options. Option A. the Microsoft 365 Defender portal. Option B. the Microsoft 365 admin center. Option C. the Microsoft Intune admin center. Option D. the Azure Active Directory admin center. Pause the video now if you want time to think about the answer.
The correct answer is D. the Azure Active Directory admin center. The Azure Active Directory admin center is the correct portal for managing Microsoft Entra ID (Azure AD) roles, including activating eligible roles like Application Administrator. This is where Privileged Identity Management (PIM) functionality is accessed to activate roles for users. The other portals handle different aspects of Microsoft 365 administration but are not the primary location for role activation. Now, why are the other options incorrect? Option A is incorrect. Microsoft 365 Defender portal is used for security threat management, not role administration. Option B is incorrect. Microsoft 365 admin center manages general Microsoft 365 settings and user management, not Azure AD role activation. Option C is incorrect. Microsoft Intune admin center manages mobile device and application management, not Azure AD roles. Therefore, D, the Azure Active Directory admin center, is the correct answer.
Play from 2:37:58 Question 84. You have a Microsoft Entra tenant that contains 1,000 users. The users are assigned Microsoft Entra Suite licenses. You are deploying Global Secure Access. You need to ensure that connections to www.microsoft.com are bypassed by Global Secure Access. Which profiles should you update? Here are the options. Option A. Intemet access profile only. Option B. Microsoft traffic profile only. Option C. Microsoft traffic profile and Internet access profile only. Option D. Microsoft traffic profile, Private access profile, and Internet access profile. Pause the video now if you want time to think about the answer.
The correct answer is A. Intemet access profile only. To bypass connections to www.microsoft.com from Global Secure Access, you need to configure the Internet access profile. This profile controls which internet destinations are routed through Global Secure Access, and adding www.microsoft.com to the bypass list ensures traffic to that site is excluded from the Global Secure Access path. Now, why are the other options incorrect? Option B is incorrect. The Microsoft traffic profile is specifically for routing Microsoft 365 services and wouldn't be the primary profile for configuring general website bypasses. Option C is incorrect. While the Internet access profile is correct, the Microsoft traffic profile is not necessary for this bypass configuration. Option D is incorrect. The Private access profile is for corporate private applications and is not relevant to bypassing public internet destinations like www.microsoft.com. Therefore, A, Intemet access profile only, is the correct answer.
Play from 2:40:11 Question 85. You have three Azure subscriptions that are linked to a single Microsoft Entra tenant. You need to evaluate and remediate the risks associated with highly privileged accounts. The solution must minimize administrative effort. What should you use? Here are the options. Option A. Global Secure Access. Option B. Privileged Identity Management (PIM). Option C. Microsoft Entra Permissions Management. Option D. Microsoft Entra Verified ID. Pause the video now if you want time to think about the answer.
The correct answer is B. Privileged Identity Management (PIM). Privileged Identity Management (PIM) is specifically designed to evaluate, monitor, and remediate risks associated with highly privileged accounts across Azure subscriptions and Microsoft Entra ID. It provides just-in-time access, access reviews, and role-based risk assessment while minimizing administrative overhead through automated workflows and built-in governance controls. Now, why are the other options incorrect? Option A is incorrect. Global Secure Access manages network and application access, not privileged account risk evaluation. Option C is incorrect. Permissions Management focuses on least-privilege access analysis but is not the primary tool for evaluating highly privileged account risks. Option D is incorrect. Verified ID manages identity verification and credentials, not privileged account risk assessment. Therefore, B, Privileged Identity Management (PIM), is the correct answer.
Play from 2:42:09 Question 86. You have a Microsoft 365 E5 subscription. You need to be able to create a Microsoft Defender for Cloud Apps session policy. What should you do first? Here are the options. Option A. From the Microsoft 365 Defender portal, select User monitoring. Option B. From the Microsoft 365 Defender portal, select App onboarding/maintenance. Option C. From the Microsoft Entra admin center, create a Conditional Access policy. Option D. From the Microsoft 365 Defender portal, create a continuous report. Pause the video now if you want time to think about the answer.
The correct answer is C. From the Microsoft Entra admin center, create a Conditional Access policy. Before creating a Defender for Cloud Apps session policy, you must first set up a Conditional Access policy in Microsoft Entra admin center. The Conditional Access policy is the prerequisite that enables session control for Cloud Apps policies to function properly. Now, why are the other options incorrect? Option A is incorrect. User monitoring is not a prerequisite for creating session policies. Option B is incorrect. App onboarding/maintenance is not the first step required for session policy creation. Option D is incorrect. Creating a continuous report does not establish the foundation needed for session policies. Therefore, C, From the Microsoft Entra admin center, create a Conditional Access policy, is the correct answer.
Play from 2:44:02 Question 87. You have an Azure Active Directory (Azure AD) tenant named Contoso that contains a terms of use (Toll) named Terms1 and an access package. Contoso users collaborate with an external organization named Fabrikam. Fabrikam users must accept Terms1 before being allowed to use the access package. You need to identify which users accepted or declined Terms1. What should you use? Here are the options. Option A. sign-in logs. Option B. the Usage and Insights report. Option C. provisioning logs. Option D. audit logs. Pause the video now if you want time to think about the answer.
The correct answer is D. audit logs. Audit logs track acceptance or rejection of terms of use by users. When users accept or decline Terms1, these actions are recorded in the Azure AD audit logs, which provide a comprehensive record of who accepted or declined the terms and when. Now, why are the other options incorrect? Option A is incorrect. Sign-in logs record authentication attempts, not terms of use acceptance/decline actions. Option B is incorrect. Usage and Insights reports provide usage statistics but don't track individual terms acceptance decisions. Option C is incorrect. Provisioning logs track user provisioning and synchronization activities, not terms of use acceptance. Therefore, D, audit logs, is the correct answer.
Play from 2:45:52 Question 88. You have an Azure AD tenant. You need to implement smart lockout with a lockout threshold of 10 failed sign-ins. What should you configure in the Azure AD admin center? Here are the options. Option A. Authentication strengths. Option B. Password protection. Option C. User risk policy. Option D. Sign-in risk policy. Pause the video now if you want time to think about the answer.
The correct answer is B. Password protection. Password protection is the correct setting to configure smart lockout with a specific failed sign-in threshold. Password protection policies in Azure AD admin center allow administrators to set smart lockout thresholds that automatically lock accounts after a specified number of failed authentication attempts, protecting against brute force attacks. Now, why are the other options incorrect? Option A is incorrect. Authentication strengths are used to define required authentication methods, not for configuring lockout thresholds. Option C is incorrect. User risk policy is used to enforce actions based on detected user risk levels, not for smart lockout configuration. Option D is incorrect. Sign-in risk policy addresses risky sign-in events, not account lockout from failed authentication attempts. Therefore, B, Password protection, is the correct answer.
Play from 2:47:34 Question 89. You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Cloud Apps and Yammer. You need prevent users from signing in to Yammer from high-risk locations. What should you do in the Microsoft Defender for Cloud Apps portal? Here are the options. Option A. Create an access policy. Option B. Create an activity policy. Option C. Unsanction Yammer. Option D. Create an anomaly detection policy. Pause the video now if you want time to think about the answer.
The correct answer is A. Create an access policy. An access policy in Microsoft Defender for Cloud Apps can block or restrict user sign-in to connected cloud applications (like Yammer) based on risk conditions including location. This is the direct mechanism for preventing access from high-risk locations. Activity policies monitor behavior, unsanctioning an app removes it from oversight, and anomaly detection policies detect suspicious behavior rather than enforcing access restrictions. Now, why are the other options incorrect? Option B is incorrect. Activity policies monitor and alert on user activities but don't prevent access based on location risk. Option C is incorrect. Unsanctioning Yammer would remove it from protection entirely, the opposite of the requirement. Option D is incorrect. Anomaly detection policies detect unusual activity patterns but don't enforce access restrictions based on location risk. Therefore, A, Create an access policy, is the correct answer.
Play from 2:49:34 Question 90. You have an Azure subscription that contains a user named User1 and two resource groups named RG1 and RG2. You need to ensure that User1 can perform the following tasks: • View all resources. • Restart virtual machines. • Create virtual machines in RG1 only. • Create storage accounts in RG1 only. What is the minimum number of role-based access control (RBAC) role assignments required? Here are the options. Option A. 1. Option B. 2. Option C. 3. Option D. 4. Pause the video now if you want time to think about the answer.
The correct answer is B. 2. A minimum of 2 role assignments achieves all requirements: First, assign Reader role at the subscription level to allow viewing all resources. Second, assign a custom role or Contributor at the subscription level for VM restart capability combined with a scoped assignment (Contributor on RG1 only) for creating VMs and storage accounts in RG1. Alternatively, Reader at subscription scope plus a custom role scoped to RG1 for create operations satisfies all four tasks with 2 assignments. Now, why are the other options incorrect? Option A is incorrect. A single role cannot satisfy all requirements because resource creation must be scoped to RG1 only while viewing and VM restart must be at subscription level. Option C is incorrect. Three assignments are more than the minimum needed when roles are properly scoped. Option D is incorrect. Four assignments exceed the minimum necessary to accomplish these tasks. Therefore, B, 2, is the correct answer.
Play from 2:51:42 Question 91. A user named User1 receives an error message when attempting to access the Microsoft Defender for Cloud Apps portal. You need to identify the cause of the error. The solution must minimize administrative effort. What should you use? Here are the options. Option A. Log Analytics. Option B. sign-in logs. Option C. audit logs. Option D. provisioning logs. Pause the video now if you want time to think about the answer.
The correct answer is B. sign-in logs. Sign-in logs in Azure AD/Microsoft Entra directly record authentication attempts and failures with detailed error messages, providing the fastest and most direct way to identify why a user cannot access a service. This minimizes administrative effort by showing the exact error code and reason without requiring additional investigation. Log Analytics requires custom queries, audit logs don't capture sign-in errors, and provisioning logs track user and group provisioning, not portal access. Now, why are the other options incorrect? Option A is incorrect. Log Analytics requires configuring custom queries and is more complex than reviewing sign-in logs directly. Option C is incorrect. Audit logs track administrative changes and user actions but don't capture sign-in failures or portal access errors. Option D is incorrect. Provisioning logs track user and group provisioning events in applications, not portal authentication attempts. Therefore, B, sign-in logs, is the correct answer.
Play from 2:53:35 Question 92. You have an Azure subscription, a Google Cloud Platform (GCP) account, and an Amazon Web Services (AWS) account. You need to recommend a solution to assess the risks associated with privilege assignments across all the platforms. The solution must minimize administrative effort. What should you include in the recommendation? Here are the options. Option A. Microsoft Sentinel. Option B. Microsoft Entra ID Protection. Option C. Microsoft Defender for Cloud Apps. Option D. Microsoft Entra Permissions Management. Pause the video now if you want time to think about the answer.
The correct answer is D. Microsoft Entra Permissions Management. Microsoft Entra Permissions Management is the solution designed to assess privilege-related risks across multiple cloud platforms including Azure, AWS, and GCP. It provides unified visibility into permission assignments and identifies over-privileged accounts across all three platforms while minimizing administrative effort through automated analysis and recommendations. Now, why are the other options incorrect? Option A is incorrect. Microsoft Sentinel is a security information and event management tool, not designed for privilege assessment across cloud platforms. Option B is incorrect. Microsoft Entra ID Protection focuses on identity risks within Azure AD, not multi-cloud privilege assessment. Option C is incorrect. Microsoft Defender for Cloud Apps is primarily for SaaS application security, not for assessing privilege assignments across cloud platforms. Therefore, D, Microsoft Entra Permissions Management, is the correct answer.
Play from 2:55:35 Question 93. You have an Azure Active Directory (Azure AD) tenant that uses conditional access policies. You plan to use third-party security information and event management (SIEM) to analyze conditional access usage. You need to download the Azure AD log by using the administrative portal. The log file must contain changes to conditional access policies. What should you export from Azure AD? Here are the options. Option A. audit logs in CSV format. Option B. sign-ins in CSV format. Option C. audit logs in JSON format. Option D. sign-ins in JSON format. Pause the video now if you want time to think about the answer.
The correct answer is C. audit logs in JSON format. Changes to conditional access policies are recorded in Azure AD audit logs. To export these logs for use in a third-party SIEM system, audit logs in JSON format should be used, as JSON provides structured data that SIEM systems can parse and analyze effectively. Now, why are the other options incorrect? Option A is incorrect. CSV format is less suitable for complex nested data structures and SIEM integration compared to JSON. Option B is incorrect. Sign-in logs record authentication events but do not capture changes to conditional access policies themselves. Option D is incorrect. Sign-in logs in JSON format record sign-in events, not policy configuration changes. Therefore, C, audit logs in JSON format, is the correct answer.
Play from 2:57:28 Question 94. You have a Microsoft Entra tenant that uses Microsoft Entra ID Premium licenses. You plan to configure a terms of use (ToU) for the tenant. You need to upload the ToU document. Which format should you use for the document? Here are the options. Option A. HTML. Option B. RTF. Option C. PDF. Option D. DOCX. Pause the video now if you want time to think about the answer.
The correct answer is C. PDF. Microsoft Entra Terms of Use requires documents to be uploaded in PDF format. PDF ensures consistent formatting and rendering across different devices and browsers, making it the standard format for official compliance documents in Microsoft Entra. Now, why are the other options incorrect? Option A is incorrect. While HTML can be used in web contexts, Microsoft Entra ToU specifically requires PDF format for uploaded documents. Option B is incorrect. RTF (Rich Text Format) is not supported for Terms of Use uploads in Microsoft Entra. Option D is incorrect. DOCX (Word documents) are not supported for Terms of Use uploads; PDF is the required format. Therefore, C, PDF, is the correct answer.
Play from 2:59:02 Question 95. You configure a new Microsoft 365 tenant to use a default domain name of contoso.com. You need to ensure that you can control access to Microsoft 365 resources by using conditional access policies. What should you do first? Here are the options. Option A. Disable Security defaults. Option B. Configure password protection for the Azure AD tenant. Option C. Configure a multi-factor authentication (MFA) registration policy. Option D. Disable the User consent settings. Pause the video now if you want time to think about the answer.
The correct answer is A. Disable Security defaults. Disabling Security defaults is the first step required to implement conditional access policies. Security defaults and conditional access policies are mutually exclusive-when Security defaults are enabled, conditional access policies cannot be created or applied. Disabling Security defaults allows organizations to implement granular conditional access policies tailored to their specific requirements. Now, why are the other options incorrect? Option B is incorrect. Password protection configuration is not a prerequisite for conditional access policies. Option C is incorrect. MFA registration policy is separate from the conditional access setup requirement. Option D is incorrect. User consent settings do not need to be disabled as a first step for conditional access implementation. Therefore, A, Disable Security defaults, is the correct answer.
Play from 3:00:59 Question 96. You create a conditional access policy that blocks access when a user triggers a high-severity sign-in alert. You need to test the policy under the following conditions: • A user signs in from another country. • A user triggers a sign-in risk. What should you use to complete the test? Here are the options. Option A. the Conditional Access What If tool. Option B. sign-ins logs in Azure Active Directory (Azure AD). Option C. the activity logs in Microsoft Defender for Cloud Apps. Option D. access reviews in Azure Active Directory (Azure AD). Pause the video now if you want time to think about the answer.
The correct answer is A. the Conditional Access What If tool. The Conditional Access What If tool is specifically designed to test conditional access policies under hypothetical scenarios. It allows you to simulate sign-in conditions including risk levels, locations, and other signals to see how your policies would apply without actually affecting real users. This tool is the proper way to validate policy behavior before full deployment. Now, why are the other options incorrect? Option B is incorrect. Sign-in logs show historical data but do not allow you to test policies under hypothetical future conditions. Option C is incorrect. Microsoft Defender for Cloud Apps activity logs monitor actual activity but are not designed for conditional access policy testing. Option D is incorrect. Access reviews are used for periodic validation of access permissions, not for testing conditional access policies. Therefore, A, the Conditional Access What If tool, is the correct answer.
Play from 3:02:58 Question 97. You have a Microsoft 365 E5 subscription. You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains a user named User1. You plan to deploy Microsoft Entra Permissions Management. You need to ensure that User1 can onboard the Azure subscription to Permissions Management. The solution must follow the principle of least principle. Which Microsoft Entra role should you assign to User1? Here are the options. Option A. Permissions Management Administrator. Option B. Global Administrator. Option C. Security Administrator. Option D. Application Administrator. Pause the video now if you want time to think about the answer.
The correct answer is A. Permissions Management Administrator. The Permissions Management Administrator role is the least privileged role that grants the specific permissions needed to onboard subscriptions to Microsoft Entra Permissions Management. This role follows the principle of least privilege by providing only the permissions necessary for Permissions Management administration without the broad permissions of Global Administrator. Now, why are the other options incorrect? Option B is incorrect. Global Administrator has excessive permissions beyond what is needed for Permissions Management onboarding. Option C is incorrect. Security Administrator has permissions focused on security features but not the specific permissions needed for Permissions Management onboarding. Option D is incorrect. Application Administrator manages applications and service principals but lacks the specific permissions for Permissions Management onboarding. Therefore, A, Permissions Management Administrator, is the correct answer.
Play from 3:05:00 Question 98. You have a Microsoft Entra tenant. You discover that a large number of new apps were added to the tenant. You need to implement an approval process for new enterprise applications. What should you do? Here are the options. Option A. From the Microsoft Defender portal, configure an app connector. Option B. From the Microsoft Entra admin center, configure an access review. Option C. From the Microsoft Defender portal, create an app detection policy. Option D. From the Microsoft Entra admin center, configure the Admin consent settings. Pause the video now if you want time to think about the answer.
The correct answer is D. From the Microsoft Entra admin center, configure the Admin consent settings. Admin consent settings in Microsoft Entra allow administrators to implement an approval workflow for new enterprise applications. This setting controls whether users can consent to app requests and requires admin review, creating a formal approval process for new applications added to the tenant. Now, why are the other options incorrect? Option A is incorrect. App connectors in Defender for Cloud Apps are for monitoring existing apps, not implementing approval processes. Option B is incorrect. Access reviews are for auditing and recertifying existing access rights, not for approving new application additions. Option C is incorrect. App detection policies in Defender are for identifying and controlling discovered apps, not implementing administrative approval workflows. Therefore, D, From the Microsoft Entra admin center, configure the Admin consent settings, is the correct answer.
Play from 3:06:58 Question 99. You have an Azure AD tenant. You plan to implement Azure AD Privileged Identity Management (PIM). Which roles can you manage by using PIM? Here are the options. Option A. Global Administrator only. Option B. Global Administrator and Security Administrator only. Option C. Global Administrator, Security Administrator, and Security Contributor only. Option D. Account Administrator, Global Administrator, Security Administrator, and Security Contributor only. Pause the video now if you want time to think about the answer.
The correct answer is B. Global Administrator and Security Administrator only. Azure AD PIM can manage Global Administrator and Security Administrator roles. These are the primary Azure AD directory roles for which PIM supports eligible and active assignments with approval workflows and time-based activation. Now, why are the other options incorrect? Option A is incorrect. While Global Administrator can be managed, Security Administrator is also a role that PIM can manage. Option C is incorrect. Security Contributor is not a role that can be managed through PIM's role management features. Option D is incorrect. Account Administrator is not an Azure AD directory role, and Security Contributor is not PIM-manageable. Therefore, B, Global Administrator and Security Administrator only, is the correct answer.
Play from 3:08:45 Question 100. You have an Azure subscription that contains an Azure Automation account named Automation1. You need to grant Automation1 access to Azure resources. The solution must meet the following requirements: • Ensure that any permissions granted to Automation1 are removed when the account is deleted. • Minimize administrative effort. What should you use? Here are the options. Option A. a client secret. Option B. a system-assigned managed identity. Option C. a certificate. Option D. user-assigned managed identity. Pause the video now if you want time to think about the answer.
The correct answer is B. a system-assigned managed identity. A system-assigned managed identity is automatically created with the Automation account and automatically deleted when the account is deleted, ensuring permissions are cleaned up without manual intervention. This minimizes administrative effort compared to certificates or client secrets which require manual lifecycle management. Now, why are the other options incorrect? Option A is incorrect. Client secrets require manual rotation and cleanup when the Automation account is deleted. Option C is incorrect. Certificates require manual management, renewal, and cleanup, increasing administrative effort. Option D is incorrect. User-assigned managed identities persist after the Automation account is deleted and require manual cleanup of permissions. Therefore, B, a system-assigned managed identity, is the correct answer.
