CCNA Secure identity and access Questions

MCQmedium

You are designing a privileged access strategy for Microsoft Entra ID. Your organization requires that all users who are assigned to the Global Administrator role must perform a privileged elevation only when needed, and the elevation must be approved by a security officer. Which feature should you implement?

A.Microsoft Entra Identity Governance – Privileged Identity Management

B.Azure AD administrative units

C.Conditional Access with session control

D.Microsoft Entra ID protection risk policies

AnswerA

Microsoft Entra Privileged Identity Management (PIM) delivers just-in-time privileged access by letting users activate eligible role assignments for a maximum time window, with optional approval workflows, MFA, and business justification. Because activation is time-bound and audited, PIM directly supports a privileged access strategy that requires temporary elevation with oversight.

Why this answer

Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged elevation for roles like Global Administrator, requiring approval from designated approvers (e.g., a security officer) before activation. This directly meets the requirement of elevation only when needed with approval, as PIM manages time-bound role assignments and approval workflows.

Exam trap

The trap here is that candidates often confuse Conditional Access (which controls sign-in access) with PIM (which controls role activation), leading them to select Option C because they think session controls can enforce approval for elevation, but Conditional Access cannot manage role activation workflows.

How to eliminate wrong answers

Option B is wrong because Azure AD administrative units restrict administrative scope to specific organizational units (e.g., departments) but do not provide JIT elevation or approval workflows for role activation. Option C is wrong because Conditional Access with session control enforces policies during sign-in (e.g., requiring MFA or device compliance) but cannot control role activation or require approval for elevation. Option D is wrong because Microsoft Entra ID Protection risk policies detect and respond to user or sign-in risks (e.g., blocking risky sign-ins) but do not manage privileged role elevation or approval processes.

Practice this question →

MCQhard

You are managing a Microsoft Entra ID tenant with external collaboration enabled. You need to restrict external user access to only the groups and applications they are explicitly granted. You also want to prevent external users from seeing other external users in the tenant directory. Which settings should you configure?

A.Set 'Guest user access restrictions' to 'Guest users have limited access...' and configure 'External collaboration settings' to restrict external user visibility

B.Use Microsoft Entra entitlement management to create access packages for external users

C.Configure cross-tenant access settings to block all external collaboration

D.Set 'Guest user access restrictions' to 'Guest users have same access as members'

AnswerA

This limits guest users to only objects they are assigned and prevents them from seeing other external users.

Why this answer

The 'Guest user access restrictions' setting controls the level of directory data guest users can see, and setting it to 'Guest users have limited access...' restricts guests from enumerating the full directory. Additionally, the 'External collaboration settings' allow you to limit guest visibility to only the groups and applications they are explicitly granted, preventing them from seeing other external users. This combination directly meets both requirements: restricting access to explicitly granted resources and hiding other external users from the directory.

Exam trap

The trap here is that candidates often confuse 'Guest user access restrictions' with 'External collaboration settings', thinking they are interchangeable, but the former controls directory read permissions while the latter controls collaboration scope and visibility, and both are required to fully satisfy the scenario.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra entitlement management is used to automate access package assignments and approvals, but it does not control directory-level visibility restrictions or prevent external users from seeing other external users. Option C is wrong because blocking all external collaboration would prevent any external user access entirely, which contradicts the requirement to allow external users but restrict their visibility. Option D is wrong because setting 'Guest users have same access as members' would grant guests full directory read permissions, allowing them to see all other users (including external users), which directly violates the requirement to prevent external users from seeing other external users.

Practice this question →

Multi-Selectmedium

Your organization uses Microsoft Entra ID and has a hybrid identity with Microsoft Entra Connect. You need to ensure that all user password changes and resets are synchronized to the cloud within 30 minutes. Which TWO actions should you take? (Choose two.)

Select 1 answer

A.Configure federation with AD FS.

B.Set the Azure AD Connect synchronization frequency to 30 minutes.

C.Enable password writeback in Microsoft Entra Connect.

D.Enable Azure AD Connect Health to monitor synchronization.

E.Configure pass-through authentication for user sign-ins.

AnswersB

Correct. Setting the synchronization frequency to 30 minutes ensures that password changes on-premises are replicated to the cloud within the required time.

Why this answer

The requirement is to synchronize password changes and resets to the cloud within 30 minutes. Option B is correct because setting the Azure AD Connect synchronization frequency to 30 minutes ensures that password changes made on-premises are synced to Microsoft Entra ID within that timeframe. Option C (password writeback) is not required because it handles syncing cloud-initiated password resets to on-premises, which is the opposite direction.

Options A, D, and E do not address synchronization frequency. Therefore, only option B meets the requirement.

Exam trap

Candidates may think both password hash synchronization and password writeback are needed, but the requirement is only for syncing changes to the cloud, not from the cloud. Password writeback is for the reverse direction.

Practice this question →

MCQhard

A company is implementing Privileged Identity Management (PIM) in Microsoft Entra ID for Azure resources. The security team wants to ensure that all privileged role activations require approval and are logged. They also want to require Azure MFA during activation. However, they notice that some users are able to activate roles without approval. What is the most likely cause?

A.Users have permanent eligible assignments that bypass approval

B.The audit log is not enabled for PIM

C.Users are assigned the role directly instead of through eligibility

D.The role settings for approval are not configured at the resource scope, and the users are using inherited settings from a management group

AnswerD

Role settings can be configured at different scopes (management group, subscription, resource group). If the approval requirement is not set at the specific scope, inherited settings may not require approval.

Why this answer

PIM role settings for Azure resources can be configured at the management group, subscription, or resource group scope. If approval is required only at the subscription scope but users activate roles at a resource group scope that inherits from a management group where approval is not configured, the activation will proceed without approval. This is a common misconfiguration where the approval requirement is not applied at the correct scope.

Exam trap

The trap here is that candidates assume PIM role settings are applied globally or uniformly across all scopes, but Azure resource PIM settings are scoped and inherited, so a missing approval configuration at a higher scope (like a management group) can silently bypass approval requirements at lower scopes.

How to eliminate wrong answers

Option A is wrong because permanent eligible assignments still require activation and are subject to the role settings (including approval) configured for that role; there is no concept of 'bypassing approval' for eligible assignments. Option B is wrong because the audit log being disabled would prevent logging of activations, but it does not affect whether approval is required during activation. Option C is wrong because if users are assigned the role directly (permanent active assignment), they do not need to activate at all, so they would not see an activation approval prompt; however, the question states users are 'able to activate roles without approval,' implying they are using activation, which means they have eligible assignments, not direct assignments.

Practice this question →

MCQmedium

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users accessing sensitive data from unmanaged devices are required to use a compliant device. What should you configure?

A.Configure a device registration policy

B.Configure a Conditional Access policy that requires that the device be marked as compliant

C.Configure an Identity Protection policy for user risk

D.Configure a Conditional Access policy that requires multi-factor authentication

AnswerB

This enforces device compliance for access to sensitive data.

Why this answer

A Conditional Access policy that requires the device to be marked as compliant ensures that only devices meeting your organization's compliance standards (e.g., antivirus enabled, encryption active) can access sensitive data. This policy evaluates device compliance status reported by Microsoft Intune or another MDM provider, and blocks or grants access based on that status. It directly addresses the requirement to enforce compliant device access from unmanaged devices.

Exam trap

The trap here is that candidates often confuse requiring MFA (Option D) with requiring device compliance, but MFA only verifies the user, not the device's security posture, which is the core requirement in this scenario.

How to eliminate wrong answers

Option A is wrong because a device registration policy only controls whether devices can be registered or joined to Entra ID, not whether they are compliant or can access sensitive data. Option C is wrong because an Identity Protection policy for user risk focuses on user sign-in risk (e.g., leaked credentials, anonymous IP) and does not evaluate device compliance status. Option D is wrong because a Conditional Access policy requiring multi-factor authentication strengthens authentication but does not enforce device compliance; an unmanaged device could still access data after MFA.

Practice this question →

MCQhard

Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM) to manage roles. You need to ensure that when a user activates a role, the activation is automatically approved only if the user's manager approves within 30 minutes. If the manager does not respond, the activation is denied. What configuration should you implement?

A.Enable just-in-time access for the role and configure a group approval with a 30-minute timeout.

B.Configure the role settings to require approval, set the maximum activation duration to 30 minutes, and add the user's manager as an approver.

C.Create an approval workflow in Microsoft Entra ID that assigns the manager as the approver and set a timeout of 30 minutes.

D.Configure the role settings to require approval and set the approval timeout to 0 minutes.

AnswerB

This ensures the manager must approve within the activation window, or the request expires.

Why this answer

In Microsoft Entra ID PIM, the 'Maximum activation duration' setting in role settings controls the time window within which an approval must be granted. If the approver does not respond within that duration, the activation request is denied. By setting this to 30 minutes, requiring approval, and adding the user's manager as an approver, you ensure the manager must approve within 30 minutes or the activation is automatically denied.

This directly meets the requirement.

Exam trap

The trap here is thinking that a separate 'Approval timeout' setting exists, when in fact the 'Maximum activation duration' serves as the timeout for the approval request itself. Candidates may incorrectly look for a distinct approval timeout setting, leading them to choose options that do not exist or are misconfigured.

How to eliminate wrong answers

Option A is wrong because enabling just-in-time access and configuring a group approval with a 30-minute timeout does not specifically assign the user's manager as the approver; group approval requires a predefined group, not dynamic manager assignment. Option C is wrong because creating an approval workflow in Microsoft Entra ID is not a native PIM feature; PIM uses role settings for approval, not separate workflows, and the timeout must be configured in the role settings, not in a workflow. Option D is wrong because setting the approval timeout to 0 minutes would cause the approval request to expire immediately, not wait 30 minutes for the manager's response, and it does not specify the manager as the approver.

Practice this question →

MCQmedium

Your company uses Microsoft Entra ID and Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with your security policies can access Exchange Online. The solution must require users to reauthenticate every 12 hours. What should you configure?

A.Create a Conditional Access policy that requires MFA for Exchange Online and set sign-in frequency to 12 hours.

B.Create a Conditional Access policy that grants access to Exchange Online only if the device is compliant, and set session sign-in frequency to 12 hours.

C.Create an app protection policy for Exchange Online that requires device compliance and sets sign-in frequency.

D.Configure a device compliance policy for all devices and enable 'Reauthenticate every 12 hours' in the compliance policy.

AnswerB

This enforces both device compliance and reauthentication frequency.

Why this answer

A Conditional Access policy can enforce device compliance as a grant control for Exchange Online, ensuring only compliant devices can access the service. Setting the session sign-in frequency to 12 hours forces users to reauthenticate at that interval, meeting the requirement without requiring MFA. This combines device compliance enforcement with session lifetime control in a single policy.

Exam trap

The trap here is that candidates confuse device compliance policies with Conditional Access session controls, assuming sign-in frequency can be set directly in a compliance policy, when it is actually a separate Conditional Access setting.

How to eliminate wrong answers

Option A is wrong because requiring MFA does not enforce device compliance; it only adds an authentication factor, so non-compliant devices could still access Exchange Online. Option C is wrong because app protection policies (MAM) manage data protection within apps, not device-level compliance, and they do not support a sign-in frequency setting. Option D is wrong because a device compliance policy itself does not include a 'Reauthenticate every 12 hours' setting; sign-in frequency is a Conditional Access session control, not a compliance policy setting.

Practice this question →

MCQeasy

You are the identity security engineer for a multinational company that uses Microsoft Entra ID. The company has recently experienced a security breach where an attacker compromised a non-administrator user account and then used that account to enumerate all users in the tenant. The attacker then attempted to brute-force passwords for high-privilege accounts. To prevent such attacks, management requires the following: - Users with administrative roles must use phishing-resistant MFA. - Any sign-in from a risky IP address must be blocked. - Users must not be able to enumerate directory information via the Graph API unless they have a specific role. - The solution should be implemented using built-in Microsoft Entra ID features. What should you configure?

A.Enable Security defaults and configure Identity Protection user risk policy to block high-risk users.

B.Configure Conditional Access policy with authentication strength for admins requiring phishing-resistant MFA. Configure Identity Protection sign-in risk policy to block risky sign-ins. Restrict access to the Graph API by requiring a specific role assignment.

C.Configure Conditional Access policy for admins to require phishing-resistant MFA. Use PIM to require approval. Enable Identity Protection sign-in risk policy.

D.Configure PIM for all admin roles. Create access reviews for all users. Enable Identity Protection to detect risky sign-ins.

AnswerB

This is the correct answer because it layers three complementary controls that directly counter the attacker's tactic. Conditional Access with an authentication strength policy requiring phishing-resistant MFA (such as FIDO2 or Windows Hello) prevents credential theft and token replay that bypass ordinary MFA. The Identity Protection sign-in risk policy blocks sign-ins in real time when the risk level is high, such as those coming from anonymous IP addresses or anomalous locations. Restricting access to the Microsoft Graph API by requiring a specific role assignment ensures that only authorized identities can enumerate directory objects, closing the enumeration vector.

Why this answer

Phishing-resistant MFA can be enforced via Conditional Access with authentication strength. Sign-in risk policies in Identity Protection can block sign-ins from risky IPs. To prevent directory enumeration, you can restrict access to the Graph API by requiring a specific role assignment.

Option A is wrong because Security defaults enforce MFA but do not block all enumeration. Option C is wrong because PIM does not block enumeration. Option D is wrong because access reviews do not block enumeration.

Practice this question →