CCNA Implement and manage Microsoft Entra identity and access Questions

Why this answer

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Verified ID is a decentralized identity solution using verifiable credentials, not designed for federating with Google Workspace for sign-in. Option B is wrong because configuring Google as a social identity provider in Microsoft Entra External ID is intended for consumer-facing applications and creates external identities, not for enterprise users with existing Google Workspace accounts. Option C is wrong because Microsoft Entra B2B collaboration creates external guest user objects in the directory, which contradicts the requirement to avoid creating external identities.

Why this answer

How to eliminate wrong answers

Option B is wrong because the `az ad app create` command always creates a new application registration; it does not update an existing one (use `az ad app update` for updates). Option C is wrong because the command does not include any parameter to set the sign-in audience (e.g., `--sign-in-audience`); by default, the audience is set to `AzureADMyOrg` (single-tenant), but the command itself does not configure it—the default applies. Option D is wrong because the command only requests permissions; admin consent requires a separate step, such as using `az ad app permission admin-consent` or the Microsoft Entra admin center.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the daemon is currently using a client secret, and switching to certificate-based authentication is not required by the policy; the policy only mandates rotating secrets every 6 months, not changing authentication methods. Option B is wrong because doing nothing violates the security policy that requires rotating secrets every 6 months, even though the current secret does not expire until 2025-12-31. Option D is wrong because extending the endDateTime of the existing secret does not rotate it; it merely prolongs the life of the same secret, which fails to meet the rotation requirement and increases security risk.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because enabling MFA for users from blocked countries does not block access; it only adds an authentication challenge, which is not a block action and does not meet the requirement to prevent access. Option B is wrong because creating a policy that blocks all locations except allowed countries is inefficient when the list of blocked countries changes frequently, as you would need to constantly update the allowed list, and it is easier to manage a list of blocked countries directly. Option C is wrong because using IP ranges in Conditional Access to block specific country IPs is impractical and inefficient; you would need to manually gather and maintain a list of all IP ranges for each blocked country, which is error-prone and does not leverage the built-in country-based location detection that Named Locations provide.

Why this answer

How to eliminate wrong answers

Option A is wrong because access reviews are used for periodic recertification of role assignments, not for controlling the activation process itself. Option C is wrong because Entitlement Management access packages manage resource access through catalogs and policies, but they do not enforce manager approval and ticket number requirements for Azure AD role activation—that is a PIM role settings feature. Option D is wrong because Conditional Access policies control authentication and session behavior, not the approval workflow or justification requirements for PIM role activation.

Why this answer

How to eliminate wrong answers

Option A is wrong because a Conditional Access policy controls access conditions (e.g., blocking sign-ins after 90 days) but does not perform recurring reviews or automatically remove guest accounts; it only blocks authentication, leaving the guest object and its assignments intact. Option C is wrong because PIM (Privileged Identity Management) settings manage just-in-time privileged role activation and approval, not recurring access reviews for all guest users or auto-removal of unapproved guests. Option D is wrong because creating an access package in entitlement management manages resource access through requests and approvals, but it does not provide a recurring review cycle with auto-removal for all guest users; access packages are for specific resource catalogs, not tenant-wide guest review.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because multi-factor authentication settings control additional verification methods (e.g., phone call, app notification) and do not manage password reuse history. Option C is wrong because account lockout threshold defines the number of failed sign-in attempts before an account is locked, not password reuse restrictions. Option D is wrong because smart lockout settings help block brute-force attacks by locking accounts after repeated failed attempts from unfamiliar locations, but they do not enforce password history or reuse rules.

Why this answer

How to eliminate wrong answers

Option A is wrong because manually exporting the risky sign-ins report every week is not efficient; it requires human intervention and does not automate the delivery to the security team. Option B is wrong because Microsoft Sentinel analytics rules are designed for security incident detection and response, not for generating scheduled reports; using Sentinel for this purpose introduces unnecessary complexity and cost. Option D is wrong because writing a PowerShell script with Microsoft Graph API to retrieve risky sign-ins and send an email weekly is less efficient than using a built-in scheduled workbook, as it requires custom development, maintenance, and handling of authentication and scheduling logic.

Why this answer

How to eliminate wrong answers

Option A is wrong because excluding specific users is not required for a conditional access policy to block non-compliant devices; the policy can target all users and still enforce compliance. Option B is wrong because the policy does not need to include all cloud apps to block non-compliant devices; it can target specific apps and still enforce the grant control. Option D is wrong because session controls (e.g., 'Use app enforced restrictions') are used for session-level restrictions, not for blocking access based on device compliance; the issue here is with grant controls, not session controls.

Why this answer