Troubleshooting practice questions

A company has a hybrid identity setup. A new employee is created in on-premises AD but does not appear in Azure AD after sync. What should the admin check first?

Trap 1: Organizational unit filtering

Could be, but sync status is first check.

Trap 2: DNS configuration

DNS does not affect sync.

Trap 3: License assignment

License doesn't affect sync.

A
Organizational unit filtering
Why wrong: Could be, but sync status is first check.
B
DNS configuration
Why wrong: DNS does not affect sync.
C
License assignment
Why wrong: License doesn't affect sync.
D
Azure AD Connect synchronization status
Sync may be failing or not scheduled.

Question 2hardmultiple choice

You are troubleshooting a user who reports that they cannot access Microsoft Teams. The user has an E3 license assigned, but Teams is grayed out in the app launcher. You verify that the user is assigned the correct license and that the service plan for Teams is enabled. What is the most likely cause?

Trap 1: The user does not have a valid email address.

Email is not required for Teams access, and other services work.

Trap 2: The Teams service plan is disabled in the license.

The scenario states the service plan is enabled.

Trap 3: The user's license has expired.

The user is assigned an E3 license, and no expiry is mentioned.

A
The user has been blocked from signing in to Microsoft Teams in the Microsoft 365 admin center.
Admins can block specific services for a user under user settings.
B
The user does not have a valid email address.
Why wrong: Email is not required for Teams access, and other services work.
C
The Teams service plan is disabled in the license.
Why wrong: The scenario states the service plan is enabled.
D
The user's license has expired.
Why wrong: The user is assigned an E3 license, and no expiry is mentioned.

Question 3hardmultiple choice

A company uses dynamic groups based on department attribute. A user moved from Sales to Marketing but the group membership did not update after 48 hours. What should the admin do first?

Trap 1: Delete and recreate the group

Unnecessary and disruptive.

Trap 2: Run a PowerShell script to update membership

Not supported for dynamic groups.

Trap 3: Wait another 24 hours

Problem persists; admin should take action.

A
Delete and recreate the group
Why wrong: Unnecessary and disruptive.
B
Run a PowerShell script to update membership
Why wrong: Not supported for dynamic groups.
C
Wait another 24 hours
Why wrong: Problem persists; admin should take action.
D
Manually refresh the dynamic group in Azure AD
Manual refresh forces recalculation.

Question 4hardmultiple choice

You are troubleshooting an issue where users from a partner organization cannot access a shared app in your Microsoft Entra ID tenant. The partner uses Microsoft Entra ID with a custom domain. You have configured cross-tenant access settings. Which setting is most likely misconfigured?

Trap 1: Outbound cross-tenant access settings for the partner's tenant ID

Outbound settings control your users accessing partner resources, not the other way.

Trap 2: The app's user assignment and provisioning configuration

If the app is shared, user assignment may be needed but the core issue is likely cross-tenant access.

Trap 3: The partner's inbound cross-tenant access settings for your tenant

The partner's inbound settings control your users accessing their tenant.

A
Outbound cross-tenant access settings for the partner's tenant ID
Why wrong: Outbound settings control your users accessing partner resources, not the other way.
B
The app's user assignment and provisioning configuration
Why wrong: If the app is shared, user assignment may be needed but the core issue is likely cross-tenant access.
C
Default inbound cross-tenant access settings for the partner's tenant ID
Inbound settings determine if external users can access your apps.
D
The partner's inbound cross-tenant access settings for your tenant
Why wrong: The partner's inbound settings control your users accessing their tenant.

Question 5hardmultiple choice

You are troubleshooting why a user cannot access a SharePoint Online site. The user is assigned a Conditional Access policy that requires compliant device, and the device is enrolled in Microsoft Intune but shows as non-compliant. What is the most likely cause?

Trap 1: The device is not enrolled in Microsoft Intune

The device is enrolled but non-compliant.

Trap 2: The Conditional Access policy is not applied to SharePoint Online

The policy targets SharePoint Online.

Trap 3: The user does not have an Intune license

The device is enrolled, so the user has a license.

A
The device is non-compliant due to missing security updates
Non-compliance blocks access via Conditional Access.
B
The device is not enrolled in Microsoft Intune
Why wrong: The device is enrolled but non-compliant.
C
The Conditional Access policy is not applied to SharePoint Online
Why wrong: The policy targets SharePoint Online.
D
The user does not have an Intune license
Why wrong: The device is enrolled, so the user has a license.

Question 6easymultiple choice

You are troubleshooting a user who cannot sign in to Microsoft Teams. Sign-in logs show error code 53003 with additional details 'Blocked by Conditional Access'. The user is a member of a group that is excluded from the Conditional Access policy. What is the most likely cause?

Trap 1: The Conditional Access policy is in Report-only mode.

Report-only does not block.

Trap 2: The user's group membership has not yet been updated in the token.

Token refresh would include current groups.

Trap 3: The user's device is not compliant.

Device compliance would show different error.

A
The Conditional Access policy is in Report-only mode.
Why wrong: Report-only does not block.
B
The user's group membership has not yet been updated in the token.
Why wrong: Token refresh would include current groups.
C
The user's device is not compliant.
Why wrong: Device compliance would show different error.
D
The user is a member of an included group via nested group membership.
Nested groups can cause policy application despite exclusion.

Question 7hardmultiple choice

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive email. You have a DLP policy that blocks emails containing credit card numbers. However, users report that some legitimate emails with credit card numbers are being blocked, while others with similar content are allowed. You need to investigate the discrepancy and ensure consistent enforcement. What should you do first?

Trap 1: Use the Exchange admin center message trace to see if the emails…

Message trace does not show DLP rule matches.

Trap 2: Check the audit log for DLP rule matches to identify the specific…

Audit log can show matches but is not the most efficient first step for false positives.

Trap 3: Review the DLP reports in the Microsoft Purview compliance portal…

Reports show aggregate data but not per-user false positive details.

A
Use the Exchange admin center message trace to see if the emails were blocked by DLP.
Why wrong: Message trace does not show DLP rule matches.
B
Check the audit log for DLP rule matches to identify the specific emails blocked.
Why wrong: Audit log can show matches but is not the most efficient first step for false positives.
C
Review the DLP reports in the Microsoft Purview compliance portal to analyze the blocked emails.
Why wrong: Reports show aggregate data but not per-user false positive details.
D
Enable policy tips in test mode for the DLP policy and instruct users to report false positives.
This allows you to identify false positives without blocking, then refine the policy.