Scenario practice questions

You need to design a solution to synchronize on-premises Active Directory users to Microsoft Entra ID for hybrid identity. Which tool should you use?

Trap 1: Microsoft Identity Manager (MIM)

MIM is an identity and access management solution that automates lifecycle workflows, self-service, and access certification, and it does include a Synchronization Service. However, it is designed for complex, customized provisioning scenarios such as HR-driven attribute distribution or multi-forest integration, not as the standard, recommended tool for routinely synchronizing a single on-premises Active Directory forest to Entra ID. Microsoft's default sync utility for that is Entra Connect, making MIM an over-engineered and rarely-correct choice for this requirement.

Trap 2: Microsoft Entra Connect Cloud Sync

Microsoft Entra Connect Cloud Sync uses a lightweight agent to sync users and groups, and it's especially useful for merging multiple disconnected forests or replacing existing sync solutions in branch environments. However, it is not the general-purpose default for a typical on-premises AD to Entra ID deployment; Microsoft recommends Entra Connect for common scenarios that require a single, feature-complete sync engine. Cloud Sync lacks some advanced capabilities like device writeback and is intended for specific topologies, so it's incorrect here.

Trap 3: Active Directory Federation Services (AD FS)

AD FS is a federation service that authenticates users by forwarding their claims to trusted relying parties, enabling single sign-on for web applications across organizational boundaries. It does not replicate directory objects, passwords, or groups; it only processes authentication requests. Therefore, it cannot synchronize on-premises AD to Entra ID and is fundamentally a different identity technology built for federated access, not directory synchronization.

A
Microsoft Identity Manager (MIM)
Why wrong: MIM is an identity and access management solution that automates lifecycle workflows, self-service, and access certification, and it does include a Synchronization Service. However, it is designed for complex, customized provisioning scenarios such as HR-driven attribute distribution or multi-forest integration, not as the standard, recommended tool for routinely synchronizing a single on-premises Active Directory forest to Entra ID. Microsoft's default sync utility for that is Entra Connect, making MIM an over-engineered and rarely-correct choice for this requirement.
B
Microsoft Entra Connect
Microsoft Entra Connect is the primary, purpose-built tool for synchronizing on-premises Active Directory identities to Microsoft Entra ID. It replicates user, group, and device objects, and supports password hash synchronization, pass-through authentication, and federation integration. As the successor to DirSync and Azure AD Sync, it's the standard first-party solution for hybrid identity, and it is the correct choice when a straightforward, sanctioned sync mechanism is required.
C
Microsoft Entra Connect Cloud Sync
Why wrong: Microsoft Entra Connect Cloud Sync uses a lightweight agent to sync users and groups, and it's especially useful for merging multiple disconnected forests or replacing existing sync solutions in branch environments. However, it is not the general-purpose default for a typical on-premises AD to Entra ID deployment; Microsoft recommends Entra Connect for common scenarios that require a single, feature-complete sync engine. Cloud Sync lacks some advanced capabilities like device writeback and is intended for specific topologies, so it's incorrect here.
D
Active Directory Federation Services (AD FS)
Why wrong: AD FS is a federation service that authenticates users by forwarding their claims to trusted relying parties, enabling single sign-on for web applications across organizational boundaries. It does not replicate directory objects, passwords, or groups; it only processes authentication requests. Therefore, it cannot synchronize on-premises AD to Entra ID and is fundamentally a different identity technology built for federated access, not directory synchronization.

Question 2mediummulti select

Which TWO actions should you take to implement a zero-trust identity strategy in Microsoft Entra ID?

Trap 1: Enable single sign-on for all applications

SSO is about convenience, not zero-trust.

Trap 2: Implement passwordless authentication for all users

Passwordless is good but not a required zero-trust action.

Trap 3: Synchronize all on-premises identities to the cloud

Synchronization is unrelated to zero-trust.

A
Enable single sign-on for all applications
Why wrong: SSO is about convenience, not zero-trust.
B
Require multi-factor authentication for all users
MFA is a key zero-trust principle.
C
Implement passwordless authentication for all users
Why wrong: Passwordless is good but not a required zero-trust action.
D
Synchronize all on-premises identities to the cloud
Why wrong: Synchronization is unrelated to zero-trust.
E
Configure Conditional Access policies based on user risk and device compliance
Conditional Access enforces zero-trust policies.

Question 3hardmultiple choice

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. The policy is enabled but users who are detected as high risk are still able to sign in. What is the most likely reason?

Exhibit

{
  "properties": {
    "displayName": "Block high-risk sign-ins",
    "state": "enabled",
    "conditions": {
      "userRiskLevels": ["high"],
      "signInRiskLevels": ["high"],
      "applications": {
        "includeApplications": ["All"]
      }
    },
    "grantControls": {
      "builtInControls": ["block"]
    }
  }
}

Trap 1: The policy state is set to 'enabled' but not 'enforced'

There is no 'enforced' state; enabled means it's on.

Trap 2: The user risk level is set to 'high' but sign-in risk is 'medium'

Both are set to high.

Trap 3: The grant control is set to 'block' but should be 'require MFA'

Block is correct for high risk.

A
No users or groups are assigned to the policy
The exhibit does not show user assignment; if none, the policy won't apply.
B
The policy state is set to 'enabled' but not 'enforced'
Why wrong: There is no 'enforced' state; enabled means it's on.
C
The user risk level is set to 'high' but sign-in risk is 'medium'
Why wrong: Both are set to high.
D
The grant control is set to 'block' but should be 'require MFA'
Why wrong: Block is correct for high risk.

Question 4mediummulti select

Your organization uses Microsoft Entra ID and Microsoft Intune. You need to design a solution that allows only hybrid Azure AD joined devices to access a sensitive application. The solution must also require that the device is compliant with company policies. Which two components should you configure? (Choose TWO.)

Trap 1: Intune app protection policy

App protection policies are for app-level data protection, not device access.

Trap 2: Conditional Access policy with 'Require multifactor authentication'

MFA is not specified in the requirements.

Trap 3: Intune device enrollment

Enrollment is a prerequisite but does not enforce access control.

A
Intune app protection policy
Why wrong: App protection policies are for app-level data protection, not device access.
B
Conditional Access policy with 'Require multifactor authentication'
Why wrong: MFA is not specified in the requirements.
C
Conditional Access policy with 'Require hybrid Azure AD joined device'
This ensures only hybrid Azure AD joined devices can access the application.
D
Intune device enrollment
Why wrong: Enrollment is a prerequisite but does not enforce access control.
E
Intune device compliance policy
Compliance policies define the security requirements for devices.

Question 5easymultiple choice

Your organization has a Microsoft 365 E5 subscription and wants to detect insider data exfiltration attempts. You need to design a solution that can identify users copying sensitive data to personal cloud storage services. Which Microsoft Purview capability should you use?

Trap 1: Data Loss Prevention (DLP) policies

Incorrect. DLP policies prevent data from being shared but do not detect exfiltration attempts based on user behavior patterns.

Trap 2: eDiscovery (Premium)

Incorrect. eDiscovery (Premium) is for legal discovery and investigation, not for detecting real-time exfiltration attempts.

Trap 3: Communication Compliance

Incorrect. Communication Compliance focuses on inappropriate communications, not data exfiltration activities.

A
Data Loss Prevention (DLP) policies
Why wrong: Incorrect. DLP policies prevent data from being shared but do not detect exfiltration attempts based on user behavior patterns.
B
eDiscovery (Premium)
Why wrong: Incorrect. eDiscovery (Premium) is for legal discovery and investigation, not for detecting real-time exfiltration attempts.
C
Communication Compliance
Why wrong: Incorrect. Communication Compliance focuses on inappropriate communications, not data exfiltration activities.
D
Insider Risk Management
Correct. Insider Risk Management uses behavioral analytics to detect risky activities like copying data to personal cloud storage.

Question 6mediummultiple choice

Wide World Importers uses Azure Active Directory (now Microsoft Entra ID) and Microsoft 365. They have a hybrid identity with password hash sync. They want to implement a passwordless authentication strategy to improve security and user experience. They have a mix of Windows 10/11 devices and mobile devices (iOS/Android). They also have some shared computers in kiosk mode. The solution must support all user scenarios and align with Microsoft's authentication best practices. What should you recommend?

Trap 1: Use SMS-based authentication for all users

SMS is not passwordless; OATH tokens are an extra cost.

Trap 2: Implement Windows Hello for Business for all Windows devices

Smart cards are not practical for mobile devices; mobile devices need Authenticator.

Trap 3: Use the Microsoft Authenticator app for all users

Authenticator alone does not cover Windows Hello for Business for Windows devices.

A
Use SMS-based authentication for all users. Deploy OATH tokens for shared computers. Implement Azure AD Conditional Access to require passwordless for admins only.
Why wrong: SMS is not passwordless; OATH tokens are an extra cost.
B
Implement Windows Hello for Business for all Windows devices. Use smart cards for mobile devices. Use FIDO2 keys for shared computers.
Why wrong: Smart cards are not practical for mobile devices; mobile devices need Authenticator.
C
Implement Windows Hello for Business for Windows 10/11 devices. Deploy Microsoft Authenticator for mobile devices for passwordless sign-in. Use FIDO2 security keys for shared computers and kiosk scenarios. Enable combined registration for self-service password reset and Microsoft Authenticator.
Comprehensive passwordless approach covering all device types.
D
Use the Microsoft Authenticator app for all users. Configure passwordless sign-in with the app. Use QR codes for kiosk computers.
Why wrong: Authenticator alone does not cover Windows Hello for Business for Windows devices.

Question 7easymultiple choice

A company uses Azure Policy to enforce that all storage accounts must have HTTPS traffic only. They assign a built-in policy to audit this setting. A developer creates a new storage account with HTTP enabled, and the policy reports it as non-compliant. What should the company do to automatically remediate this violation?

Trap 1: Enable Azure Security Center's just-in-time access for storage…

Azure Security Center's just-in-time (JIT) access is scoped to virtual machine management ports (RDP/SSH), reducing the attack surface of those VMs by requiring timed approval. Storage accounts are PaaS resources that do not expose such ports, and JIT cannot modify storage account properties like the supportsHttpsTrafficOnly flag. Therefore, this control is unrelated to enforcing or remediating HTTPS-only settings on storage accounts.

Trap 2: Change the policy effect to 'Deny' to prevent creation of…

Changing the policy effect to 'Deny' will only block new or updated storage accounts that do not meet the HTTPS-only requirement at creation time. It has no effect on existing storage accounts that were already created without the setting, leaving them permanently non-compliant unless someone manually changes them. Since the goal is automatic remediation of all non-compliant resources, Deny alone is insufficient.

Trap 3: Ask the developer to manually enable HTTPS-only on the storage…

Asking the developer to manually enable HTTPS-only provides no automated enforcement, audit trail, or ongoing compliance check. It depends on human action and can be easily missed or delayed, especially across many accounts. The scenario requires a policy-based automatic remediation mechanism, not a one-time manual request.

A
Enable Azure Security Center's just-in-time access for storage accounts.
Why wrong: Azure Security Center's just-in-time (JIT) access is scoped to virtual machine management ports (RDP/SSH), reducing the attack surface of those VMs by requiring timed approval. Storage accounts are PaaS resources that do not expose such ports, and JIT cannot modify storage account properties like the supportsHttpsTrafficOnly flag. Therefore, this control is unrelated to enforcing or remediating HTTPS-only settings on storage accounts.
B
Change the policy effect to 'Deny' to prevent creation of non-compliant storage accounts.
Why wrong: Changing the policy effect to 'Deny' will only block new or updated storage accounts that do not meet the HTTPS-only requirement at creation time. It has no effect on existing storage accounts that were already created without the setting, leaving them permanently non-compliant unless someone manually changes them. Since the goal is automatic remediation of all non-compliant resources, Deny alone is insufficient.
C
Ask the developer to manually enable HTTPS-only on the storage account.
Why wrong: Asking the developer to manually enable HTTPS-only provides no automated enforcement, audit trail, or ongoing compliance check. It depends on human action and can be easily missed or delayed, especially across many accounts. The scenario requires a policy-based automatic remediation mechanism, not a one-time manual request.
D
Create a new policy assignment with a 'deployIfNotExists' effect that enables HTTPS-only.
A policy assignment with the deployIfNotExists effect triggers remediation when Azure Policy evaluates an existing storage account that lacks HTTPS-only. It deploys a nested Microsoft.Storage/storageAccounts resource to set the supportsHttpsTrafficOnly property to true, bringing the account into compliance automatically. This approach, often paired with a remediation task, provides continuous and scalable enforcement for both existing and newly created accounts.