Courseiva

CCNA Describe the capabilities of Microsoft Entra Questions

75 of 314 questions · Page 1/5 · Describe the capabilities of Microsoft Entra · Answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selecteasy

Which TWO scenarios are addressed by Microsoft Entra ID Protection? (Choose two.)

Select 2 answers
A.Detecting leaked credentials on the dark web
B.Reviewing group membership assignments
C.Enforcing device compliance policies
D.Resetting forgotten passwords
E.Blocking sign-ins from anonymous IP addresses
AnswersA, E

ID Protection monitors for credential leaks.

Why this answer

Microsoft Entra ID Protection uses machine learning and heuristic algorithms to detect leaked credentials by monitoring known credential dumps on the dark web. When a user's credentials appear in a breach, ID Protection can automatically force a password reset or block sign-ins. Additionally, ID Protection can block sign-ins from anonymous IP addresses (e.g., Tor or anonymous VPNs) as part of its risk-based conditional access policies.

These two capabilities—detecting leaked credentials and blocking sign-ins from anonymous IP addresses—are core risk detection and remediation features of Identity Protection.

Exam trap

The trap here is confusing Identity Protection's risk detection and remediation capabilities with other Microsoft Entra features like SSPR, access reviews, or device compliance, leading candidates to select options that are not part of the Identity Protection service.

Practice this question →
2
Multi-Selecteasy

Which TWO capabilities are provided by Microsoft Entra External ID? (Choose two.)

Select 2 answers
A.Support for social identity providers like Google
B.Mobile device management
C.Collaboration with external users from partner organizations
D.On-premises server monitoring
E.Identity risk detection
AnswersA, C

Microsoft Entra External ID, specifically through its Azure AD B2C capabilities, enables organizations to allow customers and consumers to sign up and sign in to applications using their existing social accounts, such as Google, Facebook, or Microsoft accounts. This feature simplifies the user experience by leveraging familiar identity providers, reducing the need for users to create and manage new credentials. It integrates these external identities seamlessly into the application's authentication flow, providing a flexible and user-friendly access method.

Why this answer

Options A and C are correct. Microsoft Entra External ID enables collaboration with external users from partner organizations (option C) and supports social identity providers like Google, Facebook, and Microsoft accounts (option A). Option B is incorrect because mobile device management is handled by Microsoft Intune, not Entra External ID.

Option D is incorrect because on-premises server monitoring is not a capability of Entra External ID; it is unrelated to identity and access management. Option E is incorrect because identity risk detection is part of Microsoft Entra Identity Protection, not External ID.

Practice this question →
3
MCQmedium

A company uses Microsoft Entra ID. The security team wants to configure automated actions when user sign-ins are detected as high risk due to anonymized IP addresses or leaked credentials. They need to automatically block the sign-in or force a password change based on risk level. Which Microsoft Entra ID feature should they use?

A.Privileged Identity Management
B.Identity Protection
C.Azure AD Connect
D.Self-service password reset
AnswerB

Microsoft Entra ID Protection is a crucial tool for automating the detection and remediation of identity-based risks. It leverages machine learning to identify suspicious activities such as sign-ins from unfamiliar locations, leaked credentials, or infected devices. Based on configured risk policies, it can automatically enforce actions like blocking access, requiring multi-factor authentication, or forcing a password reset, thereby protecting user accounts proactively.

Why this answer

Microsoft Entra ID Protection is the correct feature because it automates the detection and remediation of identity-based risks, including sign-ins from anonymized IP addresses and leaked credentials. It allows administrators to configure conditional access policies that automatically block high-risk sign-ins or force a password change based on the risk level (e.g., low, medium, high). This directly matches the security team's requirement for automated actions tied to risk detection.

Exam trap

The trap here is that candidates often confuse Identity Protection's risk-based automation with Privileged Identity Management's role-based controls, mistakenly thinking PIM handles all security automation for identities.

Why the other options are wrong

A

Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles in Microsoft Entra ID, but it does not detect or automatically respond to risky sign-ins based on anonymized IP addresses or leaked credentials.

C

Azure AD Connect is used for hybrid identity synchronization between on-premises Active Directory and Azure AD, not for detecting or responding to risky sign-ins based on anonymized IP addresses or leaked credentials.

D

Self-service password reset (SSPR) allows users to reset their own passwords but does not include automated risk-based actions like blocking sign-ins or forcing password changes based on detected risk levels from anonymized IPs or leaked credentials.

Practice this question →
4
MCQmedium

Your company is implementing a new application that requires users to authenticate using Microsoft Entra ID. The security team wants to enforce multifactor authentication (MFA) for all users accessing this application, but only when they are connecting from an untrusted network. Which conditional access policy should you configure?

A.Session control: 'Use app enforced restrictions' to block access from untrusted networks.
B.Grant control: 'Require multifactor authentication' with a condition on 'Locations' set to 'All trusted locations' as exclusion.
C.Assignments: 'Users and groups' including all users, then grant control: 'Require multifactor authentication' without conditions.
D.Grant control: 'Require device to be marked as compliant' with a condition on 'Client apps'.
AnswerB

This configuration correctly addresses the requirement by leveraging Conditional Access's powerful location-based targeting. By setting the 'Locations' condition to 'Any location' and then explicitly *excluding* 'All trusted locations', the policy precisely targets only connections originating from untrusted networks. The 'Require multifactor authentication' grant control then ensures that users attempting to access the application from these untrusted networks must successfully complete an MFA challenge, significantly enhancing security for high-risk access attempts.

Why this answer

It configures a Conditional Access policy that grants access only when MFA is performed, and excludes trusted network locations. This ensures that MFA is enforced only when users connect from untrusted networks, meeting the security team's requirement.

Exam trap

The trap here is that candidates often confuse 'Grant control' with 'Session control' or overlook the need to exclude trusted locations, leading them to select an option that either enforces MFA everywhere or uses an inappropriate control like device compliance.

How to eliminate wrong answers

Option A is wrong because session control 'Use app enforced restrictions' does not enforce MFA; it relies on the application itself to enforce restrictions, which is not the same as requiring MFA via Conditional Access. Option C is wrong because it requires MFA for all access attempts without any location condition, which would enforce MFA even from trusted networks, violating the requirement to only enforce MFA from untrusted networks. Option D is wrong because it requires device compliance rather than MFA, and the condition on 'Client apps' does not address the location-based requirement for MFA enforcement.

Practice this question →
5
MCQmedium

Refer to the exhibit. You are reviewing a risk detection report in Microsoft Entra Identity Protection. The report shows a user with high risk level and two risk events. What does the status 'remediated' indicate?

A.The risk is still active and requires investigation.
B.The risk has been resolved by a remediation action such as password reset.
C.The user's account has been confirmed as compromised.
D.The risk was dismissed by an administrator as false positive.
AnswerB

When a risk is marked as 'Remediated,' it signifies that a specific security incident or vulnerability has been successfully resolved through an appropriate action. This could involve an automated response, such as forcing a password reset for a compromised user, or a manual intervention by an administrator to mitigate the identified threat. The remediation action effectively neutralizes the detected risk, restoring the security posture.

Why this answer

In Microsoft Entra Identity Protection, the 'remediated' status indicates that the risk associated with the user has been resolved through an automated or manual remediation action, such as a password reset or completion of a multi-factor authentication (MFA) challenge. This means the detected risk event is no longer considered active, and the user's account has been brought back to a secure state. Option B correctly identifies that the risk was resolved by a remediation action.

Exam trap

The trap here is that candidates often confuse 'remediated' with 'dismissed as false positive', not realizing that 'remediated' implies a corrective action was taken (like password reset), while 'dismissed' means the risk was deemed invalid by an admin.

How to eliminate wrong answers

Option A is wrong because 'remediated' explicitly means the risk is no longer active; an active risk would be labeled 'at risk' or 'active', not 'remediated'. Option C is wrong because 'remediated' does not confirm compromise; it indicates the risk was mitigated, whereas a confirmed compromise would be shown as 'confirmed compromised' in the report. Option D is wrong because 'remediated' is distinct from 'dismissed as false positive'; a false positive dismissal would be labeled 'dismissed' or 'false positive', not 'remediated'.

Practice this question →
6
Drag & Dropmedium

Sequence the steps to set up Microsoft Sentinel for a new workspace.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Setting up Sentinel requires a Log Analytics workspace, enabling Sentinel, connecting sources, creating rules, and automating responses.

Practice this question →
7
MCQeasy

A company uses Microsoft Entra ID for identity management. They want to allow employees to sign in using their existing Facebook credentials. Which feature should they configure?

A.Microsoft Entra Privileged Identity Management
B.Microsoft Entra External Identities
C.Microsoft Entra Conditional Access
D.Microsoft Entra Identity Protection
AnswerB

External Identities allows federation with social identity providers like Facebook.

Why this answer

Microsoft Entra External Identities is the feature that allows configuring social identity providers like Facebook as authentication sources. While it is primarily designed for external users (guests/customers), it can also be used for internal employees if the organization chooses to allow federation with social identity providers. The question tests whether you know that External Identities handles social identity provider integration, regardless of the user type.

Exam trap

The trap here is that candidates often confuse External Identities (which handles external and social identity providers) with Conditional Access or Identity Protection, mistakenly thinking those features can directly enable social login, when in fact they only enforce policies or detect risks after authentication is configured.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Privileged Identity Management (PIM) is used for managing, controlling, and monitoring access to privileged roles in Microsoft Entra ID, not for configuring external identity providers like Facebook. Option C is wrong because Microsoft Entra Conditional Access enforces policies based on signals such as user location or device compliance, but it does not configure or enable social identity providers for authentication. Option D is wrong because Microsoft Entra Identity Protection detects and remediates identity-based risks (e.g., leaked credentials or anomalous sign-ins), but it does not allow integration with external identity providers like Facebook.

Practice this question →
8
MCQhard

You need to implement a solution that allows users to access cloud applications without entering a password, using Windows Hello for Business. Which Microsoft Entra feature integrates with Windows Hello for Business?

A.Conditional Access
B.Microsoft Entra ID
C.FIDO2 security keys
D.Microsoft Authenticator
AnswerB

Microsoft Entra ID is the cloud-based identity and access management service that directly supports and integrates with Windows Hello for Business. It serves as the identity provider where users register their Windows Hello for Business credentials, such as biometrics or PINs, which are securely tied to their Entra ID account. This deep integration allows users to seamlessly sign in to Windows devices and access Entra ID-protected resources using their robust Windows Hello for Business credentials.

Why this answer

Windows Hello for Business integrates with Microsoft Entra ID (formerly Azure AD) to enable passwordless authentication. When a user enrolls a device with Windows Hello for Business, the biometric or PIN credential is bound to the device's TPM and linked to the user's identity in Microsoft Entra ID, allowing seamless access to cloud applications without a password.

Exam trap

The trap here is that candidates often confuse the authentication method (Windows Hello for Business) with the underlying identity provider (Microsoft Entra ID), mistakenly selecting FIDO2 security keys or Microsoft Authenticator as the integrating feature instead of recognizing that Microsoft Entra ID is the core directory service that stores the credential and validates the authentication.

How to eliminate wrong answers

Option A is wrong because Conditional Access is a policy engine that enforces access controls (e.g., requiring MFA or compliant devices) but does not directly integrate with Windows Hello for Business for passwordless authentication. Option C is wrong because FIDO2 security keys are a separate passwordless authentication method that can be used with Microsoft Entra ID, but they are not the feature that integrates with Windows Hello for Business. Option D is wrong because Microsoft Authenticator is a mobile app used for MFA or passwordless phone sign-in, but it is not the underlying Microsoft Entra feature that enables Windows Hello for Business integration.

Practice this question →
9
MCQmedium

A company uses Microsoft Entra ID. The IT department has three teams: Helpdesk, Global Administrators, and Security Administrators. The company wants to allow the Helpdesk team to manage password resets and group memberships, but only for users who belong to the 'Sales' organizational unit. Which Microsoft Entra feature should the administrator use to define this delegated administrative scope?

A.Administrative Units
B.Privileged Identity Management (PIM)
C.Conditional Access policies
D.Identity Governance (Access Reviews)
AnswerA

Administrative Units (AUs) in Microsoft Entra ID enable the delegation of administrative permissions over a specific subset of users, groups, or devices. By creating an AU and assigning administrators to it, their management scope is restricted solely to the objects contained within that unit, such as users belonging to a particular department or location. This capability directly addresses the need to decentralize IT administration without granting broad, tenant-wide privileges.

Why this answer

Administrative Units (AUs) in Microsoft Entra ID allow you to delegate administrative permissions scoped to specific organizational units, such as the 'Sales' OU. By placing Sales users into an AU and assigning the Helpdesk team roles like 'Helpdesk Administrator' or 'User Administrator' scoped to that AU, you precisely control which users they can manage for password resets and group memberships. This directly meets the requirement for delegated administrative scope without granting broader tenant-wide permissions.

Exam trap

The trap here is that candidates confuse Privileged Identity Management (PIM) with scope delegation, but PIM controls *when* a role is used (time-bound activation), not *where* it can be applied (scope), which is the core requirement of this question.

How to eliminate wrong answers

Option B (Privileged Identity Management) is wrong because PIM provides just-in-time activation and approval workflows for privileged roles, not the ability to scope administrative permissions to a specific organizational unit. Option C (Conditional Access policies) is wrong because Conditional Access controls authentication and access conditions (e.g., location, device compliance) for sign-ins, not delegated administration of user objects. Option D (Identity Governance with Access Reviews) is wrong because Access Reviews are used to periodically certify user access and group memberships, not to define the scope of administrative delegation.

Practice this question →
10
Multi-Selecthard

Which TWO are capabilities of Microsoft Entra ID Governance? (Choose two.)

Select 2 answers
A.Entitlement Management
B.Self-service password reset
C.Identity Protection
D.Access Reviews
E.Conditional Access
AnswersA, D

Entitlement Management is part of Entra ID Governance.

Why this answer

Entitlement Management and Access Reviews are capabilities of Entra ID Governance. Conditional Access is a separate feature, Identity Protection is security, and SSPR is user self-service.

Practice this question →
11
MCQmedium

A company uses Microsoft Entra ID. The security team wants to automatically respond to risky user behaviors, such as sign-ins from anonymous IP addresses or impossible travel between geographically distant locations within an unrealistic time frame. They need a solution that can automatically trigger actions like forcing a password reset or blocking sign-in for users identified as high risk. Which Microsoft Entra ID capability should they configure?

A.Microsoft Entra Conditional Access
B.Microsoft Entra Identity Protection
C.Microsoft Entra Privileged Identity Management
D.Microsoft Entra Identity Governance
AnswerB

Microsoft Entra Identity Protection is the correct service for detecting identity-based risks and configuring automated responses. It leverages Microsoft's vast threat intelligence to identify suspicious activities like impossible travel, leaked credentials, or unfamiliar sign-in properties. Based on the detected risk level, Identity Protection can automatically enforce actions such as requiring multi-factor authentication, forcing a password reset, or blocking access entirely for compromised or high-risk user accounts, thereby proactively securing identities.

Why this answer

Microsoft Entra Identity Protection is the correct capability because it is specifically designed to detect and automatically respond to risky user behaviors, such as sign-ins from anonymous IP addresses or impossible travel. It uses machine learning to assign risk levels and can trigger automated actions like forcing a password reset or blocking sign-in for high-risk users, aligning directly with the security team's requirements.

Exam trap

The trap here is that candidates often confuse Conditional Access with Identity Protection, but Conditional Access is the enforcement mechanism that requires a risk signal from Identity Protection to trigger automated responses like blocking or password reset.

Why the other options are wrong

A

Conditional Access enforces policies based on signals like location or device state, but it does not automatically detect or respond to risk events like anonymous IP addresses or impossible travel. Identity Protection is required to evaluate risk levels and trigger automated responses.

C

Microsoft Entra Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles in Azure AD, Azure, and other Microsoft Online Services. It does not detect or automatically respond to risky user behaviors like anonymous IP sign-ins or impossible travel.

D

Microsoft Entra Identity Governance focuses on managing user access rights, certifications, and lifecycle, not on detecting and automatically responding to risky sign-in behaviors like anonymous IPs or impossible travel.

Practice this question →
12
MCQeasy

Your organization is using Microsoft Entra ID. You want to provide a single sign-on (SSO) experience for users accessing multiple SaaS applications. Which feature should you implement?

A.Microsoft Entra ID as an identity provider
B.Microsoft Entra application proxy
C.Microsoft Entra myapps portal
D.Microsoft Entra Privileged Identity Management
AnswerA

Microsoft Entra ID functions as a robust cloud-based identity provider (IdP), centralizing user authentication and authorization. When configured for single sign-on (SSO) with a Software as a Service (SaaS) application, Entra ID authenticates the user and then issues a security token, often using protocols like SAML or OpenID Connect, to the SaaS application (the service provider). This federated identity model allows users to access multiple SaaS applications with a single set of credentials, eliminating the need for separate logins and improving security posture.

Why this answer

Microsoft Entra ID acts as an identity provider (IdP) to enable single sign-on (SSO) for SaaS applications. When configured as the IdP, Entra ID authenticates the user once and issues a security token (e.g., SAML 2.0 assertion or OpenID Connect token) that is accepted by the SaaS application, eliminating the need for repeated logins. This is the core mechanism for federated SSO across multiple cloud applications.

Exam trap

The trap here is that candidates confuse the My Apps portal (a user interface for launching apps) with the actual SSO authentication mechanism, but the portal itself does not perform authentication—it relies on Entra ID as the identity provider.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra Application Proxy is a reverse proxy solution for publishing on-premises web applications externally, not for providing SSO to SaaS applications. Option C is wrong because the My Apps portal is a user-facing dashboard that aggregates access to applications, but it does not itself provide the SSO authentication mechanism; it relies on Entra ID as the IdP. Option D is wrong because Privileged Identity Management (PIM) is a feature for managing, controlling, and monitoring access to privileged roles, not for enabling SSO to SaaS applications.

Practice this question →
13
MCQmedium

Your company wants to use Microsoft Entra ID to provide single sign-on (SSO) to a SaaS application that supports SAML 2.0. What should you configure in Microsoft Entra ID?

A.Enable Microsoft Entra ID Domain Services
B.Add the application from the Microsoft Entra ID Gallery in Enterprise applications
C.Configure Microsoft Entra ID Governance
D.Register the application in App registrations
AnswerB

The Microsoft Entra ID Gallery within Enterprise applications offers a vast catalog of pre-integrated software-as-a-service (SaaS) applications, each with pre-configured settings for single sign-on (SSO). Adding an application from this gallery streamlines the setup process, allowing administrators to quickly enable secure access and user provisioning using standards like SAML or OIDC without manual configuration. This approach is ideal for integrating common third-party cloud services, leveraging Microsoft Entra ID as the central identity provider.

Why this answer

Adding the SaaS application from the Microsoft Entra ID Gallery in Enterprise applications is the standard method to configure SAML 2.0-based single sign-on (SSO). The gallery provides pre-integrated templates that include the necessary SAML endpoints, certificates, and attribute mappings, enabling seamless federation between Entra ID and the external application.

Exam trap

The trap here is that candidates confuse App registrations (for custom apps using OAuth/OpenID Connect) with Enterprise applications (for pre-integrated gallery apps using SAML), leading them to select option D instead of the correct B.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Domain Services (formerly Azure AD DS) provides managed domain services like LDAP and Kerberos for legacy applications, not SAML-based SSO for SaaS apps. Option C is wrong because Microsoft Entra ID Governance focuses on identity lifecycle, access reviews, and entitlement management, not the direct configuration of SAML SSO for a specific application. Option D is wrong because App registrations is used for custom application development (OAuth 2.0/OpenID Connect), not for integrating pre-built gallery applications that support SAML 2.0; gallery apps are added via Enterprise applications.

Practice this question →
14
MCQeasy

A company uses Microsoft Entra ID. The security team wants to automatically block sign-ins from IP addresses that exhibit brute-force attack patterns. Which capability should they enable?

A.Microsoft Entra Identity Protection
B.Microsoft Entra Privileged Identity Management
C.Microsoft Entra External Identities
D.Microsoft Entra Conditional Access
AnswerA

Microsoft Entra Identity Protection is the correct choice because it specifically leverages machine learning and heuristic rules to detect potential vulnerabilities affecting identities, such as leaked credentials, impossible travel, or sign-ins from unfamiliar locations. It automatically assesses user and sign-in risk in real-time and can be configured to take automated remediation actions like blocking access, requiring multi-factor authentication, or forcing a password reset, directly addressing the need to detect and block risky sign-ins.

Why this answer

Microsoft Entra Identity Protection is the correct capability because it uses machine learning and heuristic detection to automatically identify and block sign-ins from IP addresses exhibiting brute-force attack patterns, such as repeated failed authentication attempts. It can trigger risk-based policies, including blocking access or requiring multi-factor authentication, without manual intervention. This directly addresses the security team's requirement to automate the response to brute-force patterns.

Exam trap

The trap here is that candidates often confuse Conditional Access (which enforces policies based on conditions) with Identity Protection (which provides the risk detection signals), leading them to select D, even though Conditional Access alone cannot automatically detect brute-force patterns without Identity Protection's risk assessments.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra Privileged Identity Management (PIM) is focused on managing, controlling, and monitoring access to privileged roles (e.g., Global Administrator) through just-in-time activation and approval workflows, not on detecting or blocking brute-force sign-in patterns. Option C is wrong because Microsoft Entra External Identities is designed for managing collaboration with external users (e.g., B2B and B2C scenarios), including identity providers and guest user access, and does not include automated brute-force detection or blocking. Option D is wrong because Microsoft Entra Conditional Access is a policy engine that enforces access controls (e.g., requiring MFA or blocking access) based on conditions like location or device state, but it does not natively detect brute-force attack patterns; it relies on signals from Identity Protection or other sources to trigger such responses.

Practice this question →
15
MCQmedium

A company uses Microsoft Entra ID and wants to automatically detect potential security risks such as leaked credentials and suspicious sign-in patterns. They also need the ability to investigate these risks and configure automated responses based on risk levels. Which Microsoft Entra capability should they use?

A.Microsoft Entra ID Governance
B.Microsoft Entra Identity Protection
C.Microsoft Entra Privileged Identity Management (PIM)
D.Microsoft Entra Domain Services
AnswerB

Microsoft Entra Identity Protection is specifically engineered to detect identity-based risks in real-time, such as impossible travel, sign-ins from infected devices, or leaked credentials. It leverages machine learning and heuristics to identify suspicious activities and calculate a risk level for each sign-in and user. Based on these risk levels, administrators can configure automated policies to enforce actions like requiring multi-factor authentication, forcing a password change, or blocking access entirely, thereby providing automated responses to mitigate threats.

Why this answer

Microsoft Entra Identity Protection is the correct service because it automatically detects potential security risks such as leaked credentials and suspicious sign-in patterns, provides investigation tools (e.g., risk reports and detailed risk event logs), and enables automated responses like conditional access policies that block or require MFA based on risk levels. This directly matches the scenario's requirements for detection, investigation, and automated remediation.

Exam trap

The trap here is confusing Identity Protection (which handles user and sign-in risk detection and automated response) with Privileged Identity Management (PIM), which only manages privileged role activation and does not detect leaked credentials or suspicious sign-in patterns.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Governance focuses on managing identity lifecycle, access reviews, and entitlement management, not on detecting security risks like leaked credentials or suspicious sign-in patterns. Option C is wrong because Microsoft Entra Privileged Identity Management (PIM) is specifically for managing, controlling, and monitoring access to privileged roles (e.g., just-in-time access), not for detecting general user sign-in risks or leaked credentials. Option D is wrong because Microsoft Entra Domain Services provides managed domain services (e.g., LDAP, Kerberos, NTLM) for legacy applications, not risk detection or automated response capabilities.

Practice this question →
16
MCQeasy

Your organization uses Microsoft Entra ID free tier. You need to synchronize user accounts from your on-premises Active Directory to the cloud. You also need to synchronize password hashes so that users can use the same password for cloud and on-premises resources. Which tool should you use?

A.Configure Microsoft Entra Domain Services to sync from on-premises.
B.Use Microsoft Graph API to create users and set passwords.
C.Install Microsoft Entra Connect and enable password hash synchronization.
D.Deploy Active Directory Federation Services (AD FS) to enable single sign-on.
AnswerC

Microsoft Entra Connect is the official Microsoft tool specifically designed to synchronize user identities, groups, and other directory objects from an on-premises Active Directory to Microsoft Entra ID. Enabling password hash synchronization (PHS) within Entra Connect securely hashes and synchronizes user passwords from the on-premises AD to Microsoft Entra ID, allowing users to sign in to cloud services with their existing credentials without requiring additional infrastructure like federation. This is the standard and recommended method for hybrid identity.

Why this answer

Microsoft Entra Connect is the correct tool for synchronizing on-premises Active Directory user accounts to Microsoft Entra ID (formerly Azure AD) and enabling password hash synchronization. Password hash synchronization allows users to use the same password for both on-premises and cloud resources by syncing a hash of the on-premises password to Entra ID, which is supported in the free tier of Entra ID.

Exam trap

The trap here is that candidates often confuse Microsoft Entra Domain Services with Microsoft Entra Connect, thinking that Domain Services can sync from on-premises AD, when in fact it only syncs from Entra ID to the managed domain, not the other way around.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Domain Services (Azure AD DS) provides managed domain services like domain join and Group Policy, but it does not synchronize user accounts from on-premises AD to Entra ID; it syncs from Entra ID to the managed domain, not the reverse. Option B is wrong because the Microsoft Graph API can programmatically create users and set passwords, but it does not provide ongoing synchronization of existing on-premises AD accounts or password hash synchronization; it is an API for manual or scripted operations, not a sync tool. Option D is wrong because Active Directory Federation Services (AD FS) enables single sign-on (SSO) using federation, but it does not synchronize user accounts or password hashes; it relies on an existing identity store and is typically used for federated authentication, not sync.

Practice this question →
17
MCQhard

You are the identity administrator for a large enterprise using Microsoft Entra ID. The company has 50,000 users and recently acquired a smaller company with 2,000 users that uses a third-party identity provider (IdP) based on SAML 2.0. The acquisition must be fully integrated within 30 days. The CISO mandates that all users must use MFA for any access to cloud applications. The acquired company's users currently do not use MFA. You need to choose an approach that minimizes changes to the acquired company's current authentication infrastructure while meeting the MFA requirement. The solution must also allow the acquired company's users to access resources in the parent tenant using their existing credentials. What should you do?

A.Configure B2B collaboration with the acquired company's IdP and enable MFA trust. In the parent tenant, create a Conditional Access policy that requires MFA for guest users.
B.Set up password hash synchronization from the acquired company's IdP to the parent tenant and enable MFA for all sync'ed users.
C.Create new user accounts in the parent tenant for the acquired company's users and assign them Microsoft Entra ID P2 licenses to enable MFA via Conditional Access.
D.Migrate all acquired company users to the parent tenant's on-premises Active Directory and sync them to Microsoft Entra ID. Enable MFA via Conditional Access.
AnswerA

This option leverages Microsoft Entra B2B collaboration with direct federation, allowing users from the acquired company to authenticate using their existing Identity Provider (IdP) without migrating accounts. Enabling MFA trust ensures that the parent tenant can either accept MFA claims from the acquired company's IdP or enforce its own MFA. A Conditional Access policy then specifically targets these guest users, mandating MFA for access to resources, providing a secure and efficient integration.

Why this answer

B2B collaboration allows the acquired company's users to authenticate against their existing SAML 2.0 IdP using their current credentials, minimizing infrastructure changes. By enabling MFA trust, the parent tenant can rely on the MFA claims already issued by the third-party IdP if it supports MFA, but since it does not, you can enforce MFA in the parent tenant via a Conditional Access policy that requires MFA for guest users. This approach meets the CISO's mandate without requiring the acquired company to deploy MFA on their own IdP or migrate users.

Exam trap

The trap here is that candidates often assume B2B collaboration cannot enforce MFA for guest users, or they mistakenly think password hash synchronization is a valid option for a third-party SAML IdP, when in fact PHS is only applicable to on-premises Active Directory environments.

How to eliminate wrong answers

Option B is wrong because password hash synchronization (PHS) requires the acquired company's IdP to be integrated with Microsoft Entra ID via Azure AD Connect, which is designed for on-premises Active Directory, not a third-party SAML 2.0 IdP; PHS also does not allow users to authenticate with their existing IdP credentials. Option C is wrong because creating new user accounts in the parent tenant forces the acquired company's users to manage separate credentials, violating the requirement to use their existing credentials. Option D is wrong because migrating users to the parent tenant's on-premises AD is a complex, time-consuming process that cannot be completed within 30 days and fundamentally changes the acquired company's authentication infrastructure, contradicting the goal of minimizing changes.

Practice this question →
18
MCQmedium

Your company uses Microsoft Entra ID. You need to monitor and detect suspicious sign-in activities, such as sign-ins from anonymous IP addresses or unfamiliar locations. Which Microsoft Entra feature provides this capability?

A.Microsoft Entra audit logs
B.Conditional Access
C.Microsoft Entra Connect
D.Microsoft Entra ID Protection
AnswerD

Microsoft Entra ID Protection is specifically designed to detect, investigate, and remediate identity-based risks. It leverages machine learning and heuristic rules to analyze sign-in and user behavior data in real-time, identifying suspicious patterns such as impossible travel, unfamiliar sign-in properties, or leaked credentials. This service automatically generates risk detections and can trigger automated responses, like requiring multi-factor authentication or blocking access, making it the primary tool for monitoring and protecting against identity threats.

Why this answer

Microsoft Entra ID Protection is the correct answer because it is specifically designed to detect and respond to identity-based risks, including suspicious sign-in activities such as sign-ins from anonymous IP addresses (e.g., Tor network) and unfamiliar locations. It uses machine learning algorithms and heuristic detection to assign a risk level to each sign-in, enabling automated remediation or alerting.

Exam trap

The trap here is that candidates often confuse Conditional Access (a policy enforcement engine) with the detection capability itself, not realizing that Conditional Access relies on risk assessments from ID Protection to act on suspicious sign-ins.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra audit logs record all changes and activities within the tenant (e.g., user creation, role changes) but do not perform real-time risk detection or analysis of sign-in patterns. Option B is wrong because Conditional Access enforces access policies based on conditions (e.g., location, device state) but does not inherently detect suspicious activities; it relies on signals from other services like ID Protection. Option C is wrong because Microsoft Entra Connect is a tool for synchronizing on-premises Active Directory objects to Microsoft Entra ID and has no role in monitoring or detecting sign-in anomalies.

Practice this question →
19
MCQmedium

A company uses Microsoft Entra ID. They want to ensure that only users with a specific role can reset passwords for other users in their organization. Which feature should they use?

A.Privileged Identity Management
B.Conditional Access
C.Administrative Units
D.Identity Protection
AnswerC

Microsoft Entra Administrative Units (AUs) provide a mechanism to delegate administrative permissions over a specific subset of Microsoft Entra objects, such as users, groups, or devices. By creating an AU and adding relevant objects, an organization can assign administrative roles (e.g., User Administrator, Password Administrator) that are scoped only to the members within that unit. This ensures that administrators can manage only the users or groups they are authorized for, preventing them from affecting the entire directory.

Why this answer

Administrative Units allow you to delegate administrative tasks, such as password resets, to users who have a specific role scoped to a subset of users. By assigning the Helpdesk Administrator role to an Administrative Unit, you ensure that only those users can reset passwords for members of that unit, meeting the requirement precisely.

Exam trap

The trap here is that candidates often confuse Privileged Identity Management (PIM) with role-based delegation, but PIM controls when a role is active, not who can perform a specific action on a specific set of users.

How to eliminate wrong answers

Option A is wrong because Privileged Identity Management (PIM) provides time-based and approval-based role activation to reduce standing access, but it does not scope password reset permissions to specific users; it manages role eligibility and activation. Option B is wrong because Conditional Access enforces access controls based on signals like location or device state, but it does not delegate or restrict who can perform administrative tasks like password resets. Option D is wrong because Identity Protection detects and responds to identity-based risks, such as leaked credentials or suspicious sign-ins, but it does not control which users have permission to reset passwords.

Practice this question →
20
MCQeasy

A company uses Microsoft Entra ID. The security manager wants to provide temporary, time-bound elevated access to the Global Administrator role only when needed, and require approval from a designated approver. Which Microsoft Entra ID capability should they use?

A.Microsoft Entra Conditional Access
B.Microsoft Entra Privileged Identity Management (PIM)
C.Microsoft Entra Identity Protection
D.Microsoft Entra Identity Governance (Access Reviews)
AnswerB

Microsoft Entra Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources within Microsoft Entra ID, Azure, and other Microsoft services. It enables just-in-time (JIT) access, allowing users to activate privileged roles only when needed and for a limited duration. PIM enforces time-bound assignments, multi-factor authentication, and approval workflows for role activation, significantly reducing the attack surface associated with standing privileged access.

Why this answer

Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by allowing users to activate the Global Administrator role for a limited, time-bound duration only when needed, and it enforces approval workflows from designated approvers. This directly matches the security manager's requirement for temporary, approval-based elevation.

Exam trap

The trap here is that candidates confuse Conditional Access (which controls sign-in conditions) with PIM (which controls role activation), leading them to pick A because they think 'time-bound' refers to session timeout policies rather than role activation duration.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Conditional Access controls access based on conditions like location or device compliance, but it does not provide time-bound role activation or approval workflows for privileged roles. Option C is wrong because Microsoft Entra Identity Protection detects and responds to identity risks (e.g., leaked credentials, sign-in anomalies) but does not manage privileged role activation or approval. Option D is wrong because Microsoft Entra Identity Governance (Access Reviews) is used for periodic certification of group memberships or role assignments, not for on-demand, time-bound elevation with approval.

Practice this question →
21
MCQmedium

A company uses Microsoft Entra ID. The security team wants to configure a policy so that when a user signs in from an unfamiliar location (not on the company's trusted IP ranges) or from an unfamiliar device, they are prompted for additional verification (e.g., MFA). However, if the sign-in is from a trusted location (e.g., office IP range) and a known device, no additional verification is required. Which Microsoft Entra ID feature should they configure?

A.Microsoft Entra ID Protection
B.Microsoft Entra Conditional Access
C.Microsoft Entra Privileged Identity Management (PIM)
D.Microsoft Entra Access Reviews
AnswerB

Microsoft Entra Conditional Access is the correct solution as it enables granular policy enforcement based on real-time sign-in signals. It allows administrators to define conditions such as user/group, location (via named locations), and device state (e.g., compliant, hybrid Azure AD joined) to determine access. This capability directly supports requiring multi-factor authentication (MFA) for untrusted contexts while explicitly allowing trusted locations and known devices to bypass MFA, aligning perfectly with the scenario's need for conditional authentication.

Why this answer

Microsoft Entra Conditional Access is the correct feature because it allows administrators to define policies that evaluate sign-in context—such as user location (via named locations with trusted IP ranges) and device state (compliant or hybrid Azure AD joined)—and then enforce actions like requiring MFA only when conditions are not met. This directly matches the requirement to prompt for additional verification from unfamiliar locations or devices while skipping it for trusted ones.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID Protection with Conditional Access, but ID Protection provides risk signals (e.g., unfamiliar sign-in properties) that can be used by Conditional Access policies, not the policy engine itself that enforces location- and device-based MFA prompts.

Why the other options are wrong

A

Microsoft Entra ID Protection identifies risks like unfamiliar sign-in properties but does not enforce access policies; it only provides risk signals. Conditional Access is needed to actually require MFA based on those signals.

C

Privileged Identity Management (PIM) manages just-in-time privileged role activation and oversight, not sign-in risk policies based on location or device trust. The described policy requires Conditional Access to evaluate conditions like location and device state before prompting for MFA.

D

Access Reviews are used to review and certify user access rights periodically, not to enforce real-time sign-in policies based on location or device trust.

Practice this question →
22
MCQeasy

Your organization is implementing a Zero Trust security model. Which Microsoft Entra ID capability helps verify the identity of users before granting access to resources?

A.Microsoft Entra ID Connect
B.Microsoft Entra ID Domain Services
C.Microsoft Entra ID Governance
D.Microsoft Entra ID Protection
AnswerD

Microsoft Entra ID Protection is a key component for implementing Zero Trust principles by continuously evaluating user and sign-in risks. It detects potential vulnerabilities affecting identities, such as leaked credentials, and identifies suspicious sign-in activities, like impossible travel or sign-ins from infected devices. By integrating with Conditional Access policies, Entra ID Protection can then enforce adaptive controls, such as requiring multi-factor authentication or blocking access, based on the real-time risk level, thereby ensuring continuous verification before granting access.

Why this answer

Microsoft Entra ID Protection (D) is the correct answer because it directly addresses the Zero Trust principle of 'verify explicitly' by using real-time risk detection and conditional access policies to verify user identity before granting access. It evaluates sign-in risk, user risk, and enforces policies like multi-factor authentication (MFA) or blocking access when suspicious activity is detected, ensuring that only legitimate users can access resources.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID Protection with Microsoft Entra ID Governance, mistakenly thinking that governance policies (like access reviews) verify identity, when in fact governance manages permissions after access is granted, not the real-time verification required by Zero Trust.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Connect is a tool for synchronizing on-premises Active Directory objects to Microsoft Entra ID, not for verifying user identity at access time. Option B is wrong because Microsoft Entra ID Domain Services provides managed domain services like Kerberos and LDAP for legacy applications, but it does not perform identity verification or risk-based access control. Option C is wrong because Microsoft Entra ID Governance focuses on managing identity lifecycle, access reviews, and entitlement management, not on real-time identity verification or risk assessment during authentication.

Practice this question →
23
MCQhard

Your organization plans to migrate from on-premises Active Directory to Microsoft Entra ID. You need to design the identity synchronization strategy to support password hash synchronization and password writeback. Which tool should you use?

A.Microsoft Identity Manager
B.Active Directory Federation Services
C.Microsoft Entra Cloud Sync
D.Microsoft Entra Connect
AnswerD

Microsoft Entra Connect is the comprehensive on-premises agent for synchronizing identities from Active Directory to Microsoft Entra ID, providing robust hybrid identity capabilities. It fully supports password hash synchronization, securely replicating a hash of the on-premises password to the cloud, and crucially, it enables password writeback, allowing self-service password reset (SSPR) changes in Microsoft Entra ID to update the user's password in on-premises Active Directory.

Why this answer

Microsoft Entra Connect is the correct tool because it supports both password hash synchronization and password writeback, which are required for the migration scenario. Password hash sync synchronizes a hash of the on-premises AD password to Entra ID, while password writeback enables password changes in the cloud to be written back to on-premises AD. Entra Connect is the primary hybrid identity tool that integrates on-premises directories with Microsoft Entra ID, offering these features natively.

Exam trap

The trap here is that candidates often confuse Microsoft Entra Cloud Sync with Entra Connect, assuming Cloud Sync supports all the same features, but Cloud Sync lacks password writeback support, making it unsuitable for this requirement.

How to eliminate wrong answers

Option A is wrong because Microsoft Identity Manager (MIM) is an on-premises identity management solution for managing users and groups across multiple directories, but it does not directly support password hash synchronization or password writeback to Entra ID; those features are specific to Entra Connect. Option B is wrong because Active Directory Federation Services (AD FS) is a federation service that provides single sign-on (SSO) and claims-based authentication, but it does not perform password hash synchronization or password writeback; it relies on federation trust rather than password sync. Option C is wrong because Microsoft Entra Cloud Sync is a lightweight agent designed for syncing users from on-premises AD to Entra ID, but it does not support password writeback; password writeback requires the full Entra Connect installation.

Practice this question →
24
MCQmedium

A company wants to prevent users from setting weak passwords that are commonly found in leaked databases. They use Microsoft Entra ID (Microsoft Entra ID). Which feature should they enable?

A.Microsoft Entra ID Protection
B.Microsoft Entra ID Password Protection
C.Microsoft Entra ID Privileged Identity Management
D.Microsoft Entra ID Conditional Access
AnswerB

Microsoft Entra ID Password Protection directly addresses the challenge of weak passwords by preventing users from creating or changing to commonly used, easily guessable, or compromised passwords. It achieves this by maintaining both a globally banned password list, which Microsoft curates based on breach data, and allowing organizations to define their own custom banned password lists. This proactive enforcement occurs at the point of password creation or reset, significantly reducing the risk of password-based attacks.

Why this answer

Microsoft Entra ID Password Protection is the correct feature because it specifically blocks weak passwords by comparing them against a global list of commonly compromised passwords (e.g., from leaked databases) and an optional custom banned password list. This feature enforces password strength at the time of creation or reset, preventing users from setting passwords that appear in known breaches.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID Protection (which alerts on leaked credentials after they are used) with Password Protection (which proactively blocks weak passwords at creation), leading them to choose the risk-detection feature instead of the prevention feature.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Protection focuses on detecting and responding to identity-based risks (e.g., leaked credentials, anomalous sign-ins) but does not enforce password policies or block weak passwords at creation. Option C is wrong because Privileged Identity Management (PIM) manages just-in-time access and approval workflows for privileged roles, not password strength enforcement. Option D is wrong because Conditional Access evaluates sign-in conditions (e.g., location, device compliance) to grant or block access, but it does not validate or block weak passwords during password setting.

Practice this question →
25
MCQmedium

A user reports that they cannot access a critical application, receiving an error that their session has expired. The sign-in logs show the user was prompted for multifactor authentication (MFA) multiple times during the same session. What should an administrator review to reduce these interruptions?

A.Microsoft Entra tenant-wide MFA settings
B.Microsoft Entra Conditional Access session controls
C.Microsoft Entra Identity Protection policies
D.Microsoft Entra Privileged Identity Management settings
AnswerB

Microsoft Entra Conditional Access session controls are specifically designed to manage user sessions after initial authentication, including the frequency of re-authentication and the persistence of browser sessions. By configuring sign-in frequency, administrators can reduce the number of MFA prompts users receive within a defined period, enhancing productivity while maintaining security. These controls provide the granular capability to balance security posture with user experience for specific applications or conditions.

Why this answer

Session controls in Conditional Access policies can be configured to reduce repeated MFA prompts within the same session, such as by adjusting the sign-in frequency or persistent browser session settings. Option A is wrong because tenant-wide MFA settings enforce MFA globally but do not control session-specific behavior. Option C is wrong because Identity Protection focuses on risk-based policies, not directly on session lifetime.

Option D is wrong because Privileged Identity Management manages role activation and assignment, not session controls.

Practice this question →
26
Multi-Selecthard

Your organization uses Microsoft Entra ID. Which THREE authentication methods can be used for passwordless sign-in?

Select 3 answers
A.Microsoft Authenticator (phone sign-in)
B.SMS-based verification
C.FIDO2 security keys
D.Windows Hello for Business
E.Time-based one-time password (TOTP)
AnswersA, C, D

Microsoft Authenticator enables passwordless phone sign-in by leveraging push notifications sent directly to the user's registered mobile device. Users approve the sign-in request on their phone, often secured by a biometric (fingerprint, face ID) or a device PIN. This method eliminates the need to type a password, providing a seamless and highly secure authentication experience by tying identity to a trusted device.

Why this answer

Microsoft Authenticator (phone sign-in) enables passwordless authentication by using a cryptographic key pair tied to the user's device. When signing in, the user approves a notification on their phone, and the Authenticator app signs the challenge with the private key, eliminating the need for a password.

Exam trap

The trap here is that candidates confuse second-factor methods like TOTP or SMS codes with passwordless authentication, but passwordless requires the primary authentication factor to be something you have (device or key) without needing a password at all.

Practice this question →
27
MCQeasy

Your organization is deploying Microsoft Entra ID. You need to ensure that users can sign in using their existing on-premises Active Directory credentials without creating new cloud passwords. Which feature should you configure?

A.Microsoft Entra Connect
B.Microsoft Entra Multifactor Authentication
C.Microsoft Entra Self-Service Password Reset
D.Microsoft Entra Privileged Identity Management (PIM)
AnswerA

Microsoft Entra Connect is the essential tool for establishing and maintaining hybrid identity, synchronizing on-premises Active Directory users, groups, and contacts into Microsoft Entra ID. It facilitates seamless sign-in experiences by enabling features like Password Hash Synchronization (PHS), Pass-through Authentication (PTA), or federation with ADFS, allowing users to authenticate to cloud services using their existing on-premises credentials. This ensures a consistent identity and access management across both environments.

Why this answer

Microsoft Entra Connect is the correct feature because it synchronizes on-premises Active Directory identities to Microsoft Entra ID and enables password hash synchronization or pass-through authentication, allowing users to sign in with their existing on-premises credentials without creating new cloud passwords. This ensures a seamless hybrid identity experience where the same username and password work for both on-premises and cloud resources.

Exam trap

The trap here is that candidates often confuse Microsoft Entra Connect with Microsoft Entra Multifactor Authentication, thinking that MFA alone can authenticate against on-premises credentials, but MFA only provides an additional verification step and does not handle primary authentication against on-premises Active Directory.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra Multifactor Authentication adds a second layer of security but does not synchronize or authenticate on-premises credentials; it requires an existing identity in the cloud. Option C is wrong because Microsoft Entra Self-Service Password Reset allows users to reset their own passwords but does not enable sign-in with existing on-premises credentials; it relies on an already synchronized or cloud-only identity. Option D is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time access and role assignments, not credential synchronization or authentication against on-premises Active Directory.

Practice this question →
28
Multi-Selectmedium

A company uses Microsoft Entra ID. They need to implement a Conditional Access policy for the finance application that requires multifactor authentication (MFA) when a user accesses the app from an unmanaged device. Additionally, they want to block access if the sign-in risk level is high. Which two grant controls should they configure in the policy? (Select two.)

Select 2 answers
A.Require multi-factor authentication
B.Block access
C.Require device to be marked as compliant
D.Require approved client app
AnswersA, B

This grant control mandates that users successfully complete an additional verification step, such as a phone call, text message, or authenticator app notification, before gaining access to the resource. When applied as a Conditional Access policy, it effectively elevates the authentication strength for specific conditions, like sign-ins from unmanaged devices or high-risk locations. This ensures that even if a primary credential is compromised, unauthorized access is prevented by requiring a second, distinct factor.

Why this answer

The scenario explicitly requires multifactor authentication (MFA) when a user accesses the finance application from an unmanaged device. In Microsoft Entra ID Conditional Access, the 'Require multi-factor authentication' grant control enforces MFA as part of the policy, directly meeting this requirement. Option B is correct because the scenario also requires blocking access if the sign-in risk level is high.

The 'Block access' grant control is the appropriate control to deny authentication when a high-risk sign-in is detected, as it overrides any other grant controls.

Exam trap

The trap here is that candidates often confuse 'Require device to be marked as compliant' with 'unmanaged device' conditions, but unmanaged devices are not necessarily non-compliant; the policy specifically targets unmanaged devices for MFA, not compliance enforcement.

Practice this question →
29
Matchingmedium

Match each compliance term to its correct definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Where data is stored geographically

Data subject to laws of the country where it is stored

Process of identifying and delivering electronic information for legal cases

Preserve data for litigation purposes

Categorizing data based on sensitivity

Why these pairings

Compliance terms in Microsoft 365 cover data protection, communication restrictions, data governance, and legal discovery. DLP prevents data leaks, Information Barriers control internal communication, Records Management handles retention, and eDiscovery supports legal processes.

Practice this question →
30
MCQhard

A company has Microsoft Entra ID with Conditional Access policies. Users report being prompted for MFA every time they access the company's CRM app from their corporate laptops. However, the policy is configured to require MFA only for untrusted locations. What is the most likely cause?

A.Users are authenticating via device code flow.
B.The Conditional Access policy has the 'Persistent browser session' setting enabled.
C.The policy is blocking legacy authentication.
D.The corporate laptops are not marked as compliant devices.
AnswerD

If corporate laptops are not marked as compliant devices, Conditional Access policies can be configured to require device compliance as a grant control. When a device fails to meet the defined compliance standards (e.g., missing security updates, unencrypted), the Conditional Access policy will enforce re-authentication, including MFA, or even block access until the device's compliance status is remediated.

Why this answer

The most likely cause is that the corporate laptops are not marked as compliant devices. Conditional Access policies can use device compliance as a condition; if the laptops are not compliant, they may be treated as untrusted, triggering MFA even if the location is trusted. Device compliance is determined by Microsoft Intune or another MDM, and without it, the policy's location condition may not override the device state.

Exam trap

The trap here is that candidates assume location is the only condition evaluated, but Conditional Access policies can combine multiple conditions, and device compliance often overrides location when devices are not trusted.

How to eliminate wrong answers

Option A is wrong because device code flow is an authentication method for devices without browsers (e.g., CLI tools) and does not inherently bypass location-based MFA conditions. Option B is wrong because the 'Persistent browser session' setting controls session lifetime, not the frequency of MFA prompts based on location; it would not cause repeated MFA on every access. Option C is wrong because blocking legacy authentication would prevent access entirely for non-modern auth clients, not cause repeated MFA prompts for users already using modern authentication.

Practice this question →
31
MCQeasy

A user reports that they cannot access Microsoft 365 apps from a public Wi-Fi network. The admin sees a Conditional Access policy requiring a compliant device and a trusted location. Which component enforces this policy?

A.Microsoft Entra ID
B.Microsoft Defender for Cloud Apps
C.Microsoft Entra Conditional Access
D.Microsoft Intune
AnswerA

Correct. Microsoft Entra ID performs enforcement of Conditional Access policies during authentication.

Why this answer

Microsoft Entra ID enforces Conditional Access policies during the authentication process. While Conditional Access is where policies are defined, the actual enforcement—checking conditions like location and device compliance—occurs within the Microsoft Entra ID service when a token is issued.

Exam trap

Candidates often think Conditional Access is the enforcer, but it is the policy engine that defines rules. The enforcement happens within Microsoft Entra ID during authentication.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID is the identity and authentication service that processes the Conditional Access policy, but it is not the component that 'enforces' the policy; the policy is defined in the Conditional Access feature of Microsoft Entra ID. Option B is wrong because Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility and control over cloud app usage, but it does not enforce Conditional Access policies for initial sign-in to Microsoft 365 apps. Option D is wrong because Microsoft Intune is a Mobile Device Management (MDM) and Mobile Application Management (MAM) service that manages device compliance, but it does not enforce Conditional Access policies; it provides the compliance status that Conditional Access policies can use as a condition.

Practice this question →
32
MCQhard

A company is planning to migrate from on-premises Active Directory to Microsoft Entra ID. They have a custom line-of-business application that uses Windows Integrated Authentication and requires Kerberos. Which approach should they use to enable hybrid identity?

A.Deploy Microsoft Entra Kerberos authentication and register the app
B.Use password hash synchronization (PHS) and configure the app for OAuth
C.Use pass-through authentication (PTA) and configure the app for SAML
D.Federate with Active Directory Federation Services (ADFS)
AnswerA

Deploying Microsoft Entra Kerberos authentication is the correct approach because it enables Microsoft Entra ID to issue Kerberos tickets for on-premises applications. This feature allows users authenticated by Entra ID to access legacy applications that rely on Kerberos for authentication, without requiring a direct line of sight to a traditional Active Directory domain controller from the client. It effectively bridges the gap between cloud-managed identities and on-premises Kerberos-dependent resources, often in conjunction with the Microsoft Entra application proxy for remote access.

Why this answer

Microsoft Entra Kerberos authentication enables hybrid identity for legacy on-premises applications that require Kerberos and Windows Integrated Authentication. By deploying this feature, the app can authenticate users against Microsoft Entra ID while still receiving Kerberos tickets, allowing a seamless migration without modifying the application's authentication code.

Exam trap

The trap here is that candidates often assume that any hybrid identity scenario requires federation (ADFS) or that modern protocols like OAuth/SAML can always replace Kerberos, but Microsoft Entra Kerberos authentication is specifically designed to support legacy Kerberos-dependent apps without federation.

How to eliminate wrong answers

Option B is wrong because password hash synchronization (PHS) does not provide Kerberos tickets; it only synchronizes password hashes for cloud authentication, and configuring the app for OAuth would require the app to support OAuth, which it does not (it uses Windows Integrated Authentication). Option C is wrong because pass-through authentication (PTA) validates passwords on-premises but does not issue Kerberos tickets; SAML is a different protocol that the app does not support. Option D is wrong because federating with Active Directory Federation Services (ADFS) would add unnecessary complexity and is not the recommended modern approach for enabling Kerberos-based hybrid identity; Microsoft Entra Kerberos authentication is the simpler, cloud-native solution.

Practice this question →
33
MCQmedium

A university wants to provide its students with a verifiable digital transcript that the students can share with potential employers. The university uses Microsoft Entra Verified ID to issue credentials. When an employer wants to verify a student's transcript, they scan a QR code or receive a link. Which Microsoft Entra ID feature allows the university to issue these tamper-proof credentials and allows employers to verify them without contacting the university directly?

A.Microsoft Entra ID Protection
B.Microsoft Entra Domain Services
C.Microsoft Entra Verified ID
D.Microsoft Entra Permissions Management
AnswerC

Microsoft Entra Verified ID enables organizations, like a university, to issue tamper-proof, self-owned digital credentials to individuals. These decentralized identifiers (DIDs) allow students to prove attributes, such as enrollment status or degree completion, to relying parties without sharing underlying personal data directly. It leverages open standards for verifiable credentials, ensuring interoperability and user control over their identity data. This directly addresses the need for a verifiable credential system.

Why this answer

Microsoft Entra Verified ID (option C) is the correct answer because it is the decentralized identity solution built on open standards (W3C Decentralized Identifiers and Verifiable Credentials) that allows the university to issue tamper-proof digital credentials. Employers can verify these credentials independently by scanning a QR code or following a link, without needing to contact the university, because the verification is done cryptographically against the issuer's public DID on a distributed ledger.

Exam trap

The trap here is that candidates may confuse 'Verified ID' with general identity protection or access management features, but the key differentiator is the decentralized, tamper-proof credential issuance and independent verification capability that only Verified ID provides.

Why the other options are wrong

A

Microsoft Entra ID Protection is a security tool for detecting identity risks and vulnerabilities, not for issuing or verifying verifiable credentials.

B

Microsoft Entra Domain Services provides managed domain services like domain join, group policy, and LDAP, but it does not issue or verify verifiable credentials. The scenario requires a decentralized identity solution for tamper-proof credentials, which is not a feature of Domain Services.

D

Microsoft Entra Permissions Management is a cloud infrastructure entitlement management (CIEM) tool for managing permissions across multi-cloud environments, not for issuing or verifying verifiable credentials like digital transcripts.

Practice this question →
34
MCQhard

Your organization has multiple on-premises directories and wants to synchronize them to Microsoft Entra ID. However, you must avoid duplicate user objects. Which feature should you configure?

A.Password Hash Sync
B.Pass-through Authentication
C.Active Directory Federation Services
D.Source anchor attribute
AnswerD

The source anchor attribute, also known as `immutableId` in Azure AD, is a critical attribute used by Azure AD Connect to uniquely identify an object across both the on-premises Active Directory and Azure AD. When synchronizing from multiple on-premises directories, Azure AD Connect uses this attribute to establish a persistent, unique link for each object. This ensures that each on-premises object maps to a single, unique object in Azure AD, effectively preventing the creation of duplicate identities for the same user or group.

Why this answer

The source anchor attribute (often the objectGUID in on-premises directories) is used during synchronization to uniquely identify each object and prevent duplicates. By mapping each on-premises object to a single, immutable source anchor, Microsoft Entra Connect ensures that even if multiple directories contain the same user, only one corresponding object is created in Entra ID.

Exam trap

The trap here is that candidates often confuse features that handle authentication (Password Hash Sync, Pass-through Authentication, AD FS) with the identity-mapping mechanism (source anchor) that prevents duplicate objects during synchronization.

How to eliminate wrong answers

Option A is wrong because Password Hash Sync is a method for synchronizing user password hashes for authentication, not for preventing duplicate user objects. Option B is wrong because Pass-through Authentication validates passwords directly against on-premises Active Directory without synchronizing hashes, but does not address object deduplication. Option C is wrong because Active Directory Federation Services (AD FS) provides federated authentication using claims and does not handle object identity mapping or duplicate prevention during directory synchronization.

Practice this question →
35
Multi-Selecteasy

Which THREE are features of Microsoft Entra ID? (Choose three.)

Select 3 answers
A.Firewall management
B.Multifactor authentication
C.Self-service password reset
D.Single sign-on
E.Anti-malware protection
AnswersB, C, D

MFA is a feature of Entra ID.

Why this answer

Microsoft Entra ID provides multifactor authentication (MFA) as a core identity security feature, requiring users to verify their identity using two or more methods such as a password plus a phone call or mobile app notification. This significantly reduces the risk of credential theft and unauthorized access.

Exam trap

The trap here is that candidates confuse Microsoft Entra ID with broader Azure security services, incorrectly assuming it includes network or endpoint protection features like firewall management or anti-malware, when in reality it is strictly an identity and access management solution.

Practice this question →
36
MCQeasy

Your organization wants to use Microsoft Entra ID to authenticate users from a partner company that uses its own identity provider. Which federation standard should you use?

A.OAuth 2.0
B.SCIM
C.OpenID Connect
D.SAML 2.0
AnswerD

Security Assertion Markup Language (SAML) 2.0 is an XML-based open standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). It enables web-based single sign-on (SSO) across different security domains by allowing an IdP to assert a user's identity to an SP securely. This protocol is specifically designed for establishing trust and federating identities between distinct organizations or systems, making it ideal for enterprise federation scenarios.

Why this answer

SAML 2.0 is the correct federation standard because it enables cross-organization authentication by allowing Microsoft Entra ID to trust assertions from a partner company's own identity provider. SAML 2.0 is specifically designed for enterprise federation scenarios where an external IdP authenticates users and sends a SAML assertion to Entra ID for access.

Exam trap

The trap here is that candidates confuse OpenID Connect (which is for modern app authentication) with SAML 2.0 (which is the standard for enterprise federation between separate identity providers), especially when the question mentions 'federation' and 'partner company using its own identity provider'.

How to eliminate wrong answers

Option A is wrong because OAuth 2.0 is an authorization framework, not an authentication protocol; it issues access tokens for delegated access but does not provide user identity assertions. Option B is wrong because SCIM (System for Cross-domain Identity Management) is a provisioning standard for automating user identity lifecycle management, not for authentication or federation. Option C is wrong because OpenID Connect is an authentication layer built on OAuth 2.0, but it is optimized for modern applications and social logins, not for the enterprise federation scenario where a partner company uses its own identity provider with SAML 2.0 assertions.

Practice this question →
37
MCQmedium

A company wants to allow external business partners to access its internal applications using their own corporate credentials (e.g., their Microsoft Entra ID or Google account), without creating separate user accounts in the company's directory. Which Microsoft Entra ID feature should they use?

A.Azure AD B2C (Business-to-Consumer)
B.B2B collaboration
C.Microsoft Entra Domain Services
D.Conditional Access
AnswerB

Microsoft Entra B2B collaboration enables organizations to securely share applications and resources with external business partners, allowing them to sign in using their own existing work, school, or social identities. This process creates a guest user object in the inviting organization's directory, which can then be granted access to specific resources, streamlining external access while maintaining control and minimizing administrative overhead.

Why this answer

B2B collaboration allows the company to grant external business partners access to its internal applications using their own corporate identities (such as Microsoft Entra ID or Google accounts) without creating separate user accounts in the company's directory. It leverages federation trust and cross-tenant authentication, enabling partners to authenticate with their home organizations while accessing resources in the host tenant.

Exam trap

The trap here is confusing B2B collaboration (for business partners with existing corporate identities) with Azure AD B2C (for customers using social or local accounts), as both involve external users but serve fundamentally different scenarios.

Why the other options are wrong

A

Azure AD B2C is designed for customer-facing identity management, allowing external users to sign up and log in with social or local accounts, but it requires creating user profiles in the B2C directory, not using their existing corporate credentials from other identity providers like Microsoft Entra ID or Google without separate accounts.

C

Microsoft Entra Domain Services provides managed domain services like domain join, group policy, and LDAP for legacy applications, not external identity federation for business partners.

D

Conditional Access is a policy engine that enforces access controls (e.g., MFA, device compliance) after authentication, but it does not enable external users to authenticate with their own corporate credentials. The question specifically asks for a feature that allows external partners to use their own identities, which is B2B collaboration, not Conditional Access.

Practice this question →
38
MCQmedium

A company uses Microsoft Entra ID. They want to enforce that users accessing the payroll application from outside the corporate network must use multifactor authentication and must access the app only from devices that are marked as compliant by Intune. Which Conditional Access component should they use to combine these requirements?

A.Conditions
B.Grant controls
C.Sign-in risk policy
D.Session controls
AnswerB

Grant controls are the 'then' part of a Microsoft Entra Conditional Access policy that dictate what must be satisfied *before* access to a cloud application is granted. These controls allow administrators to enforce specific requirements such as requiring multi-factor authentication (MFA), a device marked as compliant, or a hybrid Azure AD joined device. They directly enforce the desired authentication and device posture necessary for access.

Why this answer

B is correct because Grant controls in a Conditional Access policy allow administrators to specify the access requirements that must be satisfied before a user can access a resource. In this scenario, the requirement to enforce both multifactor authentication and device compliance (from Intune) is achieved by configuring the Grant control to 'Require multifactor authentication' and 'Require device to be marked as compliant', combined with the 'Require all the selected controls' option. This ensures that both conditions must be met simultaneously for access to the payroll application from outside the corporate network.

Exam trap

The trap here is that candidates confuse 'Conditions' (the 'when' and 'where' of the policy) with 'Grant controls' (the 'what must happen' to gain access), leading them to incorrectly select Conditions as the component that combines the requirements.

How to eliminate wrong answers

Option A is wrong because Conditions define the signals or triggers for the policy (e.g., user location, device platform, application), not the actions or requirements that must be met once the policy is triggered. Option C is wrong because Sign-in risk policy is a specific type of Identity Protection policy that responds to real-time risk detections (e.g., anonymous IP address, atypical travel) and is not designed to combine static requirements like MFA and device compliance for a specific application. Option D is wrong because Session controls enforce limitations on the user session after access is granted (e.g., app-enforced restrictions, sign-in frequency), not the pre-access requirements like MFA or device compliance.

Practice this question →
39
MCQeasy

A company uses Microsoft Entra ID. They have a financial application that should only be accessible from Windows devices. The security team wants to create a Conditional Access policy to block access from other operating systems such as macOS or Linux. Which assignment condition should they configure?

A.Locations
B.Device platforms
C.Client apps
D.Sign-in risk
AnswerB

The Device platforms condition in Microsoft Entra Conditional Access precisely targets the operating system of the device attempting to access resources. By configuring this condition to include only specific OS types, such as Windows, administrators can effectively block access attempts originating from non-compliant or unauthorized platforms like macOS, iOS, Android, or Linux. This ensures that sensitive financial data is only accessed from devices running approved operating systems, directly meeting the requirement to restrict access based on the device's OS.

Why this answer

The Device platforms condition in a Conditional Access policy allows administrators to target specific operating systems (e.g., Windows, iOS, Android, macOS) or block others. By configuring this condition to only include Windows devices, the policy will block access from macOS, Linux, or any other non-Windows platform. This directly addresses the security team's requirement to restrict the financial application to Windows devices only.

Exam trap

The trap here is that candidates often confuse Device platforms with Client apps, thinking that blocking 'mobile apps' or 'browsers' would restrict the OS, but Client apps only controls the type of application client, not the underlying operating system.

Why the other options are wrong

A

Locations control access based on geographic or network locations (e.g., IP ranges), not the operating system of the device. The requirement is to block macOS and Linux, which is about device platform, not location.

C

The question specifies blocking access based on the operating system (Windows vs. macOS/Linux), which is a device platform condition, not a client app condition. Client apps refer to the type of application (e.g., browser, mobile app, legacy auth), not the OS.

D

Sign-in risk is used to detect and respond to risky authentication attempts (e.g., leaked credentials, anonymous IP addresses), not to restrict access based on the device's operating system. The question specifically requires blocking macOS or Linux, which is a device platform condition.

Practice this question →
40
MCQmedium

A company wants to automatically detect and alert the security team when a user sign-in appears to originate from a known compromised credential or from an anonymizing VPN service. The company wants to receive a risk score for each sign-in and be able to trigger automated remediation actions. Which Microsoft Entra ID feature should they enable?

A.Microsoft Entra ID Protection
B.Microsoft Entra Identity Governance
C.Microsoft Entra Privileged Identity Management
D.Microsoft Entra External Identities
AnswerA

Microsoft Entra ID Protection is the correct service for automatically detecting and alerting security teams about identity-based risks. It continuously monitors user sign-ins and identities for suspicious activities, such as sign-ins from unfamiliar locations, anonymous IP addresses, or leaked credentials. Upon detection, it can trigger automated responses like multi-factor authentication prompts, password resets, or blocking access, thereby protecting user accounts from compromise and preventing unauthorized access.

Why this answer

Microsoft Entra ID Protection is the correct feature because it is specifically designed to detect and respond to identity-based risks, including sign-ins from compromised credentials and anonymizing VPN services (e.g., Tor). It assigns a risk score (low, medium, high) to each sign-in and user, and supports automated remediation actions such as requiring multi-factor authentication (MFA) or blocking sign-in via Conditional Access policies integrated with the risk detection.

Exam trap

The trap here is that candidates often confuse Privileged Identity Management (PIM) with Identity Protection because both involve 'risk' or 'security,' but PIM only manages privileged role activation and does not detect or score sign-in risks from compromised credentials or anonymizing VPNs.

Why the other options are wrong

B

Microsoft Entra Identity Governance focuses on managing identity lifecycles, access reviews, and entitlement management, not on detecting risky sign-ins or compromised credentials. It lacks the risk detection and automated remediation capabilities required by the question.

C

Microsoft Entra Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles, not sign-in risk detection or automated remediation based on compromised credentials or anonymizing VPNs.

D

Microsoft Entra External Identities is designed for managing external user identities (e.g., B2B collaboration), not for detecting compromised credentials, anonymizing VPNs, or providing risk scores and automated remediation for sign-ins.

Practice this question →
41
MCQmedium

A company has an on-premises Active Directory domain and uses Microsoft Entra ID (Azure AD) for cloud applications. They purchase new Windows 10 laptops that are not yet joined to any domain. The IT admin wants users to be able to sign in with their existing on-premises credentials and automatically have the laptops joined to both the on-premises AD domain and Microsoft Entra ID. Which device identity option should the admin configure?

A.Microsoft Entra registered
B.Microsoft Entra joined
C.Microsoft Entra hybrid joined
D.On-premises domain join only
AnswerC

Microsoft Entra hybrid joined devices are those that are joined to an on-premises Active Directory domain and simultaneously registered with Microsoft Entra ID. This configuration allows organizations to maintain existing on-premises management and group policies while enabling seamless single sign-on (SSO) to cloud resources and leveraging Microsoft Entra ID's conditional access policies. It effectively bridges the gap between traditional on-premises infrastructure and modern cloud services, providing a unified identity for devices across both environments.

Why this answer

Microsoft Entra hybrid join allows devices to be joined to both an on-premises Active Directory domain and Microsoft Entra ID simultaneously. This enables users to sign in with their existing on-premises credentials and automatically have the laptops registered in both directories, meeting the requirement for a seamless single sign-on experience.

Exam trap

The trap here is that candidates often confuse 'Microsoft Entra joined' (cloud-only) with 'Microsoft Entra hybrid joined' (dual-joined), failing to recognize that the requirement for on-premises credentials and automatic dual join necessitates the hybrid option.

Why the other options are wrong

A

Microsoft Entra registered devices are not joined to on-premises AD or Entra ID; they are only registered for single sign-on to cloud resources, lacking the ability to join both on-premises AD and Entra ID automatically.

B

Microsoft Entra joined devices are joined only to Microsoft Entra ID, not to an on-premises AD domain. The requirement is for laptops to be joined to both on-premises AD and Microsoft Entra ID, which requires hybrid join.

D

On-premises domain join only does not integrate with Microsoft Entra ID, so users cannot sign in with their existing on-premises credentials to access cloud applications, nor will the laptops be joined to Entra ID.

Practice this question →
42
MCQmedium

A company uses Microsoft Entra ID. The IT help desk team needs to be able to reset passwords and manage user account properties, but only for users located in the United Kingdom. The organization has created a dynamic group that contains all UK users. Which Microsoft Entra feature should an administrator use to delegate these administrative permissions specifically to the help desk team, limited to the UK user scope?

A.Administrative Units
B.Conditional Access
C.Privileged Identity Management (PIM)
D.Access Packages
AnswerA

Administrative Units (AUs) are the correct solution because they enable the delegation of administrative roles with a defined scope, such as specific sets of users, groups, or devices. This allows the IT help desk to be assigned administrative roles, like User Administrator, but with their permissions restricted to only manage users who are members of the 'UK Users' administrative unit, preventing them from affecting users outside that scope.

Why this answer

Administrative Units (AUs) in Microsoft Entra ID allow an administrator to delegate administrative permissions over a subset of users, groups, or devices, scoped to a specific organizational boundary. By creating an AU that contains the dynamic group of UK users, the administrator can assign the Helpdesk Administrator role scoped to that AU, granting the help desk team the ability to reset passwords and manage user account properties only for those UK users. This directly meets the requirement of delegating permissions limited to the UK user scope.

Exam trap

The trap here is that candidates often confuse Privileged Identity Management (PIM) with scope delegation, assuming PIM can limit permissions to a subset of users, when in fact PIM only controls role activation timing and approval, not the scope of the role's authority.

How to eliminate wrong answers

Option B is wrong because Conditional Access is a policy engine that enforces access controls (e.g., MFA, device compliance) based on conditions like location or risk, not a delegation mechanism for administrative permissions. Option C is wrong because Privileged Identity Management (PIM) provides just-in-time activation and approval workflows for privileged roles, but it does not scope permissions to a subset of users like UK users; it controls who can use a role, not where the role applies. Option D is wrong because Access Packages are part of Entitlement Management and are used to automate access requests and approvals for resources like groups or apps, not to delegate administrative permissions for user management tasks.

Practice this question →
43
MCQmedium

An organization uses Microsoft Intune to manage devices. They want to ensure that only devices marked as compliant can access corporate email in Exchange Online. Which Conditional Access component should they configure?

A.Conditions -> Device state
B.Grant controls -> Require device to be marked as compliant
C.Sign-in risk policy
D.Session controls -> Use Conditional Access App Control
AnswerB

This Grant control is the precise mechanism within Conditional Access policies to enforce that only devices deemed compliant by a Mobile Device Management (MDM) solution, such as Microsoft Intune, are permitted to access protected resources. By selecting 'Require device to be marked as compliant,' the policy explicitly gates access, ensuring that devices meet organizational security standards before a user can proceed. It directly leverages Intune's compliance reporting to make real-time access decisions.

Why this answer

The 'Require device to be marked as compliant' grant control in Conditional Access enforces that only Intune-compliant devices can access Exchange Online. This integrates with Microsoft Entra ID to check the device compliance status reported by Intune before granting access to corporate email.

Exam trap

The trap here is confusing 'Conditions -> Device state' (which filters by platform or state) with the actual compliance enforcement in 'Grant controls', leading candidates to choose Option A thinking it checks compliance directly.

Why the other options are wrong

A

The question asks for the component that enforces access based on device compliance. 'Conditions -> Device state' is a condition that defines which devices are included in the policy, not the control that grants or blocks access. The grant control 'Require device to be marked as compliant' is the actual enforcement mechanism.

C

Sign-in risk policy is part of Azure AD Identity Protection, not a Conditional Access component. It evaluates the risk level of an authentication attempt, not device compliance, and cannot directly block access based on device compliance status.

D

Session controls with Conditional Access App Control are used to monitor and control app sessions in real time, not to enforce device compliance for email access. The requirement to block non-compliant devices from accessing Exchange Online is achieved via Grant controls, not Session controls.

Practice this question →
44
MCQhard

Your organization uses Microsoft Entra ID and Microsoft Sentinel. You need to analyze sign-in logs to detect risky sign-ins that are not blocked by Conditional Access policies. Which Microsoft Entra feature provides risk detection and can feed into Sentinel?

A.Microsoft Entra Verified ID
B.Microsoft Entra Identity Protection
C.Microsoft Entra Privileged Identity Management
D.Microsoft Entra Entitlement Management
AnswerB

Microsoft Entra Identity Protection is a crucial security capability that automatically detects, remediates, and investigates identity-based risks in an organization. It identifies potential vulnerabilities affecting identities, such as leaked credentials, and detects suspicious actions like anomalous sign-in locations or impossible travel. These risk detections are fed directly into Microsoft Sentinel as incidents, enabling security analysts to correlate identity risk data with other security logs for comprehensive threat detection and response.

Why this answer

Microsoft Entra Identity Protection is the correct feature because it specifically provides risk detection for sign-ins and users, including leaked credentials, anonymous IP addresses, and atypical travel. It can feed these risk detections directly into Microsoft Sentinel via a connector, enabling advanced analysis and automated response. Conditional Access policies can use Identity Protection's risk signals to block or require MFA, but Identity Protection itself identifies the risky sign-ins that policies may not block.

Exam trap

The trap here is that candidates may confuse Privileged Identity Management (PIM) with Identity Protection because both involve 'protection' and security, but PIM focuses on privileged role access, not sign-in risk detection.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Verified ID is a decentralized identity solution for verifiable credentials, not a risk detection or sign-in analysis feature. Option C is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time access and role activation, not sign-in risk detection. Option D is wrong because Microsoft Entra Entitlement Management handles access packages and governance for application access, not risk detection for sign-ins.

Practice this question →
45
MCQhard

A large enterprise uses Microsoft Entra ID with P2 licenses. The security team wants to implement just-in-time (JIT) access for privileged roles and require approval for role activation. Additionally, they want to receive alerts when a role is activated outside business hours. Which feature should they use?

A.Microsoft Entra Identity Protection.
B.Conditional Access policies.
C.Microsoft Entra Privileged Identity Management (PIM).
D.Microsoft Entra entitlement management.
AnswerC

Microsoft Entra Privileged Identity Management (PIM) is specifically engineered to manage, control, and monitor access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. It enables just-in-time (JIT) access, allowing users to activate privileged roles for a limited, specified duration, often requiring approval and providing comprehensive audit trails. This capability directly addresses the need for controlled, temporary role elevation, aligning with the principle of least privilege.

Why this answer

Microsoft Entra Privileged Identity Management (PIM) is the correct feature because it provides just-in-time (JIT) activation of privileged roles, supports approval workflows for role activation, and can send alerts when roles are activated outside business hours. PIM is specifically designed for managing, controlling, and monitoring access to privileged roles in Microsoft Entra ID, including time-bound activation and notification settings.

Exam trap

The trap here is that candidates confuse Conditional Access policies (which control sign-in conditions) with PIM's role activation controls, but Conditional Access cannot manage role activation, approval, or time-based alerts for privileged roles.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Identity Protection is a tool for detecting and responding to identity-based risks (e.g., leaked credentials, sign-in anomalies) and does not provide JIT role activation, approval workflows, or alerts for role activation timing. Option B is wrong because Conditional Access policies enforce access controls based on conditions like location or device state but cannot manage privileged role activation, approval, or time-based alerts. Option D is wrong because Microsoft Entra entitlement management focuses on managing access packages and resource access for users and groups, not on privileged role activation with JIT, approval, or business-hours alerts.

Practice this question →
46
MCQhard

A multinational organization uses Microsoft Entra ID and wants to allow employees to sign in to a custom customer-facing application using their existing social identities (e.g., LinkedIn, Google). They also need to enforce a specific terms of use agreement and be able to revoke a user's access if their social account is compromised. Which Microsoft Entra capability should they configure?

A.Microsoft Entra External ID (B2C)
B.Microsoft Entra B2B collaboration
C.Microsoft Entra Identity Protection
D.Microsoft Entra Conditional Access
AnswerA

Microsoft Entra External ID (B2C) is specifically engineered for Customer Identity and Access Management (CIAM) scenarios, enabling organizations to manage millions of customer identities for their public-facing applications. It natively supports sign-up and sign-in with a wide array of social identity providers like Google, Facebook, and LinkedIn, alongside local accounts. This service allows for extensive customization of user journeys, branding, and the integration of terms of use, making it ideal for consumer applications requiring flexible authentication and authorization for external users.

Why this answer

Microsoft Entra External ID (B2C) is the correct choice because it is specifically designed for customer-facing applications that need to support social identity providers (like LinkedIn and Google) via OAuth 2.0 and OpenID Connect. It allows you to enforce a custom terms of use agreement during sign-up and provides the ability to revoke a user's access by disabling their account in the B2C directory or removing the social identity mapping, which directly addresses the requirement to respond to a compromised social account.

Exam trap

The trap here is that candidates often confuse Microsoft Entra B2B collaboration (designed for external business partners accessing internal apps) with Microsoft Entra External ID (B2C) (designed for customer-facing apps with social identity providers), because both involve external users, but their use cases and capabilities are fundamentally different.

How to eliminate wrong answers

Option B (Microsoft Entra B2B collaboration) is wrong because it is designed for business-to-business scenarios, allowing external business partners to access your organization's internal resources (like SharePoint or Teams), not for customer-facing applications with social identity providers. Option C (Microsoft Entra Identity Protection) is wrong because it is a risk-based detection and remediation service for user sign-ins and identities, not a solution for managing external customer identities or enforcing terms of use agreements. Option D (Microsoft Entra Conditional Access) is wrong because it is a policy engine that enforces access controls (like MFA or device compliance) on sign-ins to your own resources, but it does not provide the ability to manage social identity providers or host a separate customer identity directory.

Practice this question →
47
MCQmedium

Your organization uses Microsoft Entra ID and Microsoft Intune. You need to ensure that only devices that are enrolled in Intune and compliant with your organization's security policies can access corporate email. Which Microsoft Entra feature should you use?

A.Microsoft Entra Entitlement Management
B.Microsoft Entra Conditional Access
C.Microsoft Entra Privileged Identity Management (PIM)
D.Microsoft Entra Terms of Use
AnswerB

Microsoft Entra Conditional Access policies evaluate various signals, including user, location, application, and device state, to make real-time access decisions. By integrating with Microsoft Intune, Conditional Access can enforce that devices must be marked as compliant before users can access corporate resources, directly addressing the need for device-based access control. This mechanism ensures only trusted devices can connect.

Why this answer

Microsoft Entra Conditional Access is the correct feature because it enforces policy-based access controls that evaluate device compliance status reported by Microsoft Intune. By configuring a Conditional Access policy to require 'Device to be marked as compliant,' only devices enrolled in Intune and meeting security policies can access corporate email, leveraging the integration between Entra ID and Intune.

Exam trap

The trap here is that candidates often confuse Conditional Access with Privileged Identity Management (PIM) because both involve access control, but PIM focuses on privileged roles, not device compliance enforcement.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Entitlement Management manages access packages and identity governance for resource access, not device-level compliance enforcement. Option C is wrong because Microsoft Entra Privileged Identity Management (PIM) controls just-in-time privileged role activation and access reviews, not device compliance checks. Option D is wrong because Microsoft Entra Terms of Use presents acceptance agreements to users but does not evaluate device enrollment or compliance status.

Practice this question →
48
Matchingmedium

Match each identity term to its correct meaning.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

An entity that can be authenticated

Proving you are who you claim to be

Determining what an authenticated user can do

Trust relationship between identity providers

Creating and managing user accounts and access

Why these pairings

Identity is the entity (user, device, service) being authenticated. Authentication verifies who you are (e.g., passwords, MFA). Authorization determines what you can access (e.g., permissions).

Directory stores identity information (e.g., Azure AD). Common confusion: mixing authentication and authorization definitions.

Practice this question →
49
Multi-Selectmedium

Your organization is planning to implement Microsoft Entra ID for identity and access management. Which TWO capabilities are provided by Microsoft Entra ID?

Select 2 answers
A.External identity management for customer-facing apps
B.Security event log analysis
C.Identity governance (e.g., access reviews)
D.Mobile device management (MDM)
E.Single sign-on (SSO) for cloud applications
AnswersC, E

Microsoft Entra ID provides robust identity governance capabilities, which are crucial for managing and auditing the identity lifecycle and access to resources. This includes features like access reviews, enabling periodic verification of user access to groups and applications, and entitlement management, which automates access request workflows and lifecycle for internal and external users. These tools ensure that users have only the necessary access for their roles, enhancing security and compliance.

Why this answer

Microsoft Entra ID provides identity governance capabilities such as access reviews, which allow administrators to automate the process of reviewing and certifying user access to applications and groups. This ensures compliance and security by regularly validating that users have appropriate access rights. Single sign-on (SSO) is a core feature of Entra ID, enabling users to authenticate once and access multiple cloud applications without re-entering credentials, leveraging protocols like OAuth 2.0 and SAML 2.0.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID (workforce identity) with Microsoft Entra External ID (customer identity) or assume that log analysis and MDM are part of Entra ID, when they belong to separate Azure services like Sentinel and Intune.

Practice this question →
50
MCQmedium

A company needs to ensure that only approved devices can access corporate resources. Which Microsoft Entra feature should they combine with Microsoft Intune?

A.Conditional Access
B.Application Proxy
C.Identity Protection
D.Privileged Identity Management
AnswerA

Azure AD Conditional Access policies evaluate conditions such as user, location, application, and device state before granting access to cloud resources. By integrating with Microsoft Intune, Conditional Access can enforce that devices must be marked as compliant with organizational policies (e.g., encryption, OS version, antivirus) before users can access sensitive applications or data. This directly addresses the requirement to ensure only approved devices can access resources.

Why this answer

Conditional Access is the Microsoft Entra feature that enforces policies to grant or block access based on conditions such as device compliance. When combined with Microsoft Intune, which manages device compliance policies (e.g., requiring encryption, a specific OS version, or a healthy device health attestation), Conditional Access can block access from non-compliant or unapproved devices. This integration ensures that only devices marked as compliant by Intune can access corporate resources.

Exam trap

The trap here is that candidates often confuse Identity Protection (which deals with user risk) with device-based access control, but Conditional Access is the policy engine that enforces device compliance from Intune.

How to eliminate wrong answers

Option B is wrong because Application Proxy provides secure remote access to on-premises web applications without requiring a VPN, but it does not enforce device compliance or approval. Option C is wrong because Identity Protection detects and responds to identity-based risks (e.g., leaked credentials, impossible travel), but it does not control which devices are allowed to access resources. Option D is wrong because Privileged Identity Management manages just-in-time privileged role assignments and access reviews, not device-level access control.

Practice this question →
51
MCQhard

A multinational company needs to enforce multi-factor authentication for all users but exclude a break-glass emergency account. Which approach should they take in Microsoft Entra ID?

A.Use identity protection to require MFA only for high-risk users
B.Enable security defaults and add the break-glass account to a group that bypasses MFA
C.Enable per-user MFA for all users and turn off for the break-glass account
D.Create a Conditional Access policy requiring MFA for all users, excluding the break-glass account
AnswerD

Creating a Conditional Access policy is the recommended and most flexible method to enforce multi-factor authentication for all users while strategically excluding a break-glass account. Conditional Access allows administrators to define precise conditions, such as requiring MFA for 'All users,' and then apply specific 'Exclusions' for designated emergency access accounts, ensuring both comprehensive security and operational continuity.

Why this answer

Conditional Access policies in Microsoft Entra ID allow granular control over authentication requirements, including the ability to exclude specific users or groups. By creating a policy that requires multi-factor authentication (MFA) for all users but explicitly excludes the break-glass account, the company ensures security while maintaining emergency access. This approach is more flexible and scalable than per-user MFA or security defaults, which lack the ability to selectively bypass MFA for critical accounts.

Exam trap

The trap here is that candidates may confuse security defaults with Conditional Access, assuming security defaults can be customized with exclusions, when in fact security defaults are a fixed baseline that cannot be modified to exclude specific accounts.

How to eliminate wrong answers

Option A is wrong because Identity Protection's risk-based policies require MFA only for users flagged as high-risk, not for all users, which fails to enforce universal MFA as required. Option B is wrong because security defaults enforce MFA for all users globally and do not allow excluding specific accounts via group membership; adding a break-glass account to a group does not bypass MFA in security defaults. Option C is wrong because per-user MFA is a legacy, less secure approach that does not support modern Conditional Access exclusions; turning off MFA for the break-glass account via per-user settings is possible but lacks the centralized control and reporting of Conditional Access, and Microsoft recommends migrating away from per-user MFA.

Practice this question →
52
MCQmedium

A company uses Microsoft Entra ID (Microsoft Entra ID) and wants to configure self-service password reset (SSPR) for all users. The security team requires that users must verify their identity with at least two methods before resetting a password. Which SSPR setting should be configured?

A.Number of methods required to reset: 2
B.Require re-registration on every authentication
C.Enable combined registration for SSPR and MFA
D.Set password expiration to 0 days
AnswerA

This setting, configured within Microsoft Entra ID's Self-Service Password Reset (SSPR) policy, directly controls the security posture of the SSPR process. It dictates the number of distinct authentication factors a user must successfully provide to verify their identity before being allowed to reset their password. Setting this value to '2' ensures a multi-factor authentication approach for password resets, significantly enhancing security by requiring more than one proof of identity.

Why this answer

Self-Service Password Reset (SSPR) in Microsoft Entra ID allows administrators to set the number of authentication methods required to reset a password. By setting 'Number of methods required to reset' to 2, users must provide two verification methods (e.g., email and phone) to confirm their identity.

Exam trap

Candidates might confuse combined registration (Option C) with the number of methods required for reset, overlooking the direct control for identity verification.

Practice this question →
53
Multi-Selecthard

Which THREE of the following are capabilities provided by Microsoft Entra ID Protection? (Select three.)

Select 3 answers
A.Automated investigation and remediation of identity risks
B.Passwordless authentication options
C.Device compliance assessment
D.Detection of compromised credentials and risky sign-ins
E.Risk-based conditional access policies
AnswersA, D, E

Microsoft Entra ID Protection provides automated responses to detected identity risks, such as suspicious sign-ins or compromised credentials. It can automatically block access, require multi-factor authentication, or prompt for a password change based on predefined policies and the assessed risk level. This capability significantly reduces the manual effort required to mitigate identity-related threats and enhances overall security posture by enforcing real-time remediation.

Why this answer

Microsoft Entra ID Protection includes automated investigation and remediation capabilities that respond to detected identity risks. When a risk is identified, such as a compromised user account, the service can automatically trigger actions like requiring a password reset or blocking sign-in attempts, reducing the need for manual intervention.

Exam trap

The trap here is that candidates may confuse the broader set of Microsoft Entra ID features (like passwordless authentication or device compliance) with the specific risk detection and response capabilities of Entra ID Protection, which is narrowly focused on identity risk management.

Practice this question →
54
MCQmedium

Your company uses Microsoft Entra ID with P1 licenses. You need to implement a policy that blocks access to Microsoft 365 from countries that are not authorized, except for users who are members of a specific security group. Which Microsoft Entra feature should you use?

A.Microsoft Entra Identity Protection.
B.Microsoft Entra entitlement management.
C.Microsoft Entra B2B collaboration.
D.Conditional Access policy with location condition and group exclusion.
AnswerD

Conditional Access policies are the definitive tool within Microsoft Entra ID for enforcing granular access controls based on various conditions, including user location. By configuring a policy with a 'Location' condition, administrators can specify trusted or untrusted IP ranges and block access from specific countries or regions. The ability to apply this policy to specific groups while excluding others provides the necessary flexibility to implement targeted access restrictions.

Why this answer

D is correct because Conditional Access policies in Microsoft Entra ID allow you to define access controls based on location conditions, such as blocking access from specific countries. You can then exclude a security group from the block, ensuring that members of that group can still access Microsoft 365 from unauthorized countries. This directly meets the requirement of blocking access except for users in a specific group.

Exam trap

The trap here is that candidates often confuse Identity Protection (which deals with risk-based policies) with Conditional Access (which handles broader access controls like location), leading them to select A instead of D.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Identity Protection is a feature for detecting and responding to identity risks (e.g., leaked credentials, sign-ins from anonymous IPs), not for implementing location-based access blocks with group exclusions. Option B is wrong because Microsoft Entra entitlement management is used to manage access packages and identity governance (e.g., automated access reviews and assignment of resources), not for enforcing real-time location-based access policies. Option C is wrong because Microsoft Entra B2B collaboration is designed to enable external users (guests) to access your organization's resources, not to block or allow internal users based on geographic location.

Practice this question →
55
MCQhard

Refer to the exhibit. User2 attempts to activate the Global Administrator role. What must happen before User2 gains the role?

A.User3 must approve the activation request
B.An approver defined in PIM must approve the request
C.User1 must approve the activation request
D.User2 must pass MFA
AnswerB

PIM requires approval from designated approvers.

Why this answer

User2 is attempting to activate the Global Administrator role via Privileged Identity Management (PIM). In PIM, role activation requires approval from a designated approver before the role is granted. Option B correctly identifies that an approver defined in PIM must approve the request, which is the required step for activation.

Exam trap

The trap here is that candidates may assume MFA is the only requirement for activation, but the exhibit clearly shows an approval workflow is in place, making the approval step the immediate prerequisite before the role is granted.

How to eliminate wrong answers

Option A is wrong because User3 is the designated approver, but the statement 'User3 must approve the activation request' is too specific—it implies User3 is the only possible approver, whereas PIM allows multiple approvers or a group; the correct requirement is that an approver defined in PIM must approve. Option C is wrong because User1 is not mentioned as an approver in the exhibit; the exhibit shows User3 as the approver, so User1 has no role in this approval. Option D is wrong because while MFA may be required as part of the activation process (depending on policy), the question specifically asks what must happen before User2 gains the role, and the exhibit shows the approval step is the immediate prerequisite; MFA is often a separate prerequisite but not the direct answer to this scenario.

Practice this question →
56
MCQmedium

An organization uses Microsoft Entra ID to manage user access. The security policy requires that membership in the 'Finance - Sensitive Data' group must be reviewed every quarter by the group owner to confirm that each member still requires access. The group owner must approve or deny each membership, and any denied memberships should be automatically removed. Which Microsoft Entra ID feature should be configured to automate this process?

A.Microsoft Entra ID Access Reviews
B.Microsoft Entra ID Privileged Identity Management (PIM)
C.Microsoft Entra ID Conditional Access
D.Microsoft Entra ID Protection
AnswerA

Microsoft Entra ID Access Reviews provide a systematic way for organizations to periodically review who has access to specific resources, such as group memberships or application assignments. Reviewers, often resource owners, can attest whether users still require their current access. This process helps enforce the principle of least privilege by automatically removing access for users whose permissions are no longer justified, enhancing security and compliance.

Why this answer

Microsoft Entra ID Access Reviews is the correct feature because it enables periodic review of group memberships, where the group owner can approve or deny each member's continued access. When a member is denied, Access Reviews can be configured to automatically remove that user from the group, satisfying the security policy's requirement for quarterly reviews and automatic removal of denied memberships.

Exam trap

The trap here is that candidates often confuse Privileged Identity Management (PIM) with Access Reviews because both involve approvals, but PIM handles time-bound role activation for privileged roles, not recurring membership reviews for standard groups.

Why the other options are wrong

B

Privileged Identity Management (PIM) manages just-in-time access and role activation for privileged roles, not periodic membership reviews with owner approval and automatic removal of denied members.

C

Conditional Access enforces access policies based on signals like user, device, or location, but it does not provide periodic review and approval workflows for group membership. The requirement for quarterly review and automatic removal of denied memberships is specifically addressed by Access Reviews.

D

Microsoft Entra ID Protection focuses on detecting and responding to identity-based risks like compromised credentials or sign-ins from unusual locations, not on reviewing and certifying group membership access.

Practice this question →
57
MCQeasy

The exhibit shows that a user was added to the Global Administrator role. Which Microsoft Entra feature should be used to provide just-in-time access to this role?

A.Privileged Identity Management
B.Conditional Access
C.Self-Service Password Reset
D.Identity Protection
AnswerA

Privileged Identity Management (PIM) is the dedicated Azure AD service designed to manage, control, and monitor access to important resources. It enables just-in-time (JIT) access, allowing users to activate privileged roles like Global Administrator only when needed and for a limited duration. This significantly reduces the attack surface by eliminating standing administrative access and provides robust auditing capabilities for all role activations.

Why this answer

Privileged Identity Management (PIM) is the Microsoft Entra feature specifically designed to provide just-in-time (JIT) privileged access to roles like Global Administrator. PIM enables time-bound activation, approval workflows, and audit logging, ensuring users have elevated permissions only when needed and for a limited duration.

Exam trap

The trap here is that candidates confuse Conditional Access (which controls access to resources) with Privileged Identity Management (which controls elevation to administrative roles), leading them to select Conditional Access when the question explicitly asks for just-in-time role access.

How to eliminate wrong answers

Option B is wrong because Conditional Access is a policy engine that enforces access controls (e.g., MFA, location) based on signals, but it does not provide time-bound role activation or JIT elevation to privileged roles. Option C is wrong because Self-Service Password Reset (SSPR) allows users to reset their own passwords without administrator intervention, but it has no capability to grant or manage privileged role assignments. Option D is wrong because Identity Protection is a risk-detection service that identifies compromised identities and risky sign-ins, but it does not offer JIT role activation or privileged access management.

Practice this question →
58
MCQmedium

A company uses Microsoft Entra ID. Their sales team wants to use a third-party customer relationship management (CRM) application that requires the 'Sign in and read user profile' permission and also a high-risk permission to 'Read all users' full profiles'. The security team wants to allow users to request access to this application, but they want to require an administrator to review and approve the high-risk permission request before consent is granted. Which Microsoft Entra ID feature should they configure?

A.Admin consent workflow
B.Conditional Access
C.Identity Protection
D.Privileged Identity Management (PIM)
AnswerA

The Admin consent workflow in Microsoft Entra ID allows users to request administrator approval for applications that require permissions necessitating admin consent. When a user attempts to access such an application, they are prompted to request approval, triggering a workflow where designated administrators can review the requested permissions and decide to grant or deny the organization-wide consent. This mechanism ensures that applications requiring elevated permissions are properly vetted before being authorized for use across the tenant, maintaining security and compliance.

Why this answer

The admin consent workflow in Microsoft Entra ID allows end users to request consent for applications that require permissions, while requiring administrator approval for high-risk permissions. In this scenario, the CRM app requests both a low-risk permission ('Sign in and read user profile') and a high-risk permission ('Read all users' full profiles'), and the security team wants admin review for the high-risk one. The admin consent workflow enables this by letting users initiate the request, then routing it to designated administrators for approval or denial, ensuring that high-risk permissions are not granted without oversight.

Exam trap

The trap here is that candidates often confuse the admin consent workflow with Privileged Identity Management (PIM) because both involve administrative approval, but PIM handles role activation, not application consent requests.

Why the other options are wrong

B

Conditional Access is used to enforce access controls based on signals like user location or device state, not to manage consent workflows for application permissions. The question specifically requires a feature to allow user-initiated consent requests with admin review for high-risk permissions, which is the admin consent workflow.

C

Identity Protection is designed to detect and respond to identity-based risks, such as compromised accounts or suspicious sign-ins, not to manage consent workflows for application permissions.

D

Privileged Identity Management (PIM) manages just-in-time access and role activation for privileged roles, not the review and approval of user consent requests for application permissions.

Practice this question →
59
MCQmedium

A multinational organization uses Microsoft Entra ID. The IT help desk team is responsible for password resets and group management, but only for users located in the European region. The organization has created a group containing all European user accounts. Which Microsoft Entra feature should an administrator use to delegate these administrative tasks specifically to the help desk team, limited to the European user scope?

A.Administrative units
B.Access reviews
C.Conditional Access
D.Self-service password reset (SSPR)
AnswerA

Administrative units allow scoping of administrative roles (e.g., Helpdesk Administrator) to a specific subset of users, such as those in a particular region or department. This feature directly meets the requirement to delegate tasks limited to European users.

Why this answer

Administrative units (AUs) in Microsoft Entra ID allow administrators to delegate administrative permissions scoped to a specific subset of users, groups, or devices. By creating an AU containing only the European user group, the administrator can assign the help desk team roles (e.g., Helpdesk Administrator or User Administrator) limited to that AU, ensuring they can perform password resets and group management only for European users.

Exam trap

The trap here is that candidates often confuse delegation of administrative tasks with end-user self-service features (SSPR) or access control policies (Conditional Access), failing to recognize that Administrative Units are the dedicated Microsoft Entra feature for scoped role-based delegation.

How to eliminate wrong answers

Option B (Access reviews) is wrong because it is a governance feature for reviewing and recertifying access assignments, not for delegating administrative tasks with a scope. Option C (Conditional Access) is wrong because it enforces access control policies (e.g., MFA, location-based restrictions) at sign-in, not for delegating delegated administration or scoping permissions. Option D (Self-service password reset) is wrong because it allows end users to reset their own passwords without help desk intervention, not for delegating password reset tasks to a specific team with a limited scope.

Practice this question →
60
MCQmedium

An administrator needs to grant a vendor temporary access to an Azure subscription for exactly 48 hours. After that time, access must be automatically revoked. Which Microsoft Entra feature should be used?

A.Microsoft Entra External Identities
B.Microsoft Entra Privileged Identity Management
C.Microsoft Entra access reviews
D.Microsoft Entra Conditional Access
AnswerB

Microsoft Entra Privileged Identity Management (PIM) is the correct solution because it enables just-in-time (JIT) and time-bound access to resources and roles. Administrators can assign a vendor a specific role for a predefined duration, and PIM will automatically revoke that access once the assignment period expires. This ensures temporary access is granted only when needed and automatically removed, aligning perfectly with the requirement for automatic expiration.

Why this answer

Microsoft Entra Privileged Identity Management (PIM) allows administrators to configure just-in-time (JIT) access with time-bound activation and automatic expiration. By setting a maximum activation duration of 48 hours for a role assignment, PIM ensures the vendor's access is automatically revoked after that period without manual intervention.

Exam trap

The trap here is that candidates often confuse PIM's just-in-time access with External Identities (B2B), assuming that inviting a guest user inherently includes time limits, but B2B invitations do not automatically expire unless combined with other features like access reviews or PIM.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra External Identities is used for inviting external users (B2B collaboration) or managing customer identities (B2C), but it does not provide time-bound access with automatic revocation. Option C is wrong because Microsoft Entra access reviews are periodic attestation workflows that require manual or scheduled review cycles, not a mechanism to enforce a precise 48-hour automatic expiration. Option D is wrong because Microsoft Entra Conditional Access enforces access policies based on conditions like location or device state, but it cannot grant or revoke role-based access to an Azure subscription with a specific time limit.

Practice this question →
61
Multi-Selectmedium

Your organization uses Microsoft Entra ID. Which TWO features help protect against identity-based attacks by detecting and responding to risks?

Select 2 answers
A.Privileged Identity Management
B.Access reviews
C.Conditional Access
D.Entitlement management
E.Identity Protection
AnswersC, E

Microsoft Entra Conditional Access is a powerful policy engine that evaluates various conditions, such as user location, device compliance, and sign-in risk, in real-time before granting access to resources. It allows administrators to enforce specific controls, like multi-factor authentication, password changes, or blocking access, based on these conditions. When integrated with Identity Protection, Conditional Access policies can automatically respond to detected user and sign-in risks, ensuring adaptive security.

Why this answer

Conditional Access is correct because it enforces policy-based access controls that evaluate real-time signals (e.g., user location, device compliance, sign-in risk) to block or challenge suspicious sign-in attempts, directly mitigating identity-based attacks. Identity Protection is correct because it uses machine learning to detect risk signals such as leaked credentials, anonymous IP addresses, and atypical travel, then automatically triggers remediation actions like requiring password reset or blocking access.

Exam trap

The trap here is that candidates confuse Privileged Identity Management (PIM) with Identity Protection, assuming PIM's role activation controls also detect attacks, when in fact PIM is purely a privileged access management tool with no risk detection capabilities.

Practice this question →
62
MCQmedium

A company wants employees to be able to access corporate applications from their personal mobile devices, but only if those devices are enrolled in mobile device management (MDM) and have a PIN code set. Which Microsoft Entra capability should the administrator use to enforce these requirements?

A.Identity Protection
B.Conditional Access
C.Privileged Identity Management
D.Enterprise App Registration
AnswerB

Conditional Access policies in Microsoft Entra ID are powerful "if-then" statements that define conditions under which users can access resources. It can specifically require that a device accessing corporate applications is marked as compliant by an MDM solution, such as Microsoft Intune, ensuring it meets security standards like having a PIN or being encrypted. This capability directly enforces device management requirements as a prerequisite for access, aligning perfectly with the company's goal.

Why this answer

Conditional Access is the correct Microsoft Entra capability because it allows administrators to create policies that enforce specific requirements—such as device enrollment in MDM and a PIN code—before granting access to corporate applications. By configuring a Conditional Access policy with a grant control requiring 'Require device to be marked as compliant' (which depends on MDM enrollment and PIN compliance), the administrator can block access from personal devices that do not meet these conditions.

Exam trap

The trap here is that candidates often confuse Conditional Access with Identity Protection, thinking that risk-based policies (like requiring MFA for risky sign-ins) are the same as device compliance policies, but Identity Protection does not enforce device enrollment or PIN requirements.

How to eliminate wrong answers

Option A is wrong because Identity Protection focuses on detecting and responding to identity-based risks (e.g., leaked credentials, sign-ins from anonymous IPs) and does not enforce device-level requirements like MDM enrollment or PIN code. Option C is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role activation and access reviews, not device compliance or mobile device management policies. Option D is wrong because Enterprise App Registration is used to register and configure applications for authentication with Microsoft Entra ID, not to enforce device enrollment or PIN requirements.

Practice this question →
63
MCQmedium

Refer to the exhibit. The JSON shows a conditional access policy. What is the effect of this policy?

A.Requires MFA for Office 365 from trusted locations.
B.Applies only to external guest users.
C.Blocks all access to Office 365 from trusted locations.
D.Requires a compliant device for Office 365.
AnswerA

The policy's grant control explicitly states 'Require multi-factor authentication,' which means users must successfully complete an MFA challenge to gain access. When combined with a condition that specifies access to Office 365 from 'trusted locations,' this policy ensures enhanced security even from known network perimeters. It mandates an additional layer of identity verification for these specific access attempts. This configuration aligns perfectly with the principle of least privilege and Zero Trust.

Why this answer

The policy assigns the 'Require multifactor authentication' grant to Office 365 cloud apps, and the condition restricts it to 'trusted locations' (typically corporate networks or compliant IP ranges). This means users accessing Office 365 from those trusted locations must complete MFA, while access from untrusted locations is not affected by this policy (it may be handled by other policies). Option A correctly describes this effect.

Exam trap

The trap here is that candidates confuse 'Require MFA' with 'Block access' or assume that trusted locations imply automatic access without MFA, when in fact the policy explicitly requires MFA even from trusted locations.

How to eliminate wrong answers

Option B is wrong because the policy targets 'All users' (not just external guest users) and does not include a filter for user type. Option C is wrong because the policy grants 'Require multifactor authentication' — it does not block access; blocking would require the 'Block access' control. Option D is wrong because the policy does not include a 'Require compliant device' grant; it only specifies MFA.

Practice this question →
64
MCQmedium

A company manages Azure resources for multiple departments. The security team needs to grant IT administrators temporary, just-in-time access to high-privilege roles (e.g., Contributor, Owner) only when needed, with approval workflows. Which Microsoft Entra ID capability should they configure?

A.Conditional Access
B.Identity Protection
C.Privileged Identity Management (PIM)
D.Entitlement Management (Identity Governance)
AnswerC

Azure AD Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources within Azure AD, Azure, and other Microsoft online services. It enforces just-in-time (JIT) access, allowing users to activate privileged roles only when needed and for a limited duration. This capability significantly reduces the attack surface by eliminating standing administrative access, requiring explicit activation and often approval workflows for elevated permissions.

Why this answer

Privileged Identity Management (PIM) is the correct Microsoft Entra ID capability because it provides just-in-time (JIT) activation of high-privilege roles like Contributor and Owner, with time-bound approvals and approval workflows. PIM allows administrators to request temporary elevation to a role, which must be approved by designated approvers, and the access automatically expires after the specified duration. This directly addresses the requirement for temporary, approval-based access to privileged roles.

Exam trap

The trap here is that candidates often confuse Privileged Identity Management (PIM) with Entitlement Management, because both involve access requests and approvals, but PIM is specifically for just-in-time privileged role activation, while Entitlement Management is for ongoing access to resources like groups and apps.

Why the other options are wrong

A

Conditional Access enforces access policies based on signals like user, device, or location, but does not provide just-in-time role activation or approval workflows for privileged roles.

B

Identity Protection focuses on detecting and responding to identity-based risks (e.g., compromised credentials, risky sign-ins), not on granting temporary, just-in-time privileged access with approval workflows.

D

Entitlement Management focuses on managing access packages and resource access for users, not on providing just-in-time, time-bound, approval-based elevation to high-privilege Azure roles like Contributor or Owner.

Practice this question →
65
MCQmedium

You are evaluating the Conditional Access policy JSON exhibit. The policy includes MFA for Exchange Online but excludes trusted locations. A user reports that they are prompted for MFA when accessing webmail from a trusted IP address. Which is the most likely cause?

A.The location condition is configured to include trusted locations
B.The policy targets high sign-in risk
C.The policy does not apply to Exchange Online
D.The policy requires device compliance
AnswerA

This statement is correct because a Conditional Access policy configured to "include" trusted locations in its `locations` condition will apply its grant controls, such as requiring multi-factor authentication (MFA), even when users are signing in from designated secure network segments. For most MFA policies, the best practice is to *exclude* trusted locations to provide a frictionless experience for users on corporate networks, making the inclusion of trusted locations an often misconfigured or overly restrictive setting.

Why this answer

The policy includes MFA for Exchange Online, but the location condition 'includeLocations' with 'AllTrusted' means it applies to trusted locations, not excludes them. To exclude trusted locations, the policy should use 'excludeLocations'. Therefore, the user is prompted for MFA when accessing from a trusted IP because the policy is incorrectly configured to include trusted locations, making option A the most likely cause.

Practice this question →
66
MCQmedium

A company uses Microsoft Entra ID. They want to require users to perform multifactor authentication (MFA) every 30 days on devices that are marked as compliant, but require MFA for every sign-in attempt on non-compliant devices. Which Conditional Access control should they configure to meet this requirement?

A.Grant control: Require MFA
B.Session control: Sign-in frequency
C.Conditions: Device state
D.Session control: Application restrictions
AnswerB

Sign-in frequency session control allows the administrator to specify how often a user must re-authenticate. This can be set to every 30 days for compliant devices and to 0 (every time) for non-compliant devices to achieve the goal.

Why this answer

The requirement specifies different MFA frequency based on device compliance: every 30 days for compliant devices and every sign-in for non-compliant devices. This is achieved by configuring a Session control called 'Sign-in frequency' in a Conditional Access policy, which allows administrators to set the reauthentication interval (e.g., 30 days) and can be scoped to specific conditions like device state (compliant vs. non-compliant). Grant controls like 'Require MFA' enforce MFA but do not control the frequency of re-prompting.

Exam trap

The trap here is that candidates confuse 'Grant controls' (which enforce MFA) with 'Session controls' (which manage sign-in frequency), leading them to pick 'Require MFA' instead of 'Sign-in frequency' when the question specifically asks about controlling the frequency of MFA prompts.

How to eliminate wrong answers

Option A is wrong because 'Grant control: Require MFA' enforces MFA on every sign-in but cannot differentiate between compliant and non-compliant devices or set a reauthentication frequency like 30 days. Option C is wrong because 'Conditions: Device state' is a condition that filters which devices the policy applies to (e.g., compliant or non-compliant), not a control that enforces MFA frequency. Option D is wrong because 'Session control: Application restrictions' controls access to specific apps or data (e.g., using app protection policies) and does not manage MFA reauthentication intervals.

Practice this question →
67
MCQhard

Your organization, Contoso, uses Microsoft Entra ID for identity management. The security team has recently identified that several users have had their credentials compromised. You need to implement a solution that automatically enforces a password change for high-risk users and blocks sign-ins from risky locations. Additionally, you want to allow users to self-remediate by changing their password when they are at medium risk. You have the following requirements: - Users detected as high risk must be blocked from signing in until an administrator resets their password. - Users detected as medium risk must be prompted to change their password via self-service password reset before they can access resources. - All risk detections must be logged and reported to the security team. - The solution must use built-in Microsoft Entra capabilities without third-party tools. Which of the following actions should you take to meet the requirements?

A.Create conditional access policies that block sign-ins based on location and require MFA for all users.
B.Configure Microsoft Entra ID Protection user risk policies: set a policy to block access for high user risk and a policy to require password change for medium user risk. Enable risk reporting.
C.Administratively assign users to administrative units and require administrators to review risk manually.
D.Use Microsoft Entra ID Governance to create an access package and require approval for access.
AnswerB

Configuring Microsoft Entra ID Protection user risk policies directly fulfills all requirements by leveraging machine learning to detect anomalous user behavior and assign a risk level. A policy can be set to automatically block access for users deemed high risk, preventing potential breaches. Concurrently, another policy can enforce a password change for users with medium risk, proactively mitigating credential compromise. Enabling risk reporting ensures ongoing visibility and auditing of these security events.

Why this answer

Microsoft Entra ID Protection provides built-in user risk policies that automatically block sign-ins for high-risk users and require a password change for medium-risk users, meeting the requirements for automated enforcement and self-remediation. Additionally, ID Protection includes risk reporting capabilities that log all risk detections for the security team, all without third-party tools.

Exam trap

The trap here is that candidates often confuse conditional access policies (which control access based on conditions like location or device) with Identity Protection risk policies (which specifically enforce actions based on user or sign-in risk levels), leading them to choose Option A instead of the correct risk-based policy configuration.

How to eliminate wrong answers

Option A is wrong because conditional access policies that block sign-ins based on location and require MFA do not automatically enforce password changes based on user risk level, nor do they provide the granular risk-based remediation (block vs. password change) required for high and medium risk. Option C is wrong because manually assigning users to administrative units and requiring administrators to review risk manually does not automate enforcement or allow self-remediation; it contradicts the requirement for automatic password change and blocking. Option D is wrong because Microsoft Entra ID Governance access packages and approval workflows are designed for managing resource access and entitlement, not for enforcing risk-based password changes or blocking sign-ins based on compromised credentials.

Practice this question →
68
MCQmedium

A company uses Microsoft Entra ID (Microsoft Entra ID) to manage access to internal applications for employees and guest users. The compliance team requires that all guest users' access to a sensitive application must be reviewed every 90 days by the application owner. If the owner does not respond to the review request, the guest's access must be automatically revoked. Which Microsoft Entra ID feature should the company use?

A.Conditional Access
B.Identity Protection
C.Access Reviews
D.Privileged Identity Management (PIM)
AnswerC

Microsoft Entra ID Access Reviews are specifically designed to manage and streamline the periodic review of user access to resources like groups, applications, and roles. Administrators can configure recurring reviews, assign reviewers (e.g., resource owners, managers), and set up automated actions, such as removing access for users whose access is not approved or if the reviewer fails to respond within a specified timeframe. This capability directly addresses the need for periodic recertification and automated removal.

Why this answer

Access Reviews in Microsoft Entra ID allow administrators to create recurring reviews of guest user access to applications, groups, or roles. The scenario requires a 90-day review cycle with automatic revocation if the owner does not respond, which is a built-in configuration option within an Access Review policy. This directly meets the compliance team's requirement for periodic attestation and automated removal of access.

Exam trap

The trap here is confusing Access Reviews with Privileged Identity Management (PIM), since both involve approvals and time-bound access, but PIM focuses on privileged role activation while Access Reviews handle recurring attestation of any user's access to resources.

How to eliminate wrong answers

Option A is wrong because Conditional Access enforces access policies based on signals like location or device state, but it does not provide periodic attestation or automatic revocation based on reviewer non-response. Option B is wrong because Identity Protection detects and remediates identity-based risks such as leaked credentials or sign-ins from anonymous IP addresses, but it does not schedule recurring access reviews or revoke access due to reviewer inaction. Option D is wrong because Privileged Identity Management (PIM) manages just-in-time activation and approval workflows for privileged roles, but it is not designed for recurring attestation of guest user access to a sensitive application.

Practice this question →
69
MCQhard

A company uses Microsoft Entra ID and a third-party SaaS application. They want to prevent users from downloading sensitive documents from the SaaS app when accessing from unmanaged personal devices, while still allowing read-only access. Which Conditional Access control should they apply to achieve this?

A.Require multifactor authentication (MFA)
B.Require compliant device (Intune compliance policy)
C.Use app control with Microsoft Defender for Cloud Apps session policy
D.Block access
AnswerC

Microsoft Defender for Cloud Apps (MDCAS) acts as a Cloud Access Security Broker (CASB), providing real-time session control over cloud applications. By implementing an MDCAS session policy with app control, traffic between the user and the third-party SaaS application is proxied, allowing for granular actions such as blocking file downloads while simultaneously permitting read-only access. This capability precisely addresses the requirement to allow users to view content but prevent data exfiltration through downloads, often based on contextual factors like device state or user group.

Why this answer

Microsoft Defender for Cloud Apps (MDCA) session policies enable granular control over user actions within a SaaS app, such as blocking downloads while allowing read-only access. This is achieved through reverse proxy architecture that intercepts and enforces policies on HTTP/HTTPS traffic in real time, regardless of device compliance or identity provider status. Conditional Access with MDCA session control is the only option that provides app-level data protection without requiring device management or blocking access entirely.

Exam trap

The trap here is that candidates often confuse identity-based controls (like MFA or device compliance) with app-level data protection controls, not realizing that only MDCA session policies can enforce granular actions like 'block download' while still allowing read-only access within the app itself.

How to eliminate wrong answers

Option A is wrong because requiring multifactor authentication (MFA) only verifies identity and does not control what users can do within a SaaS app after authentication, such as downloading documents. Option B is wrong because requiring a compliant device via Intune compliance policy would block access entirely from unmanaged personal devices, rather than allowing read-only access while preventing downloads. Option D is wrong because blocking access would prevent all access, including the desired read-only capability, which is too restrictive for the requirement.

Practice this question →
70
MCQeasy

Your company is implementing Microsoft Entra ID and wants to ensure that users can sign in using their existing social media accounts. Which feature should you configure?

A.B2B collaboration
B.Conditional Access
C.External Identities
D.Identity Protection
AnswerC

Microsoft Entra External Identities is the comprehensive set of capabilities that allows organizations to manage all external users, including customers, partners, and citizens. It specifically supports enabling sign-in for consumers using social identity providers like Google, Facebook, and Microsoft accounts, as well as enterprise identity providers, allowing them to access applications and resources securely. This feature is crucial for scenarios requiring consumer-facing applications where users bring their own social identities.

Why this answer

External Identities in Microsoft Entra ID allows you to configure identity providers for social media accounts (e.g., Google, Facebook) so users can sign in with their existing credentials. This is done by enabling federation with social identity providers via the External Identities blade, which uses OAuth 2.0 and OpenID Connect protocols to authenticate users without creating a separate Microsoft account.

Exam trap

The trap here is that candidates confuse B2B collaboration (which is for business partners) with External Identities (which includes social identity providers), because both involve external users, but only External Identities supports social login providers like Google and Facebook.

How to eliminate wrong answers

Option A is wrong because B2B collaboration is specifically for inviting external business partners (e.g., from other Azure AD tenants) to access your resources, not for allowing social media account sign-ins. Option B is wrong because Conditional Access is a policy engine that enforces access controls (e.g., MFA, location) after authentication, not a feature for configuring social identity providers. Option D is wrong because Identity Protection is a risk-based detection and remediation service (e.g., leaked credentials, sign-in anomalies), not a feature for adding social identity providers.

Practice this question →
71
MCQeasy

Refer to the exhibit. You are configuring an access package in Microsoft Entra Entitlement Management. Based on the policy, which users can request access to the HR App?

A.Any user in the organization can request access, but guests require manager approval.
B.Only administrators can assign access.
C.Only users in the HR department can request access.
D.Only guest users can request access.
AnswerA

This option accurately describes a common configuration in Azure AD entitlement management access packages. A policy configured for "users in your directory" typically allows all internal members to request access. Furthermore, entitlement management policies offer granular control to specify different approval requirements, such as mandating manager approval specifically for guest users, while internal users might have a different or no approval flow. This balances self-service with necessary oversight for external collaborators.

Why this answer

The access package policy shown in the exhibit is configured with 'For users in your directory' as the scope and 'Specific connected organization' is not selected, meaning any internal user can request. The policy also has 'Approval' set to 'Manager approval' only for 'Guest users', so internal users do not require approval, while guests do. This matches the description that any user in the organization can request, but guests need manager approval.

Exam trap

The trap here is that candidates may misinterpret the approval setting as applying to all users, when in fact it is configured only for guest users, leading them to incorrectly select an option that implies restricted access or exclusive guest access.

How to eliminate wrong answers

Option B is wrong because the policy allows users to request access directly; it does not restrict assignment to administrators only. Option C is wrong because the policy scope is set to 'All users' (or 'For users in your directory'), not limited to the HR department. Option D is wrong because the policy allows both internal users and guest users to request access, not exclusively guests.

Practice this question →
72
MCQeasy

Your organization uses Microsoft Entra ID. A user reports that they are unable to access any Microsoft 365 services because they forgot their password. Which self-service tool should they use?

A.Self-Service Password Reset (SSPR)
B.Password reset admin portal
C.Identity Protection
D.Privileged Identity Management
AnswerA

Self-Service Password Reset (SSPR) allows users to reset their forgotten password without administrator intervention, directly addressing the user's inability to access Microsoft 365 services due to password loss. SSPR operates through Microsoft Entra ID's authentication methods—such as security questions, phone verification, or email verification—to verify identity before permitting a reset, satisfying the constraint that the user cannot authenticate via their forgotten password.

Why this answer

Self-Service Password Reset (SSPR) allows users to reset their own passwords without administrator intervention. Option B, the Password reset admin portal, is intended for administrators to reset passwords for users, not for self-service. Option C, Identity Protection, is a feature that detects and responds to identity-based risks, not for password resets.

Option D, Privileged Identity Management, manages and monitors privileged roles and access, not password recovery.

Practice this question →
73
MCQeasy

An organization wants to protect against password spray attacks by automatically blocking sign-ins from suspicious IP addresses. Which Microsoft Entra feature should they use?

A.Microsoft Entra Self-Service Password Reset
B.Microsoft Entra Identity Protection
C.Microsoft Entra Privileged Identity Management
D.Microsoft Entra Multifactor Authentication
AnswerB

Microsoft Entra Identity Protection is purpose-built to detect and automatically remediate identity-based risks, including sophisticated password spray attacks. It utilizes machine learning and behavioral analytics to identify anomalous sign-in patterns, such as sign-ins from unfamiliar locations, impossible travel, or multiple failed attempts across various accounts from a suspicious IP address. Based on these risk detections, Identity Protection can enforce conditional access policies to block or challenge risky sign-ins, effectively preventing unauthorized access.

Why this answer

Microsoft Entra Identity Protection uses machine learning to detect and automatically block sign-ins from suspicious IP addresses, such as those associated with anonymous proxies or known malicious activity. It directly mitigates password spray attacks by applying risk-based conditional access policies that require additional verification or block the sign-in attempt.

Exam trap

The trap here is that candidates often confuse the detection and blocking capability (Identity Protection) with the enforcement mechanism (Conditional Access or MFA), but the question asks for the feature that 'automatically blocks sign-ins from suspicious IP addresses,' which is Identity Protection's risk-based policy integration.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Self-Service Password Reset (SSPR) allows users to reset their own passwords, but it does not detect or block sign-ins from suspicious IP addresses. Option C is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time access and role assignments for privileged accounts, not real-time sign-in risk detection. Option D is wrong because Microsoft Entra Multifactor Authentication (MFA) adds a second verification factor but does not automatically block sign-ins based on IP address reputation; it can be triggered by Identity Protection policies but is not the feature that performs the blocking itself.

Practice this question →
74
MCQmedium

Your organization uses Microsoft Entra ID and needs to block sign-ins from legacy authentication protocols to reduce risk. Which feature should you use?

A.Security defaults
B.Privileged Identity Management
C.Identity Protection
D.Conditional Access
AnswerD

Conditional Access can block legacy authentication by targeting client apps.

Why this answer

Conditional Access policies in Microsoft Entra ID allow you to block sign-ins from legacy authentication protocols by targeting client apps that use protocols like POP3, IMAP, SMTP, or older Office clients that do not support modern authentication. This is the correct feature because it provides granular, policy-based control to explicitly deny authentication requests that use legacy protocols, directly addressing the requirement to reduce risk from these less secure methods.

Exam trap

The trap here is that candidates often confuse Security defaults (which do block legacy authentication by default) with the ability to customize or target that block, but the question asks for a feature to 'block sign-ins from legacy authentication protocols' in a way that can be tailored to organizational needs, which only Conditional Access supports.

How to eliminate wrong answers

Option A is wrong because Security defaults provide a baseline set of security policies (like requiring MFA for all users and blocking legacy authentication) but are a fixed, non-customizable feature intended for small organizations; they cannot be selectively applied or fine-tuned to block legacy authentication for specific users or scenarios. Option B is wrong because Privileged Identity Management (PIM) is focused on just-in-time privileged access management, role activation, and approval workflows for administrative roles, not on controlling authentication protocols used during sign-in. Option C is wrong because Identity Protection uses risk-based policies (e.g., user risk, sign-in risk) to block or require MFA, but it does not have a direct setting to block legacy authentication protocols; it relies on Conditional Access policies to enforce such blocks.

Practice this question →
75
MCQmedium

A company uses Microsoft Entra ID and wants to automatically detect and remediate over-privileged roles in their Azure subscriptions and AWS accounts. They need to get a unified view of permissions across multiple clouds. Which Microsoft Entra capability should they use?

A.Microsoft Entra Identity Protection
B.Microsoft Entra Permissions Management
C.Microsoft Entra Verified ID
D.Microsoft Entra ID Governance
AnswerB

Microsoft Entra Permissions Management, a Cloud Infrastructure Entitlement Management (CIEM) solution, provides comprehensive visibility and control over permissions across multi-cloud environments, including Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). It enables organizations to discover, remediate, and continuously monitor permissions, identifying and right-sizing over-privileged identities to enforce the principle of least privilege. This directly addresses the need for multi-cloud permissions visibility and automated remediation.

Why this answer

Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) solution that provides visibility into permissions across multi-cloud environments, including Azure and AWS. It automatically detects over-privileged roles and can remediate them by enforcing least-privilege access policies, making it the correct choice for the described requirement.

Exam trap

The trap here is that candidates confuse Microsoft Entra ID Governance with Permissions Management because both deal with 'permissions,' but Governance handles identity lifecycle and access reviews within Entra ID, not multi-cloud infrastructure permission analysis or automated remediation.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Identity Protection focuses on detecting identity-based risks such as compromised credentials and sign-in anomalies, not on managing cloud infrastructure permissions. Option C is wrong because Microsoft Entra Verified ID is a decentralized identity solution for verifiable credentials, unrelated to cloud permission management. Option D is wrong because Microsoft Entra ID Governance covers identity lifecycle, access reviews, and entitlement management within Microsoft Entra ID, but it does not provide multi-cloud permission visibility or automated remediation for over-privileged roles in AWS or Azure subscriptions.

Practice this question →
Page 1 of 5 · 314 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Describe the capabilities of Microsoft Entra questions.

Start 20-question session