CCNA Entra Capabilities Questions — Page 2 of 5

MCQeasy

Your organization uses Microsoft Entra ID. A user reports that they are unable to access any Microsoft 365 services because they forgot their password. Which self-service tool should they use?

A.Self-Service Password Reset (SSPR)

B.Password reset admin portal

C.Identity Protection

D.Privileged Identity Management

AnswerA

Self-Service Password Reset (SSPR) allows users to reset their forgotten password without administrator intervention, directly addressing the user's inability to access Microsoft 365 services due to password loss. SSPR operates through Microsoft Entra ID's authentication methods—such as security questions, phone verification, or email verification—to verify identity before permitting a reset, satisfying the constraint that the user cannot authenticate via their forgotten password.

Why this answer

Self-Service Password Reset (SSPR) in Microsoft Entra ID allows users to reset their own passwords without contacting the helpdesk, restoring access to Microsoft 365 services. When a user forgets their password and cannot sign in, SSPR is the designated self-service tool, provided the organization has enabled and configured it. It supports authentication methods like Microsoft Authenticator, email, or phone.

Exam trap

SC-900 often tests confusion between SSPR (user self-service password reset) and Identity Protection (risk-based detection), catching candidates who pick the security monitoring tool when the scenario is a simple forgotten password.

How to eliminate wrong answers

Option B is wrong because there is no 'password reset admin portal' as a user-facing self-service tool; admins reset passwords via the Microsoft 365 admin center or Entra admin center, but that is not self-service for the end user. Option C is wrong because Identity Protection detects and remediates risky sign-ins and compromised credentials, but it does not provide a password reset interface for a user who simply forgot their password. Option D is wrong because Privileged Identity Management manages just-in-time privileged role activation, not end-user password reset.

Practice this question →

MCQeasy

An organization wants to protect against password spray attacks by automatically blocking sign-ins from suspicious IP addresses. Which Microsoft Entra feature should they use?

A.Microsoft Entra Self-Service Password Reset

B.Microsoft Entra Identity Protection

C.Microsoft Entra Privileged Identity Management

D.Microsoft Entra Multifactor Authentication

AnswerB

Microsoft Entra Identity Protection is purpose-built to detect and automatically remediate identity-based risks, including sophisticated password spray attacks. It utilizes machine learning and behavioral analytics to identify anomalous sign-in patterns, such as sign-ins from unfamiliar locations, impossible travel, or multiple failed attempts across various accounts from a suspicious IP address. Based on these risk detections, Identity Protection can enforce conditional access policies to block or challenge risky sign-ins, effectively preventing unauthorized access.

Why this answer

Microsoft Entra Identity Protection uses machine learning to detect and automatically block sign-ins from suspicious IP addresses, such as those associated with anonymous proxies or known malicious activity. It directly mitigates password spray attacks by applying risk-based conditional access policies that require additional verification or block the sign-in attempt.

Exam trap

The trap here is that candidates often confuse the detection and blocking capability (Identity Protection) with the enforcement mechanism (Conditional Access or MFA), but the question asks for the feature that 'automatically blocks sign-ins from suspicious IP addresses,' which is Identity Protection's risk-based policy integration.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Self-Service Password Reset (SSPR) allows users to reset their own passwords, but it does not detect or block sign-ins from suspicious IP addresses. Option C is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time access and role assignments for privileged accounts, not real-time sign-in risk detection. Option D is wrong because Microsoft Entra Multifactor Authentication (MFA) adds a second verification factor but does not automatically block sign-ins based on IP address reputation; it can be triggered by Identity Protection policies but is not the feature that performs the blocking itself.

Practice this question →

MCQmedium

Your organization uses Microsoft Entra ID and needs to block sign-ins from legacy authentication protocols to reduce risk. Which feature should you use?

A.Security defaults

B.Privileged Identity Management

C.Identity Protection

D.Conditional Access

AnswerD

Conditional Access evaluates sign-in conditions and can enforce a block for legacy authentication clients, which cannot perform modern interactive authentication or MFA. This directly satisfies the requirement to block legacy protocol sign-ins, since the policy targets those client types at authentication time.

Why this answer

Conditional Access policies in Microsoft Entra ID allow you to block sign-ins from legacy authentication protocols by targeting client apps that use protocols like POP3, IMAP, SMTP, or older Office clients that do not support modern authentication. This is the correct feature because it provides granular, policy-based control to explicitly deny authentication requests that use legacy protocols, directly addressing the requirement to reduce risk from these less secure methods.

Exam trap

The trap here is that candidates often confuse Security defaults (which do block legacy authentication by default) with the ability to customize or target that block, but the question asks for a feature to 'block sign-ins from legacy authentication protocols' in a way that can be tailored to organizational needs, which only Conditional Access supports.

How to eliminate wrong answers

Option A is wrong because Security defaults provide a baseline set of security policies (like requiring MFA for all users and blocking legacy authentication) but are a fixed, non-customizable feature intended for small organizations; they cannot be selectively applied or fine-tuned to block legacy authentication for specific users or scenarios. Option B is wrong because Privileged Identity Management (PIM) is focused on just-in-time privileged access management, role activation, and approval workflows for administrative roles, not on controlling authentication protocols used during sign-in. Option C is wrong because Identity Protection uses risk-based policies (e.g., user risk, sign-in risk) to block or require MFA, but it does not have a direct setting to block legacy authentication protocols; it relies on Conditional Access policies to enforce such blocks.

Practice this question →

MCQmedium

A company uses Microsoft Entra ID and wants to automatically detect and remediate over-privileged roles in their Azure subscriptions and AWS accounts. They need to get a unified view of permissions across multiple clouds. Which Microsoft Entra capability should they use?

A.Microsoft Entra Identity Protection

B.Microsoft Entra Permissions Management

C.Microsoft Entra Verified ID

D.Microsoft Entra ID Governance

AnswerB

Microsoft Entra Permissions Management, a Cloud Infrastructure Entitlement Management (CIEM) solution, provides comprehensive visibility and control over permissions across multi-cloud environments, including Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). It enables organizations to discover, remediate, and continuously monitor permissions, identifying and right-sizing over-privileged identities to enforce the principle of least privilege. This directly addresses the need for multi-cloud permissions visibility and automated remediation.

Why this answer

Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) solution that provides visibility into permissions across multi-cloud environments, including Azure and AWS. It automatically detects over-privileged roles and can remediate them by enforcing least-privilege access policies, making it the correct choice for the described requirement.

Exam trap

The trap here is that candidates confuse Microsoft Entra ID Governance with Permissions Management because both deal with 'permissions,' but Governance handles identity lifecycle and access reviews within Entra ID, not multi-cloud infrastructure permission analysis or automated remediation.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Identity Protection focuses on detecting identity-based risks such as compromised credentials and sign-in anomalies, not on managing cloud infrastructure permissions. Option C is wrong because Microsoft Entra Verified ID is a decentralized identity solution for verifiable credentials, unrelated to cloud permission management. Option D is wrong because Microsoft Entra ID Governance covers identity lifecycle, access reviews, and entitlement management within Microsoft Entra ID, but it does not provide multi-cloud permission visibility or automated remediation for over-privileged roles in AWS or Azure subscriptions.

Practice this question →

MCQmedium

A user reports that they cannot access the company's HR application, which requires Microsoft Entra ID authentication. The user can access other apps that also use Entra ID. What is the most likely cause?

A.The user's account is disabled.

B.The tenant is blocked for all sign-ins.

C.The user's password expired.

D.A conditional access policy is blocking access to that specific app.

AnswerD

Conditional Access policies provide granular control over access to specific cloud applications based on various conditions, such as user location, device state, or sign-in risk. An administrator could have configured a policy specifically targeting the HR application to block access under certain circumstances, while allowing access to other applications that are not subject to the same restrictive policy. This targeted enforcement is a core capability of Conditional Access and aligns perfectly with the observed behavior.

Why this answer

The user can access other Microsoft Entra ID-integrated apps, which rules out account-level issues like a disabled account or expired password. A conditional access policy can target specific applications, so it is the most likely cause of the block on just the HR app.

Exam trap

The trap here is that candidates often assume a user-specific issue (like disabled account or expired password) when they see a single user blocked, but the key clue is that other apps work, pointing to an app-specific conditional access policy rather than a global or user-level problem.

How to eliminate wrong answers

Option A is wrong because if the user's account were disabled, they would be unable to access any Entra ID-authenticated app, not just the HR app. Option B is wrong because a tenant-wide block would prevent all sign-ins for all users, not just this user's access to one app. Option C is wrong because an expired password would affect authentication to all apps using the same Entra ID tenant, not selectively block one app.

Practice this question →

MCQmedium

A company wants to allow its partners to access a specific SharePoint Online site using their own corporate credentials. The company does not want to manage partner accounts. Which Microsoft Entra feature should they use?

A.Microsoft Entra External ID

B.Microsoft Entra Privileged Identity Management

C.Microsoft Entra Identity Protection

D.Microsoft Entra Conditional Access

AnswerA

Microsoft Entra External ID is the comprehensive solution for managing external identities and providing them secure access to your organization's applications and resources. It enables business-to-business (B2B) collaboration, allowing partners to use their existing corporate or social identities (e.g., Microsoft accounts, Google, federated SAML/WS-Fed providers) to sign in. This feature integrates external users directly into your Microsoft Entra tenant, facilitating seamless collaboration while maintaining administrative control over their access permissions.

Why this answer

Microsoft Entra External ID (formerly Azure AD B2B) allows organizations to grant external partners access to resources like SharePoint Online using their own corporate or social identities. This eliminates the need to create and manage separate user accounts for partners, as they authenticate through their home identity provider via federation or invitation redemption.

Exam trap

The trap here is that candidates often confuse Conditional Access (which controls access after authentication) with the identity provider federation capability of External ID, mistakenly thinking policies alone can enable external authentication without a dedicated identity solution.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra Privileged Identity Management (PIM) is used for just-in-time privileged role activation and access reviews within an organization, not for enabling external partner access with their own credentials. Option C is wrong because Microsoft Entra Identity Protection detects and remediates identity-based risks (e.g., leaked credentials, sign-ins from anonymous IPs) for internal users, not for managing external partner authentication. Option D is wrong because Microsoft Entra Conditional Access enforces policies (e.g., MFA, device compliance) on sign-in events but does not itself provide the mechanism for external identities to authenticate using their own credentials; it works in conjunction with External ID.

Practice this question →

MCQeasy

A user reports that they are unable to sign in to a SaaS application that is configured for single sign-on (SSO) with Microsoft Entra ID. The user can sign in to other applications. What should you check first?

A.Confirm the user's account is not disabled.

B.Verify that the user has reset their password recently.

C.Ensure the user has an appropriate Microsoft 365 license.

D.Check if the user is assigned to the application in Microsoft Entra ID.

AnswerD

For most enterprise applications configured with Microsoft Entra ID for single sign-on, explicit user or group assignment is a mandatory authorization step. If a user is not assigned to the application, Microsoft Entra ID will deny access even if their authentication credentials are valid, preventing them from reaching the SaaS application.

Why this answer

The most common cause of SSO failure for a single application, when the user can sign in to other apps, is that the user has not been assigned to that specific application in Microsoft Entra ID. Without explicit assignment, the user cannot authenticate via SSO even if their account is active and licensed. This is a core requirement for application-level access control in Entra ID.

Exam trap

The trap here is that candidates confuse global authentication issues (like disabled accounts or password problems) with application-specific authorization, which is governed by user assignment in Entra ID, not by the user's overall account state or licensing.

How to eliminate wrong answers

Option A is wrong because if the user's account were disabled, they would be unable to sign in to any application, not just the one in question. Option B is wrong because a recent password reset does not affect SSO sign-in; SSO relies on the user's primary authentication token, and a password change would apply globally, not selectively block one app. Option C is wrong because Microsoft 365 licensing is unrelated to SSO access for a third-party SaaS application; licensing controls access to Microsoft 365 services, not Entra ID application assignments.

Practice this question →

MCQmedium

Refer to the exhibit. You are reviewing a risk detection in Microsoft Entra Identity Protection. The risk event indicates 'unfamiliarFeatures' with medium risk level for user John Doe from IP 203.0.113.5. What is the most likely cause of this risk detection?

A.There was an impossible travel event detected.

B.John Doe's credentials were leaked on the dark web.

C.The sign-in originated from an anonymous IP address.

D.The sign-in was from an unfamiliar location or device.

AnswerD

The unfamiliarFeatures detection flags sign-in properties that deviate from the user's learned baseline, such as a new location, device or network. Medium risk at IP 203.0.113.5 indicates behaviour outside John Doe's normal pattern rather than confirmed credential compromise.

Why this answer

The 'unfamiliarFeatures' risk detection in Microsoft Entra Identity Protection specifically identifies sign-ins that exhibit properties unfamiliar to the user's typical behavior, such as a new device, browser, or geographic location. The detection is based on machine learning models that compare the current sign-in against the user's historical sign-in patterns, and a medium risk level indicates a moderate likelihood that the sign-in is not legitimate. This matches option D, as the risk event is triggered by a sign-in from an unfamiliar location or device, not by impossible travel, leaked credentials, or anonymous IP.

Exam trap

The trap here is that candidates confuse 'unfamiliarFeatures' with 'impossible travel' or 'anonymous IP address', but Microsoft Entra Identity Protection categorizes each risk detection type separately, and the question's specific risk event name directly points to unfamiliar sign-in properties, not to other detection types.

How to eliminate wrong answers

Option A is wrong because 'impossible travel' is a separate risk detection type that requires two sign-ins from geographically distant locations within a time window that makes physical travel impossible, which is not indicated by the 'unfamiliarFeatures' detection. Option B is wrong because 'leaked credentials' is a distinct risk detection that checks for credentials exposed in known data breaches or on the dark web, not for unfamiliar sign-in properties. Option C is wrong because 'anonymous IP address' is a different risk detection that flags sign-ins from known anonymous proxies or VPNs, which is not the same as an unfamiliar location or device; the IP 203.0.113.5 is a documentation example and not necessarily anonymous.

Practice this question →

MCQmedium

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their existing social media accounts, such as Google or Facebook, while maintaining security and compliance with conditional access policies. What should you configure?

A.Enable Microsoft Entra Permissions Management.

B.Deploy Microsoft Entra Verified ID.

C.Configure Microsoft Entra B2B collaboration for guest users.

D.Configure Microsoft Entra External ID with social identity providers.

AnswerD

Microsoft Entra External ID, formerly Azure AD B2C, is specifically designed to manage customer-facing applications and enable users to sign in using various identity providers, including social accounts like Google, Facebook, and Microsoft accounts. It provides robust capabilities for user flows, custom branding, and integration with applications, allowing organizations to configure social identity providers directly to facilitate seamless consumer access and apply conditional access policies.

Why this answer

Microsoft Entra External ID (formerly Azure AD External Identities) allows you to configure social identity providers such as Google and Facebook as external identity sources. This enables users to sign in with their existing social media accounts while still being subject to your tenant's conditional access policies, ensuring security and compliance.

Exam trap

The trap here is confusing Microsoft Entra B2B collaboration (for business guest users) with Microsoft Entra External ID (which includes social identity providers for consumer-facing apps), leading candidates to incorrectly select option C.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) tool for managing permissions across multi-cloud environments, not for configuring social identity providers. Option B is wrong because Microsoft Entra Verified ID is a decentralized identity solution based on verifiable credentials (W3C standards), not for integrating social media logins. Option C is wrong because Microsoft Entra B2B collaboration is designed for inviting external business partners as guest users using their work or school accounts, not for allowing end users to sign in with personal social media accounts.

Practice this question →

Multi-Selecthard

Which THREE components are part of Microsoft Entra ID's identity governance? (Choose three.)

Select 3 answers

A.Self-Service Password Reset

B.Privileged Identity Management

C.Entitlement Management

D.Access Reviews

E.Conditional Access

AnswersB, C, D

Microsoft Entra ID Privileged Identity Management (PIM) is a core component of identity governance designed to manage, control, and monitor access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. PIM helps mitigate the risks associated with excessive, unnecessary, or misused access permissions by providing just-in-time (JIT) access, time-bound access, and requiring approval or multi-factor authentication for role activation. It specifically governs privileged roles by enforcing principles like least privilege and zero trust, ensuring that elevated permissions are only granted when absolutely necessary and for a limited duration.

Why this answer

Privileged Identity Management (B) is a core identity governance component in Microsoft Entra ID, providing just-in-time role activation, approval workflows, and time-bound privileged access to Azure AD and Azure resources. Entitlement Management (C) is also part of identity governance, delivering access packages, catalogs, and automated access request/assignment workflows for internal and external users. Access Reviews (D) belongs to identity governance as well, enabling periodic recertification of group memberships, application assignments, and privileged role assignments to ensure least privilege.

Self-Service Password Reset (A) is an authentication/credential management feature, not an identity governance component, and Conditional Access (E) is a policy-based access control engine for enforcing sign-in conditions, not part of identity governance.

Exam trap

The trap here is that candidates often confuse Conditional Access (a security control) with identity governance, or mistake Self-Service Password Reset (a user convenience feature) for a governance tool, when in fact governance focuses on managing who has access and for how long, not on how access is authenticated or enforced.

Practice this question →

MCQeasy

A company wants to enable employees to securely access on-premises applications without needing a VPN. Which Microsoft Entra feature should they implement?

A.Identity Protection

B.B2B Collaboration

C.Application Proxy

D.Privileged Identity Management

AnswerC

Azure AD Application Proxy provides secure remote access to on-premises web applications for internal users without requiring a VPN or opening inbound firewall ports. It acts as a reverse proxy, publishing internal applications through Azure AD, allowing employees to authenticate with their Azure AD credentials. This solution enables seamless and secure access to corporate resources from any location, making it the ideal choice for the scenario described.

Why this answer

Microsoft Entra Application Proxy provides secure remote access to on-premises web applications by acting as a reverse proxy. It eliminates the need for a VPN by routing user traffic through the Entra ID service, which authenticates the user and then establishes a secure outbound connection to the on-premises application connector. This allows employees to access internal apps from anywhere using the same credentials and conditional access policies.

Exam trap

The trap here is that candidates often confuse Application Proxy with a VPN or assume that B2B Collaboration is needed for remote access, but the key differentiator is that Application Proxy is specifically designed for secure, VPN-less access to on-premises web apps through a reverse proxy architecture.

How to eliminate wrong answers

Option A is wrong because Identity Protection is a risk-based detection and remediation tool that identifies compromised identities and suspicious sign-ins, not a remote access solution for on-premises applications. Option B is wrong because B2B Collaboration enables external users (partners, vendors) to access your organization's resources using their own identities, but it does not provide a reverse proxy or secure channel to on-premises apps. Option D is wrong because Privileged Identity Management (PIM) manages just-in-time and time-bound access to privileged roles in Azure AD and Azure resources, not general remote access to on-premises applications.

Practice this question →

MCQhard

Your organization is using Microsoft Entra ID with P2 licenses. You need to ensure that all guest users are reviewed for access quarterly, and if not approved, access is automatically removed. Which Microsoft Entra feature should you configure?

A.Microsoft Entra Privileged Identity Management

B.Microsoft Entra Identity Protection

C.Microsoft Entra Entitlement Management

D.Microsoft Entra Access Reviews

AnswerD

Microsoft Entra Access Reviews provide a systematic and efficient way for organizations to manage and attest to group memberships, access to enterprise applications, and privileged role assignments. They enable resource owners or designated reviewers to periodically verify who still requires access, and critically, can be configured to automatically revoke access for users who are not approved or fail to respond to the review, directly addressing the requirement to remove access if not approved.

Why this answer

Microsoft Entra Access Reviews (D) is the correct feature because it allows you to create recurring reviews for guest users, set the frequency to quarterly, and configure auto-apply settings to automatically remove access if the review is not approved. This directly meets the requirement for periodic attestation and automated remediation.

Exam trap

The trap here is that candidates confuse Entitlement Management (which creates access packages) with Access Reviews (which performs the actual recurring review and auto-removal), but only Access Reviews provides the quarterly schedule and automatic removal enforcement described in the scenario.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Privileged Identity Management (PIM) is designed for just-in-time privileged role activation and approval workflows, not for periodic access reviews of guest users. Option B is wrong because Microsoft Entra Identity Protection focuses on detecting and remediating identity-based risks (e.g., leaked credentials, sign-in anomalies), not on scheduling and automating access reviews. Option C is wrong because Microsoft Entra Entitlement Management manages access packages and catalogs for resource provisioning, but it does not natively provide the recurring review and auto-removal cycle; it relies on Access Reviews for that functionality.

Practice this question →

MCQhard

You are the identity administrator for a multinational company using Microsoft Entra ID. The company has a Microsoft 365 E5 subscription. The security team wants to enforce the following requirements: 1. All users must use multi-factor authentication (MFA) when accessing sensitive applications (e.g., finance app). 2. Users from the IT department must use passwordless authentication methods (e.g., Windows Hello for Business) when accessing any resource. 3. All access to sensitive applications must be logged and monitored for anomalous activity. 4. Guest users from partner organizations must be automatically reviewed quarterly to ensure they still need access. 5. The company wants to minimize administrative overhead by automating as much as possible. You need to design a solution that meets these requirements using Microsoft Entra ID capabilities. Which combination of actions should you take?

A.Configure Self-Service Password Reset (SSPR) for all users. Enable Microsoft Entra ID Protection. Create an access review for guests.

B.Use Microsoft Entra ID Protection to enforce MFA based on risk. Implement Privileged Identity Management (PIM) for IT. Configure access reviews for guests.

C.Enable security defaults to enforce MFA for all users. Configure Microsoft Entra ID Protection to monitor anomalies. Use Microsoft Entra ID Governance to automate guest access reviews.

D.Create Conditional Access policies: one requiring MFA for the finance app, another requiring passwordless authentication strength for IT. Enable Microsoft Entra ID Protection to log and monitor sign-in risks. Create an access review for guest users.

AnswerD

This option directly addresses all specified requirements. Creating Conditional Access policies allows for precise enforcement: one policy can require MFA for the finance application, and another can mandate a passwordless authentication strength for the IT group. Enabling Microsoft Entra ID Protection ensures that sign-in risks are continuously logged and monitored, providing essential security insights. Finally, creating an access review for guest users fulfills the requirement for systematic management of external access.

Why this answer

It uses Conditional Access policies to enforce MFA for the finance app and passwordless authentication strength for IT, meeting requirements 1 and 2. Microsoft Entra ID Protection logs and monitors sign-in risks for sensitive apps (requirement 3), and an access review for guest users automates quarterly reviews (requirement 4). This minimizes administrative overhead by leveraging automation, aligning with requirement 5.

Exam trap

The trap here is that candidates often confuse security defaults (which enforce MFA for all users but lack granularity) with Conditional Access policies (which allow targeted MFA and authentication strength requirements), and they may overlook that passwordless enforcement requires an authentication strength policy, not just MFA.

How to eliminate wrong answers

Option A is wrong because SSPR does not enforce MFA or passwordless authentication; it only allows self-service password reset, and Entra ID Protection alone cannot enforce MFA without a Conditional Access policy. Option B is wrong because PIM is for just-in-time privileged access management, not for enforcing passwordless authentication for all IT users; it also does not address the MFA requirement for the finance app. Option C is wrong because security defaults enforce MFA for all users, not just for sensitive apps, and they do not support passwordless authentication strength policies; Entra ID Governance is not a specific feature for automating guest access reviews (access reviews are part of Entra ID Governance, but the option incorrectly implies a separate product).

Practice this question →

MCQhard

A multinational organization uses Microsoft Entra ID for identity management. External contractors need temporary elevated access to Azure resources for a critical project. The access must be time-bound (expires after 8 hours), require manager approval, and enforce multifactor authentication (MFA) when contractors activate the role. Which Microsoft Entra capability should they configure?

A.Privileged Identity Management (PIM)

B.Identity Protection

C.Conditional Access

D.Access Reviews

AnswerA

Microsoft Entra Privileged Identity Management (PIM) enables organizations to manage, control, and monitor access to important resources. It provides just-in-time (JIT) access, allowing users to activate privileged roles for a limited time period. This activation often requires multi-factor authentication (MFA) and an approval workflow, ensuring that elevated permissions are granted only when necessary and with proper oversight, significantly reducing the attack surface for privileged accounts.

Why this answer

Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure resources with time-bound activation (e.g., 8-hour expiry), requires approval workflows (manager approval), and enforces multifactor authentication (MFA) during role activation. PIM is specifically designed to manage, control, and monitor access to critical resources through time-limited, approved, and MFA-protected role assignments.

Exam trap

The trap here is that candidates confuse Conditional Access (which enforces MFA at sign-in) with PIM's ability to enforce MFA specifically during role activation, or they mistakenly think Access Reviews can grant time-bound access, when in fact Access Reviews only validate existing access and do not provide JIT activation or approval workflows.

How to eliminate wrong answers

Option B (Identity Protection) is wrong because it focuses on detecting and remediating identity-based risks (e.g., leaked credentials, sign-ins from anonymous IPs) and does not provide time-bound role activation, approval workflows, or MFA enforcement for privileged access. Option C (Conditional Access) is wrong because it enforces access policies (like MFA) based on signals (user, location, device) at sign-in time, but it does not manage role activation, time-bound expiry, or approval workflows for privileged roles. Option D (Access Reviews) is wrong because it is used to periodically review and certify existing group memberships or role assignments, not to grant temporary, time-bound elevated access with approval and MFA enforcement.

Practice this question →

Drag & Dropmedium

Order the steps to create a conditional access policy in Azure AD.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Creating a conditional access policy requires admin sign-in, navigating to Conditional Access, creating a new policy, configuring assignments and controls, then enabling it.

Practice this question →

MCQmedium

A company uses Microsoft Entra ID. They want to ensure only current employees have access to a sensitive HR application. They implement a process where group membership for the HR app is reviewed quarterly by the HR manager, and any unnecessary access is automatically removed. Which Microsoft Entra feature should they use?

A.A

B.B

C.C

D.D

AnswerC

Microsoft Entra Access Reviews, a component of Entra ID Governance, are specifically designed to manage the lifecycle of access to resources by enabling organizations to periodically review who has access to groups, applications, or roles. This feature allows for scheduled reviews, automated notifications to reviewers, and the automatic removal of access for users who no longer require it, directly addressing the need for periodic access validation and cleanup.

Why this answer

The scenario describes a recurring review of group membership for the HR application, with automatic removal of unnecessary access. This is exactly what Microsoft Entra ID Governance's Access Reviews feature provides: scheduled reviews (e.g., quarterly) where a reviewer (the HR manager) attests to each member's continued need, and stale access is automatically revoked upon completion.

Exam trap

The trap here is that candidates often confuse Access Reviews with Privileged Identity Management (PIM) because both involve 'review' and 'access,' but PIM is specifically for privileged roles and time-bound activation, not for recurring attestation of standard application group memberships.

How to eliminate wrong answers

Option A is wrong because Privileged Identity Management (PIM) is designed for just-in-time privileged role activation and approval workflows, not for recurring attestation of standard group membership for an application. Option B is wrong because Conditional Access policies enforce real-time access controls based on conditions (location, device, risk), but they do not provide periodic review or automatic removal of group memberships. Option D is wrong because Identity Protection focuses on detecting and responding to identity-based risks (e.g., leaked credentials, anomalous sign-ins), not on scheduling and automating group membership attestation.

Practice this question →

MCQeasy

You are designing an identity solution for a new company that will use Microsoft Entra ID. The company wants employees to use biometrics (fingerprint) on their mobile devices to sign in without typing a password. Which Microsoft Entra feature should you implement?

A.Windows Hello for Business

B.Microsoft Authenticator app (passwordless)

C.SMS-based sign-in

D.FIDO2 security keys

AnswerB

The Microsoft Authenticator app provides a secure and convenient passwordless sign-in experience by leveraging the biometric capabilities (fingerprint or facial recognition) inherent to the user's mobile device. When a user attempts to sign in to an Azure AD-connected application, a notification is sent to the Authenticator app, prompting for approval using the device's native biometrics. This method securely verifies the user's identity on their registered mobile device, eliminating the need to type a password and enhancing security against phishing attacks. It directly addresses the requirement for mobile biometric authentication.

Why this answer

The Microsoft Authenticator app (passwordless) allows users to sign in to Microsoft Entra ID using biometrics (fingerprint, face, or PIN) on their mobile device without entering a password. This feature uses the device's built-in biometric capabilities to verify the user's identity, making it the correct choice for the described scenario.

Exam trap

The trap here is that candidates may confuse Windows Hello for Business with mobile biometrics, but Windows Hello for Business is specifically tied to Windows devices and not to mobile phones or tablets.

How to eliminate wrong answers

Option A is wrong because Windows Hello for Business is designed for Windows devices (PCs, laptops) using biometrics like fingerprint or facial recognition, not for mobile devices. Option C is wrong because SMS-based sign-in uses a text message code, not biometrics, and still requires a password for initial setup. Option D is wrong because FIDO2 security keys are hardware-based external devices (e.g., USB keys) that require physical possession, not mobile device biometrics.

Practice this question →

MCQmedium

A user reports that they cannot access a cloud app even though they are in the correct location and have a valid license. The administrator suspects a Conditional Access policy might be blocking access. Which tool should the admin use to diagnose the issue?

A.Sign-in logs

B.My Apps portal

C.Conditional Access 'What If' tool

D.Audit logs

AnswerA

Sign-in logs provide historical data about past authentication attempts, detailing success or failure, and any Conditional Access policies that were applied at that specific time. However, they do not offer a predictive capability to simulate a new sign-in scenario with hypothetical conditions, which is crucial for proactively diagnosing why a user *might* be blocked before they even attempt access under new circumstances.

Why this answer

Sign-in logs provide detailed information about every sign-in attempt, including whether Conditional Access policies were applied, which policies were triggered, and the outcome (success or failure). When a user reports they cannot access an app and a Conditional Access policy is suspected, reviewing the sign-in logs for that user's attempts will directly show if a policy blocked access and why, making it the primary diagnostic tool for an existing issue.

Exam trap

The trap here is that candidates might confuse the 'What If' tool (which simulates what *would* happen) with the Sign-in logs (which show what *did* happen). For diagnosing an *actual* reported access issue, the Sign-in logs provide the definitive record of the specific Conditional Access policy application and outcome.

How to eliminate wrong answers

Option A is wrong because Sign-in logs show historical sign-in events and their status (success, failure, blocked), but they do not allow proactive simulation of Conditional Access policies to determine why a specific access attempt was blocked. Option B is wrong because the My Apps portal is an end-user interface for launching assigned applications, not a diagnostic tool for analyzing Conditional Access policy impacts. Option D is wrong because Audit logs track changes made to directory resources (e.g., policy modifications, user updates), not real-time sign-in attempts or Conditional Access policy evaluations.

Practice this question →

MCQmedium

A company's security team discovers that most recent account compromises resulted from attackers exploiting legacy authentication protocols (POP3, IMAP, SMTP Auth) that do not support multi-factor authentication. The team wants to immediately block all sign-in attempts using these legacy protocols while still allowing modern authentication methods (e.g., OAuth 2.0). Which Microsoft Entra ID feature should they configure?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management

D.Multi-factor Authentication

AnswerA

Conditional Access policies can include a 'Block legacy authentication' condition. This allows administrators to create a policy that blocks all sign-ins from clients that do not support MFA, effectively stopping attacks that rely on legacy protocols while preserving modern authentication.

Why this answer

Conditional Access policies in Microsoft Entra ID can be configured to block authentication attempts from legacy protocols (POP3, IMAP, SMTP Auth) by targeting client apps that do not support modern authentication. This allows the security team to immediately enforce a block on all sign-ins using these protocols while still permitting modern OAuth 2.0-based methods, directly addressing the requirement without disabling MFA for users who can use modern clients.

Exam trap

The trap here is that candidates often confuse the 'block legacy authentication' capability with MFA or Identity Protection, assuming that enabling MFA alone will stop legacy protocol abuse, when in fact legacy protocols bypass MFA entirely and require a Conditional Access policy to be explicitly blocked.

Why the other options are wrong

Identity Protection is designed to detect and respond to identity-based risks, such as suspicious sign-ins or leaked credentials, but it does not provide the capability to block specific authentication protocols like POP3, IMAP, or SMTP Auth.

Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles, but it does not block legacy authentication protocols. The question requires blocking sign-in attempts based on authentication protocol, which is a Conditional Access policy capability.

Multi-factor Authentication (MFA) is an authentication method, not a policy to block legacy protocols. The question asks for a feature to block sign-in attempts using legacy protocols, which requires a conditional access policy to enforce MFA or block specific authentication methods.

Practice this question →

MCQeasy

Refer to the exhibit. You run this PowerShell cmdlet. What is the outcome?

A.A guest user is created in Microsoft Entra ID and an invitation email is sent.

B.The external user is added as a member user without an invitation.

C.The external user is provisioned as a consumer account in Azure AD B2C.

D.The external user is added as a member user and cannot be a guest.

AnswerA

The New-MgInvitation or New-AzureADMSInvitation cmdlet, when executed with appropriate parameters like InvitedUserEmailAddress and SendInvitationMessage -eq $true, specifically facilitates Microsoft Entra B2B collaboration. This action creates a new guest user object in the inviting tenant's Microsoft Entra ID, representing the external user. Concurrently, an invitation email containing a unique redemption link is automatically dispatched to the specified external email address, enabling the invited user to accept the invitation and gain access.

Why this answer

The `New-MgInvitation` cmdlet creates a guest user in Microsoft Entra ID and sends an invitation email by default. This is the standard behavior for B2B collaboration, where the external user is assigned the 'Guest' user type and receives an email to accept the invitation and redeem their account.

Exam trap

The trap here is that candidates often confuse the `New-MgInvitation` cmdlet with `New-MgUser`, which creates a member user, and mistakenly think the invitation email is optional or that the user type can be changed to member without additional steps.

How to eliminate wrong answers

Option B is wrong because `New-MgInvitation` always sends an invitation email; it does not add the external user as a member user without an invitation. Option C is wrong because Azure AD B2C consumer accounts are created using separate B2C-specific cmdlets (e.g., `New-AzureADMSB2CUser`), not `New-MgInvitation`. Option D is wrong because the cmdlet explicitly creates a guest user, not a member user, and the guest user type cannot be changed to member via this cmdlet.

Practice this question →

MCQmedium

A company uses Microsoft Entra ID and wants to allow users to reset their own passwords without help desk intervention. However, they want to ensure that only users who have already registered for multifactor authentication (MFA) can use self-service password reset (SSPR). Which Microsoft Entra feature should the administrator configure to enforce this requirement?

A.Conditional Access

B.Self-Service Password Reset (SSPR) settings

C.Identity Protection

D.Privileged Identity Management

AnswerB

Self-Service Password Reset (SSPR) settings in Microsoft Entra ID directly control the user experience for password resets, including the authentication methods users must register and use. Administrators can configure the "Number of methods required to reset" and specify which "Methods available to users." Crucially, SSPR also offers an "Enforce registration" option, which can prompt users to register for SSPR (and thus their chosen authentication methods, including MFA options) at their next sign-in, ensuring they are prepared before a reset is needed.

Why this answer

Self-Service Password Reset (SSPR) settings in Microsoft Entra ID include a configuration option to require users to register for multifactor authentication (MFA) before they can use SSPR. By enabling the 'Require users to register when they sign in' setting under SSPR, the administrator ensures that only MFA-registered users can reset their own passwords, meeting the requirement without additional policies.

Exam trap

The trap here is that candidates often confuse Conditional Access (which enforces MFA during sign-in) with the SSPR registration requirement, but Conditional Access does not control the SSPR registration prerequisite—only the SSPR settings can enforce that users must be MFA-registered before using password reset.

How to eliminate wrong answers

Option A is wrong because Conditional Access is a policy engine that enforces access controls (e.g., requiring MFA during sign-in) but does not directly control SSPR registration requirements; it cannot enforce that only MFA-registered users can use SSPR. Option C is wrong because Identity Protection is designed to detect and respond to identity risks (e.g., leaked credentials, anomalous sign-ins) and does not manage SSPR registration or usage restrictions. Option D is wrong because Privileged Identity Management (PIM) provides just-in-time privileged role activation and access reviews, not password reset registration enforcement.

Practice this question →

MCQmedium

A company uses Microsoft Entra ID and Intune for mobile device management. They want to grant access to a confidential project management site only from devices that are encrypted and have the latest anti-malware updates. Which Conditional Access assignment should they configure to enforce this requirement?

A.Sign-in risk

B.Device state

C.User risk

D.Application

AnswerB

The 'Device state' Conditional Access condition specifically evaluates whether a device is marked as compliant by a Mobile Device Management (MDM) solution like Microsoft Intune. This condition enforces that the device meets predefined security baselines, such as requiring disk encryption, an up-to-date operating system, or active anti-malware protection. By leveraging Intune's compliance reporting, this condition ensures only trusted and healthy devices can access corporate resources.

Why this answer

(Device state) is correct because Conditional Access policies can use the 'Device state' condition to require that devices are marked as compliant or are hybrid Azure AD joined. Compliance is determined by Intune compliance policies, which can enforce requirements like encryption and up-to-date anti-malware. By setting the 'Device state' condition to 'Compliant device' or 'Hybrid Azure AD joined device', access to the confidential site is granted only to devices meeting those security baselines.

Exam trap

The trap here is that candidates confuse 'Device state' (which enforces device compliance like encryption and anti-malware) with 'Sign-in risk' or 'User risk', which are identity-focused risk detections unrelated to device health.

How to eliminate wrong answers

Option A (Sign-in risk) is wrong because sign-in risk is a real-time detection of anomalous sign-in behavior (e.g., impossible travel, anonymous IP) and does not evaluate device encryption or anti-malware status. Option C (User risk) is wrong because user risk assesses the likelihood that a user's identity has been compromised based on historical events (e.g., leaked credentials), not device health attributes. Option D (Application) is wrong because the Application condition specifies which cloud apps the policy applies to, not the device compliance state; it controls scope, not device security posture.

Practice this question →

MCQmedium

Your organization uses Microsoft Entra ID with P1 licenses. You need to provide a temporary access pass for a new employee to set up their account without a password. Which Microsoft Entra feature should you use?

A.Microsoft Entra Temporary Access Pass

B.Microsoft Entra Privileged Identity Management

C.Microsoft Entra Identity Protection

D.Microsoft Entra Verified ID

AnswerA

Microsoft Entra Temporary Access Pass (TAP) is a time-limited passcode issued by an administrator, specifically designed to enable passwordless onboarding and account recovery. It allows users to sign in without their primary password, register passwordless authentication methods like FIDO2 security keys or Microsoft Authenticator, and then expire, ensuring a secure transition to a fully passwordless state. This mechanism is crucial for new employees or users who have lost their primary authentication method, providing a secure initial access point.

Why this answer

The Temporary Access Pass (TAP) is a time-limited passcode issued by an administrator that allows a user to register passwordless authentication methods (e.g., Microsoft Authenticator, FIDO2 security key) without needing an existing password. This directly meets the requirement for a new employee to set up their account without a password, and it is available with Microsoft Entra ID P1 licenses.

Exam trap

The trap here is that candidates often confuse Privileged Identity Management (PIM) with any 'temporary' access feature, but PIM grants temporary privileged roles, not a passwordless onboarding token.

How to eliminate wrong answers

Option B is wrong because Privileged Identity Management (PIM) is used for just-in-time privileged role activation and access reviews, not for issuing temporary credentials for passwordless onboarding. Option C is wrong because Identity Protection detects and remediates identity-based risks (e.g., leaked credentials, sign-in anomalies) but does not provide a mechanism to create a temporary pass for initial setup. Option D is wrong because Verified ID is a decentralized identity solution for issuing and verifying verifiable credentials (e.g., diplomas, IDs) and is unrelated to temporary access passes for passwordless registration.

Practice this question →

MCQmedium

Your company uses Microsoft Entra ID. You need to enforce that all users register for MFA within 14 days of account creation. Which feature should you use?

A.Identity Protection

B.MFA registration campaign

C.Conditional Access

D.Security defaults

AnswerB

The Microsoft Entra ID MFA registration campaign policy is specifically designed to drive user adoption of multi-factor authentication by actively prompting users to register their MFA methods. This feature allows administrators to configure a grace period, expressed as a specific number of days, during which users are repeatedly prompted to register before MFA becomes mandatory for all sign-ins. It directly addresses the need to enforce registration within a customizable, set number of days.

Why this answer

The MFA registration campaign is specifically designed to nudge users to register for MFA within a configurable time frame after account creation. It sends targeted notifications and enforces registration by blocking access until the user completes MFA setup, directly meeting the 14-day requirement.

Exam trap

The trap here is that candidates often confuse Conditional Access (which enforces MFA at sign-in) with the registration campaign (which enforces the initial MFA setup process), not realizing that Conditional Access cannot force a user to register within a specific number of days—it only blocks access if MFA is absent.

How to eliminate wrong answers

Option A is wrong because Identity Protection is a risk-based detection and remediation tool (e.g., detecting leaked credentials or risky sign-ins), not a mechanism to enforce MFA registration deadlines. Option C is wrong because Conditional Access policies can require MFA during sign-in but cannot enforce a registration deadline or send reminder prompts; they only block access if MFA is not already registered. Option D is wrong because Security defaults enforce MFA registration for all users but do not allow a custom 14-day grace period—they require registration at first sign-in with no configurable delay.

Practice this question →

100

MCQeasy

A company uses Microsoft Entra ID. The IT team wants to allow users to reset their own passwords without calling the help desk, but only after they verify their identity by using a code sent to their registered mobile phone. They also want to require users to register for this capability the next time they sign in. Which Microsoft Entra feature should they enable?

A.Microsoft Entra Password Protection

B.Microsoft Entra Connect Sync

C.Microsoft Entra ID Protection

D.Self-service password reset (SSPR)

AnswerD

SSPR allows users to reset their own passwords after verifying their identity through one or more authentication methods, such as a code sent to a registered mobile phone. You can require users to register for SSPR at next sign-in, and you can restrict reset to only users who have the required methods. This directly matches the scenario.

Why this answer

Self-service password reset (SSPR) in Microsoft Entra ID lets users reset their own passwords after verifying their identity with registered methods. You can require users to register for SSPR at next sign-in, and you can configure authentication methods such as mobile phone. This reduces help desk calls and matches the requirement for phone-based verification and registration enforcement.

Exam trap

The trap here is confusing Password Protection, which blocks weak passwords, with SSPR, which allows users to reset their own passwords after identity verification.

Practice this question →

101

MCQhard

Your organization has a Microsoft Entra ID tenant with 5,000 users. You need to implement a solution that automatically detects and remediates users with leaked credentials. Additionally, you need to require users to change their password when a high risk is detected. Which Microsoft Entra features should you configure?

A.Enable Microsoft Entra Identity Protection, configure a user risk policy to require password change when risk is medium or high.

B.Create an Access Review for all users and require them to confirm their access quarterly.

C.Enable Privileged Identity Management (PIM) and require multi-factor authentication for all role activations.

D.Configure a Conditional Access policy to require password change when sign-in risk is high.

AnswerA

Microsoft Entra Identity Protection actively monitors for various risk detections, including leaked credentials, which are identified through dark web monitoring and other sources. A user risk policy, configured within Identity Protection, can then automatically enforce remediation actions like requiring a password change when a user's aggregated risk level (e.g., medium or high) indicates potential compromise. This direct linkage ensures that detected credential compromises are promptly addressed.

Why this answer

Microsoft Entra Identity Protection detects leaked credentials by monitoring for credential exposures on the dark web and other sources. Configuring a user risk policy to require a password change when risk is medium or high automatically remediates the detected risk by forcing the user to update their password, directly addressing the requirement for automatic detection and remediation.

Exam trap

The trap here is confusing user risk (which detects leaked credentials and other user-level threats) with sign-in risk (which evaluates real-time session anomalies), leading candidates to incorrectly select Option D, which only addresses sign-in risk and not the required leaked credential detection.

How to eliminate wrong answers

Option B is wrong because Access Reviews are designed for periodic attestation of access rights, not for detecting or remediating leaked credentials or enforcing password changes based on risk. Option C is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role activation and requires MFA for those activations, but it does not detect leaked credentials or enforce user password changes for general users. Option D is wrong because a Conditional Access policy can require a password change only when sign-in risk is high, but it does not automatically detect leaked credentials; sign-in risk evaluates real-time session anomalies, not leaked credential exposure, and the question specifically requires detection of leaked credentials, which is a user risk feature.

Practice this question →

102

Multi-Selectmedium

Which TWO of the following are capabilities of Microsoft Entra ID? (Select two.)

Select 2 answers

A.Antivirus and antimalware protection

B.Identity as a Service (IDaaS) for cloud applications

C.Provide network firewall services

D.Manage mobile devices and applications

E.Single sign-on (SSO) to thousands of SaaS applications

AnswersB, E

Microsoft Entra ID serves as a comprehensive Identity as a Service (IDaaS) solution, providing a cloud-based platform for managing digital identities and controlling access to various cloud applications. It enables organizations to centralize user accounts, enforce authentication policies, and provision users to Software as a Service (SaaS) applications and custom cloud applications. This capability streamlines identity management operations and enhances security across diverse cloud environments.

Why this answer

Microsoft Entra ID is a cloud-based identity and access management service, providing Identity as a Service (IDaaS) for cloud applications. It enables organizations to manage user identities and control access to resources, including thousands of pre-integrated SaaS applications through single sign-on (SSO). This makes option B correct because Entra ID's core function is identity management, not endpoint security or network infrastructure.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID with broader security suites like Microsoft 365 Defender or Azure security services, mistakenly attributing endpoint protection or network firewall capabilities to identity management.

Practice this question →

103

MCQmedium

A company uses Microsoft Entra ID and wants to allow external business partners to request access to a specific application through an approval process. The access should be time-limited and automatically expired. Which Microsoft Entra ID feature should be configured?

A.Conditional Access

B.Entitlement management

C.Privileged Identity Management (PIM)

D.Self-service group management

AnswerB

Microsoft Entra Entitlement Management is designed to streamline the lifecycle of access for both internal and external users, particularly for external partners needing access to specific applications or resources. It utilizes access packages, which bundle resources and define policies for requesting access, including approval workflows, mandatory reviews, and automatic expiration dates. This ensures that external access is granted only when needed, for a specific duration, and with appropriate oversight, making it ideal for managing B2B collaboration securely and efficiently.

Why this answer

Entitlement management in Microsoft Entra ID (part of Identity Governance) provides access packages that bundle resources such as applications, groups, and SharePoint sites. External users can request access through a self-service portal, with approval workflows, time-limited assignments, and automatic expiration. This exactly matches the requirement for partner access requests with approval and time limits.

Exam trap

SC-900 often tests the difference between PIM (just-in-time privileged roles for internal admins) and entitlement management (access packages for internal/external users with approvals and expiration) — candidates pick PIM because it sounds like 'privileged access', but it does not handle partner access requests.

Why the other options are wrong

Conditional Access enforces access policies based on signals like user location or device state, but it does not provide time-limited access requests with approval workflows for external partners.

Privileged Identity Management (PIM) manages just-in-time access for privileged roles (e.g., admin roles), not for external partners requesting access to a specific application with time-limited, auto-expiring access.

Self-service group management allows users to create and manage their own groups in Microsoft Entra ID, but it does not provide time-limited access or automated expiration for external partners. It lacks the approval workflows and access packages needed for this scenario.

Practice this question →

104

MCQeasy

Your company wants to allow employees to use their corporate Microsoft Entra ID credentials to sign in to third-party SaaS applications like Salesforce and ServiceNow. Which Microsoft Entra feature should you configure?

A.Conditional Access policies.

B.Microsoft Entra B2B collaboration.

C.Microsoft Entra Identity Protection.

D.Enterprise applications with pre-integrated gallery apps.

AnswerD

Enterprise applications in Microsoft Entra ID provide the central framework for integrating various applications, including Software as a Service (SaaS) applications. The pre-integrated gallery apps offer ready-to-use templates with pre-configured settings for popular SaaS applications, significantly simplifying the process of enabling Single Sign-On (SSO). This allows employees to access corporate applications using their existing Microsoft Entra credentials without needing to re-authenticate, streamlining access and enhancing security.

Why this answer

Configuring a third-party SaaS application like Salesforce or ServiceNow as an Enterprise Application in Microsoft Entra ID allows you to set up federation using SAML 2.0 or OpenID Connect, enabling users to sign in with their corporate Entra ID credentials. The pre-integrated gallery apps provide pre-configured templates that simplify the setup of single sign-on (SSO) and user provisioning, making it the appropriate feature for this requirement.

Exam trap

The trap here is that candidates confuse Conditional Access (which controls access after authentication) with the actual SSO configuration feature, or they mistakenly think B2B collaboration is for internal users accessing external apps, when it is specifically for external users accessing internal resources.

How to eliminate wrong answers

Option A is wrong because Conditional Access policies are used to enforce access controls (e.g., MFA, location restrictions) after SSO is configured, not to enable the initial sign-in with corporate credentials. Option B is wrong because Microsoft Entra B2B collaboration is designed for inviting external users (guests) from other organizations, not for enabling internal employees to use their corporate credentials for third-party SaaS apps. Option C is wrong because Microsoft Entra Identity Protection is a risk-based security tool that detects and responds to identity threats (e.g., leaked credentials, impossible travel), not a feature for configuring SSO or authentication to external applications.

Practice this question →

105

MCQmedium

A company uses Microsoft Entra ID. The security team needs to grant temporary elevated access to the Global Administrator role for a specific task, such as configuring a new security policy. They want the user to request activation, which is then approved by a manager, and the privileges automatically expire after 4 hours. Which Microsoft Entra feature should they use?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management (PIM)

D.Self-Service Password Reset (SSPR)

AnswerC

Microsoft Entra Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources within an organization by implementing just-in-time (JIT) access. It enables users to activate privileged roles only when needed and for a limited, predefined duration, often requiring an approval workflow. PIM also provides automatic expiration of assignments and comprehensive auditing, significantly reducing the attack surface associated with standing privileged access.

Why this answer

Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access, allowing users to request activation of roles like Global Administrator. The activation can require approval from a manager and is automatically deactivated after a configurable maximum duration (e.g., 4 hours), directly meeting the security team's requirements.

Exam trap

The trap here is that candidates confuse Privileged Identity Management (PIM) with Conditional Access, because both involve policies and access control, but PIM specifically handles just-in-time privileged role activation with approval and expiration, while Conditional Access focuses on access conditions for all users.

How to eliminate wrong answers

Option A is wrong because Conditional Access enforces policies based on signals like user location or device compliance, but it does not provide time-bound role activation with approval workflows. Option B is wrong because Identity Protection detects and remediates identity-based risks (e.g., leaked credentials), not manage privileged role activation or expiration. Option D is wrong because Self-Service Password Reset (SSPR) allows users to reset their own passwords, not to elevate or manage role assignments.

Practice this question →

106

MCQmedium

You are the identity administrator for a company that uses Microsoft Entra ID. The security team wants to ensure that any user who is assigned the Privileged Role Administrator role must activate the role only after providing a justification and passing an MFA challenge. They also want to require approval from a designated approver before the role becomes active. What should you configure?

A.Create an access review for the Privileged Role Administrator role and require reviewers to approve the user's continued assignment.

B.Set the user's per-user MFA status to Enabled and create a Conditional Access policy requiring MFA for the Privileged Role Administrator role.

C.Assign the user the Privileged Role Administrator role as a permanent active assignment and enable Azure AD Identity Protection risk policies.

D.Configure Privileged Identity Management (PIM) with role settings that require multi-factor authentication on activation, require justification, and require approval.

AnswerD

PIM provides just-in-time privileged access. By configuring role settings for Privileged Role Administrator, you can require MFA on activation, require a justification, and require approval from specified approvers. This exactly matches the scenario: the controls apply only when the user activates the role, not at every sign-in.

Why this answer

Privileged Identity Management (PIM) is the Microsoft Entra feature that provides just-in-time role activation with activation-time controls such as MFA, justification, and approval. Unlike Conditional Access or access reviews, PIM governs the role assignment lifecycle itself, ensuring privileged roles are not permanently active and that activation is auditable and gated by the required conditions. This directly satisfies the security team's requirements.

Exam trap

The trap here is assuming that Conditional Access or per-user MFA can enforce controls at the moment of privileged role activation, when only PIM provides activation-time gating with justification and approval.

Practice this question →

107

MCQmedium

A company uses Microsoft Entra ID. The security team wants to provide just-in-time (JIT) administrative access to Azure resources. They require that administrators must request approval before gaining elevated privileges, and that the elevated access automatically expires after the task is completed. Which Microsoft Entra capability should they use?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management (PIM)

D.Self-Service Password Reset (SSPR)

AnswerC

Privileged Identity Management delivers just-in-time role activation with approval workflows and time-bound assignments that expire automatically. This satisfies both constraints: administrators must request approval before elevation, and the elevated access is removed once the task completes, rather than persisting as standing privilege.

Why this answer

Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure resources with time-bound activation, approval workflows, and automatic expiration. PIM allows administrators to request elevation for a specific role, which must be approved by designated approvers, and the elevated access automatically expires after the configured duration (e.g., 1–8 hours). This directly meets the security team's requirements for approval-based, time-limited administrative access.

Exam trap

The trap here is that candidates often confuse Conditional Access (which controls access to apps and resources) with PIM (which controls time-bound elevation of roles), because both involve 'access' and 'conditions,' but only PIM provides JIT activation with approval and automatic expiration.

How to eliminate wrong answers

Option A is wrong because Conditional Access enforces access policies based on signals like user location or device compliance, but it does not provide JIT role activation, approval workflows, or automatic expiration of elevated privileges. Option B is wrong because Identity Protection detects and remediates identity-based risks (e.g., leaked credentials or sign-ins from anonymous IPs), but it does not manage privileged role assignments or time-bound elevation. Option D is wrong because Self-Service Password Reset (SSPR) allows users to reset their own passwords without administrator intervention, which is unrelated to granting or managing elevated administrative access to Azure resources.

Practice this question →

108

MCQmedium

A company uses Microsoft Entra ID. They want to require all users accessing the external vendor portal to accept a terms of use document before they are granted access. The acceptance must be revoked after 30 days, requiring the user to accept again. Which Conditional Access component should the administrator configure?

A.Assignments

B.Access controls (Grant)

C.Conditions

D.Session controls

AnswerB

Access controls, specifically the "Grant" controls within Conditional Access policies, are precisely where administrators define the requirements users must satisfy to gain access to a resource. This section allows for mandating actions like multifactor authentication, requiring a device to be marked as compliant, or, critically, demanding explicit acceptance of Terms of Use before access is permitted. It directly enforces the "allow or block" decision based on specified conditions.

Why this answer

The administrator needs to enforce a terms of use acceptance that expires after 30 days. In Conditional Access, the 'Access controls (Grant)' section includes the 'Require terms of use' option, which can be configured to require re-acceptance after a specified duration (e.g., 30 days). This directly meets the requirement by blocking access until the user accepts the current version of the terms of use document.

Exam trap

The trap here is that candidates often confuse 'Session controls' (which manage sign-in frequency or app restrictions) with the ability to enforce terms of use acceptance, but only the 'Grant' control can require a terms of use document to be accepted.

How to eliminate wrong answers

Option A is wrong because 'Assignments' define which users, groups, or applications the policy applies to, not the specific access requirements like terms of use acceptance. Option C is wrong because 'Conditions' define signals such as location, device state, or risk level that trigger the policy, but they do not enforce the acceptance of a terms of use document. Option D is wrong because 'Session controls' manage user experience during a session (e.g., app enforced restrictions, sign-in frequency), but they cannot enforce a terms of use acceptance requirement.

Practice this question →

109

MCQeasy

You are configuring Microsoft Entra ID Governance. You need to ensure that when a user leaves the organization, their access to all SaaS applications is automatically revoked. Which Microsoft Entra feature should you use?

A.Microsoft Entra Conditional Access

B.Microsoft Entra Privileged Identity Management (PIM)

C.Microsoft Entra Access Reviews

D.Microsoft Entra Terms of Use

AnswerC

Microsoft Entra Access Reviews are a fundamental capability within Microsoft Entra ID Governance that allows organizations to efficiently manage group memberships, access to enterprise applications, and privileged role assignments. They enable administrators or business owners to regularly review who has access to what, and crucially, to automatically remove access for users who no longer need it, especially when their accounts are disabled or they leave the organization, thereby enforcing least privilege and compliance.

Why this answer

Microsoft Entra Access Reviews allows administrators to create recurring reviews of user access to SaaS applications. When a user leaves the organization, an automated access review can be configured to remove their access based on the review results, ensuring revocation of access to all assigned SaaS apps. This directly addresses the requirement for automatic revocation upon departure.

Exam trap

The trap here is that candidates often confuse Conditional Access (which controls access during authentication) with lifecycle management features like Access Reviews, which handle ongoing governance and automatic removal of access after a user leaves.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Conditional Access enforces access policies based on conditions like location or device state at sign-in time, but it does not automatically revoke access when a user leaves the organization. Option B is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time privileged role activation and approval workflows, not the lifecycle-based revocation of access to SaaS applications for departing users. Option D is wrong because Microsoft Entra Terms of Use presents acceptance policies to users before accessing resources, but it does not automate access removal when a user leaves.

Practice this question →

110

Multi-Selectmedium

Which TWO features are part of Microsoft Entra ID P2 licensing? (Choose two.)

Select 2 answers

A.Conditional Access

B.Basic Mobility and Security

C.Microsoft Entra Identity Protection

D.Microsoft Entra Self-Service Password Reset

E.Microsoft Entra Privileged Identity Management

AnswersC, E

Microsoft Entra Identity Protection is a core security capability of Microsoft Entra ID P2, designed to detect, investigate, and remediate identity-based risks. It leverages machine learning and heuristics to identify suspicious activities, such as leaked credentials, impossible travel, and anomalous sign-in patterns, across an organization's identities. This feature provides automated responses like requiring multi-factor authentication or blocking access, significantly enhancing an organization's security posture against identity compromise.

Why this answer

Microsoft Entra ID P2 licensing includes advanced security features such as Microsoft Entra Identity Protection and Microsoft Entra Privileged Identity Management (PIM). Identity Protection uses machine learning to detect and remediate identity-based risks like leaked credentials and anomalous sign-in patterns, while PIM provides just-in-time privileged access and approval workflows. These capabilities are exclusive to P2 and are not available in P1 or free tiers.

Exam trap

The trap here is that candidates often confuse Conditional Access (a P1 feature) as a P2 exclusive because it is commonly paired with Identity Protection in security demos, but Conditional Access itself does not require P2 licensing.

Practice this question →

111

Multi-Selecthard

Which three features are available in Microsoft Entra ID P2 but not in P1? (Choose three.)

Select 3 answers

A.Access reviews

B.Privileged Identity Management (PIM)

C.Identity Protection risk-based policies

D.Conditional Access policies

E.Self-service password reset (SSPR) with writeback

AnswersA, B, C

Microsoft Entra ID P2 includes Access reviews, a critical governance feature enabling organizations to efficiently manage group memberships, application assignments, and privileged role assignments. This feature allows administrators to regularly review who has access to what resources, ensuring that only necessary permissions are maintained and reducing the risk of stale or excessive access. Without P2, these automated and recurring reviews are not available, making manual auditing cumbersome and prone to oversight.

Why this answer

Access reviews are a Microsoft Entra ID P2 feature that allows administrators to automate periodic reviews of group memberships, application access, and role assignments. This capability is not available in P1, which lacks the automated review workflows and attestation features that P2 provides for governance and compliance.

Exam trap

The trap here is that candidates often confuse Conditional Access policies as a P2-only feature, but they are actually available in P1, while P2 adds Identity Protection risk-based policies and PIM, not the base Conditional Access engine.

Practice this question →

112

MCQmedium

Your organization uses Microsoft Entra ID and Microsoft Defender for Cloud Apps. You want to monitor and control the use of cloud apps by enforcing session policies, such as preventing downloads from unmanaged devices. Which integration should you use?

A.Microsoft Purview

B.Microsoft Sentinel

C.Microsoft Intune

D.Microsoft Defender for Cloud Apps

AnswerD

Microsoft Defender for Cloud Apps (MDCA) is a Cloud Access Security Broker (CASB) that provides comprehensive visibility, control, and protection for cloud applications. It integrates with Microsoft Entra Conditional Access to enforce session policies by acting as a reverse proxy, allowing real-time monitoring and control over user activities within cloud apps. This capability enables organizations to block downloads, restrict copy-paste, or enforce other granular controls during a user's session, directly addressing the need for session policies.

Why this answer

Microsoft Defender for Cloud Apps is the correct integration because it provides Cloud Access Security Broker (CASB) functionality, enabling session policies via reverse proxy to control user actions like blocking downloads from unmanaged devices. These policies are enforced in real-time by inspecting and modifying traffic to cloud apps based on device compliance signals from Microsoft Entra ID.

Exam trap

The trap here is that candidates often confuse Microsoft Intune's device management capabilities with the real-time session enforcement provided by Defender for Cloud Apps, assuming Intune can directly block downloads from unmanaged devices in cloud apps, which it cannot.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview focuses on data governance, compliance, and information protection (e.g., DLP, retention labels), not on real-time session control of cloud app usage. Option B is wrong because Microsoft Sentinel is a Security Information and Event Management (SIEM) and SOAR tool for threat detection and response, not for enforcing granular session policies on cloud apps. Option C is wrong because Microsoft Intune is a Mobile Device Management (MDM) and Mobile Application Management (MAM) service that manages devices and apps, but it does not provide the reverse proxy session-level controls needed to enforce policies like preventing downloads from unmanaged devices in cloud apps.

Practice this question →

113

Multi-Selecthard

You are a security architect for a large enterprise using Microsoft Entra ID. You need to implement a solution that enforces least-privilege access and reduces lateral movement. Which THREE Microsoft Entra capabilities should you include in your design?

Select 3 answers

A.Identity Protection

B.Password hash synchronization

C.Privileged Identity Management (PIM)

D.Conditional Access policies

E.Microsoft Defender for Cloud Apps

AnswersA, C, D

Identity Protection is a crucial Microsoft Entra ID feature that automatically detects, remediates, and reports identity-based risks. It analyzes sign-in and user behavior for anomalies, such as impossible travel, leaked credentials, or unfamiliar sign-in properties. By identifying these risks, it can trigger automated responses like blocking access, enforcing multi-factor authentication, or requiring password resets, significantly reducing the potential for compromised identities to facilitate lateral movement or data breaches.

Why this answer

Identity Protection is correct because it uses machine learning to detect and automatically respond to identity-based risks, such as leaked credentials or anomalous sign-in patterns, which directly reduces the attack surface and limits lateral movement by blocking or challenging risky authentications before an attacker can pivot.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud Apps (a CASB for SaaS app governance) with a core Entra ID capability, or mistakenly think password hash synchronization provides a security benefit beyond authentication synchronization.

Practice this question →

114

MCQhard

Refer to the exhibit. A security analyst runs the KQL query in Microsoft Sentinel. The query returns sign-in logs with error code 50076. What does this error indicate?

A.The user did not pass multi-factor authentication.

B.The user account is disabled.

C.The user's password has expired.

D.The sign-in was blocked by a Conditional Access policy.

AnswerA

Azure Active Directory (Azure AD) sign-in logs use specific error codes to indicate the reason for a failed authentication attempt. Error code 50076 specifically signifies that the user failed to complete the multi-factor authentication (MFA) challenge required for access. This could be due to the user not responding to the MFA prompt, entering an incorrect verification code, or declining the authentication request. Consequently, the sign-in attempt was unsuccessful because the mandatory second factor was not satisfied.

Why this answer

Error code 50076 in Microsoft Entra sign-in logs specifically indicates that the user did not pass multi-factor authentication (MFA). This error is returned when the MFA challenge fails, such as when the user enters an incorrect verification code, denies the push notification, or the MFA session expires. It is a direct signal that the authentication attempt was not completed successfully due to MFA failure.

Exam trap

The trap here is that candidates confuse the error code for failing MFA (50076) with the error code for being blocked by a Conditional Access policy (53003), because both involve MFA enforcement, but the error codes indicate different stages of the authentication flow.

How to eliminate wrong answers

Option B is wrong because a disabled user account would generate error code 50057 (user account is disabled), not 50076. Option C is wrong because an expired password results in error code 50055 (password expired), not 50076. Option D is wrong because a sign-in blocked by a Conditional Access policy would return error code 53003 (blocked by Conditional Access), not 50076.

Practice this question →

115

MCQmedium

A company uses Microsoft Entra ID (Microsoft Entra ID) and wants to allow users to sign in using biometrics (fingerprint or face) on their mobile devices instead of passwords. They want this to work for both iOS and Android devices. Which Microsoft Entra ID feature should they enable?

A.Passwordless authentication using Microsoft Authenticator

B.Microsoft Entra Connect Sync Health

C.Microsoft Entra ID Protection

D.Self-Service Password Reset (SSPR)

AnswerA

The Microsoft Authenticator app facilitates passwordless authentication by transforming a user's mobile device into a strong credential. Users can approve sign-in requests via push notifications, verifying their identity with a biometric gesture like a fingerprint or face scan, or a PIN. This method eliminates the need for traditional passwords, significantly enhancing security by making authentication phishing-resistant and improving user experience.

Why this answer

Microsoft Authenticator supports passwordless authentication using FIDO2-based biometric verification on mobile devices. This feature allows users to sign in with a fingerprint or face on both iOS and Android, eliminating the need for a password while leveraging the device's built-in biometric capabilities.

Exam trap

The trap here is that candidates may confuse Self-Service Password Reset (SSPR) with passwordless authentication, but SSPR only resets passwords and does not enable biometric sign-in without a password.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra Connect Sync Health is a monitoring tool for synchronization health, not a feature for passwordless authentication. Option C is wrong because Microsoft Entra ID Protection is a security service that detects and responds to identity risks, not a mechanism for biometric sign-in. Option D is wrong because Self-Service Password Reset (SSPR) allows users to reset their passwords, not to sign in without a password using biometrics.

Practice this question →

116

MCQmedium

A company wants to allow external business partners to access a specific SharePoint Online site using their own corporate identities (such as Google or Facebook accounts). The company also needs to enforce multi-factor authentication (MFA) for these external users. Which Microsoft Entra capability should the administrator configure?

A.Microsoft Entra Connect

B.Microsoft Entra External Identities (B2B collaboration)

C.Microsoft Entra Identity Protection

D.Microsoft Entra Privileged Identity Management (PIM)

AnswerB

B2B collaboration allows you to invite external users to your tenant using their own identities (e.g., Google, Facebook, or any Microsoft Entra ID tenant). Combined with Conditional Access, you can enforce MFA for those guest users.

Why this answer

Microsoft Entra External Identities (B2B collaboration) allows you to invite external users (including those with social identities like Google or Facebook) to access your organization's resources using their own identities. It supports conditional access policies, including the enforcement of multi-factor authentication (MFA) for guest users, which meets both requirements.

Exam trap

The trap here is that candidates often confuse Microsoft Entra Connect (which handles hybrid identity sync) with External Identities (which handles guest user access), or they assume Identity Protection or PIM can be used to grant external access, when they are security monitoring and privilege management tools respectively.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Connect is used for synchronizing on-premises Active Directory identities to Microsoft Entra ID, not for inviting external users with social identities. Option C is wrong because Microsoft Entra Identity Protection is a risk-based detection and remediation tool for user identities, not a mechanism to invite external users or enforce MFA on guest access. Option D is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time privileged role assignments and access reviews, not external user invitations or MFA enforcement for guest users.

Practice this question →

117

Multi-Selecthard

Which TWO of the following are benefits of using Microsoft Entra ID Governance?

Select 2 answers

A.Network segmentation for on-premises resources.

B.Automated access reviews for group memberships.

C.Synchronizing identities from on-premises Active Directory.

D.Lifecycle workflows for employee onboarding and offboarding.

E.Enforcing multi-factor authentication for all users.

AnswersB, D

Microsoft Entra ID Governance offers automated access reviews, enabling organizations to periodically review and certify user access to groups, applications, and roles. These reviews ensure that users maintain only the necessary permissions, helping to enforce the principle of least privilege and reduce the risk of stale or excessive access. This feature streamlines compliance efforts by automating the process of obtaining attestations from resource owners and managers.

Why this answer

Option B is correct because Microsoft Entra ID Governance includes Access Reviews, which automate the periodic recertification of group memberships, application assignments, and privileged role assignments so that stale or inappropriate access is removed without manual tracking. Option D is correct because Lifecycle Workflows in Entra ID Governance automate joiner-mover-leaver processes, such as triggering onboarding tasks (for example, adding a user to groups or generating a Temporary Access Pass) and offboarding tasks (for example, disabling the account and removing licenses) based on employee attributes. Option A is not a governance benefit; network segmentation is a security architecture control typically delivered by firewalls, VLANs, or microsegmentation, not by Entra ID Governance.

Option C is not a governance benefit; identity synchronization from on-premises Active Directory is provided by Microsoft Entra Connect (or Cloud Sync), which is a hybrid identity capability rather than a governance feature. Option E is not a governance benefit; enforcing MFA for all users is done through Conditional Access or security defaults in Microsoft Entra ID, not through Entra ID Governance.

Exam trap

SC-900 often tests the boundary between Entra ID Governance and other Entra services, catching candidates who attribute synchronization or MFA to governance when those belong to Entra Connect and Conditional Access.

Practice this question →

118

MCQeasy

Your organization uses Microsoft Entra ID Governance. You need to ensure that guest users' access to internal applications is automatically removed after 90 days. What should you configure?

A.Entitlement management

B.Access reviews

C.Identity Protection

D.Privileged Identity Management (PIM)

AnswerA

Entitlement management primarily focuses on streamlining the request and approval process for access to resources through access packages. While access packages can be configured with an expiration date, this feature sets a fixed end date for access rather than facilitating a periodic review of ongoing need. It does not provide the mechanism for reviewers to attest to continued access and then automatically remove it if justification is lacking or the review is ignored.

Why this answer

Microsoft Entra ID Governance's Entitlement Management allows you to define access packages with specific policies, including an expiration date for assignments. By configuring an access package to grant access to the internal applications and setting its assignment policy to expire after 90 days, guest users' access will be automatically revoked at the end of that period. This directly fulfills the requirement for time-based automatic removal after 90 days.

Exam trap

The trap here is that candidates might consider Access Reviews for managing guest access, but Access Reviews are primarily for certifying existing access and removing it based on review decisions or lack thereof, not for automatically enforcing a fixed access duration from the point of initial access. Entitlement Management's access package expiration is designed for this specific time-based access lifecycle management.

How to eliminate wrong answers

Option A is wrong because entitlement management manages access packages and catalogs for provisioning access, but it does not automatically remove access after a fixed duration without an associated access review policy. Option C is wrong because Identity Protection focuses on detecting and remediating identity-based risks (e.g., compromised accounts, sign-in anomalies), not on scheduling automatic removal of guest access. Option D is wrong because Privileged Identity Management (PIM) provides just-in-time privileged role activation and approval workflows, but it is designed for administrative roles, not for managing guest user access to internal applications with a 90-day removal policy.

Practice this question →

119

Multi-Selecthard

A company uses Microsoft Entra ID. The security team wants to implement a solution that provides real-time risk detection during sign-ins and can automatically enforce access policies based on user risk and sign-in risk. Which TWO Microsoft Entra features should they use together to achieve this? (Choose two.)

Select 2 answers

A.Microsoft Entra Privileged Identity Management (PIM)

B.Microsoft Entra ID Protection

C.Microsoft Entra self-service password reset (SSPR)

D.Microsoft Entra ID Governance

E.Microsoft Entra Conditional Access

AnswersB, E

Microsoft Entra ID Protection detects risk events such as leaked credentials, atypical travel, and anonymous IP addresses. It calculates user risk and sign-in risk in real time. By itself, it can generate alerts and risk reports, but to automatically enforce access decisions, it must be integrated with Conditional Access. This feature is essential for the risk detection component of the scenario.

Why this answer

Microsoft Entra ID Protection detects user and sign-in risks in real time, while Conditional Access enforces policies based on those risks. Together, they enable automated responses such as requiring MFA or blocking access when risk is elevated. This combination directly addresses the need for real-time risk detection and dynamic policy enforcement.

Exam trap

The trap here is thinking that PIM or ID Governance can enforce risk-based policies, but only ID Protection and Conditional Access work together for real-time risk detection and enforcement.

Practice this question →

120

MCQhard

Refer to the exhibit. You are configuring a Conditional Access policy that requires compliant device for access to Microsoft 365. The device shown in the exhibit is Azure AD joined, compliant, and managed. However, a user signing in from this device is still blocked. What is the most likely cause?

A.The device profile type is 'Workplace', which is not allowed.

B.The device is not compliant.

C.The device is not managed.

D.The Conditional Access policy requires Hybrid Azure AD joined device.

AnswerD

The exhibit implies the device is Azure AD joined, which is distinct from a Hybrid Azure AD joined device. A Hybrid Azure AD joined device is registered with both on-premises Active Directory and Azure Active Directory. If the Conditional Access policy is specifically configured to grant access only to Hybrid Azure AD joined devices, an Azure AD joined-only device would fail this requirement, leading to access being blocked. This mismatch in device join type is a common reason for Conditional Access policy enforcement.

Why this answer

The exhibit shows the device is Azure AD joined, compliant, and managed, yet the user is still blocked. This indicates the Conditional Access policy is configured to require a Hybrid Azure AD joined device, which is a stricter requirement than just being Azure AD joined. A Hybrid Azure AD joined device must be both domain-joined to on-premises Active Directory and registered with Azure AD, whereas an Azure AD joined device is only cloud-joined.

Since the device in the exhibit is only Azure AD joined, it does not satisfy the Hybrid Azure AD joined condition, causing the block.

Exam trap

The trap here is that candidates assume 'compliant' and 'managed' automatically satisfy all Conditional Access device requirements, but Microsoft distinguishes between Azure AD joined, Hybrid Azure AD joined, and registered devices, and policies can require a specific join type that the device does not meet.

How to eliminate wrong answers

Option A is wrong because 'Workplace' is not a valid device profile type in Azure AD; the exhibit shows the device is Azure AD joined, and the profile type field is irrelevant to the policy requirement. Option B is wrong because the exhibit explicitly states the device is compliant, so non-compliance cannot be the cause of the block. Option C is wrong because the exhibit states the device is managed (e.g., via Intune or MDM), so lack of management is not the issue.

Practice this question →

121

MCQhard

Your organization uses Microsoft Entra ID with P2 licenses. You need to delegate the ability to manage role assignments in Entra ID without granting global admin rights. Which feature should you use?

A.Entitlement Management

B.Conditional Access

C.Administrative Units

D.Privileged Identity Management

AnswerD

Microsoft Entra Privileged Identity Management (PIM) is the correct solution for managing, controlling, and monitoring access to important resources within Microsoft Entra ID and other Microsoft online services. PIM specifically enables just-in-time (JIT) access to roles, time-bound assignments, and approval workflows for role activation. It allows organizations to delegate the management of role assignments, including the ability for designated users to assign eligible roles to others, thereby significantly reducing the standing access of highly privileged accounts.

Why this answer

Privileged Identity Management (PIM) in Microsoft Entra ID P2 enables just-in-time, time-bound, and approval-based role assignments, allowing you to delegate role management without granting permanent global admin rights. PIM provides role activation workflows and auditing, making it the correct feature for delegating role assignment management.

Exam trap

The trap here is confusing Administrative Units (which limit scope) with Privileged Identity Management (which manages role assignment delegation and activation), as both deal with role management but serve different purposes.

How to eliminate wrong answers

Option A is wrong because Entitlement Management is for managing access packages and resource access lifecycle, not for delegating role assignments in Entra ID. Option B is wrong because Conditional Access enforces access policies based on signals like user location or device compliance, but does not delegate role management. Option C is wrong because Administrative Units restrict administrative scope to specific organizational units (e.g., departments) but do not delegate the ability to manage role assignments themselves; they limit where a role applies, not who can assign roles.

Practice this question →

122

MCQmedium

A company wants to prevent users from using common passwords like 'Password123' and custom banned passwords such as 'Contoso2024' during sign-up or password change. They also need to apply a common list of banned passwords across tenant-wide. Which Microsoft Entra feature should they configure?

A.Conditional Access

B.Microsoft Entra ID Password Protection

C.Identity Protection

D.Multifactor Authentication (MFA)

AnswerB

Microsoft Entra ID Password Protection directly addresses the challenge of weak and commonly used passwords by integrating a global banned password list and enabling administrators to create custom banned lists specific to their organization. This service actively checks passwords during creation, reset, or change operations against these lists, preventing users from setting easily guessable or compromised credentials. It ensures stronger password hygiene by proactively blocking known weak patterns, directly fulfilling the requirement to prevent common passwords.

Why this answer

Microsoft Entra ID Password Protection allows administrators to enforce both a global banned password list (Microsoft-managed) and a custom banned password list (tenant-specific). This feature blocks weak passwords like 'Password123' and custom entries like 'Contoso2024' during sign-up or password change operations, making it the correct choice for tenant-wide password policy enforcement.

Exam trap

The trap here is that candidates confuse Conditional Access (which controls access conditions) with password protection policies, or assume Identity Protection handles password bans when it actually focuses on risk detection, not password content enforcement.

How to eliminate wrong answers

Option A is wrong because Conditional Access is a policy engine that enforces access controls (e.g., requiring MFA or blocking sign-ins from certain locations) based on signals like user risk or device compliance, not for banning specific passwords. Option C is wrong because Identity Protection focuses on detecting and responding to identity-based risks (e.g., leaked credentials, anomalous sign-ins) and does not manage password content policies. Option D is wrong because Multifactor Authentication (MFA) adds a second verification layer (e.g., phone call, app notification) but does not evaluate or block the use of common or custom banned passwords.

Practice this question →

123

MCQhard

Your company uses Microsoft Entra ID and wants to automatically assign licenses to new employees based on their department. Which feature should you use?

A.Privileged Identity Management

B.Access reviews

C.Dynamic groups and group-based licensing

D.Entitlement management

AnswerC

This combination provides a robust solution for automatic license assignment based on user attributes. Dynamic groups in Microsoft Entra ID automatically update their membership based on predefined rules that query user attributes (e.g., department, job title, location). When group-based licensing is then applied to such a dynamic group, all current and future members automatically receive the assigned licenses, and licenses are automatically revoked if a user's attributes change, causing them to no longer meet the group's membership criteria.

Why this answer

Dynamic groups in Microsoft Entra ID allow you to automatically add or remove users based on attributes like department. Combined with group-based licensing, you can assign licenses (e.g., Microsoft 365 E5) to all members of that group, so when a new employee is added with the matching department attribute, they automatically receive the correct license without manual intervention.

Exam trap

The trap here is that candidates confuse Entitlement management (which manages access packages) with automatic license assignment, but Entitlement management does not natively assign licenses based on department attributes—it requires custom integration, whereas Dynamic groups with group-based licensing is the direct, built-in solution.

How to eliminate wrong answers

Option A is wrong because Privileged Identity Management (PIM) is used for just-in-time privileged role activation and access oversight, not for automatic license assignment. Option B is wrong because Access reviews are periodic attestations to verify that users still need access, not a mechanism to assign licenses automatically. Option D is wrong because Entitlement management handles access packages and approval workflows for resource access, not direct license assignment based on department attributes.

Practice this question →

124

MCQhard

A company uses Microsoft Entra ID and needs to regularly review membership of a group that grants access to a sensitive HR application. The identity team wants to automate quarterly reviews and automatically remove users who fail to respond or are denied by the reviewer. Which Microsoft Entra ID feature should they use?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management (PIM)

D.Access Reviews

AnswerD

Microsoft Entra Access Reviews provide a systematic way for organizations to manage access lifecycle by regularly reviewing who has access to various resources. This feature allows administrators to create recurring reviews for group memberships, application assignments, and Microsoft Entra role assignments. Reviewers, such as group owners or managers, can then approve or deny access, with the system automatically removing unresponsive or denied users based on configured settings, ensuring least privilege.

Why this answer

Microsoft Entra Access Reviews are specifically designed to automate periodic attestation of group memberships, including the ability to automatically remove users who do not respond or are denied by the reviewer. This feature supports quarterly recurring reviews and integrates directly with Entra ID groups to enforce access governance for sensitive applications.

Exam trap

The trap here is that candidates often confuse Privileged Identity Management (PIM) with Access Reviews because both involve 'reviews,' but PIM only handles role activation and approval workflows, not recurring group membership attestation with automatic removal.

Why the other options are wrong

Conditional Access is used to enforce access policies based on signals like user location or device state, not to automate review and removal of group memberships.

Identity Protection is designed to detect and respond to identity-based risks, such as compromised credentials or suspicious sign-ins, not to automate periodic membership reviews with removal of non-responding or denied users.

Practice this question →

125

MCQmedium

A company uses Microsoft Entra ID and wants to provide external business partners with access to a specific internal application. The partners already use Microsoft Entra ID in their own organization. The company wants the partners to use their existing corporate credentials to sign in, without creating new user accounts in the company's tenant. The company also wants to manage the access lifecycle, including automatically removing access after a project ends. Which Microsoft Entra ID feature should they use?

A.Microsoft Entra B2B collaboration

B.Microsoft Entra B2C

C.Identity Protection

D.Privileged Identity Management (PIM)

AnswerA

Microsoft Entra B2B collaboration is the correct solution for enabling external partners to access resources within a company's Microsoft Entra ID tenant using their existing corporate identities. This feature allows inviting guest users from other Microsoft Entra organizations, social identity providers, or email-verified accounts, integrating them into the tenant for seamless access to applications and resources. It provides robust lifecycle management, allowing administrators to manage guest user access and permissions effectively.

Why this answer

Microsoft Entra B2B collaboration is the correct feature because it allows external users from partner organizations who already have their own Microsoft Entra ID accounts to sign in using their existing corporate credentials, without requiring new user accounts in the company's tenant. It also supports access lifecycle management through features like entitlement management and access reviews, enabling automatic removal of access when a project ends.

Exam trap

The trap here is that candidates often confuse B2B collaboration (for business partners with existing corporate identities) with B2C (for customers using social or local accounts), leading them to select B2C when the scenario clearly describes partner organizations using their own corporate credentials.

Why the other options are wrong

Microsoft Entra B2C is designed for customer-facing applications where users sign up with social or local identities, not for business partners using their own corporate credentials. The question requires partners to use existing Entra ID credentials, which is B2B collaboration, not B2C.

Identity Protection is a tool for detecting and responding to identity-based risks, such as compromised credentials or suspicious sign-ins. It does not provide external user access management or lifecycle automation for business partners.

Privileged Identity Management (PIM) manages just-in-time access and role activation for privileged roles within an organization, not external partner access or lifecycle management for external users.

Practice this question →

126

MCQmedium

A company wants to allow employees to securely access internal applications from their personal devices. The security policy requires that access is only granted if the device is compliant with company security policies (e.g., encryption enabled, password required, up-to-date operating system). Which Microsoft Entra ID capability should they use?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management

D.Microsoft Entra Verified ID

AnswerA

Conditional Access policies in Microsoft Entra ID are fundamental for implementing Zero Trust principles by evaluating specific conditions before granting access. These policies can enforce requirements such as multifactor authentication, specific location, or crucially, that a device must be marked as compliant by Microsoft Intune. This ensures that only trusted devices meeting organizational security standards can access internal applications, directly addressing the need for secure access from compliant endpoints.

Why this answer

Conditional Access in Microsoft Entra ID is the correct capability because it allows administrators to define policies that enforce device compliance before granting access to applications. By integrating with Microsoft Intune, Conditional Access can require that devices meet specific security policies—such as encryption, password requirements, and OS updates—before allowing access. This directly addresses the requirement to grant access only from compliant personal devices.

Exam trap

The trap here is that candidates often confuse Identity Protection (risk-based conditional access) with device compliance Conditional Access, but Identity Protection does not evaluate device health or compliance policies.

How to eliminate wrong answers

Option B is wrong because Identity Protection focuses on detecting and responding to identity-based risks (e.g., leaked credentials, anomalous sign-ins), not on enforcing device compliance. Option C is wrong because Privileged Identity Management (PIM) manages just-in-time access and approval workflows for privileged roles, not device-level security checks. Option D is wrong because Microsoft Entra Verified ID is a decentralized identity solution for verifiable credentials (e.g., digital IDs), not for device compliance enforcement.

Practice this question →

127

MCQmedium

A company uses Microsoft Entra ID. A junior administrator needs to occasionally reset passwords for the IT department. The security team wants to grant this permission only for a limited time and require an approval from a senior administrator before the permission becomes active. All password reset actions must be audited. Which Microsoft Entra ID feature should they configure?

A.Entra ID Identity Protection

B.Entra ID Privileged Identity Management (PIM)

C.Entra ID Conditional Access

D.Entra ID Terms of Use

AnswerB

Entra ID Privileged Identity Management (PIM) is the correct solution because it directly addresses the need for secure, time-bound access to administrative roles. PIM enables just-in-time (JIT) role activation, meaning users only get elevated permissions when needed and for a limited duration. It integrates approval workflows, requiring an authorized approver to grant temporary access, and provides detailed audit logs for accountability, aligning perfectly with managing role permissions with approval.

Why this answer

Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access, allowing the junior administrator to request a time-limited role for password reset that requires approval from a senior administrator. PIM also enables auditing of all role activations and actions, meeting the security team's requirements for limited duration, approval workflow, and auditability.

Exam trap

The trap here is that candidates often confuse PIM with Conditional Access, thinking that Conditional Access can enforce time-limited permissions, but Conditional Access controls access to resources based on conditions, not the activation or approval of privileged roles.

Why the other options are wrong

Entra ID Identity Protection is designed to detect and respond to identity-based risks, such as compromised credentials or suspicious sign-ins, not to manage time-limited, approval-based permissions for password resets.

Conditional Access controls access based on conditions like location or device state, but does not provide time-limited, approval-based role activation or auditing of specific actions like password reset.

Practice this question →

128

MCQmedium

Your company uses Microsoft Entra ID and wants to implement a passwordless authentication strategy for all users. You have a mix of Windows 10 devices, iOS devices, and Android devices. You need a solution that works across all platforms and does not require users to remember passwords. What should you implement?

A.Deploy FIDO2 security keys to all users and register them in Microsoft Entra ID.

B.Deploy Microsoft Authenticator with phone sign-in enabled for all users.

C.Implement certificate-based authentication using smart cards.

D.Enable Windows Hello for Business on all Windows devices.

AnswerB

Deploying Microsoft Authenticator with phone sign-in provides a highly scalable and user-friendly passwordless solution by leveraging users' existing smartphones. This method supports cross-platform compatibility across Windows, iOS, and Android devices, enabling a consistent authentication experience without requiring passwords. Users simply approve a notification on their mobile device, making it an efficient and broadly applicable choice for an entire organization.

Why this answer

Microsoft Authenticator with phone sign-in enabled provides a cross-platform passwordless authentication solution that works on Windows 10, iOS, and Android devices. It uses a key-based authentication model where the user's phone generates a cryptographic key pair, eliminating the need for passwords while supporting all required device types.

Exam trap

The trap here is that candidates often assume FIDO2 security keys (Option A) are the only true passwordless solution, but they overlook the cross-platform limitation and the fact that Microsoft Authenticator also implements FIDO2/WebAuthn, making it the more practical choice for heterogeneous device environments.

How to eliminate wrong answers

Option A is wrong because FIDO2 security keys require a USB or NFC interface, which is not supported on all iOS devices (iOS does not support FIDO2 over NFC for authentication in all scenarios), and deploying physical keys to all users is less scalable and platform-agnostic than a phone-based solution. Option C is wrong because certificate-based authentication using smart cards requires specialized hardware (smart card readers) and is not natively supported on iOS and Android devices without additional middleware, making it impractical for a cross-platform passwordless strategy. Option D is wrong because Windows Hello for Business is limited to Windows devices and does not address iOS or Android devices, failing the requirement for a solution that works across all platforms.

Practice this question →

129

Multi-Selecthard

Which TWO Microsoft Entra features can help protect against credential attacks?

Select 2 answers

A.Microsoft Entra Connect

B.Self-service password reset

C.Microsoft Entra password protection

D.Access reviews

E.Smart lockout

AnswersC, E

Microsoft Entra password protection actively safeguards user accounts by preventing the use of weak, easily guessable, or commonly compromised passwords. It enforces strong password policies by blocking known bad passwords globally and allows organizations to define custom banned password lists. This feature directly mitigates password spray and brute-force attacks by ensuring that even if an attacker attempts a common password, it will be rejected.

Why this answer

Microsoft Entra password protection (C) helps defend against credential attacks by automatically blocking weak passwords and common variations of known compromised passwords, such as those from botnets or public password lists. Smart lockout (E) protects against brute-force attacks by locking an account after a configurable number of failed sign-in attempts, using intelligent heuristics to distinguish between legitimate users and attackers. Both features directly mitigate password-based attacks like password spraying and brute force.

Exam trap

The trap here is that candidates often confuse self-service password reset (SSPR) with a security feature that prevents attacks, when in reality SSPR is a convenience feature for password recovery, not a proactive defense against credential threats.

Practice this question →

130

MCQhard

Your organization uses Microsoft Entra ID with P2 licenses. You need to implement a policy that requires users to perform multifactor authentication (MFA) when accessing the finance application from an untrusted network, but not when accessing it from the corporate network. Which Microsoft Entra feature should you configure?

A.Microsoft Entra Entitlement Management

B.Microsoft Entra ID Protection MFA registration policy

C.Microsoft Entra Conditional Access policy

D.Microsoft Entra Privileged Identity Management (PIM)

AnswerC

Microsoft Entra Conditional Access policies are powerful 'if-then' statements that evaluate various signals, such as user, device, location, and application, to make real-time access decisions. By configuring a Conditional Access policy, an organization can specify conditions (e.g., users signing in from untrusted networks) and then enforce specific controls, such as requiring Multi-Factor Authentication, before granting access to resources. This capability directly addresses the need to enforce MFA during sign-in based on location.

Why this answer

Microsoft Entra Conditional Access policies allow you to enforce MFA based on conditions such as network location. By configuring a policy that targets the finance application and includes a condition for 'untrusted networks' (e.g., any location other than the corporate network's trusted IP ranges), you can require MFA only when access originates from outside the corporate network. This is the correct feature for granular, condition-based access controls.

Exam trap

The trap here is that candidates often confuse the MFA registration policy (which only ensures users have registered MFA methods) with a Conditional Access policy that actually enforces MFA during sign-in based on conditions like network location.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Entitlement Management is used for managing access packages and identity governance (e.g., automated access requests and reviews), not for enforcing MFA based on network location. Option B is wrong because the Microsoft Entra ID Protection MFA registration policy only enforces that users register for MFA, not that they perform MFA during sign-in based on network conditions. Option D is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time privileged role activation and approval workflows, not location-based MFA enforcement for application access.

Practice this question →

131

MCQmedium

A company uses Microsoft Entra ID. The security team wants to grant temporary, time-limited administrative access to Azure subscriptions only when needed, with an approval workflow. Which Microsoft Entra capability should they use?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management (PIM)

D.Entra ID Governance

AnswerC

Microsoft Entra Privileged Identity Management (PIM) is the dedicated solution for managing, controlling, and monitoring access to critical resources across Microsoft Entra ID, Azure, and other Microsoft Online Services. It enables just-in-time (JIT) access, allowing users to activate eligible administrative roles for a limited, time-bound period. PIM also supports multi-stage approval workflows for role activation, ensuring that elevated privileges are granted only when necessary and with proper authorization, directly addressing the requirement for time-bound, approved elevation.

Why this answer

Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure AD and Azure resources, including Azure subscriptions. PIM supports time-bound role activation with an approval workflow, allowing the security team to grant temporary administrative access only when needed, which directly matches the requirement.

Exam trap

The trap here is that candidates confuse PIM with Conditional Access, thinking that Conditional Access can enforce time-limited access via session controls, but Conditional Access cannot grant or revoke Azure RBAC role assignments or require an approval workflow for role activation.

How to eliminate wrong answers

Option A is wrong because Conditional Access is a policy engine that enforces access controls (e.g., MFA, device compliance) based on signals like user location or risk, but it does not provide time-limited role activation or an approval workflow for privileged access. Option B is wrong because Identity Protection focuses on detecting and remediating identity-based risks (e.g., leaked credentials, anomalous sign-ins) and does not manage role assignments or temporary privileged access. Option D is wrong because Entra ID Governance encompasses broader capabilities like access reviews, entitlement management, and lifecycle workflows, but the specific feature for time-limited, approval-based privileged access to Azure subscriptions is PIM, not governance as a whole.

Practice this question →

132

MCQmedium

An organization decides to eliminate passwords for their employees. They deploy Windows Hello for Business on company-issued laptops, allowing users to sign in with a PIN or a biometric gesture (e.g., fingerprint). The IT team also enables Microsoft Authenticator and FIDO2 security keys as alternative sign-in methods. Which Microsoft Entra ID capability are they leveraging?

A.Microsoft Entra ID Protection

B.Conditional Access

C.Passwordless authentication

D.Self-Service Password Reset (SSPR)

AnswerC

Passwordless authentication directly addresses the goal of eliminating passwords by replacing them with stronger, more convenient alternatives. In Microsoft Entra ID, this includes methods like Windows Hello for Business, Microsoft Authenticator app, and FIDO2 security keys. These methods leverage biometrics, device-bound credentials, or cryptographic keys to verify user identity, significantly enhancing security and streamlining the sign-in experience without ever requiring a traditional password.

Why this answer

The organization is implementing passwordless authentication by removing passwords and using Windows Hello for Business (PIN/biometrics), Microsoft Authenticator, and FIDO2 security keys. These methods replace the password with a cryptographic key pair bound to the device or user, satisfying the definition of passwordless authentication in Microsoft Entra ID.

Exam trap

The trap here is that candidates confuse the authentication method (passwordless) with the security policies that protect it (Conditional Access) or the risk detection that monitors it (Identity Protection), leading them to select a wrong answer that sounds related but is not the core capability being demonstrated.

Why the other options are wrong

Microsoft Entra ID Protection is a security tool that detects and remediates identity-based risks (e.g., leaked credentials, anomalous sign-ins), not a method for eliminating passwords. The question focuses on deploying passwordless sign-in methods (PIN, biometrics, Authenticator, FIDO2), which is a passwordless authentication capability.

Conditional Access is a policy engine that enforces access controls based on signals like user, device, or location, but it is not the capability that enables passwordless sign-in methods like Windows Hello for Business, Microsoft Authenticator, or FIDO2 keys.

The scenario describes eliminating passwords and using PIN, biometrics, Authenticator, and FIDO2 keys for sign-in, which is passwordless authentication. SSPR is a feature that allows users to reset their own passwords when forgotten, not to eliminate passwords entirely.

Practice this question →

133

MCQhard

Refer to the exhibit. The Conditional Access policy is configured to block access for high-risk users. A user with a medium risk level attempts to sign in. What will happen?

A.Access is blocked

B.User is redirected to a password reset page

C.Access is granted

D.User is prompted for MFA

AnswerC

Access is granted because the fundamental conditions defined within the Conditional Access policy's "Assignments" section were not entirely satisfied. When a policy's conditions are not met, the policy is not triggered, and its configured controls—whether to grant, block, or require specific actions—are not enforced. In such cases, access typically defaults to being granted, assuming no other active policies or security defaults intervene to restrict it.

Why this answer

The Conditional Access policy is configured to block access for high-risk users only. Since the user has a medium risk level, the policy condition is not met, so the policy does not apply. Therefore, access is granted based on the default behavior of allowing sign-in when no Conditional Access policy is triggered.

Exam trap

The trap here is that candidates often assume any risk level triggers the block action, but Conditional Access policies only enforce controls when the condition exactly matches the configured risk level, not for lower or higher levels unless explicitly specified.

How to eliminate wrong answers

Option A is wrong because the policy specifically targets high-risk users, and a medium-risk user does not match the condition, so access is not blocked. Option B is wrong because a password reset page is triggered only by a policy that requires password change (e.g., user risk policy with 'Require password change' control), which is not configured here. Option D is wrong because MFA prompt would require a policy with 'Require multifactor authentication' control, which is not present in this configuration.

Practice this question →

134

MCQhard

An organization is migrating from on-premises Active Directory to Microsoft Entra ID. They need to synchronize user passwords so that users can use the same password for both on-premises and cloud resources. Which authentication method should they choose?

A.Password Hash Synchronization

B.Seamless Single Sign-On

C.Pass-through Authentication

D.Federation with AD FS

AnswerA

Password Hash Synchronization (PHS) is a cloud authentication method that securely synchronizes a cryptographic hash of a user's password from an on-premises Active Directory to Azure AD. This allows users to sign in to cloud services using the same credentials they use on-premises, without exposing their actual passwords in the cloud. It provides a simple, robust solution for hybrid identity, enabling a seamless transition for users during migration while maintaining a cloud-managed authentication experience.

Why this answer

Password Hash Synchronization (PHS) is the correct choice because it synchronizes a hash of the user's on-premises Active Directory password to Microsoft Entra ID, allowing users to authenticate with the same password for both on-premises and cloud resources. This method is specifically designed for password synchronization without requiring any additional infrastructure or real-time validation against on-premises systems.

Exam trap

The trap here is that candidates confuse 'synchronization' with 'single sign-on' or 'pass-through validation,' assuming that Seamless SSO or Pass-through Authentication also synchronize passwords, when in fact they do not transfer password hashes to the cloud.

How to eliminate wrong answers

Option B (Seamless Single Sign-On) is wrong because it does not synchronize passwords; it only provides automatic sign-in for domain-joined devices on corporate networks by using Kerberos delegation, but the actual password validation still relies on another method like PHS or Pass-through Authentication. Option C (Pass-through Authentication) is wrong because it validates passwords directly against on-premises Active Directory in real time without synchronizing password hashes to the cloud, which means it does not meet the requirement to synchronize passwords for offline or cloud-only authentication. Option D (Federation with AD FS) is wrong because it uses a federated trust with on-premises Active Directory Federation Services (AD FS) for authentication, requiring complex infrastructure and redirecting authentication to on-premises servers, rather than synchronizing password hashes to Microsoft Entra ID.

Practice this question →

135

MCQmedium

A company uses Microsoft Entra ID. The IT department wants to ensure that users are prompted to change their password only when there is a high likelihood that their credentials have been compromised, rather than forcing periodic password changes. They also want to block users from using common passwords from a custom list of banned passwords. Which Microsoft Entra features should they use?

A.Identity Protection and Password Protection

B.Conditional Access and Multi-Factor Authentication

C.Privileged Identity Management and Identity Governance

D.Access Reviews and Entitlement Management

AnswerA

Microsoft Entra Identity Protection actively detects potential vulnerabilities affecting user identities, such as leaked credentials or risky sign-in behaviors, and can automate remediation actions including forcing a password change for high-risk users. Microsoft Entra Password Protection specifically prevents users from creating weak, commonly used, or custom-banned passwords, directly addressing the prevention of easily guessable or compromised passwords within the organization.

Why this answer

Identity Protection uses machine learning to detect leaked credentials and risky sign-in behaviors, triggering a password change prompt only when compromise is likely, not on a fixed schedule. Password Protection enforces custom banned password lists (e.g., common passwords or company-specific terms) at the time of password change or reset, blocking weak passwords in real time.

Exam trap

The trap here is that candidates confuse Identity Protection with Conditional Access, assuming risk-based policies are the same as password change triggers, or they think Password Protection is part of MFA or PIM, when in fact it is a separate feature focused solely on password content validation.

How to eliminate wrong answers

Option B is wrong because Conditional Access controls access policies (e.g., requiring MFA based on risk) but does not manage password change triggers or banned password lists; Multi-Factor Authentication adds a second verification factor but does not detect credential compromise or enforce password bans. Option C is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role activation and approval workflows, not password policies or compromise detection; Identity Governance handles access certifications and lifecycle, not password change logic. Option D is wrong because Access Reviews are for periodic recertification of group memberships or application access, and Entitlement Management manages access packages and catalogs; neither feature triggers password changes based on compromise likelihood or enforces custom banned password lists.

Practice this question →

136

MCQeasy

Your organization wants to enforce MFA for all users accessing the Azure portal. However, users accessing from the corporate office network should not be prompted for MFA. Which Conditional Access assignment should you configure?

A.Include all users, include trusted locations.

B.Include all trusted locations.

C.Include Azure portal app, exclude trusted locations.

D.Include all locations, exclude trusted locations.

AnswerD

This Conditional Access policy configuration effectively enforces Multi-Factor Authentication (MFA) for all users attempting to access resources from any network location, while simultaneously creating a specific exception for trusted network environments. By including "all locations" and then explicitly excluding "trusted locations," the policy ensures MFA is mandated for external or untrusted access attempts, but users on the secure corporate network are not prompted for an additional factor, balancing robust security with user experience.

Why this answer

Conditional Access policies evaluate assignments based on conditions such as user, app, and location. To enforce MFA for all users accessing the Azure portal while excluding the corporate office network, you must include all users and the Azure portal app, then exclude trusted locations (the corporate network). This ensures MFA is required only when access originates from outside the trusted corporate network.

Exam trap

The trap here is that candidates often confuse 'include' and 'exclude' assignments, mistakenly thinking that including trusted locations will skip MFA, when in fact you must exclude trusted locations to bypass MFA from those networks.

How to eliminate wrong answers

Option A is wrong because it includes all users and includes trusted locations, which would require MFA even from the corporate network, contradicting the requirement to skip MFA from trusted locations. Option B is wrong because it only includes trusted locations, which does not specify which users or apps are targeted, leaving the policy incomplete and ineffective. Option C is wrong because it includes the Azure portal app but excludes trusted locations, yet it omits the user assignment (e.g., 'all users'), so the policy would not apply to any user.

Practice this question →

137

MCQeasy

Your organization wants to enable single sign-on (SSO) for users accessing Microsoft 365 apps from unmanaged devices while enforcing multifactor authentication (MFA). Which Microsoft Entra feature should you configure?

A.Self-Service Password Reset (SSPR)

B.Conditional Access

C.Privileged Identity Management (PIM)

D.Identity Protection

AnswerB

Azure Active Directory Conditional Access is the policy engine that evaluates specific conditions before granting access to resources. It enables organizations to enforce strong authentication requirements, such as Multi-Factor Authentication (MFA), and control access based on factors like user location, device compliance, or application sensitivity. This capability is fundamental for implementing Single Sign-On (SSO) securely by defining the prerequisites for a user's initial authentication and subsequent access to integrated applications.

Why this answer

Conditional Access is the correct feature because it allows you to create policies that enforce specific access controls, such as requiring MFA, based on conditions like device state (unmanaged). By combining a device condition (e.g., 'Device is not compliant' or 'Device is unmanaged') with a grant control requiring MFA, you can achieve SSO for users while enforcing MFA on unmanaged devices. This directly addresses the requirement without affecting managed devices.

Exam trap

The trap here is that candidates often confuse Identity Protection (which detects risk) with Conditional Access (which enforces policy), or mistakenly think SSPR or PIM can enforce MFA on unmanaged devices, when only Conditional Access provides the conditional logic to tie device state to authentication requirements.

How to eliminate wrong answers

Option A is wrong because Self-Service Password Reset (SSPR) is a feature for users to reset their own passwords, not for enforcing MFA or controlling access based on device state. Option C is wrong because Privileged Identity Management (PIM) manages just-in-time access and approval workflows for privileged roles, not device-based access policies or MFA enforcement for all users. Option D is wrong because Identity Protection detects and remediates identity-based risks (e.g., leaked credentials, sign-ins from anonymous IPs) but does not natively enforce MFA based on device management status; it can trigger Conditional Access policies but is not the policy engine itself.

Practice this question →

138

Multi-Selecthard

A security administrator uses Microsoft Entra ID Protection to identify and respond to identity-based risks. Which two types of risk detections can be reviewed in Microsoft Entra ID Protection? (Choose two.)

Select 2 answers

A.Sign-in risk

B.User risk

C.Application permission risk

D.Device compliance risk

AnswersA, B

Microsoft Entra ID Protection actively monitors and evaluates various sign-in attempts for suspicious patterns, classifying them as "sign-in risk." This includes detecting anomalies like impossible travel from geographically disparate locations, sign-ins from anonymous IP addresses or malware-linked IPs, and unfamiliar sign-in properties such as new devices or locations. These real-time detections are crucial for preventing unauthorized access by compromised accounts.

Why this answer

Microsoft Entra ID Protection evaluates identity-based risks by analyzing two primary detection types: sign-in risk and user risk. Sign-in risk assesses the probability that a specific authentication attempt is unauthorized, while user risk evaluates the likelihood that a user account has been compromised based on aggregated suspicious activities.

Exam trap

The trap here is that candidates often confuse risk detection types with other security features like device compliance or application permissions, but Entra ID Protection specifically focuses on sign-in and user risk detections only.

Practice this question →

139

MCQmedium

A company has a Microsoft Entra ID tenant and an on-premises Active Directory Domain Services (AD DS) forest. They need to synchronize user accounts, groups, and passwords from AD DS to Microsoft Entra ID. Due to network restrictions, they prefer a lightweight agent that can be deployed on-premises and supports staging mode for testing. Which identity synchronization tool should they use?

A.Microsoft Entra Connect Sync

B.Microsoft Entra Connect Health

C.Microsoft Entra Cloud Sync

D.Microsoft Identity Manager (MIM)

AnswerA

Microsoft Entra Connect Sync is the primary and recommended tool for establishing hybrid identity by synchronizing users, groups, and devices from a single on-premises Active Directory Domain Services (AD DS) forest to Microsoft Entra ID. It supports various authentication methods like Password Hash Synchronization (PHS), Pass-through Authentication (PTA), and federation with AD FS. Its robust feature set includes attribute filtering, writeback capabilities, and a crucial staging mode for testing configurations before full deployment, making it ideal for most enterprise scenarios.

Why this answer

Microsoft Entra Connect Sync is the correct choice because it is the full-featured synchronization tool that supports staging mode for testing and can be deployed as a lightweight agent on-premises. It synchronizes user accounts, groups, and passwords from AD DS to Microsoft Entra ID, including password hash synchronization, pass-through authentication, and federation integration, making it ideal for complex on-premises environments with network restrictions.

Exam trap

The trap here is that candidates confuse 'Cloud Sync' as the lightweight agent because it is simpler, but they overlook that Cloud Sync does not support staging mode, which is explicitly required in the question.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra Connect Health is a monitoring and analytics tool, not a synchronization engine; it provides health insights for Entra Connect Sync but does not perform identity sync itself. Option C is wrong because Microsoft Entra Cloud Sync is a lightweight agent that syncs from AD DS to Entra ID but does not support staging mode; it is designed for simpler scenarios and lacks the full staging and testing capabilities of Entra Connect Sync. Option D is wrong because Microsoft Identity Manager (MIM) is an on-premises identity management solution that can sync to Entra ID but is not a lightweight agent; it requires a full server deployment and does not natively support staging mode for Entra ID synchronization.

Practice this question →

140

MCQmedium

Your company, Proseware, uses Microsoft Entra ID P2. You have a custom application that integrates with Microsoft Graph API to read user profiles. The application uses client credentials flow (application permissions). You need to ensure that the application can only read user profiles and not perform any other operations. Additionally, you want to review and approve the permissions periodically. What should you do?

A.Create a Conditional Access policy to restrict the app to read-only operations.

B.Enable Privileged Identity Management for the app and require approval for each API call.

C.Use delegated permissions for the application and assign users to the app role.

D.In Microsoft Entra ID, grant the application the User.Read.All permission and configure an access review for the application permissions.

AnswerD

Granting the `User.Read.All` application permission provides the necessary access for an application to read all user profiles in Microsoft Entra ID without granting excessive write or administrative capabilities, adhering to the principle of least privilege. Configuring an access review for these application permissions ensures that the granted access is periodically re-evaluated by designated reviewers, promoting ongoing security hygiene and preventing the accumulation of stale or unnecessary permissions over time.

Why this answer

The application uses client credentials flow (application permissions), which requires granting an application permission like User.Read.All to read all user profiles. Configuring an access review for the application permissions in Microsoft Entra ID allows periodic review and approval of those permissions, meeting the requirement to ensure the app can only read user profiles and that permissions are reviewed periodically.

Exam trap

The trap here is that candidates may confuse Conditional Access policies or PIM with permission management, not realizing that application permissions in the client credentials flow are static and require access reviews for periodic oversight, not dynamic runtime controls.

How to eliminate wrong answers

Option A is wrong because Conditional Access policies control user sign-in and access conditions, not the scope of permissions granted to an application; they cannot restrict an app to read-only operations after permissions are granted. Option B is wrong because Privileged Identity Management (PIM) is designed for just-in-time privileged role activation, not for requiring approval on each API call; it does not restrict the permissions of an application or approve individual API calls. Option C is wrong because delegated permissions operate on behalf of a signed-in user and are not suitable for a client credentials flow (application permissions) which runs without a user context; assigning users to an app role does not change the permission type.

Practice this question →

141

MCQmedium

Your organization, Fabrikam, has recently merged with another company. You need to provide seamless access to resources for users from both companies while maintaining separate identity directories. The users from the acquired company have their own Microsoft Entra ID tenant. You need to enable them to access applications in your tenant using their existing corporate credentials, without creating new accounts. Additionally, you want to enforce conditional access policies from your tenant for these users. Which approach should you use?

A.Create new user accounts in your tenant for the acquired company's users and assign them access.

B.Set up a federation trust between your tenant and the other company's on-premises Active Directory.

C.Use Microsoft Entra B2C to create a custom identity provider for the other company.

D.Use Microsoft Entra B2B collaboration to invite users from the other tenant as guest users, and apply conditional access policies to guest users.

AnswerD

Microsoft Entra B2B collaboration is the correct and most efficient solution for integrating users from another Microsoft Entra ID tenant following a merger. It allows Fabrikam to invite the acquired company's users as guest accounts, enabling them to authenticate using their existing credentials from their home tenant. Furthermore, Fabrikam can apply its own Conditional Access policies to these guest users, ensuring consistent security and compliance standards are enforced for all access to its resources.

Why this answer

Microsoft Entra B2B collaboration allows you to invite external users from another Microsoft Entra tenant to access your applications using their own corporate identities. This approach meets the requirement of not creating new accounts, and because guest users are represented as user objects in your tenant, you can enforce your own conditional access policies on them. Option D is correct because it directly addresses the need for seamless access with separate directories and policy control.

Exam trap

The trap here is confusing Microsoft Entra B2B collaboration (for business-to-business guest access with existing corporate identities) with Microsoft Entra B2C (for customer-facing identity management), leading candidates to incorrectly select option C.

How to eliminate wrong answers

Option A is wrong because creating new user accounts violates the requirement to use existing corporate credentials without creating new accounts. Option B is wrong because federation trust with on-premises Active Directory does not directly enable access to applications in your Microsoft Entra tenant for users from another Microsoft Entra tenant; it is used for hybrid identity scenarios with your own on-premises directory. Option C is wrong because Microsoft Entra B2C is designed for customer-facing identity management with social or local accounts, not for enabling access for users from another Microsoft Entra tenant using their existing corporate credentials.

Practice this question →

142

MCQeasy

A company uses Microsoft Entra ID. They want to allow employees to access the expense reporting application only from managed devices that are compliant with security policies and from trusted IP ranges. Additionally, if the user's sign-in risk is high, access must be blocked. Which of the following conditions should the administrator configure in a Conditional Access policy to enforce these requirements?

A.Only Device state and Locations

B.Only Sign-in risk and Device state

C.Device state, Locations, and Sign-in risk

D.Only Locations and Sign-in risk

AnswerC

This configuration provides a robust and comprehensive security posture by combining all three essential conditions. Device state ensures that only healthy, managed, and compliant devices can access resources, mitigating endpoint-related risks. Locations restricts access to authorized network perimeters, such as corporate offices or VPNs, preventing unauthorized external access. Sign-in risk dynamically assesses the likelihood of a compromised sign-in and can block or challenge suspicious attempts, providing a multi-faceted defense against evolving threats.

Why this answer

The scenario requires three distinct conditions: device compliance (Device state), trusted network locations (Locations), and high sign-in risk (Sign-in risk). Conditional Access policies in Microsoft Entra ID allow combining these assignments to enforce granular access controls. Only by including all three can the administrator block access when the user's sign-in risk is high, while also requiring a managed device and trusted IP range.

Exam trap

The trap here is that candidates often assume only two conditions are needed (e.g., device and location, or risk and device) and overlook the third, but the question explicitly lists three distinct requirements that must all be enforced simultaneously.

How to eliminate wrong answers

Option A is wrong because it omits Sign-in risk, which is explicitly required to block access when sign-in risk is high. Option B is wrong because it omits Locations, which is needed to restrict access to trusted IP ranges. Option D is wrong because it omits Device state, which is required to enforce access only from managed devices that are compliant with security policies.

Practice this question →

143

MCQmedium

A security administrator at an organization using Microsoft Entra ID needs to automatically detect user sign-ins that exhibit risky behavior, such as signing in from a suspicious IP address or using leaked credentials. The administrator also wants the system to automatically calculate a risk level for each user and take actions like requiring a password reset when risk is high. Which Microsoft Entra ID feature should the administrator use?

A.Identity Protection

B.Privileged Identity Management (PIM)

C.Conditional Access

D.Identity Governance

AnswerA

Identity Protection applies Microsoft Entra ID's risk detections to sign-ins and users, automatically calculating risk levels and triggering conditional access actions such as password reset. This matches the requirement for automatic detection of suspicious IPs and leaked credentials with automated remediation.

Why this answer

Microsoft Entra ID Protection is the correct feature because it automatically detects risky sign-in behaviors—such as sign-ins from suspicious IP addresses, anonymous IP addresses, or leaked credentials—and calculates a user risk level. It can then automatically trigger remediation actions like requiring a password reset when the risk level is high, directly matching the administrator's requirements.

Exam trap

The trap here is that candidates often confuse Conditional Access with Identity Protection, but Conditional Access is the enforcement layer that uses risk signals from Identity Protection—it does not perform the detection or risk calculation itself.

Why the other options are wrong

Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles in Microsoft Entra ID, but it does not detect risky sign-ins or calculate user risk levels based on behaviors like suspicious IP addresses or leaked credentials.

Conditional Access enforces policies based on signals like location or device state, but it does not automatically detect risky sign-ins or calculate user risk levels; it relies on Identity Protection for risk detection.

Identity Governance focuses on managing user access rights and certifications, not on detecting risky sign-in behaviors or calculating risk levels. It does not automatically detect suspicious IP addresses or leaked credentials.

Practice this question →

144

MCQmedium

A company wants to require multi-factor authentication (MFA) for all users accessing a financial application, but only when they sign in from outside the corporate network. Which Microsoft Entra ID feature should be used?

A.Identity Protection

B.Conditional Access

C.Privileged Identity Management (PIM)

D.Self-Service Password Reset (SSPR)

AnswerB

Conditional Access policies evaluate various signals in real-time, including user, device, application, and network location. Administrators can configure these policies to mandate specific controls, such as multi-factor authentication (MFA), when certain conditions are met, like a user attempting to access resources from an untrusted network or outside the corporate IP range. This directly addresses the requirement to enforce MFA for users accessing resources under specific conditions.

Why this answer

Conditional Access is the correct choice because it allows administrators to define policies that enforce multi-factor authentication (MFA) based on specific conditions, such as network location. In this scenario, a Conditional Access policy can be configured to require MFA only when users access the financial application from outside the corporate network, using the 'Locations' condition to distinguish trusted IP ranges from external sign-ins. This granular control directly addresses the requirement without affecting internal access.

Exam trap

The trap here is that candidates often confuse Identity Protection's risk-based MFA triggers with Conditional Access's location-based MFA enforcement, assuming Identity Protection alone can enforce MFA based on network location, whereas it only provides risk signals that must be consumed by a Conditional Access policy.

Why the other options are wrong

Identity Protection is a tool for detecting and responding to identity risks, but it does not enforce access controls like requiring MFA based on network location. Conditional Access is the feature that applies policies such as location-based MFA requirements.

Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles, not location-based MFA enforcement. It does not evaluate network location to trigger MFA.

Self-Service Password Reset (SSPR) allows users to reset their own passwords without administrator intervention, but it does not enforce multi-factor authentication based on network location. The requirement to require MFA only when signing in from outside the corporate network is a conditional access policy, which is handled by Conditional Access, not SSPR.

Practice this question →

145

MCQhard

A multinational organization uses Microsoft Entra ID for identity management. The security team wants to implement a Conditional Access policy that blocks access from untrusted locations unless the user's device is marked as compliant by Microsoft Intune. However, users traveling to trusted partner locations should be allowed access even if their device is non-compliant. Which two conditions should be configured in the policy?

A.Locations: All trusted locations; Grant: Require compliant device.

B.Locations: All trusted locations; Grant: Block access.

C.Locations: All locations, exclude trusted locations; Grant: Require compliant device.

D.Locations: All locations; Grant: Require compliant device.

AnswerC

This policy correctly targets "All locations" while specifically excluding "trusted locations" from its scope. Consequently, it applies only to untrusted network locations. For access attempts originating from these untrusted environments, the policy mandates that the device must be compliant with organizational security standards. Access from trusted locations is not governed by this specific policy, effectively allowing access from those locations without requiring device compliance, which aligns with typical security requirements.

Why this answer

The policy must block access from untrusted locations unless the device is compliant, while allowing access from trusted partner locations even if the device is non-compliant. By setting 'Locations: All locations' and excluding trusted locations, the policy applies only to untrusted locations. Then, 'Grant: Require compliant device' ensures that only compliant devices can access from those untrusted locations, meeting both requirements.

Exam trap

The trap here is that candidates often confuse 'exclude trusted locations' with 'include trusted locations,' leading them to choose options that incorrectly apply the policy to trusted locations instead of untrusted ones.

How to eliminate wrong answers

Option A is wrong because it applies the policy to all trusted locations, which would block non-compliant devices from trusted partner locations, contradicting the requirement to allow access from trusted locations even if non-compliant. Option B is wrong because it blocks access from all trusted locations entirely, which does not allow any access from trusted partner locations, regardless of device compliance. Option D is wrong because it applies the policy to all locations without excluding trusted locations, meaning non-compliant devices would be blocked from trusted partner locations as well, failing the requirement to allow access from those locations.

Practice this question →

146

MCQeasy

Your organization uses Microsoft Entra ID and needs to allow external partners to sign in using their own identity providers (e.g., Google or Facebook). Which Microsoft Entra feature should you configure?

A.Microsoft Entra Privileged Identity Management

B.Microsoft Entra External Identities (B2B collaboration)

C.Microsoft Entra Verified ID

D.Microsoft Entra Identity Protection

AnswerB

Microsoft Entra External Identities, particularly its B2B collaboration feature, is the correct solution for enabling external users to securely access an organization's applications and resources. This service allows guest users to sign in using their own corporate credentials, social identities, or other identity providers, seamlessly integrating them into the host organization's Microsoft Entra ID tenant for collaborative purposes.

Why this answer

Microsoft Entra External Identities (B2B collaboration) is the correct feature because it allows external partners to sign in using their own identity providers, such as Google or Facebook, through federation. B2B collaboration supports SAML/WS-Fed identity providers and social identity providers like Google, enabling guest users to access your organization's resources without needing a separate Microsoft account. This directly meets the requirement for external partner access with their own credentials.

Exam trap

The trap here is that candidates often confuse B2B collaboration with B2C (Azure AD B2C) or think PIM is needed for external access, but B2B collaboration is specifically designed for federating external identities from any IdP without requiring a separate directory.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Privileged Identity Management (PIM) is a feature for managing, controlling, and monitoring access to privileged roles within your own directory, not for enabling external identity providers. Option C is wrong because Microsoft Entra Verified ID is a decentralized identity solution based on verifiable credentials (W3C standards) for issuing and verifying claims, not for federating external sign-in with Google or Facebook. Option D is wrong because Microsoft Entra Identity Protection is a risk-based security tool that detects and responds to identity threats (e.g., leaked credentials, sign-in anomalies), not a feature for configuring external identity providers.

Practice this question →

147

MCQmedium

A user reports frequent password reset requests. You suspect password spray attacks. Which Microsoft Entra ID feature should you use to investigate?

A.Identity Protection risk detections

B.Audit logs

C.Conditional Access policies

D.Multifactor authentication

AnswerA

Azure AD Identity Protection actively monitors user sign-ins and user behavior for suspicious activities, including password spray attacks, impossible travel, anomalous IP addresses, and leaked credentials. When it detects these risks, it generates risk detections that can trigger automated responses or alert administrators. This capability directly addresses the need to identify the cause of frequent password reset requests by pinpointing the underlying attack patterns.

Why this answer

Identity Protection risk detections are the correct feature because they specifically analyze sign-in patterns and flag suspicious activities such as password spray attacks. A password spray attack involves an attacker trying a small number of common passwords against many accounts, and Identity Protection uses machine learning to detect this anomalous behavior and generate risk detections like 'Unfamiliar sign-in properties' or 'Malicious IP address'.

Exam trap

The trap here is that candidates confuse Audit logs (which show what happened) with Identity Protection risk detections (which analyze why it happened), leading them to pick Audit logs as the investigative tool for attack patterns.

How to eliminate wrong answers

Option B is wrong because Audit logs record administrative actions and configuration changes, not real-time sign-in risk analysis; they would show password reset events but not identify the attack pattern. Option C is wrong because Conditional Access policies enforce access controls based on conditions (e.g., require MFA), but they do not provide investigative insights into attack patterns like password spray. Option D is wrong because Multifactor authentication is a security control that adds a second verification step, not a detective tool for analyzing sign-in anomalies.

Practice this question →

148

Multi-Selecteasy

Which TWO features are included in Microsoft Entra ID P2 licensing?

Select 2 answers

A.Passwordless authentication

B.Multifactor authentication (MFA)

C.Single sign-on (SSO) to SaaS apps

D.Microsoft Entra Privileged Identity Management

E.Microsoft Entra Identity Protection

AnswersD, E

Microsoft Entra Privileged Identity Management (PIM) is a robust feature designed to manage, control, and monitor access to critical resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. It provides just-in-time (JIT) and just-enough-administration (JEA) access, significantly reducing the attack surface by limiting the duration and scope of elevated permissions. This advanced capability for privileged access governance is a cornerstone feature of Microsoft Entra ID P2.

Why this answer

Microsoft Entra ID P2 includes Microsoft Entra Privileged Identity Management (D), which provides just-in-time privileged role activation, access reviews, and approval workflows for administrative roles, and Microsoft Entra Identity Protection (E), which delivers risk-based Conditional Access policies, user and sign-in risk detection, and automated remediation of risky identities. These two capabilities are the distinguishing features that separate Entra ID P2 from P1, since P1 already covers the baseline identity features. Passwordless authentication (A), multifactor authentication (B), and single sign-on to SaaS apps (C) are all included in Entra ID P1 (and in large part in the free tier), so they are not exclusive to or introduced by P2 licensing.

Exam trap

The trap here is that candidates often confuse features available in Microsoft Entra ID P1 (like MFA, SSO, and passwordless) with P2-exclusive features, forgetting that P2 adds only advanced identity protection and privileged identity management on top of P1.

Practice this question →

149

MCQmedium

Your organization uses Microsoft Entra ID for identity management. You need to enable users to sign in using a QR code from the Microsoft Authenticator app. Which Microsoft Entra feature should you configure?

A.FIDO2 security keys

B.Temporary Access Pass

C.Passwordless sign-in with Microsoft Authenticator

D.My Security-info (https://aka.ms/mysecurityinfo)

AnswerC

Passwordless sign-in with Microsoft Authenticator is a core feature that allows users to sign into Microsoft Entra ID-connected applications without entering a password. When a user attempts to sign in, they are presented with an option to scan a QR code displayed on the sign-in screen using the Microsoft Authenticator app on their mobile device. The app then securely approves the sign-in request, often after a number match confirmation, providing a seamless and secure authentication experience.

Why this answer

The Microsoft Authenticator app supports passwordless sign-in by allowing users to approve a notification or scan a QR code from the sign-in screen. This feature eliminates the need for a password and relies on the Authenticator app as a primary authentication method, which is configured under the Passwordless sign-in with Microsoft Authenticator option in Entra ID.

Exam trap

The trap here is that candidates confuse the QR code scanning capability of the Authenticator app with FIDO2 security keys, but the question specifically asks about using the Microsoft Authenticator app, not a separate hardware device.

How to eliminate wrong answers

Option A is wrong because FIDO2 security keys are hardware-based passwordless credentials that use public-key cryptography, not QR codes from the Microsoft Authenticator app. Option B is wrong because Temporary Access Pass is a time-limited passcode used for onboarding or recovery scenarios, not for QR-code-based sign-in. Option D is wrong because My Security-info (https://aka.ms/mysecurityinfo) is a user portal for managing authentication methods, not a feature that enables QR-code sign-in.

Practice this question →

150

MCQmedium

Refer to the exhibit. A user reports being unable to access Exchange Online from their personal laptop. The sign-in log shows failure due to device non-compliance. What should you configure to allow access while maintaining security?

A.Create a Conditional Access policy requiring compliant device

B.Reset the user's password

C.Block all personal devices

D.Enable MFA for the user

AnswerA

Creating a Conditional Access policy that requires a compliant device directly addresses access issues stemming from device non-compliance. This policy evaluates the device's security posture, as determined by an MDM solution like Microsoft Intune, ensuring it meets predefined organizational security standards (e.g., OS version, encryption, antivirus status). Access to protected resources is then granted only if the device is marked as compliant, thereby enforcing a secure endpoint environment.

Why this answer

The sign-in log indicates the failure is due to device non-compliance, meaning the user's personal laptop does not meet your organization's compliance policies (e.g., missing antivirus, encryption, or required updates). Creating a Conditional Access policy that requires a compliant device will block access from non-compliant devices while allowing access from compliant ones, maintaining security by enforcing device health checks before granting access to Exchange Online.

Exam trap

The trap here is that candidates often confuse device compliance with authentication factors like MFA or password resets, but the sign-in log explicitly states the failure is due to device non-compliance, so the solution must enforce device health, not just user identity verification.

How to eliminate wrong answers

Option B is wrong because resetting the user's password addresses credential compromise, not device compliance; the failure is due to the device not meeting compliance requirements, not an incorrect password. Option C is wrong because blocking all personal devices is overly restrictive and not necessary; Conditional Access can selectively allow compliant personal devices while blocking non-compliant ones, preserving user productivity. Option D is wrong because enabling MFA strengthens authentication but does not enforce device compliance; the sign-in failure is specifically due to device non-compliance, not a lack of multi-factor authentication.

Practice this question →