CCNA Entra Capabilities Questions — Page 4 of 5

226

MCQeasy

Your organization wants to allow employees to use their personal mobile devices to access corporate resources, but you need to ensure that corporate data is protected if the device is lost or stolen. You also need to enforce a PIN policy on the device. Which combination of Microsoft Entra and Microsoft Intune features should you use?

A.Use Windows Autopilot to configure devices and then apply a device restriction policy.

B.Implement a Conditional Access policy requiring multi-factor authentication and trusted locations.

C.Enroll devices in Microsoft Intune MDM, create a device compliance policy requiring PIN, and configure a Conditional Access policy to allow only compliant devices.

D.Use Microsoft Intune app protection policies (MAM) without device enrollment, requiring PIN for managed apps.

AnswerC

Correct: MDM enrollment enables compliance policies and remote wipe of corporate data.

Why this answer

Enrolling devices in Microsoft Intune MDM allows the organization to apply device compliance policies (such as requiring a PIN) and then use Conditional Access to grant access only to compliant devices. If a device is lost or stolen, the organization can perform a selective wipe to remove corporate data while leaving personal data intact. Option A (Windows Autopilot) is a device provisioning tool, not a security or protection solution.

Option B (Conditional Access with MFA and trusted locations) does not enforce device-level policies like PIN. Option D (MAM without enrollment) can enforce a PIN for managed apps but cannot manage the device itself or perform selective wipe of all corporate data; it is less comprehensive than MDM.

Practice this question →

227

MCQhard

An organization has deployed Microsoft Entra ID Governance and wants to automate the process of revoking access to a critical application when an employee leaves the company. Which feature should they configure?

A.Microsoft Entra ID Governance Lifecycle Workflows

B.Microsoft Entra Privileged Identity Management

C.Microsoft Entra Access Reviews

D.Microsoft Entra Terms of Use

AnswerA

Microsoft Entra ID Governance Lifecycle Workflows provide automated identity lifecycle management, enabling organizations to define and execute tasks based on HR-driven events like joining, moving, or leaving. This feature can automatically provision or deprovision access to applications and resources, ensuring that when an employee departs, their access is systematically revoked without manual intervention, aligning directly with the requirement to remove access based on HR events.

Why this answer

Microsoft Entra ID Governance Lifecycle Workflows enable automated workflows triggered by HR events like employee termination. When an employee leaves, a lifecycle workflow can be configured to automatically remove the user from the application's access group or disable their account, ensuring immediate revocation of access without manual intervention.

Exam trap

The trap here is confusing automated offboarding (Lifecycle Workflows) with periodic access review (Access Reviews) or privileged role management (PIM), as candidates often think any governance feature can handle termination-based revocation.

How to eliminate wrong answers

Option B is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role activation and approval, not automated offboarding workflows for standard application access. Option C is wrong because Access Reviews are periodic attestation processes that require manual or scheduled review decisions, not automated revocation triggered by a lifecycle event like termination. Option D is wrong because Terms of Use present acceptance policies to users but do not enforce any automated access revocation actions.

Practice this question →

228

MCQmedium

A company uses Microsoft Entra ID and wants to ensure that guest users who are inactive for 90 days have their access to internal resources automatically revoked. Additionally, a manager must review all guest accounts annually. Which Microsoft Entra feature should be used to implement these requirements?

A.Microsoft Entra Identity Governance Access Reviews

B.Conditional Access policies

C.Privileged Identity Management (PIM)

D.Self-Service Password Reset (SSPR)

AnswerA

Microsoft Entra Identity Governance Access Reviews enable organizations to manage the lifecycle of user access, particularly for guest accounts. They facilitate periodic reviews by resource owners or managers to certify continued access, ensuring compliance and security. These reviews can be automated to remove access for users who are not re-approved or have shown no activity for a defined period, directly addressing the need for guest account management and cleanup. This capability is crucial for maintaining a clean and secure identity posture by preventing stale accounts.

Why this answer

Microsoft Entra Identity Governance Access Reviews enables administrators to create recurring reviews of guest user access and automatically remove access for inactive users. By configuring an access review with a duration of 90 days and enabling automatic revocation, guest users who have not signed in for that period will have their access removed. Additionally, the annual manager review requirement is met by scheduling a recurring review for all guest accounts, ensuring compliance with governance policies.

Exam trap

The trap here is that candidates often confuse Conditional Access policies with identity governance features, mistakenly thinking that Conditional Access can enforce inactivity-based revocation, when in fact it only controls access at sign-in time and cannot perform periodic reviews or automatic removal of stale accounts.

How to eliminate wrong answers

Option B is wrong because Conditional Access policies enforce real-time access controls based on conditions like location or device state, but they cannot automatically revoke access based on inactivity duration or schedule periodic manager reviews. Option C is wrong because Privileged Identity Management (PIM) manages just-in-time activation and approval for privileged roles, not guest user access reviews or inactivity-based revocation. Option D is wrong because Self-Service Password Reset (SSPR) allows users to reset their own passwords and does not provide any mechanism for reviewing or revoking guest access based on inactivity.

Practice this question →

229

MCQmedium

A company uses Microsoft Entra ID. They want to require multi-factor authentication (MFA) for users who sign in from locations with a high risk score, as determined by Microsoft's analysis of the sign-in's IP address and other behavioral signals. Which Microsoft Entra ID feature should they configure?

A.Identity Protection

B.Conditional Access

C.Privileged Identity Management

D.Entitlement Management

AnswerA

Microsoft Entra ID Protection is the dedicated service for detecting identity-based risks, including both sign-in risk and user risk, using adaptive machine learning and heuristics. It continuously monitors sign-in attempts and user behavior for anomalies like impossible travel, unfamiliar sign-in properties, or leaked credentials. Based on these detections, Identity Protection can automatically trigger responses such as requiring multi-factor authentication, enforcing a password change, or blocking access, thereby directly addressing the need for risk-based MFA.

Why this answer

Identity Protection is the correct feature because it provides risk-based detection and remediation, including the ability to automatically enforce MFA when a sign-in is flagged with a high risk score. It uses machine learning models to analyze signals such as anonymized IP addresses, atypical travel, and leaked credentials to assign a risk level. This directly matches the requirement to require MFA based on Microsoft's analysis of the sign-in's IP address and behavioral signals.

Exam trap

The trap here is that candidates often confuse Conditional Access as the feature that evaluates risk, when in fact Conditional Access is the policy engine that enforces controls, but Identity Protection is the service that generates the risk scores used as conditions.

Why the other options are wrong

Conditional Access is the policy engine that enforces MFA, but it relies on a risk assessment from Identity Protection. The question asks for the feature that determines the risk score, which is Identity Protection, not Conditional Access.

Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles in Azure AD, not risk-based MFA policies. The question asks for a feature that enforces MFA based on sign-in risk scores, which is handled by Identity Protection, not PIM.

Entitlement Management is used for managing access packages and identity governance, not for enforcing MFA based on risk signals from sign-in behavior.

Practice this question →

230

Multi-Selectmedium

Which TWO conditions can be used in a Microsoft Entra Conditional Access policy? (Choose two.)

Select 2 answers

A.MFA registration status

B.Password complexity

C.Device platform

D.User risk level

E.Login frequency

AnswersC, D

Device platform is a fundamental condition in Microsoft Entra Conditional Access, enabling administrators to specify which operating systems a policy applies to. This condition allows for highly granular control, such as requiring compliant devices only for specific platforms like iOS and Android, while potentially blocking access from less secure or unsupported platforms like Linux or macOS unless they meet additional criteria. It directly evaluates the OS of the device initiating the access request.

Why this answer

Device platform is a standard condition in Microsoft Entra Conditional Access policies, allowing administrators to target policies based on the operating system (e.g., Windows, iOS, Android). Option D is correct because User risk level is a condition derived from Microsoft Entra ID Protection, reflecting the probability that a user's identity has been compromised, and can be used to trigger step-up authentication or block access.

Exam trap

The trap here is that candidates confuse conditions (e.g., device platform, user risk) with grant controls (e.g., require MFA, sign-in frequency) or configuration settings (e.g., password complexity), leading them to select options that are not valid conditions in the Conditional Access policy editor.

Practice this question →

231

MCQmedium

A company's security team discovers that several recent account compromises originated from attackers using legacy mail protocols (POP3, IMAP) which do not support multi-factor authentication. The team wants to immediately prevent any sign-in attempts using these protocols. Which Microsoft Entra ID feature should they configure to enforce this restriction?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management (PIM)

D.Microsoft Entra Password Protection

AnswerA

Conditional Access policies provide the precise control needed to block legacy authentication by evaluating various conditions, including the client application used for access. Administrators can configure a policy to specifically target and block client apps that utilize legacy authentication protocols, such as Exchange ActiveSync or 'Other clients' (which often encompasses protocols like POP3, IMAP, and SMTP AUTH). This ensures that only modern authentication methods, which support features like multi-factor authentication, are permitted for accessing corporate resources.

Why this answer

Conditional Access in Microsoft Entra ID allows administrators to create policies that control access based on conditions such as client apps. By configuring a policy to block authentication requests from legacy authentication protocols (POP3, IMAP, SMTP, etc.), the security team can immediately prevent sign-in attempts that do not support multi-factor authentication, effectively mitigating the risk of account compromise via these outdated protocols.

Exam trap

The trap here is that candidates often confuse Identity Protection's risk-based policies with the ability to block legacy protocols, but Identity Protection only triggers MFA or block based on risk scores, not on the protocol type itself.

Why the other options are wrong

Identity Protection detects and remediates risks but does not block legacy authentication protocols directly; it requires Conditional Access policies to enforce such blocks.

Privileged Identity Management (PIM) manages just-in-time privileged access and role activation, not authentication protocol restrictions. It cannot block legacy mail protocols like POP3/IMAP.

Practice this question →

232

Matchingmedium

Match each Microsoft Defender product to its focus area.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Protect on-premises Active Directory

Secure email and collaboration tools

Protect cloud workloads and resources

Secure Internet of Things devices

SaaS application security

Why these pairings

Microsoft Defender for Cloud secures cloud workloads; Defender for Endpoint secures endpoints; Defender for Identity secures identities; Defender for Office 365 secures email and collaboration; Defender for Cloud Apps secures shadow IT and app permissions.

Practice this question →

233

MCQmedium

An organization wants to allow users to reset their own passwords without help desk intervention. They also need to enforce multifactor authentication during the reset process. Which Microsoft Entra feature should they configure?

A.Microsoft Entra Self-Service Password Reset

B.Microsoft Entra Identity Protection

C.Microsoft Entra Privileged Identity Management

D.Microsoft Entra Multifactor Authentication

AnswerA

Microsoft Entra Self-Service Password Reset (SSPR) is the correct solution because it directly addresses the need for users to reset their own passwords without requiring administrator intervention. This feature allows users to verify their identity using pre-registered authentication methods, such as mobile app notifications, phone calls, or email verification, to securely regain access to their accounts. SSPR significantly reduces helpdesk call volumes related to password resets and improves user productivity by providing immediate self-service access restoration.

Why this answer

Microsoft Entra Self-Service Password Reset (SSPR) allows users to reset their own passwords without help desk intervention. By integrating with Microsoft Entra Multifactor Authentication, SSPR can enforce MFA during the reset process, satisfying both requirements.

Exam trap

The trap here is that candidates often confuse Microsoft Entra Multifactor Authentication as a standalone solution for password reset, when in fact it is only a component that must be integrated with SSPR to achieve both self-service reset and MFA enforcement.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra Identity Protection is a risk-based detection and remediation tool that can trigger automated responses like requiring MFA or blocking sign-ins, but it does not directly provide self-service password reset capabilities. Option C is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time privileged access and role activation, not general user password reset workflows. Option D is wrong because Microsoft Entra Multifactor Authentication is an authentication method that can be used as part of SSPR, but by itself it does not provide the self-service password reset functionality; it must be combined with SSPR to meet both requirements.

Practice this question →

234

MCQmedium

A company uses Microsoft Entra ID. The IT team wants to provide remote employees with secure, single sign-on (SSO) access to a critical on-premises web application that uses password-based authentication, without requiring a VPN connection. Which Microsoft Entra ID feature should they use?

A.Microsoft Entra Application Proxy

B.Microsoft Entra Connect

C.Microsoft Entra Domain Services

D.Microsoft Entra ID P2 license

AnswerA

Microsoft Entra Application Proxy enables secure remote access to on-premises web applications from any device, without requiring a VPN or opening inbound firewall ports. It works by deploying a lightweight connector within the private network that establishes an outbound connection to the Microsoft Entra service. This allows users to access internal applications using their Microsoft Entra ID credentials, benefiting from single sign-on and Microsoft Entra's robust security features like Conditional Access.

Why this answer

Microsoft Entra Application Proxy enables secure remote access to on-premises web applications by publishing them through an external endpoint, without requiring a VPN. It supports password-based SSO by securely storing and replaying credentials to the legacy application, allowing users to authenticate once via Entra ID. This makes it the correct choice for providing SSO to a password-based on-premises app without a VPN.

Exam trap

The trap here is that candidates often confuse Microsoft Entra Connect (a sync tool) with Application Proxy, mistakenly thinking that syncing identities alone provides remote access and SSO to on-premises apps.

Why the other options are wrong

Microsoft Entra Connect is used for synchronizing on-premises directories with Entra ID, not for proxying access to on-premises web applications. It does not provide SSO or eliminate the need for a VPN.

Microsoft Entra Domain Services provides managed domain services like domain join and LDAP, not secure remote access to on-premises web apps without VPN. The question requires a reverse proxy solution for password-based SSO, which is Application Proxy's role.

The question asks for a specific feature to provide SSO access to an on-premises web app without VPN. A Microsoft Entra ID P2 license is a licensing tier, not a feature; it does not directly enable SSO or remote access to on-premises apps.

Practice this question →

235

MCQmedium

A company wants to offer a secure sign-in experience for external customers who may use personal accounts from Facebook, Google, or any OpenID Connect provider. They also need to customize the sign-in pages with their company logo and colors. Which Microsoft Entra capability should they use?

A.Microsoft Entra ID (formerly Microsoft Entra ID) — free edition

B.Microsoft Entra External ID (formerly Microsoft Entra ID B2C)

C.Microsoft Entra Domain Services

D.Microsoft Entra Permissions Management

AnswerB

Microsoft Entra External ID is purpose-built as a robust Customer Identity and Access Management (CIAM) solution, specifically engineered to manage identities for millions of external customers accessing applications and services. It natively supports a wide array of identity providers, including popular social accounts (e.g., Google, Facebook), enterprise accounts, and local accounts. Furthermore, it offers extensive customization capabilities for sign-up, sign-in, and profile management pages, ensuring a fully branded and user-friendly experience tailored for external customers.

Why this answer

Microsoft Entra External ID (formerly Azure AD B2C) is the correct choice because it is specifically designed for customer-facing identity scenarios, supporting social identity providers (Facebook, Google) and any OpenID Connect provider. It also provides full customization of sign-in pages, including company branding like logos and colors, which is not available in the free edition of Microsoft Entra ID.

Exam trap

The trap here is that candidates often confuse Microsoft Entra External ID with the free edition of Microsoft Entra ID, assuming that 'free' includes external identity support, but the free edition is strictly for internal users and lacks social identity federation and UI customization capabilities.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID (free edition) is intended for internal organizational users and does not support external customer identities with social or OpenID Connect providers, nor does it allow customization of sign-in pages for external users. Option C is wrong because Microsoft Entra Domain Services provides managed domain services (e.g., Kerberos, NTLM) for legacy applications, not identity federation or customer sign-in customization. Option D is wrong because Microsoft Entra Permissions Management is a cloud infrastructure entitlement management (CIEM) tool for managing permissions across multi-cloud environments, unrelated to customer authentication or branding.

Practice this question →

236

MCQeasy

Your organization wants to use Microsoft Entra Verified ID to issue digital credentials to employees. Which Microsoft Entra service provides the ability to issue and verify verifiable credentials?

A.Microsoft Entra Entitlement Management

B.Microsoft Entra Verified ID

C.Microsoft Entra Identity Protection

D.Microsoft Entra Privileged Identity Management

AnswerB

Microsoft Entra Verified ID is the dedicated service for implementing decentralized identity and managing verifiable credentials (VCs). It enables organizations to issue digital attestations, such as proof of employment or qualifications, to individuals, who then hold these VCs in a digital wallet. This service facilitates a trust framework where issuers can attest to facts about a user, and verifiers can cryptographically confirm the authenticity of these credentials without relying on a central authority, directly addressing the need for verifiable identity proofs.

Why this answer

Microsoft Entra Verified ID is the specific service designed to issue and verify verifiable credentials based on decentralized identity standards such as W3C Verifiable Credentials and Decentralized Identifiers (DIDs). It enables organizations to create, issue, and cryptographically verify digital credentials without relying on a central authority, aligning with the scenario described.

Exam trap

The trap here is that candidates may confuse 'Verified ID' with other identity governance or security services like Entitlement Management or Identity Protection, but only Verified ID directly handles the issuance and verification of verifiable credentials using decentralized identity standards.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Entitlement Management focuses on automating access reviews, access packages, and lifecycle management for applications and groups, not on issuing or verifying verifiable credentials. Option C is wrong because Microsoft Entra Identity Protection is a security tool that detects identity-based risks like compromised accounts and sign-in anomalies, not a credential issuance or verification service. Option D is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time privileged role assignments and access approvals, not the creation or verification of digital credentials.

Practice this question →

237

MCQhard

Your organization, Contoso, uses Microsoft Entra ID P2. You have a Microsoft Entra tenant with several privileged roles including Global Administrator, Exchange Administrator, and SharePoint Administrator. The security team wants to enforce just-in-time (JIT) access for these roles, requiring users to request activation and get approval before they can use the role. Additionally, all activations must be logged and reviewed monthly. What should you configure?

A.Configure Microsoft Entra Privileged Identity Management (PIM) to require approval for role activation and enable access reviews.

B.Configure Conditional Access policies to require MFA for privileged roles.

C.Use Microsoft Entra Entitlement Management to create access packages for roles.

D.Create an Identity Protection risk policy to block risky sign-ins for privileged users.

AnswerA

Microsoft Entra Privileged Identity Management (PIM) is the dedicated service for managing, controlling, and monitoring access to important resources. It enables just-in-time (JIT) access, meaning users are assigned privileged roles only when needed and for a limited duration. Requiring approval for role activation ensures an additional layer of control, while access reviews provide periodic verification that users still require their assigned privileges, enforcing the principle of least privilege.

Why this answer

Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by requiring users to activate their role assignments with approval from designated approvers. It also includes access reviews that can be scheduled to audit and confirm active role assignments, meeting the logging and monthly review requirements. This directly addresses the need for activation approval and periodic review of privileged role usage.

Exam trap

The trap here is confusing Conditional Access policies (which control sign-in conditions) with PIM (which controls role activation and approval workflows), leading candidates to select MFA enforcement instead of the JIT and review capabilities unique to PIM.

How to eliminate wrong answers

Option B is wrong because Conditional Access policies enforce authentication requirements (like MFA) during sign-in but do not provide JIT activation workflows, approval processes, or scheduled access reviews for privileged roles. Option C is wrong because Entitlement Management manages access packages for resource access (e.g., groups, apps, sites) but does not handle role activation approval or time-bound JIT elevation for Entra ID administrative roles. Option D is wrong because Identity Protection risk policies block or require MFA for risky sign-ins, but they do not control role activation, require approval, or log/review privileged role usage.

Practice this question →

238

MCQhard

Refer to the exhibit. A Microsoft Graph PowerShell script is shown. What is the purpose of this script?

A.Register a phone authentication method for users.

B.Configure self-service password reset settings.

C.Reset passwords for all users named John.

D.Enable multifactor authentication for the users.

AnswerA

The PowerShell script utilizes the `New-MgUserAuthenticationPhoneMethod` cmdlet, which is specifically designed to add a new phone authentication method to a specified user's authentication methods in Microsoft Entra ID. This action registers a phone number, making it available for use in scenarios such as SMS-based multifactor authentication or passwordless sign-in, but does not inherently enable MFA itself. It's a foundational step for phone-based authentication.

Why this answer

The script uses the `New-MgUserAuthenticationPhoneMethod` cmdlet to register a phone number as an authentication method for a user in Microsoft Entra ID. This cmdlet specifically creates a phone authentication method, which can be used for multifactor authentication or self-service password reset, but its direct purpose is to register the phone method itself.

Exam trap

The trap here is that candidates confuse registering a phone authentication method with enabling MFA or configuring SSPR, because the phone method is a common component of both, but the cmdlet's specific purpose is only to register the method, not to enable the broader feature.

How to eliminate wrong answers

Option B is wrong because configuring self-service password reset (SSPR) settings requires cmdlets like `Update-MgPolicyAuthenticationMethodPolicy` or `Set-MgUserAuthenticationMethodPolicy`, not `New-MgUserAuthenticationPhoneMethod`. Option C is wrong because the script does not perform any password reset operation; it only registers a phone method, and it targets a single user by UserPrincipalName, not all users named John. Option D is wrong because enabling multifactor authentication (MFA) for users is done via Conditional Access policies or per-user MFA settings, not by registering a phone method; the cmdlet only adds a phone as an authentication method, which is a prerequisite but not the act of enabling MFA.

Practice this question →

239

MCQeasy

Your organization uses Microsoft Entra ID and wants to enforce multi-factor authentication (MFA) for all users. Which policy should you create?

A.Conditional Access policy

B.Identity Protection policy

C.Security defaults

D.Privileged Identity Management

AnswerA

Conditional Access policies are the primary method in Microsoft Entra ID for enforcing granular access controls, including multi-factor authentication (MFA). They evaluate conditions such as user, device, location, and application to determine if access should be granted, blocked, or require additional authentication methods like MFA, making them highly flexible for enforcing specific security requirements across an organization.

Why this answer

Conditional Access policies are the correct mechanism to enforce MFA for all users because they allow granular, policy-driven access controls based on signals like user, location, device, and application. By creating a Conditional Access policy that requires MFA for all cloud apps, you can target all users and enforce MFA at authentication time, providing a flexible and scalable solution.

Exam trap

The trap here is that candidates confuse Security defaults (a simple, pre-configured baseline) with a customizable policy, but Security defaults is not a policy you 'create'—it is an all-or-nothing toggle that cannot be scoped or modified, whereas Conditional Access policies are the correct, granular tool for enforcing MFA.

How to eliminate wrong answers

Option B is wrong because Identity Protection policies are designed to detect and respond to risks (e.g., leaked credentials, sign-ins from anonymous IPs) and can automatically trigger MFA based on risk level, but they cannot enforce MFA for all users unconditionally. Option C is wrong because Security defaults is a baseline set of security configurations that includes enforcing MFA for all users, but it is a tenant-wide setting that cannot be customized or scoped; it is not a policy you 'create' but rather enable or disable. Option D is wrong because Privileged Identity Management (PIM) provides just-in-time privileged access and approval workflows for roles, not MFA enforcement for all users; it manages role activation, not authentication requirements.

Practice this question →

240

MCQmedium

A company has discovered that many account compromise attacks are using legacy authentication protocols (e.g., IMAP, POP3, SMTP) which do not support multi-factor authentication. They want to block all sign-ins that use these protocols to reduce risk. Which Microsoft Entra ID feature should they use to enforce this block?

A.Conditional Access

B.Identity Protection

C.Azure AD Application Proxy

D.Privileged Identity Management (PIM)

AnswerA

Conditional Access policies are the primary mechanism in Azure AD for enforcing specific access controls based on various conditions, including user attributes, device state, location, and client applications. To effectively block legacy authentication, a Conditional Access policy can be configured to target 'Other clients' or 'Exchange ActiveSync clients' and then apply a 'Block access' grant control. This prevents older protocols such as POP, IMAP, and SMTP from authenticating, thereby mitigating associated security risks by forcing the use of modern authentication.

Why this answer

Conditional Access policies in Microsoft Entra ID can be configured to block access from legacy authentication protocols (such as IMAP, POP3, and SMTP) by targeting the 'Client apps' condition. Since these protocols do not support modern authentication methods like MFA, blocking them directly reduces the attack surface for account compromise. This is the correct feature to enforce the block.

Exam trap

The trap here is that candidates may confuse Identity Protection's risk-based policies with Conditional Access's protocol-level controls, assuming that blocking legacy authentication is a risk-detection feature rather than a conditional access rule.

Why the other options are wrong

Identity Protection detects and remediates risks like leaked credentials or anomalous sign-ins, but it does not block legacy authentication protocols. Blocking specific protocols is done via Conditional Access policies.

Azure AD Application Proxy is used to provide secure remote access to on-premises web applications, not to block legacy authentication protocols. It does not enforce authentication policies or block specific sign-in methods.

Practice this question →

241

MCQhard

The exhibit shows a Conditional Access policy named 'Block Legacy Auth'. The admin notices that the policy is not blocking legacy authentication as intended. Based on the output, what is the most likely reason?

A.The policy name is incorrect.

B.The policy does not have any client app types configured to block.

C.The policy is assigned to no users.

D.The policy is disabled.

AnswerB

For a Conditional Access policy to effectively target and block specific client application types, such as "Exchange ActiveSync clients" or "Other clients" (which often represent legacy authentication protocols), the `ClientAppTypes` condition must be explicitly configured. If this condition is empty or not selected, the policy will not apply to any particular client application type, thus failing to block legacy authentication attempts originating from those specific clients.

Why this answer

The policy is not blocking legacy authentication because it lacks configured client app types. Conditional Access policies require explicit selection of client apps (e.g., Exchange ActiveSync, other clients) to target legacy authentication protocols like POP3, IMAP, and SMTP. Without this configuration, the policy has no conditions to enforce, so it cannot block any authentication attempts.

Exam trap

The trap here is that candidates assume a Conditional Access policy with 'Block access' grant will automatically block all authentication, but they overlook the critical requirement to explicitly configure client app types to cover legacy protocols.

How to eliminate wrong answers

Option A is wrong because the policy name is irrelevant to its functionality; Conditional Access policies enforce based on conditions and controls, not names. Option C is wrong because the policy is assigned to 'All users' as shown in the exhibit, so user assignment is not the issue. Option D is wrong because the policy is enabled (status 'On' in the exhibit), so a disabled state is not the reason for failure.

Practice this question →

242

Multi-Selectmedium

Which THREE components are part of Microsoft Entra Permissions Management (CIEM)?

Select 3 answers

A.Activity trail

B.Audit trail

C.Identity Protection

D.Access reviews

E.Permissions Analytics Report

AnswersA, B, E

Within Microsoft Entra Permissions Management, the Activity trail component meticulously records all user and resource actions performed across connected cloud environments, including AWS, Azure, and GCP. This comprehensive log details who accessed what resource, when, and how, providing critical visibility into the actual usage of granted permissions. It is essential for detecting anomalous behavior, identifying potential misuse of entitlements, and understanding the real-world impact of permission policies.

Why this answer

Activity trail (A) is correct because Microsoft Entra Permissions Management (CIEM) captures a detailed log of all user actions and resource access events across multi-cloud environments (AWS, Azure, GCP). This trail is essential for forensic analysis and identifying anomalous behavior, directly supporting the CIEM goal of providing visibility into permissions usage.

Exam trap

The trap here is that candidates confuse the CIEM components (Activity trail, Audit trail, Permissions Analytics Report) with broader Microsoft Entra features like Identity Protection or Access reviews, which serve different governance and security functions.

Practice this question →

243

MCQeasy

Your organization uses Microsoft Entra ID to manage user identities. A new employee named John joins the company and needs access to Microsoft 365 apps. You want to ensure John's identity is verified using a phone call. Which authentication method should you configure?

A.Time-based one-time password (TOTP)

B.Email one-time passcode

C.Text message (SMS)

D.Phone call (voice call)

E.FIDO2 security key

AnswerD

Phone call (voice call) is a supported multi-factor authentication method where Microsoft Entra ID initiates an automated voice call to a user's registered phone number. To complete authentication, the user must answer the incoming call and typically press a specific key, such as the # key, on their phone's keypad to confirm their identity. This directly fulfills the requirement of a phone call for user verification.

Why this answer

The question explicitly requires verification using a phone call. The Phone call (voice call) authentication method in Microsoft Entra ID delivers an automated voice call to the user's registered phone number, prompting them to press a key to confirm their identity. This directly matches the requirement, making D the correct choice.

Exam trap

The trap here is that candidates may confuse 'phone call' with 'text message (SMS)' because both involve a phone, but the question explicitly specifies 'phone call (voice call)', not a text-based code delivery.

How to eliminate wrong answers

Option A is wrong because Time-based one-time password (TOTP) uses a software or hardware token to generate a code, not a phone call. Option B is wrong because Email one-time passcode sends a code via email, which is not a phone-based voice call. Option C is wrong because Text message (SMS) delivers a code via text, not a voice call.

Option E is wrong because FIDO2 security key is a hardware-based passwordless authentication method that uses public-key cryptography, not a phone call.

Practice this question →

244

MCQmedium

Your organization uses Microsoft Entra ID P2 and wants to reduce the risk of identity compromise by requiring multifactor authentication (MFA) for all users, but excluding users when they are on the corporate network. Which policy type should you configure?

A.Conditional Access policy

B.Self-service password reset (SSPR) policy

C.Identity Protection risk policy

D.Privileged Identity Management (PIM) activation policy

AnswerA

Microsoft Entra Conditional Access policies are the primary mechanism for enforcing access controls based on specific conditions, such as user location, device state, or application being accessed. By defining a policy that targets all users and requires MFA, an administrator can then create an exception for trusted IP ranges, effectively bypassing MFA when users are on the corporate network. This granular control over access based on real-time signals is central to Microsoft Entra ID P2 security capabilities.

Why this answer

Conditional Access policies allow you to enforce MFA based on network location, user, and device conditions. Option A is correct because the policy can target all users and exclude trusted IPs (e.g., the corporate network). Option B is wrong because self-service password reset (SSPR) does not enforce MFA.

Option C is wrong because Identity Protection detects risk but does not directly enforce MFA by location. Option D is wrong because Privileged Identity Management (PIM) manages just-in-time access for privileged roles, not general MFA.

Practice this question →

245

MCQmedium

A company has several on-premises web-based applications that need to be securely accessed by remote employees without requiring a VPN. The IT team wants to provide single sign-on (SSO) using Microsoft Entra ID. Which Microsoft Entra ID feature should they implement?

A.Microsoft Entra Application Proxy

B.Microsoft Entra Self-Service Password Reset (SSPR)

C.Microsoft Entra Privileged Identity Management (PIM)

D.Microsoft Entra Identity Protection

AnswerA

Microsoft Entra Application Proxy is the correct solution for securely publishing on-premises web applications to external users. It achieves this by deploying a lightweight connector within the on-premises network, which establishes an outbound connection to Azure, creating a secure tunnel. This allows users to access internal web apps remotely with single sign-on capabilities, leveraging Entra ID's conditional access policies without requiring a VPN or opening inbound firewall ports.

Why this answer

Microsoft Entra Application Proxy enables secure remote access to on-premises web applications without a VPN by acting as a reverse proxy. It integrates with Microsoft Entra ID to provide single sign-on (SSO) for users, leveraging pre-authentication and conditional access policies. This directly meets the requirement for VPN-less, SSO-enabled access.

Exam trap

The trap here is that candidates often confuse Application Proxy with a VPN solution or think SSPR or PIM can provide remote access, but only Application Proxy specifically proxies on-premises web apps with SSO integration.

Why the other options are wrong

SSPR allows users to reset their own passwords without admin intervention, but it does not provide secure remote access to on-premises web applications or enable SSO. The question specifically requires a solution for accessing on-premises apps without a VPN, which SSPR does not address.

Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles in Microsoft Entra ID, not remote access to on-premises web apps without a VPN.

Microsoft Entra Identity Protection is a tool for detecting and responding to identity-based risks, such as compromised credentials or suspicious sign-ins, not for providing secure remote access to on-premises applications without a VPN.

Practice this question →

246

MCQmedium

A company uses Microsoft Entra ID (Azure AD). The IT team has created a security group named 'SalesTeam' that contains all sales department users. They want to ensure that only members of this group can access the company's CRM application, which is registered as an enterprise application in Entra ID. What should the IT team configure?

A.A Conditional Access policy that requires group membership

B.Self-service group management settings

C.Enterprise application user and group assignment

D.Application registration settings

AnswerC

This is the fundamental and most direct method to control which users or groups are authorized to access a specific enterprise application in Microsoft Entra ID. By assigning a group like 'SalesTeam' to the CRM application, you explicitly provision access for all members of that group, ensuring only authorized individuals can sign in and utilize the application. This method establishes the baseline access permissions for the application.

Why this answer

Enterprise applications in Microsoft Entra ID can be configured to require user or group assignment, which restricts access to only assigned users or groups. By assigning the 'SalesTeam' security group to the CRM enterprise application, the IT team ensures that only members of that group can authenticate and access the application. This is the standard method for controlling access to gallery or custom enterprise applications in Entra ID.

Exam trap

The trap here is confusing Conditional Access (which controls conditions and grants during authentication) with user/group assignment (which controls the fundamental ability to authenticate to the application), leading candidates to select A when C is the direct and correct configuration for restricting access.

Why the other options are wrong

Conditional Access policies control access based on conditions like location or device state, not direct user-to-app assignment. The requirement is to restrict access to only SalesTeam members, which is achieved by assigning the group to the enterprise application, not by a Conditional Access policy.

Self-service group management settings allow users to create and manage their own groups, but do not control access to an enterprise application. Access to the CRM app requires explicit user/group assignment, not group management features.

Application registration settings define how an app authenticates (e.g., redirect URIs, certificates), not which users can access it. User assignment for access is configured in the enterprise application's 'Users and groups' blade.

Practice this question →

247

MCQmedium

A company is using Microsoft Entra ID to manage identities for a multi-tenant SaaS application. They want to allow users from partner organizations to access the application using their own corporate credentials, without needing to manage separate accounts. Which solution should they implement?

A.Microsoft Entra B2C

B.Microsoft Entra federation with the partner's identity provider

C.Microsoft Entra B2B collaboration

D.Microsoft Entra provisioning service

AnswerC

Microsoft Entra B2B (Business-to-Business) collaboration is the appropriate solution for enabling partner users to access applications and resources within your organization using their existing corporate or social identities. This feature creates guest user objects in your directory, allowing external users to authenticate with their home identity provider while granting them controlled access to your Microsoft Entra ID-protected resources without requiring complex federation setup.

Why this answer

Microsoft Entra B2B collaboration is the correct solution because it enables partner users to access the company's multi-tenant SaaS application using their own corporate credentials, without requiring separate accounts. B2B collaboration supports cross-tenant access by creating lightweight guest user objects in the resource tenant, which can authenticate via their home tenant's identity provider. This aligns with the requirement to allow partner organizations to use their existing credentials while avoiding account management overhead.

Exam trap

The trap here is that candidates often confuse Microsoft Entra B2B collaboration with Microsoft Entra B2C, mistakenly thinking both handle external users, but B2C is for customer identities (social/local accounts) while B2B is for partner identities (corporate credentials).

How to eliminate wrong answers

Option A is wrong because Microsoft Entra B2C is designed for customer-facing identity management, allowing external users (e.g., consumers) to sign up and sign in with social or local accounts, not for partner organizations using their own corporate credentials. Option B is wrong because federation with a partner's identity provider typically establishes a trust between two organizations' identity systems, but it requires complex configuration and often involves setting up a federation trust (e.g., using SAML or WS-Federation) for the entire domain, which is overkill for simple guest access and does not natively support the lightweight, invitation-based model of B2B collaboration. Option D is wrong because the Microsoft Entra provisioning service automates the creation, update, and deletion of user accounts in SaaS applications (e.g., via SCIM), but it does not enable external users to authenticate with their own credentials; it manages identity lifecycle, not cross-tenant authentication.

Practice this question →

248

MCQmedium

A company has many guest users in Microsoft Entra ID who collaborate on a project in a specific SharePoint site. The compliance team needs to periodically verify that these guest users still require access to the site. If a reviewer does not respond within 30 days, the guest's access should be automatically removed. Additionally, the company wants to ensure that once access is removed, the guest user object is eventually deleted from the directory after 90 days. Which Microsoft Entra Identity Governance features should they use together?

A.Access Reviews configured to auto-apply results and delete guest users after a specified number of days

B.Entitlement Management access packages with an expiration policy

C.Lifecycle Workflows to schedule a periodic task

D.Privileged Identity Management (PIM) for guest roles

AnswerA

Access Reviews are specifically designed for periodically reviewing user access to resources, including guest users. By configuring an Access Review to auto-apply results, access can be automatically revoked if reviewers do not respond or deny access. Crucially, the 'Delete users' setting within the review can be enabled to automatically remove guest user objects from Microsoft Entra ID after a specified number of days if their access is denied or not re-certified, directly addressing the need for automated guest cleanup.

Why this answer

Access Reviews in Microsoft Entra ID can be configured to automatically apply results, removing guest access when a reviewer does not respond within a specified period (e.g., 30 days). Additionally, the 'Delete guest users not reviewed within' setting allows automatic deletion of the guest user object from the directory after a configurable number of days (e.g., 90 days). This directly meets both requirements: periodic verification of access and eventual cleanup of the directory object.

Exam trap

The trap here is that candidates confuse 'removing access' (which many features can do) with 'deleting the user object from the directory' (which only Access Reviews with the specific deletion setting can do), leading them to choose Entitlement Management or Lifecycle Workflows.

How to eliminate wrong answers

Option B is wrong because Entitlement Management access packages with an expiration policy can remove a user's assignment to a resource (like the SharePoint site) but do not automatically delete the guest user object from the directory after a specified number of days; they only expire the package assignment. Option C is wrong because Lifecycle Workflows are designed for automating joiner, mover, and leaver processes for employees, not for periodic guest access reviews or automatic deletion of guest objects. Option D is wrong because Privileged Identity Management (PIM) manages just-in-time activation and approval for privileged roles, not periodic access reviews or automatic removal of guest user objects from the directory.

Practice this question →

249

MCQhard

A company is implementing a Microsoft Entra ID tenant for a new subsidiary. They require that all users authenticate using passwordless methods, specifically the Microsoft Authenticator app. What is the minimum configuration required to enforce this?

A.Enable Microsoft Entra ID Protection and configure MFA registration policy

B.Turn on Security defaults

C.Configure Microsoft Entra Hybrid Join for all devices

D.Create a Conditional Access policy targeting all users that requires 'Require authentication strength' and select the 'Passwordless MFA' authentication strength

AnswerD

This is the correct approach because Microsoft Entra Conditional Access policies, combined with authentication strengths, are designed to enforce specific authentication methods. By configuring a policy to 'Require authentication strength' and selecting 'Passwordless MFA', administrators can explicitly mandate that users authenticate using only passwordless methods, such as FIDO2 security keys or Windows Hello for Business. This effectively blocks any sign-in attempt that relies on a password as the primary credential, thereby achieving a truly passwordless environment.

Why this answer

A Conditional Access policy with the 'Require authentication strength' setting allows you to select the 'Passwordless MFA' authentication strength, which enforces passwordless methods like the Microsoft Authenticator app. This is the minimum configuration that directly targets all users and mandates passwordless authentication, as opposed to broader or less specific settings.

Exam trap

The trap here is that candidates often confuse 'MFA registration' or 'Security defaults' with enforcing a specific authentication method, but neither restricts the method to passwordless only, which is the key requirement in the question.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Protection and MFA registration policy only enforce that users register for MFA, not that they use passwordless methods specifically. Option B is wrong because Security defaults enforce MFA using any method (including passwords), not exclusively passwordless authentication. Option C is wrong because Microsoft Entra Hybrid Join is a device state requirement for scenarios like Windows Hello for Business, but it does not enforce passwordless authentication via the Authenticator app and is not the minimum configuration for this requirement.

Practice this question →

250

MCQmedium

A company runs a consumer-facing e-commerce website and wants to allow customers to sign in using their existing social media accounts such as Google, Facebook, or LinkedIn. Which Microsoft Entra ID solution should they implement?

A.Microsoft Entra External ID (B2C)

B.Microsoft Entra External ID (B2B)

C.Microsoft Entra Identity Protection

D.Microsoft Entra Conditional Access

AnswerA

Microsoft Entra External ID (B2C) is specifically engineered to manage customer identities for consumer-facing applications and services, such as an e-commerce website. It enables users to sign up and sign in using their preferred social identity providers, such as Google, Facebook, or Apple, or by creating a local account. This service provides highly customizable user experiences for registration, sign-in, and profile management, scaling to millions of users while integrating seamlessly with your platform.

Why this answer

Microsoft Entra External ID (B2C) is the correct solution because it is specifically designed for consumer-facing applications, allowing customers to sign in using social identity providers (IdPs) like Google, Facebook, and LinkedIn via OAuth 2.0 and OpenID Connect protocols. It provides a customizable authentication experience for external users, distinct from B2B which targets organizational collaboration.

Exam trap

The trap here is that candidates confuse B2B with B2C, assuming 'External ID' covers all external users, but B2B strictly targets organizational partners (e.g., using their work accounts) while B2C is for consumer social logins.

Why the other options are wrong

B2B is designed for business-to-business collaboration, allowing external partners to access internal resources, not for consumer-facing identity management with social identity providers.

Microsoft Entra Identity Protection is a security tool for detecting and responding to identity risks, not for enabling social identity federation for consumer sign-in.

Microsoft Entra Conditional Access is a policy engine for enforcing access controls based on signals like user location or device state, not a solution for enabling social identity federation for external customers.

Practice this question →

251

MCQhard

Your organization uses Microsoft Entra ID. You need to ensure that when a user is terminated, all access to SaaS applications is automatically revoked. What should you configure?

A.Configure a conditional access policy to block access for disabled users.

B.Use Privileged Identity Management to remove role assignments.

C.Schedule an access review for quarterly review of access.

D.Configure Microsoft Entra lifecycle workflows to disable the user and remove group memberships upon termination.

AnswerD

Microsoft Entra lifecycle workflows are specifically designed to automate user lifecycle events, including offboarding. These workflows can be configured to automatically disable a user account, remove them from specified groups, and revoke application access immediately upon a termination event, often triggered by changes synced from an HR system. This ensures timely, consistent, and comprehensive removal of access, directly addressing the requirement for efficient and secure offboarding.

Why this answer

Microsoft Entra lifecycle workflows automate the user offboarding process by disabling the user account and removing group memberships upon termination. This ensures that the user loses access to all SaaS applications that rely on Entra ID for authentication, as group membership removal revokes access tokens and disables sign-in.

Exam trap

The trap here is that candidates often confuse conditional access policies (which control sign-in conditions) with automated lifecycle actions, mistakenly thinking a policy can proactively revoke access upon termination without the underlying user state change.

How to eliminate wrong answers

Option A is wrong because a conditional access policy that blocks access for disabled users is reactive and does not automatically trigger upon termination; it only enforces a block if the user is already disabled, but does not handle the removal of group memberships or provisioning. Option B is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role assignments and does not revoke access to SaaS applications for non-privileged users or remove group memberships. Option C is wrong because scheduling an access review for quarterly review only provides periodic auditing and does not automatically revoke access upon termination; it is a manual or scheduled review process, not an immediate revocation mechanism.

Practice this question →

252

MCQeasy

Your company wants to provide a single sign-on experience for all cloud applications. Which Microsoft Entra ID feature should you implement?

A.B2B collaboration

B.Identity Protection

C.App registration and SSO configuration

D.Conditional Access

AnswerC

App registration in Microsoft Entra ID is the essential process for integrating an application to use Entra ID as its identity provider. By registering an application, administrators define how users authenticate, grant necessary permissions, and configure single sign-on (SSO) protocols like OpenID Connect or SAML. This direct integration enables users to access the registered application seamlessly using their existing Entra ID credentials without re-entering them, thereby providing a unified SSO experience.

Why this answer

App registration and SSO configuration in Microsoft Entra ID enables single sign-on (SSO) by registering each cloud application as an enterprise application and configuring federation protocols such as SAML 2.0, OpenID Connect, or OAuth 2.0. This allows users to authenticate once with their Entra ID credentials and access all configured cloud applications without repeated logins.

Exam trap

The trap here is that candidates often confuse Conditional Access (a policy enforcement tool) with SSO configuration, or they mistakenly think B2B collaboration is needed for internal app SSO, when in fact App registration and SSO configuration is the correct feature for enabling a unified sign-on experience.

How to eliminate wrong answers

Option A is wrong because B2B collaboration is designed for inviting external users (guests) from other organizations, not for providing SSO across cloud applications for internal users. Option B is wrong because Identity Protection is a security feature that detects and remediates identity-based risks (e.g., leaked credentials, sign-ins from anonymous IPs), not a mechanism for SSO. Option D is wrong because Conditional Access is a policy engine that enforces access controls (e.g., MFA, device compliance) after authentication, but it does not configure or enable SSO itself.

Practice this question →

253

MCQmedium

A company has an on-premises web-based expense report application. The IT team wants to make this application accessible to remote employees over the internet without requiring a VPN. They need to use Microsoft Entra ID for authentication and apply Conditional Access policies such as requiring multi-factor authentication. Which Microsoft Entra ID feature should they implement?

A.Azure AD Application Proxy

B.Self-service password reset (SSPR)

C.Azure AD B2B collaboration

D.Azure AD Domain Services

AnswerA

Azure AD Application Proxy securely publishes on-premises web applications, making them accessible to remote users without requiring a VPN or inbound firewall rules. It leverages a lightweight connector installed within the corporate network, which establishes an outbound-only connection to the Azure AD Application Proxy service. This allows users to pre-authenticate with Entra ID, apply Conditional Access policies, and then access the internal application via a secure proxy URL, providing single sign-on capabilities.

Why this answer

Azure AD Application Proxy allows on-premises web applications to be published for remote access without a VPN. It integrates with Microsoft Entra ID for authentication and supports Conditional Access policies, including multi-factor authentication, by acting as a reverse proxy that forwards authenticated requests to the internal application.

Exam trap

The trap here is that candidates may confuse Azure AD Application Proxy with a VPN solution or think that Azure AD Domain Services is needed for authentication, but the key is that Application Proxy specifically publishes on-premises web apps with Entra ID authentication and Conditional Access support without requiring a VPN.

Why the other options are wrong

Azure AD B2B collaboration is designed for sharing apps and resources with external guest users from other organizations, not for publishing internal on-premises apps to remote employees.

Azure AD Domain Services provides managed domain services like domain join, group policy, and LDAP, but it does not publish on-premises web applications to the internet or integrate with Conditional Access policies for remote access without VPN.

Practice this question →

254

MCQmedium

A company uses Microsoft Entra ID and Intune for device management. They want to ensure that only devices marked as compliant (e.g., updated, encrypted) can access the corporate HR portal. Which Conditional Access assignment condition should the administrator configure?

A.Locations

B.Device state

C.Client apps

D.Sign-in risk

AnswerB

Device state condition can be set to require a device to be compliant (as defined in Intune) or hybrid Microsoft Entra ID joined. This is the correct condition to enforce access based on device compliance.

Why this answer

The 'Device state' condition in Conditional Access allows administrators to require that only devices marked as compliant (via Intune compliance policies) can access resources. By configuring this condition, the HR portal will block access from non-compliant devices, enforcing security requirements like encryption and updates before granting access.

Exam trap

The trap here is that candidates may confuse 'Device state' with 'Sign-in risk' or 'Client apps', thinking device compliance is tied to user risk or application type, but Microsoft specifically separates device health from user risk and app context in Conditional Access.

How to eliminate wrong answers

Option A is wrong because 'Locations' controls access based on IP address ranges or geographic regions, not device compliance status. Option C is wrong because 'Client apps' filters access by application type (e.g., browser, mobile app), not device health or compliance. Option D is wrong because 'Sign-in risk' is part of Identity Protection and evaluates user authentication risk (e.g., leaked credentials), not device compliance.

Practice this question →

255

Multi-Selecteasy

Which TWO of the following are capabilities of Microsoft Entra ID?

Select 2 answers

A.Email filtering and anti-malware protection.

B.Identity and access management for cloud applications.

C.Single sign-on to SaaS applications.

D.Encryption of data at rest in Azure Storage.

E.Network firewall management.

AnswersB, C

Microsoft Entra ID is a comprehensive identity and access management (IAM) solution designed to manage user identities and control their access to various cloud-based applications. It enables organizations to provision users, enforce authentication policies like multi-factor authentication, and authorize access based on roles and groups. This capability is central to securing access to a vast ecosystem of SaaS and custom-developed cloud applications.

Why this answer

Microsoft Entra ID (formerly Azure Active Directory) is a cloud-based identity and access management (IAM) service. It provides authentication and authorization for cloud applications, including support for single sign-on (SSO) to thousands of pre-integrated SaaS applications like Salesforce, Office 365, and Workday. These are core IAM capabilities, not security functions like email filtering or network firewall management.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID's identity management role with broader security services like email protection or network security, leading them to select options that belong to other Azure or Microsoft 365 security products.

Practice this question →

256

MCQeasy

A company uses Microsoft Entra ID and wants to enable employees to reset their own passwords without needing to contact the help desk. They want to enforce multifactor authentication when the employee performs the reset. Which Microsoft Entra feature should they enable?

A.Microsoft Entra Self-Service Password Reset (SSPR)

B.Microsoft Entra ID Federation

C.Microsoft Entra Identity Protection

D.Microsoft Entra Privileged Identity Management (PIM)

AnswerA

Microsoft Entra Self-Service Password Reset (SSPR) is a Microsoft Entra ID feature that empowers users to reset their forgotten or locked passwords without requiring administrator assistance. It significantly reduces helpdesk calls by allowing users to verify their identity through pre-registered authentication methods, such as a mobile app notification, text message, or email to an alternate address. This self-service capability enhances user productivity and can be configured to enforce multi-factor authentication during the reset process for heightened security.

Why this answer

Microsoft Entra Self-Service Password Reset (SSPR) is the correct feature because it allows users to reset their own passwords without help desk intervention, and it can be configured to require multifactor authentication (MFA) during the reset process. This aligns directly with the scenario of enabling self-service password changes while enforcing MFA for security.

Exam trap

The trap here is that candidates often confuse Identity Protection (which detects risky password changes) with SSPR (which enables the actual password reset), leading them to select Option C instead of A.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra ID Federation is used to establish trust between an on-premises identity provider (e.g., AD FS) and Entra ID for single sign-on, not for self-service password reset with MFA enforcement. Option C is wrong because Microsoft Entra Identity Protection is a risk-based security tool that detects and responds to identity threats (e.g., risky sign-ins or leaked credentials), but it does not provide a self-service password reset capability. Option D is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time privileged role activation and access reviews, not end-user password reset functionality.

Practice this question →

257

MCQhard

A company wants to allow external customers to sign in to their custom web application using their own social identities, such as Google or Facebook. They also need to support self-service registration and custom branding for the sign-in pages. Which Microsoft Entra External ID solution should they use?

A.Microsoft Entra ID B2B collaboration

B.Microsoft Entra ID B2C

C.Microsoft Entra ID guest accounts

D.Managed identities

AnswerB

Microsoft Entra ID B2C is specifically engineered for customer identity and access management (CIAM), enabling external customers to sign up and sign in to your custom web and mobile applications. It supports a wide array of identity providers, including social accounts like Google and Facebook, as well as local accounts. B2C provides a highly customizable, branded experience for customer registration, sign-in, and profile management, making it ideal for this scenario.

Why this answer

Microsoft Entra ID B2C (Business-to-Consumer) is the correct solution because it is specifically designed for external customer identity and access management, supporting social identity providers (Google, Facebook, etc.) via OAuth 2.0 and OpenID Connect, self-service registration, and full customization of sign-in pages (branding, HTML, CSS). This aligns exactly with the requirements for a customer-facing web application with social sign-in and custom branding.

Exam trap

The trap here is that candidates often confuse B2B collaboration (for external partners) with B2C (for external customers), mistakenly thinking B2B can handle social identities and self-service registration, but B2B lacks those capabilities and is designed for federated business accounts.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID B2B collaboration is intended for business-to-business scenarios, allowing external partners to sign in with their own work or school accounts, not social identities like Google or Facebook, and it does not support self-service registration or custom branding for sign-in pages. Option C is wrong because Microsoft Entra ID guest accounts are a feature of B2B collaboration, used for inviting external users (typically with work/school accounts) to access resources in the tenant, lacking social identity provider support and self-service registration. Option D is wrong because managed identities are an Azure resource authentication mechanism for Azure services to authenticate to other Azure services without storing credentials, not a solution for external customer sign-in or identity management.

Practice this question →

258

MCQhard

Your organization is using Microsoft Entra Permissions Management (CIEM). You need to identify overprivileged identities in AWS. Which capability should you use?

A.Audit trail

B.Permissions Analytics Report

C.Identity governance

D.Activity trail

AnswerB

The Permissions Analytics Report within Microsoft Entra Permissions Management is specifically designed to identify overprivileged identities by analyzing granted permissions against actual usage data over a defined period. This report leverages machine learning to compare an identity's assigned permissions with the specific actions they have performed, highlighting unused, high-risk, or excessive permissions. It provides actionable insights to right-size permissions and enforce the principle of least privilege effectively.

Why this answer

Permissions Analytics Report is the correct capability because it specifically analyzes permissions across AWS, Azure, and GCP to identify overprivileged identities, unused permissions, and risky actions. It generates a detailed report that highlights identities with excessive permissions, enabling remediation to enforce least privilege. This aligns directly with the CIEM (Cloud Infrastructure Entitlement Management) goal of reducing privilege risks.

Exam trap

The trap here is that candidates confuse 'Permissions Analytics Report' with generic auditing features like Audit trail or Activity trail, assuming any logging tool can identify overprivileged identities, but only the report performs the specific analysis of permissions versus usage.

How to eliminate wrong answers

Option A is wrong because Audit trail in Microsoft Entra Permissions Management records historical changes to permissions and configurations, but it does not analyze or identify overprivileged identities; it is a logging feature. Option C is wrong because Identity governance in Microsoft Entra ID focuses on access reviews, entitlement management, and lifecycle workflows for users and groups, not on analyzing cloud infrastructure permissions across AWS. Option D is wrong because Activity trail tracks user actions and API calls in real-time or historically, but it does not assess permission levels or detect overprivileged identities; it is an auditing feature.

Practice this question →

259

MCQhard

A company uses Microsoft Entra ID with a custom line-of-business application that only supports SAML 2.0. They want to enable single sign-on for users. What should they configure in Microsoft Entra ID?

A.Kerberos delegation

B.OpenID Connect authentication

C.SCIM-based user provisioning

D.SAML-based single sign-on

AnswerD

SAML (Security Assertion Markup Language) 2.0 is an XML-based open standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). Microsoft Entra ID acts as a robust IdP, enabling users to sign in once and gain access to multiple enterprise applications (SPs) without re-entering credentials. This protocol is widely adopted for federated single sign-on with custom line-of-business applications and many SaaS applications, making it a secure, mature, and common solution for integrating enterprise applications with Microsoft Entra ID.

Why this answer

D is correct because the custom line-of-business application explicitly supports SAML 2.0, and Microsoft Entra ID can be configured as an identity provider (IdP) to enable SAML-based single sign-on. This allows users to authenticate once in Entra ID and then access the application without re-entering credentials, using SAML assertions to pass authentication and authorization data.

Exam trap

The trap here is that candidates may confuse SCIM provisioning (Option C) with SSO, or assume OpenID Connect (Option B) is universally compatible, but the question explicitly states the application only supports SAML 2.0, making SAML-based SSO the only correct choice.

How to eliminate wrong answers

Option A is wrong because Kerberos delegation is used for Windows-integrated authentication (e.g., on-premises Active Directory) and requires Kerberos protocol support, which is not compatible with a SAML 2.0-only application. Option B is wrong because OpenID Connect (OIDC) is built on OAuth 2.0 and uses JSON Web Tokens (JWTs), not SAML 2.0; the application only supports SAML 2.0, so OIDC cannot be used. Option C is wrong because SCIM (System for Cross-domain Identity Management) is a provisioning protocol for automating user and group lifecycle management, not an authentication or SSO protocol; it does not enable single sign-on.

Practice this question →

260

MCQhard

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to ensure that when a user's on-premises account is disabled, their cloud account is automatically disabled within 5 minutes. Which configuration should you use?

A.Microsoft Entra Privileged Identity Management

B.Microsoft Entra Conditional Access with session controls

C.Microsoft Entra Connect with directory sync configured for 5-minute sync interval

D.Microsoft Entra Connect Health

AnswerC

Microsoft Entra Connect is the foundational tool for synchronizing identities between an on-premises Active Directory and Microsoft Entra ID, including critical user account attributes like 'disabled' status. By default, the synchronization cycle runs every 30 minutes, but administrators can configure the Microsoft Entra Connect sync scheduler to run more frequently. This allows for a minimum 5-minute interval, ensuring that time-sensitive changes, such as account disablement, are reflected in the cloud promptly.

Why this answer

Microsoft Entra Connect with directory synchronization configured for a 5-minute sync interval ensures that changes made to on-premises Active Directory (such as disabling a user account) are replicated to Microsoft Entra ID within that interval. This meets the requirement of automatically disabling the cloud account within 5 minutes of the on-premises change.

Exam trap

The trap here is confusing identity synchronization (Entra Connect) with identity governance or access control tools like PIM or Conditional Access, which do not handle the propagation of on-premises account status changes to the cloud.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time access and role activation, not the synchronization of user account status changes. Option B is wrong because Microsoft Entra Conditional Access with session controls enforces access policies based on conditions like location or device state, but it does not synchronize account disabled status from on-premises to the cloud. Option D is wrong because Microsoft Entra Connect Health monitors the health and performance of the sync infrastructure but does not control the sync interval or propagate account status changes.

Practice this question →

261

MCQmedium

A company uses Microsoft Entra ID. The compliance team requires that membership in highly privileged roles, such as Global Administrator, is reviewed quarterly. The review must be automated: role owners are sent an email notification with a list of current members to approve or deny. If a member does not respond within 30 days, their access should be automatically revoked. Which Microsoft Entra ID feature should the team use to set up this periodic review and automatic removal?

A.Access Reviews

B.Privileged Identity Management (PIM)

C.Conditional Access

D.Identity Protection

AnswerA

Microsoft Entra Access Reviews are specifically designed to manage and automate the periodic review of user access to resources, applications, and roles within Microsoft Entra ID. This feature allows organizations to schedule recurring campaigns where designated reviewers, such as resource owners or managers, certify whether users still require their current permissions. Crucially, Access Reviews can automatically revoke access for users whose permissions are not approved or who fail to respond, directly addressing the compliance requirement for regular access validation and removal of stale assignments.

Why this answer

Access Reviews in Microsoft Entra ID is the correct feature because it is specifically designed for periodic, automated attestation of group or role memberships. It sends email notifications to designated reviewers, tracks responses, and can automatically remove users who do not respond within a defined period (e.g., 30 days). This directly meets the compliance requirement for quarterly reviews of Global Administrator membership with automatic revocation.

Exam trap

The trap here is confusing Privileged Identity Management (PIM) with Access Reviews, as both involve role management, but PIM handles activation and approval while Access Reviews handle periodic attestation and automatic removal.

Why the other options are wrong

PIM provides just-in-time role activation and time-bound assignments, but it does not include built-in automated periodic review workflows with email notifications and automatic removal after 30 days of non-response. That functionality is specific to Access Reviews.

Identity Protection is designed to detect and respond to identity-based risks (e.g., compromised accounts, sign-in anomalies), not to manage periodic access reviews or automatic removal of role members.

Practice this question →

262

MCQmedium

A company uses Microsoft Entra ID. They frequently collaborate with an external partner organization. The IT team wants to allow the partner's users to access the company's internal SharePoint site using their existing corporate credentials from their own Microsoft Entra tenant. The partner users should not have to create separate guest accounts or remember another password. Which Microsoft Entra feature should the IT team configure?

A.Microsoft Entra B2C

B.Microsoft Entra B2B collaboration

C.Microsoft Entra Domain Services

D.Microsoft Entra Application Proxy

AnswerB

Microsoft Entra B2B collaboration is the correct solution for enabling secure and seamless collaboration with external partners. It allows organizations to invite guest users from other Microsoft Entra tenants, social identity providers, or email-verified accounts to access applications and resources within their own Microsoft Entra ID. This feature facilitates cross-organizational projects by letting external users utilize their existing credentials without creating new accounts in the host directory, ensuring efficient and governed access.

Why this answer

Microsoft Entra B2B collaboration is the correct feature because it enables external users from a partner organization to access the company's internal SharePoint site using their own corporate credentials from their Microsoft Entra tenant. B2B collaboration creates a guest user object in the resource tenant without requiring separate guest accounts or additional passwords, leveraging cross-tenant trust and SAML/WS-Federation for authentication.

Exam trap

The trap here is that candidates often confuse B2B collaboration with B2C, thinking both are for external users, but B2C is for consumers with self-service sign-up, while B2B is for business partners using their existing corporate identities.

Why the other options are wrong

Microsoft Entra B2C is designed for customer-facing applications where external users sign up and manage their own identities, not for enabling existing corporate credentials from another Entra tenant to access internal resources like SharePoint.

Microsoft Entra Domain Services provides managed domain services like domain join and group policy, not external user access to SharePoint. It does not enable cross-tenant collaboration or federated authentication for partner users.

Microsoft Entra Application Proxy is used to publish on-premises web applications externally, not to enable cross-tenant collaboration with external partners using their existing credentials.

Practice this question →

263

MCQeasy

Your organization uses Microsoft Entra ID to manage identities for employees and external partners. You need to ensure that external partners can access only specific applications and that their access expires automatically after 60 days. Which Microsoft Entra feature should you use?

A.Microsoft Entra B2B collaboration.

B.Conditional Access policies.

C.Microsoft Entra Identity Protection.

D.Microsoft Entra entitlement management.

AnswerD

Microsoft Entra entitlement management is a robust identity governance feature specifically designed to manage the identity and access lifecycle for both internal and external users. It enables organizations to create access packages, which bundle resources like groups, applications, and SharePoint sites, and define policies that include mandatory access reviews and automatic expiration dates for assigned access. This capability directly addresses the requirement for assigning access and enforcing its automatic expiration.

Why this answer

Microsoft Entra entitlement management allows you to create access packages that govern external partner access to specific applications, groups, and sites, with built-in time-limited access that automatically expires after a defined period (e.g., 60 days). This feature directly addresses the requirement to scope access to only specific applications and enforce automatic expiration, which is not natively handled by other Entra ID features.

Exam trap

The trap here is that candidates often confuse the invitation and authentication capabilities of B2B collaboration (Option A) with the full lifecycle and access governance provided by entitlement management, assuming B2B alone can enforce time-bound application access.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra B2B collaboration enables external user invitation and authentication but does not provide granular control over which specific applications they can access or enforce automatic time-bound expiration policies on its own. Option B is wrong because Conditional Access policies enforce access controls based on conditions (e.g., location, device state) but cannot automatically expire access after a fixed duration like 60 days; they are real-time evaluation rules, not time-limited access management. Option C is wrong because Microsoft Entra Identity Protection focuses on detecting and remediating identity-based risks (e.g., leaked credentials, suspicious sign-ins) and does not manage application-specific access or automatic expiration schedules.

Practice this question →

264

MCQmedium

A company uses Microsoft Entra ID and wants to automate the lifecycle of guest users. When a contractor's project ends, the guest account should be automatically blocked and then removed after 30 days. Which Microsoft Entra capability should they configure to manage this process?

A.Conditional Access

B.Entitlement Management

C.Privileged Identity Management

D.Identity Governance

AnswerB

Entitlement Management, a core component of Microsoft Entra Identity Governance, is specifically designed to automate the lifecycle of access for both internal and external users. It allows organizations to define access packages that bundle resources and specify access policies, including start and end dates. When an access package expires, Entitlement Management automatically revokes access and can remove guest accounts from the directory, directly addressing the requirement for automated guest account creation and removal tied to project timelines.

Why this answer

Entitlement Management in Microsoft Entra ID Governance allows organizations to automate the lifecycle of external identities, including guest users. By configuring an access package with a specific expiration policy (e.g., 30 days after project end), the system can automatically block and then remove the guest account when the entitlement expires, without manual intervention.

Exam trap

The trap here is that candidates confuse the broad category 'Identity Governance' (Option D) with the specific feature 'Entitlement Management' (Option B), but the question asks for the capability that directly configures the automated lifecycle, which is Entitlement Management.

How to eliminate wrong answers

Option A is wrong because Conditional Access enforces access controls based on signals like location or device compliance, but it does not automate the lifecycle or removal of guest accounts. Option C is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role assignments and approvals, not the lifecycle of guest users or their automatic removal. Option D is wrong because Identity Governance is the overarching category that includes Entitlement Management, but it is not the specific capability that directly configures automated guest lifecycle policies; Entitlement Management is the precise tool within Identity Governance for this task.

Practice this question →

265

MCQmedium

An organization has Microsoft Sentinel and Microsoft Defender XDR. They want to automatically block a user's sign-in if a high-risk alert is triggered. Which Microsoft Entra feature integrates with these products to enforce access controls?

A.Conditional Access with Identity Protection integration

B.Microsoft Entra Access Reviews

C.Microsoft Entra Identity Protection

D.Microsoft Entra Privileged Identity Management

AnswerA

Conditional Access policies, when integrated with Microsoft Entra Identity Protection, can evaluate real-time sign-in risk levels detected by Identity Protection. These policies can then enforce automated actions, such as blocking access, requiring multifactor authentication, or forcing a password change, based on the configured risk thresholds. This provides a robust, automated mechanism to prevent unauthorized access attempts from risky sign-ins.

Why this answer

Conditional Access with Identity Protection integration allows organizations to create policies that automatically block sign-ins when Microsoft Sentinel or Microsoft Defender XDR triggers a high-risk alert. This integration leverages risk signals from Identity Protection to enforce real-time access controls, such as blocking authentication, without manual intervention.

Exam trap

The trap here is that candidates confuse Microsoft Entra Identity Protection (which only detects and reports risk) with Conditional Access (which enforces the actual block), leading them to select Identity Protection alone instead of the integrated Conditional Access solution.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra Access Reviews are used for periodic attestation of group memberships, application access, and role assignments, not for real-time automated blocking based on risk alerts. Option C is wrong because Microsoft Entra Identity Protection alone detects and reports risk signals (e.g., leaked credentials, anonymous IP addresses) but does not enforce access controls; it requires integration with Conditional Access to take blocking actions. Option D is wrong because Microsoft Entra Privileged Identity Management (PIM) manages just-in-time privileged role activation and approval workflows, not automated sign-in blocking based on security alerts.

Practice this question →

266

MCQmedium

Your organization uses Microsoft Entra ID for identity management. You need to allow external partners to access a specific SharePoint Online site without requiring them to have a Microsoft Entra ID account in your tenant. Which feature should you use?

A.Use Microsoft Entra B2B collaboration to invite partners as guest users.

B.Set up identity protection to allow external access.

C.Configure Microsoft Entra B2C for the partners.

D.Create guest user accounts for each partner.

AnswerA

Microsoft Entra B2B collaboration is the specific feature designed for securely sharing applications and resources with external users from other organizations. It enables partners to use their own corporate or social identities (e.g., Microsoft accounts, Google IDs) to authenticate, rather than requiring them to create new credentials in your tenant. Upon invitation, these partners are represented as guest user objects in your Microsoft Entra ID, allowing for granular access control to specified resources.

Why this answer

Microsoft Entra B2B collaboration is the correct feature because it allows you to invite external partners as guest users who can access resources like SharePoint Online using their own identity (e.g., a Microsoft account or a corporate account from another identity provider) without requiring a separate Microsoft Entra ID account in your tenant. This leverages the B2B collaboration protocol, which uses SAML/WS-Federation or OIDC for federation, enabling seamless access while maintaining centralized access control.

Exam trap

The trap here is that candidates often confuse Microsoft Entra B2B collaboration with Microsoft Entra B2C, assuming both are for external users, but B2C is for customer-facing apps with self-service sign-up, while B2B is for granting access to business partners with existing identities.

How to eliminate wrong answers

Option B is wrong because Identity Protection is a security tool for detecting and responding to identity-based risks (e.g., compromised credentials, anomalous sign-ins) and does not provide a mechanism to grant external users access to resources. Option C is wrong because Microsoft Entra B2C is designed for customer-facing applications where users sign up and sign in with social or local accounts, not for granting external business partners access to internal resources like SharePoint Online. Option D is wrong because creating guest user accounts manually for each partner is inefficient and not a feature name; the correct feature is Microsoft Entra B2B collaboration, which automates the invitation and lifecycle management of guest users.

Practice this question →

267

MCQeasy

A user is unable to access a cloud app and receives a message that their sign-in was blocked by a Conditional Access policy. The admin wants to allow the user to self-remediate by meeting policy requirements. What should the admin enable?

A.Self-Service Password Reset

B.Multifactor Authentication registration

C.Identity Protection risk policies

D.Conditional Access policy feedback

AnswerD

Conditional Access policies evaluate various signals, including user, device, location, application, and real-time risk, to make granular access decisions. When a user is blocked from accessing a cloud application due to a Conditional Access policy, the system is designed to provide direct, actionable feedback. This feedback explicitly informs the user *why* access was denied (e.g., 'Your device is not compliant') and often includes clear steps or links to remediate the issue, enabling them to meet the policy requirements and gain access.

Why this answer

Enabling Conditional Access policy feedback allows users to receive guidance on why their sign-in was blocked and how to meet the policy requirements, such as using a compliant device or accessing from a trusted location. This feature provides actionable messages that enable self-remediation without admin intervention, directly addressing the scenario where the user needs to unblock themselves by satisfying the policy conditions.

Exam trap

The trap here is that candidates often confuse 'Conditional Access policy feedback' with other self-service features like SSPR or MFA registration, but the question specifically asks for the mechanism that provides users with actionable guidance on why they were blocked and how to meet the policy requirements, which is unique to policy feedback.

How to eliminate wrong answers

Option A is wrong because Self-Service Password Reset (SSPR) allows users to reset their own passwords, but it does not address Conditional Access policy blocks that are unrelated to password issues, such as device compliance or location requirements. Option B is wrong because Multifactor Authentication (MFA) registration enables users to set up MFA, but the sign-in was blocked by a Conditional Access policy that may require additional conditions (e.g., compliant device, trusted IP) beyond MFA; enabling MFA registration alone does not guarantee the user can meet all policy requirements. Option C is wrong because Identity Protection risk policies are a separate feature that detects and responds to risky sign-ins (e.g., leaked credentials), but they do not provide the user with specific feedback on why a Conditional Access policy blocked them or how to self-remediate; risk policies automatically block or require MFA based on risk level, not user-driven feedback.

Practice this question →

268

MCQmedium

Your company is using Microsoft Entra ID to manage identities. You want to allow users to reset their own passwords without help desk intervention, but only if they have registered for self-service password reset (SSPR). What should you configure?

A.Require all users to register for Microsoft Entra MFA.

B.Configure Microsoft Entra password protection.

C.Implement Privileged Identity Management (PIM).

D.Enable Self-Service Password Reset (SSPR) in Microsoft Entra ID.

AnswerD

Enabling Self-Service Password Reset (SSPR) in Microsoft Entra ID is the direct and correct solution for allowing users to reset their own forgotten passwords without requiring administrator assistance. Once SSPR is configured and users have successfully registered their chosen authentication methods (e.g., mobile app, phone, email), they can independently verify their identity and set a new password, significantly improving user experience and reducing help desk workload.

Why this answer

Enabling Self-Service Password Reset (SSPR) in Microsoft Entra ID allows users to reset their own passwords without help desk intervention, provided they have registered for the feature. This directly meets the requirement of allowing password resets only for registered users, as SSPR requires prior registration to verify identity before a reset is permitted.

Exam trap

The trap here is that candidates often confuse enabling SSPR with requiring MFA registration, but MFA registration alone does not grant password reset capabilities—SSPR must be explicitly enabled and configured.

How to eliminate wrong answers

Option A is wrong because requiring all users to register for Microsoft Entra MFA is a separate security feature that adds multi-factor authentication but does not enable password reset functionality; MFA can be used as part of SSPR registration but is not sufficient alone. Option B is wrong because Microsoft Entra password protection is a feature that blocks weak passwords and common password attacks, but it does not provide self-service password reset capabilities. Option C is wrong because Privileged Identity Management (PIM) is designed for managing, controlling, and monitoring access to privileged roles, not for enabling end-user password self-service.

Practice this question →

269

MCQmedium

You are an identity consultant for a mid-sized company with 5,000 employees. They use Microsoft Entra ID P1 and Microsoft Intune for device management. The company wants to implement passwordless authentication for all employees to improve security and user experience. Currently, users sign in with username and password plus MFA via the Microsoft Authenticator app. The company has a mix of Windows 10/11 devices (both domain-joined and Microsoft Entra joined) and iOS/Android mobile devices. They want to support passwordless sign-in on all platforms. The CTO is concerned about cost and wants to minimize additional licensing. Which passwordless method should you recommend?

A.Enable Windows Hello for Business for all devices

B.Deploy FIDO2 security keys to all employees

C.Implement SMS-based one-time passcodes

D.Use the Microsoft Authenticator app for passwordless sign-in

AnswerD

The Microsoft Authenticator app offers a highly effective and cost-efficient solution for passwordless sign-in across a wide range of devices, including iOS, Android, and Windows. It leverages existing smartphone hardware to provide a secure, push-notification-based or number-matching authentication method, eliminating the need for users to type a password. This approach minimizes additional hardware costs, simplifies deployment, and enhances user convenience and security by removing the weakest link in traditional authentication.

Why this answer

The Microsoft Authenticator app supports passwordless sign-in using phone-based authentication, which works on both iOS and Android devices and can be used to sign into Windows 10/11 devices via the 'Sign in with phone' feature. This method leverages existing Microsoft Entra ID P1 licensing without requiring additional costs, as it is included with the current P1 license. It provides a seamless user experience by eliminating the need for hardware tokens or additional infrastructure, aligning with the CTO's cost-minimization goal.

Exam trap

The trap here is that candidates often assume Windows Hello for Business is the only Microsoft passwordless solution for Windows devices, overlooking that the Microsoft Authenticator app can provide passwordless sign-in across all platforms (Windows, iOS, Android) without additional licensing or hardware costs.

How to eliminate wrong answers

Option A is wrong because Windows Hello for Business requires either a domain-joined device with on-premises Active Directory or a Microsoft Entra joined device, and it does not support iOS/Android mobile devices, so it cannot cover all platforms as required. Option B is wrong because deploying FIDO2 security keys to 5,000 employees would incur significant hardware procurement and management costs, contradicting the CTO's directive to minimize additional licensing and expenses. Option C is wrong because SMS-based one-time passcodes are not a passwordless method; they still require a password as the primary authentication factor and are considered a form of MFA, not passwordless authentication.

Practice this question →

270

MCQhard

Your organization implements a Microsoft Entra ID tenant with a custom domain (contoso.com). You need to ensure that all users are assigned a unique user principal name (UPN) based on their email address. What should you do?

A.Configure the user naming attribute to use the email address as the UPN

B.Verify the custom domain in Microsoft Entra ID

C.Enable Microsoft Entra ID Domain Services

D.Use Microsoft Entra ID Connect to sync UPNs from on-premises

AnswerA

Setting the UPN to email ensures each user has a unique UPN based on email.

Why this answer

To ensure users are assigned a UPN based on their email address in Microsoft Entra ID, administrators must manually set the UPN during user creation or modification. For new users, this involves entering the desired email address (or its prefix) as the 'User name' and selecting the appropriate custom domain suffix. For existing users, their UPNs can be updated in bulk using PowerShell or the Microsoft Entra admin center's bulk operations feature to match their email addresses.

While there isn't a single 'user naming attribute' setting that automates this process globally, the action of configuring the UPN for each user to match their email address is the necessary step.

Exam trap

The trap here is that candidates often confuse verifying a custom domain (Option B) with automatically assigning UPNs based on email addresses, but verification alone does not change how UPNs are generated; it only enables the domain to be used as a suffix.

How to eliminate wrong answers

Option B is wrong because verifying the custom domain in Microsoft Entra ID is a prerequisite for using that domain in UPNs, but it does not automatically assign UPNs based on email addresses; it only confirms domain ownership. Option C is wrong because enabling Microsoft Entra ID Domain Services provides managed domain services (e.g., LDAP, Kerberos) for legacy applications, but it does not affect UPN assignment for users. Option D is wrong because using Microsoft Entra ID Connect to sync UPNs from on-premises would only work if the on-premises UPNs already match email addresses; it does not configure the cloud tenant to automatically assign UPNs based on email addresses for cloud-only users.

Practice this question →

271

MCQmedium

A company uses Microsoft Entra ID. The IT department wants to automatically assign a Microsoft 365 E5 license to all users in the Sales department based on their department attribute. Which Microsoft Entra ID feature should they use?

A.Dynamic Groups

B.Administrative Units

C.Identity Protection

D.Access Reviews

AnswerA

Microsoft Entra ID dynamic groups automatically manage membership based on defined attribute-based rules, such as a user's department or job title. When a user's attributes change, they are automatically added to or removed from the group, ensuring accurate membership. This capability is crucial for automating license assignment through group-based licensing, as licenses are then automatically provisioned or de-provisioned as users join or leave these dynamic groups.

Why this answer

Dynamic Groups in Microsoft Entra ID allow automatic user membership based on user attributes, such as the department attribute. By creating a dynamic group rule like `user.department -eq "Sales"`, the system automatically assigns the group membership and can then apply a Microsoft 365 E5 license via group-based licensing.

Exam trap

The trap here is that candidates may confuse Administrative Units with Dynamic Groups, thinking that delegating admin control over a department also handles license assignment, but Administrative Units only manage administrative boundaries, not automated provisioning.

Why the other options are wrong

Administrative Units are used to delegate administrative permissions over subsets of users, groups, or devices, not to automatically assign licenses based on attributes like department.

Identity Protection is a feature for detecting and responding to identity-based risks, not for automating license assignments based on user attributes.

Access Reviews are used to review and certify user access rights periodically, not to automatically assign licenses based on attributes.

Practice this question →

272

MCQeasy

A company wants to allow employees to use their corporate Microsoft Entra ID credentials to sign in to third-party SaaS applications like Salesforce and ServiceNow. Which feature provides this capability?

A.Microsoft Entra federation with SaaS applications

B.Microsoft Entra B2B collaboration

C.Microsoft Entra Identity Protection

D.Microsoft Entra Privileged Identity Management

AnswerA

Microsoft Entra federation with SaaS applications is the correct solution because it enables employees to use their existing corporate Microsoft Entra ID credentials for single sign-on (SSO) to third-party Software as a Service (SaaS) applications. This process involves configuring Microsoft Entra ID as the identity provider, allowing it to authenticate users and securely pass identity assertions (e.g., via SAML or OIDC) to the SaaS application, eliminating the need for separate usernames and passwords. This enhances user experience, improves security posture, and centralizes identity management.

Why this answer

Microsoft Entra federation with SaaS applications (Option A) enables single sign-on (SSO) by establishing a trust relationship between Microsoft Entra ID and third-party SaaS apps like Salesforce and ServiceNow. This allows users to authenticate using their corporate Entra ID credentials via federation protocols such as SAML 2.0 or OpenID Connect, eliminating the need for separate credentials.

Exam trap

The trap here is that candidates often confuse B2B collaboration (external user access) with federation (corporate user SSO to external apps), leading them to select Option B instead of A.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra B2B collaboration is designed for inviting external users (e.g., partners or vendors) to access your organization's resources, not for enabling corporate users to sign in to third-party SaaS apps. Option C is wrong because Microsoft Entra Identity Protection is a security tool that detects and responds to identity-based risks (e.g., leaked credentials or anomalous sign-ins), not a feature for federated authentication. Option D is wrong because Microsoft Entra Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles within Azure AD and Azure resources, not for federating with external SaaS applications.

Practice this question →

273

MCQmedium

Your company is implementing a hybrid identity solution with Microsoft Entra ID. You need to ensure that password changes on-premises are synchronized to the cloud within minutes. Which feature should you enable?

A.Password Hash Synchronization

B.Pass-through Authentication

C.Seamless Single Sign-On

D.Password Writeback

AnswerA

Correct. Password Hash Synchronization syncs password hashes from on-premises to Azure AD in near real-time, so on-premises password changes appear in the cloud within minutes.

Why this answer

Password Hash Synchronization (A) synchronizes password hashes from on-premises Active Directory to Microsoft Entra ID in near real-time, ensuring that password changes made on-premises are reflected in the cloud within minutes. Password Writeback (D) performs the reverse: it writes password changes from the cloud back to on-premises, not from on-premises to the cloud. Pass-through Authentication (B) validates passwords against on-premises AD directly without syncing hashes, and Seamless SSO (C) provides automatic sign-in but does not handle password synchronization.

Exam trap

The trap is that candidates often think Password Writeback is for on-premises-to-cloud sync when it actually does the opposite (cloud-to-on-premises). Password Hash Synchronization is the correct feature for synchronizing on-premises password changes to the cloud.

How to eliminate wrong answers

Option A is wrong because Password Hash Synchronization (PHS) syncs password hashes from on-premises to the cloud but does not write back changes made on-premises; it is a one-way sync that occurs every few minutes by default, not triggered by individual password changes. Option B is wrong because Pass-through Authentication (PTA) validates passwords against on-premises Active Directory without storing password hashes in the cloud, so it does not synchronize password changes to the cloud. Option C is wrong because Seamless Single Sign-On (SSO) provides automatic sign-in for domain-joined devices but does not handle password synchronization or writeback.

Practice this question →

274

MCQmedium

Your company uses Microsoft Entra ID and wants to allow external partners to sign in using their own Google or Facebook accounts. Which feature should you enable?

A.Azure Active Directory Domain Services

B.Microsoft Entra B2C

C.Microsoft Entra B2B collaboration

D.External Identities (social identity providers)

AnswerD

External Identities is the overarching capability within Microsoft Entra ID that enables secure interaction with external users. Specifically, the social identity providers feature allows external users to sign in to your Microsoft Entra ID-protected applications using their existing credentials from popular social accounts like Google, Facebook, LinkedIn, or Amazon. This eliminates the need for external users to create a new account or have an existing Microsoft Entra ID or Microsoft account, streamlining access for a broad range of external collaborators.

Why this answer

External Identities (social identity providers) in Microsoft Entra ID allows you to configure Google and Facebook as identity providers for external users. This enables partners to sign in using their existing social accounts without needing a separate Microsoft account, leveraging OAuth 2.0 and OpenID Connect protocols for authentication.

Exam trap

The trap here is that candidates often confuse Microsoft Entra B2B collaboration (which handles external organizational accounts) with External Identities (which includes social identity providers), leading them to incorrectly select B2B when the question explicitly mentions Google or Facebook accounts.

How to eliminate wrong answers

Option A is wrong because Azure Active Directory Domain Services (Azure AD DS) provides managed domain services like LDAP and Kerberos for legacy applications, not social identity federation. Option B is wrong because Microsoft Entra B2C is designed for customer-facing applications with extensive customization of sign-up and sign-in flows, not for simple partner access using existing social accounts. Option C is wrong because Microsoft Entra B2B collaboration enables external users to sign in with their own organizational accounts (e.g., Azure AD, Microsoft account) but does not natively support social identity providers like Google or Facebook without additional configuration through External Identities.

Practice this question →

275

MCQmedium

A company uses Microsoft Entra ID. The security team needs to ensure that when users sign in to a critical financial application from an untrusted network, they must first complete multi-factor authentication (MFA). Additionally, the team wants to block the sign-in if the device is not marked as compliant by Microsoft Intune. Which conditional access grant control should they configure to meet both requirements?

A.Require multi-factor authentication AND Require device to be marked as compliant

B.Require multi-factor authentication only

C.Require one of the selected controls

D.Require device to be marked as compliant only

AnswerA

Conditional Access allows adding multiple grant controls; all must be satisfied for access to be allowed. This enforces both MFA and device compliance.

Why this answer

Conditional Access grant controls allow you to require multiple conditions to be met simultaneously. By selecting 'Require multi-factor authentication' AND 'Require device to be marked as compliant', the policy ensures that both MFA and device compliance are enforced for the sign-in, meeting the security team's requirements.

Exam trap

The trap here is that candidates often confuse 'AND' (all controls required) with 'OR' (one of the selected controls), leading them to choose Option C, which would not enforce both MFA and device compliance simultaneously.

Why the other options are wrong

This option only enforces MFA, but the question explicitly requires both MFA and device compliance. It fails to block sign-ins from non-compliant devices, so it does not meet the full requirement.

The question requires both MFA and device compliance to be enforced simultaneously. Option C, 'Require one of the selected controls,' would allow sign-in if either MFA or device compliance is met, not both, failing to meet the requirement.

Practice this question →

276

MCQeasy

A company wants to provide employees with single sign-on access to both Microsoft 365 and a third-party SaaS application. Which feature of Microsoft Entra ID should they use?

A.Identity Protection

B.Conditional Access

C.Federation

D.Privileged Identity Management

AnswerC

Federation establishes a trust relationship between an identity provider (IdP) and one or more service providers (SPs), enabling users to authenticate once with the IdP and gain access to multiple SPs without re-entering credentials. This mechanism, often leveraging protocols like SAML or OpenID Connect, allows the IdP to assert a user's identity to various applications. It is the core technology that facilitates single sign-on (SSO) across different applications and organizational boundaries.

Why this answer

Federation (Option C) is correct because it establishes a trust relationship between Microsoft Entra ID and the third-party SaaS application's identity provider using standards like SAML 2.0 or WS-Federation. This allows users to authenticate once with their corporate credentials and gain access to both Microsoft 365 and the third-party app without separate logins, enabling true single sign-on (SSO).

Exam trap

The trap here is that candidates confuse Conditional Access (a policy engine) with the underlying federation trust required for SSO, mistakenly thinking that policy enforcement alone enables single sign-on.

How to eliminate wrong answers

Option A is wrong because Identity Protection is a risk-based detection and remediation tool that identifies compromised identities or suspicious sign-ins, not a mechanism for enabling SSO. Option B is wrong because Conditional Access enforces policies (e.g., requiring MFA or blocking sign-ins from certain locations) after authentication, but it does not establish the trust relationship needed for SSO. Option D is wrong because Privileged Identity Management (PIM) manages just-in-time access and approval workflows for privileged roles, not the federation trust required for SSO.

Practice this question →

277

MCQmedium

A company uses Microsoft Entra ID and wants to enforce multi-factor authentication (MFA) only for external guest users, while allowing internal employees to sign in without MFA. Which Conditional Access setting should be configured?

A.Require MFA for all users

B.Exclude internal users by group

C.Target the 'Guest or external users' identity type

D.Use Identity Protection's user risk policy

AnswerC

Conditional Access policies in Microsoft Entra ID provide the precise control needed to enforce requirements based on identity types. By configuring a policy to include the 'Guest or external users' identity type, administrators can specifically mandate multi-factor authentication (MFA) solely for B2B collaboration guests and other external identities. This direct targeting ensures that internal users are not affected, thereby accurately meeting the requirement to enforce MFA exclusively for external users.

Why this answer

Conditional Access allows targeting the 'Guest or external users' identity type, which enables MFA enforcement exclusively for external guest users without affecting internal employees. This setting leverages the user type attribute in Microsoft Entra ID to differentiate between internal and external identities, providing granular control over authentication requirements.

Exam trap

The trap here is that candidates often confuse exclusion-based approaches (like excluding internal users by group) with direct targeting of guest identity types, leading them to choose Option B instead of the more precise and scalable Option C.

Why the other options are wrong

This option applies MFA to all users, including internal employees, which contradicts the requirement to enforce MFA only for external guest users.

Excluding internal users by group does not specifically target external guest users; it would still require MFA for all other users, including guests, but the question asks for MFA only for external guests, not all users.

Identity Protection's user risk policy requires Azure AD Premium P2 and evaluates sign-in risk, not user type. It cannot target only external guest users for MFA enforcement.

Practice this question →

278

MCQeasy

A user is locked out of their account due to multiple failed sign-in attempts. Which Microsoft Entra ID feature can automatically block suspicious sign-in attempts based on risk?

A.Self-Service Password Reset (SSPR)

B.Microsoft Entra ID Governance

C.Microsoft Entra ID Protection

D.Conditional Access

AnswerC

Microsoft Entra ID Protection is specifically designed to detect, report, and automatically remediate identity-based risks, such as unusual sign-in locations, impossible travel, and multiple failed sign-in attempts. It leverages machine learning to identify suspicious activities and can configure policies to automatically block access or enforce multi-factor authentication (MFA) when a user's risk level is deemed high. This capability directly addresses the scenario of an account lockout due to multiple failed sign-ins by identifying and responding to the underlying risk.

Why this answer

Microsoft Entra ID Protection uses machine learning and heuristic algorithms to detect and automatically block suspicious sign-in attempts based on risk signals such as anonymous IP addresses, atypical travel, or leaked credentials. When a user is locked out due to multiple failed attempts, Entra ID Protection can evaluate the sign-in risk and enforce a block or require multi-factor authentication before allowing access.

Exam trap

The trap here is that candidates often confuse Conditional Access with risk-based blocking, but Conditional Access is the policy engine that enforces the block, while Entra ID Protection is the service that actually detects and assesses the risk to trigger the automatic block.

How to eliminate wrong answers

Option A is wrong because Self-Service Password Reset (SSPR) allows users to unlock their accounts or reset passwords after being locked out, but it does not proactively block suspicious sign-in attempts based on risk. Option B is wrong because Microsoft Entra ID Governance focuses on managing identity lifecycles, access reviews, and entitlement management, not on detecting or blocking risky sign-in events. Option D is wrong because Conditional Access enforces policies based on conditions like location or device compliance after a sign-in attempt is made, but it does not inherently analyze risk signals to automatically block suspicious attempts; it typically relies on risk assessments from Entra ID Protection.

Practice this question →

279

MCQeasy

Your company wants to allow partners to use their own corporate credentials to access a specific SharePoint site. Which Microsoft Entra ID feature supports this?

A.App Registrations

B.B2C collaboration

C.Device Registration

D.B2B collaboration

AnswerD

Microsoft Entra B2B collaboration is the correct solution, enabling organizations to securely share applications and resources with external users from partner companies. It allows these invited guest users to sign in using their existing corporate credentials from their home directory (e.g., another Microsoft Entra tenant, a federated identity provider, or even social identities), eliminating the need for partners to create new accounts in the inviting tenant. This streamlines access while maintaining security and partner identity management.

Why this answer

Microsoft Entra ID B2B (business-to-business) collaboration allows you to invite external users from partner organizations to access your company's resources, such as SharePoint sites, using their own corporate credentials. This feature supports identity federation with the partner's Azure AD or other identity providers, enabling seamless single sign-on (SSO) without requiring the partner users to create new accounts in your tenant.

Exam trap

The trap here is that candidates often confuse B2B collaboration (for partner organizations with existing corporate identities) with B2C collaboration (for consumers using social or local accounts), leading them to select the wrong option when the question specifies 'partners' and 'corporate credentials'.

How to eliminate wrong answers

Option A is wrong because App Registrations are used to register and configure applications that integrate with Microsoft Entra ID for authentication and authorization, not to grant external users access to resources like SharePoint. Option B is wrong because B2C collaboration (Azure AD B2C) is designed for customer-facing applications where users sign up with social or local identities, not for partner organizations using their corporate credentials. Option C is wrong because Device Registration is used to register devices (e.g., Windows, iOS, Android) for management and conditional access policies, not to enable external user access to SharePoint.

Practice this question →

280

MCQmedium

A company uses Microsoft Entra ID and Intune to manage devices. They want to enforce a policy that allows access to financial data from SharePoint Online only when the user's device is compliant (e.g., encrypted, patched) AND the user authenticates from a trusted IP address range. Additionally, if the sign-in risk is assessed as medium or high by Identity Protection, the user must also perform multifactor authentication (MFA). Which Conditional Access components should the administrator configure?

A.Configure conditions for sign-in risk and locations, and use Grant controls to require MFA and device compliance.

B.Configure a session control to require device compliance and an assignment for sign-in risk to trigger MFA.

C.Use Microsoft Entra ID Protection to automatically enforce MFA and device compliance for all users regardless of location.

D.Configure a compliance policy in Intune and link it directly to SharePoint Online to block non-compliant devices.

AnswerA

This correctly identifies that conditions (sign-in risk and locations) are used to define when the policy applies, and Grant controls enforce the requirements. The Grant control 'Require all the selected controls' can combine device compliance and MFA.

Why this answer

Conditional Access in Microsoft Entra ID allows combining multiple conditions (sign-in risk, locations) with grant controls (require MFA, require device compliance) to enforce the described policy. The administrator configures conditions for sign-in risk (medium/high) and locations (trusted IP range), then uses Grant controls to require MFA and device compliance, ensuring access is allowed only when all requirements are met.

Exam trap

The trap here is confusing session controls with grant controls, leading candidates to incorrectly select Option B, which misassigns device compliance as a session control instead of a grant control.

How to eliminate wrong answers

Option B is wrong because session controls (e.g., app enforced restrictions) cannot require device compliance; device compliance is a grant control, not a session control, and sign-in risk is a condition, not an assignment. Option C is wrong because Microsoft Entra ID Protection does not automatically enforce MFA and device compliance for all users regardless of location; it provides risk detection but relies on Conditional Access policies to apply controls. Option D is wrong because Intune compliance policies cannot be linked directly to SharePoint Online to block non-compliant devices; they require Conditional Access to enforce access restrictions based on compliance status.

Practice this question →

281

MCQeasy

A company wants to allow employees to access corporate resources such as email and internal apps using their personal smartphones. The IT team does not want to fully manage or domain-join these devices but needs each device to have a simple identity that links the user's work account to the device. Which Microsoft Entra ID device identity option should they implement?

A.Microsoft Entra ID Registered

B.Microsoft Entra ID Joined

C.Hybrid Microsoft Entra ID Joined

D.Active Directory Joined

AnswerA

This option is specifically designed for Bring Your Own Device (BYOD) scenarios, allowing personal devices to establish a device identity in Microsoft Entra ID. It enables employees to securely access corporate resources, such as email and applications, through conditional access policies without the organization taking full management control of the device. The device is recognized and trusted, but not fully managed, making it ideal for personal devices.

Why this answer

Microsoft Entra ID supports three device identity options: Registered, Joined, and Hybrid Joined. Microsoft Entra ID Registered is designed for 'bring your own device' (BYOD) scenarios. A registered device is known to Azure AD but not fully managed; it simply links the user's work account to the device, often enabling single sign-on and conditional access.

Microsoft Entra ID Joined is for corporate-owned devices that are managed by MDM. Hybrid Joined requires an on-premises Active Directory. Active Directory Joined is a traditional on-premises domain join, not a cloud identity option.

Why the other options are wrong

Hybrid Microsoft Entra ID Joined requires devices to be domain-joined and managed by on-premises AD with synchronization to Entra ID, which contradicts the requirement to avoid full management or domain-joining of personal smartphones.

Active Directory Joined requires devices to be domain-joined to an on-premises Active Directory, which involves full management and does not support personal smartphones that are not domain-joined. The question specifies that devices should not be fully managed or domain-joined.

Practice this question →

282

MCQmedium

An organization uses Microsoft Entra ID. The security team wants to require multi-factor authentication (MFA) for all users accessing sensitive data from outside the corporate network. Which Microsoft Entra capability should they configure?

A.Conditional Access

B.B2B Collaboration

C.Privileged Identity Management

D.Identity Protection

AnswerA

Conditional Access policies evaluate real-time signals such as user location and network IP address, enabling the security team to enforce MFA specifically when access originates from outside the corporate network. This satisfies the stem’s constraint of restricting MFA to external access only, without affecting internal users. Unlike baseline or per-user MFA, Conditional Access provides granular, context-aware control based on the network location condition.

Why this answer

Conditional Access is the correct capability because it allows administrators to define policies that enforce MFA based on specific conditions, such as network location. By configuring a policy that targets all users and applies the 'Require multi-factor authentication' grant control when the location is outside the corporate network, the security team can precisely meet the requirement. This policy evaluates the user's IP address against named locations defined in Entra ID before granting access to sensitive data.

Exam trap

The trap here is that candidates often confuse Identity Protection's risk-based MFA trigger with the ability to enforce MFA based on a static network location, but Identity Protection only responds to risk events and does not allow direct configuration of location-based conditions.

How to eliminate wrong answers

Option B (B2B Collaboration) is wrong because it is designed for inviting external users (guests) from partner organizations, not for enforcing MFA on internal users based on network location. Option C (Privileged Identity Management) is wrong because it focuses on just-in-time privileged role activation and approval workflows, not on location-based MFA enforcement for all users. Option D (Identity Protection) is wrong because it detects and remediates risks like leaked credentials or sign-ins from anonymous IPs, but it does not directly enforce MFA based on a static network boundary; it can trigger MFA via Conditional Access policies but is not the capability that configures the location condition itself.

Practice this question →

283

MCQmedium

A company has an on-premises Active Directory and wants to synchronize user accounts to Microsoft Entra ID. They also need to enable password hash synchronization so users can sign in to cloud resources with the same password. Which Microsoft tool should they use?

A.Microsoft Entra Connect

B.Microsoft Entra ID Application Proxy

C.Microsoft Identity Manager

D.Microsoft Entra Domain Services

AnswerA

Microsoft Entra Connect is the essential Microsoft tool designed to achieve hybrid identity goals by synchronizing users, groups, and contacts from an on-premises Active Directory to Microsoft Entra ID. It facilitates various synchronization features, including password hash synchronization (PHS), pass-through authentication (PTA), and federation with Active Directory Federation Services (AD FS). PHS, enabled by default, securely synchronizes a hash of the user's password hash, allowing users to sign in to cloud services with their on-premises credentials.

Why this answer

Microsoft Entra Connect is the correct tool because it is specifically designed to synchronize on-premises Active Directory user accounts to Microsoft Entra ID and supports password hash synchronization (PHS). PHS enables users to sign in to cloud resources using the same password as their on-premises environment by synchronizing a hash of the password hash to Entra ID.

Exam trap

The trap here is that candidates may confuse Microsoft Entra Connect with Microsoft Identity Manager (MIM), but MIM is a legacy tool for on-premises identity management and does not natively support password hash synchronization to Microsoft Entra ID.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra ID Application Proxy provides secure remote access to on-premises web applications, not directory synchronization or password hash sync. Option C is wrong because Microsoft Identity Manager (MIM) is an on-premises identity management solution for managing identities across heterogeneous directories, but it is not the primary tool for synchronizing to Microsoft Entra ID and does not natively enable password hash synchronization to Entra ID. Option D is wrong because Microsoft Entra Domain Services provides managed domain services (e.g., Kerberos, LDAP) for cloud VMs, not user account synchronization or password hash sync from on-premises Active Directory.

Practice this question →

284

MCQmedium

A company needs to grant IT administrators temporary and time-limited access to privileged roles in Microsoft Entra ID (Azure AD). The access must require approval from a manager and be automatically revoked after the task is completed. Which Microsoft Entra ID feature should be used?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management (PIM)

D.Entitlement Management

AnswerC

Azure AD Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources in Azure AD, Azure, and other Microsoft services. It enables just-in-time (JIT) access, allowing administrators to activate privileged roles only when needed, for a specific, time-limited duration. This includes features like multi-factor authentication (MFA) enforcement during activation, approval workflows, and comprehensive audit logs, directly fulfilling the requirement for temporary and time-limited administrative access.

Why this answer

Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access by allowing administrators to activate eligible role assignments for a limited duration. It supports approval workflows (e.g., manager approval) and automatically deactivates the role when the activation time expires or the task is completed, meeting the requirement for temporary, time-limited, approved, and auto-revoked access.

Exam trap

The trap here is confusing Entitlement Management (which manages access packages for non-privileged resources) with PIM (which specifically handles time-limited privileged role activation with approval), leading candidates to choose D because they see 'approval' and 'temporary access' without recognizing the privileged role context.

Why the other options are wrong

Conditional Access enforces access policies based on signals like user location or device state, but it does not provide time-limited, approval-based activation of privileged roles or automatic revocation.

Identity Protection is designed to detect and respond to identity-based risks, such as compromised credentials or suspicious sign-ins, not to manage time-limited privileged role assignments with approval workflows.

Entitlement Management manages access packages and resource access requests, but it does not provide time-limited, automatically revoked privileged role assignments with manager approval; PIM handles just-in-time privileged role activation.

Practice this question →

285

MCQhard

You are the identity administrator for Contoso Ltd., a global company with over 10,000 employees. The company uses Microsoft Entra ID P2 and Microsoft Intune. Employees use both company-owned and personal devices. The security team requires that all access to corporate applications be protected with multifactor authentication (MFA). However, to minimize user friction, they want to exempt MFA for users who are on the corporate network and using compliant devices. Additionally, for users with privileged roles (e.g., Global Administrator), MFA must always be required regardless of location or device. You need to configure a Conditional Access policy to meet these requirements. Which of the following approaches should you take?

A.Create two Conditional Access policies: Policy 1 targets all users except privileged roles, requires MFA, and excludes trusted locations and compliant devices. Policy 2 targets privileged roles and requires MFA with no exclusions.

B.Create one Conditional Access policy that targets all users and requires MFA. Create a second policy that targets privileged roles and excludes trusted locations.

C.Create one Conditional Access policy that targets all users, requires MFA, and excludes trusted locations and compliant devices. Do not create any additional policies.

D.Create one Conditional Access policy that targets all users and requires MFA. Use Microsoft Intune compliance policies to exempt compliant devices from MFA.

AnswerA

This solution correctly implements a layered security approach using two distinct Conditional Access policies. Policy 1 ensures that standard users require Multi-Factor Authentication (MFA) but allows for usability by excluding trusted locations and compliant devices. Policy 2 specifically targets privileged roles, enforcing MFA without any exclusions, thereby guaranteeing that these high-impact accounts always face the strongest authentication challenge, regardless of their location or device compliance status. This design effectively balances security for privileged identities with user experience for general users.

Why this answer

It uses two separate Conditional Access policies to handle the two distinct user groups. Policy 1 targets all users except privileged roles, requires MFA, and excludes trusted locations and compliant devices, which satisfies the requirement to minimize friction for users on the corporate network with compliant devices. Policy 2 targets privileged roles and requires MFA with no exclusions, ensuring that Global Administrators and other privileged role members always must perform MFA regardless of location or device compliance.

Exam trap

The trap here is that candidates often think a single policy with exclusions can handle all users, forgetting that privileged roles require unconditional MFA, which necessitates a separate policy with no exclusions to override the more permissive exclusions applied to regular users.

How to eliminate wrong answers

Option B is wrong because it creates a second policy that targets privileged roles and excludes trusted locations, which would exempt privileged role users from MFA when they are on the corporate network, violating the requirement that MFA must always be required for privileged roles. Option C is wrong because it creates only one policy targeting all users with exclusions for trusted locations and compliant devices, which would incorrectly exempt privileged role users from MFA when they meet those conditions. Option D is wrong because Intune compliance policies cannot be used to exempt devices from MFA in a Conditional Access policy; MFA enforcement is controlled by Conditional Access policies, not by compliance policies.

Practice this question →

286

MCQmedium

An organization needs to grant its IT administrators temporary access to the Global Administrator role. The access should require a separate approval from a designated manager before activation, and the permissions should automatically expire after 4 hours. Which Microsoft Entra ID feature should they configure?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management (PIM)

D.Access Reviews

AnswerC

Azure AD Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources within an organization. It enables just-in-time (JIT) access, allowing administrators to activate privileged roles only when needed and for a limited duration. This process often includes an approval workflow, multi-factor authentication, and automatic deactivation of the role after the specified time, directly addressing the requirement for temporary, controlled access.

Why this answer

Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access, allowing IT administrators to activate the Global Administrator role for a limited time (e.g., 4 hours) only after receiving approval from a designated manager. This directly meets the requirement for temporary, approval-based, and auto-expiring permissions.

Exam trap

The trap here is that candidates often confuse Privileged Identity Management (PIM) with Conditional Access, mistakenly thinking that Conditional Access can enforce time-limited role activation, when in fact PIM is the only feature that provides just-in-time privileged access with approval and automatic expiration.

Why the other options are wrong

Conditional Access enforces access policies based on signals like user location or device state, but it does not provide just-in-time role activation with approval and automatic expiry.

Access Reviews are used to audit and confirm the ongoing need for group memberships or role assignments, not to grant temporary, approval-based activation of privileged roles with automatic expiration.

Practice this question →

287

MCQmedium

Refer to the exhibit. You are reviewing Microsoft Entra role assignments for a user. The first assignment has a roleDefinitionId of '62e90394-69f5-4237-9190-012177145e10' at scope '/'. The second assignment has a roleDefinitionId of '194ae4cb-b126-40b2-bd5b-6091b380977d' at a subscription scope. What can you infer?

A.The user has the Global Administrator role at the tenant level.

B.The user can only read Azure AD objects.

C.The second role is assigned at the subscription scope.

D.The user is a Global Administrator with full access to all Azure AD and Azure resources.

AnswerA

Role ID 62e90394... is the Global Administrator role, assigned at tenant scope.

Why this answer

The roleDefinitionId '62e90394-69f5-4237-9190-012177145e10' corresponds to the Global Administrator role in Microsoft Entra ID. The scope '/' indicates the tenant root scope, meaning the assignment applies to the entire tenant. Therefore, the user is a Global Administrator at the tenant level, granting broad administrative access to Azure AD (Entra ID) resources.

However, Global Administrator does not automatically provide Azure RBAC roles for managing Azure resources; those require separate assignments.

Exam trap

The trap here is that candidates often assume the Global Administrator role automatically grants full access to all Azure resources, but in reality, Azure AD roles and Azure RBAC roles are separate authorization systems, and a Global Administrator must be explicitly assigned an Azure RBAC role (like Contributor or Owner) to manage Azure resources.

How to eliminate wrong answers

Option B is wrong because the Global Administrator role provides full read and write access to Azure AD objects, not just read-only. Option C is wrong because while the second assignment is indeed at a subscription scope, this is a true statement but does not address the question's inference about the user's overall role; the key inference is the Global Administrator role from the first assignment. Option D is wrong because although Global Administrators have full access to Azure AD, they do not automatically have full access to all Azure resources; access to Azure resources requires additional role assignments (e.g., Owner or Contributor) at the subscription or resource scope.

Practice this question →

288

MCQeasy

A company wants to provide secure external access to a partner application without creating user accounts manually. They need to allow partners to authenticate using their existing corporate identities (e.g., from other organizations) and configure policies for access. Which Microsoft Entra feature should they use?

A.Microsoft Entra Identity Protection

B.Microsoft Entra External ID (B2B collaboration)

C.Microsoft Entra Privileged Identity Management

D.Microsoft Entra Domain Services

AnswerB

Microsoft Entra External ID (B2B collaboration) is the correct solution as it specifically enables organizations to invite external users, such as partners, to access their applications and resources using their own existing identities. This feature integrates partner users into the inviting organization's Microsoft Entra tenant as guest users, allowing for the application of robust access policies and secure management of their access to partner applications.

Why this answer

Microsoft Entra External ID (B2B collaboration) allows organizations to securely share applications and resources with external partners by letting them authenticate using their own corporate identities (e.g., from other Azure AD tenants, Microsoft accounts, or social identity providers). It eliminates the need to manually create and manage user accounts for partners, while enabling you to apply conditional access policies for granular control over external access.

Exam trap

The trap here is that candidates often confuse B2B collaboration (External ID) with B2C (External Identities for customer-facing apps) or think that Privileged Identity Management is needed for external access, but the question specifically asks about allowing partners to use their existing corporate identities without manual account creation, which is the core purpose of B2B collaboration.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Identity Protection is a risk-based security tool that detects and responds to identity threats (e.g., leaked credentials, sign-in anomalies) for users within your tenant, not a feature for inviting external partners or federating with their existing identities. Option C is wrong because Microsoft Entra Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles within your own directory (e.g., just-in-time admin access), not for enabling external partner authentication or collaboration. Option D is wrong because Microsoft Entra Domain Services provides managed domain services (e.g., LDAP, Kerberos, NTLM) for legacy on-premises applications in the cloud, not for external identity federation or B2B guest access.

Practice this question →

289

MCQmedium

Your company uses Microsoft Entra ID. Security policy requires that all external guest users must be reviewed and their access approved by their sponsor every 90 days. If not approved, access should be automatically removed. Which feature should you use?

A.Microsoft Entra Conditional Access

B.Microsoft Entra B2B collaboration settings

C.Microsoft Entra entitlement management

D.Microsoft Entra access reviews

AnswerD

Microsoft Entra access reviews are specifically designed to enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments by scheduling periodic reviews. These reviews allow designated reviewers to confirm continued access necessity, and critically, they can be configured to automatically remove access for users who are not approved or whose review is not completed, directly addressing the requirement for periodic validation and automated revocation.

Why this answer

Microsoft Entra access reviews (Option D) allow you to configure recurring reviews of guest users' access, with automatic removal of access if not approved. This directly meets the requirement for a 90-day review cycle with automatic enforcement, as access reviews can be scoped to guest users and integrated with entitlement management or groups.

Exam trap

The trap here is that candidates confuse entitlement management (which creates access packages) with the actual review and removal mechanism, but access reviews are the specific feature that enforces periodic attestation and automatic cleanup.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Conditional Access controls access based on conditions like location or device state, but it does not provide periodic review or automatic removal of access based on approval. Option B is wrong because Microsoft Entra B2B collaboration settings manage invitation policies and external user properties, but they lack the recurring review and auto-removal workflow. Option C is wrong because Microsoft Entra entitlement management manages access packages and catalogs, but the actual review and removal process is implemented through access reviews, not entitlement management alone.

Practice this question →

290

MCQmedium

A company uses Microsoft Entra ID and wants to enforce multifactor authentication (MFA) for all users accessing a sensitive customer relationship management (CRM) application, but only when the access request originates from outside the corporate network. Which component of a Conditional Access policy should the administrator configure to specify this location-based requirement?

A.Assignments

B.Conditions

C.Grant controls

D.Session controls

AnswerB

Conditions are the "if" part of a Conditional Access policy, evaluating specific attributes of a sign-in attempt to determine if the policy applies. This includes critical contextual factors such as the user's sign-in risk level, the device platform being used, the client application, and crucially, the network location from which the access request originates. The location condition specifically allows administrators to define trusted or untrusted IP ranges, enabling enforcement based on geographic or network-specific access points.

Why this answer

The 'Conditions' section of a Conditional Access policy allows administrators to define the circumstances under which the policy is applied, including the location from which an access request originates. By configuring a location condition, you can specify that MFA is enforced only when users access the CRM application from outside the corporate network, using named locations or IP ranges. This is the correct component to enforce the location-based requirement.

Exam trap

The trap here is that candidates often confuse 'Assignments' (who/what) with 'Conditions' (when/where), mistakenly selecting Assignments because they think location is part of the user or app assignment, whereas Conditions specifically handle environmental factors like location, device state, and risk.

How to eliminate wrong answers

Option A is wrong because 'Assignments' define which users, groups, or applications the policy applies to, not the conditions under which it is triggered. Option C is wrong because 'Grant controls' specify what actions to take (e.g., require MFA, require compliant device) after the policy conditions are met, not the location condition itself. Option D is wrong because 'Session controls' manage session-level behaviors like app-enforced restrictions or sign-in frequency, not the location-based trigger for MFA enforcement.

Practice this question →

291

MCQeasy

A company uses Microsoft Entra ID. Employees often forget their passwords and contact the IT helpdesk to reset them. The company wants to reduce helpdesk costs by allowing users to reset their own passwords using a verified mobile phone number or email address. Which Microsoft Entra ID feature should the administrator enable?

A.Microsoft Entra ID Identity Protection

B.Self-Service Password Reset (SSPR)

C.Privileged Identity Management (PIM)

D.Conditional Access

AnswerB

Self-Service Password Reset (SSPR) is a crucial Microsoft Entra ID feature that empowers users to reset their forgotten passwords without requiring assistance from IT helpdesk staff. Users must pre-register at least two authentication methods, such as a mobile phone number or an alternate email address, which are then used to verify their identity during the reset process. This capability significantly reduces helpdesk call volumes and improves user productivity by enabling immediate password recovery.

Why this answer

Self-Service Password Reset (SSPR) is the correct feature because it allows users to reset their own passwords without helpdesk intervention, using a verified mobile phone number or email address as authentication methods. This directly reduces helpdesk costs by shifting password reset responsibility to the user, while maintaining security through verification of registered contact methods.

Exam trap

The trap here is that candidates often confuse Privileged Identity Management (PIM) with self-service password reset, because both involve 'management' of identities, but PIM is strictly for privileged role activation, not end-user password changes.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Identity Protection is a risk-based security tool that detects potential identity vulnerabilities and automated remediation, but it does not provide self-service password reset capabilities. Option C is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role activation and access reviews, not end-user password resets. Option D is wrong because Conditional Access enforces access policies based on signals like user location or device state, but it does not enable users to reset their own passwords.

Practice this question →

292

MCQmedium

A company uses Microsoft Entra ID to manage identities. They want to enforce access policies based on user location, device compliance, and application sensitivity. Which Microsoft Entra ID capability should they use?

A.Microsoft Entra ID Protection

B.Conditional Access

C.Privileged Identity Management (PIM)

D.Microsoft Entra Connect Sync

AnswerB

Conditional Access is the precise solution for defining and enforcing granular access policies based on a wide array of conditions. Administrators can configure policies that evaluate user attributes, device state (e.g., compliant vs. non-compliant), location, application being accessed, and sign-in risk. This allows for dynamic access control, enabling actions like requiring multi-factor authentication, blocking access, or allowing access only from managed devices, directly addressing the need for policy enforcement based on specific criteria.

Why this answer

Conditional Access is the correct capability because it allows administrators to create policies that enforce access controls based on conditions such as user location, device compliance, and application sensitivity. These policies evaluate signals at sign-in time and can require multi-factor authentication, block access, or grant limited access based on the defined conditions.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID Protection (which deals with risk detection) with Conditional Access (which enforces policies based on conditions like location and device compliance), but ID Protection does not directly enforce location- or device-based access rules.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Protection focuses on detecting and remediating identity-based risks (e.g., leaked credentials, anonymous IP addresses) and does not directly enforce policies based on device compliance or application sensitivity. Option C is wrong because Privileged Identity Management (PIM) provides just-in-time privileged access and role activation workflows, not location- or device-based access policies. Option D is wrong because Microsoft Entra Connect Sync is a tool for synchronizing on-premises directory objects to Entra ID and has no role in enforcing access policies.

Practice this question →

293

MCQeasy

A company wants to grant temporary, time-limited access to a critical Azure resource for an external consultant. Which Microsoft Entra feature should they use?

A.Entra Verified ID

B.Privileged Identity Management (PIM)

C.Identity Protection

D.Conditional Access

AnswerB

Microsoft Entra Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources by providing just-in-time (JIT) and just-enough-access (JEA) capabilities. It allows administrators to grant temporary, time-limited access to privileged roles, which can be activated on demand for a specified duration. This ensures that users only have elevated permissions when absolutely necessary, significantly reducing the attack surface.

Why this answer

Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure resources, allowing administrators to grant time-bound, temporary access that automatically expires. This aligns directly with the requirement for temporary, time-limited access for an external consultant, as PIM supports activation windows, approval workflows, and audit logging for such scenarios.

Exam trap

The trap here is that candidates often confuse Privileged Identity Management (PIM) with Conditional Access, thinking that Conditional Access can enforce time-limited access, but Conditional Access only controls sign-in conditions, not the duration of privileged role assignments.

How to eliminate wrong answers

Option A is wrong because Entra Verified ID is a decentralized identity verification solution using verifiable credentials (based on W3C standards) and does not provide time-limited access management to Azure resources. Option C is wrong because Identity Protection is a risk-detection and remediation service that identifies compromised identities or risky sign-ins, not a tool for granting or managing temporary access. Option D is wrong because Conditional Access enforces policies based on conditions like location or device state at sign-in time, but it does not grant or schedule time-limited privileged access to specific resources.

Practice this question →

294

MCQhard

Your organization uses Microsoft Entra ID Governance. You need to ensure that access to a critical application is reviewed every 90 days by the application owner. If the review is not completed, access should be revoked automatically. Which feature should you configure?

A.Terms of use

B.Access reviews

C.Privileged Identity Management

D.Entitlement management

AnswerB

Microsoft Entra ID Access Reviews are specifically designed to manage the lifecycle of access to resources, groups, and applications by enabling regular, scheduled reviews. Administrators can configure these reviews to recur periodically, assign reviewers, and set up automatic actions, such as revoking access for users who are not approved or whose review is not completed within a specified timeframe. This functionality directly addresses the requirement for recurring access validation and automated revocation.

Why this answer

Access reviews in Microsoft Entra ID Governance allow you to create recurring reviews of group memberships or application assignments, with automatic revocation of access if the review is not completed. By configuring a review every 90 days and setting the 'Auto apply' action to 'Remove access', you ensure that the application owner must certify access or it is automatically revoked.

Exam trap

The trap here is that candidates confuse Entitlement management (which handles access packages and lifecycle) with Access reviews (which specifically handle recurring attestation and automatic revocation), leading them to pick D instead of B.

How to eliminate wrong answers

Option A is wrong because Terms of use are used to present legal or policy documents that users must accept before accessing applications, not to schedule recurring access reviews with automatic revocation. Option C is wrong because Privileged Identity Management (PIM) is designed for just-in-time privileged role activation and approval workflows, not for recurring attestation of access to a critical application. Option D is wrong because Entitlement management handles access packages and automated provisioning/deprovisioning based on policies, but it does not provide the recurring review cycle with automatic revocation if the review is not completed; that is the specific function of Access reviews.

Practice this question →

295

MCQhard

A multinational company uses Microsoft Entra ID. They want to ensure that users from a specific country only access a sensitive application from compliant devices. Additionally, they want to block access if the sign-in risk is medium or high. Which combination of policies should they create?

A.A Conditional Access session policy to enforce sign-in frequency

B.A device compliance policy in Microsoft Intune

C.A Conditional Access policy requiring MFA from that country

D.A Conditional Access policy with conditions for location, device compliance, and sign-in risk

AnswerD

This Conditional Access policy effectively combines multiple critical signals to provide robust, risk-adaptive access control. By including conditions for location, device compliance, and sign-in risk (from Microsoft Entra ID Protection), it allows the system to evaluate the user's context comprehensively. This enables granular decisions, such as blocking access or requiring stronger authentication, specifically when a sign-in attempt is identified as risky based on these combined factors, directly addressing the company's security requirements.

Why this answer

A single Conditional Access policy can combine multiple conditions—such as location (country), device compliance (via integration with Intune), and sign-in risk—to enforce granular access controls. This allows the company to require compliant devices and block access when sign-in risk is medium or high, all within one policy.

Exam trap

The trap here is that candidates think they need separate policies for each condition (location, device compliance, risk), but Microsoft Entra ID allows combining all three conditions into a single Conditional Access policy, which is more efficient and aligns with the scenario's requirements.

How to eliminate wrong answers

Option A is wrong because sign-in frequency is a session control that re-prompts for authentication after a set time, not a condition to restrict access by location, device compliance, or risk. Option B is wrong because a device compliance policy in Intune defines compliance rules (e.g., encryption, OS version) but does not enforce access decisions or block based on sign-in risk; it only marks devices as compliant or non-compliant. Option C is wrong because requiring MFA from that country does not address device compliance or sign-in risk; it only adds an authentication step, not a block for medium/high risk or non-compliant devices.

Practice this question →

296

Multi-Selectmedium

Which THREE of the following are features of Microsoft Entra ID Protection?

Select 3 answers

A.Automatically notify users when their password is about to expire.

B.Ability to define risk-based Conditional Access policies.

C.Automated remediation of risky users by blocking sign-in.

D.Just-in-time privileged role activation.

E.Detection of sign-in risks from anonymous IP addresses.

AnswersB, C, E

This is a core security feature of Microsoft Entra ID Protection, which integrates seamlessly with Conditional Access. Entra ID Protection continuously assesses sign-in and user risks in real-time, allowing administrators to define Conditional Access policies that dynamically enforce controls like multi-factor authentication, password change, or access blocking based on the perceived risk level of an authentication attempt.

Why this answer

Microsoft Entra ID Protection provides risk detection signals that can be integrated into Conditional Access policies, enabling administrators to automatically enforce controls such as requiring multi-factor authentication or blocking access based on user or sign-in risk levels. This allows organizations to respond dynamically to detected threats without manual intervention.

Exam trap

The trap here is that candidates confuse the distinct Microsoft Entra services—Entra ID Protection (risk detection and remediation), Privileged Identity Management (PIM) for just-in-time access, and general password policy settings—leading them to select options that belong to other services.

Practice this question →

297

MCQmedium

Your company uses Microsoft Entra ID. You need to enable users to sign in to third-party SaaS applications using their corporate credentials without storing passwords in those apps. Which Microsoft Entra feature should you configure?

A.Configure single sign-on (SSO) using federation

B.Deploy Microsoft Entra Self-Service Password Reset

C.Configure conditional access policies with MFA

D.Enable Microsoft Entra Identity Protection

AnswerA

Configuring single sign-on (SSO) using federation establishes a trust relationship where Microsoft Entra ID acts as the identity provider. When users access an application, they are redirected to Entra ID for authentication. Upon successful verification, Entra ID issues a security token to the application, granting access without the application ever storing or directly handling the user's password, thereby centralizing authentication and eliminating application-specific credential storage.

Why this answer

Configuring single sign-on (SSO) using federation allows users to authenticate against Microsoft Entra ID (their corporate identity provider) and then pass a security token to third-party SaaS applications. This eliminates the need for the SaaS app to store or manage user passwords, as authentication happens via standards like SAML 2.0 or WS-Federation, and the app trusts the token issued by Entra ID.

Exam trap

The trap here is that candidates often confuse Conditional Access or Identity Protection with the core mechanism for passwordless federation, not realizing that SSO via federation is the specific feature that removes password storage in the third-party app.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra Self-Service Password Reset (SSPR) enables users to reset their own passwords, but it does not provide a mechanism to sign in to third-party SaaS apps without storing passwords in those apps. Option C is wrong because Conditional Access policies with MFA enforce additional security controls (like requiring multi-factor authentication) during sign-in, but they do not eliminate the need for password storage in the SaaS app itself. Option D is wrong because Microsoft Entra Identity Protection detects and responds to identity-based risks (e.g., leaked credentials, anomalous sign-ins), but it does not enable passwordless or federated authentication to third-party applications.

Practice this question →

298

MCQeasy

A company has a hybrid identity environment with Active Directory synchronizing to Microsoft Entra ID. They want users to be able to reset their own on-premises passwords via the cloud SSPR portal. What is the minimum license required for this capability?

A.Microsoft Entra ID Free

B.Microsoft Entra ID P1

C.Microsoft Entra ID P2

D.Microsoft 365 Business Basic

AnswerB

Microsoft Entra ID P1 is the minimum required license tier to enable Self-Service Password Reset (SSPR) with password writeback in a hybrid identity environment. This tier provides the necessary functionality to allow users to reset their passwords in the cloud, and then have those changes securely synchronized back to their corresponding accounts in the on-premises Active Directory. This ensures a consistent password across both environments and fulfills the requirements of the question.

Why this answer

Microsoft Entra ID P1 is the minimum license required for password writeback, which enables users to reset their on-premises Active Directory passwords via the cloud SSPR portal. This feature requires Microsoft Entra ID P1 or higher because it involves synchronizing password changes back to on-premises AD using Microsoft Entra Connect.

Exam trap

The trap here is that candidates often assume Microsoft Entra ID Free or a basic Microsoft 365 license is sufficient for SSPR, forgetting that password writeback to on-premises AD is a premium feature requiring at least P1.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Free does not include password writeback; it only supports cloud-only SSPR without on-premises writeback. Option C is wrong because Microsoft Entra ID P2 includes P1 features plus Identity Protection and Privileged Identity Management, but P1 already provides password writeback, so P2 is not the minimum. Option D is wrong because Microsoft 365 Business Basic includes Microsoft Entra ID Free, not P1, and thus lacks password writeback capability.

Practice this question →

299

MCQmedium

Your organization requires that all external guest users must sign in using Microsoft Authenticator for MFA. What should you configure?

A.Conditional Access policy

B.Microsoft Entra B2B collaboration settings

C.Access reviews

D.ID Protection policies

AnswerA

A Conditional Access policy is the definitive control plane in Microsoft Entra ID for enforcing specific access requirements, such as multi-factor authentication (MFA), based on various conditions. By targeting 'All guest and external users' and requiring MFA, organizations can ensure that all external collaborators must satisfy this strong authentication method before accessing resources, regardless of their home tenant's policies. This provides a robust security posture for external access by integrating MFA directly into the sign-in flow.

Why this answer

A Conditional Access policy is the correct choice because it allows you to enforce MFA requirements for specific users, including external guest users, based on conditions such as sign-in risk, location, or device state. By targeting the 'Guest or external users' directory role in a Conditional Access policy, you can require Microsoft Authenticator as the MFA method, overriding default settings. This provides granular control over authentication behavior for B2B collaboration guests.

Exam trap

The trap here is that candidates confuse the high-level B2B collaboration settings (which only control trust of MFA from the home tenant) with the ability to enforce a specific MFA method directly on guest users, which requires a Conditional Access policy.

How to eliminate wrong answers

Option B (Microsoft Entra B2B collaboration settings) is wrong because these settings control invitation, redemption, and cross-tenant access policies, but they do not directly enforce MFA methods like Microsoft Authenticator; they only set trust settings for MFA from the guest's home tenant. Option C (Access reviews) is wrong because access reviews are used to periodically review and recertify user access, not to enforce authentication methods or MFA requirements. Option D (ID Protection policies) is wrong because ID Protection policies focus on risk-based conditional access (e.g., sign-in risk, user risk) and can trigger MFA, but they do not allow you to specify a particular MFA method like Microsoft Authenticator; that is done via Conditional Access grant controls.

Practice this question →

300

MCQmedium

A company uses Microsoft Entra ID. The security team needs to block all sign-in attempts from a list of known malicious IP addresses. They also want to block sign-ins that originate from anonymous proxy services. Which Microsoft Entra capability should they configure to meet these requirements?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management

D.Access Reviews

AnswerA

Microsoft Entra Conditional Access is the primary policy engine within Microsoft Entra ID for enforcing access decisions based on various conditions, including user location. By configuring "named locations," administrators can define specific trusted or untrusted IP address ranges. A Conditional Access policy can then be created to explicitly block sign-in attempts originating from these designated malicious IP ranges or from anonymous IP addresses, directly addressing the requirement to prevent access from specific unwanted network origins.

Why this answer

Conditional Access policies in Microsoft Entra ID allow administrators to define conditions under which sign-ins are blocked or allowed. By configuring a policy that includes 'Locations' as a condition, you can specify a list of known malicious IP addresses and also enable the 'Anonymous IP address' risk detection to block sign-ins from anonymous proxy services. This directly meets the requirement to block sign-ins from both specific IPs and anonymous proxies.

Exam trap

The trap here is that candidates often confuse Identity Protection’s risk detection capabilities with the enforcement mechanism, mistakenly thinking Identity Protection alone can block sign-ins, when in fact it only identifies risks and requires Conditional Access to enforce the block.

How to eliminate wrong answers

Option B (Identity Protection) is wrong because Identity Protection is a risk-based detection and remediation service that identifies suspicious sign-ins (e.g., from anonymous IPs) but does not itself enforce blocking; it relies on Conditional Access policies to take action. Option C (Privileged Identity Management) is wrong because PIM focuses on just-in-time privileged role activation and access governance, not on blocking sign-ins based on IP address or proxy services. Option D (Access Reviews) is wrong because Access Reviews are used to periodically audit and certify user access to resources, not to block sign-ins in real time based on location or network characteristics.

Practice this question →