HOTSPOT
-
You have a Microsoft 365 E5 subscription.
You need to configure Privileged Identity Management (PIM) for the User Administrator role in Microsoft Entra. Eligible users must meet the following requirements:
• Always be able to request the User Administrator role
• Must provide a reason when requesting the User Administrator role
• Must require multi-factor authentication (MFA) when activating the User Administrator role
The solution must minimize administrative effort.
How should you configure the Role settings for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Always be able to request the User Administrator role:
Set Allow permanent eligible assignment to Yes.
Must provide a reason when requesting the User Administrator role:
Select Require justification on activation.
Must require MFA when activating the User Administrator role:
Set On activation require Azure MFA.
Explanation: Permanent eligible assignment ensures users can always request activation without approvals. Requiring justification enforces a reason during activation. Requiring Azure MFA on activation enforces MFA at the moment the role is activated, minimizing extra administrative configuration.
Question 151
Your network contains an Active Directory domain named adatum.com that is synced to a Microsoft Entra tenant.
The domain contains 100 user accounts.
The city attribute for all the users is set to the city where the user resides.
You need to modify the value of the city attribute to the three-letter airport code of each city.
What should you do?
A. From Windows PowerShell on a domain controller, run the Get-ADUser and Set-ADUser cmdlets.
B. From Azure Cloud Shell, run the Get-MgUser and Update-MgUser cmdlets.
C. From the Microsoft Entra admin center, select all the Microsoft Entra users, and then use the User settings blade.
D. From the Microsoft 365 admin center, select the users, and then use the Bulk actions option.
Show Answer
Correct Answer: A
Explanation: The users are synchronized from an on-premises Active Directory domain to Microsoft Entra ID. For synced objects, authoritative attribute changes must be made in on-premises AD, not in the cloud. Using the Get-ADUser and Set-ADUser cmdlets on a domain controller allows bulk modification of the city attribute, after which the updated values will sync to Microsoft Entra ID.
Question 152
You have a Microsoft 365 E5 subscription.
From the Microsoft 365 Defender portal, you review your company’s Microsoft Secure Score.
You discover a large number of recommended actions.
You need to ensure that the actions can be filtered based on specific department names.
What should you create first?
A. a dynamic security group
B. a tag
C. an administrative unit
D. a custom detection rule
Show Answer
Correct Answer: B
Explanation: Microsoft Secure Score recommendations in the Microsoft 365 Defender portal can be filtered using tags. By creating a tag and assigning it to specific Secure Score recommendations, the tag name becomes available as a filter, allowing you to view and manage actions by department. Dynamic groups, administrative units, and custom detection rules do not provide filtering capabilities within Secure Score recommendations.
Question 153
HOTSPOT
-
You have a Microsoft 365 E5 subscription.
You need to create a Conditional Access policy that will require the use of FIDO2 security keys only when users join their Windows devices to Microsoft Entra ID.
How should you configure the policy? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Target resources: Cloud apps
Conditions: Device platforms
Grant access: Require device to be marked as compliant
Explanation: Device join is evaluated through access to cloud apps during the join process. Targeting Cloud apps with a Windows device platform condition allows control at join time, and requiring the device to be marked as compliant enforces strong authentication (such as FIDO2) via device compliance and authentication strength policies.
Question 154
HOTSPOT
-
You have a Microsoft 365 subscription.
You plan to update the EmployeeType attribute for all the users in a group named Contractors. You retrieve the GroupId value of the Contractors group.
You need to use Microsoft Graph PowerShell to retrieve all the Contractors group users and set their EmployeeType attribute to Part-time.
How should you complete the PowerShell script? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: Use Get-MgGroupMember with the GroupId to enumerate users in the Contractors group. Update user properties via Update-MgUser, which identifies the target user by -UserId when setting the EmployeeType attribute.
Question 155
HOTSPOT
-
You have a Microsoft 365 subscription that contains two administrative units named AU1 and AU2.
The subscription contains the users shown in the following table.
The subscription contains the groups shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
Yes
No
Explanation: User1 is a User Administrator scoped to AU1, which allows password resets for users in AU1, including User2 as shown in the scenario.
User2 is a Global Administrator with tenant-wide permissions and can modify group membership in any administrative unit, including Group1 in AU2.
User3 is not within User1’s effective administrative scope for password reset, so User1 cannot reset User3’s password.
Question 156
HOTSPOT
-
You have a Microsoft 365 subscription.
You need to identify all users that have an Enterprise Mobility + Security plan, and then provide a list of the users in the CSV format.
Which settings should you use in the Microsoft 365 admin center, and which option should you select? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: In the Microsoft 365 admin center, the Licenses section lets you select a specific subscription such as Enterprise Mobility + Security and export the list of assigned users as a CSV file.
Question 158
HOTSPOT
-
You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Office 365.
You need to automate Attack simulation training for users when a phishing campaign is detected in real-time.
Which type of automation should you use, and which condition should you configure for the Attack simulation training? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: Payload automation supports real-time triggers from detected phishing campaigns. Credential Harvest is the appropriate condition to launch training when credential phishing is identified.
Question 159
You have a Microsoft 365 subscription that uses Microsoft 365 Defender.
You need to compare your company's security configurations to Microsoft best practices and review improvement actions to increase the security posture.
What should you use?
A. Microsoft Secure Score
B. Cloud discovery
C. Exposure distribution
D. Threat tracker
E. Exposure score
Show Answer
Correct Answer: A
Explanation: Microsoft Secure Score compares your Microsoft 365 security configuration against Microsoft best practices and provides actionable improvement recommendations to increase your overall security posture.
Question 160
DRAG DROP
-
You have an Azure subscription that is linked to a hybrid Microsoft Entra tenant.
All users sync from Active Directory Domain Services (AD DS) to the tenant by using Express Settings in Microsoft Entra Connect.
You plan to implement self-service password reset (SSPR).
You need to ensure that when a user resets or changes a password, the password syncs with AD DS.
Which actions should you perform in sequence? To answer, drag the appropriate actions to the correct order. Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Step 1: From the Microsoft Entra admin center, configure the registration settings for SSPR.
Step 2: Select Password writeback in Microsoft Entra Connect.
Step 3: From the Microsoft Entra admin center, configure on-premises integration password writeback.
Explanation: SSPR must be enabled and users allowed to register first. Password writeback is then enabled in Microsoft Entra Connect to allow synchronization back to AD DS. Finally, on‑premises integration password writeback is configured in the Microsoft Entra admin center to complete and manage the writeback integration.
$19
Get all 417 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
