SIMULATION
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Microsoft 365 Username:
Microsoft 365 Password: =1122334455667788
If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 99999999
-
You need to create a group named Audit. The solution must ensure that the members of Audit can activate the Security Reader role.
To complete this task, sign in to the appropriate admin center.
Show Answer
Correct Answer: Microsoft Entra admin center
Create a new Security group named Audit with 'Microsoft Entra roles can be assigned to the group' = Yes.
Then in Privileged Identity Management (Microsoft Entra roles), assign the group as Eligible for the Security Reader role.
Explanation: A role-assignable group is required so members can activate the Security Reader role through PIM eligibility rather than receiving a permanent role assignment.
Question 103
SIMULATION
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Microsoft 365 Username:
Microsoft 365 Password: =1122334455667788
If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 99999999
-
You need to prevent all users from using passwords that are variations of the word Falcon.
To complete this task, sign in to the appropriate admin center.
Show Answer
Correct Answer: Microsoft Entra admin center
Entra ID → Authentication methods → Password protection
Enable Enforce custom list
Add: Falcon to the Custom banned password list
Explanation: Use Microsoft Entra Password Protection with a custom banned password entry so variations of 'Falcon' are blocked for all users.
Question 104
SIMULATION
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Microsoft 365 Username:
Microsoft 365 Password: =1122334455667788
If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 99999999
-
You need to ensure the owner of each Microsoft 365 group is notified to renew their group every 180 days. Groups that are NOT renewed must be deleted. For groups without an owner, the notifications must be sent to Allan Deyoung.
To complete this task, sign in to the appropriate admin center.
Show Answer
Correct Answer: Microsoft Entra admin center → Groups → Expiration
Set Group lifetime: 180 days
Apply to: All Microsoft 365 groups
Email contact for groups with no owners: Allan Deyoung
Save
Explanation: Configure the Microsoft 365 Groups expiration policy in Microsoft Entra ID so owners receive renewal notifications every 180 days, unrenewed groups are deleted, and notifications for ownerless groups go to the specified contact.
Question 105
HOTSPOT
-
You have an Azure subscription named Sub1 that contains the resources shown in the following table.
Sub1 contains the managed identities shown in the following table.
Sub1 has the role-based access control (RBAC) role assignments shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
Yes
Yes
Explanation: RBAC scope inherits downward. Identity1 has access only in RG2 while Vault1 is in RG1, so Automation1 cannot access Vault1. Identity2 is the system-assigned identity of Automation2 and has the Key Vault Secrets User role at the subscription scope, which includes Vault1. Identity3 is the system-assigned identity of VM1 and has the role at RG1, which contains Vault1.
Question 106
HOTSPOT
-
You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains the identities shown in the following table.
The tenant is onboarded to Permissions Management.
You create the Azure resources shown in the following table.
From Microsoft Entra Insights, which identity will be included in Accounts assigned to highly privileged roles, and which identity will be included in Service principals with privileged role assignments?
Show Answer
Correct Answer: Accounts assigned to highly privileged roles: Group2
Service principals with privileged role assignments: Managed2
Explanation: Highly privileged roles in Entra Insights include roles such as Exchange Administrator, while Global Administrator is reviewed separately. For service principals, Cloud Application Administrator is included in the privileged role assignments review; Azure RBAC Owner and Security Operator are not part of this specific Entra role list.
Question 107
You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users.
From the Groups blade in the Microsoft Entra admin center, you assign Microsoft Office 365 Enterprise E5 licenses to a group that includes all users.
You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort.
What should you use?
A. the Set-MgUserLicense cmdlet
B. the Identity Governance blade in the Microsoft Entra admin center
C. the Groups blade in the Microsoft Entra admin center
D. the Update-MgGroup cmdlet
Show Answer
Correct Answer: A
Explanation: Group-based licensing can assign the new E5 license efficiently, but removing existing licenses that were assigned directly to individual users requires removing the direct user license assignment. The Set-MgUserLicense cmdlet is designed to add and remove directly assigned licenses for users and can be scripted to update all 2,500 users with minimal administrative effort. The Groups blade manages group-based license assignments, not bulk removal of existing direct user license assignments. Identity Governance and Update-MgGroup are not used for this task.
Question 108
HOTSPOT -
You have a Microsoft 365 E5 subscription that contains two attribute sets named Set1 and Set2. The subscription contains the users shown in the following table.
You have the custom security attributes shown in the following table.
You assign User2 the Attribute Definition Administrator role for Set1.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
No
Yes
Explanation: Global Administrator alone cannot manage custom security attribute definitions. Attribute Definition Administrator manages definitions, not attribute values on users. Attribute Assignment Administrator can view and manage assigned custom security attribute values for all users.
Question 109
You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users.
From the Groups blade in the Microsoft Entra admin center, you assign Microsoft Office 365 Enterprise E5 licenses to a group that includes all users.
You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort.
What should you use?
A. the Identity Governance blade in the Microsoft Entra admin center
B. the Update-MgGroup cmdlet
C. the Set-MgUserLicense cmdlet
D. the Administrative units blade in the Microsoft Entra admin center
Show Answer
Correct Answer: C
Explanation: To remove directly assigned Microsoft 365 E3 licenses from users after assigning an E5 license via group-based licensing, use the Set-MgUserLicense cmdlet. This cmdlet is designed to add and remove user license assignments. The other options do not remove user license assignments at scale.
Question 110
HOTSPOT -
Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains computers that run Windows 11.
You have a Microsoft 365 E5 subscription.
You plan to enable hybrid join and enroll the computers in Microsoft Intune.
You need to recommend the software that should be deployed to the domain, and the actions that should be performed in Intune.
What should you include in the recommendation? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Domain: Microsoft Entra Connect
Intune: Modify the mobile device management (MDM) user scope
Explanation: Hybrid Microsoft Entra join for existing AD DS devices requires Microsoft Entra Connect to synchronize/device registration. Automatic Intune enrollment is enabled by configuring the MDM user scope. The Intune Connector for Active Directory is used for Windows Autopilot hybrid deployment, which is not stated here.
Question 112
You have an Azure subscription that contains the resources shown in the following table.
You need to grant permissions to the resources by using attribute-based access control (ABAC).
To which resource can you grant permissions?
A. Vault1
B. VM1
C. App1
D. Storage1
Show Answer
Correct Answer: D
Explanation: Azure ABAC role assignment conditions are currently supported for Azure Storage data access, specifically Blob and Queue Storage data actions. They are not generally available for Azure VMs, App Service, or Azure Key Vault role assignments in this context. Therefore, the storage account is the resource to which you can grant permissions using ABAC.
$19
Get all 387 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.