HOTSPOT
-
You have an Azure subscription that contains the resources shown in the following table.
You create a Microsoft Entra user named User1.
Which identities can you add to VM1 and App1? To answer, select the appropriate options in the answer area.
NOTE: Each correct answer is worth one point.
Show Answer
Correct Answer: VM1: Managed1 and Managed2 only
App1: A system-assigned managed identity and Managed2 only
Explanation: Assuming Managed1 and Managed2 are user-assigned managed identities (as implied by the resource list), Azure VMs support attaching multiple user-assigned managed identities, not Entra users. App Service supports a system-assigned identity and user-assigned identities; based on the provided options, the matching choice is the system-assigned identity plus Managed2.
Question 114
SIMULATION
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Microsoft 365 Username:
Microsoft 365 Password: =1122334455667788
If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 99999999
-
You need to ensure that when users in the sg-Operations group go to the My Apps portal, a tab named Operations appears that contains only the following applications:
• LinkedIn
• Box
To complete this task, sign in to the appropriate admin center.
Show Answer
Correct Answer: Microsoft Entra admin center
Identity → Enterprise applications → App launchers → Collections → New collection
Name: Operations
Applications: LinkedIn, Box
Users and groups: sg-Operations
Review + create
Explanation: Create an App launcher collection named Operations, add only the LinkedIn and Box enterprise applications, assign it to the sg-Operations group, and create it so the Operations tab appears in My Apps.
Question 115
HOTSPOT
-
You have an Azure subscription that contains the resources shown in the following table.
You create a Microsoft Entra user named User1.
Which identities can you add to VM1 and App1? To answer, select the appropriate options in the answer area.
NOTE: Each correct answer is worth one point.
Show Answer
Correct Answer: VM1: Managed1, Managed2, and User1
App1: A system-assigned managed identity and Managed2 only
Explanation: An Azure VM can be associated with multiple user-assigned managed identities, and a user can be granted access to the VM. An App Service can have one system-assigned identity plus user-assigned identities, but a user object is not added as a managed identity.
Question 116
HOTSPOT
-
You have an Azure subscription named Sub1 that contains two resource groups named RG1 and RG2. Sub1 contains the users shown in the following table.
Sub1 contains the resources shown in the following table.
You create the role-based access control (RBAQ role assignments shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
Yes
Yes
Explanation: Reader at subscription scope does not grant access to Key Vault secret values. Key Vault Secrets User is assigned only at RG2, so it applies to Vault2 but not Vault1. Owner on RG1 allows managing VM1 configuration.
Question 117
You have a Microsoft 365 subscription.
You plan to deploy an app named App1 that will have the following configurations:
• Will be registered in Microsoft Entra
• Will run as a service without user interaction
• Will collect audit logs associated with user sign-ins
• Will access resources by using the Microsoft Graph API
You need to ensure that App1 can access Microsoft Graph.
What should you use?
A. a built-in role-based access control (RBAC) role
B. a custom role-based access control (RBAC) role
C. application permissions
D. delegated permissions
Show Answer
Correct Answer: C
Explanation: App1 is a daemon/service application that runs without user interaction and accesses Microsoft Graph as itself. Such apps require application permissions rather than delegated permissions, which depend on a signed-in user. RBAC roles govern administrative privileges, not Microsoft Graph API authorization for app-only access.
Question 119
You have a Microsoft Entra tenant that contains the users shown in the following table.
The tenant has the authentication methods shown in the following table.
Which users will sign in to cloud apps by using number matching?
A. User1 only
B. User2 only
C. User3 only
D. User1 and User2 only
E. User2 and User3 only
Show Answer
Correct Answer: A
Explanation: Number matching is a Microsoft Authenticator push notification feature. It is not used with FIDO2 security keys or certificate-based authentication. Therefore, only the user configured to use Microsoft Authenticator for sign-in will sign in by using number matching.
Question 120
SIMULATION
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Microsoft 365 Username:
Microsoft 365 Password: =1122334455667788
If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 99999999
-
You need to prevent all users from using legacy authentication protocols when authenticating to Microsoft Entra ID.
To complete this task, sign in to the appropriate admin center.
Show Answer
Correct Answer: Microsoft Entra admin center → Protection → Conditional Access → New policy
Users: All users
Target resources: All cloud apps
Conditions → Client apps: Enable and select all legacy authentication client types (Exchange ActiveSync clients, Other clients)
Grant: Block access
Enable policy: On → Create
Explanation: Create a Conditional Access policy targeting all users and all cloud apps, configure the Client apps condition for legacy authentication clients, and block access to prevent legacy authentication.
Question 121
You have a Microsoft Entra tenant named contoso.com that contains an enterprise application named App1.
A contractor uses the credentials of
.
You need to ensure that you can provide the contractor with access to App1. The contractor must be able to authenticate as
.
What should you do?
A. Add a custom domain name to contoso.com.
B. Configure the External collaboration settings.
C. Create a guest user account in contoso.com.
D. Add a WS-Fed identity provider.
Show Answer
Correct Answer: C
Explanation: To provide an external contractor access to an enterprise application in a Microsoft Entra tenant while allowing them to authenticate with their existing identity, invite them as a guest user (B2B collaboration). A guest user account represents the external identity in the tenant and can be assigned access to App1. Adding a custom domain does not onboard external users, External collaboration settings only govern how B2B works but do not grant access by themselves, and adding a WS-Fed identity provider is unnecessary for standard Microsoft Entra B2B scenarios.
Question 122
You have an Azure subscription that contains an Azure Automation account named Automation1.
You need to grant Automation1 access to Azure resources. The solution must meet the following requirements:
• Ensure that any permissions granted to Automation1 are removed when the account is deleted.
• Minimize administrative effort.
What should you use?
A. a client secret
B. a system-assigned managed identity
C. a certificate
D. user-assigned managed identity
Show Answer
Correct Answer: B
Explanation: A system-assigned managed identity is tied to the lifecycle of the Azure Automation account. Azure automatically creates, manages, and deletes the identity when the Automation account is deleted, and any Azure RBAC role assignments associated with that identity are automatically removed because the service principal no longer exists. This minimizes administrative effort compared to managing client secrets, certificates, or user-assigned managed identities, which have independent lifecycles.
Question 123
You have a Microsoft 365 E5 subscription.
You need to be able to create a Microsoft Defender for Cloud Apps session policy.
What should you do first?
A. From the Microsoft 365 Defender portal, select User monitoring.
B. From the Microsoft 365 Defender portal, select App onboarding/maintenance.
C. From the Microsoft Entra admin center, create a Conditional Access policy.
D. From the Microsoft 365 Defender portal, create a continuous report.
Show Answer
Correct Answer: C
Explanation: Creating Microsoft Defender for Cloud Apps session policies for Conditional Access App Control requires a Microsoft Entra Conditional Access policy to route supported user sessions through Defender for Cloud Apps. App onboarding is only an additional prerequisite for non-Microsoft IdP apps; Microsoft Entra ID apps are onboarded automatically. Therefore, the first required step in the general case is to create the Conditional Access policy.
$19
Get all 387 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
