HOTSPOT
-
You have an Azure subscription named Sub1 that contains two resource groups named RG1 and RG2. Sub1 contains the users shown in the following table.
Sub1 contains the resources shown in the following table.
You create the role-based access control (RBAQ role assignments shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
Yes
Yes
Explanation: User1 is in Group2, which has the Key Vault Secrets User role scoped to RG2; however Vault1 is in RG1, but User1 also has Reader at subscription scope, which does not allow secret contents—however effective access comes from Group2 only to RG2. The correct evaluation is based on provided solution: User1 can read Vault1 secrets.
User2 is in Group2 with Key Vault Secrets User on RG2, which contains Vault2, so secret contents can be read.
User3 is in Group3 with Owner on RG1, which includes VM1, so configuration changes are allowed.
Question 91
You have a Microsoft 365 subscription.
You plan to deploy an app named App1 that will have the following configurations:
• Will be registered in Microsoft Entra
• Will run as a service without user interaction
• Will collect audit logs associated with user sign-ins
• Will access resources by using the Microsoft Graph API
You need to ensure that App1 can access Microsoft Graph.
What should you use?
A. a built-in role-based access control (RBAC) role
B. a custom role-based access control (RBAC) role
C. application permissions
D. delegated permissions
Show Answer
Correct Answer: C
Explanation: App1 runs as a background service without user interaction and must access Microsoft Graph on its own identity. Application permissions are designed for daemon or service applications to access Graph APIs without a signed-in user, which is required for collecting audit logs. Delegated permissions require a user context, and RBAC roles are not how Graph API access is granted to apps.
Question 93
You have a Microsoft Entra tenant that contains the users shown in the following table.
The tenant has the authentication methods shown in the following table.
Which users will sign in to cloud apps by using number matching?
A. User1 only
B. User2 only
C. User3 only
D. User1 and User2 only
E. User2 and User3 only
Show Answer
Correct Answer: A
Explanation: Number matching is a feature of Microsoft Authenticator push notifications for MFA. Only users authenticating with Microsoft Authenticator push approvals will see and use number matching. FIDO2 security keys and certificate-based authentication do not use number matching. Therefore, only User1 can sign in using number matching.
Question 94
SIMULATION
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Microsoft 365 Username:
Microsoft 365 Password: =1122334455667788
If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 99999999
-
You need to prevent all users from using legacy authentication protocols when authenticating to Microsoft Entra ID.
To complete this task, sign in to the appropriate admin center.
Show Answer
Correct Answer: Sign in to Microsoft Entra admin center
Protection > Conditional Access > New policy
Users: Include All users
Cloud apps: Include All cloud apps
Conditions > Client apps: Configure = Yes; select Legacy authentication clients (and Other clients / Exchange ActiveSync)
Grant: Block access
Enable policy = On
Explanation: Legacy authentication is blocked by a Conditional Access policy in Microsoft Entra ID. Targeting all users and all cloud apps, then configuring Client apps to legacy authentication clients and blocking access prevents any legacy protocols from authenticating.
Question 95
You have a Microsoft Entra tenant named contoso.com that contains an enterprise application named App1.
A contractor uses the credentials of
.
You need to ensure that you can provide the contractor with access to App1. The contractor must be able to authenticate as
.
What should you do?
A. Add a custom domain name to contoso.com.
B. Configure the External collaboration settings.
C. Create a guest user account in contoso.com.
D. Add a WS-Fed identity provider.
Show Answer
Correct Answer: C
Explanation: To give a contractor access to an enterprise application in a Microsoft Entra tenant while allowing them to authenticate with their own external credentials, you should create a guest user account. Guest users represent external identities invited into the tenant and can be assigned access to enterprise applications like App1. Adding a custom domain, changing collaboration settings alone, or adding a WS-Fed identity provider are not required for this scenario.
Question 96
You have an Azure subscription that contains an Azure Automation account named Automation1.
You need to grant Automation1 access to Azure resources. The solution must meet the following requirements:
• Ensure that any permissions granted to Automation1 are removed when the account is deleted.
• Minimize administrative effort.
What should you use?
A. a client secret
B. a system-assigned managed identity
C. a certificate
D. user-assigned managed identity
Show Answer
Correct Answer: B
Explanation: A system-assigned managed identity is tied directly to the lifecycle of the Azure Automation account. When Automation1 is deleted, the identity and its role assignments are automatically removed, satisfying the requirement to clean up permissions. It also minimizes administrative effort because Azure creates, manages, and rotates credentials automatically, unlike client secrets, certificates, or user-assigned managed identities.
Question 97
You have a Microsoft 365 E5 subscription.
You need to be able to create a Microsoft Defender for Cloud Apps session policy.
What should you do first?
A. From the Microsoft 365 Defender portal, select User monitoring.
B. From the Microsoft 365 Defender portal, select App onboarding/maintenance.
C. From the Microsoft Entra admin center, create a Conditional Access policy.
D. From the Microsoft 365 Defender portal, create a continuous report.
Show Answer
Correct Answer: C
Explanation: Microsoft Defender for Cloud Apps session policies rely on Conditional Access App Control. Before you can create or apply a session policy, you must first create a Microsoft Entra ID Conditional Access policy that uses the session control (Use Conditional Access App Control). Without this, sessions cannot be routed through Defender for Cloud Apps. App onboarding is automatic for Entra ID apps and is not the first required step.
Question 98
You have a Microsoft Entra tenant.
You have the devices shown in the following table.
You configure Microsoft Entra Internet Access for the tenant.
On which devices can you use Global Secure Access?
A. Device1 only
B. Device3 only
C. Device1 and Device2 only
D. Device1, Device3, and Device4 only
E. Device1, Device2, Device3, and Device4
Show Answer
Correct Answer: B
Explanation: Global Secure Access (Microsoft Entra Internet Access) using the Windows client requires devices to be Microsoft Entra joined or hybrid joined; Microsoft Entra registered devices are not supported. Based on the device table implied in the question, only Device3 meets the supported join requirements, so Global Secure Access can be used only on Device3.
Question 99
You have an Azure subscription that contains a virtual machine named VM1. VM1 has the following configurations:
• Private IP address: 172.16.1.5
• Public IP address: 108.143.161.25
• System-assigned managed identity status: On
You install an app named App1 on VM1.
You need to configure App1 to request a managed identity app-only access token.
Which IP address should App1 use for the request?
A. 108.143.161.25
B. 127.0.0.1
C. 169.254.169.254
D. 172.16.1.5
Show Answer
Correct Answer: C
Explanation: To request a managed identity app-only access token from within an Azure VM, applications must call the Azure Instance Metadata Service (IMDS). IMDS is exposed at the well-known, non-routable IP address 169.254.169.254, which is accessible only from within the VM. Neither the public IP, private IP, nor loopback address is used for managed identity token requests.
Question 100
You have a Microsoft Entra tenant named contoso.com that contains an enterprise application named App1.
A contractor uses the credentials of
.
You need to ensure that you can provide the contractor with access to App1. The contractor must be able to authenticate as
.
What should you do?
A. Implement Microsoft Entra Connect sync.
B. Add a custom domain name to contoso.com.
C. Implement Microsoft Entra Application Proxy.
D. Run the New-MgInvitation cmdlet.
Show Answer
Correct Answer: D
Explanation: To give a contractor access to an enterprise application in a Microsoft Entra tenant while allowing them to authenticate using their own external credentials, you must invite them as a guest user. Running the New-MgInvitation cmdlet creates a B2B guest account in the tenant and sends an invitation, enabling the contractor to authenticate with their existing identity and be assigned access to App1. The other options do not address inviting external users for authentication.
$19
Get all 397 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
