You have an Azure subscription that contains a virtual machine named VM1. VM1 has the following configurations:
• Private IP address: 172.16.1.5
• Public IP address: 108.143.161.25
• System-assigned managed identity status: On
You install an app named App1 on VM1.
You need to configure App1 to request a managed identity app-only access token.
Which IP address should App1 use for the request?
A. 108.143.161.25
B. 127.0.0.1
C. 169.254.169.254
D. 172.16.1.5
Show Answer
Correct Answer: C
Explanation: Azure VMs with a system-assigned managed identity obtain access tokens through the Azure Instance Metadata Service (IMDS). Applications running on the VM request tokens from the IMDS endpoint at the link-local IP address 169.254.169.254, not the VM's private, public, or loopback address.
Question 126
You have a Microsoft Entra tenant named contoso.com that contains an enterprise application named App1.
A contractor uses the credentials of
.
You need to ensure that you can provide the contractor with access to App1. The contractor must be able to authenticate as
.
What should you do?
A. Implement Microsoft Entra Connect sync.
B. Add a custom domain name to contoso.com.
C. Implement Microsoft Entra Application Proxy.
D. Run the New-MgInvitation cmdlet.
Show Answer
Correct Answer: D
Explanation: To provide an external contractor access to an enterprise application in a Microsoft Entra tenant while allowing them to authenticate with their existing identity, invite them as a Microsoft Entra B2B guest user. The New-MgInvitation cmdlet creates the B2B invitation. Entra Connect is for directory synchronization, adding a custom domain does not onboard external users, and Application Proxy publishes on-premises apps rather than inviting external identities.
Question 127
You have a Microsoft Entra tenant.
You need to create a Conditional Access policy to manage administrative access to the tenant. The solution must ensure that administrators are authenticated by using a phishing-resistant multi-factor authentication (MFA) method.
Which three authentication methods should you include in the solution? Each correct answer presents a complete solution.
A. Windows Hello for Business
B. an FIDO2 security key
C. certificate-based authentication (multi-factor)
D. voice call
E. SMS
F. email OTP
G. certificate-based authentication (single-factor)
H. Microsoft Authenticator
Show Answer
Correct Answer: A, B, C
Explanation: Phishing-resistant MFA authentication strengths in Microsoft Entra include Windows Hello for Business, FIDO2 security keys, and certificate-based authentication (multi-factor). Microsoft Authenticator push notifications, SMS, voice calls, email OTP, and single-factor certificate-based authentication are not considered phishing-resistant MFA methods.
Question 128
You have an on-premises app named App1.
You have a Microsoft Entra tenant.
You plan to publish App1 by using Microsoft Entra Private Access.
You need to enable the Private access profile.
Which blade should you use in the Microsoft Entra admin center?
A. Remote networks
B. Traffic forwarding
C. Security profiles
D. Connectors
Show Answer
Correct Answer: B
Explanation: To enable the Private Access profile for Microsoft Entra Private Access, you use the Global Secure Access > Connect > Traffic forwarding blade and enable the Private Access traffic forwarding profile. Remote networks define connected networks, Connectors are the on-premises agents, and Security profiles are for security policy configuration rather than enabling the traffic forwarding profile itself.
Question 129
You have an Azure subscription that contains a storage account named storage1.
You plan to deploy an app named App1 that will be hosted on multiple virtual machines. The virtual machines will authenticate to a third-party API by using secrets.
You need to recommend an authentication solution for the virtual machines. The solution must meet the following requirements:
• Securely store secrets.
• Ensure that credentials do NOT need to be stored in the App1 code.
• Ensure that the virtual machines can access Azure resources by using Microsoft Entra authentication
• Minimize administrative effort.
What should you include in the recommendation?
A. user accounts and Storage Service Encryption
B. user-assigned managed identities and Azure Key Vault
C. user accounts and Azure Key Vault
D. system assigned managed identities and Storage Service Encryption
Show Answer
Correct Answer: B
Explanation: Azure Key Vault is the appropriate service to securely store third-party API secrets. Managed identities eliminate the need to store credentials in application code and allow VMs to authenticate to Azure resources using Microsoft Entra ID. Because the application runs on multiple VMs, a user-assigned managed identity can be shared across those VMs, simplifying identity management and minimizing administrative effort compared to separate system-assigned identities. Storage Service Encryption protects data at rest in storage accounts and is not a secret-management solution.
Question 130
You have a Microsoft 365 subscription.
You need to ensure that when users access the Microsoft 365 portal from Microsoft Edge and have their browser language set to Spanish, they are presented with a Spanish sign-in form.
What should you do in the Microsoft Entra admin center?
A. From Settings for the users, configure the Usage location setting.
B. From Global Secure Access, configure the Session management settings.
C. Configure the Company branding settings.
D. Create a Conditional Access policy.
Show Answer
Correct Answer: C
Explanation: To present a localized sign-in experience based on the user's browser language, configure Microsoft Entra Company branding. Company branding includes browser language customization, allowing the sign-in page to display the appropriate localized branding and sign-in experience (such as Spanish) when the browser language is set accordingly. Usage location, Session management, and Conditional Access do not control the sign-in page language.
Question 131
You have a Microsoft 365 E5 subscription that contains the users shown in the following table.
You configure Microsoft Entra Internet Access.
Which users can manage Microsoft Entra Internet Access?
A. User1 only
B. User2 only
C. User3 only
D. User1 and User2 only
E. User1, User2, and User3
Show Answer
Correct Answer: D
Explanation: Global Administrator and Global Secure Access Administrator can manage Microsoft Entra Internet Access. Privileged Role Administrator manages role assignments but does not have permissions to administer Internet Access features.
Question 132
You have a Microsoft 365 E5 subscription.
You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains a user named User1.
You plan to deploy Microsoft Entra Permissions Management.
You need to ensure that User1 can onboard the Azure subscription to Permissions Management. The solution must follow the principle of least principle.
Which Microsoft Entra role should you assign to User1?
A. Permissions Management Administrator
B. Global Administrator
C. Security Administrator
D. Application Administrator
Show Answer
Correct Answer: A
Explanation: The least-privileged Microsoft Entra role for onboarding Microsoft Entra Permissions Management and onboarding cloud environments (including an Azure subscription) is Permissions Management Administrator. Global Administrator is more privileged than necessary, while Security Administrator and Application Administrator do not grant the specific Permissions Management onboarding capabilities.
Question 133
You have a Microsoft 365 E5 subscription.
You need to ensure that users are prompted to accept a custom terms of use (ToU) agreement when they sign in to the subscription.
What should you configure?
A. an access package
B. a Conditional Access policy
C. a lifecycle workflow
D. an authentication method
Show Answer
Correct Answer: B
Explanation: Custom Terms of Use in Microsoft Entra ID are enforced by associating the Terms of Use document with a Conditional Access policy. Users are prompted to accept the agreement when the Conditional Access policy applies during sign-in. Access packages can also use Terms of Use for entitlement management, but the general sign-in prompt for Microsoft 365 is configured through Conditional Access. Lifecycle workflows and authentication methods do not provide Terms of Use acceptance.
Question 135
You have a Microsoft 365 E5 subscription.
You plan to deploy a third-party software as a service (SaaS) app named App1.
You need to onboard App1 to Microsoft Defender for Cloud Apps. The solution must ensure that you can implement session control policies.
What should you do first?
A. From the Microsoft Defender portal, configure Cloud discovery.
B. From the Microsoft Entra admin center, configure single sign-on (SSO) for App1.
C. From the Microsoft Defender portal, create an OAuth app policy.
D. From the Microsoft Entra admin center, configure a traffic forwarding profile.
Show Answer
Correct Answer: B
Explanation: To use Microsoft Defender for Cloud Apps session controls (Conditional Access App Control) with a third-party SaaS application, the application must first be integrated with Microsoft Entra ID for single sign-on (typically SAML/OpenID Connect). Session controls are enforced through the identity provider during sign-in. Cloud Discovery identifies apps but does not onboard them for session control, OAuth app policies govern OAuth permissions, and traffic forwarding profiles are for Global Secure Access traffic routing rather than the prerequisite onboarding step.
$19
Get all 387 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.