You have a Microsoft Entra tenant.
You need to create a Conditional Access policy to manage administrative access to the tenant. The solution must ensure that administrators are authenticated by using a phishing-resistant multi-factor authentication (MFA) method.
Which three authentication methods should you include in the solution? Each correct answer presents a complete solution.
A. Windows Hello for Business
B. an FIDO2 security key
C. certificate-based authentication (multi-factor)
D. voice call
E. SMS
F. email OTP
G. certificate-based authentication (single-factor)
H. Microsoft Authenticator
Show Answer
Correct Answer: A, B, C
Explanation: Phishing-resistant MFA methods are those that cannot be replayed or proxied by a phishing site. Windows Hello for Business uses device-bound credentials and biometrics/PIN, making it phishing resistant. FIDO2 security keys use public key cryptography and are inherently phishing resistant. Certificate-based authentication configured as multi-factor combines a certificate with another factor and is recognized by Microsoft Entra as phishing resistant. Methods like SMS, voice, email OTP, and standard Microsoft Authenticator push notifications are vulnerable to phishing, and single-factor certificate-based authentication does not meet MFA requirements.
Question 102
You have an on-premises app named App1.
You have a Microsoft Entra tenant.
You plan to publish App1 by using Microsoft Entra Private Access.
You need to enable the Private access profile.
Which blade should you use in the Microsoft Entra admin center?
A. Remote networks
B. Traffic forwarding
C. Security profiles
D. Connectors
Show Answer
Correct Answer: B
Explanation: To enable Microsoft Entra Private Access, you must turn on the Private Access traffic forwarding profile. This is done in the Microsoft Entra admin center under **Global Secure Access > Connect > Traffic forwarding**, where you select and enable the Private Access profile. The Security profiles blade is used later for defining access policies, not for enabling the profile itself.
Question 103
You have an Azure subscription that contains a storage account named storage1.
You plan to deploy an app named App1 that will be hosted on multiple virtual machines. The virtual machines will authenticate to a third-party API by using secrets.
You need to recommend an authentication solution for the virtual machines. The solution must meet the following requirements:
• Securely store secrets.
• Ensure that credentials do NOT need to be stored in the App1 code.
• Ensure that the virtual machines can access Azure resources by using Microsoft Entra authentication
• Minimize administrative effort.
What should you include in the recommendation?
A. user accounts and Storage Service Encryption
B. user-assigned managed identities and Azure Key Vault
C. user accounts and Azure Key Vault
D. system assigned managed identities and Storage Service Encryption
Show Answer
Correct Answer: B
Explanation: Azure Key Vault securely stores the third-party API secrets and prevents credentials from being embedded in the application code. Using a managed identity allows the virtual machines to authenticate to Azure resources via Microsoft Entra ID without managing credentials. A user-assigned managed identity is appropriate because it can be shared across multiple virtual machines hosting the app, minimizing administrative effort while meeting all security and authentication requirements.
Question 104
You have a Microsoft 365 subscription.
You need to ensure that when users access the Microsoft 365 portal from Microsoft Edge and have their browser language set to Spanish, they are presented with a Spanish sign-in form.
What should you do in the Microsoft Entra admin center?
A. From Settings for the users, configure the Usage location setting.
B. From Global Secure Access, configure the Session management settings.
C. Configure the Company branding settings.
D. Create a Conditional Access policy.
Show Answer
Correct Answer: C
Explanation: The language of the Microsoft 365 sign-in experience is controlled by Microsoft Entra ID Company branding. By configuring Company branding, you can enable browser language detection so that when users access the portal with Microsoft Edge set to Spanish, the sign-in form is automatically displayed in Spanish. Usage location, Global Secure Access, and Conditional Access do not control the sign-in UI language.
Question 105
You have a Microsoft 365 E5 subscription that contains the users shown in the following table.
You configure Microsoft Entra Internet Access.
Which users can manage Microsoft Entra Internet Access?
A. User1 only
B. User2 only
C. User3 only
D. User1 and User2 only
E. User1, User2, and User3
Show Answer
Correct Answer: D
Explanation: Microsoft Entra Internet Access can be managed by users who have roles with permissions over Global Secure Access features. A Global Administrator can manage Microsoft Entra Internet Access, and the Global Secure Access Administrator role is specifically designed to manage Microsoft Entra Internet Access and Private Access. The Privileged Role Administrator role is limited to managing role assignments and does not grant permissions to manage Internet Access.
Question 106
You have a Microsoft 365 E5 subscription.
You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains a user named User1.
You plan to deploy Microsoft Entra Permissions Management.
You need to ensure that User1 can onboard the Azure subscription to Permissions Management. The solution must follow the principle of least principle.
Which Microsoft Entra role should you assign to User1?
A. Permissions Management Administrator
B. Global Administrator
C. Security Administrator
D. Application Administrator
Show Answer
Correct Answer: A
Explanation: Onboarding an Azure subscription to Microsoft Entra Permissions Management requires the least-privileged role specifically designed for this service. The Permissions Management Administrator role can onboard cloud environments and manage Permissions Management without granting broader tenant-wide privileges. Global Administrator, Security Administrator, and Application Administrator provide excessive permissions and do not follow the principle of least privilege.
Question 107
You have a Microsoft 365 E5 subscription.
You need to ensure that users are prompted to accept a custom terms of use (ToU) agreement when they sign in to the subscription.
What should you configure?
A. an access package
B. a Conditional Access policy
C. a lifecycle workflow
D. an authentication method
Show Answer
Correct Answer: B
Explanation: Custom Terms of Use in Microsoft Entra ID are enforced by creating a Terms of Use and then assigning it through a Conditional Access policy. The Conditional Access policy triggers the prompt during user sign-in, requiring acceptance before access is granted.
Question 108
You have a Microsoft Entra tenant that contains the devices shown in the following table.
You plan to configure Microsoft Entra Private Access.
You deploy the Global Secure Access client to compatible devices.
From which devices can you use Private Access?
A. Device1 only
B. Device2 only
C. Device2 and Device4 only
D. Device1, Device2, and Device3 only
E. Device1, Device2, Device3, and Device4
Show Answer
Correct Answer: B
Explanation: Microsoft Entra Private Access requires the Global Secure Access client. For Windows, the client supports only Microsoft Entra joined or hybrid joined devices; Microsoft Entra registered Windows devices are not supported. Android devices do not support Private Access. Therefore, only Device2 (Windows, Microsoft Entra joined) can use Private Access.
Question 109
You have a Microsoft 365 E5 subscription.
You plan to deploy a third-party software as a service (SaaS) app named App1.
You need to onboard App1 to Microsoft Defender for Cloud Apps. The solution must ensure that you can implement session control policies.
What should you do first?
A. From the Microsoft Defender portal, configure Cloud discovery.
B. From the Microsoft Entra admin center, configure single sign-on (SSO) for App1.
C. From the Microsoft Defender portal, create an OAuth app policy.
D. From the Microsoft Entra admin center, configure a traffic forwarding profile.
Show Answer
Correct Answer: B
Explanation: To use Microsoft Defender for Cloud Apps session control policies (Conditional Access App Control), the SaaS app must first be integrated with Microsoft Entra ID using single sign-on (SSO). Session controls rely on Entra ID acting as the identity provider so that sessions can be monitored and controlled in real time. Other options such as Cloud Discovery, OAuth app policies, or traffic forwarding are not prerequisites for enabling session control on a specific SaaS app.
Question 110
You have a Microsoft Entra tenant.
You configure self-service password reset (SSPR) by using the following settings:
• Require users to register when signing in: Yes
• Number of methods required to reset: 1
What is a valid authentication method available to users?
A. an email to an address outside your organization
B. a mobile app notification
C. a smartcard
D. an email to an address in your organization
Show Answer
Correct Answer: A
Explanation: With SSPR configured to require only one method, Microsoft Entra restricts app-based methods to verification codes only, not push notifications. Smartcards aren’t supported for SSPR, and sending reset emails to an internal corporate address isn’t allowed. Email as an SSPR method refers to a verification code sent to an external email address, which is valid in this configuration.
$19
Get all 397 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.