You have a Microsoft Entra tenant.
You configure self-service password reset (SSPR) by using the following settings:
• Require users to register when signing in: Yes
• Number of methods required to reset: 1
What is a valid authentication method available to users?
A. an email to an address outside your organization
B. a mobile app notification
C. a smartcard
D. an email to an address in your organization
Show Answer
Correct Answer: A
Explanation: With SSPR configured to require only one authentication method for password reset, Microsoft Entra allows the Microsoft Authenticator app only via verification code, not push notification. Therefore, a mobile app notification is not valid in this configuration. SSPR email authentication uses an alternate email address outside the organization; organizational email addresses are not used for password reset because access to them may depend on the password being reset. Smartcards are not an SSPR authentication method.
Question 137
You have a Microsoft Entra tenant that contains a terms of use (ToU) named Terms1.
You create a Conditional Access policy named Policy1 to deploy Terms1.
You need to configure Policy1 to require users to accept Terms1.
Which settings should you configure for Policy1?
A. Conditions
B. Session
C. Grant
D. Target resources
Show Answer
Correct Answer: C
Explanation: To require users to accept a Terms of Use document in a Microsoft Entra Conditional Access policy, you configure the policy's Grant controls. In the Grant section, select 'Require terms of use' and choose the Terms of Use object (Terms1). Conditions and Target resources define scope, while Session controls do not enforce Terms of Use acceptance.
Question 138
You have a Microsoft 365 E5 subscription.
You need to ensure that users can only access resources in the subscription from a device that has the Global Secure Access client connected.
What should you do first?
A. Enable Global Secure Access signaling.
B. Enable tagging to enforce tenant restrictions.
C. Create a named location.
D. Create a remote network.
Show Answer
Correct Answer: A
Explanation: To require that users access Microsoft 365 resources only when the Global Secure Access client is connected, the first prerequisite is enabling Global Secure Access signaling. This allows Microsoft Entra Conditional Access to recognize traffic coming through the Global Secure Access client and use that signal in access policies. Creating named locations, tenant restriction tagging, or remote networks are not the initial prerequisite for this scenario.
Question 140
You have a Microsoft Entra tenant.
You configure self-service password reset (SSPR) by using the following settings:
• Require users to register when signing in: Yes
• Number of methods required to reset: 1
What is a valid authentication method available to users?
A. a Windows Hello PIN
B. a smartcard
C. a mobile app notification
D. an email to an address outside your organization
Show Answer
Correct Answer: D
Explanation: For Microsoft Entra SSPR with only one authentication method required, mobile app notification is not a valid reset verification method; only the mobile app verification code can be used in that configuration. Windows Hello PIN and smartcards are not SSPR authentication methods. Email is a supported SSPR method, and it uses an email address outside the organization.
Question 141
You have a Microsoft Entra tenant that contains the users shown in the following table.
You add an enterprise application named App1 and configure the following Self-service settings:
• Allow users to request access to this application: Yes
• To which group should assigned users be added: Group1
• Require approval before granting access to this application: Yes
• Who is allowed to approve access to this application: User2
Which users can request access to App1?
A. User3 only
B. User2 and User3 only
C. User1 and User3 only
D. User1, User2, and User3
Show Answer
Correct Answer: D
Explanation: Enabling self-service application access allows users in the tenant to request access to the application through My Apps. Selecting a target group specifies which group approved users are added to; it does not limit who can submit a request. Being configured as an approver does not inherently grant app access or prevent requesting access. Therefore User1, User2, and User3 can all request access.
Sources:
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/manage-self-service-access
https://learn.microsoft.com/en-us/answers/questions/5807529/application-access-request
Question 142
You have an Azure subscription that contains a virtual machine named VM1 and an Azure key vault named Vault1. VM1 has a system-assigned managed identity.
You need to ensure that VM1 can retrieve the values of secrets stored in Vault1. The solution must minimize administrative effort.
What should you do first?
A. Configure the Resource access settings for Vault1.
B. Configure the permissions model for Vault1.
C. Add a user-assigned managed identity to VM1.
D. Assign an Azure role to VM1.
Show Answer
Correct Answer: D
Explanation: VM1 already has a system-assigned managed identity. To allow it to retrieve secrets from Azure Key Vault, the identity must be granted permission. With the current recommended model, this is done by assigning an appropriate Azure RBAC role (such as Key Vault Secrets User) to the managed identity. There is no indication that the vault's permission model must be changed first, so the minimal first action is to assign the required Azure role.
Question 143
You have a Microsoft 365 E5 subscription that contains a user named User1.
You need to ensure that User1 can create access reviews for Microsoft Entra roles. The solution must use the principle of least privilege.
Which role should you assign to User1?
A. Identity Governance Administrator
B. User Access Administrator
C. User Administrator
D. Privileged Role Administrator
Show Answer
Correct Answer: D
Explanation: To create access reviews specifically for Microsoft Entra role assignments, the least-privileged built-in role is Privileged Role Administrator. Identity Governance Administrator can create and manage many access reviews (such as for groups, applications, and access packages), but access reviews targeting Microsoft Entra role assignments require Privileged Role Administrator or a higher-privileged role.
Question 144
You have a Microsoft Exchange organization that uses an SMTP address space of contoso.com.
Several users use their contoso.com email address for self-service sign-up to Microsoft Entra.
You gain global administrator privileges to the Microsoft Entra tenant that contains the self-signed users.
You need to prevent the users from creating user accounts in the contoso.com Microsoft Entra tenant for self-service sign-up to Microsoft 365 services.
Which PowerShell cmdlet should you run?
A. Update-MgPolicyAuthorizationPolicy
B. Update-MgDomain
C. Update-MgPolicyPermissionGrantPolicyExclude
D. Update-MgDomainFederationConfiguration
Show Answer
Correct Answer: A
Explanation: To prevent users from creating self-service sign-up accounts for Microsoft 365 services in the tenant, update the Microsoft Entra authorization policy and disable email-based self-service sign-up by setting the AllowedToSignUpEmailBasedSubscriptions property to False. This is done with Update-MgPolicyAuthorizationPolicy. The other cmdlets manage domains, federation, or permission grant policies and do not control self-service sign-up.
Question 145
You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1 and a Microsoft Teams team named Team1. The subscription contains five security groups named Group1, Group2, Group3, Group4, and Group5.
You need to implement access packages for Site1 and Team1. The solution must meet the following requirements:
• Members of Group3 must be able to request access to Site1 only.
• Members of Group1 must be able to request access to Site1 and Team1.
• Members of Group4 must be able to request access to Site1 and Team1.
• Only members of Group2 must be able to approve access package requests from Group1 members.
• Only members of Groups must be able to approve access package requests from Group3 and Group4 members.
What h the minimum number of access packages you should create?
A. 2
B. 3
C. 4
D. 5
Show Answer
Correct Answer: A
Explanation: An access package can contain both Site1 and Team1 resources, and a single access package can have multiple assignment policies. Assignment policies let you scope different requestor groups and configure different approvers for each policy. Therefore, create one access package for Site1 only (Group3 requestors with the required approver group) and one access package for Site1 + Team1 with separate assignment policies for Group1 and Group4 so each has its own approver configuration. This satisfies the resource and approval requirements with the minimum number of access packages.
Question 146
You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Linux.
You need to configure enhanced security for VM1. The solution must meet the following requirements:
• Ensure that users can sign in to VM1 by using their Microsoft Entra credentials.
• Ensure that users authenticate by using multi-factor out-of-band.
• Prevent users from signing in to VM1 by using passwords.
Which two authentication methods can you include in the solution? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. the Microsoft Authenticator app
B. FIDO2 security keys
C. Temporary Access Pass
D. SMS
E. Windows Hello for Business
Show Answer
Correct Answer: A, B
Explanation: For Azure Linux VMs using Microsoft Entra sign-in, passwordless authentication methods that satisfy MFA and prevent password-based sign-in include the Microsoft Authenticator app (passwordless phone sign-in) and FIDO2 security keys. Temporary Access Pass is a temporary bootstrap method rather than the ongoing authentication method. SMS is not passwordless and does not meet the requirement to prevent password sign-in. Windows Hello for Business is a Windows client authentication technology and is not an authentication method for signing directly into a Linux VM.
$19
Get all 387 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.