You have a Microsoft Entra tenant that contains a terms of use (ToU) named Terms1.
You create a Conditional Access policy named Policy1 to deploy Terms1.
You need to configure Policy1 to require users to accept Terms1.
Which settings should you configure for Policy1?
A. Conditions
B. Session
C. Grant
D. Target resources
Show Answer
Correct Answer: C
Explanation: In Microsoft Entra Conditional Access, enforcing acceptance of a Terms of Use is configured in the **Grant** controls. You select **Require Terms of Use** and choose the specific ToU (Terms1). Conditions define who/when, Session controls manage session behavior, and Target resources define apps, but ToU enforcement itself is a Grant requirement.
Question 112
You have a Microsoft 365 E5 subscription.
You need to ensure that users can only access resources in the subscription from a device that has the Global Secure Access client connected.
What should you do first?
A. Enable Global Secure Access signaling.
B. Enable tagging to enforce tenant restrictions.
C. Create a named location.
D. Create a remote network.
Show Answer
Correct Answer: A
Explanation: To restrict access so that users can only reach Microsoft 365 resources when the Global Secure Access (GSA) client is connected, the first required step is to enable Global Secure Access signaling. This allows Entra ID and supported Microsoft services to detect whether traffic is coming through the GSA client, which is then used in Conditional Access policies. Other options like named locations, tenant restrictions, or remote networks depend on this signaling and cannot enforce the requirement by themselves.
Question 113
You have two Microsoft Entra tenants named contoso.com and fabrikam.com. Contoso.com contains the identities shown in the following table.
You configure cross-tenant synchronization from contoso.com to fabrikam.com.
Which identities will sync with fabrikam.com?
A. User1 only
B. User1 and Group1 only
C. User1 and Group2 only
D. User1, Group1, and Group2
Show Answer
Correct Answer: A
Explanation: In Microsoft Entra cross-tenant synchronization, only user objects are synchronized. Group objects (security groups, Microsoft 365 groups), devices, and contacts are not synchronized; groups can only be used to scope which users are in scope. Therefore, only User1 will sync to fabrikam.com.
Question 114
You have a Microsoft Entra tenant.
You configure self-service password reset (SSPR) by using the following settings:
• Require users to register when signing in: Yes
• Number of methods required to reset: 1
What is a valid authentication method available to users?
A. a Windows Hello PIN
B. a smartcard
C. a mobile app notification
D. an email to an address outside your organization
Show Answer
Correct Answer: D
Explanation: With SSPR configured to require only one method, email is a valid authentication method. An email address (including one outside the organization) can be used to receive a verification code for password reset. Mobile app notifications require additional constraints and, when only one method is required, are limited to verification codes rather than push notifications, making email the clearly valid option among the choices.
Question 115
You have a Microsoft Entra tenant that contains the users shown in the following table.
You add an enterprise application named App1 and configure the following Self-service settings:
• Allow users to request access to this application: Yes
• To which group should assigned users be added: Group1
• Require approval before granting access to this application: Yes
• Who is allowed to approve access to this application: User2
Which users can request access to App1?
A. User3 only
B. User2 and User3 only
C. User1 and User3 only
D. User1, User2, and User3
Show Answer
Correct Answer: B
Explanation: In Entra ID self-service application access, only users who do not already have access to the application can submit an access request. User1 is already a member of Group1, which is the assignment group for App1, so User1 already has access and will not see or need the request option. Being an approver does not grant access by itself, so User2 can still request access, and User3 (not in Group1) can also request access. Therefore, only User2 and User3 can request access.
Question 116
You have an Azure subscription that contains a virtual machine named VM1 and an Azure key vault named Vault1. VM1 has a system-assigned managed identity.
You need to ensure that VM1 can retrieve the values of secrets stored in Vault1. The solution must minimize administrative effort.
What should you do first?
A. Configure the Resource access settings for Vault1.
B. Configure the permissions model for Vault1.
C. Add a user-assigned managed identity to VM1.
D. Assign an Azure role to VM1.
Show Answer
Correct Answer: D
Explanation: VM1 already has a system-assigned managed identity, so no additional identity configuration is required. To allow that identity to retrieve secrets from Vault1 with minimal administrative effort, you must grant it permissions. The first required action is to assign an appropriate Azure RBAC role (such as Key Vault Secrets User) to the VM’s managed identity. Configuring the permissions model or resource settings is only necessary if RBAC is not already in use, but granting access is the essential first step.
Question 117
You have a Microsoft 365 E5 subscription that contains a user named User1.
You need to ensure that User1 can create access reviews for Microsoft Entra roles. The solution must use the principle of least privilege.
Which role should you assign to User1?
A. Identity Governance Administrator
B. User Access Administrator
C. User Administrator
D. Privileged Role Administrator
Show Answer
Correct Answer: D
Explanation: To create and manage access reviews specifically for Microsoft Entra **role assignments**, the required minimum role is **Privileged Role Administrator**. Microsoft documentation explicitly grants this role permission to manage access reviews for Entra roles. Identity Governance Administrator can manage access reviews for groups, applications, and access packages, but not Entra role assignments. Therefore, assigning Privileged Role Administrator satisfies the requirement while adhering to least privilege.
Question 118
You have a Microsoft Exchange organization that uses an SMTP address space of contoso.com.
Several users use their contoso.com email address for self-service sign-up to Microsoft Entra.
You gain global administrator privileges to the Microsoft Entra tenant that contains the self-signed users.
You need to prevent the users from creating user accounts in the contoso.com Microsoft Entra tenant for self-service sign-up to Microsoft 365 services.
Which PowerShell cmdlet should you run?
A. Update-MgPolicyAuthorizationPolicy
B. Update-MgDomain
C. Update-MgPolicyPermissionGrantPolicyExclude
D. Update-MgDomainFederationConfiguration
Show Answer
Correct Answer: A
Explanation: To prevent users from creating accounts via self-service sign-up using the contoso.com email domain, you must disable email-based self-service sign-up at the tenant level. This is done by updating the authorization policy and setting AllowedToSignUpEmailBasedSubscriptions to False, which is accomplished with the Update-MgPolicyAuthorizationPolicy cmdlet.
Question 119
You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1 and a Microsoft Teams team named Team1. The subscription contains five security groups named Group1, Group2, Group3, Group4, and Group5.
You need to implement access packages for Site1 and Team1. The solution must meet the following requirements:
• Members of Group3 must be able to request access to Site1 only.
• Members of Group1 must be able to request access to Site1 and Team1.
• Members of Group4 must be able to request access to Site1 and Team1.
• Only members of Group2 must be able to approve access package requests from Group1 members.
• Only members of Groups must be able to approve access package requests from Group3 and Group4 members.
What h the minimum number of access packages you should create?
A. 2
B. 3
C. 4
D. 5
Show Answer
Correct Answer: A
Explanation: In Microsoft Entra ID Entitlement Management, a single access package can contain multiple resources and multiple access package policies. Each policy can target different requestor groups and define different approvers.
Design:
1) Access Package 1 – Site1 only
• Resource: Site1
• Requestors: Group3
• Approvers: Group5 (as required for Group3)
2) Access Package 2 – Site1 + Team1
• Resources: Site1 and Team1
• Policy 1: Requestors = Group1, Approvers = Group2
• Policy 2: Requestors = Group4, Approvers = Group5
Because different approval workflows can be configured using separate policies within the same access package, there is no need to split Group1 and Group4 into separate packages. Therefore, the minimum number of access packages required is two.
Question 120
You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Linux.
You need to configure enhanced security for VM1. The solution must meet the following requirements:
• Ensure that users can sign in to VM1 by using their Microsoft Entra credentials.
• Ensure that users authenticate by using multi-factor out-of-band.
• Prevent users from signing in to VM1 by using passwords.
Which two authentication methods can you include in the solution? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. the Microsoft Authenticator app
B. FIDO2 security keys
C. Temporary Access Pass
D. SMS
E. Windows Hello for Business
Show Answer
Correct Answer: A, B
Explanation: To meet the requirements, the authentication method must support Microsoft Entra ID sign-in to a Linux VM, enforce multi-factor out-of-band authentication, and be passwordless.
• Microsoft Authenticator app supports passwordless sign-in with out-of-band MFA using push notifications and works with Microsoft Entra ID for Linux VM access.
• FIDO2 security keys provide strong, phishing-resistant, passwordless authentication with Microsoft Entra ID and satisfy MFA requirements.
Temporary Access Pass is temporary and not a full authentication method, SMS is not passwordless, and Windows Hello for Business is not supported for Linux VM sign-in.
$19
Get all 397 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.