You have a Microsoft Entra tenant that uses Microsoft Entra ID Premium licenses.
You plan to configure a terms of use (ToU) for the tenant.
You need to upload the ToU document.
Which format should you use for the document?
A. HTML
B. RTF
C. PDF
D. DOCX
Show Answer
Correct Answer: C
Explanation: Microsoft Entra ID Terms of Use require the document to be uploaded in PDF format. Other formats such as HTML, RTF, or DOCX are not supported for ToU documents.
Question 122
You have a Microsoft 365 tenant that uses the domain name fabrikam.com.
The External collaboration settings are configured as shown in the Collaboration exhibit. (Click the Collaboration tab.)
The Email one-time passcode for guests setting is enabled for the tenant.
A user named
shares a Microsoft SharePoint Online document library to the users shown in the following table.
Which users will be emailed a passcode?
A. User1 only
B. User2 only
C. User1 and User2 only
D. User1, User2, and User3
Show Answer
Correct Answer: B
Explanation: Email one-time passcode (OTP) is sent during the redemption/sign-in process for new guest users who lack another authentication method. Enabling OTP does not affect existing guests who have already redeemed their invitation. In this scenario, only User2 is a new external guest without a Microsoft/Entra account at the time of sharing, so only User2 will be emailed a passcode.
Question 123
HOTSPOT
-
You have a Microsoft Entra tenant that contains the users shown in the following table.
You have a user risk policy that has the following settings:
• Assignments:
o Include: Group1
o Exclude: Group2
• Sign-in risk: Medium and above
• Access controls:
o Grant access: Require password change
When the users attempt to sign in, user risk levels are detected as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: User1: Yes
User2: No
User3: No
Explanation: The policy includes Group1 and excludes Group2, and exclusions take precedence over inclusions. User1 is only in Group1 and has High risk, so the policy applies and requires a password change. User2 is in Group2 only, so is excluded from the policy. User3 is in both Group1 and Group2, and because exclusion overrides inclusion, the policy does not apply despite the High risk level.
Question 125
You have an Azure subscription that contains a resource group named RG1 and four users named User1, User2, User3, and User4.
You plan to assign the users the following roles for RG1:
• User1: Reader
• User2: Contributor
• User3: Storage Blob Data Reader
• User4: Virtual Machine Contributor
You are evaluating the use of attribute-based access control (ABAC).
Which user's role will support the use of ABAC?
A. User1
B. User2
C. User3
D. User4
Show Answer
Correct Answer: C
Explanation: Azure ABAC conditions are currently supported for role assignments that include data actions for Azure Storage (Blob and Queue). Among the listed roles, only **Storage Blob Data Reader** supports adding role assignment conditions (ABAC). Reader, Contributor, and Virtual Machine Contributor do not support ABAC conditions.
Question 127
You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users.
From the Groups blade in the Microsoft Entra admin center, you assign Microsoft Office 365 Enterprise E5 licenses to a group that includes all users.
You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort.
What should you use?
A. the Set-WindowsProductKey cmdlet
B. the Update-MgGroup cmdlet
C. the Set-MgUserLicense cmdlet
D. the Update-MgUser cmdlet
Show Answer
Correct Answer: C
Explanation: To remove an individually assigned Office 365 Enterprise E3 license from users, you must modify each user’s license assignments. The Set-MgUserLicense cmdlet is specifically designed to add or remove licenses from users in bulk via scripting, which is the least administrative effort compared to manual changes. Group license assignment does not automatically remove existing per-user licenses, so a user-level license removal cmdlet is required.
Question 128
You have an Azure subscription named Sub1 that contains a virtual machine named VM1.
You need to enable Microsoft Entra login for VM1 and configure VM1 to access the resources in Sub1.
Which type of identity should you assign to VM1?
A. Microsoft Entra user account
B. user-assigned managed identity
C. Azure Automation account
D. system-assigned managed identity
Show Answer
Correct Answer: D
Explanation: To enable Microsoft Entra (Azure AD) login on a virtual machine and allow it to access other Azure resources within the same subscription, the VM must have a managed identity. A system-assigned managed identity is created and tied directly to the lifecycle of VM1, making it the simplest and recommended choice for granting the VM access to resources in Sub1. User accounts and automation accounts are not appropriate for VM authentication, and a user-assigned managed identity is unnecessary unless the identity must be shared across multiple resources.
Question 129
DRAG DROP
-
Your network contains an on-premises Active Directory domain named contoso.com that syncs with Microsoft Entra ID by using Microsoft Entra Connect. The domain contains the users shown in the following table.
From Active Directory Users and Computers, you add the following user:
• Name: User3
• UPN:
• Proxy addresses: smtp:
, smtp:
From Active Directory Users and Computers, you update the proxyAddresses attribute for each user as shown in the following table.
You trigger a manual synchronization.
Which sync status will Microsoft Entra Connect sync return for each user? To answer, drag the appropriate status to the correct users. Each status may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Explanation: User1: Proxy address changes remain unique across the tenant, so sync succeeds.
User2: A proxyAddress value conflicts with another synchronized object, violating uniqueness, causing AttributeValueMustBeUnique.
User3: As a new object, its UPN/proxyAddress matches an existing cloud object with a different sourceAnchor, triggering InvalidSoftMatch during soft-match.
Question 130
You have an Azure subscription that contains a user-assigned managed identity named Managed1 in the East US Azure region. The subscription contains the resources shown in the following table.
Which resources can use Managed1 as their identity?
A. WebApp1 only
B. storage1 and WebApp1 only
C. VM1 and WebApp1 only
D. VM1, storage1, and WebApp1
Show Answer
Correct Answer: C
Explanation: User-assigned managed identities can be assigned to compute resources such as virtual machines and App Service apps. Azure Storage accounts cannot have a managed identity assigned to them—they are accessed by other identities instead. Therefore, Managed1 can be used by VM1 and WebApp1 only.
Question 131
You have a Microsoft Entra tenant.
You need to configure continuous access evaluation for app sign-ins and assign the configuration to users that are assigned the Application Administrator role.
What should you configure?
A. a sign-in risk policy
B. an access review
C. a Conditional Access policy
D. the Admin consent settings
Show Answer
Correct Answer: C
Explanation: Continuous Access Evaluation (CAE) for app sign-ins is configured and enforced through Conditional Access. Conditional Access policies support CAE-enabled apps and can be scoped to specific users or directory roles, such as users assigned the Application Administrator role. Other options (sign-in risk policy, access review, admin consent settings) do not configure real-time or continuous access evaluation.
Question 133
HOTSPOT
-
You have an Azure subscription named Sub1.
You plan to onboard Microsoft Entra Permissions Management.
You need to ensure that Permissions Management users can manage role assignments for Sub1. The solution must follow the principle of least privilege.
Which role should you assign and to which identity should you assign the role? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: User Access Administrator
Cloud Infrastructure Entitlements Management
Explanation: Permissions Management requires the ability to manage Azure role assignments. The least-privileged built-in role that allows managing role assignments is User Access Administrator, and it must be assigned to the Cloud Infrastructure Entitlements Management (CIEM) service principal used by Microsoft Entra Permissions Management.
$19
Get all 397 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
