You work for a company named Contoso, Ltd. that has a Microsoft Entra tenant named contoso.com.
Contoso is working on a project with the following two partner companies:
• A company named A. Datum Corporation that has a Microsoft Entra tenant named adatum.com.
• A company named Fabrikam, Inc. that has a Microsoft Entra tenant named fabrikam.com.
When you attempt to invite a new guest user from adatum.com to contoso.com, you receive an error message.
You can successfully invite a new guest user from fabnkam.com to contoso.com.
You need to be able to invite new guest users from adatum.com to contoso.com.
What should you configure?
A. Guest invite settings
B. Verifiable credentials
C. Named locations
D. Collaboration restrictions
Show Answer
Correct Answer: D
Explanation: The issue occurs because Contoso can invite guests from fabrikam.com but not from adatum.com, which indicates a domain-based restriction on B2B invitations. In Microsoft Entra ID, this behavior is controlled by External Identities → External collaboration settings → Collaboration restrictions. An allowlist or blocklist may be configured, and adatum.com is either not included in the allowlist or is explicitly blocked. Configuring Collaboration restrictions to allow adatum.com resolves the problem.
Question 149
You have an Azure subscription that contains an Azure Automation account named Automation1 and an Azure key vault named Vault1. Vault1 contains a secret named Secret1.
You enable a system-assigned managed identity for Automation1.
You need to ensure that Automation1 can read the contents of Secret1. The solution must meet the following requirements:
• Prevent Automation1 from accessing other secrets stored in Vault1.
• Follow the principle of least privilege.
What should you do?
A. From Vault1, configure the Access control (IAM) settings.
B. From Automation1, configure the Identity settings.
C. From Automation1, configure the Run as accounts settings.
D. From Secret1, configure the Access control (IAM) settings.
Show Answer
Correct Answer: D
Explanation: To meet least-privilege requirements and prevent access to other secrets, permissions must be scoped to only Secret1. With the Azure Key Vault RBAC permission model, you can assign an IAM role (such as Key Vault Secrets User with Get permission) directly on an individual secret. Configuring Access control (IAM) at the Secret1 level grants Automation1’s system-assigned managed identity access only to that secret, not to the entire vault.
Question 150
HOTSPOT
-
Your network contains an on-premises Active Directory Domain Services (AD DS) domain named fabrikam.com. The domain contains an Active Directory Federation Services (AD FS) instance and a member server named Server1 that runs Windows Server. The domain contains the users shown in the following table.
You have a Microsoft Entra tenant named contoso.com that is linked to a Microsoft 365 subscription.
You establish federation between fabrikam.com and contoso.com by using a Microsoft Entra Connect instance that is configured as shown in the following exhibit.
You perform the following tasks in contoso.com:
• Create a group named Group1.
• Disable User2.
• Enable User3.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
No
Yes
Explanation: Group writeback is not enabled, so a cloud-only group cannot include on-premises–sourced users for on-prem use.
User2 is disabled in Microsoft Entra ID and federation is used, so sign-in is blocked.
User3 is enabled in Microsoft Entra ID and can authenticate to Microsoft 365 via the federated setup.
Question 151
Your on-premises network contains an Active Directory Domain Services (AD DS) domain and a certification authority (CA) named CA1.
You have an Azure AD tenant.
You need to implement certificate-based authentication in Azure AD. The solution must ensure that users can sign in by using certificates issued by CA1. What should you do first?
A. Deploy an Azure key vault.
B. Add CA1 as a Certificate Authority to the Microsoft Entra ID tenant.
C. Enable auto-enrollment for CA1.
D. Deploy Windows Hello for Business.
Show Answer
Correct Answer: B
Explanation: To enable certificate-based authentication in Microsoft Entra ID (Azure AD), the tenant must first trust the issuing certification authority. This is done by adding the on-premises CA (CA1) to the Entra ID tenant, which involves uploading the root (and any intermediate) CA certificates and configuring CRL access. Only after the CA is trusted can certificates it issues be used for user sign-in. Other options are either unrelated or occur later in the configuration process.
Question 152
HOTSPOT -
You have a Microsoft Entra tenant that has a Microsoft Entra ID P2 service plan. The tenant contains the users shown in the following table.
You have the Device settings shown in the following exhibit.
User1 has the devices shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise. select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
Yes
No
Explanation: User1 already has four Microsoft Entra devices (joined or registered) and the maximum is five, so they cannot add four more.
A Cloud Device Administrator can manage device settings, including requiring MFA for device join or registration.
Local administrator rights via Microsoft Entra apply only to Entra joined Windows devices; Device3 is only Entra registered.
Question 153
HOTSPOT
-
You have two Azure subscriptions named Sub1 and Sub2 that are linked to a Microsoft Entra tenant. The tenant contains three groups named Group1, Group2, and Group3.
The subscriptions contain the resources shown in the following table.
The tenant contains the users shown in the following table.
You manage the subscriptions by using Microsoft Entra Permissions Management. Permissions Management is configured as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
Yes
Yes
Explanation: User1 belongs only to Group1, which has Viewer on Sub1, not Sub2 where VM2 resides.
User2 is in Group2, which is a Controller on Sub2 and is allowed to request for other identities (User1).
User3 is in Group3, which is an Approver for all current and future authorization systems, including VM2 in Sub2.
Question 154
You have accounts for the following cloud platforms:
• Azure
• Alibaba Cloud
• Amazon Web Services (AWS)
• Google Cloud Platform (GCP)
You configure an Azure subscription to use Microsoft Entra Permissions Management to manage the permissions in Azure only.
Which additional cloud platforms can be managed by using Permissions Management?
A. AWS only
B. Alibaba Cloud and AWS only
C. Alibaba Cloud and GCP only
D. AWS and GCP only
E. Alibaba Cloud, AWS, and GCP
Show Answer
Correct Answer: D
Explanation: Microsoft Entra Permissions Management (CIEM) supports managing permissions across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). It does not provide a connector or management capability for Alibaba Cloud. Therefore, in addition to Azure, the supported platforms are AWS and GCP only.
Question 155
HOTSPOT
-
You have a Microsoft Entra tenant that contains multiple storage accounts.
You plan to deploy multiple Azure App Service apps that will require access to the storage accounts.
You need to recommend an identity solution to provide the apps with access to the storage accounts. The solution must minimize administrative effort.
Which type of identity should you recommend, and what should you recommend using to control access to the storage accounts? To answer, select the appropriate options in the answer area.
Show Answer
Correct Answer: User-assigned managed identity
Role-based access control (RBAC)
Explanation: Multiple App Service apps need access to the same storage accounts. A user-assigned managed identity can be shared across apps, reducing the number of identities and role assignments to manage. Azure RBAC provides centralized, least-privilege access control for storage accounts without managing keys or tokens.
Question 156
You have a Microsoft Entra tenant.
You need to query risky user activity for the tenant.
How long will the logs of risky user activity be retained?
A. 30 days
B. 60 days
C. 90 days
D. 180 days
Show Answer
Correct Answer: C
Explanation: In Microsoft Entra ID (Identity Protection), the commonly tested retention period for querying risky user activity is 90 days. While the *Risky users* object itself is not deleted until risk is remediated, the underlying risk history and related activity that you can query in the portal (especially with Entra ID P2) is limited to the last 90 days. Therefore, the correct exam-oriented answer is 90 days.
Question 157
You have an Azure subscription that contains a user named User1 and two resource groups named RG1 and RG2.
You need to ensure that User1 can perform the following tasks:
• View all resources.
• Restart virtual machines.
• Create virtual machines in RG1 only.
• Create storage accounts in RG1 only.
What is the minimum number of role-based access control (RBAC) role assignments required?
A. 1
B. 2
C. 3
D. 4
Show Answer
Correct Answer: C
Explanation: Using built-in RBAC roles (as assumed in Microsoft exam questions), the minimum is three assignments:
1) Reader at the subscription scope to view all resources.
2) Virtual Machine Contributor at the subscription scope to restart VMs in all resource groups.
3) Contributor at the RG1 scope to allow creation of virtual machines and storage accounts only in RG1.
This satisfies all requirements without granting create permissions in RG2, and cannot be done with fewer built-in role assignments.
$19
Get all 397 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
