You have an Azure subscription named Sub1 that contains a user named User1.
You need to ensure that User1 can purchase a Microsoft Entra Permissions Management license for Sub1. The solution must follow the principle of least privilege.
Which role should you assign to User1?
A. Global Administrator
B. Billing Administrator
C. Permissions Management Administrator
D. User Access Administrator
Show Answer
Correct Answer: B
Explanation: The task is only to purchase a Microsoft Entra Permissions Management license, not to onboard or configure the service. According to the current Microsoft documentation, purchasing or activating a trial requires the Billing Administrator role, while Global Administrator is only required later for onboarding and configuration. Applying the principle of least privilege, Billing Administrator is the correct role.
Question 159
HOTSPOT
-
You have a Microsoft Entra tenant that contains a group named Group3 and an administrative unit named Department1.
Department1 has the users shown in the Users exhibit. (Click the Users tab.)
Department1 has the groups shown in the Groups exhibit. (Click the Groups tab.)
The User Administrator role assignments are shown in the Assignments exhibit (Click the Assignments tab.)
The members of Group2 are shown in the Group2 exhibit. (Click the Group2 tab.)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
No
Yes
Explanation: Admin1 is scoped to the Department1 administrative unit. Group membership in an administrative unit does not grant management rights over the group’s members, so User3 and User4 (members of Group2 only) are out of scope. Group3 is not in Department1, so Admin1 cannot add users to it. Admin3 has a directory-scoped User Administrator role and can reset the password of User1.
Question 160
HOTSPOT -
You have an Azure AD tenant.
You perform the tasks shown in the following table.
On April 5, an administrator deletes App1, App2, App3, and App4.
You need to restore the apps and the settings.
Which apps can you restore on April 16, and which settings can you restore for App4 on April 16? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Apps:
App1, App2, App3, and App4
App4 settings:
App roles, Users and groups, Client secret, and Self-service
Explanation: Deleted enterprise applications can be restored within 30 days. Since all apps were deleted on April 5 and restoration is attempted on April 16, all four apps are recoverable. Restoring an enterprise application brings back its configuration, including app roles, user and group assignments, client secrets, and self-service settings.
Question 161
You have an Azure subscription that contains the users shown in the following table.
You need to implement Azure AD Privileged Identity Management (PIM).
Which users can use PIM to activate their role permissions?
A. Admin1 only
B. Admin2 only
C. Admin3 only
D. Admin1 and Admin2 only
E. Admin2 and Admin3 only
F. Admin1, Admin2, and Admin3
Show Answer
Correct Answer: C
Explanation: Azure AD Privileged Identity Management supports Azure AD roles and Azure resource roles, but it does not support classic subscription administrator roles (Account Administrator, Service Administrator, Co-Administrator). Admin1 and Admin2 hold classic subscription roles, which cannot be activated via PIM. Admin3 holds an Azure AD role (SharePoint Administrator), which is supported by PIM and can be activated.
Question 162
HOTSPOT -
You have an Azure subscription that contains the resources shown in the following table.
The subscription contains the virtual machines shown in the following table.
Which identities can be assigned the Owner role for RG1, and to which virtual machines can you assign Managed2? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Identities with Owner role: Managed1, Managed2, VM1, VM2, and VM3 only
Virtual machines assigned to Managed2: VM1, VM2, VM3, and VM4
Explanation: RBAC roles can be assigned to managed identities (user- or system-assigned) regardless of region. VM1 and VM2 have system-assigned identities; VM3 uses the user-assigned identity Managed1; VM4 has no identity and cannot be assigned a role. User-assigned managed identities are not region-bound and can be attached to any VM, and a VM can have both system- and user-assigned identities, so Managed2 can be assigned to all VMs.
Question 163
You have an Azure subscription that contains a user named User1.
The App registration settings for the Azure AD tenant are configured as shown in the following exhibit.
User1 builds an ASP.NET web app named App1.
You need to ensure that User1 can register App1. The solution must use the principle of least privilege.
Which role should you assign to User1?
A. Application Developer
B. Cloud App Security Administrator
C. Cloud Application Administrator
D. Application Administrator
Show Answer
Correct Answer: A
Explanation: When the tenant setting **Users can register applications** is disabled, only specific directory roles can create app registrations. The **Application Developer** role explicitly allows a user to register and manage applications they own without granting broader administrative privileges. Compared to Cloud Application Administrator or Application Administrator, it provides the minimum permissions required, satisfying the principle of least privilege.
Question 164
You have an Azure AD tenant that contains the external user shown in the following exhibit.
You update the email address of the user.
You need to ensure that the user can authenticate by using the updated email address.
What should you do for the user?
A. Modify the Authentication methods settings.
B. Reset the password.
C. Revoke the active sessions.
D. Reset the redemption status.
Show Answer
Correct Answer: D
Explanation: The user is an external (B2B guest) user. After a guest redeems an invitation, their sign-in email/identity is tied to the redemption. Simply updating the email attribute does not update the authentication identity. To allow the user to authenticate using the new email address, you must reset the user’s redemption status and re-invite them. This preserves the existing user object, group memberships, and app assignments while allowing authentication with the updated email.
Question 165
You have an Azure AD tenant.
You need to ensure that only users from specific external domains can be invited as guests to the tenant.
Which settings should you configure?
A. External collaboration settings
B. All identity providers
C. Cross-tenant access settings
D. Linked subscriptions
Show Answer
Correct Answer: A
Explanation: To restrict which external domains can be invited as guest users, you configure Azure AD External collaboration settings. These settings include collaboration restrictions that let you allow invitations only from specified domains or deny specific domains. Other options like cross-tenant access focus on access policies after invitation, not controlling which domains can be invited.
Question 166
You have an Azure AD tenant.
You plan to implement Azure AD Privileged Identity Management (PIM).
Which roles can you manage by using PIM?
A. Global Administrator only
B. Global Administrator and Security Administrator only
C. Global Administrator, Security Administrator, and Security Contributor only
D. Account Administrator, Global Administrator, Security Administrator, and Security Contributor only
Show Answer
Correct Answer: C
Explanation: Privileged Identity Management can manage both Microsoft Entra ID roles and Azure RBAC roles. Global Administrator and Security Administrator are Entra roles supported by PIM, and Security Contributor is an Azure RBAC role that can also be managed through PIM. Account Administrator is a classic subscription administrator role and cannot be managed by PIM, which rules out option D. Therefore, the correct choice is C.
Question 167
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Amazon Web Services (AWS) account, a Google Workspace subscription, and a GitHub account.
You deploy an Azure subscription and enable Microsoft 365 Defender.
You need to ensure that you can monitor OAuth authentication requests by using Microsoft Defender for Cloud Apps.
Solution: From the Microsoft 365 Defender portal, you add the GitHub app connector.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Adding only the GitHub app connector does not meet the goal of monitoring OAuth authentication requests across the environment. Microsoft Defender for Cloud Apps requires connecting each supported platform individually (such as Microsoft 365/Azure AD, Google Workspace, AWS, GitHub) to monitor OAuth activity for those services. A single GitHub connector provides visibility only into GitHub-related OAuth activity, not the others.
$19
Get all 397 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
