You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Cloud Apps.
You plan to increase app security for the subscription.
You need to identify which apps do NOT require user authentication.
What should you do in the Microsoft 365 Defender portal?
A. Review the cloud app catalog.
B. Create an OAuth policy and review alerts.
C. Create a snapshot Cloud Discovery report.
D. Create a discovered app query.
Show Answer
Correct Answer: A
Explanation: To identify apps that do NOT require user authentication in Microsoft Defender for Cloud Apps, you should review the Cloud App Catalog. The catalog includes security risk factors such as whether an app requires user authentication, and you can filter on 'Requires user authentication = No'. Other options focus on alerts, OAuth usage, or discovery reports, which are not the primary or most direct method for identifying authentication requirements.
Question 169
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have a Microsoft 365 tenant.
All users must use the Microsoft Authenticator app for multi-factor authentication (MFA) when accessing Microsoft 365 services.
Some users report that they received an MFA prompt on their Microsoft Authenticator app without initiating a sign-in request.
You need to block the users automatically when they report an MFA request that they did not initiate.
Solution: From the Azure Active Directory admin center, you configure the Block/unblock users settings for multi-factor authentication (MFA).
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Configuring Block/unblock users in Azure AD MFA settings is a manual administrative control. It does not automatically block users based on reported unsolicited MFA prompts. Automatic blocking requires features like Fraud Alert/Report suspicious activity or risk-based policies, not the basic block/unblock user setting.
Question 170
You have an Azure AD tenant.
You deploy a new enterprise application named App1.
When users attempt to provide App1 with access to the tenant, the attempt fails.
You need to ensure that the users can request admin consent for App1. The solution must follow the principle of least privilege.
What should you do first?
A. Enable admin consent requests for the tenant.
B. Designate a reviewer of admin consent requests for the tenant.
C. From the Permissions settings of App1, grant App1 admin consent for the tenant.
D. Create a Conditional Access policy for App1.
Show Answer
Correct Answer: A
Explanation: To allow users to request admin consent, the tenant-wide setting for admin consent requests must be enabled first. Without this, users cannot submit consent requests at all. This approach follows least privilege because it does not grant admin consent directly or elevate user permissions; it only enables the request workflow. Designating reviewers is a secondary step that only applies after the feature is enabled.
Question 171
HOTSPOT
-
You have an Azure AD tenant.
You need to configure the following External Identities features:
• B2B collaboration
• Monthly active users (MAU)-based pricing
Which two settings should you configure? To answer, select the settings in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: External collaboration settings configure B2B collaboration behavior for external users. Linked subscriptions are required to enable and manage Monthly Active Users (MAU)-based pricing for External Identities.
Question 172
You have an Azure AD tenant that contains a user named User1 and a Microsoft 365 group named Group1. User1 is the owner of Group1.
You need to ensure that User1 is notified every three months to validate the guest membership of Group1.
What should you do?
A. Configure the External collaboration settings.
B. Create an access review.
C. Configure an access package.
D. Create a group expiration policy.
Show Answer
Correct Answer: B
Explanation: To notify a group owner periodically to validate guest membership, you must use Microsoft Entra ID access reviews. Access reviews can be scheduled (for example, every three months) and can be configured so that the group owner reviews and approves or removes guest users. External collaboration settings are global controls, access packages are for entitlement-managed resource bundles, and group expiration policies handle inactive groups—not membership validation.
Question 173
You have a Microsoft Exchange organization that uses an SMTP address space of contoso.com.
Several users use their contoso.com email address for self-service sign-up to Azure AD.
You gain global administrator privileges to the Azure AD tenant that contains the self-signed users.
You need to prevent the users from creating user accounts in the contoso.com Azure AD tenant for self-service sign-up to Microsoft 365 services.
Which PowerShell cmdlet should you run?
A. Update-MgOrganization
B. Update-MgPolicyPermissionGrantPolicyExclude
C. Update-MgDomain
D. Update-MgDomainFederationConfiguration
Show Answer
Correct Answer: A
Explanation: To block self-service sign-up using a verified domain (contoso.com), you must disable the ability for email-verified users to join the organization. This is an organization-wide tenant setting. The Update-MgOrganization cmdlet configures these tenant properties (for example, AllowEmailVerifiedUsers = $false). The other options manage permission grant policies or domain federation and do not control self-service user sign-up behavior.
Question 174
You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users.
From the Groups blade in the Azure Active Directory admin center, you assign Microsoft Office 365 Enterprise E5 licenses to a group that includes all users.
You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort.
What should you use?
A. the Update-MgGroup cmdlet
B. the Licenses blade in the Azure Active Directory admin center
C. the Set-WindowsProductKey cmdlet
D. the Administrative units blade in the Azure Active Directory admin center
Show Answer
Correct Answer: B
Explanation: To remove directly assigned Office 365 E3 licenses from many users with minimal effort, use the Licenses blade in the Azure Active Directory admin center. From there, you can view users with the E3 license and remove the direct assignments in bulk. The other options do not provide a simple or appropriate method for bulk removal of user-assigned licenses.
Question 175
You have a Microsoft 365 tenant.
An on-premises Active Directory domain is configured to sync with the Azure AD tenant. The domain contains the servers shown in the following table.
The domain controllers are prevented from communicating to the internet.
You implement Azure AD Password Protection on Server1 and Server2.
You deploy a new server named Server4 that runs Windows Server 2022.
You need to ensure that Azure AD Password Protection will continue to work if a single server fails.
What should you implement on Server4?
A. Azure AD Connect
B. Azure AD Application Proxy
C. Password Change Notification Service (PCNS)
D. the Azure AD Password Protection proxy service
Show Answer
Correct Answer: D
Explanation: Azure AD Password Protection for on-premises AD requires the Azure AD Password Protection proxy service to communicate with Azure because domain controllers cannot access the internet. To avoid a single point of failure, multiple proxy servers must be deployed. Installing the Azure AD Password Protection proxy service on Server4 provides redundancy so password validation continues if one existing proxy server fails.
Question 176
You configure a new Microsoft 365 tenant to use a default domain name of contoso.com.
You need to ensure that you can control access to Microsoft 365 resources by using conditional access policies.
What should you do first?
A. Disable Security defaults.
B. Configure password protection for the Azure AD tenant.
C. Configure a multi-factor authentication (MFA) registration policy.
D. Disable the User consent settings.
Show Answer
Correct Answer: A
Explanation: In a new Microsoft 365 tenant, Security defaults are enabled by default. When Security defaults are on, you cannot create or manage custom Conditional Access policies because the built-in protections override them. Therefore, the first required step to control access using Conditional Access policies is to disable Security defaults. The other options can be configured later but do not enable Conditional Access by themselves.
Question 177
You have a Microsoft 365 E5 subscription that contains three users named User1, User2, and User3 and a Microsoft SharePoint Online site named Site1.
The subscription contains the devices shown in the following table.
The users sign in to the devices as shown in the following table.
You have a Conditional Access policy that has the following settings:
• Name: CA1
• Assignments
o Users and groups: User1, User2, User3
o Cloud apps or actions: SharePoint - Site1
• Access controls
o Session: Use app enforced restrictions
From the SharePoint admin center, you configure Access control for unmanaged devices to allow limited, web-only access.
Which users will have full access to Site1?
A. User1 only
B. User2 only
C. User3only
D. User1 and User2 only
E. User1, User2, and User3
Show Answer
Correct Answer: B
Explanation: With SharePoint Access control for unmanaged devices set to allow limited, web-only access, only users on managed devices get full access. A managed device is one that is hybrid/Azure AD joined or compliant in Intune. User1’s device is joined but non-compliant, so it’s treated as unmanaged. User3’s device is not joined and not compliant, so it’s unmanaged. User2’s device is compliant, therefore managed, and gets full access.
$19
Get all 397 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
