You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains the groups shown in the following table.
Which groups can you manage by using Privileged Identity Management (PIM)?
A. Group2 only
B. Group1 and Group2 only
C. Group2 and Group4 only
D. Group1, Group2, and Group3 only
E. Group1, Group2, Group3, and Group4
Show Answer
Correct Answer: E
Explanation: PIM for Groups can manage assigned-membership security groups and Microsoft 365 groups. A group does not have to be security-enabled or role-assignable to qualify, so all four groups can be managed.
Sources:
https://learn.microsoft.com/en-us/graph/whats-new-earlier
Question 5
You have a Microsoft Entra tenant.
You need to configure protected actions to require privileged users to use phishing-resistant multifactor authentication (MFA).
What should you do first?
A. Create an access package.
B. Configure an authentication strength for the tenant.
C. Add an authentication context.
D. Create a Conditional Access policy.
Show Answer
Correct Answer: C
Explanation: To use protected actions with phishing-resistant MFA, you first add an authentication context. The authentication context is then referenced by a Conditional Access policy that enforces an authentication strength requiring phishing-resistant MFA. Authentication strengths and Conditional Access are configured afterward, so the initial step is to create the authentication context.
Question 5
HOTSPOT
You have a Microsoft 365 E5 subscription that contains two administrative units named AU1 and AU2.
You create five users as shown in the following table.
For which users can User2 and User3 reset passwords? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: User2: User5 only
User3: User1 and User2 only
Explanation: Each role assignment applies only to users in its specified administrative unit. User2’s Helpdesk Administrator role can reset the password of the non-admin user in AU1. User3’s Privileged Authentication Administrator role can reset passwords for both users in AU2, including administrators.
Question 6
You have a Microsoft Entra tenant that contains the users shown in the following table.
Admin4 creates a Conditional Access policy named Policy1 by using the Require multifactor authentication for Azure management template.
Which users will be required to use multi-factor authentication (MFA) the next time they sign in?
A. Admin2 and Admin3 only
B. Admin1 and Admin4 only
C. Admin1, Admin2, and Admin3 only
D. Admin1, Admin2, Admin3, and Admin4
Show Answer
Correct Answer: C
Explanation: The template targets all users for MFA when accessing Azure management, but automatically excludes the user creating the policy to help prevent lockout. Therefore Admin1, Admin2, and Admin3 are required to use MFA; Admin4 is excluded.
Question 6
You have a Microsoft 365 tenant.
All users have mobile phones and Windows 11 laptops.
The users frequently work from remote locations that do not have Wi-Fi access or mobile phone connectivity. While working from the remote locations, the users connect their laptop to a wired network that has internet access.
You plan to implement multi-factor authentication (MFA).
Which MFA authentication method can the users use from the remote location?
A. email В. Windows Hello for Business
C. voice
D. an app password
Show Answer
Correct Answer: B
Explanation: Windows Hello for Business can satisfy MFA on a Windows 11 device using a device-bound credential (PIN/biometric plus TPM-backed key) and only requires the laptop's internet connection. Email is not a Microsoft Entra MFA method, voice requires phone connectivity, and app passwords are legacy credentials that do not perform MFA.
Sources:
https://www.brainscape.com/flashcards/sc-300-set-2-15459532/packs/21970233
Question 7
You have an Azure subscription that contains the resources shown in the following table.
You need to grant permissions to the resources by using attribute-based access control (ABAC).
To which resource can you grant permissions?
A. Vault1
B. VM1
C. App1
D. Storage1
Show Answer
Correct Answer: D
Explanation: Azure role-assignment conditions (ABAC) are supported for applicable Azure Storage data roles, such as roles for blob or queue data. Of the listed resources, Storage1 is the supported resource.
Question 7
HOTSPOT
-
You have a Microsoft 365 E5 subscription that contains a user named User1.
User1 needs to perform the following tasks:
• Create a Microsoft 365 group named Group1 that has dynamic user membership
• Assign a Microsoft Entra Suite license to Group1.
In which portals can User1 perform each task? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Create Group1: Microsoft Entra admin center and Microsoft Intune admin center only
Assign a Microsoft Entra Suite license to Group1: Microsoft 365 admin center only
Explanation: Dynamic membership can be configured when creating the group in Entra or Intune. Group-based license assignments are managed in the Microsoft 365 admin center.
Question 8
You have a Microsoft Entra tenant that contains the users shown in the following table.
The tenant has the authentication methods shown in the following table.
Which users will sign in to cloud apps by using number matching?
A. User1 only
B. User2 only
C. User3 only
D. User1 and User2 only
E. User2 and User3 only
Show Answer
Correct Answer: A
Explanation: User1 is in Group1, where Microsoft Authenticator is enabled. Authenticator push notifications use number matching. User2 has a FIDO2 security key, and User3 has certificate-based authentication; neither uses number matching.
Question 8
HOTSPOT
-
You have a Microsoft Entra tenant that contains two remote networks named RemoteNetwork1 and RemoteNetwork2 and the users shown in the following table.
You have the devices shown in the following table.
You have a Conditional Access policy that has the following settings:
o Name: CAPolicy1
o Assignments
- Users: Group1, Group2
- Target resources: All internet resources with Global Secure Access
o Access controls
- Grant: Require multifactor authentication
o Enable policy: On
Global Secure Access traffic forwarding is configured as shown in the following exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: User1: Yes
User2: Yes
User3: No
Explanation: RemoteNetwork1 is assigned to the traffic profile, so traffic from User1 and User2 can be forwarded through Global Secure Access even though Device2 has no client. RemoteNetwork2 is not assigned.
Question 8
HOTSPOT
-
You have a Microsoft Entra tenant named contoso.com that contains a user named User1.
User1 has the devices shown in the following table:
On November 5, 2025, you create and enforce terms of use in contoso.com that has the following settings:
• Name: Terms1
• Display name: Contoso terms of use
• Require users to expand the terms of use: On
• Require users to consent on every device: On
• Expire consents: On
• Expire starting on: December 10, 2025
• Frequency: Monthly
On November 15, 2025, User1 accepts Terms1 on Device3.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
No
Yes
Explanation: Per-device consent requires a Microsoft Entra-registered device. Device1 is registered and has not yet accepted, so acceptance is allowed. Device2 is not registered, so per-device terms cannot be accepted. Device3 already accepted on Nov 15; monthly expiration starts Dec 10, so on Dec 7 the existing consent is still valid.
$19
Get all 410 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
