You have a Microsoft Entra tenant.
You create an enterprise application collection named HR Apps that has the following settings:
• Applications: App1, App2, App3
• Owners: Admin1
• Users and groups: HRUsers
All three apps have the following Properties settings:
• Enabled for users to sign in: Yes
• User assignment required: Yes
• Visible to users: Yes
Users report that they only see App1 and App2 in the My Apps portal.
You need to ensure that the users can also see App3.
What should you do from App3?
A. From Single sign-on, configure a sign-on method.
B. From Permissions, review the User consent permissions.
C. From Users and groups, add HRUsers.
D. From Properties, change User assignment required to No.
Show Answer
Correct Answer: C
Explanation: Enterprise application collections do not automatically grant app assignment. Because App3 has 'User assignment required' set to Yes, the HRUsers group must also be assigned directly to App3 under Users and groups for it to appear in My Apps. Configuring SSO or reviewing permissions does not affect My Apps visibility, and disabling user assignment is unnecessary.
Question 13
HOTSPOT
-
You have a Microsoft Entra tenant that contains an administrative unit named AU1. AU1 is configured for assigned membership.
The tenant contains the users shown in the following table.
The tenant contains the groups shown in the following table.
For AU1, you update the following configurations:
• Membership type: Dynamic User
• Dynamic membership rule: (user.department -eq "hr")
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
Yes
No
Explanation: Changing the administrative unit to Dynamic User evaluates only user membership by the rule. User1 matches department = HR and is included. User2 does not match and is removed. Existing group membership is not governed by the dynamic user rule, so the HR group remains in the administrative unit.
Question 14
HOTSPOT
-
You have a Microsoft Entra tenant that contains 1,000 users. The users are assigned Microsoft Entra Suite licenses.
You perform the following actions:
• Deploy Global Secure Access.
• Create a Global Secure Access security profile named Profile1.
• Create the following Conditional Access policies:
o Name: CApolicy1
o Target resources: All internet resources with Global Secure Access
o Name: CApolicy2
o Session:
- Use Global Secure Access security profile: Profile1
To which Global Secure Access traffic forwarding profiles is CAPolicy1 linked, and to which profile does Profile1 apply? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: CAPolicy1: Microsoft traffic profile and Internet access profile
Profile1: Internet access profile
Explanation: Conditional Access targeting 'All internet resources with Global Secure Access' is associated with Internet Access and Microsoft Traffic forwarding. Global Secure Access security profiles are applied to the Internet access profile via the Conditional Access session control.
Question 15
You have a Microsoft 365 E5 subscription.
Users authorize third-party cloud apps to access their data.
You need to configure an alert that will be triggered when an app requires high permissions and is authorized by more than 20 users.
Which type of policy should you create in Microsoft Defender for Cloud Apps?
A. app discovery policy
B. access policy
C. OAuth app policy
D. activity policy
Show Answer
Correct Answer: C
Explanation: OAuth app policies in Microsoft Defender for Cloud Apps are designed to monitor and alert on third-party OAuth applications, including conditions such as high permission levels and the number of users who have authorized the app. This matches the requirement to trigger an alert when an app with high permissions is authorized by more than 20 users.
Question 16
HOTSPOT
-
You have an on-premises server named Server1 that runs Windows Server.
You have a Microsoft Entra tenant that contains an app registration named App1. App1 has Microsoft Graph application permissions.
You need to configure the environment to support App1. The solution must meet the following requirements:
• App1 must be accessible only from the corporate network.
• The credentials for App1 must NOT be stored as plain text.
• Non-interactive scheduled tasks on Server1 must be able to authenticate to App1.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: In the tenant: A Conditional Access policy
Scheduled tasks: Certificate
Explanation: Use Conditional Access to restrict the app to requests from the corporate network (for workload identities). For an on-premises Windows Server, managed identities are unavailable, and a certificate provides secure non-interactive authentication without storing a plain-text secret.
Question 17
You have a Microsoft Entra tenant.
You need to ensure that users are prevented from consenting to high-privilege permission requests for enterprise applications. The solution must ensure that the users can consent to low-risk permission requests.
What should you modify first?
A. Admin consent settings
B. Permission classifications
C. User consent settings
D. App registrations
Show Answer
Correct Answer: B
Explanation: To allow users to consent only to low-risk permissions while preventing consent to high-privilege permissions, you must first classify delegated permissions using permission classifications. After permissions are classified (for example, marking appropriate permissions as low impact), user consent settings can be configured to allow consent only for those low-impact permissions. Therefore, the first item to modify is Permission classifications.
Question 18
HOTSPOT
-
You have a Microsoft Entra tenant named contoso.com that has cross-tenant access configured as shown in the following table.
You have two partner organizations named Fabrikam, Inc. and A. Datum Corporation. Fabrikam has a Microsoft 365 domain named fabrikam.com. A. Datum has a Microsoft 365 domain named adatum.com.
You configure cross-tenant access for fabrikam.com as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
No
No
Explanation: Default cross-tenant settings block everything. A partner-specific configuration for fabrikam.com overrides defaults and allows inbound B2B collaboration, so Fabrikam users can be invited into Contoso. Outbound B2B collaboration from Contoso to partners remains blocked, so invitations to A. Datum are blocked and Contoso users cannot use B2B collaboration outbound to accept/access Fabrikam invitations.
Question 20
You have a Microsoft Entra tenant.
You need to add the Facebook social identity provider to the tenant. What should you do first?
A. Add a custom domain
B. Add a WS-Fed identity provider.
C. Add a SAML identity provider.
D. Set Enable guest self-service sign up via user flows to Yes.
Show Answer
Correct Answer: D
Explanation: Before adding the built-in Facebook social identity provider for external identities, guest self-service sign-up via user flows must be enabled in the Microsoft Entra tenant. Adding a custom domain or configuring WS-Fed/SAML providers is not the required first step for Facebook.
Question 21
You have a Microsoft Entra tenant that contains three users named User1, User2, and User3.
You need to configure just-in-time (JIT) access to admin roles by using Privileged Identity Management (PIM). The solution must meet the following requirements:
• Ensure that User1 can use the User Administrator role without approval.
• Ensure that User2 can use the User Administrator role once User3 has approved the role request of User2.
What should you create first?
A. role assignments
B. administrative units
C. security groups
D. Conditional Access policies
Show Answer
Correct Answer: C
Explanation: Create security groups first and make the groups eligible for the User Administrator role through PIM for Groups. PIM activation settings (such as requiring approval) are configured per role assignment, so using separate groups allows different activation policies: one group can allow User1 to activate without approval, while another group can require User3's approval before User2 can activate. Direct role assignments would share the same activation settings for that role. Administrative units and Conditional Access policies do not provide this separation.
Question 22
You have a Microsoft Entra tenant named contoso.com that contains an enterprise application named App1.
A contractor uses the credentials of
.
You need to ensure that you can provide the contractor with access to App1. The contractor must be able to authenticate as
.
What should you do?
A. Run the New-MgUser cmdlet.
B. Add a custom domain name to contoso.com.
C. Run the New-MgInvitation cmdlet.
D. Implement Microsoft Entra Connect sync.
Show Answer
Correct Answer: C
Explanation: To provide an external contractor access to an enterprise application while allowing them to authenticate with their existing external identity, invite them as a Microsoft Entra B2B guest user. The New-MgInvitation cmdlet creates the B2B invitation and guest account, enabling authentication with the contractor's home credentials. Creating a new user, adding a custom domain, or implementing Entra Connect do not address this scenario.
$19
Get all 387 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
