You have a Microsoft 365 tenant.
All users have mobile phones and Windows 10 laptops.
The users frequently work from remote locations that do not have Wi-Fi access or mobile phone connectivity. While working from the remote locations, the users connect their laptop to a wired network that has internet access.
You plan to implement multi-factor authentication (MFA).
Which MFA authentication method can the users use from the remote location?
A. Windows Hello for Business
B. an app password
C. a notification through the Microsoft Authenticator app
D. security questions
Show Answer
Correct Answer: A
Explanation: Windows Hello for Business can be used when the laptop has a wired internet connection and does not rely on a mobile phone, cellular service, or Wi‑Fi. It provides MFA by combining something the user has (the registered device) with something they know or are (PIN, fingerprint, or face). The other options require mobile connectivity, are not true MFA, or are not valid Microsoft 365 MFA methods.
Question 45
You have a Microsoft Entra tenant.
You open the risk detections report.
Which risk detection type is classified as a user risk?
A. password spray
B. anonymous IP address
C. unfamiliar sign-in properties
D. Microsoft Entra threat intelligence
Show Answer
Correct Answer: D
Explanation: In Microsoft Entra ID, risk detections are grouped into sign-in risk and user risk. Password spray, anonymous IP address, and unfamiliar sign-in properties are all sign-in risk detections related to a specific authentication attempt. Microsoft Entra threat intelligence is classified as a user risk because it indicates the user account itself may be compromised based on intelligence from Microsoft security sources.
Question 46
You have a Microsoft Entra tenant.
You open the risk detections report.
Which risk detection type is classified as a user risk?
A. impossible travel
B. anonymous IP address
C. atypical travel
D. leaked credentials
Show Answer
Correct Answer: D
Explanation: In Microsoft Entra ID Protection, user risk reflects the likelihood that a user's identity is compromised. "Leaked credentials" is a user risk because it indicates the user's credentials were exposed in a breach. The other options (impossible/atypical travel, anonymous IP) are sign-in risk detections tied to suspicious sign-in behavior, not the user identity itself.
Question 47
You have a Microsoft 365 E5 subscription.
You create an access review named Review1. Review1 requires that every six months, Microsoft 365 group owners review guest user access to their groups.
You need to ensure that if the group owners fail to review the membership of Review1, guest users are removed automatically.
Which settings should you configure for Review1?
A. Scheduling
B. When completed
C. General
D. Reviewers
Show Answer
Correct Answer: B
Explanation: To automatically remove guest users when group owners do not complete the access review, you must configure the **When completed** setting. This setting defines the default action at the end of the review period, such as removing access if no decision is made.
Question 48
You have a Microsoft 365 tenant.
All users have mobile phones and Windows 10 laptops.
The users frequently work from remote locations that do not have Wi-Fi access or mobile phone connectivity. While working from the remote locations, the users connect their laptop to a wired network that has internet access.
You plan to implement multi-factor authentication (MFA).
Which MFA authentication method can the users use from the remote location?
A. a verification code from the Microsoft Authenticator app
B. SMS
C. an app password
D. a notification through the Microsoft Authenticator app
Show Answer
Correct Answer: A
Explanation: The users have no mobile network or Wi‑Fi connectivity, but they do have internet access via a wired network. The Microsoft Authenticator app can generate offline time‑based one‑time passcodes (TOTP), which do not require any network connectivity on the phone. SMS and push notifications both require mobile or internet connectivity, and app passwords are legacy and not an MFA method. Therefore, the correct choice is a verification code from the Microsoft Authenticator app.
Question 49
HOTSPOT
-
You have a Microsoft 365 E5 subscription that contains two groups named Group1 and Group2 and the users shown in the following table.
Group2 is a member of Group1.
You configure cross-tenant synchronization with a partner organization named fabrikam.com by using the following configurations:
• Provisioning status: On
• Users and groups: Group1
• Prevent accidental deletion: 500
• Scope: Sync only assigned users and groups
• Scoping filter: Department EQUALS Marketing
From the Cross-tenant synchronization settings, you set Provisioning Mode to Automatic.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: User1: Yes
User2: No
User3: No
Explanation: Only Group1 is in scope. Provisioning includes users assigned through Group1 and matching the scoping filter (Department = Marketing). User1 is a direct member of Group1 and in Marketing. User2 is only a member of nested Group2, which is not evaluated for scope. User3 is in Group1 but excluded by the Department filter.
Question 51
You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains a registered app named App1.
You have a partner organization that has a Microsoft Entra tenant. The tenant contains a registered app named App2.
You need to ensure that App1 can access App2.
Which two types of credentials can App1 use? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. certificate
B. managed identity
C. secret
D. user account
E. one-time password
Show Answer
Correct Answer: A, C
Explanation: To allow App1 to access App2 across Microsoft Entra tenants, the standard approach is app-to-app authentication using OAuth 2.0 (client credentials flow). In this flow, an application authenticates using its own credentials, not a user.
Valid credential types are:
- Certificate: Uses a public/private key pair and is a supported, secure method for app authentication.
- Secret: Uses a client secret and is also a supported credential for app authentication.
Managed identities do not work across tenants, user accounts are not used in client credentials flow, and one-time passwords are only for interactive user sign-ins.
Question 52
You have a Microsoft 365 E5 subscription and an Azure subscription.
You plan to analyze Microsoft Entra sign-in logs by using Azure Monitor.
You need to configure diagnostic settings for Microsoft Entra.
Which destination should you configure for the sign-in logs?
A. an Azure event hub
B. an Azure SQL database
C. a Log Analytics workspace
D. an Azure Storage account
Show Answer
Correct Answer: C
Explanation: To analyze Microsoft Entra (Azure AD) sign-in logs with Azure Monitor, the logs must be sent to a Log Analytics workspace. This enables querying with KQL, integration with Azure Monitor and Microsoft Sentinel, alerting, and visualizations. Other destinations are for streaming or archiving, not direct analysis.
Question 53
HOTSPOT
-
You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains two Azure key vaults named KV1 and KV2 that use Azure role-based access control (Azure RBAC).
The subscription contains the users shown in the following table.
KV1 contains a secret named Secret1. KV2 contains a secret named Secret2.
Which users can read the values of each secret? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Secret1:
User1 and User3 only
Secret2:
User1 only
Explanation: User1 has Key Vault Administrator at subscription scope, which allows full access to secrets in all key vaults. User3 has Key Vault Secrets User scoped to KV1 only, so can read Secret1 but not Secret2. User2 has Key Vault Reader, which does not permit reading secret values.
Question 54
You have a Microsoft 365 subscription.
You have an Azure subscription that contains an Azure App Service web app named App1.
You have multiple devices that run Windows and are enrolled in Microsoft Intune.
You deploy the Global Secure Access client to the devices by using Intune.
You need to configure private access to App1.
What should you do next?
A. Create a remote network.
B. Configure a traffic forwarding profile.
C. Deploy a private network connector.
D. Create an application security group.
Show Answer
Correct Answer: B
Explanation: App1 is an Azure App Service hosted in Azure, not an on‑premises or customer‑managed private network. Private network connectors are only required to bridge Global Secure Access to on‑premises or isolated private networks. For Azure App Service, private access is achieved by integrating the app with a Private Endpoint and then configuring Global Secure Access to route traffic for the app’s private FQDN. The next required step on the Global Secure Access side is to configure a traffic forwarding (Private Access) profile so Intune‑managed devices send that traffic through the Global Secure Access client.
$19
Get all 397 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
