HOTSPOT -
You have an Azure subscription named Sub1 that contains two storage accounts named storage1 and storage2 and the blob containers shown in the following table.
Sub1 contains the users shown in the following table.
Condition1 has the following definition:
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: 1. No
2. Yes
3. Yes
Explanation: Condition1 permits blob read only when the container name is cont1. User1 can read blobs in cont1 (blob1 and blob3), but not blob2 in cont2. Condition2 restricts only write operations matching the path pattern; it does not restrict read access, so the Storage Blob Data Owner role still allows reading blob1.
Question 69
You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1.
You need to enable Microsoft Defender for Cloud Apps session control for Site1.
Which type of policy should you create first?
A. access
B. app governance
C. session
D. Conditional Access
Show Answer
Correct Answer: D
Explanation: Microsoft Defender for Cloud Apps session control is initiated through a Microsoft Entra Conditional Access policy by selecting 'Use Conditional Access App Control' under Session controls for the target cloud app (such as SharePoint Online). After that, session policies can be created in Defender for Cloud Apps to enforce monitoring or restrictions. Therefore, the first policy that must be created is a Conditional Access policy.
Question 70
You have an Azure subscription that contains two virtual machines named VM1 and VM2 and an Azure SQL managed instance named SQL1.
You need to ensure that VM1 and VM2 can retrieve data from SQL1.
The solution must minimize administrative effort.
What should you create first?
A. a certificate
B. a shared access signature (SAS) token
C. a managed identity
D. a Microsoft Entra user account
Show Answer
Correct Answer: C
Explanation: Create a managed identity for the virtual machines first. A managed identity allows Azure VMs to authenticate to Azure SQL Managed Instance through Microsoft Entra ID without storing or managing credentials, minimizing administrative effort. Certificates require lifecycle management, SAS tokens are for Azure Storage rather than SQL authentication, and a regular Microsoft Entra user account is intended for users rather than Azure workloads.
Question 71
You have a Microsoft 365 tenant.
All users have mobile phones and Windows 10 laptops.
The users frequently work from remote locations that do not have Wi-Fi access or mobile phone connectivity. While working from the remote locations, the users connect their laptop to a wired network that has internet access.
You plan to implement multi-factor authentication (MFA).
Which MFA authentication method can the users use from the remote location?
A. Windows Hello for Business
B. an app password
C. a notification through the Microsoft Authenticator app
D. security questions
Show Answer
Correct Answer: A
Explanation: Windows Hello for Business is a phishing-resistant MFA method that uses a registered device plus a biometric or PIN. It can authenticate without requiring the user's mobile phone to have Wi-Fi or cellular connectivity. App passwords are for legacy authentication and are not MFA, Microsoft Authenticator push notifications require the mobile device to be connected, and security questions are not a Microsoft 365 MFA authentication method.
Question 72
You have a Microsoft Entra tenant.
You open the risk detections report.
Which risk detection type is classified as a user risk?
A. password spray
B. anonymous IP address
C. unfamiliar sign-in properties
D. Microsoft Entra threat intelligence
Show Answer
Correct Answer: D
Explanation: Microsoft Entra ID Protection distinguishes between sign-in risk detections and user risk detections. Password spray, anonymous IP address, and unfamiliar sign-in properties are sign-in risk detections because they evaluate the risk of a specific authentication attempt. Microsoft Entra threat intelligence is a user risk detection, indicating the user's credentials are believed to be compromised based on Microsoft's threat intelligence.
Question 73
You have a Microsoft Entra tenant.
You open the risk detections report.
Which risk detection type is classified as a user risk?
A. impossible travel
B. anonymous IP address
C. atypical travel
D. leaked credentials
Show Answer
Correct Answer: D
Explanation: In Microsoft Entra ID Protection, user risk represents the likelihood that a user's identity has been compromised. 'Leaked credentials' is a user risk detection because it indicates the user's credentials have been exposed. 'Impossible travel', 'anonymous IP address', and 'atypical travel' are sign-in risk detections based on suspicious authentication activity.
Question 74
You have a Microsoft 365 E5 subscription.
You create an access review named Review1. Review1 requires that every six months, Microsoft 365 group owners review guest user access to their groups.
You need to ensure that if the group owners fail to review the membership of Review1, guest users are removed automatically.
Which settings should you configure for Review1?
A. Scheduling
B. When completed
C. General
D. Reviewers
Show Answer
Correct Answer: B
Explanation: The required behavior is controlled by the access review completion settings. In the 'When completed' section, you configure the action to apply review results and specify what happens to users who are not reviewed, such as automatically removing guest users' access if reviewers do not respond. Scheduling only defines recurrence, General covers metadata, and Reviewers specifies who performs the review.
Question 75
You have a Microsoft 365 tenant.
All users have mobile phones and Windows 10 laptops.
The users frequently work from remote locations that do not have Wi-Fi access or mobile phone connectivity. While working from the remote locations, the users connect their laptop to a wired network that has internet access.
You plan to implement multi-factor authentication (MFA).
Which MFA authentication method can the users use from the remote location?
A. a verification code from the Microsoft Authenticator app
B. SMS
C. an app password
D. a notification through the Microsoft Authenticator app
Show Answer
Correct Answer: A
Explanation: The Microsoft Authenticator app can generate time-based one-time passcodes (verification codes) offline, so users can complete MFA even without cellular service or Wi-Fi. SMS requires mobile connectivity, push notifications require internet connectivity for the mobile device, and app passwords are for legacy authentication rather than an MFA verification method.
Question 76
HOTSPOT
-
You have a Microsoft 365 E5 subscription that contains two groups named Group1 and Group2 and the users shown in the following table.
Group2 is a member of Group1.
You configure cross-tenant synchronization with a partner organization named fabrikam.com by using the following configurations:
• Provisioning status: On
• Users and groups: Group1
• Prevent accidental deletion: 500
• Scope: Sync only assigned users and groups
• Scoping filter: Department EQUALS Marketing
From the Cross-tenant synchronization settings, you set Provisioning Mode to Automatic.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
No
No
Explanation: Only users in the assigned scope that satisfy the scoping filter are provisioned. Assigning Group1 does not expand nested group membership for provisioning scope, so User2 is not included. User1 is a direct member of Group1 and Department matches Marketing. User3 is filtered out because Department is HR.
Question 77
You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains a registered app named App1.
You have a partner organization that has a Microsoft Entra tenant. The tenant contains a registered app named App2.
You need to ensure that App1 can access App2.
Which two types of credentials can App1 use? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. certificate
B. managed identity
C. secret
D. user account
E. one-time password
Show Answer
Correct Answer: A, C
Explanation: For application-to-application access between Microsoft Entra tenants, the standard OAuth 2.0 client credentials flow authenticates the calling application using either a client certificate or a client secret. Managed identities are intended for Azure-managed resources and are not used as cross-tenant credentials for a registered app in this scenario. User accounts and one-time passwords are user authentication methods, not application credentials.
$19
Get all 387 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
