You have a Microsoft 365 E5 subscription and an Azure subscription.
You plan to analyze Microsoft Entra sign-in logs by using Azure Monitor.
You need to configure diagnostic settings for Microsoft Entra.
Which destination should you configure for the sign-in logs?
A. an Azure event hub
B. an Azure SQL database
C. a Log Analytics workspace
D. an Azure Storage account
Show Answer
Correct Answer: C
Explanation: Microsoft Entra diagnostic settings support sending sign-in logs to Log Analytics, Azure Storage, or Event Hubs. To analyze the logs using Azure Monitor, the appropriate destination is a Log Analytics workspace, which enables Azure Monitor Logs and KQL queries, alerts, and workbooks. Azure SQL Database is not a supported diagnostic destination.
Question 79
HOTSPOT
-
You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains two Azure key vaults named KV1 and KV2 that use Azure role-based access control (Azure RBAC).
The subscription contains the users shown in the following table.
KV1 contains a secret named Secret1. KV2 contains a secret named Secret2.
Which users can read the values of each secret? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Secret1: User1 and User3 only
Secret2: User1 only
Explanation: Key Vault Administrator at subscription scope can access all key vaults. Key Vault Reader can view metadata but cannot read secret values. Key Vault Secrets User can read secret values only within the assigned key vault (KV1).
Question 80
You have a Microsoft 365 subscription.
You have an Azure subscription that contains an Azure App Service web app named App1.
You have multiple devices that run Windows and are enrolled in Microsoft Intune.
You deploy the Global Secure Access client to the devices by using Intune.
You need to configure private access to App1.
What should you do next?
A. Create a remote network.
B. Configure a traffic forwarding profile.
C. Deploy a private network connector.
D. Create an application security group.
Show Answer
Correct Answer: C
Explanation: Microsoft Entra Private Access requires a private network connector (in a connector group) to broker connectivity between the Global Secure Access service and private resources before client traffic can reach them. After the connector is in place, you configure the application and enable the Private Access traffic forwarding profile.
Sources:
https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-per-app-access
https://learn.microsoft.com/en-us/entra/global-secure-access/quickstart-per-app-access
Question 81
You have a Microsoft Entra tenant that contains the users shown in the following table.
Admin4 creates a Conditional Access policy named Policy1 by using the Require multifactor authentication for Azure management template.
Which users will be required to use multi-factor authentication (MFA) the next time they sign in?
A. Admin2 and Admin3 only
B. Admin1 and Admin4 only
C. Admin1, Admin2, and Admin3 only
D. Admin1, Admin2, Admin3, and Admin4
Show Answer
Correct Answer: C
Explanation: The 'Require multifactor authentication for Azure management' Conditional Access template targets administrative roles. When created from this template, the administrator creating the policy is excluded by default to reduce the risk of lockout. Therefore, the other applicable administrative users (Admin1, Admin2, and Admin3) will be required to use MFA at their next sign-in, while Admin4, as the policy creator, is excluded.
Question 84
HOTSPOT
-
You have a Microsoft Entra tenant that contains the identities shown in the following table.
Group1 has the following configurations:
• Owners: User1, User4
• Members: User1, Managed2, Group2
You create an access review that has the following settings:
• Name: Review1
• Review scope: Select Teams + Groups
• Group: Group1
• Scope: All users
• Select reviewers: Group owner(s)
The Fallback reviewers setting is NOT configured.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
Yes
No
Explanation: Group owners review direct members of the selected group. Self-review is not allowed when acting as a group-owner reviewer. Managed identities that are direct group members can be reviewed. Nested group users are not reviewed as members of the parent group; only direct membership is in scope.
Question 85
HOTSPOT
-
You have a Microsoft Entra tenant that contains the users shown in the following table.
The tenant contains the identities shown in the following table.
Which users can create custom security attributes, and to which identities can the attributes be assigned? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: User2 only
Service1 only
Explanation: Only the Attribute Definition Administrator role can create custom security attribute definitions by default; Global Administrator does not inherently have this permission. Custom security attributes are assignable to users and service principals, and among the listed identities only the service principal qualifies.
Question 86
You have a Microsoft Entra tenant named contoso.com that contains an enterprise application named App1.
A contractor uses the credentials of
.
You need to ensure that you can provide the contractor with access to App1. The contractor must be able to authenticate as
.
What should you do?
A. Run the New-MgUser cmdlet.
B. Run the New-MgInvitation cmdlet.
C. Configure the External collaboration settings.
D. Implement Microsoft Entra Connect sync.
Show Answer
Correct Answer: B
Explanation: The correct action is to invite the external contractor as a Microsoft Entra B2B guest user by using the New-MgInvitation cmdlet. This creates a guest invitation so the contractor can authenticate with their existing external identity and be granted access to the enterprise application. New-MgUser creates a new user in the tenant rather than inviting an external identity, External collaboration settings only control whether B2B invitations are allowed and do not perform the invitation, and Entra Connect is for synchronizing on-premises identities, not onboarding external contractors.
Question 87
SIMULATION
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Microsoft 365 Username:
Microsoft 365 Password: =1122334455667788
If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 99999999
-
You need to configure Microsoft Entra Identity Protection to meet the following requirements:
• Require multi-factor authentication (MFA) for any sign-ins at the high risk level.
• Apply the configuration to all users except for Mod Administrator.
To complete this task, sign in to the appropriate admin center.
Show Answer
Correct Answer: Microsoft Entra admin center → Identity Protection → Sign-in risk policy
Include: All users
Exclude: Mod Administrator
Sign-in risk: High
Access: Allow access, Require multifactor authentication
Enable the policy.
Explanation: Configure a Sign-in risk policy targeting all users except Mod Administrator, trigger on High sign-in risk, and require MFA by selecting Allow access with Require multifactor authentication, then enable the policy.
Question 88
You have a management group named Group1 that contains two Azure subscriptions named Sub1 and Sub2. The subscriptions are linked to a Microsoft Entra tenant that contains a user named User1.
You need to ensure that User1 can onboard Sub1 to Permissions Management. The solution must follow the principle of least privilege.
Which permission should you grant to User1?
A. Microsoft.Authorization/roleAssignments/read for Sub1
B. Microsoft.Authorization/roleAssignments/write for Group1
C. MicrosoftAuthorization/roleAssignments/write for Sub1
D. Microsoft.Authorization/roleAssignments/read for Group1
Show Answer
Correct Answer: C
Explanation: Onboarding an Azure subscription to Microsoft Entra Permissions Management requires the ability to create the required role assignments, which requires the Microsoft.Authorization/roleAssignments/write permission. Applying this permission at the Sub1 scope satisfies the principle of least privilege because it grants only the necessary permission on the single subscription being onboarded, rather than at the management group scope.
Question 89
HOTSPOT -
Your on-premises network contains an Active Directory domain that uses Microsoft Entra Connect sync to sync with a Microsoft Entra tenant.
You need to configure Microsoft Entra Connect sync to meet the following requirements:
• Microsoft Entra sign-ins must be authenticated by an Active Directory domain controller.
• Active Directory domain users must be able to use Microsoft Entra self-service password reset (SSPR).
• Minimize administrative effort.
What should you use for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Authentication by the domain controller: Pass-through authentication
SSPR: Password writeback
Explanation: Pass-through authentication validates sign-ins against on-premises Active Directory domain controllers without requiring AD FS, minimizing administration. Password writeback enables Microsoft Entra self-service password reset to update passwords back to on-premises Active Directory.
$19
Get all 387 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
