Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
Before external guests can open a partner portal, legal wants each of them to accept a confidentiality agreement as part of signing in. A Conditional Access policy targets the guests and the portal. Which grant control should the policy require?
ARequire the organization's terms of use
BRequire multifactor authentication
CRequire the device to be marked as compliant
DRequire a password change
Show the answer and why
ARequire the organization's terms of use
Correct
This grant control requires users to accept the organization's terms of use before access is granted.
BRequire multifactor authentication
Incorrect
MFA verifies the user with another factor; it doesn't ask for acceptance of an agreement.
CRequire the device to be marked as compliant
Incorrect
This checks the device against compliance policies; it doesn't present an agreement.
DRequire a password change
Incorrect
A password change resets the user's credential; it doesn't present an agreement.
In a Conditional Access policy, assignments decide when the policy applies and access controls decide what happens. Grant controls include requiring MFA, terms of use and other requirements before access is granted.
A new help desk lead will create user accounts, manage group memberships and handle support tickets in Microsoft Entra ID. Following the principle of least privilege, which built-in role should she get?
AGlobal Administrator
BUser Administrator
CBilling Administrator
DSecurity Administrator
Show the answer and why
AGlobal Administrator
Incorrect
Global Administrator has access to every administrative feature, far more than managing users and groups needs.
BUser Administrator
Correct
User Administrator can create and manage all aspects of users and groups, manage support tickets and monitor service health.
CBilling Administrator
Incorrect
Billing Administrator makes purchases and manages subscriptions; it can't manage users and groups.
DSecurity Administrator
Incorrect
Security Administrator is a cross-service role for Microsoft security services, not for managing users and groups.
Microsoft Entra ID includes many built-in roles with fixed permissions. The best practice is to grant the least privilege needed: someone who mostly manages users and groups should get User Administrator rather than Global Administrator, which limits the damage a compromised account could do.
A user already holds the User Administrator role in Microsoft Entra ID. She now also needs to manage the virtual machines in one Azure subscription. What does she need?
AAn Azure RBAC role assignment at that subscription's scope
BA Microsoft Entra custom role that includes Azure virtual machine permissions
CThe Security Administrator role in Microsoft Entra ID
DNothing more, since User Administrator also covers the subscription's resources
Show the answer and why
AAn Azure RBAC role assignment at that subscription's scope
Correct
Azure RBAC roles control access to Azure resources such as virtual machines.
BA Microsoft Entra custom role that includes Azure virtual machine permissions
Incorrect
Microsoft Entra roles control Microsoft Entra resources such as users, groups and applications, not virtual machines.
CThe Security Administrator role in Microsoft Entra ID
Incorrect
Security Administrator is a cross-service role for Microsoft security services, not for managing Azure virtual machines.
DNothing more, since User Administrator also covers the subscription's resources
Incorrect
User Administrator manages users and groups in Microsoft Entra ID; it gives no access to Azure resources.
Microsoft Entra RBAC and Azure RBAC apply the same idea to different things. Microsoft Entra roles control access to Microsoft Entra resources such as users, groups and applications. Azure roles control access to Azure resources such as virtual machines and storage through Azure Resource Manager, with their own role definitions, assignments and access checks.
Which two signals can a Conditional Access policy evaluate as conditions when it decides whether to ask for extra verification? (Choose TWO.)
ASign-in risk reported by Microsoft Entra ID Protection
BThe device platform, such as iOS or Windows
CThe subscription's secure score in Microsoft Defender for Cloud
DWhether the user finished a course in Attack simulation training
EHow many days ago the user last changed their password
Show the answer and why
ASign-in risk reported by Microsoft Entra ID Protection
Correct
Sign-in risk and user risk come from the integration with ID Protection.
BThe device platform, such as iOS or Windows
Correct
Device platform targets policies by the operating system running on the device.
CThe subscription's secure score in Microsoft Defender for Cloud
Incorrect
Secure score measures cloud security posture; it isn't a Conditional Access condition.
DWhether the user finished a course in Attack simulation training
Incorrect
Attack simulation training results aren't one of the conditions a policy can evaluate.
EHow many days ago the user last changed their password
Incorrect
Password age isn't among the conditions a policy can evaluate.
Conditional Access is Microsoft's Zero Trust policy engine. Besides users, target resources and network, a policy can combine conditions such as sign-in risk and user risk from ID Protection, insider risk from Microsoft Purview adaptive protection and the device platform.
How does Microsoft describe a Conditional Access policy at its simplest?
AAs an if-then statement about access and a required action
BAs a list of passwords that users aren't allowed to choose when they reset
CAs a role definition with a set of permissions
DAs a scheduled review of who still needs access
Show the answer and why
AAs an if-then statement about access and a required action
Correct
Conditional Access policies take signals into account and enforce decisions in an if-then form.
BAs a list of passwords that users aren't allowed to choose when they reset
Incorrect
That describes a banned password list.
CAs a role definition with a set of permissions
Incorrect
That describes a Microsoft Entra role.
DAs a scheduled review of who still needs access
Incorrect
That describes an access review.
Conditional Access is Microsoft's Zero Trust policy engine. At their simplest, its policies are if-then statements: if a user wants to access a resource, such as Microsoft 365, then they must complete an action, such as multifactor authentication.
A company wants a Conditional Access policy to require MFA only when people sign in from outside its office IP address ranges. Which part of the policy handles the office ranges?
AThe network assignment, with those addresses defined as a trusted named location
BThe session controls
CThe device platform condition
DThe grant control require terms of use
Show the answer and why
AThe network assignment, with those addresses defined as a trusted named location
Correct
Policies can include or exclude trusted networks, IP address ranges and named locations.
BThe session controls
Incorrect
Session controls limit experiences inside apps, such as blocking downloads, after access is granted.
CThe device platform condition
Incorrect
Device platform targets the operating system, not where the sign-in comes from.
DThe grant control require terms of use
Incorrect
Terms of use has nothing to do with location.
A Conditional Access policy's assignments include users, target resources, network and conditions. The network assignment controls access based on the user's network or physical location; administrators can include or exclude trusted networks, trusted IP address ranges, named locations and compliant networks.
Which Conditional Access access control is the most restrictive decision a policy can make?
ARequire multifactor authentication
BBlock access
CRequire a compliant device
DSign-in frequency
Show the answer and why
ARequire multifactor authentication
Incorrect
Requiring MFA still grants access once the user completes it.
BBlock access
Correct
Block access is the most restrictive decision, preventing access under the specified conditions.
CRequire a compliant device
Incorrect
This grants access from compliant devices.
DSign-in frequency
Incorrect
Sign-in frequency is a session control that sets how often users sign in again.
Access controls decide how a Conditional Access policy is enforced once its assignments are satisfied. Block access is the most restrictive decision. Grant access can come with requirements such as MFA, an authentication strength or a compliant device, and session controls such as sign-in frequency shape the experience inside apps.
Some Microsoft 365 services have their own role-based access control systems, and others rely on Microsoft Entra roles for administrative access. Which two services rely on Microsoft Entra roles?
AExchange and Intune
BExchange and Teams
CIntune and SharePoint
DTeams and SharePoint
Show the answer and why
AExchange and Intune
Incorrect
Exchange and Intune have developed their own role-based access control systems.
BExchange and Teams
Incorrect
Exchange has its own RBAC system.
CIntune and SharePoint
Incorrect
Intune has its own RBAC system.
DTeams and SharePoint
Correct
Teams and SharePoint don't have separate role-based access control systems; they use Microsoft Entra roles.
Over time some Microsoft 365 services, such as Exchange and Intune, developed their own role-based access control systems, while others, such as Teams and SharePoint, use Microsoft Entra roles for administrative access.