Question 600 A tenant plans to deploy advanced Conditional Access policies. What pre-deployment consideration matters? Verify licensing and support for the selected Conditional Access capabilities Disable audit records to reduce policy overhead Assume every trial account has unlimited features permanently Change the storage account redundancy tier to unlock CA Explanation Correct Answer A:Identity feature availability can depend on license entitlements. Incorrect Answers B:Logging removal doesn't provide licensed features. C:Trial eligibility differs from production entitlement. D:Storage replicas don't license identity controls.
Question 601 An organization configures Conditional Access and accidentally risks locking out every administrator. What resilience practice helps? Change an unrelated VM size to bypass sign-in policies Require one shared password used by all employees Delete the Entra directory if an admin is locked out Maintain carefully secured emergency-access accounts excluded from problematic policy scope Explanation Correct Answer D:Emergency identity access can assist recovery from policy misconfiguration. Incorrect Answers A:Compute sizing doesn't restore identity administration. B:Shared credentials reduce traceability and don't provide safe break-glass design. C:Destructive actions are not a recovery plan.
Question 602 Employees sign in to a central identity provider and then use several authorized cloud applications without repeated passwords. Which capability describes this? Single sign-on (SSO) A virtual machine scale set Give each application a separate local password and call it single sign-on Storage geo-replication Explanation Correct Answer A:SSO enables one sign-in session to access federated or integrated apps as permitted. Incorrect Answers B:Compute scaling doesn't create application federation. C:Independent repeated logins are not the federated or integrated sign-in experience SSO provides. D:Data copies don't reduce identity prompts.
Question 603 An employee assumes SSO means any cloud app becomes accessible without an assigned role. What is the correction? SSO can only work on devices inside an Azure datacenter SSO streamlines authentication, but applications still enforce authorization SSO always removes the need for MFA SSO changes the storage account's replica count Explanation Correct Answer B:Federated sign-in doesn't grant every user access to every app. Incorrect Answers A:Federation is not limited to datacenter-hosted clients. C:MFA can still be required by policy. D:Identity and storage redundancy are independent.
Question 604 An account requires both a password and proof through a second independent factor. Which sign-in security control is this? Require another copy of the same password and call it an independent factor Multifactor authentication (MFA) Single sign-on across applications with no independent second factor required Assigning an Azure RBAC role that permits a resource read Explanation Correct Answer B:MFA combines evidence from different factor categories to strengthen sign-in. Incorrect Answers A:MFA uses different factor categories; duplicating a password is not a new factor. C:SSO reduces repeated credential prompts; it does not itself mean the user supplied a second authentication factor. D:Authorization determines permitted operations but does not by itself create a second factor for sign-in.
Question 605 An organization moves users to FIDO2 security keys and wants to avoid typing a traditional password. Which identity approach is it adopting? A second shared static password for every user An application firewall rule as the only sign-in method Passwordless authentication with supported security keys Changing the Azure subscription name Explanation Correct Answer C:FIDO2 sign-in can use possession and local user verification without a typed account password. Incorrect Answers A:Shared passwords are not passwordless. B:Network filtering isn't a passwordless identity authenticator. D:Names don't alter sign-in methods.
Question 606 A user authenticates with a registered passkey secured by local device verification. Which security benefit is most relevant? The passkey stores all app data in a private VNet The passkey grants automatic Owner to every subscription Cryptographic passwordless authentication resistant to common password theft patterns The device no longer requires any recovery strategy Explanation Correct Answer C:A passkey avoids transmitting or reusing a shared account password at sign-in. Incorrect Answers A:A sign-in credential isn't an application data store. B:Authentication doesn't confer Azure management roles. D:Lost devices still require account recovery controls.
Question 607 A security team wants users to verify sign-ins using an approved authenticator app under an MFA policy. Which capability can supply this factor? Use only an Azure subscription approval note as proof of the authentication challenge Microsoft Authenticator-based sign-in approvals where configured VM availability-zone placement A storage account key used by every employee Explanation Correct Answer B:An authenticator can provide additional factor verification. Incorrect Answers A:Approval of cloud spend does not validate an MFA push challenge from Microsoft Authenticator. C:Compute resilience doesn't provide sign-in verification. D:Shared storage keys are not user MFA.
Question 608 Employees frequently forget passwords and IT wants a controlled self-service process without creating more help-desk tickets. Which directory capability is relevant? A Blob hot-to-cool lifecycle policy Microsoft Entra self-service password reset, where supported An Azure virtual machine snapshot An Azure VPN Gateway tunnel Explanation Correct Answer B:SSPR allows eligible users to reset passwords after required verification. Incorrect Answers A:Object tiering doesn't reset credentials. C:VM backup isn't directory account recovery. D:VPN doesn't operate the password reset workflow.
Question 609 A legacy application needs managed domain join, LDAP and Kerberos/NTLM support but the team does not want to run domain-controller VMs. What Azure offering can help? Microsoft Entra Domain Services A storage account access key Microsoft Entra ID cloud sign-in alone as a full LDAP server Use Entra ID alone and assume it offers every legacy LDAP/Kerberos domain protocol Explanation Correct Answer A:Managed domain services provide traditional directory protocols for compatible workloads. Incorrect Answers B:Storage keys aren't a managed domain directory. C:Cloud identity is not identical to a managed AD DS protocol endpoint. D:Microsoft Entra Domain Services supplies supported managed domain protocols that ordinary Entra ID sign-in alone does not.
Question 610 A team expects Microsoft Entra Domain Services to be the primary cloud identity directory that directly replaces all Entra tenant management. What distinction should it understand? Domain Services is an Azure Blob tier Managed domain services grant unrestricted global administrator automatically An Azure virtual network is a user directory Entra Domain Services is a managed domain offering linked to Entra ID identities, not the primary Entra cloud directory Explanation Correct Answer D:The services address different identity protocols and administration models. Incorrect Answers A:It is an identity service, not storage. B:No default cloud-wide admin grant follows. C:Networking cannot replace cloud identity.
