Question 180 An IT unit wants a Conditional Access policy to apply to a defined population of workforce users. Which group type is appropriate? An Exchange mail contact listing an external supplier A mail flow transport rule recipient list An Entra security group with verified membership where supported by the policy A Microsoft 365 Backup job group Explanation Correct Answer C:Security groups are appropriate identity scoping constructs for Conditional Access. Incorrect Answers A:A contact is not the intended workforce user group. B:Transport rule groups are not inherently policy target populations. D:Backup job scoping does not define Conditional Access membership.
Question 181 An employee is reassigned from Engineering to Operations and must lose the old department's product plan. What should be checked? Only the tenant's service health history Only the employee's public mailbox address Remove the employee from the Engineering collaboration group but leave any direct Engineering-specific product license assignment intact Group memberships and direct licenses granting the Engineering plan Explanation Correct Answer D:Entitlements may persist through another grant even after the primary group change. Incorrect Answers A:Historical incidents do not identify effective assigned products. B:SMTP addresses do not reveal all product licensing sources. C:Effective entitlement can persist through direct grants even after group removal; check all active assignment paths.
Question 182 An employee's mail must be handled by a designated internal delegate during a temporary absence. What should administrators consider? A global transport rule forwarding everyone's mail A broad external auto-forwarding allow policy for all users Approved mailbox delegation or forwarding scoped to the intended recipient Disabling all mailbox auditing while absent Explanation Correct Answer C:Delegation and forwarding have different security, audit and disclosure consequences. Incorrect Answers A:Tenant-wide forwarding breaches the narrow scope. B:An organization-wide exception increases data exfiltration risk. D:Suppressing audit weakens accountability for delegate activity.
Question 183 A customer success team wants an external customer directory for sending invitations but customers must not access tenant apps. What entity best fits? A tenant-wide Conditional Access exclude-all policy Privileged guest accounts assigned to all customers Member user accounts with permanent passwords for every customer Mail contacts with external destinations and no interactive sign-in Explanation Correct Answer D:The directory can expose external recipients without granting application access. Incorrect Answers A:Broad exclusions do not create mail contact objects. B:Guest privilege is not needed for address lookup only. C:Interactive identities create unnecessary access and administration.
Question 184 A cloud user cannot be created with a UPN already held by another object. What should the admin resolve? The conflicting directory identity's sign-in name or chosen unique UPN The tenant's Service health advisory language Change the conflicting user's mail alias only while leaving the duplicate cloud sign-in UPN on the existing object The user's preferred Teams background Explanation Correct Answer A:UPN values must be unique for the relevant directory sign-in namespace. Incorrect Answers B:Service notifications do not resolve object name uniqueness. C:Mail aliases and user principal names are different identity attributes; the UPN uniqueness conflict must be resolved. D:A collaboration appearance setting is unrelated to identity naming.
Question 185 A group with user-department conditions was mistakenly created as a dynamic device group. What must be changed? Grant group ownership to every user Add a dynamic membership rule using a device compliance attribute instead of switching the group to supported user-attribute evaluation Use a dynamic user membership model with supported user attributes Disable Azure AD Connect Health alerts Explanation Correct Answer C:Device groups evaluate device objects and will not select users by department. Incorrect Answers A:Owner assignment does not change dynamic group object evaluation. B:Device attributes and dynamic device group type cannot select human accounts by their department property. D:Health monitoring cannot convert device membership rules into user rules.
Question 186 An administrator must invite a large list of approved external guests. Which practice helps avoid unauthorized tenant access? Turn off external identity auditing during invitations Send invitations through a publicly accessible shared password account Validate invitee addresses and apply scoped access and guest policies Make all invitees Global Administrators for onboarding Explanation Correct Answer C:Accurate invitation targets and restrictions reduce accidental or malicious access. Incorrect Answers A:Removing activity records weakens later guest access reviews. B:Shared identities provide no reliable guest accountability. D:Broad privileges would grossly exceed collaboration requirements.
Question 187 A group owner needs to remove a member but should not reset tenant administrator passwords. What is the correct scope? Password Administrator assigned at tenant scope Security Administrator assigned to all workload portals Group ownership only for the managed group Global Administrator assigned permanently Explanation Correct Answer C:Group owners manage group membership without needing directory-wide role privileges. Incorrect Answers A:Password reset privileges are unnecessary for group membership tasks. B:Security product administration does not solve a narrow membership need. D:Tenant-wide control is excessive for the request.
Question 188 A deleted user's SMTP alias must be reused, but Exchange reports it is still assigned. What should be checked? Whether the user installed the latest Office build Whether Purview DLP has a matching policy name Any remaining, soft-deleted or active recipient object holding that proxy address Whether device security baselines are assigned Explanation Correct Answer C:Address conflicts persist when the alias is still referenced by another recipient. Incorrect Answers A:Client software version has no effect on address uniqueness. B:A policy label cannot occupy an Exchange proxy address. D:Endpoint configuration does not release SMTP proxy addresses.
Question 189 A contractor is removed from a licensing group, but a different group still grants the same product. What outcome is expected? The product remains available through the remaining valid assignment The domain's DNS TXT record must be reverified The tenant must delete the contractor account automatically Every other member loses the product Explanation Correct Answer A:Entitlements aggregate across active assignment sources. Incorrect Answers B:Group licensing state is unrelated to domain ownership verification. C:Removing one group license is not an identity deletion command. D:One user's membership change should not remove product grants for the whole group.
Question 190 A company mandates that subscriptions be assigned only by team groups. An administrator manually assigns a license to one user during troubleshooting. What governance gap arises? A direct assignment changes the user's public DNS record Direct grants permanently disable usage reporting A direct grant can bypass group-based lifecycle expectations Direct grants automatically make users tenant administrators Explanation Correct Answer C:Offboarding from groups may leave an unintended direct entitlement. Incorrect Answers A:License assignments do not edit DNS. B:Usage reports are independent from the licensing source. D:Product entitlement does not confer Global Administrator.
