Question 210 An operator must manage Exchange Online mailboxes and mail flow without editing Entra Conditional Access. Which role is appropriate? Security Reader Exchange Administrator with relevant workload permissions Global Administrator as the default permanent assignment Cloud Application Administrator Explanation Correct Answer B:This role scopes administrative authority to Exchange management tasks. Incorrect Answers A:A read-only security role cannot configure Exchange recipients. C:Global privilege includes unrelated identity and security controls. D:App registration permissions do not implement Exchange mail flow policies.
Question 211 A collaboration team must change Teams meeting policies but not Purview data retention. Which workload role should be considered? Compliance Administrator for all tenant data Global Administrator to handle Teams-only configuration Teams Administrator for supported Teams service settings Exchange Recipient Administrator Explanation Correct Answer C:Teams workload roles can manage meetings without broad compliance privilege. Incorrect Answers A:Compliance roles are excessive for a meeting policy change. B:Tenant-global access is unnecessary for supported workload roles. D:Mail recipient management does not configure Teams meeting policies.
Question 212 A site owner escalation requires an operator to manage SharePoint tenant sharing controls, not security center incidents. Which role fits? Billing Administrator Security Reader SharePoint Administrator with approved scope Teams Device Administrator Explanation Correct Answer C:SharePoint workload administration covers relevant site and sharing governance. Incorrect Answers A:Billing permissions do not administer sites. B:A read-only security role cannot implement SharePoint admin changes. D:Teams device controls do not set SharePoint sharing.
Question 213 A global administrator role is eligible through Entra PIM but an operator cannot perform a privileged change. What step is required? Create a Purview content search case Assign the administrator a permanent active Global Administrator role as a workaround for an eligible PIM role that has not been activated Activate the eligible role through PIM and satisfy its configured requirements Assign a Microsoft 365 Apps update channel Explanation Correct Answer C:Eligibility does not grant active role privileges until activation succeeds. Incorrect Answers A:Content search does not activate Entra Global Administrator. B:Permanently granting privilege bypasses the intended just-in-time activation, approval and authentication controls of the eligible PIM role. D:Office servicing is unrelated to privileged role activation.
Question 214 A support engineer occasionally needs Security Administrator rights during major incidents. What is safer than permanent active assignment? Disable MFA on privileged sign-ins for faster response PIM eligible time-bound activation with approval and justification where configured Permanent Global Administrator for every engineer Share one Security Administrator account password across the team Explanation Correct Answer B:Just-in-time elevation reduces standing privilege and adds accountability. Incorrect Answers A:Removing strong authentication weakens incident-time privileged security. C:Always-on tenant-global privilege magnifies compromise impact. D:Shared credentials remove individual accountability.
Question 215 The owner wants privileged role activations approved by the on-call security lead. Where is that condition configured? SharePoint default sharing link permissions PIM role activation settings and designated approvers Exchange spam confidence level thresholds Microsoft 365 usage report privacy settings Explanation Correct Answer B:PIM supports approval requirements for eligible role activation. Incorrect Answers A:File sharing defaults do not manage privileged role workflows. C:Mail filtering does not approve directory elevation. D:Report anonymization does not govern role approval.
Question 216 A privileged role should only be active during the maintenance window. What setting matters? Maximum activation duration configured for that PIM role Office client update deadline Set a short Exchange mailbox retention period for the privileged operator's account and treat it as the maximum role activation window Reduce the company DNS TTL to the planned maintenance duration and assume PIM will expire elevated permissions on that schedule Explanation Correct Answer A:A bounded activation prevents extended privilege beyond intended work. Incorrect Answers B:Application deployment timing does not cap directory privilege duration. C:Content retention duration does not limit the validity of a just-in-time PIM privileged-role activation. D:DNS caching has no control over active Entra role permissions; configure the role-specific maximum activation duration.
Question 217 Security asks who activated Privileged Role Administrator yesterday and for what reason. Which records are relevant? PIM audit and activation history with actor and justification The tenant's Exchange outbound mail logs only SharePoint site page-view analytics Use an Entra role assignment inventory alone to infer who activated the role and the justification recorded during PIM elevation Explanation Correct Answer A:Privileged role governance logs track activations and required metadata. Incorrect Answers B:Mail transport does not record directory role activation as the primary source. C:Site views cannot establish PIM elevation history. D:Assignment inventory shows eligibility or assignment, not the event-level actor, reason and activation timeline requested by security.
Question 218 Several inactive contractors still have eligible administrator assignments. What governance step should the team take? Remove the organization's domain verification record Grant contractors new Global Administrator roles Review PIM eligible role assignments and remove unjustified access Increase every eligible role's maximum duration Explanation Correct Answer C:Standing eligibility is sensitive even when not currently activated. Incorrect Answers A:DNS ownership does not revoke directory role eligibility. B:Extra privilege worsens the stale assignment problem. D:Longer activation raises exposure rather than reducing stale access.
Question 219 A multinational company needs its Germany help desk to administer only German employee accounts. Which Entra mechanism can support this boundary? An Exchange transport rule based on sender country A sensitivity label named Germany Administrative units with scoped supported role assignments A global tenant User Administrator assignment with no scope Explanation Correct Answer C:Administrative units can constrain eligible directory role management to specific objects. Incorrect Answers A:Mail flow cannot scope Entra user administration. B:Content labels do not constrain directory administrator targets. D:A broad tenant role can administer many unrelated users.
Question 220 A help desk admin has a User Administrator role scoped to a regional administrative unit. Why can't they change an unrelated executive user? The user has a personal OneDrive site The tenant has more than one verified domain The executive user isn't in the role's administrative unit scope Extend the regional User Administrator's permanent role to the entire tenant rather than confirm whether the executive is outside the administrative-unit scope Explanation Correct Answer C:Scoped role authority is limited to included directory objects. Incorrect Answers A:Site presence does not define AU membership. B:Domain count does not override administrative unit scoping. D:Broader role assignment could grant access but abandons least-privilege regional administration instead of addressing the scoped boundary.
