Question 240 An operator must create, delete and manage allowed group types across a department without managing tenant secrets. Which role is relevant? Billing Administrator Cloud Application Administrator Groups Administrator with any required scope constraints Security Reader Explanation Correct Answer C:Group governance can be delegated without unrestricted Global Administrator permissions. Incorrect Answers A:Subscription billing does not govern group lifecycle. B:App registration management is not a substitute for group administration. D:Security dashboards do not confer directory group modification rights.
Question 241 A SOC analyst needs incident investigation actions but must not edit every tenant identity role. What boundary matters? Assign Privileged Role Administrator to every SOC analyst Assign Compliance Administrator to edit data labels Grant each analyst Global Administrator permanently Defender workload role group with needed response operations only Explanation Correct Answer D:Workload RBAC can isolate incident actions from global identity administration. Incorrect Answers A:Role governance is not required for routine incident investigation. B:Purview label administration is different from XDR incident response. C:Full tenant administration exceeds responder duties.
Question 242 A compliance analyst must review DLP alerts but should not modify the DLP policy. What should be considered? Purview Compliance Administrator with full policy editing by default Exchange Recipient Administrator alone Global Administrator for every DLP analyst A Purview role group with alert review permissions but no policy-edit rights Explanation Correct Answer D:Review-only compliance operations can be separated from administrative control. Incorrect Answers A:Full administration is unnecessary for reviewing existing events. B:Mailbox recipient changes do not confer DLP case review permissions. C:Global privilege enlarges risk across unrelated workloads.
Question 243 Only designated legal reviewers may export investigation search results. Which access model fits? Purview eDiscovery export permissions limited to authorized case members Give every Compliance Reader export privileges Grant all tenant users a shared eDiscovery export account Assign Exchange Administrator to every case reviewer Explanation Correct Answer A:Export capability can disclose sensitive data and should be specifically scoped. Incorrect Answers B:A reporting role need not include exfiltration-capable export rights. C:Shared broad access defeats case accountability. D:Messaging administration does not equate to authorized legal export.
Question 244 A user can change groups unexpectedly because their role is inherited through a role-assignable group. What should be investigated? Whether they are a Teams meeting presenter Whether their product license contains Power BI The group's privileged role assignment, members and eligibility state Whether their mailbox is a shared mailbox Explanation Correct Answer C:Role-assignable group membership may convey effective administrative rights. Incorrect Answers A:Meeting privileges do not change directory groups. B:A service entitlement is not Entra role assignment. D:Mailbox object type does not explain inherited directory role access.
Question 245 A user activates a role through PIM but cannot change an identity in another administrative unit. What explanation is likely? PIM activation always grants Global Administrator globally The target user's mailbox type prevents any directory change The activated role assignment is scoped to a different AU or resource boundary The user's license automatically narrows role scope to their department Explanation Correct Answer C:Activation cannot grant authority outside the assignment's defined scope. Incorrect Answers A:Eligibility scope is preserved during activation. B:Mailbox type does not generally override AU scope. D:Role scope follows assignment settings, not department license.
Question 246 Finance needs to inspect subscription invoices but should not assign employee administrator roles. Which role family is appropriate? Security Administrator Billing Reader or an appropriate billing-focused role Privileged Role Administrator Exchange Administrator Explanation Correct Answer B:Billing viewing can be granted without identity or security administration. Incorrect Answers A:Security posture administration is broader and not invoice-focused. C:Role assignments are unrelated to invoice viewing. D:Mail workload settings are not subscription invoice controls.
Question 247 An accounts payable clerk may view invoices, but only procurement may change billing subscriptions. How should roles differ? Use distinct billing read versus purchase-management permissions Assign both to Privileged Authentication Administrator Use a shared Billing Administrator password Grant both staff permanent Global Administrator Explanation Correct Answer A:Invoice visibility should not imply entitlement to alter purchases. Incorrect Answers B:Authentication recovery is unrelated to billing permissions. C:Shared credentials obscure which person changed subscriptions. D:Global privilege exceeds both limited finance duties.
Question 248 A tenant has multiple regions, and the service desk needs password reset only for employees in one subsidiary. Which combination is most relevant? Supported reset role assigned at the subsidiary administrative-unit scope Global Administrator assigned to every subsidiary operator Conditional Access exclusion for service desk accounts A Microsoft 365 Group owner role over the subsidiary chat Explanation Correct Answer A:Role plus AU limits affected objects to the intended population. Incorrect Answers B:Global access crosses the approved regional boundary. C:An exclusion changes sign-in evaluation, not which users they can reset. D:Group ownership does not grant password reset rights.
Question 249 An admin user who left the security team still holds a permanent Security Administrator assignment. What should trigger a correction? A lower Secure Score improvement recommendation count An increase in Microsoft 365 app update deployments Role assignment review against current job function and removal of obsolete privilege A recently accepted Exchange mail domain Explanation Correct Answer C:Authorization should follow present duties rather than historic team membership. Incorrect Answers A:Posture scoring does not replace identity access review. B:Client update activity does not justify retaining an obsolete security role. D:Mail domain onboarding is unrelated to the leaver's privileges.
Question 250 The security chief wants awareness whenever Global Administrator is activated. Which configuration supports that? Outlook transport rules alone matching a privileged word A service-health advisory digest PIM role activation notification settings for designated recipients Tenant-wide group ownership notification settings Explanation Correct Answer C:Notifications help monitor privileged activation without sharing credentials. Incorrect Answers A:Mail filters do not authoritatively detect every PIM role activation. B:Service outages do not identify privileged role activations. D:Group membership notices are distinct from PIM elevation.
