Question 250 The security chief wants awareness whenever Global Administrator is activated. Which configuration supports that? Outlook transport rules alone matching a privileged word A service-health advisory digest PIM role activation notification settings for designated recipients Tenant-wide group ownership notification settings Explanation Correct Answer C:Notifications help monitor privileged activation without sharing credentials. Incorrect Answers A:Mail filters do not authoritatively detect every PIM role activation. B:Service outages do not identify privileged role activations. D:Group membership notices are distinct from PIM elevation.
Question 251 A new enterprise application received delegated administrator consent unexpectedly. Which evidence source is most relevant? Entra audit events for consent and role/app administration Exchange mail trace between employees Review application sign-in logs for successful token requests but omit directory audit events for the unexpected consent grant Microsoft 365 Apps inventory of client builds Explanation Correct Answer A:Directory audit records can identify who changed an application's consent state. Incorrect Answers B:Mail traffic cannot authoritatively establish an app's consent update. C:Token use can show subsequent access, but the who/when of delegated consent and role administration requires the associated Entra audit events. D:Office installation telemetry is not application consent audit.
Question 252 A vendor support person needs temporary Teams administration to diagnose meeting policies. How should access be granted? Scoped, time-limited supported Teams admin delegation with audited use Add the vendor as owner to every Microsoft 365 Group Make the vendor a permanent Global Administrator Share the tenant's emergency Global Administrator account Explanation Correct Answer A:Workload-specific privileges limit exposure to the requested incident. Incorrect Answers B:Universal ownership grants unrelated access and still may not provide Teams admin policy rights. C:Long-term tenant-wide control exceeds a narrow support task. D:A shared break-glass credential is not vendor support delegation.
Question 253 An admin plans to enable advanced Entra PIM features for role governance. What should they verify? Only Microsoft 365 Apps installed version Assume PIM entitlement is provided by any existing Microsoft 365 basic subscription without checking the applicable Entra licensing prerequisites Only Exchange Online mailbox quota Appropriate entitlement and product prerequisites for affected identities Explanation Correct Answer D:Some identity governance functionality has licensing requirements beyond basic directory access. Incorrect Answers A:Office client builds do not authorize identity-governance functionality. B:Domain ownership and tenant creation do not establish premium PIM feature eligibility for the identities being governed. C:Mailbox size does not establish Entra PIM entitlement.
Question 254 A security engineer suggests adding users to an ordinary distribution list to grant Global Reader. Why is that insufficient? A mailbox Send As right activates administrative roles Add the users to a mail-enabled distribution list with a Global Reader-looking name and treat membership as a supported directory role grant Distribution lists always inherit Global Reader automatically Administrative role delegation requires a supported directory role assignment mechanism Explanation Correct Answer D:Mail delivery membership alone does not grant Entra privileged roles. Incorrect Answers A:Mailbox sender delegation is not tenant role assignment. B:Naming or joining a distribution list does not create a directory role assignment recognized for Global Reader RBAC. C:Mail distribution has no implicit directory privilege.
Question 255 An operator can sign in but is denied access to a Defender XDR configuration page. What should be checked? Only whether the user's email appears in the global address list Only whether a Teams meeting policy is assigned Assign the operator Security Reader without confirming whether the Defender configuration page requires an administrative write action Effective workload RBAC and the exact action permission required Explanation Correct Answer D:Authentication success does not imply the needed Defender policy-write permission. Incorrect Answers A:Address visibility does not establish Defender administration. B:Meetings permissions do not grant Defender XDR writes. C:A read role may allow visibility but not the page action; verify workload RBAC against the attempted configuration.
Question 256 An organization has a break-glass Global Administrator. Which operational boundary should distinguish it from routine administration? Disable all audit monitoring for emergency sign-ins Share the emergency password with every help desk operator Use only for emergencies with monitoring, secure credential custody and periodic testing Use the account to run all scheduled Graph scripts Explanation Correct Answer C:Emergency access is reserved for failures of normal privileged access. Incorrect Answers A:Unmonitored emergency access increases insider and compromise risk. B:Wide distribution defeats emergency account control. D:Routine automation should not rely on emergency credentials.
Question 257 A developer requests Privileged Role Administrator to register a low-risk application. What should be done? Assign permanent Global Administrator as an alternative Grant both role governance and licensing roles Make the developer owner of all tenant security groups Evaluate a narrower application-management role instead of granting directory role control Explanation Correct Answer D:Creating an app seldom requires authority to assign Entra administrative roles. Incorrect Answers A:Global access is even more excessive for app registration work. B:Additional privileges do not solve least privilege. C:Broad ownership is unnecessary for one app integration.
Question 258 The SOC wants junior analysts to investigate Defender incidents but only senior engineers to modify threat policies. What is the proper division? Replace Defender roles with Microsoft 365 Group owner status Separate investigation-capable read/response permissions from policy administration Make all juniors Global Administrators Give seniors only Reports Reader rights Explanation Correct Answer B:Defender RBAC can distinguish evidence handling from protection configuration. Incorrect Answers A:Group ownership is not granular Defender authorization. C:Tenant-wide control defeats the stated separation. D:Read-only reports access cannot implement threat configuration.
Question 259 A junior admin invites external guests for a project and needs no ability to grant directory roles. Which permission boundary should be enforced? Global Administrator for the invitation duration by default Permanent Privileged Role Administrator for every inviter Delegated guest invitation capability without privileged-role assignment rights Any invitation automatically grants the guest Security Administrator Explanation Correct Answer C:Guest collaboration can be allowed while prohibiting tenant role escalation. Incorrect Answers A:Global access exceeds the invitation task. B:Role governance is unnecessary for guest invitations. D:Guest creation must not convey privileged security roles.
Question 260 A role-assignable group confers high directory privileges on members. What event deserves special alerting? Alert on licensing changes to the group while ignoring who becomes a privileged member or owner Alert on ordinary distribution-list edits while excluding role-assignable group membership events Changes to a distribution list with no role assignment Changes to membership, owners and privileged role assignments on that group Explanation Correct Answer D:A new member may gain privileged capability through the group. Incorrect Answers A:Licensing changes do not establish whether the role-assignable group's high-privilege principals have changed. B:Distribution-list activity can be audited, but it does not substitute for tracking who gains directory privileges through this group. C:An ordinary mail list does not create the same privileged access path.
