Question 260 A role-assignable group confers high directory privileges on members. What event deserves special alerting? Alert on licensing changes to the group while ignoring who becomes a privileged member or owner Alert on ordinary distribution-list edits while excluding role-assignable group membership events Changes to a distribution list with no role assignment Changes to membership, owners and privileged role assignments on that group Explanation Correct Answer D:A new member may gain privileged capability through the group. Incorrect Answers A:Licensing changes do not establish whether the role-assignable group's high-privilege principals have changed. B:Distribution-list activity can be audited, but it does not substitute for tracking who gains directory privileges through this group. C:An ordinary mail list does not create the same privileged access path.
Question 261 A temporary contractor's PIM eligible role assignment expires today. What should administrators expect? Assume that expiration of PIM eligibility terminates all ongoing user sessions and deletes prior activation history The eligibility no longer supports new activations after its configured end Remove the contractor's product license when PIM eligibility expires and treat that as proof that all future privileged role activation is denied The contractor's mailbox is deleted immediately Explanation Correct Answer B:Time-bound eligible assignments prevent indefinite future elevation. Incorrect Answers A:Eligibility expiration prevents later activations but does not erase audit evidence or necessarily revoke already issued sessions. C:License deallocation and role eligibility are separate controls; the configured assignment end date governs new activations. D:Role assignment expiration is not mailbox lifecycle deletion.
Question 262 An operator requests elevation, but the designated PIM approver denies it. Why can't the operator proceed with the requested role? PIM requests grant active rights before approval A denied request changes the operator's UPN suffix A denied request automatically suspends the employee account Approval is a required condition before activation becomes effective Explanation Correct Answer D:A denied approval prevents role elevation under that policy. Incorrect Answers A:Eligibility and requests do not automatically bypass approval. B:Role workflow has no direct identity naming effect. C:Role denial does not necessarily block all normal sign-ins.
Question 263 An administrator completed a task but requests repeated extensions of Security Administrator with no new work. What is the least-privilege response? Grant a permanent Global Administrator role instead Convert the eligible assignment to permanent active Require a justified new activation only when privileged work is needed Disable security role audit notifications Explanation Correct Answer C:Privileged access should be time-limited rather than extended by default. Incorrect Answers A:Global privileges compound rather than solve excess access. B:Permanent access increases unnecessary standing privilege. D:Removing monitoring does not justify a longer activation.
Question 264 An annual audit asks why 30 users retain elevated Entra roles. What evidence should be prepared? Only Microsoft 365 service health notices Role assignment inventory, approval rationale and recent access reviews Only user profile photographs Provide an annual list of administrator email addresses with no records of role justification, assignment approval or recent access review Explanation Correct Answer B:Documented business justification supports role governance decisions. Incorrect Answers A:Vendor incidents do not explain permanent directory grants. C:Identity photos contain no role authorization evidence. D:Names alone cannot establish continuing business need or approval history for elevated Entra permissions.
Question 265 An app administrator needs to rotate one client secret, but does not need edit rights for every app. What should be preferred? Exchange Administrator for mail connectors Privileged Role Administrator for all role assignments Permanent Global Administrator for the rotation task Specific application ownership or supported scoped app administration Explanation Correct Answer D:Object-level app ownership can avoid tenant-wide application administration rights. Incorrect Answers A:Messaging administration does not manage Entra app credentials. B:Directory role assignment rights are not a secret rotation requirement. C:Global access is excessive for one app secret.
Question 266 A scoped help desk admin suddenly can update users from a new department. What should be reviewed? Administrative unit membership and the operator's scoped role assignment Tenant billing owner contact information Exchange inbound domain connectors Office desktop client update rings Explanation Correct Answer A:Changes to scope membership can expand an operator's effective targets. Incorrect Answers B:Billing contacts do not confer user administrative scope. C:Mail flow cannot alter directory scoped role boundaries. D:Application servicing does not govern AU membership.
Question 267 A Compliance Administrator can configure a Purview policy but cannot open a restricted SharePoint document. What concept explains this? A Teams meeting policy is needed for file access Add the admin to the broad Global Administrator role and assume Purview policy management grants automatic unrestricted permission to protected SharePoint content Policy administration RBAC does not necessarily confer unrestricted access to user content All administrators automatically see every encrypted file Explanation Correct Answer C:Management permissions and content item authorization are distinct controls. Incorrect Answers A:Meeting settings do not override document permissions. B:Administrative permission to configure a compliance policy is not the same as authorization to open protected business documents. D:Administrative role does not universally bypass content protection.
Question 268 An auditor only needs to read Microsoft 365 Message center and Service health notices. What privilege direction minimizes risk? Grant Privileged Role Administrator for every auditor Assign permanent Global Administrator for browsing notices Use available read-oriented roles or access grants for those administrative reports Add every auditor to an Exchange transport management role Explanation Correct Answer C:Notices do not generally require tenant-wide configuration writes. Incorrect Answers A:Directory role governance is unrelated to reading vendor notices. B:Global write privilege is excessive for reading messages. D:Mail flow configuration does not control all Microsoft service messages.
Question 269 A contractor received temporary SharePoint Administrator for migration; the migration is finished. What should happen? Delete all SharePoint sites migrated by the contractor Promote the contractor to Global Administrator Remove or expire the task-specific role and review remaining access Turn off tenant audit trails to close the project Explanation Correct Answer C:Privileges should not persist after the approved work ends. Incorrect Answers A:Deleting resources is not needed to end the user's admin grant. B:Greater standing privilege is the opposite of offboarding. D:Audit retention is independent of temporary role expiry.
Question 270 Before first Entra directory synchronization, several on-premises users have duplicate or invalid proxy addresses. Which preflight tool category is relevant? Defender endpoint onboarding Purview DLP testing IdFix and source-directory attribute remediation Start an unrestricted export before cleaning duplicate proxyAddresses in the source directory Explanation Correct Answer C:Identity preparation tools can expose directory attributes that would cause sync conflicts. Incorrect Answers A:Device enrollment does not validate user proxy addresses for synchronization. B:Data exfiltration rules cannot fix source directory attribute formatting. D:Sending known conflicting proxy addresses to Entra simply repeats the uniqueness failures; the source attributes must be corrected first.
