Question 360 After a source attribute mapping update, a pilot group receives incorrect cloud department values. What rollback preparation is appropriate? Restore verified mapping logic and compare exported object state before broader cycles Disable all source logging to simplify the test Delete the entire tenant to reset mappings Rotate every end-user password to refresh department Explanation Correct Answer A:Controlled rollback prevents propagating incorrect attributes. Incorrect Answers B:Removing evidence makes verification harder. C:Tenant deletion is destructive and unnecessary. D:Password changes cannot correct transformation rules.
Question 361 A company must require phishing-resistant sign-in for privileged cloud administrators. Which credential is an appropriate primary option? FIDO2 security key bound to the legitimate sign-in origin Require a regular phone-based MFA approval for privileged admins while leaving phishing-resistant authentication strength unconfigured Password plus security questions SMS one-time code sent to a mobile phone Explanation Correct Answer A:The cryptographic challenge is origin-bound, limiting credential phishing. Incorrect Answers B:Phone call authentication may be an MFA method but is not phishing-resistant because it is not bound cryptographically to the legitimate sign-in origin. C:Shared secrets can be harvested or replayed. D:Codes can be relayed to attacker-controlled sites.
Question 362 An attacker hosts a page that copies the Microsoft login appearance and asks for passkey authentication. Which characteristic helps resist this attack? The authenticator verifies the relying-party origin before signing The browser remembers a previous Microsoft 365 authentication session The login page visually reproduces the Microsoft sign-in brand Rely on an SMS fallback to validate the login website's origin even though the malicious page is relaying the authentication attempt Explanation Correct Answer A:A passkey is bound to the legitimate authentication domain. Incorrect Answers B:Browser history cannot bind a new passkey challenge to the real relying-party domain. C:A copied logo and page style are not cryptographic proof of the relying-party origin. D:SMS does not cryptographically bind the response to the intended relying party and cannot provide the origin verification furnished by a passkey.
Question 363 A new employee lacks a strong authenticator but must enroll a passwordless method. What temporary credential should the help desk evaluate? A recovery email sent to an unknown personal address Issue the same reusable recovery password to every new employee and use it to enroll their passwordless devices A properly scoped Temporary Access Pass issued after identity verification A disabled Conditional Access policy for all users Explanation Correct Answer C:TAP can bootstrap registration of stronger authentication methods. Incorrect Answers A:Unverified channels can expose account access. B:A shared static password is not a scoped temporary bootstrap credential and cannot provide appropriate individual onboarding accountability. D:Tenant-wide bypass is unnecessary for onboarding.
Question 364 A Temporary Access Pass is issued for remote onboarding, but the recipient will not register until tomorrow. Which configuration should be checked? Extend the guest invitation redemption deadline while leaving the TAP's configured start time, expiration and one-time use unchanged The user's Exchange Online mailbox size TAP lifetime, start time and one-time or multi-use behavior Check only whether the user has redeemed an external guest invitation, despite the authentication bootstrap being a Temporary Access Pass Explanation Correct Answer C:An expired or already used pass cannot complete enrollment. Incorrect Answers A:Guest invitation status does not determine whether the temporary bootstrap authentication credential is still usable tomorrow. B:Mailbox quotas do not determine TAP validity. D:B2B invitation redemption does not establish the TAP's lifetime, activation or redemption restrictions for the new user's registration.
Question 365 Users accidentally approve unexpected mobile MFA prompts. Which verification enhancement can help reduce blind approvals? More frequent uncontextualized push prompts Disabling authentication method registration Microsoft Authenticator number matching in supported push flows Increase password lifetime so users receive fewer unexpected Authenticator challenges while leaving approval interactions unchanged Explanation Correct Answer C:Users must match the displayed challenge rather than approve reflexively. Incorrect Answers A:Extra prompts can increase MFA fatigue. B:Unregistered users cannot use stronger factors. D:Password expiry cadence does not distinguish a legitimate number-matched prompt from a malicious push-fatigue approval request.
Question 366 A user receives repeated Authenticator prompts they did not initiate. What is the most appropriate immediate advice? Deny the prompts and report the suspicious authentication attempts Share the numerical challenge with the caller Approve the next unsolicited authenticator prompt to acknowledge it and assume the attacker's repeated MFA attempts will then stop Remove every Conditional Access policy globally Explanation Correct Answer A:Unexpected push activity can indicate password compromise or abuse. Incorrect Answers B:A stranger should not receive an authentication challenge. C:Approving an unexpected prompt can grant attacker access rather than report malicious pressure; the user should reject and escalate it. D:Global access weakening is not incident handling.
Question 367 An organization intends to move from SMS to Microsoft Authenticator without breaking every sign-in at once. What can support staged adoption? Force SMS methods off for every user immediately without piloting Microsoft Authenticator registration or recovery readiness Require users to reset their mail transport rules Configure an authentication-method registration campaign for targeted users Delete SMS credentials before users can enroll alternatives Explanation Correct Answer C:Staged nudges encourage users to register stronger factors. Incorrect Answers A:An abrupt broad cutover can strand users who have not enrolled a supported authenticator, so a targeted registration campaign is appropriate. B:Mail rules do not enroll authentication factors. D:Abrupt deletion can lock users out.
Question 368 An admin enables a method for a pilot security group but users outside that group cannot enroll it. What setting should be reviewed? Add nonpilot users to an unrelated SharePoint membership group rather than confirming authentication-method policy targeting Authentication methods policy targeting and group membership The primary Exchange Online mail flow connector The endpoint file download quarantine action Explanation Correct Answer B:Allowed methods can be enabled only for selected users. Incorrect Answers A:SharePoint access does not determine whether an Entra authentication method is enabled for the user's pilot security group. C:Mail transport does not scope auth methods. D:Download protection is unrelated to method targeting.
Question 369 A user knows the current password and wants to update it, while another forgot theirs. What distinction should the help desk explain? Trigger a password change for an unknown-password user without the SSPR identity-verification process needed to recover access Both tasks require deleting and recreating the cloud account Users must have Global Administrator to change passwords Password change uses a known credential; SSPR reset verifies identity without it Explanation Correct Answer D:The two journeys have different validation and recovery requirements. Incorrect Answers A:A known-password change presumes authentication; forgotten-password recovery requires the supported reset flow and verification. B:Recreation is not the standard recovery path. C:Elevated privilege is not required for self-service changes.
Question 370 An organization wants users to prove identity with two approved authentication methods before self-service password reset. What should it set? Require two company-owned DNS suffixes for each user before a password reset, instead of checking the allowed SSPR authentication methods A Defender phishing campaign with two questions An Exchange message-size limit of two attachments The SSPR method-count requirement and allowed method list Explanation Correct Answer D:SSPR policy determines proof needed to reset a forgotten password. Incorrect Answers A:Domain verification is not a user verification method and does not establish the number of methods needed during SSPR. B:Training content is not an SSPR proof method. C:Mailbox limits are not reset assurance.
