Question 370 An organization wants users to prove identity with two approved authentication methods before self-service password reset. What should it set? Require two company-owned DNS suffixes for each user before a password reset, instead of checking the allowed SSPR authentication methods A Defender phishing campaign with two questions An Exchange message-size limit of two attachments The SSPR method-count requirement and allowed method list Explanation Correct Answer D:SSPR policy determines proof needed to reset a forgotten password. Incorrect Answers A:Domain verification is not a user verification method and does not establish the number of methods needed during SSPR. B:Training content is not an SSPR proof method. C:Mailbox limits are not reset assurance.
Question 371 SSPR works for HR but the sales pilot group sees the service unavailable. What should be investigated first? Re-register the HR pilot's authentication methods rather than checking whether the sales accounts are actually in the SSPR enabled-user scope The Microsoft 365 Apps servicing channel The number of SharePoint libraries they can access SSPR enabled-user scope and the user's current group membership Explanation Correct Answer D:Group targeting controls who can use the reset service. Incorrect Answers A:Method registration cannot grant access to SSPR if the users or their current group membership fall outside the enabled scope. B:Office patch cadence does not enable SSPR. C:Library membership is not SSPR eligibility.
Question 372 A user receives a prompt saying insufficient authentication information is registered for SSPR. What should they do? Disable the organization's custom domain Clear every Conditional Access rule to let the user bypass the insufficient SSPR registration condition Register the required recovery methods through the supported security info experience Request an extra Teams channel membership Explanation Correct Answer C:SSPR needs previously registered proof methods. Incorrect Answers A:Domain removal will not register recovery factors. B:Removing tenant access policies does not populate the user's required recovery methods and weakens protections for unrelated sign-ins. D:Collaboration groups are not reset methods.
Question 373 A privileged administrator can reset a password only under more stringent verification than a standard user. What should the engineer check? Whether the user's mailbox has litigation hold Role-specific SSPR authentication requirements for administrator accounts Whether the user belongs to a Microsoft 365 Group Lower the administrator account's reset-verification method count to the general employee value, despite role-specific safeguards Explanation Correct Answer B:Privileged reset policies can require stronger validation. Incorrect Answers A:Retention does not set reset method requirements. C:Collaboration group membership is not administrator assurance. D:Privileged administrator recovery may have stricter verification requirements; ordinary-user configuration should not silently override them.
Question 374 Hybrid users must reset in Entra and sign in to on-prem AD DS with the new password. What feature is required? The Intune device compliance grace period Supported password writeback setup with source directory permissions Synchronize the new password hash from AD DS to Entra and expect that to reverse the direction of a cloud-initiated SSPR reset Enable password hash synchronization and assume cloud-initiated password resets will automatically write back to on-prem AD DS Explanation Correct Answer B:Cloud-only reset without writeback does not update AD DS credentials. Incorrect Answers A:Compliance timing is not password writeback. C:Password hash synchronization is ordinarily on-premises to cloud; cloud-initiated reset requires supported writeback and source permissions. D:PHS synchronizes credential hashes toward Entra; supported SSPR password writeback is a separate flow with source permissions.
Question 375 Multiple users report that the reset portal accepted verification but refused to write new passwords. Where is useful diagnostic evidence? SSPR audit and reset logs with writeback or policy errors Assume a successful MFA verification proves AD DS password writeback succeeded without inspecting the failed writeback operation SharePoint recycle-bin activity only Exchange message trace for unrelated mail Explanation Correct Answer A:The logs show which reset stage failed. Incorrect Answers B:Identity verification is a separate step from source-directory password update; error and audit events reveal why writeback was rejected. C:File deletion is unrelated to password reset. D:Mail routing is not the decisive reset audit.
Question 376 The organization wants to prevent employees from choosing familiar company slogans as passwords. Which control is relevant? Microsoft Entra Password Protection custom banned-password list A Purview custom sensitive information type Apply a standard Windows update ring name matching prohibited slogans and expect the setting to block cloud password selection A transport rule for subject keywords Explanation Correct Answer A:Custom terms can be prohibited during supported password validation. Incorrect Answers B:Content classifiers do not reject passwords. C:Client deployment targeting cannot enforce Entra's password quality policy; banned-password rules evaluate password choices. D:Mail subject rules do not validate passwords.
Question 377 The company wants cloud banned password rules to influence AD DS password-change attempts. What needs deployment? A Conditional Access sign-in frequency policy Enable only cloud tenant password protection and assume AD DS password-change events are automatically checked without DC agents Supported Microsoft Entra Password Protection proxy and DC agents Microsoft Defender for Cloud Apps discovery logs Explanation Correct Answer C:AD DS requires on-prem components for enforcement. Incorrect Answers A:CA sign-in controls do not validate new AD DS passwords. B:The on-premises extension depends on supported proxy and domain-controller agents to evaluate password changes against the protection rules. D:App discovery cannot intercept AD DS password changes.
Question 378 A new password-protection policy needs impact assessment before blocking users in AD DS. Which mode helps the pilot? Set tenant-wide access to allow all users Audit mode to record prohibited-password findings without rejecting changes Enable enforcement for all AD DS users immediately, treating the first rejected password change as sufficient evidence of a safe rollout Remove all domain controllers during testing Explanation Correct Answer B:Audit collects evidence before moving to enforce. Incorrect Answers A:Access policies cannot simulate banned-password detection. C:Audit mode provides evidence of password-policy impact without immediately blocking existing user workflows during a pilot. D:This prevents credential services rather than measuring impact.
Question 379 A password is rejected even though it is not an exact entry in the organization's custom list. Which behavior explains this? A SharePoint site title is automatically a tenant-wide password list Search for an exact match in the custom banned-password list and ignore normalized variants or globally prohibited weak terms Users can bypass all restrictions by retyping the same phrase Normalized variations and Microsoft's global banned-password checks may also apply Explanation Correct Answer D:Validation is broader than literal custom-string equality. Incorrect Answers A:Site metadata is not the credential policy. B:Entra Password Protection checks normalized and related variants, so absence of a literal custom-list match does not guarantee acceptance. C:Retrying an invalid candidate does not make it valid.
Question 380 A user can sign in with a password but cannot register a security key. Which policies are relevant? Authentication-method eligibility and device/key support for the registration flow The user's Teams meeting lobby settings only Assign more OneDrive storage to the user and retry security-key registration without checking method policy eligibility or key support Mail flow connector TLS minimum version only Explanation Correct Answer A:Method policy can block a supported user or device. Incorrect Answers B:Meeting policies do not grant key registration. C:Storage entitlement does not enable FIDO2 or passkey registration; the relevant method and client capability must be available. D:Mail transport does not enroll security keys.
