Question 380 A user can sign in with a password but cannot register a security key. Which policies are relevant? Authentication-method eligibility and device/key support for the registration flow The user's Teams meeting lobby settings only Assign more OneDrive storage to the user and retry security-key registration without checking method policy eligibility or key support Mail flow connector TLS minimum version only Explanation Correct Answer A:Method policy can block a supported user or device. Incorrect Answers B:Meeting policies do not grant key registration. C:Storage entitlement does not enable FIDO2 or passkey registration; the relevant method and client capability must be available. D:Mail transport does not enroll security keys.
Question 381 An administrator wants users to adopt passkeys on supported devices but finds inconsistent enrollment options across platforms. What must be checked? The organization's Exchange accepted domains The SharePoint page publishing schedule Supported passkey types, authenticator platform and authentication-method policy Assume every mobile authenticator supports the same passkey form and ignore device OS, provider and method-policy support Explanation Correct Answer C:Platform and policy determine allowed enrollment paths. Incorrect Answers A:Mail domains do not determine device passkey support. B:Site publishing is not a passkey method. D:Passkey capability differs across supported authenticator platforms and enrollment targets; retention labels are irrelevant to availability.
Question 382 A laptop user uses a local PIN to unlock a cryptographic credential and sign in to Entra-backed services. What should be understood? The PIN is transmitted as the Entra password to every service Treat the Windows Hello PIN as a reusable cloud password that should be transmitted to every cloud relying party during authentication Treat the Windows Hello PIN as a reusable Microsoft 365 password that help desk can recover and issue on another computer Windows Hello for Business PIN unlocks a device-bound key, not a reusable cloud PIN Explanation Correct Answer D:The PIN is local to the protected credential. Incorrect Answers A:The cloud does not receive the PIN as a password. B:The PIN unlocks local credential material; it is not a portable password or shared second factor submitted to cloud services. C:The PIN unlocks device-bound cryptographic credentials and is neither a cloud-stored reusable password nor transferable authentication secret.
Question 383 A user asks why passwordless Authenticator sign-in is unavailable while OTP codes still work. Which configuration should be examined? Exchange online public folder permissions only Enable generic OTP generation in Authenticator and assume it automatically enables passwordless phone sign-in for the same users Purview retention policies for Teams chats only Passwordless phone sign-in enablement and targeted authentication methods Explanation Correct Answer D:Different Authenticator capabilities can have separate eligibility. Incorrect Answers A:Public folders are not authentication settings. B:OTP and passwordless phone sign-in are distinct methods and tenant policies; their availability can differ by user and registration state. C:Retention cannot enable passwordless approval.
Question 384 A sign-in succeeds using SMS but a sensitive application requires a phishing-resistant authentication strength. What outcome is expected? The current factor does not satisfy the required authentication strength Allow the existing SMS factor because it qualifies as MFA, without evaluating the application's explicit phishing-resistant strength requirement Signing in through Outlook bypasses the strength requirement Any MFA method automatically satisfies every named strength Explanation Correct Answer A:SMS cannot meet phishing-resistant strength criteria. Incorrect Answers B:A method may satisfy generic MFA while failing the higher assurance authentication strength required by the sensitive application. C:Client choice does not remove CA strength checks. D:Different strengths restrict acceptable methods.
Question 385 A legacy client submits basic credentials and is blocked while modern clients work. What should be investigated? Enable password writeback to AD DS while continuing to use the legacy client's Basic authentication protocol Enable password writeback while continuing to submit Basic authentication requests SharePoint document library retention only The legacy authentication protocol and associated modern-auth blocking policy Explanation Correct Answer D:Older protocols may lack modern token and MFA capabilities. Incorrect Answers A:Password writeback does not modernize an unsupported sign-in protocol; the client or authentication flow must support modern auth. B:Password writeback does not make a legacy protocol compatible with modern authentication or Conditional Access requirements. C:Retention cannot enable an obsolete sign-in protocol.
Question 386 A user sees an authentication error after a password change. Which log fields help distinguish wrong password from conditional policy denial? Only the user's latest Teams message content Entra sign-in status, failure code, and Conditional Access evaluation Inspect Microsoft 365 Apps device version history as proof of whether a cloud sign-in was denied by Conditional Access Only Exchange mailbox quota and forwarding settings Explanation Correct Answer B:The result separates credential failures from policy blocks. Incorrect Answers A:Chat content is not sign-in telemetry. C:Software update history cannot substitute for the Entra sign-in failure code and evaluated access conditions. D:Mail settings cannot classify Entra errors.
Question 387 A user completes the password step but is told to satisfy an additional verification before gaining access. What should be reviewed? The specific MFA or registration requirement and its sign-in log outcome Assume every extra prompt comes from security defaults without reviewing the affected sign-in log Review only the endpoint's device risk posture, without checking the triggered MFA or registration interruption in the sign-in record Check the user's MFA registration list alone without reviewing which policy required the challenge Explanation Correct Answer A:The interrupted journey can be expected policy enforcement. Incorrect Answers B:Security defaults are only one possible source; policy evaluation and authentication details must establish the actual requirement. C:Device health may affect some grants, but the recorded authentication step and policy outcome identify why an extra verification was required. D:A registered method may be usable, but the sign-in's actual challenge and policy result explain why additional verification was required.
Question 388 Repeated invalid password attempts trigger temporary denial for one user. Which Microsoft Entra safeguard may explain it? Increase every Conditional Access sign-in frequency interval and assume the invalid-password lockouts will disappear The recipient's Exchange mail flow rule count Smart lockout or relevant account protection thresholds A SharePoint site deleted by its owner Explanation Correct Answer C:Protection controls mitigate repeated credential guessing. Incorrect Answers A:Session frequency controls are distinct from password-attempt thresholds and may not address Smart Lockout on repeated bad credentials. B:Transport configuration cannot lock a cloud sign-in. D:Site deletions do not impose Entra account lockout.
Question 389 A business has false lockouts after synchronized password changes. What should be analyzed before adjusting thresholds? Reset affected cloud passwords repeatedly without correlating Entra failed sign-ins with AD DS account lockout timing Sign-in failure patterns, on-prem lockout interactions, and Smart Lockout configuration The SharePoint external sharing default The number of service health subscriptions Explanation Correct Answer B:Evidence distinguishes attack traffic from user or sync failures. Incorrect Answers A:Uncoordinated resets can worsen confusion; timestamped cloud and on-premises authentication events reveal the lockout interaction. C:Sharing does not identify credential attempts. D:Subscriptions do not cause failed passwords.
Question 390 A departing employee still has a registered personal authenticator on the account during transfer to a successor. What should happen? Remove or reset stale authentication methods under approved identity verification Forward the former user's password reset mails externally Retain all methods indefinitely to avoid help desk work Leave the departing worker's personal authenticator registered and ask a successor to reuse its one-time codes during handoff Explanation Correct Answer A:Old device registrations must not remain trusted for another person. Incorrect Answers B:Unverified forwarding can enable takeover. C:Stale factors remain an access risk. D:Reusing a former employee's factor removes accountability and allows continued unauthorized control of the registered sign-in method.
