Question 390 A departing employee still has a registered personal authenticator on the account during transfer to a successor. What should happen? Remove or reset stale authentication methods under approved identity verification Forward the former user's password reset mails externally Retain all methods indefinitely to avoid help desk work Leave the departing worker's personal authenticator registered and ask a successor to reuse its one-time codes during handoff Explanation Correct Answer A:Old device registrations must not remain trusted for another person. Incorrect Answers B:Unverified forwarding can enable takeover. C:Stale factors remain an access risk. D:Reusing a former employee's factor removes accountability and allows continued unauthorized control of the registered sign-in method.
Question 391 A legitimate user loses the only Authenticator device and needs emergency recovery. What should support personnel require? Strong identity verification followed by supported authentication-method reset or TAP Restore the MFA registration based solely on an email reply apparently from the user's normal work address, without an independent identity check Accept the serial number of the missing Authenticator phone as the sole identity check Temporary tenant-wide MFA disablement for every employee Explanation Correct Answer A:Recovery should establish identity before issuing a new factor. Incorrect Answers B:Access to a mailbox may itself be compromised; method reset should follow strong approved identity verification. C:A caller may know device details without being the account holder, so secure recovery requires an approved independent verification procedure. D:Global relaxation is disproportionate.
Question 392 Security alerts show an unexpected new security method on an executive's account. What investigation should follow? Review security-info registration audit events and revoke unauthorized methods or sessions Only shorten the Exchange retention period Inspect only the executive's current MFA method inventory, without establishing who registered the newly added authenticator or when Assume registration is harmless if the account has a license Explanation Correct Answer A:New methods can sustain attacker access after a password reset. Incorrect Answers B:Retention does not revoke sessions. C:Registration inventory lists methods but does not by itself prove authorization; audit events and session review are needed to investigate the unexpected change. D:Licensing does not validate the new method.
Question 393 A user receives an Authenticator prompt that shows the wrong number relative to the sign-in screen. What should the user do? Reject the prompt and restart only a verified, intended authentication flow Read the code aloud to any support caller Disable all account audit logging Approve the displayed wrong Authenticator number because the username is familiar and the session started around the same time Explanation Correct Answer A:Mismatched challenges may indicate an unrelated attempt. Incorrect Answers B:Disclosing authentication challenges is unsafe. C:Suppressing evidence does not resolve mismatched prompts. D:Number mismatches are signs of an unintended challenge; approving can allow the wrong session rather than protect the account.
Question 394 A high-assurance environment uses user certificates backed by an enterprise PKI. Which Entra feature needs evaluation? Upload a signing certificate for Microsoft 365 Apps updates and treat it as the CA trust needed for Entra certificate-based authentication Configure a trusted mail-signing DKIM certificate and treat its selector as the trust required for user certificate-based sign-in The SharePoint site HTTPS certificate only Microsoft Entra certificate-based authentication trust and binding policy Explanation Correct Answer D:Certificate trust can provide strong identity verification. Incorrect Answers A:Code-signing and authentication certificate purposes differ; Entra CBA needs configured trusted issuer and certificate-to-user binding. B:Message signatures and Entra CBA trust serve different purposes; the latter needs a trusted issuing CA and user mapping. C:Site TLS certificate is not the user's sign-in credential.
Question 395 Certificate-based sign-in fails for users whose certificate chain is untrusted in the tenant configuration. What should be checked? The mailbox's anti-spam safe sender list The user's OneDrive storage permissions Trusted issuing CAs, certificate mapping and authentication binding rules Renew the endpoint's Office software certificate while leaving the Entra trusted issuer and user certificate mapping unexamined Explanation Correct Answer C:Untrusted or mismatched certs cannot establish the intended identity. Incorrect Answers A:Sender lists do not form user certificate trust. B:Storage ACLs cannot validate certificate chains. D:Office client updates do not repair an untrusted X.509 authentication chain or a missing directory binding for certificate sign-in.
Question 396 The company revokes employee certificates after offboarding but cloud sign-ins must reject revoked certs. What configuration matters? Remove an employee from Microsoft 365 Groups but leave the authentication certificate valid and revocation checks disabled Remove the user's mailbox SMTP aliases and assume Entra will automatically reject the now-revoked authentication certificate An Authenticator notification campaign only Supported certificate revocation checking and reliable revocation endpoint availability Explanation Correct Answer D:Trust should account for revoked credentials, not only expiration. Incorrect Answers A:Group authorization changes do not ensure a revoked certificate is rejected by Entra CBA, which requires supported revocation validation. B:Mail attributes do not enforce X.509 certificate revocation; supported revocation checks and reachable endpoints are required. C:Push registration does not validate certificate revocation.
Question 397 A user reports a successful sign-in from a country they have never visited. Which evidence is most useful? Check the employee's outbound mail SPF results and infer that the successful foreign sign-in must be authorized Sign-in logs with IP, device, application and authentication detail Only the user's OneDrive file count Only Outlook folder sizes and message flags Explanation Correct Answer B:Session context supports investigation of unexpected access. Incorrect Answers A:Email sender authentication offers no direct evidence about the cloud identity, IP, device and sign-in risk of a suspect login. C:File count cannot identify sign-in geography. D:Mailbox metadata lacks sign-in origin.
Question 398 An otherwise eligible user is redirected to registration at every sign-in after enrolling an app. What should be examined? The tenant's Exchange anti-malware quarantine days Registration completeness and applicable security-info or campaign policy state Clear the user's Office desktop account cache while ignoring registration campaign and security-info completeness records The user's current SharePoint document title Explanation Correct Answer B:Partially registered methods may not satisfy the requirement. Incorrect Answers A:Mail filtering does not track factor completion. C:Local Office caches cannot resolve an Entra policy that continually requires registration because the required methods are missing. D:File titles cannot acknowledge enrollment.
Question 399 An organization is migrating legacy per-user MFA settings to Conditional Access. What design risk must be considered? Overlapping challenges and inconsistent enforcement between old and new control paths Retain both legacy per-user MFA enforcement and new Conditional Access MFA without testing whether duplicate challenges occur Enabling CA automatically deletes every old per-user setting Both mechanisms are identical billing licenses Explanation Correct Answer A:Mixed models can produce confusing authentication behavior. Incorrect Answers B:Parallel MFA mechanisms can lead to overlapping prompts and inconsistent control evaluation during a migration. C:Legacy state should be reviewed explicitly. D:They are different enforcement and administration models.
Question 400 A user expects a prior approval to satisfy the next high-risk sign-in, but CA demands MFA again. What is relevant? Policy session controls and sign-in risk can require fresh authentication Assume the user's previous browser session meets every future sign-in risk policy without assessing authentication recency An Exchange shared mailbox permission overrides CA Assume a successful earlier MFA satisfies all later high-risk sign-ins regardless of session lifetime or risk conditions Explanation Correct Answer A:A previous claim may not meet the current session requirement. Incorrect Answers B:Session and sign-in risk requirements can demand fresh authentication even if a previous challenge succeeded. C:Mail permissions do not waive CA checks. D:New risk or session requirements can trigger step-up authentication despite a previous valid factor approval.
