Question 400 A user expects a prior approval to satisfy the next high-risk sign-in, but CA demands MFA again. What is relevant? Policy session controls and sign-in risk can require fresh authentication Assume the user's previous browser session meets every future sign-in risk policy without assessing authentication recency An Exchange shared mailbox permission overrides CA Assume a successful earlier MFA satisfies all later high-risk sign-ins regardless of session lifetime or risk conditions Explanation Correct Answer A:A previous claim may not meet the current session requirement. Incorrect Answers B:Session and sign-in risk requirements can demand fresh authentication even if a previous challenge succeeded. C:Mail permissions do not waive CA checks. D:New risk or session requirements can trigger step-up authentication despite a previous valid factor approval.
Question 401 Help desk staff need to update users' registered methods but should not gain broad tenant administration. Which governance principle applies? Share one privileged admin account among all agents Grant Global Administrator permanently to each help desk agent Assign the appropriate authentication-method administrative role with scoped access where supported Disable audit logs to protect user privacy Explanation Correct Answer C:Limited delegation reduces account takeover risk. Incorrect Answers A:Shared accounts erase audit attribution. B:Excess permissions increase compromise impact. D:Method resets require attributable evidence.
Question 402 An employee disputes a newly added phone number used for verification. Where should investigators look? An Exchange Online mail flow rule inventory only Directory audit events for authentication-method registration and the sign-in timeline A Microsoft 365 billing invoice A device compliance report without user registration history Explanation Correct Answer B:Registration evidence links identity changes to sessions. Incorrect Answers A:Transport rules cannot prove phone-factor changes. C:Billing cannot establish who enrolled the number. D:Compliance does not prove method additions.
Question 403 A compromised account's password is reset, but the responder needs to terminate active cloud access too. What additional control is relevant? Only enable archive mailbox storage Require a password change on the next login but leave currently issued cloud sessions active Only change DMARC enforcement Revoke user sessions or refresh tokens as part of incident response Explanation Correct Answer D:Password rotation alone may not terminate every token immediately. Incorrect Answers A:Archives cannot end active sign-ins. B:A future password-change prompt cannot immediately invalidate access already granted through active tokens. C:Mail spoof controls cannot revoke Entra tokens.
Question 404 A user cannot select an obvious company-name password at change time; another is blocked after many incorrect attempts. Which distinction is accurate? Neither event can be audited or configured Both events prove the user is unlicensed Password Protection rejects weak new candidates; smart lockout mitigates repeated failed sign-ins Both events are caused by Outlook spam rules Explanation Correct Answer C:They operate at different points in the credential lifecycle. Incorrect Answers A:The policies have controls and relevant telemetry. B:Licensing does not explain password quality checks. D:Spam policy does not choose passwords.
Question 405 A cloud-only user with no license to advanced Entra features asks whether SSPR can be used. What should an admin verify? Whether the user created an Outlook calendar Whether the user has a Teams dial-in number SSPR entitlement and tenant or group-scoped configuration for that account Assign an Entra security group containing the user but do not enable SSPR for that group under the actual tenant policy Explanation Correct Answer C:Availability depends on configuration and applicable licensing. Incorrect Answers A:Calendar existence is not SSPR eligibility. B:Calling options do not establish SSPR entitlement. D:Group membership alone does not establish feature availability; entitlement and enabled-user scope must both be satisfied.
Question 406 An SSPR user is prompted to verify by email but the only registered address is the mailbox they cannot access. What design concern exists? Reuse the locked-out mailbox as the only recovery email even though the person cannot access it until after reset Recovery evidence should be independent and accessible without the locked-out account SSPR can always deliver to the locked-out primary mailbox A new Exchange transport rule eliminates identity proof Explanation Correct Answer B:Using the inaccessible mailbox can prevent account recovery. Incorrect Answers A:The verification path must be accessible independently of the inaccessible account to prevent circular recovery. C:The mailbox may be inaccessible during reset. D:Transport cannot replace SSPR verification.
Question 407 Employees registered MFA but SSPR still reports missing recovery methods. Which distinction should be checked? Whether their shared mailbox has an owner Whether registered methods satisfy both relevant MFA and SSPR policy requirements Whether their workstation installed a PDF reader Whether the office network prefers IPv6 Explanation Correct Answer B:Not every method qualifies for every recovery flow. Incorrect Answers A:Shared mailbox rights do not establish SSPR methods. C:Application inventory is not recovery evidence. D:Transport preference does not register recovery proof.
Question 408 A user has both SMS and Authenticator methods and the tenant wants to encourage the stronger available factor. Which capability is relevant? Change the user's mail alias to select MFA Always remove every weaker method immediately System-preferred multifactor authentication when supported and enabled Disable all authentication method targeting Explanation Correct Answer C:The service can prioritize stronger eligible registered methods. Incorrect Answers A:Alias changes cannot rank authentication factors. B:Abrupt removal can disrupt recovery without rollout planning. D:Removing targeting does not make a factor preferred.
Question 409 Push authentication works on Wi-Fi but fails on one phone when mobile data is active. Which factor should be evaluated? The user's SharePoint guest sharing policy Mobile notification connectivity and the registered Authenticator instance The tenant's Exchange mailbox archive limit Re-register every employee's Microsoft Authenticator instance despite the problem occurring only on one device's mobile data connection Explanation Correct Answer B:Delivery requires the supported device to receive prompts. Incorrect Answers A:Guest sharing cannot repair device notification delivery. C:Mailbox storage cannot deliver phone push notifications. D:Mass re-registration is disproportionate; inspect the affected phone's notification and network connectivity first.
Question 410 A phone can generate a time-based one-time code offline even when push notification service is unavailable. What property explains this? Authenticator TOTP codes can be generated locally using a shared secret and time TOTP always replaces every conditional access control A TOTP code is the same as a passwordless FIDO2 assertion TOTP codes are mailed by Exchange before each login Explanation Correct Answer A:Generating codes does not depend on live push delivery. Incorrect Answers B:A valid factor does not bypass policy decisions. C:The security properties and protocols differ. D:Offline TOTP does not require Exchange delivery.
