Question 410 A phone can generate a time-based one-time code offline even when push notification service is unavailable. What property explains this? Authenticator TOTP codes can be generated locally using a shared secret and time TOTP always replaces every conditional access control A TOTP code is the same as a passwordless FIDO2 assertion TOTP codes are mailed by Exchange before each login Explanation Correct Answer A:Generating codes does not depend on live push delivery. Incorrect Answers B:A valid factor does not bypass policy decisions. C:The security properties and protocols differ. D:Offline TOTP does not require Exchange delivery.
Question 411 A workforce has no compatible smartphones but needs an approved second factor. Which alternative may meet the requirement? One tenant-wide password stored in a safe The same mailbox email OTP sent to every employee A verified domain TXT token printed on badges Supported OATH hardware tokens registered under the tenant's authentication methods Explanation Correct Answer D:Physical tokens can generate approved one-time codes. Incorrect Answers A:A shared password is not individual MFA. B:Shared channels do not provide unique account proof. C:DNS ownership tokens are not user authenticators.
Question 412 An external collaborator cannot use the organization's internal Authenticator registration but needs to redeem a guest invitation. Which experience may be available? The guest must configure Microsoft 365 mail DNS Every guest must first receive an internal AD DS account A global administrator must share their own TAP Email one-time passcode for supported external identity redemption Explanation Correct Answer D:Guest flows may use email-based verification where configured. Incorrect Answers A:Guest verification is not external DNS ownership. B:B2B access does not always require local accounts. C:Administrative credentials must not be delegated to guests.
Question 413 A sign-in logs 'MFA satisfied by claim in token' even though no prompt appeared this time. What is the useful interpretation? The account was granted Global Administrator automatically The sign-in was necessarily password-only and insecure The user bypassed all applicable Conditional Access policies An existing authentication claim met the evaluated MFA requirement Explanation Correct Answer D:Prompt frequency is not identical to current factor assurance. Incorrect Answers A:Token claims do not assign privileged directory roles. B:MFA may have been satisfied earlier. C:A valid claim does not mean policies were bypassed.
Question 414 A device browser repeatedly prompts for MFA despite recent successful challenges. What should be examined? Session controls, cookies, token persistence and sign-in evaluation Only a SharePoint sensitivity label on a file The tenant's email accepted domain list Only the current mailbox item count Explanation Correct Answer A:Session restrictions can force new challenges. Incorrect Answers B:File labels do not control session cookies. C:Mail acceptance does not determine token persistence. D:Mailbox quota does not create MFA loops.
Question 415 An employee asks help desk to delete their only registered factor without a replacement. What is the operational risk? The cloud user must lose all group memberships Removing the last factor can lock the user out of required MFA or SSPR journeys The mailbox will automatically be removed The domain verification record will expire immediately Explanation Correct Answer B:Recovery should establish a replacement route. Incorrect Answers A:Factor removal does not dissolve groups. C:Authentication methods do not delete Exchange mailboxes. D:Factor changes cannot expire DNS ownership.
Question 416 A caller demands a help desk password reset based only on a public employee-directory listing. What should staff require? Trust an email using the organization's usual signature as proof of the caller's identity An Exchange mail trace for the employee proves consent Independent approved identity verification before resetting credentials or factors A matching displayName is enough to issue a TAP Explanation Correct Answer C:Public profile details are insufficient proof of account ownership. Incorrect Answers A:Corporate signatures can be copied and are not a substitute for the approved identity-verification process. B:Message delivery is not identity proof. D:Display names can be learned or spoofed.
Question 417 Several accounts show low-rate failures from the same infrastructure without a single lockout. What assessment should lead? Disable sign-in logging to reduce server load Raise the mailbox size quota to prevent failures Correlate Entra sign-in failure trends, IPs and risk signals for password spraying Assign all users a weaker authentication method Explanation Correct Answer C:Distributed attempts may avoid per-account lockout thresholds. Incorrect Answers A:Audit suppression obscures the attack. B:Mailbox size does not affect password guessing. D:Weaker assurance increases successful compromise risk.
Question 418 A synchronized user's on-premises password expired under a hybrid policy and cloud sign-in is denied. Which interaction needs examination? The selected cloud authentication method and password expiration synchronization behavior Change the organization's public mail routing after a hybrid password expiration event without identifying the authentication path Whether the OneDrive quota reached capacity Whether every Teams channel has a retention label Explanation Correct Answer A:Expiration effects depend on configured hybrid sign-in design. Incorrect Answers B:MX records govern mail delivery, not the selected cloud sign-in protocol and password-expiration synchronization behavior. C:Storage quotas do not set authentication age. D:Teams retention cannot validate passwords.
Question 419 A stolen laptop is associated with suspicious sign-ins; incident response needs immediate interruption of account access. What action should be evaluated? Only move the user's OneDrive files to another folder Only send a password change reminder for next month Block the user sign-in and revoke sessions while investigating Remove the stolen laptop from device compliance reports while leaving the affected user's sign-in and current tokens active Explanation Correct Answer C:Blocking the identity curbs further access pending recovery. Incorrect Answers A:File location does not block cloud sign-in. B:Delayed reminders leave active threats. D:Device compliance inventory alone cannot interrupt a compromised identity's existing access; block and revoke the sessions.
Question 420 A responder revoked user sessions but an existing app continues showing cached content temporarily. What explains the limitation? Tokens and application cache behavior can delay visible effects until reauthentication Treat a user's token revocation as a command to delete every application's locally cached file content immediately Revocation permanently deletes the user account Revocation always deletes every offline cache immediately Explanation Correct Answer A:Revocation is not always identical to instantaneous local data erasure. Incorrect Answers B:Revocation affects authentication tokens but cached content may persist until application reauthentication or cleanup. C:Session invalidation is not account deletion. D:Local cached data may remain on a device.
