Question 420 A responder revoked user sessions but an existing app continues showing cached content temporarily. What explains the limitation? Tokens and application cache behavior can delay visible effects until reauthentication Treat a user's token revocation as a command to delete every application's locally cached file content immediately Revocation permanently deletes the user account Revocation always deletes every offline cache immediately Explanation Correct Answer A:Revocation is not always identical to instantaneous local data erasure. Incorrect Answers B:Revocation affects authentication tokens but cached content may persist until application reauthentication or cleanup. C:Session invalidation is not account deletion. D:Local cached data may remain on a device.
Question 421 A tenant deploys strict MFA and Conditional Access and must still recover from policy misconfiguration. What safeguard should be established? One common admin account shared with everyone Disable all Conditional Access before every deployment Protected emergency access accounts with monitored, tested exclusion strategy Rely solely on one administrator's personal smartphone Explanation Correct Answer C:Break-glass paths preserve recovery if normal admin access fails. Incorrect Answers A:Shared privileged secrets reduce accountability. B:Global disablement undermines the security baseline. D:A single device is an availability weakness.
Question 422 An emergency administrator account signs in despite there being no declared incident. What response is appropriate? Delete audit records to protect the account Investigate the privileged sign-in and alert on unauthorized emergency account activity Treat every break-glass sign-in as routine staff behavior Convert the account to an anonymous guest user Explanation Correct Answer B:Break-glass use should be exceptional and monitored. Incorrect Answers A:Removing evidence prevents investigation. C:Unusual emergency use may signal compromise. D:Guest conversion does not resolve suspicious access.
Question 423 A new hire used a Temporary Access Pass to register a FIDO2 key successfully. What must be assessed next? Retain a one-time TAP indefinitely as a fallback after security-key enrollment The TAP validity and revocation after the intended onboarding use Keep the TAP active indefinitely because the new security key is registered, without checking intended one-time-use or expiry rules Whether Teams usage reports contain the hire Explanation Correct Answer B:Temporary bootstrap access should not linger unnecessarily. Incorrect Answers A:Leaving a temporary onboarding credential active beyond its approved scope increases identity risk rather than completing the controlled registration process. C:A bootstrap credential should be retired under its issuance policy after enrollment rather than remain an unnecessary recovery path. D:Adoption reporting does not expire temporary secrets.
Question 424 A noninteractive workload uses application credentials rather than interactive user sign-in. What authentication distinction matters? Require an SMS code on every unattended token refresh Register the service principal as a telephone contact Use supported workload identity authentication instead of assuming interactive MFA prompts apply Use an Exchange spam filter as the app secret Explanation Correct Answer C:Service principals use different credential and policy patterns. Incorrect Answers A:Noninteractive flows cannot answer phone challenges. B:Contacts do not turn apps into interactive users. D:Mail filtering is not workload authentication.
Question 425 The security team wants to prevent adversary-in-the-middle phishing from capturing usable MFA sessions. Which direction is appropriate? Favor origin-bound phishing-resistant factors and compatible access policy enforcement Require only SMS plus password Send longer one-time codes by email Require only a knowledge-based security question Explanation Correct Answer A:Phishing-resistant methods reduce relay-based credential theft. Incorrect Answers B:SMS codes can still be relayed. C:Longer codes are still transferable to phishing sites. D:Shared knowledge can be phished.
Question 426 A user registered Microsoft Authenticator but a particular app only accepts password and blocks sign-in. What should be inspected? Re-register Microsoft Authenticator repeatedly without checking the application's sign-in protocol Re-enroll Authenticator repeatedly while leaving the affected legacy application's unsupported authentication protocol unchanged The authenticator is automatically authorized for all legacy clients App authentication protocol and CA requirements rather than registration alone Explanation Correct Answer D:Having a method registered does not make every app support modern authentication. Incorrect Answers A:Registration does not make a password-only legacy client support modern MFA challenges or satisfy the applicable access policy. B:Registration cannot make a protocol incapable of modern sign-in satisfy the app's authentication and access requirements. C:Legacy auth may not carry MFA.
Question 427 Automated scripts submit repeated SSPR reset requests for many accounts. What should the administrator examine? A mailbox auto-reply rule on each employee A SharePoint retention label protecting login pages Disable MFA registration prompts globally when reset abuse is detected, without evaluating SSPR request audit signals or throttling SSPR abuse protections, audit signals and controls limiting unexpected requests Explanation Correct Answer D:Reset workflows need protection against enumeration and flooding. Incorrect Answers A:Auto-replies do not rate-limit identity proofing. B:Retention cannot throttle reset requests. C:MFA registration and abusive SSPR requests are different operations; reset abuse needs targeted detection and account protection.
Question 428 A guest signs in using credentials from the home tenant, but resource policies require MFA. What should the resource tenant assess? Cross-tenant access trust settings and the accepted MFA claims The default PowerPoint template settings Accept a home tenant's MFA claim automatically for every guest, without evaluating the resource tenant's trust settings The guest user's local Exchange mailbox forwarding Explanation Correct Answer A:Trust configuration governs whether home-tenant assurance is honored. Incorrect Answers B:Document design cannot control guest assurance. C:Cross-tenant claim trust is explicitly configured; home sign-in success alone does not satisfy the resource tenant MFA requirement. D:Mail forwarding is not cross-tenant factor trust.
Question 429 A mobile push shows an unfamiliar city while the employee is traveling with VPN egress. What should the support team compare? Treat the location text as unchallengeable proof Network egress context, session logs, and user intent before attributing compromise Change the tenant's custom domain name Disable MFA for all traveling employees Explanation Correct Answer B:Geolocation can reflect the VPN or proxy endpoint. Incorrect Answers A:IP geography is approximate and context-dependent. C:Domain labels cannot fix geolocation inference. D:Global relaxation creates unnecessary risk.
Question 430 An admin requires users to register a hardware security key for daily sign-in but wants safe account recovery. What should be planned? Use a company intranet headline as a recovery question Share one spare key with every staff member Approved recovery methods with independent identity proofing and emergency enrollment paths Delete every recovery option to prevent enrollment changes Explanation Correct Answer C:Phishing-resistant daily sign-in still needs a secure recovery design. Incorrect Answers A:Public information is weak identity evidence. B:Shared authenticators defeat individual accountability. D:No recovery route can cause permanent lockouts.
