Question 430 An admin requires users to register a hardware security key for daily sign-in but wants safe account recovery. What should be planned? Use a company intranet headline as a recovery question Share one spare key with every staff member Approved recovery methods with independent identity proofing and emergency enrollment paths Delete every recovery option to prevent enrollment changes Explanation Correct Answer C:Phishing-resistant daily sign-in still needs a secure recovery design. Incorrect Answers A:Public information is weak identity evidence. B:Shared authenticators defeat individual accountability. D:No recovery route can cause permanent lockouts.
Question 431 A user is synchronized and resets a password only on-premises, but Microsoft 365 still accepts the old credential temporarily. What should be checked? Password hash sync or selected authentication path and recent synchronization status A Defender email quarantine release The Exchange Online spam confidence score The user's OneDrive file version history Explanation Correct Answer A:Cloud sign-in may not reflect source changes until relevant processing completes. Incorrect Answers B:Quarantine changes do not propagate credentials. C:Spam scoring does not refresh sign-in secrets. D:File versions do not carry passwords.
Question 432 A user suddenly receives a certificate-selection dialog for a cloud app after an authentication policy rollout. What is relevant? Update a user's certificate registration but ignore whether the new Conditional Access policy explicitly selected Entra certificate-based authentication The organization profile description text Whether certificate-based authentication was enabled and required for the user's context An eDiscovery case hold assignment Explanation Correct Answer C:The prompt may result from eligible CBA policy changes. Incorrect Answers A:Certificates may be enrolled, but the policy and authentication method targeting explain the new certificate prompt. B:Business metadata does not request client certificates. D:Legal holds do not prompt for client authentication certs.
Question 433 A company is removing an old authentication method from policy but has hundreds of users who depend on it. What is the safe sequence? Inventory usage, register alternatives, pilot restrictions, then enforce removal Rename the old method in a spreadsheet Continue allowing obsolete methods indefinitely without review Delete the old method for everyone in one untested step Explanation Correct Answer A:Measured migration reduces unexpected lockout. Incorrect Answers B:A name change does not remove availability. C:Permanent allowance retains avoidable risk. D:Unplanned removal can strand users.
Question 434 An IT manager asks whether targeted users adopted stronger MFA methods after a registration campaign. What evidence is appropriate? Count total tenant users and infer that every targeted pilot account has registered a stronger authentication method Only the Teams monthly meeting count Only the number of mailbox recipients Authentication methods registration and campaign reporting for the target population Explanation Correct Answer D:Enrollment metrics show whether the change took effect. Incorrect Answers A:Account inventory is not evidence of registered methods; inspect the registration and campaign outcome for the pilot population. B:Meeting activity is not method registration. C:Recipients do not measure authenticator enrollment.
Question 435 A user sees sign-in failure after rejecting an MFA request. Which log outcome distinguishes this from an administrator-disabled account? A shared mailbox message trace only Authentication detail showing denied MFA versus account-disabled error The user's Office document recent list Treat every failed sign-in result as an account-disabled event without checking whether the user rejected an MFA challenge Explanation Correct Answer B:Different failure causes demand different responses. Incorrect Answers A:Email delivery cannot distinguish user sign-in results. C:Recent files do not identify failure reasons. D:Denied second-factor prompts have distinguishable authentication details from account-disabled errors.
Question 436 A pilot requires excluding one service account from a new interactive method policy. What should administrators validate? Remove all identity protection reporting An unlimited exclusion of every administrator Change only the account's email alias The precise policy targeting, exclusion, and noninteractive identity assumptions Explanation Correct Answer D:Exclusions must be scoped and documented. Incorrect Answers A:Disabling telemetry is not a scoped exception. B:Broad exemptions weaken controls without necessity. C:Mail alias does not remove method targeting.
Question 437 A user receives password-expired prompts at sign-in but can complete self-service reset. What should support verify? The SSPR capability and supported password-expired reset journey for that identity type The tenant's backup retention period must be raised Refresh locally cached passwords without checking the identity source's supported SSPR flow Exchange email forwarding must be disabled globally Explanation Correct Answer A:Recovery must be available at the blocked sign-in point. Incorrect Answers B:Backups do not allow a user to reset expired credentials. C:Cached client credentials do not determine whether password-expired users are eligible to reset credentials through the configured directory integration. D:Mail forwarding does not govern password expiration flow.
Question 438 Modern browsers sign in but one old mail client repeatedly asks for a password. What should be checked first? Disable modern authentication for the old client to eliminate password prompts despite the tenant blocking Basic sign-in An emergency access account's display name A retention label on the affected mailbox Client support for modern auth and current tenant legacy authentication controls Explanation Correct Answer D:Old clients may not complete the modern token flow. Incorrect Answers A:Turning off modern auth is not an authorized workaround for legacy client protocol incompatibility; update the app or auth path. B:Break-glass branding is unrelated to client protocol. C:Retention cannot modernize a client.
Question 439 Several users registered the same shared phone as an MFA method for their individual accounts. What concern should be raised? It automatically disables sign-in auditing It makes passwordless access automatically phishing-resistant It only changes mailbox storage billing Shared authenticators weaken individual accountability and allow cross-account approval Explanation Correct Answer D:Factors should be controlled by the authorized account holder. Incorrect Answers A:Audit logging is not determined by shared phone ownership. B:Shared phones do not establish origin-bound security. C:Authentication ownership is not a licensing feature.
Question 440 A B2B collaborator cannot see a home-tenant security method accepted by a resource tenant policy. Which relationship requires attention? External identity trust and allowed authentication method evaluation for the resource Configure guest permissions on the SharePoint site alone and assume the resource tenant's external identity MFA trust requirements are automatically met The recipient's OneDrive quota The resource tenant's default Teams meeting policy Explanation Correct Answer A:B2B users can have different home and resource tenant policies. Incorrect Answers B:SharePoint permission grants do not determine which home-tenant authentication claims satisfy the resource tenant access policy. C:File storage cannot validate external authentication claims. D:Meeting settings do not define external factor acceptance.
