Question 440 A B2B collaborator cannot see a home-tenant security method accepted by a resource tenant policy. Which relationship requires attention? External identity trust and allowed authentication method evaluation for the resource Configure guest permissions on the SharePoint site alone and assume the resource tenant's external identity MFA trust requirements are automatically met The recipient's OneDrive quota The resource tenant's default Teams meeting policy Explanation Correct Answer A:B2B users can have different home and resource tenant policies. Incorrect Answers B:SharePoint permission grants do not determine which home-tenant authentication claims satisfy the resource tenant access policy. C:File storage cannot validate external authentication claims. D:Meeting settings do not define external factor acceptance.
Question 441 An employee changed phones and assumes restoring the app backup automatically restores every work account's passwordless credential. What must be verified? The user's email signature appears on the new phone The tenant's domain verification remains unchanged All user device tokens transfer without reauthorization Work account re-registration and supported credential restoration behavior for the new device Explanation Correct Answer D:Some methods require explicit reenrollment or administrator intervention. Incorrect Answers A:Signature visibility does not prove credential migration. B:Domain ownership cannot guarantee credential transfer. C:Not all cryptographic keys and registrations are portable.
Question 442 SSPR requires two methods, but a user has only one eligible method and several device sign-ins. What is the problem? Only qualifying registered recovery methods count toward SSPR requirements An Exchange alias counts as a second verification factor A SharePoint sharing link can be used as verification Every sign-in device automatically counts as a recovery method Explanation Correct Answer A:Multiple signed-in devices are not necessarily separate reset factors. Incorrect Answers B:Aliases do not prove account control. C:Content links are not approved reset evidence. D:Device count is not equivalent to method registration.
Question 443 An unattended app cannot obtain an access token after its certificate expired. What root cause should be checked? The service principal's user MFA method enrollment App credential lifetime and workload identity token request error The SharePoint site usage report date Reset the workload identity's application password while continuing token requests that use its expired certificate thumbprint Explanation Correct Answer B:Service principals authenticate with configured app credentials. Incorrect Answers A:Noninteractive apps cannot register a phone factor as users. C:Usage metrics do not extend an app certificate. D:Token acquisition through certificate credentials depends on a valid registered certificate and correct app credential configuration.
Question 444 An automation system uses a long-lived plaintext client secret in source code. What is the recommended improvement? Disable application audit logging to avoid leaks Put the secret in an email signature for auditing Use managed identity where supported or stronger managed app credentials instead of embedded secrets Replace the secret with a public domain verification token Explanation Correct Answer C:Reducing static secret exposure improves workload security. Incorrect Answers A:Audit removal is not secure credential management. B:Publishing secrets increases compromise risk. D:DNS ownership proofs are not app credentials.
Question 445 An employee changed mobile number, and SMS resets are being sent to the previous owner of that number. What must be corrected? Change all employees to a different Teams policy Verify the employee and replace stale registered recovery contact information Change the employee's SSPR verification method count but keep sending codes to the stale phone number after reassignment Increase the tenant's Outlook mail sending limit Explanation Correct Answer B:Outdated factors can permit account recovery by a third party. Incorrect Answers A:Meeting policies do not correct contact factors. C:Raising required method count cannot secure a recovery channel controlled by another person; replace and verify the registered contact. D:Email sending limits do not change recovery destinations.
Question 446 A Windows device enrollment flow expects a human user to approve an interactive MFA challenge, but the machine build is unattended. What design distinction matters? Choose a supported device provisioning or workload authentication flow rather than human-factor prompts Send the MFA request to a generic shared mailbox Disable MFA for the tenant so every build can proceed Use the tenant DNS TXT verification token as a factor Explanation Correct Answer A:Interactive MFA cannot be answered in unattended deployment. Incorrect Answers B:Shared email is not a safe replacement for human verification. C:Global weakening is not a supported enrollment design. D:Domain proof does not authenticate the device.
Question 447 One employee's account is excluded from a new FIDO2 target group despite being required to use a key by Conditional Access. What explains the sign-in deadlock? An Exchange Online mail rule is blocking security keys Add the user to a Conditional Access pilot group but leave FIDO2 registration disabled for that user in the methods policy Conditional Access requires a method that registration policy does not permit for that user The person's mailbox archive is not provisioned Explanation Correct Answer C:The policies must provide a usable permitted method. Incorrect Answers A:Mail transport has no relation to FIDO2 eligibility. B:A demanded authentication strength must be supported by the user's allowed registration method scope. D:Archives cannot enable FIDO2 key use.
Question 448 An account shows many failed primary-auth events and no MFA prompts. What should the incident responder conclude? Every failed password automatically disables the user forever No MFA prompt means no attempted compromise occurred Require stronger MFA prompts after the invalid password attempts, assuming failed primary authentication already reached the MFA stage Failures may occur before MFA; examine primary-auth errors and risk telemetry Explanation Correct Answer D:Lack of prompts does not prove the attempts were benign. Incorrect Answers A:Lockout behavior depends on controls and thresholds. B:Attackers can fail before the second factor. C:Primary credential rejection occurs before MFA is evaluated; inspect those failures and risk signals rather than expect second-factor events.
Question 449 A user can sign in under one UPN but searches for an old alias in the SSPR portal and gets account-not-found. What should support clarify? Change the user's Exchange SMTP alias and assume the SSPR portal will recognize it as the current Entra sign-in identifier Change the endpoint's local display language Use the correct current sign-in identifier and verify directory identity mapping Deactivate all group-based licensing for the user Explanation Correct Answer C:Aliases and old UPNs may not identify the intended account. Incorrect Answers A:A mail alias need not be a valid directory UPN used for SSPR lookup; confirm the current sign-in identity and mapping. B:Language setting does not resolve cloud account mapping. D:Licensing changes do not change their sign-in identity.
Question 450 An authentication report shows the user blocked by device compliance even after completing MFA. What does this indicate? MFA success does not satisfy independent Conditional Access grant controls Retry the MFA challenge with a stronger authentication method and assume that this satisfies an independently enforced device compliance requirement Reset the user's sign-in password and reauthenticate, disregarding the explicit device compliance failure in the Conditional Access results Exclude the user from the multi-factor policy only, expecting that exception to bypass a separate Conditional Access device-compliance condition Explanation Correct Answer A:Device requirements can still deny the session. Incorrect Answers B:Authentication strength and compliant-device state are separate Conditional Access grant controls and may both be required for one session. C:A correct credential does not satisfy a compliant-device grant condition; password rotation does not make the device compliant. D:Excluding an MFA-specific requirement does not remove the independent compliant-device grant that caused the blocked session.
