Question 460 A company wants a named location representing only published office egress IP ranges. What information should the admin define? A list of office street addresses without IP ranges A list of SMTP mail relay hostnames The MAC addresses of internal employee laptops The actual public IP ranges used by approved offices Explanation Correct Answer D:Named IP locations match network egress data. Incorrect Answers A:Addresses do not provide an IP-based match. B:Mail relays may not represent user egress addresses. C:Public cloud sign-in does not use client MACs for this location.
Question 461 Employees use a cloud VPN whose egress IPs change dynamically and a CA trusted-location policy behaves inconsistently. What should be reviewed? The number of registered MFA methods The employee's OneDrive folder count Treat every corporate VPN user as a trusted location based on their sign-in UPN suffix rather than the actual public egress IP The verified VPN egress IP inventory and the named-location entries Explanation Correct Answer D:Mismatched IP lists cause inconsistent location evaluation. Incorrect Answers A:Registration count cannot correct IP geolocation. B:File count cannot affect sign-in IP classification. C:Named-location evaluation depends on observed network addresses, not the user's email suffix or a log retention schedule.
Question 462 The company plans to block sign-ins from disallowed countries, but contractors use shared proxy egress. What must be considered? IP geolocation accuracy, proxy routes and approved exception paths Country labels always prove a user's physical location A domain verification TXT record establishes country Blocking is unnecessary if users have a password Explanation Correct Answer A:Location-based rules may misclassify traveling or proxied users. Incorrect Answers B:IP location is approximate and can reflect VPN exit points. C:DNS ownership does not identify sign-in geography. D:Passwords do not mitigate unwanted geographic access.
Question 463 Identity Protection assigns a high user risk due to probable credential compromise. Which type of access policy could require remediation? A DLP policy blocking external file shares A sign-in frequency policy based only on time elapsed A device update ring target list A user-risk Conditional Access decision with supported password-change requirement Explanation Correct Answer D:User risk reflects account compromise and can drive remediation. Incorrect Answers A:Data controls do not remediate account risk. B:Session renewal does not specifically remediate compromised passwords. C:Update cadence is not user risk remediation.
Question 464 A single unfamiliar session is rated high risk but the user's overall risk remains low. Which signal is associated with this event? Infer sign-in risk from the user's cumulative account-risk score alone and ignore the unusual properties of this individual authentication event User risk always equals the last sign-in risk A Secure Score number determines the session's risk Sign-in risk evaluates that particular authentication attempt Explanation Correct Answer D:Session risk and persistent user risk are separate signals. Incorrect Answers A:A user-risk score and per-sign-in risk are related but different signals; the unusual session can be risky while the account's aggregate risk remains low. B:They can be calculated independently. C:Posture score is not individual sign-in risk.
Question 465 Identity Protection lists a high-risk user with recent atypical access and token activity. What should responders do? Turn off risk detection so the user disappears Immediately remove every user's MFA method Force every user in the tenant to reset their password before reviewing which Entra Identity Protection detections affected the high-risk identity Investigate risk detections, confirm compromise and remediate the account Explanation Correct Answer D:High-risk users require an identity-specific response. Incorrect Answers A:Suppressing visibility does not remediate an attack. B:Global changes exceed the incident scope. C:A broad reset is not a scoped investigation of the risky account or its tokens; determine affected identity and remediate appropriately.
Question 466 An administrator verifies a sign-in risk alert resulted from a known employee VPN and successful expected MFA. What can be documented? Evidence-based dismissal or confirmation of the risk after investigation Disable all identity risk policies permanently Publish the employee's full sign-in data publicly Reset every employee password automatically Explanation Correct Answer A:A reviewed false positive can be resolved with audit evidence. Incorrect Answers B:One benign event does not justify removing coverage. C:Sensitive audit details should not be exposed. D:Broad resets are unrelated to the investigated session.
Question 467 A security analyst needs to know why Identity Protection marked an account risky. What evidence should be examined? Only Microsoft 365 Apps update status Only Teams meeting transcript keywords The risk detections and related sign-in evidence for the affected user Only the organization's default domain suffix Explanation Correct Answer C:Detections give the reasons behind risk classification. Incorrect Answers A:Software update reports do not explain identity risk. B:Meetings content is not sign-in risk evidence. D:The suffix does not explain risk events.
Question 468 An administrator wants an app to accept passkeys but reject SMS codes even though both count as MFA. Which CA setting is suitable? Require any password with at least eight characters Require MFA without specifying an authentication strength Change the cloud app's display name Require a phishing-resistant authentication strength Explanation Correct Answer D:Strength policies restrict which registered methods satisfy the grant. Incorrect Answers A:Password length is not phishing-resistant MFA. B:Ordinary MFA may accept weaker factors. C:Names do not determine authentication assurance.
Question 469 A CA policy is intended only for managed iOS and Android devices. What targeting must be configured carefully? Change each user's preferred language to mobile Apply a Conditional Access user filter based on email domains, assuming that limits the rule to managed iOS and Android endpoints Device platform conditions plus supported grant requirements and exclusions Set a named location for the phone manufacturer Explanation Correct Answer C:A platform condition narrows where enforcement applies. Incorrect Answers A:Language preference does not identify device platform. B:Email-domain targeting does not identify device operating system; supported platform and grant conditions are required. D:IP location cannot identify operating systems.
Question 470 A policy targeting browsers unexpectedly excludes a native mobile client. Which condition may explain that? Client apps conditions distinguish browser and mobile/desktop application flows The company lacks a second verified domain The mobile app has a shorter display name The user's Exchange email alias differs Explanation Correct Answer A:Different client categories can match separate policy scopes. Incorrect Answers B:Domains do not change browser-versus-app targeting. C:Display names do not select CA client categories. D:Aliases do not determine client app policy classification.
