Question 480 A named CA policy appears 'not applied' on a successful sign-in. What should be concluded? All CA policies were disabled permanently Treat the successful sign-in as proof that the named policy enforced MFA and allowed it, despite the explicit not-applied status The policy must have blocked the user silently Its targeting or conditions did not match that evaluated sign-in Explanation Correct Answer D:Not applied does not prove a control was bypassed. Incorrect Answers A:One unmatched policy does not establish global state. B:A nonapplied policy did not cause that sign-in's grant decision; inspect unmatched users, applications and conditions. C:No applicable block is shown by that result.
Question 481 A noninteractive application fails after an interactive user CA policy change. What must be distinguished? Every application should use a shared human password Service principal or workload identity policies versus interactive user targeting The tenant email domain should be deleted The application must register SMS MFA like an employee Explanation Correct Answer B:Different identity types may require different controls. Incorrect Answers A:Human secrets are inappropriate for unattended workloads. C:Domain deletion does not fix workload authentication. D:Noninteractive workloads cannot answer phone prompts.
Question 482 A regulated application requires users to reauthenticate regularly rather than rely indefinitely on a prior session. Which CA session control is relevant? Set a Conditional Access persistent-browser-session policy without defining how often the users must reauthenticate An Exchange archive policy An SSPR recovery method count setting Sign-in frequency for the targeted application and users Explanation Correct Answer D:Frequency can require renewed authentication over time. Incorrect Answers A:Browser persistence and sign-in frequency are distinct session controls; the requirement specifies a recurring fresh login. B:Archives do not control token renewal. C:Recovery method count is not session freshness.
Question 483 Users on shared kiosks must not retain long-lived browser sessions to sensitive apps. Which setting should be reviewed? The tenant's incoming mail security policy The user's group email alias settings Persistent browser session controls in Conditional Access Set a long sign-in frequency while allowing a persistent browser session on shared kiosks Explanation Correct Answer C:Session persistence affects sign-in continuity on shared browsers. Incorrect Answers A:Email filtering does not define kiosk sessions. B:Aliases do not manage browser token persistence. D:Long-lived browser sessions increase residual access at shared devices; persistent-browser controls should be evaluated.
Question 484 An employee claims to have checked 'remember me' but CA still requires verification for a finance app. What policy behavior should be reviewed? Every remembered session must last forever A Teams calendar setting controls MFA memory Sign-in frequency and authentication strength requirements can supersede remembered state The app can use any anonymous login after MFA once Explanation Correct Answer C:Session grants determine acceptable assurance and renewal. Incorrect Answers A:Policies may demand fresh verification. B:Calendar preferences cannot set CA sessions. D:Prior MFA does not authorize anonymous access.
Question 485 An organization wants higher-assurance verification before access to administrative portals. Which target category can help? Applicable Microsoft admin portal cloud apps in Conditional Access The default Teams app catalog permission An email spam filter for Global Administrators A Purview content label on role assignments Explanation Correct Answer A:Targeting administrative endpoints helps protect elevated actions. Incorrect Answers B:App catalog is not admin portal authentication. C:Mail policies cannot enforce admin portal MFA. D:Labels do not enforce sign-in challenges.
Question 486 A sensitive SharePoint site uses authentication context to demand stronger access requirements. What integration matters? Apply a Conditional Access policy to all SharePoint traffic without targeting the site's configured authentication-context identifier Assign the SharePoint site owner the Security Administrator directory role instead of configuring the matching authentication-context CA policy A blanket tenant password reset campaign A Conditional Access policy targeting the configured authentication context Explanation Correct Answer D:The context links resource access to an additional grant evaluation. Incorrect Answers A:Broad app targeting may not enforce the specific step-up policy triggered by the site's authentication context. B:Administration permissions do not make a particular site interaction trigger a stronger authentication context. C:Global reset does not target the sensitive resource.
Question 487 A team wants sign-in risk policies but its licenses may not support Identity Protection. What should it verify? Assign an Entra Security Reader role and assume it enables Identity Protection risk policies without verifying premium licensing Only the number of Teams audio licenses Applicable Microsoft Entra licensing and Identity Protection prerequisites Only the company's domain registration period Explanation Correct Answer C:Risk-based features depend on eligible services and licenses. Incorrect Answers A:RBAC controls access to features, but advanced risk policy availability also depends on the licensed product prerequisites. B:Calling subscriptions do not enable sign-in risk detection. D:Domain ownership does not grant Identity Protection.
Question 488 A user gets MFA while colleagues on the same network do not, following a risky sign-in detection. What could explain this? A single office IP guarantees equal risk for everyone All users must always receive identical prompts Different session risk evaluations under Conditional Access Apply the same trusted-location exception to every user and assume identical session risk regardless of each event's signals Explanation Correct Answer C:Risk-based controls can vary per sign-in. Incorrect Answers A:Other identity and session signals still matter. B:Conditional decisions are contextual. D:Risk evaluations can differ per sign-in based on behavior and context even from the same network path.
Question 489 An account appears in a leaked credentials risk detection. What is the most relevant remediation? Enable a SharePoint site storage alert Investigate compromised credentials, reset/revoke access and review activity Disable the user's Microsoft 365 mailbox without revoking cloud sessions or investigating the leaked credential risk Add a stronger MFA registration method but leave the leaked password and existing sessions active without further investigation Explanation Correct Answer B:Credential exposure requires identity response. Incorrect Answers A:Storage alerts do not remediate password leaks. C:Mailbox access is only one workload; identity remediation must cover the exposed credentials and affected sessions. D:A stronger factor may improve future authentication, but it does not remove previously compromised credentials or active sessions.
Question 490 One high-risk sign-in is detected, but the overall user account is not yet classified compromised. What is a suitable targeted control? Allow the session solely because the password is correct Change all tenant group memberships indiscriminately Require stronger authentication or block the risky session under sign-in risk policy Permanently delete the cloud user immediately in every case Explanation Correct Answer C:Session controls can stop anomalous access. Incorrect Answers A:Password success does not clear risk. B:Global changes are not targeted risk response. D:Deletion is disproportionate without investigation.
