Question 490 One high-risk sign-in is detected, but the overall user account is not yet classified compromised. What is a suitable targeted control? Allow the session solely because the password is correct Change all tenant group memberships indiscriminately Require stronger authentication or block the risky session under sign-in risk policy Permanently delete the cloud user immediately in every case Explanation Correct Answer C:Session controls can stop anomalous access. Incorrect Answers A:Password success does not clear risk. B:Global changes are not targeted risk response. D:Deletion is disproportionate without investigation.
Question 491 Identity Protection labels a sign-in unfamiliar due to browser, device or location changes. What evidence should be correlated? Match the unfamiliar sign-in to historic Microsoft Entra device registrations but ignore whether the observed IP and browser are normal for this user Infer that the unfamiliar sign-in is malicious solely because the browser changed, without considering travel or a legitimate new device User travel, known devices, IP context and authentication history Compare prior Entra sign-in risk detections for the user but disregard the current session's IP, device and credential outcomes Explanation Correct Answer C:New properties can be legitimate or suspicious. Incorrect Answers A:Device history is useful context but not sufficient alone to resolve unfamiliar sign-in risk without location and authentication detail. B:Risk should be investigated with several correlated context signals; a browser change can have benign explanations. D:Historical detections help but do not replace assessing the actual new sign-in context.
Question 492 A CA policy requiring compliant devices denies access for an employee whose device was just enrolled. What should be verified? Device registration, Intune evaluation, compliance status and token claims A Teams meeting attendance record proves device trust Trust the device's displayed enrolled status as evidence of compliance without checking Intune policy evaluation and issued device claims Being licensed makes any device compliant Explanation Correct Answer A:Enrollment alone does not guarantee current compliant status. Incorrect Answers B:Meeting presence is not a compliance signal. C:Enrollment alone is not equivalent to compliant state; Conditional Access must evaluate the actual compliant-device claim. D:Licenses do not replace posture assessment.
Question 493 A newly added pilot user still bypasses an expected CA policy that targets a security group. What should be checked? The employee's file sharing links Effective group membership and propagation into policy evaluation Assign the user to a similarly named Microsoft 365 Group without confirming membership in the CA policy's targeted security group Assume the group-based CA assignment is immediate and never investigate propagation or the actual included/excluded group membership Explanation Correct Answer B:Targeting depends on current membership and token state. Incorrect Answers A:Shared links do not update membership claims. C:Groups with similar labels are distinct objects; policy evaluation uses effective membership in the exact assigned group. D:Newly changed group membership can take time to be reflected; verify effective targeting rather than infer from the request.
Question 494 One applicable policy requires MFA and another requires a hybrid joined device. What is generally required? Only whichever policy was created earlier Only hybrid join because it is a device claim Only MFA because it is more visible to the user Satisfy the requirements of all applicable grant policies Explanation Correct Answer D:Separate applicable grants can both constrain sign-in. Incorrect Answers A:Creation order is not a general policy priority rule. B:Device trust does not negate MFA grants. C:A factor does not negate device requirements.
Question 495 An admin is enabling a new app policy for every employee during business hours. What change-control strategy reduces risk? Disable emergency administrator monitoring Pilot and report-only assessment with staged enforcement and rollback plan Enable the blocking rule for all users at once and rely on restoring an earlier policy version if employees are locked out Immediately apply to all users without testing Explanation Correct Answer B:Evidence and controlled rollout reduce disruption. Incorrect Answers A:Recovery account monitoring remains essential. C:A rollback plan is useful but does not replace a scoped report-only pilot before applying high-impact enforcement. D:Unverified targeting can cause organization-wide lockout.
Question 496 A small tenant uses security defaults but wants custom CA exceptions by app and group. What change must be planned? Change every user's email suffix first Review the mutually exclusive security defaults and custom Conditional Access configuration Layer custom CA on top of security defaults without review Use a mail flow transport rule for app exceptions Explanation Correct Answer B:Granular CA requires the appropriate policy model and licensing. Incorrect Answers A:UPN suffix does not select the security policy model. C:The two controls are not simply independent stacking options. D:Transport rules cannot make identity access exceptions.
Question 497 A tenant with security defaults enabled experiences MFA requirements that admins cannot customize per group. What explains this? Security defaults are equivalent to an unused report-only policy Security defaults configure Exchange mail routing only Security defaults apply Microsoft-managed baseline protections rather than granular CA rules Security defaults allow excluding all privileged roles individually Explanation Correct Answer C:The baseline intentionally offers limited customization. Incorrect Answers A:They can enforce baseline requirements. B:They cover identity protections, not just mail flow. D:Custom granular exclusions are not their design.
Question 498 An employee connects from a trusted office IP but the device is compromised. What limitation should the design acknowledge? Location exclusions eliminate all credential phishing Trusted IPs automatically mark every device compliant A trusted network location is not proof that the account or device is safe No sign-in audit should run on trusted networks Explanation Correct Answer C:Other security signals and controls remain important. Incorrect Answers A:Origin location alone does not eliminate compromise. B:Network origin is not device posture. D:Trusted locations still merit monitoring.
Question 499 A policy must deny any sign-in from unmanaged devices rather than merely limit file downloads. Which control type meets the requirement? A named location tag without grants Use session download restrictions alone and assume they stop all sign-in attempts from unmanaged devices A block or appropriate grant policy based on evaluated device conditions An app control download-only restriction Explanation Correct Answer C:A session download restriction is not a full sign-in denial. Incorrect Answers A:Naming cannot by itself deny sign-ins. B:Session controls can limit actions after admission; a device-based block/grant is needed when the policy intends to deny the sign-in itself. D:Download control still permits some session access.
Question 500 A retired managed device retains access to an application after its compliance state is removed. What should administrators investigate? Assume the compliance change revoked every previously issued session immediately Evaluate the retired device's old compliance status once and ignore whether previously issued application tokens remain valid Token/session lifetime and revocation together with updated compliance evaluation Reset only the user's mailbox delegate permissions while retaining the device's app tokens and changed compliance evaluation unexamined Explanation Correct Answer C:Existing sessions can outlive the moment posture changed. Incorrect Answers A:Previously issued tokens can persist until appropriate reevaluation or revocation, even after compliance policy state changes. B:Conditional Access reevaluation and token/session behavior affect how quickly an already-signed-in device loses access. D:Shared mailbox rights are not the device state or session controls involved in the application access issue.
