Question 500 A retired managed device retains access to an application after its compliance state is removed. What should administrators investigate? Assume the compliance change revoked every previously issued session immediately Evaluate the retired device's old compliance status once and ignore whether previously issued application tokens remain valid Token/session lifetime and revocation together with updated compliance evaluation Reset only the user's mailbox delegate permissions while retaining the device's app tokens and changed compliance evaluation unexamined Explanation Correct Answer C:Existing sessions can outlive the moment posture changed. Incorrect Answers A:Previously issued tokens can persist until appropriate reevaluation or revocation, even after compliance policy state changes. B:Conditional Access reevaluation and token/session behavior affect how quickly an already-signed-in device loses access. D:Shared mailbox rights are not the device state or session controls involved in the application access issue.
Question 501 The organization wants supported apps to react more promptly to critical account and policy events. Which feature should it evaluate? An unlimited persistent browser session Disabling access logs across supported clients Set a one-hour sign-in frequency and assume supported apps receive all account-disable and risk events immediately Continuous Access Evaluation support for the app and client scenario Explanation Correct Answer D:CAE can shorten reaction latency to certain critical events. Incorrect Answers A:Persistence could worsen delayed revocation. B:Logging removal does not improve event response. C:Sign-in frequency sets periodic prompts; Continuous Access Evaluation supports more event-responsive access decisions where applicable.
Question 502 An administrator excludes a group named PilotException but the group nesting is unsupported in the expected policy evaluation. What must be verified? Actual effective included and excluded membership for the user or service principal The outbound mail sender policy The color of the group name in the portal Look only at the PilotException group's display name rather than the effective direct and nested membership used by CA Explanation Correct Answer A:Only evaluated membership affects the policy result. Incorrect Answers B:SPF does not select CA group members. C:Presentation has no targeting meaning. D:The policy evaluates effective user/object membership and supported group semantics, not the label alone.
Question 503 A partner must access one enterprise app while being blocked from unrelated applications. What should the tenant configure? Enable all apps for any external identity A tenant-wide guest exclusion from every policy Scoped user and cloud app assignments plus resource-specific CA policies Put the partner in the resource tenant's default All users assignment and grant broad access to every enterprise application Explanation Correct Answer C:Least-privilege targeting limits partner access to approved apps. Incorrect Answers A:Open assignment is opposite of least privilege. B:Broad exclusions undermine security controls. D:The requirement is limited to one app; resource tenant app assignments and CA scope should constrain the external identity.
Question 504 A partner's MFA claim from its home tenant is not honored and the resource tenant challenges again. What configuration matters? The resource tenant's Microsoft 365 usage reports The recipient's Exchange forwarding policy Cross-tenant access MFA trust settings and the relevant guest authentication claims The partner's Teams meeting recording policy Explanation Correct Answer C:Trust configuration controls acceptance of home-tenant assurance. Incorrect Answers A:Adoption reports do not evaluate MFA trust. B:Forwarding cannot accept external MFA claims. D:Recordings are not identity tokens.
Question 505 A CA policy was built against the wrong enterprise application with a similar name. What should be corrected? Target the proper application or service principal identifier and test policy applicability Change the user's phone method for every application Disable all CA policies to avoid name confusion Rename the wrong application and keep targeting it Explanation Correct Answer A:An incorrect app target produces unexpected enforcement. Incorrect Answers B:Method reset cannot fix app targeting. C:Global disablement removes valuable protections. D:Cosmetic naming does not change the target identity.
Question 506 An automation identity starts accessing a sensitive API from an unapproved IP. What control family should the team evaluate? A per-user MFA prompt sent to the service principal Supported Conditional Access for workload identities with scoped service-principal conditions Assign the workload identity to the same Conditional Access policies intended only for interactive human users A Microsoft 365 Apps update channel policy Explanation Correct Answer B:Workload identity policies can restrict eligible noninteractive principals. Incorrect Answers A:Unattended workload sign-in cannot approve phone prompts. C:Service principals require applicable workload identity controls; ordinary user MFA sign-in policies do not directly handle noninteractive token calls. D:Client software rollout does not restrict service-principal tokens.
Question 507 A federated user presents a valid assertion but Entra detects an anomalous sign-in. What is important? Exchange mail transport must be changed to enforce CA A valid assertion overrides every tenant access rule Only the identity provider can block any risky session Risk-aware Conditional Access can still apply after authentication claims are evaluated Explanation Correct Answer D:Federation does not remove cloud authorization controls. Incorrect Answers A:Transport cannot evaluate Entra risk. B:Identity proof and access authorization are distinct. C:Cloud policies can evaluate supported risk signals.
Question 508 A new hybrid tenant must perform initial registration before users have MFA. What should the rollout include? Exclude every employee forever to simplify setup Narrowly scoped registration/Temporary Access Pass and protected bootstrap exceptions Disable user sign-in logs during onboarding Require unregistered passkeys at the registration portal Explanation Correct Answer B:Enrollment must be possible without bypassing security long term. Incorrect Answers A:Permanent exclusion defeats MFA enforcement. C:Lack of logs obscures registration failures. D:Circular prerequisite can cause lockout.
Question 509 The organization blocks countries based on sign-in IP but a VPN user appears in another region. What does this demonstrate? A VPN automatically proves the user is physically in that region IP-country policy evaluates observed network egress, not verified physical residence Named locations are based solely on user HR addresses MFA can never be required on VPN sessions Explanation Correct Answer B:VPN routing can change the apparent location. Incorrect Answers A:Egress location is not personal location. C:IP conditions use observed network signals. D:VPN users can still satisfy MFA policies.
Question 510 A newly enabled rule accidentally denies all staff access, but an emergency administrator can sign in. What should be done? Delete the affected Microsoft 365 tenant Permanently disable every security setting in the tenant Disable or safely revert the faulty policy using the protected recovery account Change the company's inbound mail routing Explanation Correct Answer C:Controlled rollback restores access without deleting all security controls. Incorrect Answers A:Tenant deletion is destructive. B:Global disablement is unnecessary after a scoped failure. D:MX cannot reverse CA sign-in blocks.
