Question 510 A newly enabled rule accidentally denies all staff access, but an emergency administrator can sign in. What should be done? Delete the affected Microsoft 365 tenant Permanently disable every security setting in the tenant Disable or safely revert the faulty policy using the protected recovery account Change the company's inbound mail routing Explanation Correct Answer C:Controlled rollback restores access without deleting all security controls. Incorrect Answers A:Tenant deletion is destructive. B:Global disablement is unnecessary after a scoped failure. D:MX cannot reverse CA sign-in blocks.
Question 511 A user is denied only on hotel Wi-Fi while corporate network sign-ins work. Which evidence should be compared? Only the number of recent Teams meetings Observed public IP, matched named location, and applicable CA conditions Only a domain verification TXT token Compare the user's location country label only, ignoring the actual observed public IP and named-location address entries Explanation Correct Answer B:Location targeting can explain environment-specific denial. Incorrect Answers A:Meeting volume does not choose access policy. C:Ownership proof does not identify hotel egress. D:Named-location matching uses the network endpoint and applicable conditions, which may differ from a coarse geographic label.
Question 512 A new Intune-enrolled laptop is not yet listed compliant in sign-in logs. What is the correct response? Tell the user every new laptop is instantly compliant Exempt the recently enrolled laptop from all CA device policies indefinitely instead of verifying its compliance evaluation Check enrollment, compliance policy evaluation and token/device registration state Add a bypass for every unmanaged laptop Explanation Correct Answer C:Device trust may need evaluation and token updates. Incorrect Answers A:Enrollment alone does not guarantee policy compliance. B:An exclusion would bypass the control rather than resolve why the device has not yet reported a valid compliant state. D:Broad bypass defeats the compliance requirement.
Question 513 The company wants stronger MFA only for privileged roles, not regular app users. Which targeting is relevant? The mail transport high-confidence phishing action Directory role targeting combined with authentication strength for administrative access Any security group with a similar display name A company-wide DLP policy for all documents Explanation Correct Answer B:CA can scope enforcement to specific privileged roles. Incorrect Answers A:Email filters cannot enforce admin MFA. C:A name alone does not identify role assignments. D:DLP controls data rather than admin authentication.
Question 514 A user is eligible for Global Administrator via PIM but not currently active. A CA policy targets privileged roles. What should be tested? How effective active role membership is evaluated in the specific CA rule The user's Teams channel membership only An expired custom-domain TXT record An existing Power BI workspace admin role Explanation Correct Answer A:Eligible versus activated privileges may affect policy targeting. Incorrect Answers B:Collaboration groups do not grant directory admin privileges. C:Domain verification does not activate roles. D:Workspace roles are not tenant Global Administrator.
Question 515 A tenant wants a CA policy to apply only to devices with supported trust types or specific attributes. What can help? An Exchange address book filter Build a network named-location condition using the device's reported model name, rather than an eligible device filter Conditional Access filter for devices with supported device properties A guest invitation redemption email policy Explanation Correct Answer C:Filters can select devices based on evaluated attributes. Incorrect Answers A:Address book filtering is not device targeting. B:Named locations evaluate sign-in network context; device filters evaluate supported trust and device properties. D:Invitations do not evaluate device attributes.
Question 516 A new device filter intended to exclude test hardware also excludes production laptops. What should be reviewed? Only the tenant's custom domain brand color The filter expression's operators, grouping and actual device attribute values Only the users' Teams status messages Assume that a filter matching test serial numbers is harmless without comparing operators and grouped conditions against production values Explanation Correct Answer B:Incorrect logic can match more devices than expected. Incorrect Answers A:Appearance does not determine filter membership. C:Presence is unrelated to device filtering. D:Filter expression logic can expand an unintended match set; actual attributes and boolean grouping must be reviewed.
Question 517 An access attempt to a protected SharePoint site triggers stronger authentication than opening a normal site. What causes the difference? A higher Exchange mail transport priority A resource authentication context mapped to a stronger Conditional Access requirement The protected site has more files stored Attribute step-up authentication to a library's document-classification labels alone Explanation Correct Answer B:Resource-specific context can invoke additional access assurance. Incorrect Answers A:Mail routing is not SharePoint authentication context. C:File quantity does not define auth strength. D:Label protection can govern documents, but it does not by itself explain a resource authentication context triggering a Conditional Access prompt.
Question 518 A help desk user cannot see detailed Identity Protection risk events, although they can read general tenant health. What should be verified? Required Identity Protection viewing roles and applicable licensing Assign Global Reader and assume it provides every restricted Identity Protection risk detection view The user's default domain suffix The person's Teams meeting organizer permission Explanation Correct Answer A:Risk telemetry has specific permissions beyond general tenant status. Incorrect Answers B:A broad read role may not confer all risk investigation privileges and licensing prerequisites; inspect the specific viewing permissions. C:The suffix does not confer risk-viewing roles. D:Meeting role is unrelated to identity risk reports.
Question 519 An old application relies on a stored user password and cannot handle interactive MFA. What security direction is appropriate? Require an SMS prompt on every unattended job execution Publish the stored password in a secure mail rule Keep excluding it from every access policy indefinitely Replace legacy authentication with a supported modern or workload identity flow Explanation Correct Answer D:Unattended password-based sign-ins are weak and may be blocked. Incorrect Answers A:The job cannot respond to interactive challenges. B:Mail rules are not secure credential storage. C:Permanent broad exceptions retain risk.
Question 520 An organization requires users to accept a current legal Terms of Use before accessing a regulated application. Which grant condition could enforce this? Conditional Access requiring acceptance of the configured Terms of Use Show Terms of Use in a SharePoint page but omit the Conditional Access grant requiring acceptance An Exchange disclaimer appended to outbound emails A named location for the legal team office Explanation Correct Answer A:A supported ToU grant can record acknowledgment before access. Incorrect Answers B:Publishing legal terms without linking their acknowledgment to access policy cannot make acceptance a sign-in prerequisite. C:Mail disclaimers are not app access grants. D:Location does not record contractual acknowledgment.
