Question 520 An organization requires users to accept a current legal Terms of Use before accessing a regulated application. Which grant condition could enforce this? Conditional Access requiring acceptance of the configured Terms of Use Show Terms of Use in a SharePoint page but omit the Conditional Access grant requiring acceptance An Exchange disclaimer appended to outbound emails A named location for the legal team office Explanation Correct Answer A:A supported ToU grant can record acknowledgment before access. Incorrect Answers B:Publishing legal terms without linking their acknowledgment to access policy cannot make acceptance a sign-in prerequisite. C:Mail disclaimers are not app access grants. D:Location does not record contractual acknowledgment.
Question 521 A legal policy changed, and employees must accept the revised terms before opening an app. What needs assessment? Only a new Outlook email signature Updated Terms of Use document and reacceptance settings applied to the correct CA policy Replace the Terms of Use document in a file repository without evaluating the existing CA policy's reacceptance behavior Only the user's calendar subscription Explanation Correct Answer B:Version and acceptance conditions determine the prompt. Incorrect Answers A:Email signatures cannot enforce app sign-in agreements. C:The new version needs correct policy integration so users are required to accept it before accessing the regulated app. D:Calendars do not attest ToU consent.
Question 522 Report-only logs show a new policy would block many users, but their current sign-ins succeed. Why is that possible? Report-only mode forces all devices compliant Only Exchange licensing controls report-only decisions A report-only decision records projected enforcement without applying the new block Report-only mode is identical to disabling audit logs Explanation Correct Answer C:Simulation does not itself deny the session. Incorrect Answers A:Reporting cannot change device posture. B:CA policy matching is independent of mail licensing. D:Simulated outcomes are recorded, not hidden.
Question 523 A security team wants high-risk sessions to one finance app blocked, but not necessarily all apps. What should it plan? Enable tenant-wide sign-in risk blocking for every cloud application rather than limit the rule to the designated finance app An SSPR policy that disables password reset for everyone A universal block of the entire tenant's sign-ins Targeted Conditional Access risk condition and exact cloud app selection Explanation Correct Answer D:App scoping can focus risk enforcement. Incorrect Answers A:A global risk rule may be stronger but violates the stated application-specific access scope and creates unintended user impact. B:Password recovery is not app-specific risk block. C:Global blocking exceeds app-specific intent.
Question 524 A CA policy that targets a particular mobile OS behaves unexpectedly for a client with missing platform details. What should be considered? How unsupported or unknown device platform signals are evaluated against conditions A mail transport rule can assign the platform automatically Treat missing platform information as proof that the device satisfies the mobile OS rule Unknown always means an approved corporate Windows device Explanation Correct Answer A:Policy decisions depend on observed device properties. Incorrect Answers B:SMTP is not device identification. C:An unknown platform signal cannot be treated as a confirmed matching operating system without evaluating the policy's conditions and limitations. D:Unidentified platform is not evidence of trust.
Question 525 A firm wants to collect session activity for supported sanctioned SaaS applications, not simply permit or block sign-in. What integration can help? A pure MFA grant requirement without session integration Depend only on a successful cloud app sign-in record as proof that in-session actions were inspected by Defender for Cloud Apps Configure a sanctioned-app tag but do not route supported browser sessions through Conditional Access App Control Defender for Cloud Apps session monitoring through compatible Conditional Access app control Explanation Correct Answer D:Session signals are evaluated after authentication for supported apps. Incorrect Answers A:Authentication alone does not capture SaaS session actions. B:Sign-in success does not establish compatible CA App Control proxy/session monitoring for specific user actions. C:Approval tags describe governance status; they do not deliver inspection of actions inside the session.
Question 526 A compliant laptop's browser sign-in does not present expected device claims, even though a native app works. What should be checked? Trust a browser's remembered credentials and assume compliant-device claims are present without validating platform and registration support Only the user's SharePoint membership Force an antivirus scan on the laptop and infer that the browser now emits the expected device registration claims Browser support, device registration, and client path for emitting device claims Explanation Correct Answer D:Some flows need supported browser or broker integration. Incorrect Answers A:Authentication cookies do not establish that a browser can transmit valid device claims for compliant-device CA evaluation. B:Resource authorization does not manufacture device claims. C:Malware scanning does not repair browser/device identity integration used by Conditional Access.
Question 527 A policy requires compromised users to reset passwords, but staff can approve MFA prompts on unchanged passwords. What distinction matters? An MFA challenge alone may not satisfy a user-risk password remediation requirement Device compliance always dismisses leaked-credential detections Change the user's Exchange mailbox password while leaving the cloud account's user-risk remediation and token state unchanged Successful MFA always clears the user's compromised credential status Explanation Correct Answer A:User risk and session MFA are separate controls. Incorrect Answers B:Trusted devices do not clear compromise by themselves. C:An Exchange transport setting cannot meet a cloud user-risk password-change grant or invalidate affected sessions. D:MFA does not necessarily rotate a leaked password.
Question 528 A tenant uses an external authentication system for a sensitive app and plans a CA custom control. What prerequisite should be verified? The app can bypass all access policies when integrated All users must be converted to external guests Mail domain verification must be disabled first Current product support and applicable integration requirements for custom controls Explanation Correct Answer D:Not every third-party flow is supported by every CA grant type. Incorrect Answers A:Integration is not a security bypass. B:User conversion is unnecessary for external methods. C:Domain ownership is not CA custom control integration.
Question 529 A tenant relies on a legacy remembered-MFA setting while CA session requirements are introduced. What should it assess? Interactions among persistent sessions, sign-in frequency, and legacy remembrance Treat the old per-user remembered-MFA duration as authoritative even where newer Conditional Access session controls demand fresh auth Remembered MFA automatically exempts every app forever An Outlook junk mail rule governs reminder lifetime Explanation Correct Answer A:Overlapping controls can create unexpected prompting patterns. Incorrect Answers B:Legacy MFA remembrance and CA sign-in frequency may interact; policy evaluation should govern the current session. C:Modern policies can demand renewed assurance. D:Mail filters cannot persist authentication claims.
Question 530 An employee promoted to a privileged role is suddenly required to use a security key for admin portal access. What is a likely cause? Assume the newly elevated user is still evaluated only by the ordinary employee CA group and ignore role targeting Role-targeted Conditional Access now applies to the elevated user A signed employee handbook updates the device trust claim A new Teams chat was created during promotion Explanation Correct Answer B:The new role adds a higher-assurance requirement. Incorrect Answers A:Privileged role activation can bring new authentication-strength policies into scope even without a change in mailbox properties. C:HR documents are not authentication grants. D:Chats do not add CA role targets.
