Question 530 An employee promoted to a privileged role is suddenly required to use a security key for admin portal access. What is a likely cause? Assume the newly elevated user is still evaluated only by the ordinary employee CA group and ignore role targeting Role-targeted Conditional Access now applies to the elevated user A signed employee handbook updates the device trust claim A new Teams chat was created during promotion Explanation Correct Answer B:The new role adds a higher-assurance requirement. Incorrect Answers A:Privileged role activation can bring new authentication-strength policies into scope even without a change in mailbox properties. C:HR documents are not authentication grants. D:Chats do not add CA role targets.
Question 531 A partner's home tenant grants a token, but the resource tenant denies access to its app. Which principle explains this? Resource tenant access policies still evaluate the external principal and application The home tenant's policies always override all resource restrictions A valid password from any tenant permits every application Depend on successful external home-tenant login as sufficient access even though the resource tenant policy denies the session Explanation Correct Answer A:Home authentication does not override resource authorization. Incorrect Answers B:External application owners retain access controls. C:Authentication is not universal authorization. D:Home identity validation does not override the resource tenant's authorization and Conditional Access requirements.
Question 532 A security auditor needs to confirm whether a protected sign-in used an accepted phishing-resistant method. What should be inspected? Only the company-wide Secure Score total Authentication details, method and CA strength requirement evaluation for the sign-in Only the user's current Microsoft 365 Groups Check that the user has registered a security key but not whether this specific sign-in used it or satisfied CA strength Explanation Correct Answer B:The log supports checking required versus satisfied assurance. Incorrect Answers A:Posture score lacks per-session authentication detail. C:Group inventory does not show method used at sign-in. D:Method registration alone does not prove that the protected session actually used an approved phishing-resistant method.
Question 533 A user satisfies MFA and device compliance but an app still denies access following a new legal acknowledgment policy. What should be checked? Check the user's sign-in MFA result but ignore the applicable legal Terms of Use requirement for the cloud application Reassign the user's application license instead of examining whether they accepted the latest legal Terms of Use version The Terms of Use grant requirement and whether the user accepted the current version The count of sensitivity labels applied to files Explanation Correct Answer C:Additional CA controls can block access after MFA. Incorrect Answers A:MFA and device grants can pass while a separate Terms of Use acceptance requirement remains unmet. B:Product entitlement and legal acknowledgment are distinct access grants; the newer version must be accepted when required. D:Classification is not a sign-in agreement.
Question 534 A user must access Microsoft 365 only from approved corporate networks, regardless of device compliance. What condition could enforce that? A phishing-resistant factor alone A Conditional Access named-location restriction with carefully scoped users and apps A compliant-device grant alone A Purview content label alone Explanation Correct Answer B:Observed network location can be an access condition. Incorrect Answers A:Strong authentication does not prove corporate network. C:Compliance does not prove location. D:Classification cannot enforce source-network limits.
Question 535 Management assumes an office IP exemption makes an unmanaged laptop safe for finance data. What distinction must be documented? A corporate Wi-Fi SSID automatically proves Intune compliance Exchange address lists can confirm device trust Network trust and device compliance are separate signals requiring separate controls All laptops on office Wi-Fi are hybrid joined Explanation Correct Answer C:An office IP does not attest endpoint posture. Incorrect Answers A:Network name is not an Intune result. B:Address books do not report endpoint compliance. D:Physical location does not grant join status.
Question 536 A security team proposes critical tenant-wide access policies but only one admin holds change permission. What governance improvement matters? Create multiple mail aliases for the lone admin Turn off all policy alerts during change windows Assign protected authorized recovery operators and test emergency access procedures Give every employee Global Administrator as a fallback Explanation Correct Answer C:Single-person recovery is a high availability risk. Incorrect Answers A:Aliases do not create independent recovery operators. B:Suppressing alerts hides incidents. D:Excess permissions create severe compromise risk.
Question 537 A tenant-wide sign-in issue began immediately after a policy edit, but nobody remembers who changed it. What evidence should the team inspect? Entra audit logs for Conditional Access policy changes and actor identity Only endpoint antivirus alerts Only SharePoint document version history Only Exchange message trace for end users Explanation Correct Answer A:Audit trails tie policy edits to administrators and timestamps. Incorrect Answers B:Device alerts may not show policy modifications. C:Document versioning is not directory policy audit. D:Mail traffic does not record CA policy edits.
Question 538 A B2B user enters with a personal Microsoft account rather than the expected corporate identity, and access is denied. What should admins inspect? Only the organization's default Microsoft 365 Apps channel The redeemed guest identity and configured identity provider or cross-tenant access rules Only the resource's Outlook anti-spam settings Modify the guest's SharePoint display name without examining the redeemed identity Explanation Correct Answer B:Guest source identity determines available claims and trust. Incorrect Answers A:Software servicing does not choose identity providers. C:Mail spam policy does not change B2B identity origin. D:A display name cannot repair a mismatch between the guest account's identity provider and applicable cross-tenant access settings.
Question 539 A corporate egress IP range is mistakenly present in both trusted and blocked named-location groups. What should the team review? The actual CA policy conditions and location match rules for that public IP Only the device hardware serial number Rename one named-location group and assume the CA engine now evaluates a different IP address for the same connection Only the tenant's service health report Explanation Correct Answer A:Conflicting location definitions can produce unexpected policy results. Incorrect Answers B:Serial numbers do not resolve overlapping public IP lists. C:A display-name edit does not change how the observed public IP matches the overlapping location rules and policy conditions. D:Service incidents do not correct IP classification.
Question 540 A legacy app is replaced by a new enterprise application, and the existing CA policy no longer triggers. What must be verified? That the previous application's display name is reused That the new application ID is included in the intended CA app scope That the user's MFA method was deleted during migration Retain the old enterprise application ID in CA targeting and assume that the replacement application inherits the same policy scope Explanation Correct Answer B:A successor service principal may require explicit targeting. Incorrect Answers A:Matching names do not ensure identical identity objects. C:Deleting methods cannot retarget policies. D:Different app registrations have distinct identifiers; the replacement must be included in the intended cloud-app selection.
