Question 270 An information security team is planning Conditional Access policy governance across multiple business applications. An administrator enables a policy and suddenly external guests lose access. What should the identity administrator implement? Scope Conditional Access to external guest users and the relevant target resources Use sign-in evaluation and assignments to identify whether guest types were inadvertently included Configure the grant-control combination logic according to the intended all-controls requirement Review Conditional Access change events in directory audit logs Explanation Correct Answer B:User and guest scoping can have unintended breadth when external user subtypes are not reviewed. Incorrect Answers A:Scope Conditional Access to external guest users and the relevant target resources would support the different situation where partner guests should authenticate with MFA when opening shared enterprise applications: resource-tenant policy can apply requirements to external users even when they authenticate at home; however it does not resolve an administrator enables a policy and suddenly external guests lose access, which calls for Use sign-in evaluation and assignments to identify whether guest types were inadvertently included. C:When security wants one policy to require all listed controls rather than accept any one of several, Configure the grant-control combination logic according to the intended all-controls requirement is justified because boolean grant selection changes whether one option or every selected condition must be satisfied; here the issue is an administrator enables a policy and suddenly external guests lose access, and Use sign-in evaluation and assignments to identify whether guest types were inadvertently included addresses that distinction. D:Review Conditional Access change events in directory audit logs concerns the change board needs audit evidence explaining when a policy was updated, where configuration change logs identify actor and timing that current policy screens alone cannot prove; the current scenario instead requires an administrator enables a policy and suddenly external guests lose access, so Use sign-in evaluation and assignments to identify whether guest types were inadvertently included is a closer fit.
Question 271 An information security team is planning Conditional Access policy governance across multiple business applications. The change board needs audit evidence explaining when a policy was updated. Which change most directly satisfies the scenario? Use sign-in evaluation and assignments to identify whether guest types were inadvertently included Evaluate the combined policy requirements and all applicable grant controls Review Conditional Access change events in directory audit logs Check the application's CAE support and token or session refresh behavior Explanation Correct Answer C:Configuration change logs identify actor and timing that current policy screens alone cannot prove. Incorrect Answers A:User and guest scoping can have unintended breadth when external user subtypes are not reviewed, which makes Use sign-in evaluation and assignments to identify whether guest types were inadvertently included appropriate when an administrator enables a policy and suddenly external guests lose access; here the task is the change board needs audit evidence explaining when a policy was updated, requiring Review Conditional Access change events in directory audit logs. B:When two active CA policies impose distinct controls on the same user and application, Evaluate the combined policy requirements and all applicable grant controls is justified because multiple matching policies must be satisfied; one successful evaluation does not override another block; here the issue is the change board needs audit evidence explaining when a policy was updated, and Review Conditional Access change events in directory audit logs addresses that distinction. D:The distinct mechanism for Check the application's CAE support and token or session refresh behavior is that session enforcement timing depends on resource capabilities and already-issued tokens; this handles a user reports that an app retains access after a policy change rather than the change board needs audit evidence explaining when a policy was updated, so use Review Conditional Access change events in directory audit logs.
Question 272 A research lab applies Conditional Access to secure internal APIs that expose protected experimental data. An internal app needs a passwordless step-up when executing the export experiment action. Which option is most appropriate for this specific condition? Apply a device compliance grant for the affected enterprise application Use an authentication-strength policy instead of assuming any prior MFA is sufficient Scope Conditional Access to external guest users and the relevant target resources Integrate supported authentication context with the export API's claims challenge Explanation Correct Answer D:Contextual step-up focuses a stronger authentication requirement on the sensitive operation. Incorrect Answers A:When the security team wants to restrict application sign-in to compliant managed devices, Apply a device compliance grant for the affected enterprise application is justified because a compliance requirement evaluates device management signals rather than proving only human identity; here the issue is an internal app needs a passwordless step-up when executing the export experiment action, and Integrate supported authentication context with the export API's claims challenge addresses that distinction. B:Use an authentication-strength policy instead of assuming any prior MFA is sufficient concerns a user already passed MFA earlier but the app requires phishing-resistant authentication for exports, where phishing resistance is a property of the selected method, not just the existence of a second factor; the current scenario instead requires an internal app needs a passwordless step-up when executing the export experiment action, so Integrate supported authentication context with the export API's claims challenge is a closer fit. C:The distinct mechanism for Scope Conditional Access to external guest users and the relevant target resources is that resource-tenant policy can apply requirements to external users even when they authenticate at home; this handles partner guests should authenticate with MFA when opening shared enterprise applications rather than an internal app needs a passwordless step-up when executing the export experiment action, so use Integrate supported authentication context with the export API's claims challenge.
Question 273 A research lab applies Conditional Access to secure internal APIs that expose protected experimental data. A user already passed MFA earlier but the app requires phishing-resistant authentication for exports. What configuration should be selected? Use an authentication-strength policy instead of assuming any prior MFA is sufficient Pilot report-only Conditional Access targeting and inspect sign-in results Scope the CA policy to the teacher group and the application or authentication context Update to a supported client that can process the required authentication context Explanation Correct Answer A:Phishing resistance is a property of the selected method, not just the existence of a second factor. Incorrect Answers B:The distinct mechanism for Pilot report-only Conditional Access targeting and inspect sign-in results is that controlled testing can expose unexpected matching conditions before stronger enforcement; this handles the lab wants to test whether step-up will affect specific researchers without blocking their work rather than a user already passed MFA earlier but the app requires phishing-resistant authentication for exports, so use Use an authentication-strength policy instead of assuming any prior MFA is sufficient. C:Although Scope the CA policy to the teacher group and the application or authentication context fits only teachers should face the stronger content-editing authentication requirement (targeted assignments avoid imposing staff-level controls on every student sign-in), it is not the necessary control for a user already passed MFA earlier but the app requires phishing-resistant authentication for exports. Select Use an authentication-strength policy instead of assuming any prior MFA is sufficient. D:Update to a supported client that can process the required authentication context would support the different situation where an outdated mobile client ignores a claims challenge from the resource: a compatible client must respond to a claims challenge to acquire a new token with required claims; however it does not resolve a user already passed MFA earlier but the app requires phishing-resistant authentication for exports, which calls for Use an authentication-strength policy instead of assuming any prior MFA is sufficient.
Question 274 A research lab applies Conditional Access to secure internal APIs that expose protected experimental data. An outdated mobile client ignores a claims challenge from the resource. Which Microsoft Entra capability best satisfies the requirement? Pilot report-only Conditional Access targeting and inspect sign-in results Check which client modes and applications support the configured session restriction Update to a supported client that can process the required authentication context Check the app's authentication-context integration and the matching Conditional Access policy Explanation Correct Answer C:A compatible client must respond to a claims challenge to acquire a new token with required claims. Incorrect Answers A:The distinct mechanism for Pilot report-only Conditional Access targeting and inspect sign-in results is that controlled testing can expose unexpected matching conditions before stronger enforcement; this handles the lab wants to test whether step-up will affect specific researchers without blocking their work rather than an outdated mobile client ignores a claims challenge from the resource, so use Update to a supported client that can process the required authentication context. B:Although Check which client modes and applications support the configured session restriction fits a vendor reports that the download block works in browsers but not in its desktop client (browser-based enforcement does not automatically extend to every native client or protocol), it is not the necessary control for an outdated mobile client ignores a claims challenge from the resource. Select Update to a supported client that can process the required authentication context. D:A context label alone does not enforce a challenge unless application request and policy evaluation align, which makes Check the app's authentication-context integration and the matching Conditional Access policy appropriate when an application presents a claims challenge but users never see the required stronger method; here the task is an outdated mobile client ignores a claims challenge from the resource, requiring Update to a supported client that can process the required authentication context.
Question 275 A research lab applies Conditional Access to secure internal APIs that expose protected experimental data. The lab wants to test whether step-up will affect specific researchers without blocking their work. Which recommendation is most defensible? Apply a device compliance grant for the affected enterprise application Pilot report-only Conditional Access targeting and inspect sign-in results Integrate supported authentication context with the export API's claims challenge Use an authentication-strength policy instead of assuming any prior MFA is sufficient Explanation Correct Answer B:Controlled testing can expose unexpected matching conditions before stronger enforcement. Incorrect Answers A:Although Apply a device compliance grant for the affected enterprise application fits the security team wants to restrict application sign-in to compliant managed devices (a compliance requirement evaluates device management signals rather than proving only human identity), it is not the necessary control for the lab wants to test whether step-up will affect specific researchers without blocking their work. Select Pilot report-only Conditional Access targeting and inspect sign-in results. C:Contextual step-up focuses a stronger authentication requirement on the sensitive operation, which makes Integrate supported authentication context with the export API's claims challenge appropriate when an internal app needs a passwordless step-up when executing the export experiment action; here the task is the lab wants to test whether step-up will affect specific researchers without blocking their work, requiring Pilot report-only Conditional Access targeting and inspect sign-in results. D:When a user already passed MFA earlier but the app requires phishing-resistant authentication for exports, Use an authentication-strength policy instead of assuming any prior MFA is sufficient is justified because phishing resistance is a property of the selected method, not just the existence of a second factor; here the issue is the lab wants to test whether step-up will affect specific researchers without blocking their work, and Pilot report-only Conditional Access targeting and inspect sign-in results addresses that distinction.
Question 276 A government department uses sign-in risk, device state, and application sensitivity in Conditional Access. Sign-ins with a high measured risk should be blocked for a protected administrative app. What should the identity administrator implement? Capture risk detections and sign-in Conditional Access evidence for the affected user and event Run the policy in report-only mode with measured sign-in coverage Review the differing sign-in and user risk policy evaluations Add the appropriate risk condition and block grant with intended user scope Explanation Correct Answer D:Risk-sensitive Conditional Access can deny suspicious sessions rather than merely log them. Incorrect Answers A:Capture risk detections and sign-in Conditional Access evidence for the affected user and event would support the different situation where a blocked login needs a defensible incident record for review: investigation requires the evaluated signal and policy result rather than just the error screenshot; however it does not resolve sign-ins with a high measured risk should be blocked for a protected administrative app, which calls for Add the appropriate risk condition and block grant with intended user scope. B:Historical evaluation reduces rollout risk when access depends on many populations and devices, which makes Run the policy in report-only mode with measured sign-in coverage appropriate when administrators need to compare the expected impact of a policy before the school term starts; here the task is sign-ins with a high measured risk should be blocked for a protected administrative app, requiring Add the appropriate risk condition and block grant with intended user scope. C:When an administrator mistakes sign-in risk for persistent user risk, Review the differing sign-in and user risk policy evaluations is justified because sign-in risk evaluates an event, whereas user risk estimates the likelihood that an identity is compromised; here the issue is sign-ins with a high measured risk should be blocked for a protected administrative app, and Add the appropriate risk condition and block grant with intended user scope addresses that distinction.
Question 277 A government department uses sign-in risk, device state, and application sensitivity in Conditional Access. A medium sign-in risk should require MFA instead of permanently disabling the employee. Which change most directly satisfies the scenario? Capture risk detections and sign-in Conditional Access evidence for the affected user and event Configure a supported sign-in-risk policy that requires multifactor authentication Require a compliant device for the portal under a targeted Conditional Access policy Add the appropriate risk condition and block grant with intended user scope Explanation Correct Answer B:Risk-based MFA allows legitimate users to satisfy extra proof when policy permits. Incorrect Answers A:Investigation requires the evaluated signal and policy result rather than just the error screenshot, which makes Capture risk detections and sign-in Conditional Access evidence for the affected user and event appropriate when a blocked login needs a defensible incident record for review; here the task is a medium sign-in risk should require MFA instead of permanently disabling the employee, requiring Configure a supported sign-in-risk policy that requires multifactor authentication. C:Require a compliant device for the portal under a targeted Conditional Access policy concerns only devices meeting an approved compliance baseline should open the route-planning portal, where compliance signals can block unhealthy endpoints even when credentials are valid; the current scenario instead requires a medium sign-in risk should require MFA instead of permanently disabling the employee, so Configure a supported sign-in-risk policy that requires multifactor authentication is a closer fit. D:The distinct mechanism for Add the appropriate risk condition and block grant with intended user scope is that risk-sensitive Conditional Access can deny suspicious sessions rather than merely log them; this handles sign-ins with a high measured risk should be blocked for a protected administrative app rather than a medium sign-in risk should require MFA instead of permanently disabling the employee, so use Configure a supported sign-in-risk policy that requires multifactor authentication.
Question 278 A government department uses sign-in risk, device state, and application sensitivity in Conditional Access. An administrator mistakes sign-in risk for persistent user risk. What is the best next administrative action? Add the appropriate risk condition and block grant with intended user scope Configure a supported sign-in-risk policy that requires multifactor authentication Use sign-in evaluation and assignments to identify whether guest types were inadvertently included Review the differing sign-in and user risk policy evaluations Explanation Correct Answer D:Sign-in risk evaluates an event, whereas user risk estimates the likelihood that an identity is compromised. Incorrect Answers A:When sign-ins with a high measured risk should be blocked for a protected administrative app, Add the appropriate risk condition and block grant with intended user scope is justified because risk-sensitive Conditional Access can deny suspicious sessions rather than merely log them; here the issue is an administrator mistakes sign-in risk for persistent user risk, and Review the differing sign-in and user risk policy evaluations addresses that distinction. B:Configure a supported sign-in-risk policy that requires multifactor authentication concerns a medium sign-in risk should require MFA instead of permanently disabling the employee, where risk-based MFA allows legitimate users to satisfy extra proof when policy permits; the current scenario instead requires an administrator mistakes sign-in risk for persistent user risk, so Review the differing sign-in and user risk policy evaluations is a closer fit. C:The distinct mechanism for Use sign-in evaluation and assignments to identify whether guest types were inadvertently included is that user and guest scoping can have unintended breadth when external user subtypes are not reviewed; this handles an administrator enables a policy and suddenly external guests lose access rather than an administrator mistakes sign-in risk for persistent user risk, so use Review the differing sign-in and user risk policy evaluations.
Question 279 A government department uses sign-in risk, device state, and application sensitivity in Conditional Access. A blocked login needs a defensible incident record for review. Which option is most appropriate for this specific condition? Review the differing sign-in and user risk policy evaluations Configure a supported sign-in-risk policy that requires multifactor authentication Capture risk detections and sign-in Conditional Access evidence for the affected user and event Set the proposed Conditional Access policy to report-only and review resulting sign-in reports Explanation Correct Answer C:Investigation requires the evaluated signal and policy result rather than just the error screenshot. Incorrect Answers A:Review the differing sign-in and user risk policy evaluations concerns an administrator mistakes sign-in risk for persistent user risk, where sign-in risk evaluates an event, whereas user risk estimates the likelihood that an identity is compromised; the current scenario instead requires a blocked login needs a defensible incident record for review, so Capture risk detections and sign-in Conditional Access evidence for the affected user and event is a closer fit. B:The distinct mechanism for Configure a supported sign-in-risk policy that requires multifactor authentication is that risk-based MFA allows legitimate users to satisfy extra proof when policy permits; this handles a medium sign-in risk should require MFA instead of permanently disabling the employee rather than a blocked login needs a defensible incident record for review, so use Capture risk detections and sign-in Conditional Access evidence for the affected user and event. D:Set the proposed Conditional Access policy to report-only and review resulting sign-in reports would support the different situation where the security team wants to estimate who would be blocked before activating the policy: report-only evaluation shows prospective outcomes without enforcing the new controls; however it does not resolve a blocked login needs a defensible incident record for review, which calls for Capture risk detections and sign-in Conditional Access evidence for the affected user and event.
Question 280 A hospital needs to restrict sensitive clinical data downloads from untrusted browser sessions. The organization wants a restricted web-only experience for users on unmanaged endpoints. Which Microsoft Entra capability best satisfies the requirement? Create explicit emergency-access exclusions and perform report-only validation first Create a policy from an appropriate Microsoft template and review its assignments before enabling Verify that Conditional Access app control and the target application support the selected session controls Configure supported app-enforced restrictions or Conditional Access app control for the resource Explanation Correct Answer D:Restricted sessions can allow controlled browser use without treating an untrusted endpoint as compliant. Incorrect Answers A:The distinct mechanism for Create explicit emergency-access exclusions and perform report-only validation first is that unreviewed broad CA assignments can lock out administrators during a configuration error; this handles an engineer proposes placing Global Administrator into all regular-user policies without testing exclusions rather than the organization wants a restricted web-only experience for users on unmanaged endpoints, so use Configure supported app-enforced restrictions or Conditional Access app control for the resource. B:Although Create a policy from an appropriate Microsoft template and review its assignments before enabling fits the team wants a supported starting point for common recommended CA protections (templates accelerate common patterns but still require deliberate tenant-specific scope and exclusions), it is not the necessary control for the organization wants a restricted web-only experience for users on unmanaged endpoints. Select Configure supported app-enforced restrictions or Conditional Access app control for the resource. C:Verify that Conditional Access app control and the target application support the selected session controls would support the different situation where a browser request is not redirected into the expected proxy-controlled session: session proxy enforcement requires supported app integration and correct policy routing; however it does not resolve the organization wants a restricted web-only experience for users on unmanaged endpoints, which calls for Configure supported app-enforced restrictions or Conditional Access app control for the resource.
