Question 290 A telecom operator is standardizing Conditional Access templates for hundreds of department apps. Security needs to apply a unique authentication requirement to one sensitive application. Which change most directly satisfies the scenario? Edit or create a dedicated scoped policy rather than modifying a universal baseline indiscriminately Apply the session restriction separately from the user's authentication requirement Create a policy from an appropriate Microsoft template and review its assignments before enabling Validate all include/exclude groups, apps, conditions and emergency accounts Explanation Correct Answer A:A targeted policy avoids imposing special controls on unrelated workloads. Incorrect Answers B:Apply the session restriction separately from the user's authentication requirement concerns an operator confuses session controls with MFA grant controls, where grant controls evaluate whether access is permitted; session controls constrain activity after access; the current scenario instead requires security needs to apply a unique authentication requirement to one sensitive application, so Edit or create a dedicated scoped policy rather than modifying a universal baseline indiscriminately is a closer fit. C:The distinct mechanism for Create a policy from an appropriate Microsoft template and review its assignments before enabling is that templates accelerate common patterns but still require deliberate tenant-specific scope and exclusions; this handles the team wants a supported starting point for common recommended CA protections rather than security needs to apply a unique authentication requirement to one sensitive application, so use Edit or create a dedicated scoped policy rather than modifying a universal baseline indiscriminately. D:Although Validate all include/exclude groups, apps, conditions and emergency accounts fits an engineer treats a prebuilt policy template as automatically safe for all accounts (a generated template can produce a broad disruption if its default scope is not reviewed), it is not the necessary control for security needs to apply a unique authentication requirement to one sensitive application. Select Edit or create a dedicated scoped policy rather than modifying a universal baseline indiscriminately.
Question 291 A telecom operator is standardizing Conditional Access templates for hundreds of department apps. A business owner needs the reason for a failure after a template was enabled. What is the best next administrative action? Edit or create a dedicated scoped policy rather than modifying a universal baseline indiscriminately Open the sign-in's Conditional Access tab and inspect each policy outcome Validate all include/exclude groups, apps, conditions and emergency accounts Correlate the affected sign-in's CA policy result and the changed policy audit entry Explanation Correct Answer D:Effective diagnosis requires both runtime policy evaluation and configuration change history. Incorrect Answers A:Edit or create a dedicated scoped policy rather than modifying a universal baseline indiscriminately concerns security needs to apply a unique authentication requirement to one sensitive application, where a targeted policy avoids imposing special controls on unrelated workloads; the current scenario instead requires a business owner needs the reason for a failure after a template was enabled, so Correlate the affected sign-in's CA policy result and the changed policy audit entry is a closer fit. B:The distinct mechanism for Open the sign-in's Conditional Access tab and inspect each policy outcome is that multiple policies can be evaluated together, so one matched grant does not explain the entire result; this handles the team is unsure which of several enabled policies caused a failed sign-in rather than a business owner needs the reason for a failure after a template was enabled, so use Correlate the affected sign-in's CA policy result and the changed policy audit entry. C:Although Validate all include/exclude groups, apps, conditions and emergency accounts fits an engineer treats a prebuilt policy template as automatically safe for all accounts (a generated template can produce a broad disruption if its default scope is not reviewed), it is not the necessary control for a business owner needs the reason for a failure after a template was enabled. Select Correlate the affected sign-in's CA policy result and the changed policy audit entry.
Question 292 A multinational financial institution uses Microsoft Entra ID Protection to identify suspicious employee sign-ins. A user is flagged for a likely compromised password across multiple recent sessions. What configuration should be selected? Disable the user or block access and revoke active sessions under the incident procedure Apply sign-in-risk-based Conditional Access controls to that event Apply a supported user-risk policy requiring secure remediation or blocking as configured Follow the documented risk investigation and confirmation or dismissal process Explanation Correct Answer C:User risk tracks the likelihood that an identity is compromised across observations rather than one isolated attempt. Incorrect Answers A:The distinct mechanism for Disable the user or block access and revoke active sessions under the incident procedure is that containment controls immediate access while separate password and method recovery repairs the identity; this handles a suspected account compromise needs containment before password recovery is approved rather than a user is flagged for a likely compromised password across multiple recent sessions, so use Apply a supported user-risk policy requiring secure remediation or blocking as configured. B:Although Apply sign-in-risk-based Conditional Access controls to that event fits a single sign-in from an unfamiliar source carries elevated risk while the user account otherwise appears healthy (sign-in risk focuses on a specific authentication attempt and supports step-up or blocking by policy), it is not the necessary control for a user is flagged for a likely compromised password across multiple recent sessions. Select Apply a supported user-risk policy requiring secure remediation or blocking as configured. D:Risk dismissal should reflect validated evidence and must not substitute for reviewing suspicious activity, which makes Follow the documented risk investigation and confirmation or dismissal process appropriate when the help desk wants to dismiss a risk indicator merely to clear a dashboard without investigation; here the task is a user is flagged for a likely compromised password across multiple recent sessions, requiring Apply a supported user-risk policy requiring secure remediation or blocking as configured.
Question 293 A multinational financial institution uses Microsoft Entra ID Protection to identify suspicious employee sign-ins. A single sign-in from an unfamiliar source carries elevated risk while the user account otherwise appears healthy. Which Microsoft Entra capability best satisfies the requirement? Inspect the user and sign-in risk detection details in Identity Protection Configure appropriate high-sign-in-risk blocking and include affected clinical apps Apply a supported user-risk policy requiring secure remediation or blocking as configured Apply sign-in-risk-based Conditional Access controls to that event Explanation Correct Answer D:Sign-in risk focuses on a specific authentication attempt and supports step-up or blocking by policy. Incorrect Answers A:Although Inspect the user and sign-in risk detection details in Identity Protection fits security needs the exact detections that caused the current risk assessment (detection evidence provides incident context that the overall risk level alone does not show), it is not the necessary control for a single sign-in from an unfamiliar source carries elevated risk while the user account otherwise appears healthy. Select Apply sign-in-risk-based Conditional Access controls to that event. B:Configure appropriate high-sign-in-risk blocking and include affected clinical apps would support the different situation where an unfamiliar-credential sign-in is assessed high risk and should never complete normally: high-risk event blocking limits immediate session use while investigation proceeds; however it does not resolve a single sign-in from an unfamiliar source carries elevated risk while the user account otherwise appears healthy, which calls for Apply sign-in-risk-based Conditional Access controls to that event. C:User risk tracks the likelihood that an identity is compromised across observations rather than one isolated attempt, which makes Apply a supported user-risk policy requiring secure remediation or blocking as configured appropriate when a user is flagged for a likely compromised password across multiple recent sessions; here the task is a single sign-in from an unfamiliar source carries elevated risk while the user account otherwise appears healthy, requiring Apply sign-in-risk-based Conditional Access controls to that event.
Question 294 A multinational financial institution uses Microsoft Entra ID Protection to identify suspicious employee sign-ins. Security needs the exact detections that caused the current risk assessment. Which recommendation is most defensible? Follow the documented risk investigation and confirmation or dismissal process Apply sign-in-risk-based Conditional Access controls to that event Review risk detections, sign-in evidence and potential credential compromise before remediation Inspect the user and sign-in risk detection details in Identity Protection Explanation Correct Answer D:Detection evidence provides incident context that the overall risk level alone does not show. Incorrect Answers A:Follow the documented risk investigation and confirmation or dismissal process would support the different situation where the help desk wants to dismiss a risk indicator merely to clear a dashboard without investigation: risk dismissal should reflect validated evidence and must not substitute for reviewing suspicious activity; however it does not resolve security needs the exact detections that caused the current risk assessment, which calls for Inspect the user and sign-in risk detection details in Identity Protection. B:Sign-in risk focuses on a specific authentication attempt and supports step-up or blocking by policy, which makes Apply sign-in-risk-based Conditional Access controls to that event appropriate when a single sign-in from an unfamiliar source carries elevated risk while the user account otherwise appears healthy; here the task is security needs the exact detections that caused the current risk assessment, requiring Inspect the user and sign-in risk detection details in Identity Protection. C:When security sees impossible-travel or atypical sign-in indicators on an executive identity, Review risk detections, sign-in evidence and potential credential compromise before remediation is justified because anomaly indicators warrant investigation because legitimate travel or network routing can resemble suspicious activity; here the issue is security needs the exact detections that caused the current risk assessment, and Inspect the user and sign-in risk detection details in Identity Protection addresses that distinction.
Question 295 A multinational financial institution uses Microsoft Entra ID Protection to identify suspicious employee sign-ins. The help desk wants to dismiss a risk indicator merely to clear a dashboard without investigation. Which configuration best addresses the stated requirement? Apply a supported user-risk policy requiring secure remediation or blocking as configured Inspect the user and sign-in risk detection details in Identity Protection Pilot supported risk-based policies with careful scope and sign-in analysis Follow the documented risk investigation and confirmation or dismissal process Explanation Correct Answer D:Risk dismissal should reflect validated evidence and must not substitute for reviewing suspicious activity. Incorrect Answers A:User risk tracks the likelihood that an identity is compromised across observations rather than one isolated attempt, which makes Apply a supported user-risk policy requiring secure remediation or blocking as configured appropriate when a user is flagged for a likely compromised password across multiple recent sessions; here the task is the help desk wants to dismiss a risk indicator merely to clear a dashboard without investigation, requiring Follow the documented risk investigation and confirmation or dismissal process. B:When security needs the exact detections that caused the current risk assessment, Inspect the user and sign-in risk detection details in Identity Protection is justified because detection evidence provides incident context that the overall risk level alone does not show; here the issue is the help desk wants to dismiss a risk indicator merely to clear a dashboard without investigation, and Follow the documented risk investigation and confirmation or dismissal process addresses that distinction. C:Pilot supported risk-based policies with careful scope and sign-in analysis concerns the team wants to assess projected risk-policy impact without locking out the dispatch workforce, where a controlled test finds unexpected matching users before automatic blocking is broadly enforced; the current scenario instead requires the help desk wants to dismiss a risk indicator merely to clear a dashboard without investigation, so Follow the documented risk investigation and confirmation or dismissal process is a closer fit.
Question 296 A hospital must protect clinician identities from password compromise during seasonal contractor onboarding. An unfamiliar-credential sign-in is assessed high risk and should never complete normally. Which change most directly satisfies the scenario? Apply sign-in-risk-based Conditional Access controls to that event Review risk policy threshold and evaluated sign-in risk instead of disabling protections globally Configure appropriate high-sign-in-risk blocking and include affected clinical apps Enable the applicable user-risk remediation requirement and SSPR prerequisites Explanation Correct Answer C:High-risk event blocking limits immediate session use while investigation proceeds. Incorrect Answers A:When a single sign-in from an unfamiliar source carries elevated risk while the user account otherwise appears healthy, Apply sign-in-risk-based Conditional Access controls to that event is justified because sign-in risk focuses on a specific authentication attempt and supports step-up or blocking by policy; here the issue is an unfamiliar-credential sign-in is assessed high risk and should never complete normally, and Configure appropriate high-sign-in-risk blocking and include affected clinical apps addresses that distinction. B:Review risk policy threshold and evaluated sign-in risk instead of disabling protections globally concerns clinicians complain that a low-risk login should not trigger an extra challenge, where risk sensitivity should match the organization's documented tolerance, not arbitrary help-desk pressure; the current scenario instead requires an unfamiliar-credential sign-in is assessed high risk and should never complete normally, so Configure appropriate high-sign-in-risk blocking and include affected clinical apps is a closer fit. D:Although Enable the applicable user-risk remediation requirement and SSPR prerequisites fits a risky user must prove control by performing an allowed secure password reset (user-risk remediation can restore access through secure password change when policy and authentication support it), it is not the necessary control for an unfamiliar-credential sign-in is assessed high risk and should never complete normally. Select Configure appropriate high-sign-in-risk blocking and include affected clinical apps.
Question 297 A hospital must protect clinician identities from password compromise during seasonal contractor onboarding. A risky user must prove control by performing an allowed secure password reset. What is the best next administrative action? Review risk policy threshold and evaluated sign-in risk instead of disabling protections globally Review Identity Protection investigation and remediation activity history Enable the applicable user-risk remediation requirement and SSPR prerequisites Review risk remediation state and revoke affected sessions when required Explanation Correct Answer C:User-risk remediation can restore access through secure password change when policy and authentication support it. Incorrect Answers A:Review risk policy threshold and evaluated sign-in risk instead of disabling protections globally concerns clinicians complain that a low-risk login should not trigger an extra challenge, where risk sensitivity should match the organization's documented tolerance, not arbitrary help-desk pressure; the current scenario instead requires a risky user must prove control by performing an allowed secure password reset, so Enable the applicable user-risk remediation requirement and SSPR prerequisites is a closer fit. B:The distinct mechanism for Review Identity Protection investigation and remediation activity history is that risk treatment evidence documents which accounts changed status or satisfied configured controls; this handles the security team wants to see which suspicious users received automatic remediations rather than a risky user must prove control by performing an allowed secure password reset, so use Enable the applicable user-risk remediation requirement and SSPR prerequisites. D:Review risk remediation state and revoke affected sessions when required would support the different situation where a high-risk account completed a password reset but still shows unresolved risky session activity: credential recovery and revocation of already-issued tokens solve different parts of compromise containment; however it does not resolve a risky user must prove control by performing an allowed secure password reset, which calls for Enable the applicable user-risk remediation requirement and SSPR prerequisites.
Question 298 A hospital must protect clinician identities from password compromise during seasonal contractor onboarding. Clinicians complain that a low-risk login should not trigger an extra challenge. Which option is most appropriate for this specific condition? Configure appropriate high-sign-in-risk blocking and include affected clinical apps Examine the sign-in risk and authentication details in the event record Review risk policy threshold and evaluated sign-in risk instead of disabling protections globally Review Identity Protection investigation and remediation activity history Explanation Correct Answer C:Risk sensitivity should match the organization's documented tolerance, not arbitrary help-desk pressure. Incorrect Answers A:The distinct mechanism for Configure appropriate high-sign-in-risk blocking and include affected clinical apps is that high-risk event blocking limits immediate session use while investigation proceeds; this handles an unfamiliar-credential sign-in is assessed high risk and should never complete normally rather than clinicians complain that a low-risk login should not trigger an extra challenge, so use Review risk policy threshold and evaluated sign-in risk instead of disabling protections globally. B:Although Examine the sign-in risk and authentication details in the event record fits an administrator wants to know whether a risky sign-in was remediated by a challenge (an overall successful login may still require reviewing which step-up requirement was actually met), it is not the necessary control for clinicians complain that a low-risk login should not trigger an extra challenge. Select Review risk policy threshold and evaluated sign-in risk instead of disabling protections globally. D:Risk treatment evidence documents which accounts changed status or satisfied configured controls, which makes Review Identity Protection investigation and remediation activity history appropriate when the security team wants to see which suspicious users received automatic remediations; here the task is clinicians complain that a low-risk login should not trigger an extra challenge, requiring Review risk policy threshold and evaluated sign-in risk instead of disabling protections globally.
Question 299 A hospital must protect clinician identities from password compromise during seasonal contractor onboarding. The security team wants to see which suspicious users received automatic remediations. What configuration should be selected? Correlate workload sign-in evidence with the service principal and application IDs Enable the applicable user-risk remediation requirement and SSPR prerequisites Configure appropriate high-sign-in-risk blocking and include affected clinical apps Review Identity Protection investigation and remediation activity history Explanation Correct Answer D:Risk treatment evidence documents which accounts changed status or satisfied configured controls. Incorrect Answers A:Although Correlate workload sign-in evidence with the service principal and application IDs fits the team wants to prove which app identity produced suspicious token requests (application display names are not unique audit identities; principal IDs provide reliable correlation), it is not the necessary control for the security team wants to see which suspicious users received automatic remediations. Select Review Identity Protection investigation and remediation activity history. B:Enable the applicable user-risk remediation requirement and SSPR prerequisites would support the different situation where a risky user must prove control by performing an allowed secure password reset: user-risk remediation can restore access through secure password change when policy and authentication support it; however it does not resolve the security team wants to see which suspicious users received automatic remediations, which calls for Review Identity Protection investigation and remediation activity history. C:High-risk event blocking limits immediate session use while investigation proceeds, which makes Configure appropriate high-sign-in-risk blocking and include affected clinical apps appropriate when an unfamiliar-credential sign-in is assessed high risk and should never complete normally; here the task is the security team wants to see which suspicious users received automatic remediations, requiring Review Identity Protection investigation and remediation activity history.
Question 300 A software company is investigating suspicious application workload identities that authenticate without human MFA. A service principal shows unusual sign-in activity and is assessed risky. Which recommendation is most defensible? Query and correlate the appropriate user and workload risk views separately Filter Entra risk and sign-in reports by guest principal and target application Rotate or revoke the compromised application credential and validate replacement deployment Investigate risky workload identity detections and restrict the affected principal as appropriate Explanation Correct Answer D:Workload identities require their own detection and remediation because noninteractive apps cannot satisfy normal user MFA. Incorrect Answers A:Query and correlate the appropriate user and workload risk views separately would support the different situation where security wants a risk report spanning human users and workload principals: risk signals are recorded for different principal types and should not be conflated; however it does not resolve a service principal shows unusual sign-in activity and is assessed risky, which calls for Investigate risky workload identity detections and restrict the affected principal as appropriate. B:Scoped incident analysis distinguishes research guest activity from ordinary internal access, which makes Filter Entra risk and sign-in reports by guest principal and target application appropriate when security requires reports showing risky external sign-ins to one protected research application; here the task is a service principal shows unusual sign-in activity and is assessed risky, requiring Investigate risky workload identity detections and restrict the affected principal as appropriate. C:When a sensitive application uses an old client secret after suspected leakage, Rotate or revoke the compromised application credential and validate replacement deployment is justified because credential remediation limits reuse of a leaked secret while application authorization remains separately controlled; here the issue is a service principal shows unusual sign-in activity and is assessed risky, and Investigate risky workload identity detections and restrict the affected principal as appropriate addresses that distinction.
