Question 450 A manufacturer operates an unattended service that needs Graph application permissions for a controlled job. Auditors need proof of who approved the application's elevated Graph consent. Which change most directly satisfies the scenario? Reduce API permissions and scope operations using the supported granular controls Remove the applicable enterprise application consent or app assignment in the customer tenant Request the supported Graph application permissions with an authorized admin consent process Review admin consent grant records and app-related directory audit activity Explanation Correct Answer D:Permission grants should be traceable to an authorized consenting administrator. Incorrect Answers A:Reduce API permissions and scope operations using the supported granular controls would support the different situation where the service principal has Directory.ReadWrite.All but only needs to inspect a small identity subset: excessively broad application grants create unnecessary tenant-wide identity exposure; however it does not resolve auditors need proof of who approved the application's elevated Graph consent, which calls for Review admin consent grant records and app-related directory audit activity. B:Tenant-local service principal permissions can be withdrawn without editing the publisher's app registration, which makes Remove the applicable enterprise application consent or app assignment in the customer tenant appropriate when the customer wants to revoke the vendor application's tenant-local permission grants; here the task is auditors need proof of who approved the application's elevated Graph consent, requiring Review admin consent grant records and app-related directory audit activity. C:When the job must read approved directory objects without an interactive employee present, Request the supported Graph application permissions with an authorized admin consent process is justified because application permissions operate as the service principal and do not depend on a signed-in user; here the issue is auditors need proof of who approved the application's elevated Graph consent, and Review admin consent grant records and app-related directory audit activity addresses that distinction.
Question 451 An insurance company is rotating confidential app credentials after an automated leak detector flags a client secret. A client secret has appeared in a public repository. Which option is most appropriate for this specific condition? Revoke the exposed secret and deploy a newly secured credential or federation method Use a federated identity credential bound to the external issuer and subject Check that the new certificate public key is registered and the correct key signs assertions Configure a supported application certificate credential with rotation controls Explanation Correct Answer A:A leaked secret should be invalidated immediately rather than only deleted from source history. Incorrect Answers B:When the app runs in a supported workload federation platform, Use a federated identity credential bound to the external issuer and subject is justified because federation can eliminate stored client credentials while still authenticating the approved external workload; here the issue is a client secret has appeared in a public repository, and Revoke the exposed secret and deploy a newly secured credential or federation method addresses that distinction. C:Check that the new certificate public key is registered and the correct key signs assertions concerns a certificate assertion receives an invalid-client error after a renewal, where certificate credential validation requires the registration and private key to correspond; the current scenario instead requires a client secret has appeared in a public repository, so Revoke the exposed secret and deploy a newly secured credential or federation method is a closer fit. D:The distinct mechanism for Configure a supported application certificate credential with rotation controls is that a certificate assertion can replace a plain shared secret when securely managed; this handles the service can authenticate using certificate-based client assertions rather than a client secret has appeared in a public repository, so use Revoke the exposed secret and deploy a newly secured credential or federation method.
Question 452 An insurance company is rotating confidential app credentials after an automated leak detector flags a client secret. The service can authenticate using certificate-based client assertions. What configuration should be selected? Check that the new certificate public key is registered and the correct key signs assertions Plan a staged credential rollover and validate the new credential before retiring the old one Configure a supported application certificate credential with rotation controls Use a federated identity credential bound to the external issuer and subject Explanation Correct Answer C:A certificate assertion can replace a plain shared secret when securely managed. Incorrect Answers A:When a certificate assertion receives an invalid-client error after a renewal, Check that the new certificate public key is registered and the correct key signs assertions is justified because certificate credential validation requires the registration and private key to correspond; here the issue is the service can authenticate using certificate-based client assertions, and Configure a supported application certificate credential with rotation controls addresses that distinction. B:Plan a staged credential rollover and validate the new credential before retiring the old one concerns a rotated certificate fails after the old key was removed too early, where overlapping valid trust during a controlled rotation prevents unnecessary application downtime; the current scenario instead requires the service can authenticate using certificate-based client assertions, so Configure a supported application certificate credential with rotation controls is a closer fit. D:Although Use a federated identity credential bound to the external issuer and subject fits the app runs in a supported workload federation platform (federation can eliminate stored client credentials while still authenticating the approved external workload), it is not the necessary control for the service can authenticate using certificate-based client assertions. Select Configure a supported application certificate credential with rotation controls.
Question 453 An insurance company is rotating confidential app credentials after an automated leak detector flags a client secret. The app runs in a supported workload federation platform. Which Microsoft Entra capability best satisfies the requirement? Revoke the exposed secret and deploy a newly secured credential or federation method Use a federated identity credential bound to the external issuer and subject Request the supported Graph application permissions with an authorized admin consent process Plan a staged credential rollover and validate the new credential before retiring the old one Explanation Correct Answer B:Federation can eliminate stored client credentials while still authenticating the approved external workload. Incorrect Answers A:Revoke the exposed secret and deploy a newly secured credential or federation method concerns a client secret has appeared in a public repository, where a leaked secret should be invalidated immediately rather than only deleted from source history; the current scenario instead requires the app runs in a supported workload federation platform, so Use a federated identity credential bound to the external issuer and subject is a closer fit. C:Although Request the supported Graph application permissions with an authorized admin consent process fits the job must read approved directory objects without an interactive employee present (application permissions operate as the service principal and do not depend on a signed-in user), it is not the necessary control for the app runs in a supported workload federation platform. Select Use a federated identity credential bound to the external issuer and subject. D:Plan a staged credential rollover and validate the new credential before retiring the old one would support the different situation where a rotated certificate fails after the old key was removed too early: overlapping valid trust during a controlled rotation prevents unnecessary application downtime; however it does not resolve the app runs in a supported workload federation platform, which calls for Use a federated identity credential bound to the external issuer and subject.
Question 454 An insurance company is rotating confidential app credentials after an automated leak detector flags a client secret. A rotated certificate fails after the old key was removed too early. Which recommendation is most defensible? Plan a staged credential rollover and validate the new credential before retiring the old one Configure a supported application certificate credential with rotation controls Revoke the exposed secret and deploy a newly secured credential or federation method Check that the new certificate public key is registered and the correct key signs assertions Explanation Correct Answer A:Overlapping valid trust during a controlled rotation prevents unnecessary application downtime. Incorrect Answers B:Although Configure a supported application certificate credential with rotation controls fits the service can authenticate using certificate-based client assertions (a certificate assertion can replace a plain shared secret when securely managed), it is not the necessary control for a rotated certificate fails after the old key was removed too early. Select Plan a staged credential rollover and validate the new credential before retiring the old one. C:Revoke the exposed secret and deploy a newly secured credential or federation method would support the different situation where a client secret has appeared in a public repository: a leaked secret should be invalidated immediately rather than only deleted from source history; however it does not resolve a rotated certificate fails after the old key was removed too early, which calls for Plan a staged credential rollover and validate the new credential before retiring the old one. D:Certificate credential validation requires the registration and private key to correspond, which makes Check that the new certificate public key is registered and the correct key signs assertions appropriate when a certificate assertion receives an invalid-client error after a renewal; here the task is a rotated certificate fails after the old key was removed too early, requiring Plan a staged credential rollover and validate the new credential before retiring the old one.
Question 455 A security software vendor is creating a protected API with separate reader, writer, and audit roles. A backend client must receive a role claim granting read-only access to API records. What should the identity administrator implement? Validate scp for delegated tokens and roles for applicable application tokens Enforce the required permission claim after validating issuer and audience Define an application role and assign it to the approved client service principal Choose app-only permissions rather than user-delegated scopes for the daemon Explanation Correct Answer C:App roles express API-level authorization that the API can validate in access token claims. Incorrect Answers A:Although Validate scp for delegated tokens and roles for applicable application tokens fits a developer confuses the OAuth scopes claim with an app-only roles claim (different grant types express authorization through different token claim conventions), it is not the necessary control for a backend client must receive a role claim granting read-only access to API records. Select Define an application role and assign it to the approved client service principal. B:Enforce the required permission claim after validating issuer and audience would support the different situation where the API needs to reject tokens missing the expected role even when signature validation succeeds: cryptographic token validity and actual API action authorization are separate decisions; however it does not resolve a backend client must receive a role claim granting read-only access to API records, which calls for Define an application role and assign it to the approved client service principal. D:When a developer attempts to use a delegated permission token from a client-credentials flow, Choose app-only permissions rather than user-delegated scopes for the daemon is justified because delegated scopes require a user context; client credentials issue application-context tokens; here the issue is a backend client must receive a role claim granting read-only access to API records, and Define an application role and assign it to the approved client service principal addresses that distinction.
Question 456 A security software vendor is creating a protected API with separate reader, writer, and audit roles. A front-end app needs a per-user permission to view only their authorized resource records. Which change most directly satisfies the scenario? Expose a delegated scope and use the signed-in user's effective entitlement checks Define an application role and assign it to the approved client service principal Complete authorized consent in the franchise tenant for the necessary permissions Enforce the required permission claim after validating issuer and audience Explanation Correct Answer A:A delegated scope expresses user-context rights, not an automatic promise that all application data is visible. Incorrect Answers B:App roles express API-level authorization that the API can validate in access token claims, which makes Define an application role and assign it to the approved client service principal appropriate when a backend client must receive a role claim granting read-only access to API records; here the task is a front-end app needs a per-user permission to view only their authorized resource records, requiring Expose a delegated scope and use the signed-in user's effective entitlement checks. C:When a franchise tenant has not granted permission to the requested application API scopes, Complete authorized consent in the franchise tenant for the necessary permissions is justified because a publisher's registration does not grant API access inside every customer tenant automatically; here the issue is a front-end app needs a per-user permission to view only their authorized resource records, and Expose a delegated scope and use the signed-in user's effective entitlement checks addresses that distinction. D:Enforce the required permission claim after validating issuer and audience concerns the API needs to reject tokens missing the expected role even when signature validation succeeds, where cryptographic token validity and actual API action authorization are separate decisions; the current scenario instead requires a front-end app needs a per-user permission to view only their authorized resource records, so Expose a delegated scope and use the signed-in user's effective entitlement checks is a closer fit.
Question 457 A security software vendor is creating a protected API with separate reader, writer, and audit roles. A developer confuses the OAuth scopes claim with an app-only roles claim. What is the best next administrative action? Expose a delegated scope and use the signed-in user's effective entitlement checks Choose app-only permissions rather than user-delegated scopes for the daemon Define an application role and assign it to the approved client service principal Validate scp for delegated tokens and roles for applicable application tokens Explanation Correct Answer D:Different grant types express authorization through different token claim conventions. Incorrect Answers A:A delegated scope expresses user-context rights, not an automatic promise that all application data is visible, which makes Expose a delegated scope and use the signed-in user's effective entitlement checks appropriate when a front-end app needs a per-user permission to view only their authorized resource records; here the task is a developer confuses the OAuth scopes claim with an app-only roles claim, requiring Validate scp for delegated tokens and roles for applicable application tokens. B:When a developer attempts to use a delegated permission token from a client-credentials flow, Choose app-only permissions rather than user-delegated scopes for the daemon is justified because delegated scopes require a user context; client credentials issue application-context tokens; here the issue is a developer confuses the OAuth scopes claim with an app-only roles claim, and Validate scp for delegated tokens and roles for applicable application tokens addresses that distinction. C:Define an application role and assign it to the approved client service principal concerns a backend client must receive a role claim granting read-only access to API records, where app roles express API-level authorization that the API can validate in access token claims; the current scenario instead requires a developer confuses the OAuth scopes claim with an app-only roles claim, so Validate scp for delegated tokens and roles for applicable application tokens is a closer fit.
Question 458 A security software vendor is creating a protected API with separate reader, writer, and audit roles. The API needs to reject tokens missing the expected role even when signature validation succeeds. Which option is most appropriate for this specific condition? Validate the token audience, issuer, signature, and authorization claims at the API Validate scp for delegated tokens and roles for applicable application tokens Enforce the required permission claim after validating issuer and audience Expose a delegated scope and use the signed-in user's effective entitlement checks Explanation Correct Answer C:Cryptographic token validity and actual API action authorization are separate decisions. Incorrect Answers A:When the security team wants the API to reject a token issued for a different service, Validate the token audience, issuer, signature, and authorization claims at the API is justified because a successful identity-provider token exchange does not grant cross-audience access to another API; here the issue is the API needs to reject tokens missing the expected role even when signature validation succeeds, and Enforce the required permission claim after validating issuer and audience addresses that distinction. B:Validate scp for delegated tokens and roles for applicable application tokens concerns a developer confuses the OAuth scopes claim with an app-only roles claim, where different grant types express authorization through different token claim conventions; the current scenario instead requires the API needs to reject tokens missing the expected role even when signature validation succeeds, so Enforce the required permission claim after validating issuer and audience is a closer fit. D:Although Expose a delegated scope and use the signed-in user's effective entitlement checks fits a front-end app needs a per-user permission to view only their authorized resource records (a delegated scope expresses user-context rights, not an automatic promise that all application data is visible), it is not the necessary control for the API needs to reject tokens missing the expected role even when signature validation succeeds. Select Enforce the required permission claim after validating issuer and audience.
Question 459 A national retailer is implementing a multitenant vendor application used by franchise employees. The app should allow authorized organization tenants rather than just the publisher's directory. Which Microsoft Entra capability best satisfies the requirement? Choose app-only permissions rather than user-delegated scopes for the daemon Configure the supported multitenant account type and consent onboarding process Complete authorized consent in the franchise tenant for the necessary permissions Validate approved token issuers and tenant authorization in addition to signature and audience Explanation Correct Answer B:Multitenant registrations must recognize other permitted tenants and their service principal consent paths. Incorrect Answers A:Choose app-only permissions rather than user-delegated scopes for the daemon concerns a developer attempts to use a delegated permission token from a client-credentials flow, where delegated scopes require a user context; client credentials issue application-context tokens; the current scenario instead requires the app should allow authorized organization tenants rather than just the publisher's directory, so Configure the supported multitenant account type and consent onboarding process is a closer fit. C:Although Complete authorized consent in the franchise tenant for the necessary permissions fits a franchise tenant has not granted permission to the requested application API scopes (a publisher's registration does not grant API access inside every customer tenant automatically), it is not the necessary control for the app should allow authorized organization tenants rather than just the publisher's directory. Select Configure the supported multitenant account type and consent onboarding process. D:Validate approved token issuers and tenant authorization in addition to signature and audience would support the different situation where a developer assumes a valid token from any tenant should be accepted by its API: multitenant token issuance broadens authentication sources; APIs must still authorize the calling tenant; however it does not resolve the app should allow authorized organization tenants rather than just the publisher's directory, which calls for Configure the supported multitenant account type and consent onboarding process.
Question 460 A national retailer is implementing a multitenant vendor application used by franchise employees. A franchise tenant has not granted permission to the requested application API scopes. Which recommendation is most defensible? Verify consented application permissions and the service principal's granted app roles Configure the supported multitenant account type and consent onboarding process Complete authorized consent in the franchise tenant for the necessary permissions Remove the applicable enterprise application consent or app assignment in the customer tenant Explanation Correct Answer C:A publisher's registration does not grant API access inside every customer tenant automatically. Incorrect Answers A:The distinct mechanism for Verify consented application permissions and the service principal's granted app roles is that merely requesting a permission in registration does not supply an effective tenant consent grant; this handles an application token lacks the Graph role despite a requested permission rather than a franchise tenant has not granted permission to the requested application API scopes, so use Complete authorized consent in the franchise tenant for the necessary permissions. B:Although Configure the supported multitenant account type and consent onboarding process fits the app should allow authorized organization tenants rather than just the publisher's directory (multitenant registrations must recognize other permitted tenants and their service principal consent paths), it is not the necessary control for a franchise tenant has not granted permission to the requested application API scopes. Select Complete authorized consent in the franchise tenant for the necessary permissions. D:Tenant-local service principal permissions can be withdrawn without editing the publisher's app registration, which makes Remove the applicable enterprise application consent or app assignment in the customer tenant appropriate when the customer wants to revoke the vendor application's tenant-local permission grants; here the task is a franchise tenant has not granted permission to the requested application API scopes, requiring Complete authorized consent in the franchise tenant for the necessary permissions.
