6.3. Practice Questions

Answers and rationales follow all ten questions. Mixed domains, exam voice.

Q1. Contoso requires that activating the Global Administrator role demand phishing-resistant MFA. PIM role settings offer "Require MFA on activation," but this accepts any registered method. What should you configure? A) Require approval on activation B) Require Microsoft Entra ID Protection sign-in risk policy C) Require authentication context on activation, targeted by a CA policy requiring phishing-resistant authentication strength D) Require ticket information on activation

Q2. You configure a user risk policy requiring secure password change for High risk. Hybrid users report they change passwords but risk never clears and prompts repeat. Cloud-only users are unaffected. What is the most likely cause? A) The users aren't registered for MFA B) Password writeback is not enabled C) The sign-in risk policy is missing D) The users are excluded from CA

Q3. Fabrikam must let employees on unmanaged personal devices open SharePoint documents in the browser but prevent downloads, with minimal administrative effort. Which two components? A) CA policy with "Use app-enforced restrictions" session control + SharePoint limited access configuration B) CA block policy for unmanaged devices C) MDCA access policy blocking unmanaged devices D) Intune app protection policy

Q4. A nightly service on an Azure VM must read secrets from Key Vault; a compliance rule bans stored credentials, and the VM is rebuilt weekly from images. Which identity? A) System-assigned managed identity B) User-assigned managed identity C) Service principal with certificate D) gMSA

Q5. Litware invites guests from partner tenant fabrikam.com. Partners complain they satisfy MFA in their tenant, then must complete MFA again in Litware's. Access must remain MFA-protected. What should you configure? A) Exclude guests from the MFA policy B) In cross-tenant access settings for fabrikam.com, trust MFA from that tenant C) Email one-time passcode D) B2B direct connect

Q6. You must give the Paris helpdesk the ability to reset passwords and re-register MFA for Paris users only. Which three actions, in order? A) Create a dynamic administrative unit for Paris users → assign Authentication Administrator scoped to the AU → verify with effective permissions B) Create a security group → assign Privileged Authentication Administrator tenant-wide → add helpdesk C) Create an AU → assign Helpdesk Administrator tenant-wide → add Paris users D) Create a restricted management AU → assign User Administrator at directory scope → move users in

Q7. An app registration serves a background service that must read every user's calendar via Microsoft Graph. Which permission configuration is correct? A) Delegated Calendars.Read with user consent B) Delegated Calendars.Read with admin consent C) Application Calendars.Read with admin consent, client credentials flow D) Application Calendars.ReadWrite with user consent

Q8. Northwind must retain Entra sign-in and audit logs for three years at minimal cost, and its SOC uses Splunk for live monitoring. Which two destinations in one diagnostic setting? A) Log Analytics + storage account B) Storage account + Event Hub C) Log Analytics + Event Hub D) Two storage accounts

Q9. Project contractors must request access to three groups and one app as a bundle, with manager approval, NDA acceptance, 90-day expiry, and automatic guest deletion 30 days after their last assignment ends. Which feature set? A) Access reviews with auto-apply B) Access package with approval policy, terms of use, expiration + external user lifecycle settings C) PIM for Groups D) Cross-tenant synchronization with attribute mapping

Q10. A staged rollout moves a pilot group from AD FS to cloud authentication. A piloted user's third-party MFA (enforced at AD FS) no longer triggers. What should you do before broad cutover? A) Roll back staged rollout B) Re-enforce MFA with a Conditional Access policy using Entra methods (migrate MFA to Entra) C) Enable seamless SSO D) Convert the domain to federated

Answers.

A1: C. PIM's generic MFA option can't demand a specific strength; binding an authentication context to activation and targeting it with a CA policy requiring the phishing-resistant authentication strength does (5.3.1, 2.2.3). A and D add gates but not method strength; B is unrelated to activation.

A2: B. Secure password change for synced users depends on password writeback reaching on-prem AD (2.3.2, 2.1.4); without it the change never lands authoritative and risk re-triggers. Cloud-only users unaffected is the tell. A would block differently; C governs sign-in risk, a different score.

A3: A. App-enforced restrictions with SharePoint's limited-access mode is the minimal-effort path for exactly this scenario (2.2.2); MDCA session policies (4.4.2) could also do it but add proxy deployment — more effort. B blocks rather than limits; C blocks the session start; D governs mobile apps, not browser downloads.

A4: B. No stored credential rules out C; weekly rebuilds destroy a system-assigned identity and its role assignments each time (4.1.2), so user-assigned — which survives resource recreation and carries its Key Vault role — is correct. gMSA is on-premises Windows (4.1.1).

A5: B. Inbound trust settings accept the partner tenant's MFA claim, eliminating the double prompt while CA still requires MFA — now satisfied at home (3.3.2). A removes protection; C is a redemption fallback; D changes the collaboration model, not the MFA experience.

A6: A. Authentication Administrator covers password resets and MFA re-registration for non-admins; AU scoping bounds it to Paris; dynamic AU membership keeps it current (3.1.1, 3.1.2). B is tenant-wide over-privilege including admins; C's tenant-wide role ignores the boundary requirement; D misuses restricted AUs and scope.

A7: C. No user is present, so delegated permissions cannot work (4.3.2); application permissions always require admin consent and are exercised via client credentials. D's user consent is impossible for application permissions, and ReadWrite over-privileges.

A8: B. Three-year cheap retention = storage account; Splunk streaming = Event Hub; both attach to one diagnostic setting (5.4.1). Log Analytics adds cost for querying that neither requirement asks for.

A9: B. The clause-by-clause map of entitlement management (5.1): package bundles resources; policy adds manager approval; ToU handles the NDA; expiration handles 90 days; external user lifecycle blocks-then-deletes the guest. Reviews recertify but don't bundle or request; PIM governs privileged activation.

A10: B. Staged rollout moves authentication to the cloud, so AD FS-attached MFA no longer sits in the path (3.4.3); the requirement must be re-implemented as Entra MFA enforced by CA before cutting over broadly. A retreats instead of fixing; C is unrelated; D reverses the migration.