You are configuring directory synchronization from on-premises Active Directory to Microsoft Entra ID. You need to enable user authentication in the cloud while retaining immediate detection of compromised credentials on the dark web without on-premises DC dependency during sign-in. Which sign-in method should you configure in Microsoft Entra Connect?
- Password Hash Synchronization (PHS) (Correct)
- Pass-through Authentication (PTA)
- Active Directory Federation Services (AD FS)
- LDAP relay over port 389
Explanation: Password Hash Synchronization (PHS) syncs an encrypted hash of the password hash to Microsoft Entra ID. It enables cloud authentication independently of on-premises DCs and allows Microsoft Entra ID Protection to match synced hashes against leaked credential databases on the dark web.
An organization wants to configure self-service password reset (SSPR) for synchronized hybrid users. When users change their passwords in Microsoft Entra ID, the new password must be applied immediately to on-premises Active Directory Domain Services. What must you enable?
- Password Writeback in Microsoft Entra Connect (Correct)
- Kerberos Constrained Delegation
- Azure ExpressRoute private peering
- Direct LDAP Synchronization
Explanation: Password Writeback is an integrated feature of Microsoft Entra Connect that securely sends cloud-initiated password resets back to on-premises Active Directory in real time over an encrypted outbound session.
You are configuring Microsoft Entra Cloud Sync to synchronize users from a disconnected Active Directory forest acquired during a merger. What is a key architectural feature of Microsoft Entra Cloud Sync compared to traditional Microsoft Entra Connect Sync?
- Cloud Sync uses lightweight agents and executes sync logic in the cloud (Correct)
- Cloud Sync requires full local SQL Server instances on-premises
- Cloud Sync cannot synchronize to Microsoft Entra ID
- Cloud Sync requires inbound open TCP port 443 on edge firewalls
Explanation: Microsoft Entra Cloud Sync uses lightweight provisioning agents on-premises that initiate outbound connections to the cloud. Synchronization rules and mapping engines are hosted directly in Microsoft Entra ID rather than on a local SQL-backed server.
You need to create a security group in Microsoft Entra ID that dynamically populates with full-time staff in the Finance department who are not guest users. What query syntax should you enter in the dynamic rule builder?
- (user.department -eq "Finance") and (user.userType -eq "Member") (Correct)
- SELECT * FROM users WHERE department = 'Finance'
- department: "Finance", type: "Member"
- user.department -like "Finance*" or user.type -eq "Guest"
Explanation: The dynamic membership expression (user.department -eq "Finance") and (user.userType -eq "Member") evaluates attributes to include internal staff while excluding guest accounts and other departments.
You need to delegate administrative authority to regional helpdesk technicians in Chicago to manage user accounts and reset passwords only for staff located in Chicago, without granting permissions over other offices. Which Microsoft Entra feature should you deploy?
- Administrative Units (AUs) (Correct)
- Active Directory Sites and Services
- Management Groups in Azure
- Microsoft Purview Information Barriers
Explanation: Administrative Units (AUs) allow scoping directory roles (such as User Administrator or Helpdesk Administrator) strictly over users, groups, or devices explicitly assigned to that AU container.
An organization wants to allow external suppliers to access corporate SharePoint sites using their existing Google Gmail accounts without creating managed work accounts. Which External ID feature should you configure?
- Google Federation in Microsoft Entra External ID (Correct)
- Active Directory Federation Services with SAML 1.1
- On-premises Application Proxy with Kerberos
- Azure AD Domain Services forest trust
Explanation: Google Federation in Microsoft Entra External ID allows external guest users to authenticate to tenant resources using their existing Google accounts via OAuth 2.0 federation.
You are reviewing external collaboration settings in Microsoft Entra ID. You need to ensure that only designated users with the Guest Inviter role can invite external B2B guests, preventing regular employees from sending invites. Where is this configured?
- Set Guest invite settings to only allow specific admin roles (Correct)
- Block TCP port 443 at the corporate firewall
- Delete all external guest accounts from the directory
- Disable modern authentication tenant-wide
Explanation: Under Microsoft Entra admin center > External ID > External collaboration settings, set "Guest invite settings" to "Only users assigned to specific admin roles can invite guest users".
You need to synchronize user accounts from an HR application (such as Workday or SAP SuccessFactors) directly into on-premises Active Directory Domain Services and Microsoft Entra ID. What should you configure?
- Microsoft Entra HR-driven user provisioning (Correct)
- Manual CSV import via PowerShell daily
- Exchange transport mail flow rules
- Defender for Endpoint onboarding scripts
Explanation: Microsoft Entra HR-driven user provisioning uses lightweight provisioning agents to query cloud HR systems and automatically provision, update, and deprovision user accounts in AD DS and Entra ID.
When configuring hybrid Microsoft Entra join, what object must be created in on-premises Active Directory to allow domain-joined computers to discover tenant registration metadata?
- A Service Connection Point (SCP) in the Active Directory Configuration partition (Correct)
- An MX record in public DNS
- A Group Policy Preference mapped network drive
- An internal reverse proxy rule
Explanation: A Service Connection Point (SCP) object created in the Configuration partition of Active Directory under CN=Services stores the Microsoft Entra tenant ID and domain name used by computers during registration.
You need to assign licenses to 500 new users based on their department attribute without writing manual scripts. Which feature should you implement in Microsoft Entra ID?
- Group-based licensing assigned to a dynamic user security group (Correct)
- Assigning licenses to each individual user manually
- Exchange recipient transport policies
- Intune device retirement rules
Explanation: Group-based licensing allows administrators to attach Microsoft 365 licenses to a security group (including dynamic membership groups) so members inherit licenses automatically upon joining.
You need to configure custom security attributes in Microsoft Entra ID to tag employee records with specific payroll codes for API queries. What role is required to define attribute sets and add custom attributes?
- Attribute Definition Administrator (Correct)
- Helpdesk Administrator
- Billing Reader
- Security Operator
Explanation: The Attribute Definition Administrator role is required to define attribute sets and custom security attribute definitions in Microsoft Entra ID.
An administrator deleted a critical user account by mistake 12 days ago. How can this user account be restored without restoring from offline backups?
- Restore the user from Deleted Users in the admin center within 30 days (Correct)
- Recreate the user account manually with a new Object ID
- Restore the Active Directory NTDS.dit database from tape
- Run a hard drive file recovery utility on the client PC
Explanation: Deleted user accounts are held in the Microsoft Entra ID Deleted Users recycle bin in a soft-deleted state for 30 days and can be restored directly via portal or PowerShell.
You need to enable collaboration via Microsoft Teams shared channels with an external business partner without creating B2B guest accounts in either directory. What must you configure?
- Cross-Tenant Access Settings with B2B direct connect (Correct)
- AD FS federated trust using WS-Trust
- Point-to-Site VPN connections
- Creating matching shadow accounts in both tenants
Explanation: Cross-Tenant Access Settings with B2B direct connect enables two Microsoft Entra organizations to establish mutual trust for Teams shared channels without guest identity creation.
In Microsoft Entra Connect, what is the default synchronization schedule interval for delta sync cycles?
- Every 30 minutes (Correct)
- Every 5 minutes
- Every 2 hours
- Once every 24 hours at midnight
Explanation: The Microsoft Entra Connect delta synchronization scheduler runs automatically every 30 minutes by default.
You want to filter which user accounts are synchronized to Microsoft Entra ID using Microsoft Entra Connect. What is the Microsoft-recommended method for ongoing production filtering?
- Domain and Organizational Unit (OU)-based filtering (Correct)
- Disabling network switch ports during sync cycles
- Filtering by user desktop wallpaper settings
- Restricting sync to odd-numbered days of the month
Explanation: Domain and Organizational Unit (OU)-based filtering configured during Microsoft Entra Connect setup is the recommended method to control which directory objects synchronize.
Which tool should you run prior to installing Microsoft Entra Connect to identify directory object synchronization errors such as invalid characters, duplicates, and UPN mismatches?
- IdFix Directory Synchronization Error Remediation Tool (Correct)
- Windows Memory Diagnostic
- Exchange Best Practices Analyzer
- Remote Connectivity Analyzer for SMTP
Explanation: IdFix (Directory Synchronization Error Remediation Tool) scans on-premises Active Directory objects and detects attribute conflicts, missing values, and formatting errors before synchronization.
You are auditing device identities in Microsoft Entra ID. What is the state of a device that is joined exclusively to Microsoft Entra ID without any on-premises Active Directory registration?
- Microsoft Entra joined (Correct)
- Microsoft Entra registered only
- Hybrid Microsoft Entra joined
- Workplace Joined
Explanation: A Microsoft Entra joined device is joined directly and exclusively to the cloud directory and managed through cloud MDM authorities like Microsoft Intune.
You need to delegate permissions to an employee to manage memberships of all security groups in the directory without allowing them to create new groups or reset user passwords. Which role follows least privilege?
- Groups Administrator (Correct)
- Global Administrator
- User Administrator
- Security Operator
Explanation: The Groups Administrator role allows managing group settings and memberships for existing security and Microsoft 365 groups without full User Administrator scope.
How can you prevent standard non-administrative users from creating new Microsoft Entra security groups and Microsoft 365 groups in the admin center?
- Set "Users can create Microsoft 365 groups" and security groups to "No" (Correct)
- Uninstall Microsoft Teams from client PCs
- Delete all existing security groups
- Block TCP port 80 at the perimeter
Explanation: Under Microsoft Entra admin center > Groups > Group settings, set "Users can create Microsoft 365 groups" and "Users can create security groups" to "No".
You are configuring pass-through authentication (PTA) in Microsoft Entra Connect. Where is password validation physically processed when a user authenticates?
- On-premises Pass-through Authentication agents on domain servers (Correct)
- Microsoft cloud authentication servers directly without on-premises agents
- Client web browsers using JavaScript
- Public DNS root hint servers
Explanation: Authentication requests are encrypted and validated in real time by lightweight Pass-through Authentication agents installed on on-premises domain-joined servers.
What is the primary identifier attribute used by Microsoft Entra Connect by default as the source anchor (immutableId) to link on-premises AD objects with cloud objects?
- mS-DS-ConsistencyGuid (Correct)
- userPrincipalName
- sAMAccountName
- telephoneNumber
Explanation: Microsoft Entra Connect uses mS-DS-ConsistencyGuid (which defaults to the objectGUID binary value) as the immutable source anchor attribute.
You want to allow external users to sign up for access to a custom consumer portal using their personal social identities (Facebook, Google, Apple). Which Microsoft Entra solution is designed for customer-facing identity management?
- Microsoft Entra External ID for customers (CIAM) (Correct)
- Active Directory Federation Services (AD FS)
- Microsoft Entra Connect Cloud Sync
- Microsoft Defender for Identity
Explanation: Microsoft Entra External ID (Customer tenants / Azure AD B2C) provides customer identity and access management (CIAM), supporting self-service sign-up and social identity federation.
An administrator needs to bulk update the Department attribute for 2,000 existing cloud users in Microsoft Entra ID. What is the most efficient method using the Entra admin center?
- Use the Bulk update users CSV template in the Entra admin center (Correct)
- Edit each of the 2,000 user profiles manually by hand
- Reset user passwords to trigger attribute updates
- Delete and recreate all 2,000 user accounts
Explanation: In Microsoft Entra admin center under Users > All users > Bulk operations, download the CSV template, populate the required attributes, and perform a Bulk update.
You are implementing passwordless sign-in for corporate Windows 11 workstations. You want users to sign in with hardware-bound cryptographic keys using biometrics or a secure PIN. Which technology must you configure?
- Windows Hello for Business (Correct)
- NTLMv2 authentication
- SMS text verification codes
- Digest authentication
Explanation: Windows Hello for Business provides strong multi-factor passwordless authentication using a cryptographic key pair bound to the device TPM and unlocked via PIN or biometrics.
To defend against MFA fatigue and prompt bombing attacks, you must require users to enter the specific two-digit number displayed on the login screen into the Microsoft Authenticator app. Which feature must you enable?
- Number Matching in Microsoft Authenticator (Correct)
- Standard TOTP rolling codes
- Automated voice calls to mobile phones
- Email verification links
Explanation: Number Matching in Microsoft Authenticator displays a two-digit code on the sign-in screen that the user must enter into the push notification before approval is granted.
You want to enforce a policy where privileged administrators can only authenticate using phishing-resistant credentials (FIDO2 security keys, Windows Hello, or Certificate-Based Authentication). Which Conditional Access control should you use?
- Authentication Strengths specifying Phishing-resistant MFA (Correct)
- Basic password complexity rules
- SMS text verification policies
- Security Defaults toggle
Explanation: Conditional Access Authentication Strengths allow administrators to specify exact combinations of authentication methods, including the built-in "Phishing-resistant MFA" strength.
In Microsoft Entra Identity Protection, what is the difference between User Risk and Sign-in Risk?
- Sign-in risk assesses individual requests; user risk assesses overall account compromise (Correct)
- User risk applies only to guest users; sign-in risk applies only to members
- There is no difference between sign-in risk and user risk
- Sign-in risk requires password reset; user risk requires device formatting
Explanation: Sign-in Risk represents the probability that a specific authentication request was not authorized by the identity owner; User Risk represents the probability that the identity itself is compromised.
You need to create a Conditional Access policy that enforces a password change via SSPR whenever Microsoft Entra Identity Protection flags an account with High User Risk. Which control should you configure in the policy?
- Require password change (with MFA) in Conditional Access Grant controls (Correct)
- Block all access permanently with no self-service remediation
- Send an email notification to the user personal address
- Wipe corporate data from user mobile devices
Explanation: In the Conditional Access Grant controls, select "Require password change" (which automatically requires MFA) to allow the user to remediate high user risk securely.
You are configuring Named Locations in Microsoft Entra ID. You want to define corporate office networks based on public IP ranges and ensure they are recognized as secure zones in Conditional Access. Which option must you mark?
- Check "Mark as trusted location" (Correct)
- Set the IP address range to 0.0.0.0/0
- Assign a Global Administrator role to the location
- Configure the location as an Administrative Unit
Explanation: When creating an IP-based named location, check the box "Mark as trusted location" so it can be evaluated as a trusted network condition in policies.
A user complains that they are prompted for MFA every 15 minutes when browsing different SharePoint Online libraries. Which Conditional Access session control governs authentication prompt intervals?
- Conditional Access Session control: Sign-in frequency (Correct)
- Kerberos ticket lifetime policy
- Exchange ActiveSync wipe countdown
- SharePoint storage limits
Explanation: The "Sign-in frequency" session control defines the time period before a user is required to re-authenticate and satisfy MFA challenges when accessing resources.
You want to block legacy authentication protocols (POP3, IMAP4, SMTP Auth) tenant-wide using Conditional Access. What condition and client app type must be targeted?
- Target Client apps condition with Exchange ActiveSync and Other clients, and Block (Correct)
- Disable TCP port 443 at the boundary firewall
- Revoke licenses from all mobile users
- Enable POP3 access on all user mailboxes
Explanation: Target the "Client apps" condition in a Conditional Access policy and select "Exchange ActiveSync clients" and "Other clients" (legacy protocols) with an access action set to "Block access".
What is the operational function of Continuous Access Evaluation (CAE) in Microsoft Entra ID?
- Near real-time revocation of access tokens when critical security events occur (Correct)
- Extending token lifetimes to 30 continuous days without evaluation
- Bypassing MFA completely on untrusted devices
- Disabling Conditional Access during business hours
Explanation: CAE enables near real-time revocation of access tokens (within minutes) when critical security events occur (user disablement, password reset, admin role change, or IP change).
You are preparing to deploy a new Conditional Access policy that blocks access from non-compliant devices. You want to monitor the impact without impacting production users. Which policy state should you select?
- Report-only mode (Correct)
- Off mode
- Enforced mode
- Simulation mode with auto-lockout
Explanation: Setting the policy state to "Report-only" logs policy evaluation results in the Microsoft Entra sign-in logs without actively enforcing block or MFA grant controls.
Which tool in the Microsoft Entra admin center allows administrators to simulate sign-in scenarios and evaluate which Conditional Access policies will apply to a user from a specific IP and device?
- Conditional Access "What If" tool (Correct)
- Microsoft Remote Connectivity Analyzer
- Windows Command Prompt ping test
- Active Directory Replication Status tool
Explanation: The Conditional Access "What If" tool simulates authentication events based on specified user, app, device, and location parameters to determine policy outcomes.
You want to protect on-premises Active Directory domain controllers from users setting easily guessable passwords (e.g., "Company2024!"). What should you deploy?
- Microsoft Entra Password Protection on-premises agents and proxies (Correct)
- Default Domain Controller GPO complexity toggle only
- Windows BitLocker PIN enforcement
- Microsoft Purview Customer Key
Explanation: Microsoft Entra Password Protection DC agents and proxies deployed on on-premises domain controllers validate password changes against global and custom banned lists in real time.
You need to configure certificate-based authentication (CBA) in Microsoft Entra ID for smart card sign-ins. Where do you upload the trusted root and intermediate Certification Authority (CA) certificates?
- Protection > Authentication methods > Certificate-based authentication (Correct)
- Exchange Admin Center under Mail flow > Connectors
- SharePoint Admin Center under Access control
- Microsoft Defender portal under Asset inventory
Explanation: In the Microsoft Entra admin center under Protection > Authentication methods > Certificate-based authentication (or Manage > Certificates), upload trusted root and intermediate CAs.
Which built-in role in Microsoft Entra ID can create, modify, and delete Conditional Access policies without granting full Global Administrator rights?
- Conditional Access Administrator (Correct)
- User Administrator
- Compliance Administrator
- Helpdesk Administrator
Explanation: The Conditional Access Administrator role grants permissions to configure and administer Conditional Access policies, named locations, and custom controls.
You need to enforce that users must accept an NDA Terms of Use before accessing corporate applications on their personal laptops. How is Terms of Use presented and enforced?
- Conditional Access Grant control requiring Terms of Use consent (Correct)
- SharePoint site collection theme settings
- Exchange transport disclaimer rules
- Intune device compliance baseline
Explanation: Upload the Terms of Use PDF into Microsoft Entra ID, then configure a Conditional Access policy targeting cloud apps with the Grant control set to require that specific Terms of Use.
What is the maximum number of emergency access "break-glass" accounts recommended by Microsoft, and how should their Conditional Access assignment be configured?
- At least two break-glass accounts explicitly excluded from all CA policies (Correct)
- One single account assigned to all helpdesk technicians
- No accounts should ever be excluded from Conditional Access
- Break-glass accounts must use simple predictable passwords
Explanation: Microsoft recommends creating at least two break-glass accounts that are explicitly excluded from all Conditional Access and MFA policies to prevent lockout during outages.
In Microsoft Entra ID Protection, what is an example of an "offline" risk detection that may take several hours to compute after an authentication event occurs?
- Atypical travel and Leaked credentials (Correct)
- Anonymous IP address connection
- Malicious IP address connection
- Unfamiliar sign-in properties evaluated during login
Explanation: Atypical travel (impossible travel) and Leaked credentials discovered in dark-web dumps are offline risk detections computed asynchronously through backend machine learning algorithms.
You want to prevent users from sharing browser sessions across untrusted computers by disabling persistent browser cookies in web sessions. Which Conditional Access control enforces this?
- Persistent browser session set to Never persistent (Correct)
- Sign-in frequency set to 365 days
- Require hybrid Entra joined device
- Require app protection policy
Explanation: In Conditional Access Session controls, configure "Persistent browser session" and set it to "Never persistent" to force session cookies to clear upon closing the browser.
You are configuring Microsoft Authenticator. You want the push notification to display the approximate city-level geographic location and the application name from which the sign-in originated. Which features should you enable?
- Show application name and geographic location in push notifications (Correct)
- Disable Number Matching tenant-wide
- Enable SMS text fallback prompts
- Switch all accounts to password-only authentication
Explanation: Under Authentication methods policies for Microsoft Authenticator, enable "Show application name in push notifications" and "Show geographic location in push notifications".
Which Microsoft Entra feature provides a baseline set of security configurations (including mandatory MFA for all admins, blocking legacy auth, and protecting privileged actions) for organizations with Free licenses?
- Security Defaults (Correct)
- Privileged Identity Management
- Continuous Access Evaluation
- Lifecycle Workflows
Explanation: Security Defaults provides a turnkey, free set of preconfigured identity protections that enforce MFA and block legacy authentication across the tenant.
What happens to Security Defaults if you configure and enable a custom Conditional Access policy in your Microsoft Entra tenant?
- Security Defaults must be disabled before enabling Conditional Access (Correct)
- Security Defaults automatically overrides all Conditional Access rules
- Both features operate concurrently with combined rulesets
- Conditional Access policies are deleted automatically
Explanation: Security Defaults must be completely disabled before you can enable custom Conditional Access policies; the two features cannot be active simultaneously.
You are configuring Self-Service Password Reset (SSPR). You want to ensure that users are required to register at least two authentication methods before they can use SSPR. What should you configure?
- Set "Number of methods required to reset" to 2 in SSPR settings (Correct)
- Require all users to enter their passport number during reset
- Force users to contact helpdesk technicians for every reset
- Disable SSPR for all non-administrative users
Explanation: In the Microsoft Entra admin center under Password reset > Authentication methods, set "Number of methods required to reset" to 2.
You need to revoke all active refresh tokens and browser sessions for an employee suspected of having compromised credentials. Which action should you take in the Entra admin center?
- Click "Revoke sessions" in the user profile in Entra admin center (Correct)
- Change the user department attribute to Terminated
- Move the user into an un-synced Active Directory OU
- Reboot the primary domain controller
Explanation: Navigate to the user profile in Microsoft Entra admin center and click "Revoke sessions" to immediately invalidate all issued refresh tokens and session cookies.
You need to enforce MFA only when a user accesses a particularly sensitive finance application, requiring step-up re-authentication even if they have an active PRT session. Which Conditional Access control enforces this?
- Authentication Context applied to the sensitive app or data (Correct)
- Disabling modern authentication for that application
- Deleting the user Entra ID account object
- Applying an Exchange transport rule
Explanation: Authentication Context in Conditional Access tags specific sensitive application actions or SharePoint sites with a context that triggers step-up MFA upon access.
Which authentication method policy allows users to sign in by sending an SMS one-time passcode to their registered mobile phone number?
- SMS authentication method policy (Correct)
- FIDO2 security key policy
- Temporary Access Pass policy
- Certificate-based authentication policy
Explanation: The SMS authentication method policy in Microsoft Entra ID allows users to receive and verify a numeric passcode sent via text message.
You need to audit sign-in failures caused specifically by Conditional Access policy block rules. Where can you find this information in the portal?
- Sign-in logs under the Conditional Access tab for specific sign-in events (Correct)
- Local client Windows Event Viewer Application logs
- Exchange Message Trace delivery reports
- Azure Cost Management cost analysis reports
Explanation: In Microsoft Entra admin center > Monitoring > Sign-in logs, inspect the "Conditional Access" tab on individual sign-in events to view policy match statuses.
In Microsoft Entra ID Protection, what is an example of a "real-time" risk detection calculated during the sign-in processing pipeline?
- Anonymous IP address and Malicious IP address (Correct)
- Leaked credentials discovered on dark-web dumps
- Atypical travel calculated across multiple days
- Suspicious user password reset patterns
Explanation: Anonymous IP address (e.g., Tor browser or commercial VPN) and Malicious IP address are real-time detections evaluated directly during authentication before tokens are issued.