I85PREP
⌘ K
MCS study materials
MCS study resources

MCS practice questions

One question at a time. Build your MCS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Describe the concepts of security, compliance, and identity

An organization wants to verify that only approved, trusted applications run on its servers. Which security concept does this requirement describe?

  1. Data loss prevention
  2. Network segmentation
  3. Privileged access management
  4. Application control Correct answer.

Explanation

Application control restricts which programs are permitted to execute, blocking unapproved binaries. It directly addresses the requirement that only trusted applications run. The other options address data exfiltration, network isolation, and administrative account governance.

Question 2Describe the concepts of security, compliance, and identity

Which principle states that a user should be granted only the permissions required to perform their job and nothing more?

  1. Least privilege Correct answer.
  2. Defense in depth
  3. Separation of duties
  4. Zero trust

Explanation

Least privilege limits access rights to the minimum needed for a task, reducing the blast radius of a compromised account. Separation of duties splits tasks to prevent fraud, which is a different control goal. Defense in depth layers controls, and zero trust is an architectural model.

Question 3Describe the concepts of security, compliance, and identity

A company must prove to auditors that it protects cardholder data. Which type of compliance requirement is specifically designed for this purpose?

  1. GDPR
  2. PCI DSS Correct answer.
  3. SOX
  4. HIPAA

Explanation

PCI DSS is the standard for organizations that store, process, or transmit payment card data. HIPAA covers health information, GDPR governs personal data of EU residents, and SOX governs financial reporting controls.

Question 4Describe the concepts of security, compliance, and identity

Which identity concept describes a single user account that can access multiple applications after authenticating once?

  1. Federated identity
  2. Conditional access
  3. Multifactor authentication
  4. Single sign-on Correct answer.

Explanation

Single sign-on lets a user authenticate once and reach multiple connected applications without re-entering credentials. Federation extends identity across organizations, multifactor authentication adds verification factors, and conditional access evaluates signals before granting access.

Question 5Describe the concepts of security, compliance, and identity

A security team wants to detect and respond to suspicious sign-in behavior across cloud services. Which capability best matches this need?

  1. Full-disk encryption
  2. Static code analysis
  3. Vulnerability scanning
  4. Security information and event management Correct answer.

Explanation

SIEM solutions collect and correlate log and event data, including sign-in telemetry, to detect and alert on suspicious activity. Static analysis reviews source code, encryption protects data at rest, and vulnerability scanning finds weaknesses in systems.

Question 6Describe the concepts of security, compliance, and identity

Which term describes the assurance that data has not been altered in transit or at rest?

  1. Non-repudiation
  2. Availability
  3. Confidentiality
  4. Integrity Correct answer.

Explanation

Integrity ensures data remains accurate and unaltered unless changed by an authorized process. Confidentiality protects secrecy, availability ensures timely access, and non-repudiation prevents denying an action.

Question 7Describe the concepts of security, compliance, and identity

An organization wants to classify data so that handling rules follow sensitivity. Which labeling approach is most appropriate?

  1. Require strong passwords for users
  2. Assign each file an owner
  3. Apply sensitivity labels to content Correct answer.
  4. Enable version history on documents

Explanation

Sensitivity labels tag content by classification level so that protection and handling policies can be applied automatically. File ownership, version history, and password policies do not convey data sensitivity classification.

Question 8Describe the concepts of security, compliance, and identity

Which statement best describes the purpose of a governance, risk, and compliance program?

  1. It guarantees that no security incidents will occur
  2. It aligns security activities with business objectives and regulatory obligations Correct answer.
  3. It replaces the need for technical security controls
  4. It focuses exclusively on encrypting stored data

Explanation

A GRC program coordinates policy, risk assessment, and compliance activities so security work supports business goals and legal duties. It does not eliminate the need for technical controls, prevent all incidents, or focus on a single technology.

Question 9Describe the concepts of security, compliance, and identity

A user signs in from an unfamiliar country and the system requires an additional verification step before granting access. Which control is being applied?

  1. Passwordless authentication
  2. Role-based access control
  3. Just-in-time provisioning
  4. Conditional access Correct answer.

Explanation

Conditional access evaluates signals such as location, device state, and risk, then enforces requirements like extra verification. Role-based access control assigns permissions by role, passwordless authentication removes passwords, and just-in-time provisioning creates access on demand.

Question 10Describe the concepts of security, compliance, and identity

An administrator needs to review which users hold elevated directory roles and when those assignments expire. Which identity governance capability addresses this?

  1. Certificate-based authentication
  2. Access reviews of privileged role assignments Correct answer.
  3. Self-service password reset
  4. Network access control

Explanation

Access reviews let reviewers certify or remove role assignments periodically, including privileged roles with time-bound eligibility. Self-service password reset, certificate authentication, and network access control address different problems.

Question 11Describe the concepts of security, compliance, and identity

A company wants to share a document with a partner organization such that the partner uses its own credentials. Which identity approach fits best?

  1. Creating duplicate local accounts for partner staff
  2. Disabling multifactor authentication for partners
  3. Emailing the document as an attachment
  4. Federating identity with the partner's identity provider Correct answer.

Explanation

Federation establishes trust between identity providers so partner users authenticate with their own organization's credentials. Duplicate accounts create management overhead, attachments bypass access control, and disabling MFA weakens security.

Question 12Describe the concepts of security, compliance, and identity

A security analyst notices many failed sign-ins followed by one success from the same source. Which threat does this pattern most likely indicate?

  1. Denial-of-service flooding
  2. Insider data exfiltration
  3. Ransomware encryption
  4. Password spray or brute-force attack Correct answer.

Explanation

Repeated failed authentications followed by a success suggest credential guessing that eventually succeeded. Ransomware, exfiltration, and denial-of-service produce different observable patterns such as file encryption, large outbound transfers, or service unavailability.

Question 13Describe the concepts of security, compliance, and identity

Which control most directly reduces the impact of a stolen password?

  1. Requiring longer password minimums
  2. Enforcing multifactor authentication Correct answer.
  3. Rotating passwords every 30 days
  4. Displaying the last sign-in time

Explanation

Multifactor authentication requires a second factor beyond the password, so a stolen password alone is insufficient. Longer or rotated passwords still fail if stolen, and sign-in history is informational only.

Question 14Describe the concepts of security, compliance, and identity

An organization must retain audit logs for a defined period to satisfy a regulatory requirement. Which practice supports this?

  1. Deleting logs after 24 hours to save space
  2. Configuring a retention policy on the log repository Correct answer.
  3. Storing logs only on the local workstation
  4. Disabling log collection during off-hours

Explanation

A retention policy defines how long logs are kept and prevents premature deletion, which supports regulatory and investigative needs. Short deletion, local-only storage, and disabled collection undermine auditability.

Question 15Describe the concepts of security, compliance, and identity

A user receives an email that appears to come from the IT department asking them to confirm credentials via a link. Which attack is this?

  1. Man-in-the-middle
  2. Privilege escalation
  3. Phishing Correct answer.
  4. SQL injection

Explanation

Phishing uses deceptive messages to trick recipients into revealing credentials or clicking malicious links. Privilege escalation gains higher rights, SQL injection exploits database queries, and man-in-the-middle intercepts communications.

Question 16Describe the concepts of security, compliance, and identity

Which identity model treats every access request as untrusted and verifies it explicitly regardless of network location?

  1. Zero trust Correct answer.
  2. Implicit trust zones
  3. Perimeter security
  4. Flat network

Explanation

Zero trust assumes no implicit trust based on location and verifies each request using identity, device, and context signals. Perimeter security trusts internal networks, implicit trust zones assume internal safety, and a flat network lacks segmentation.

Question 17Describe the concepts of security, compliance, and identity

A compliance officer needs evidence that only authorized changes reach production systems. Which control provides this evidence?

  1. Antivirus signature updates
  2. Printer usage quotas
  3. Change approval records with audit trails Correct answer.
  4. Wireless network encryption

Explanation

Documented change approvals and audit trails show that modifications were authorized and reviewed, which is the evidence auditors seek. Antivirus updates, wireless encryption, and printer quotas do not demonstrate change authorization.

Question 18Describe the concepts of security, compliance, and identity

Which practice best protects sensitive data at rest in a cloud storage account that is accidentally made public?

  1. Enabling encryption with customer-managed keys Correct answer.
  2. Relying on obscurity of the storage name
  3. Granting anonymous read access
  4. Compressing the stored files

Explanation

Encryption with customer-managed keys keeps data unreadable even if access controls fail and the container becomes public. Obscurity, compression, and anonymous access do not protect confidentiality.

Question 19Describe the concepts of security, compliance, and identity

An attacker with limited user access exploits a flaw to obtain administrator rights on the same system. Which term describes this?

  1. Data exfiltration
  2. Reconnaissance
  3. Privilege escalation Correct answer.
  4. Lateral movement

Explanation

Privilege escalation is the act of gaining higher permissions than originally granted. Lateral movement spreads to other systems, exfiltration removes data, and reconnaissance gathers information before an attack.

Question 20Describe the concepts of security, compliance, and identity

Which mechanism lets an application obtain a short-lived token to call an API on behalf of a signed-in user without storing the user's password?

  1. Anonymous access
  2. OAuth 2.0 delegated authorization Correct answer.
  3. Shared API key embedded in code
  4. Basic authentication

Explanation

OAuth 2.0 delegated authorization issues scoped tokens so applications can call APIs without handling user passwords. Basic authentication sends reusable credentials, embedded keys are shared secrets, and anonymous access provides no authorization.

Question 21Describe the concepts of security, compliance, and identity

A company needs to demonstrate that it continuously meets a cloud provider's security commitments. Which document type is most relevant?

  1. The provider's marketing brochure
  2. The internal network diagram of the customer
  3. The customer's employee handbook
  4. Independent audit reports and certifications of the provider Correct answer.

Explanation

Independent audit reports and certifications provide third-party evidence that a provider meets stated controls. Marketing materials, customer diagrams, and handbooks do not attest to provider compliance.

Question 22Describe the concepts of security, compliance, and identity

A team must ensure that departing employees lose access immediately while their mailbox data remains available to their manager. Which approach is most appropriate?

  1. Change the user's password and keep the account active
  2. Convert the account to a shared administrative account
  3. Delete the user account and all data immediately
  4. Disable the account and reassign or delegate access to the data Correct answer.

Explanation

Disabling the account blocks sign-in immediately while preserving data for delegation to the manager. Deleting removes data, keeping the account active leaves an access path, and converting to a shared admin account creates accountability and privilege problems.

Question 23Describe the concepts of security, compliance, and identity

An organization wants to limit the damage a compromised workload identity could cause if its secret leaks. Which combination is most effective?

  1. Disabling logging for the workload to reduce noise
  2. A single shared secret used by all workloads
  3. Long-lived secrets stored in source code with broad permissions
  4. Short-lived credentials with narrowly scoped permissions and rotation Correct answer.

Explanation

Short-lived, narrowly scoped credentials limit both the window and the scope of misuse if a secret leaks. Long-lived embedded secrets, shared secrets, and disabled logging all increase exposure and reduce detection.

Question 24Describe the concepts of security, compliance, and identity

A regulator requires that personal data of EU residents be processed lawfully with documented legal basis and minimized collection. Which framework primarily drives this obligation?

  1. ISO 27001 certification
  2. PCI DSS
  3. GDPR Correct answer.
  4. NIST Cybersecurity Framework

Explanation

GDPR establishes legal bases, data minimization, and individual rights for personal data of EU residents. PCI DSS covers card data, ISO 27001 is a management system standard, and the NIST framework provides voluntary guidance.

Question 25Describe the concepts of security, compliance, and identity

During an investigation, an analyst must prove that a log file was not modified after collection. Which technique provides this assurance?

  1. Renaming the file with the collection date
  2. Copying the file to a shared drive
  3. Generating a cryptographic hash of the file at collection time Correct answer.
  4. Compressing the file into an archive

Explanation

A cryptographic hash recorded at collection creates a verifiable fingerprint so later changes can be detected. Compression, renaming, and copying do not provide tamper evidence.

Question 26Describe the concepts of security, compliance, and identity

In the shared responsibility model for a cloud service, which security task always remains the customer's responsibility regardless of whether the service is IaaS, PaaS, or SaaS?

  1. Classifying and governing the data they store in the service Correct answer.
  2. Managing the physical security of the datacenter
  3. Patching the underlying hypervisor
  4. Maintaining the host operating system firmware

Explanation

Across every cloud service model the provider owns the physical facility, hardware, and virtualization layer, while the customer always remains accountable for their own data, including how it is classified, who may access it, and how it is governed. Control over the operating system and middleware shifts toward the provider as you move from IaaS to SaaS, but data accountability never transfers.

Question 27Describe the concepts of security, compliance, and identity

A new employee must complete security awareness training before receiving access to production systems. Which type of control does this training represent?

  1. Compensating
  2. Detective
  3. Corrective
  4. Preventive Correct answer.

Explanation

A control is preventive when it stops an unwanted event from occurring at all, and requiring training before granting access blocks risky behavior before it can happen. Detective controls identify events after the fact, corrective controls restore systems after an incident, and compensating controls substitute for a primary control that cannot be applied.

Question 28Describe the concepts of security, compliance, and identity

An organization wants users to reach many cloud applications through a single sign-in and to enforce conditional access policies centrally. Which identity capability should it deploy?

  1. A password manager synchronized to each device
  2. Federation through a central identity provider using standards such as SAML or OpenID Connect Correct answer.
  3. Local accounts created separately in every application
  4. A shared service account used by all staff for each application

Explanation

Federating applications to a central identity provider lets users authenticate once and receive tokens that each relying application trusts, so policies such as conditional access are evaluated in one place. Local per-application accounts and shared accounts fragment control and prevent consistent policy enforcement.

Question 29Describe the concepts of security, compliance, and identity

A company must prove to an auditor that its cloud workloads satisfy a recognized set of security controls, and it wants an independent third party to attest to that. Which approach provides this evidence?

  1. Completing a self-assessment questionnaire answered by the engineering team
  2. Publishing an internal security policy on the corporate intranet
  3. Obtaining an independent audit report against a framework such as ISO/IEC 27001 or SOC 2 Correct answer.
  4. Running a vulnerability scan of the production network

Explanation

An independent audit against a recognized framework produces attestation that an outside party reviewed the controls, which is the evidence auditors typically accept. Self-assessment and internal documents show intent but lack independent verification, and a vulnerability scan tests only technical weaknesses at a point in time.

Question 30Describe the concepts of security, compliance, and identity

An attacker who has compromised a low-privilege user account repeatedly escalates privileges until reaching a domain administrator, then uses that access to reach many systems. Which concept best explains why this progression is dangerous and how it should be contained?

  1. Zero trust, because every request is verified regardless of network location
  2. Encryption at rest, because stolen credentials cannot be used against encrypted disks
  3. Least privilege combined with tiered administration, because separating administrative tiers prevents lower-trust credentials from controlling higher-trust assets Correct answer.
  4. Defense in depth, because multiple overlapping controls slow each escalation step and limit reach

Explanation

The attack path depends on lower-privilege identities being able to obtain or use higher-privilege credentials on the same systems. Least privilege and tiered administration break that path by ensuring administrative credentials for high-value tiers are never exposed on lower-trust endpoints, so a compromised user account cannot climb to domain control.

Question 31Describe the capabilities of Microsoft Entra

A company wants employees to use one set of credentials to sign in to Microsoft 365, Azure portal, and third-party SaaS apps. Which Microsoft Entra capability directly provides this single sign-on experience?

  1. Microsoft Entra Permissions Management CIEM
  2. Microsoft Entra Verified ID decentralized identifiers
  3. Microsoft Entra ID as a cloud identity provider with SSO and app gallery integration Correct answer.
  4. Microsoft Entra Domain Services managed domain join

Explanation

Microsoft Entra ID is the cloud identity provider that authenticates users once and issues tokens to Microsoft 365, Azure, and thousands of pre-integrated gallery applications. Domain Services, Verified ID, and Permissions Management solve different problems, so only the cloud IdP with SSO provides unified sign-in.

Question 32Describe the capabilities of Microsoft Entra

An administrator needs to require multifactor authentication only when users access a sensitive finance application, without affecting other apps. Which Microsoft Entra feature should be configured?

  1. Conditional Access policy targeting the finance app Correct answer.
  2. Per-user MFA enabled for all users
  3. Self-service password reset with authentication methods
  4. Security defaults at the tenant level

Explanation

Conditional Access evaluates signals such as user, group, app, and risk, and can enforce MFA for a specific target application only. Tenant-wide controls such as security defaults or per-user MFA apply broadly and cannot be scoped to one app.

Question 33Describe the capabilities of Microsoft Entra

Which Microsoft Entra capability lets an organization define who must approve a user's request to join a marketing group, with automatic access expiry?

  1. Entra ID B2C user flows
  2. Entitlement management with access packages Correct answer.
  3. Privileged Identity Management
  4. Identity Protection risk detections

Explanation

Entitlement management uses access packages to bundle resources with approval workflows and expiration policies, which is exactly the governance scenario described. PIM governs activation of privileged roles, Identity Protection scores risk, and B2C handles customer identity journeys.

Question 34Describe the capabilities of Microsoft Entra

A security team wants to automatically detect sign-ins from anonymous IP addresses and impossible travel, then feed those detections into Conditional Access. Which Microsoft Entra ID P2 feature provides this?

  1. Access reviews
  2. Entra ID Connect cloud sync
  3. Identity Protection Correct answer.
  4. Administrative units

Explanation

Identity Protection provides risk detections such as anonymous IP use and impossible travel, and exposes user and sign-in risk as Conditional Access conditions. Access reviews, cloud sync, and administrative units do not produce risk signals.

Question 35Describe the capabilities of Microsoft Entra

An organization wants to give an auditor read-only access to Entra ID sign-in logs and audit logs without granting any write permissions. Which approach follows least privilege?

  1. Assign the Global Administrator role temporarily
  2. Assign the Reports Reader role scoped to the tenant Correct answer.
  3. Assign the User Administrator role
  4. Add the auditor as an owner of the tenant root group

Explanation

The Reports Reader role grants read access to sign-in and audit reports without configuration rights, which satisfies least privilege. Global Administrator and User Administrator carry write capabilities, and tenant root ownership is unrelated to Entra reporting.

Question 36Describe the capabilities of Microsoft Entra

Which Microsoft Entra feature allows an on-premises Active Directory user to authenticate to Microsoft 365 using their existing domain password while password hashes are synchronized to the cloud?

  1. Federation with Active Directory Federation Services
  2. Pass-through authentication
  3. Certificate-based authentication
  4. Password hash synchronization Correct answer.

Explanation

Password hash synchronization copies a hash of the on-premises password to Entra ID so users authenticate in the cloud with the same password. Federation and pass-through authentication validate credentials on-premises instead of synchronizing hashes.

Question 37Describe the capabilities of Microsoft Entra

A user reports that a sign-in prompt shows a numeric code in the Microsoft Authenticator app. Which Microsoft Entra capability is being used?

  1. Self-service password reset
  2. Windows Hello for Business
  3. Passwordless authentication with phone sign-in Correct answer.
  4. Entra Connect cloud sync

Explanation

Phone sign-in is a passwordless method where the authenticator app displays a number that the user matches on the sign-in screen. SSPR resets passwords, Windows Hello is device-bound, and cloud sync provisions identities.

Question 38Describe the capabilities of Microsoft Entra

Which Microsoft Entra service is designed for external business partners who need to sign in with their own organizational credentials while you manage their access to your Teams resources?

  1. Microsoft Entra Domain Services
  2. Microsoft Entra External ID B2C
  3. Microsoft Entra External ID B2B collaboration Correct answer.
  4. Microsoft Entra Connect

Explanation

B2B collaboration lets guest users authenticate with their home tenant or social identity and be governed by your access policies. B2C targets consumer-facing apps, Domain Services supports legacy protocols, and Connect synchronizes identities.

Question 39Describe the capabilities of Microsoft Entra

An administrator wants to delegate user management for a single country's subsidiary to a local IT team, restricting them to that subsidiary's users only. Which Microsoft Entra construct should be used?

  1. Conditional Access named locations
  2. Dynamic security groups
  3. Administrative units Correct answer.
  4. Access packages

Explanation

Administrative units are containers that scope role assignments to a subset of users and groups, so delegated admins manage only that subsidiary. Named locations, access packages, and dynamic groups control access or membership rather than administrative scope.

Question 40Describe the capabilities of Microsoft Entra

Which Microsoft Entra ID capability provides just-in-time activation of the Global Administrator role with approval and time-bound assignment?

  1. Entitlement management
  2. Access reviews
  3. Privileged Identity Management Correct answer.
  4. Identity Protection

Explanation

Privileged Identity Management makes eligible role assignments that users activate on demand, optionally with approval, MFA, and expiration. Access reviews, entitlement management, and Identity Protection address different governance needs.

Question 41Describe the capabilities of Microsoft Entra

A company wants to automatically assign the Sales department license and group membership to users whose department attribute equals Sales. Which Microsoft Entra feature should be configured?

  1. Manual group assignment by an administrator
  2. Conditional Access group targeting
  3. Dynamic membership rules on a security group Correct answer.
  4. Access review of the group

Explanation

Dynamic groups evaluate attribute-based rules such as user.department equals Sales and update membership automatically. Manual assignment requires ongoing effort, while access reviews and Conditional Access consume membership rather than create it.

Question 42Describe the capabilities of Microsoft Entra

Which Microsoft Entra capability allows users to reset their own passwords after proving identity with an authenticator app or phone, reducing helpdesk calls?

  1. Password protection with banned password lists
  2. Self-service password reset Correct answer.
  3. Temporary Access Pass
  4. Password hash synchronization

Explanation

Self-service password reset lets users verify identity with registered methods and change or unlock their password without a helpdesk ticket. The other options concern password policy, hybrid sync, or onboarding credentials.

Question 43Describe the capabilities of Microsoft Entra

A tenant wants to block legacy authentication protocols that cannot enforce MFA, while still allowing modern clients. Which Microsoft Entra control is appropriate?

  1. A named location for the office IP range
  2. A Conditional Access policy that blocks legacy authentication client apps Correct answer.
  3. An access review of guest users
  4. Security defaults with MFA registration

Explanation

A Conditional Access policy can target the legacy authentication client apps condition and block them, closing the MFA bypass path. Security defaults do not selectively block legacy protocols, and access reviews or named locations address different concerns.

Question 44Describe the capabilities of Microsoft Entra

Which Microsoft Entra ID feature lets an organization publish on-premises web applications so remote users can reach them through Entra ID authentication without a VPN?

  1. Microsoft Entra Verified ID
  2. Microsoft Entra Domain Services
  3. Microsoft Entra Connect cloud sync
  4. Microsoft Entra application proxy Correct answer.

Explanation

Application proxy publishes internal web apps externally and pre-authenticates users with Entra ID before forwarding traffic through a connector. Domain Services, cloud sync, and Verified ID do not publish on-premises web apps.

Question 45Describe the capabilities of Microsoft Entra

An administrator must ensure that a departing contractor's access to all applications is removed immediately and that another user's access is transferred. Which Microsoft Entra ID Governance feature supports this lifecycle?

  1. Conditional Access session controls
  2. Lifecycle workflows Correct answer.
  3. Identity Protection risk policies
  4. Entra ID B2C custom policies

Explanation

Lifecycle workflows automate joiner, mover, and leaver tasks such as disabling accounts and reassigning access. Conditional Access, Identity Protection, and B2C policies enforce or evaluate access rather than orchestrate lifecycle tasks.

Question 46Describe the capabilities of Microsoft Entra

Which statement accurately describes the difference between Microsoft Entra ID P1 and P2 licensing for identity governance?

  1. P2 removes Conditional Access and replaces it with security defaults
  2. P1 includes Identity Protection while P2 adds only Conditional Access
  3. P1 and P2 are identical in every feature except support hours
  4. P2 includes Identity Protection and Privileged Identity Management, which P1 does not Correct answer.

Explanation

Entra ID P2 adds Identity Protection and Privileged Identity Management on top of the P1 feature set, which already includes Conditional Access. The tiers differ substantially in governance and risk capabilities, not just support.

Question 47Describe the capabilities of Microsoft Entra

A user's sign-in is flagged as high risk. The security team wants the user to complete MFA before access is granted, and to force a password change if risk persists. Which configuration achieves this?

  1. Security defaults enabled for the tenant
  2. A Conditional Access policy using sign-in risk as a condition with grant controls for MFA and password change Correct answer.
  3. A dynamic group rule based on department
  4. An access review assigned to the user's manager

Explanation

Conditional Access can use Identity Protection sign-in risk as a condition and require MFA or password change as grant controls. Security defaults apply uniformly, while access reviews and dynamic groups do not respond to risk.

Question 48Describe the capabilities of Microsoft Entra

Which Microsoft Entra capability verifies a user's identity once and issues a cryptographically signed credential that a relying party can validate without contacting the issuer?

  1. Microsoft Entra Verified ID Correct answer.
  2. Microsoft Entra Connect cloud sync
  3. Microsoft Entra ID B2B collaboration
  4. Microsoft Entra Password Protection

Explanation

Verified ID implements decentralized identity standards so issuers sign verifiable credentials that verifiers can validate offline. B2B, Password Protection, and cloud sync serve different identity functions.

Question 49Describe the capabilities of Microsoft Entra

An organization needs to enforce that only compliant, hybrid-joined devices can access Microsoft 365 from outside the office, while allowing any device from the office network. Which combination of Microsoft Entra capabilities is required?

  1. Administrative units plus PIM
  2. Conditional Access device state conditions plus named locations Correct answer.
  3. Access packages plus access reviews
  4. Security defaults plus per-user MFA

Explanation

Conditional Access can require compliant or hybrid-joined device state as a grant control and treat the office IP range as a named location exception. The other combinations address MFA, governance, or delegation rather than device-based access.

Question 50Describe the capabilities of Microsoft Entra

A company wants to give new employees a time-limited code they can use to register MFA methods before their password is issued. Which Microsoft Entra feature fits?

  1. Windows Hello for Business
  2. Temporary Access Pass Correct answer.
  3. Self-service password reset
  4. Certificate-based authentication

Explanation

Temporary Access Pass is a time-limited, reusable or single-use code that lets users register passwordless methods during onboarding. SSPR requires an existing password, and Windows Hello and certificate authentication need prior enrollment.