Free Microsoft Identity and Access Administrator Certification Questions and Answers — Questions and Answers
Question 1: Your business recently adopted Privileged Identity Management for Azure Active Directory (Azure AD) (PIM). You analyze the roles in PIM and find that all 15 employees in the company's IT division have permanent security administrator privileges. The IT department users should only have access to the Security administrator job when necessary, you must make sure. How should the Security administrator role assignment be configured?
- Expire active assignments after from the Role settings details
- Expire eligible assignments after from the Role settings details
- Assignment type to Eligible (Correct answer)
- Assignment type to Active
Correct answer: Assignment type to Eligible
Setting the assignment type to Eligible converts the standing Security Administrator access into just-in-time access, so the IT staff must activate the role only when needed instead of holding it permanently. Active assignment keeps the role always on, and the 'expire assignments after' settings only cap how long an assignment lasts—they don't make it on-demand.
Question 2: You have a tenant called contoso.com in Azure Active Directory (Azure AD). Policies governing conditional access are applied to all users that run applications that are registered in Azure AD. The users must not be allowed to use legacy authentication. What ought to be covered by the conditional access policies to weed out attempts at legacy authentication?
- A sign-in risk condition
- Cloud apps or actions condition
- User risk condition
- Client apps condition (Correct answer)
Correct answer: Client apps condition
The Client apps condition in Conditional Access lets you target legacy authentication clients (those that can't perform modern auth), so you can block them specifically. Sign-in risk, user risk, and cloud apps conditions target other signals and don't distinguish legacy versus modern authentication protocols.
Question 3: Your Azure Active Directory (Azure AD) tenancy already exists. To look into previous sign-ins, you must look via the Azure AD sign-ins log. How long are events kept in the sign-in log by Azure AD?
- 365 days
- 30 days (Correct answer)
- 14 days
- 90 days
Correct answer: 30 days
By default Azure AD retains sign-in log events for 30 days in the portal. To keep them longer (up to 90 days requires a premium license, and beyond that needs export) you must route them to Log Analytics or storage, but the built-in retention is 30 days.
Question 4: You set up a new Microsoft 365 tenant to utilize the contoso.com domain name by default. By utilizing conditional access restrictions, you must make sure that you have control over who has access to Microsoft 365 resources. What should you do first?
- Disable Security defaults (Correct answer)
- Disable the User consent settings
- Configure password protection for Windows Server Active Directory
- Configure a multi-factor authentication (MFA) registration policy
Correct answer: Disable Security defaults
New Microsoft 365 tenants have Security defaults enabled, and Security defaults are mutually exclusive with Conditional Access—you can't create custom CA policies while they're on. So disabling Security defaults is the required first step; the other options are unrelated configuration tasks that don't unblock Conditional Access.
Question 5: An Azure Active Directory (Azure AD) tenant and your Active Directory domain are synced. A VPN server that authenticates to the on-premises Active Directory domain is part of the on-premises network. The Azure Multi-Factor Authentication feature is NOT supported by the VPN server (MFA). You must suggest a method for enabling Azure MFA for VPN connections. What should the recommendation contain?
- An Azure AD Password Protection proxy
- Azure AD Application Proxy
- A pass-through authentication proxy
- Network Policy Server (NPS) (Correct answer)
Correct answer: Network Policy Server (NPS)
A Network Policy Server (NPS) with the Azure MFA extension acts as a RADIUS proxy, letting the VPN server hand authentication requests to Azure MFA even though it has no native MFA support. Password Protection proxy, Application Proxy, and pass-through authentication agents serve different purposes and don't bridge RADIUS-based VPN auth to Azure MFA.
Question 6: You have a tenant called contoso.com in Azure Active Directory (Azure AD). At Fabrikam, Inc., you use entitlement management to grant users access to resources. The website fabrikam.com is operated by Fabrikam. Once access is no longer necessary, Fabrikam users must be automatically deleted from the tenant. The following settings require configuration: <br> <br> - Block external users from signing in to this directory: No <br> - Remove external user: Yes <br> - Number of days before removing the external user from this directory: 90 <br> <br> What should you configure on the Identity Governance blade?
- Terms of use
- Access reviews
- Access packages
- Settings (Correct answer)
Correct answer: Settings
Entitlement management's external-user lifecycle controls—blocking sign-in, removing external users, and the number of days before removal—are configured under the Settings area of the Identity Governance blade. Terms of use, access reviews, and access packages manage other aspects and don't hold these global removal settings.
Question 7: You are a Premium P2 tenant of Azure Active Directory. You establish a workspace for Log Analytics. You must make sure that using Azure Monitor, you can access data from the Azure Active Directory (Azure AD) audit logs. <br> What should you do first?
- Run the Get-AzureADAuditDirectoryLogs cmdlet
- Modify the Diagnostics settings for Azure A (Correct answer)
- Create an Azure AD workbook
- Run the Set-AzureADTenantDetail cmdlet
Correct answer: Modify the Diagnostics settings for Azure A
Sending Azure AD audit logs to a Log Analytics workspace is done by configuring the Diagnostics settings for Azure AD and selecting the workspace as the destination. The Get-AzureADAuditDirectoryLogs cmdlet only reads logs, workbooks visualize existing data, and Set-AzureADTenantDetail edits tenant properties—none of them route logs to Azure Monitor.
Free Microsoft Identity and Access Administrator Certification Questions and Answers
Your business recently adopted Privileged Identity Management for Azure Active Directory (Azure AD) (PIM).
You analyze the roles in PIM and find that all 15 employees in the company's IT division have permanent security administrator privileges.
The IT department users should only have access to the Security administrator job when necessary, you must make sure.
How should the Security administrator role assignment be configured?