Free Microsoft Identity and Access Administrator Dumps Questions and Answers — Questions and Answers
Question 1: To achieve the monitoring criteria, you must configure the detection of many staged attacks. <br> What should you do?
- Create a workbook.
- Customize the Azure Sentinel rule logic.
- Add Azure Sentinel data connectors. (Correct answer)
- Add an Azure Sentinel playbook.
Correct answer: Add Azure Sentinel data connectors.
Azure Sentinel is a SIEM, and before it can detect staged or multi-stage attacks it must first ingest security data—that ingestion is done through data connectors. Workbooks only visualize data, custom rule logic and playbooks operate on data that has already been collected, so none of them work until the connectors are in place.
Question 2: For users who connect from the Boston office, you must establish the MFA settings. Both the access requirements and the authentication criteria must be satisfied by the solution. <br> What should you configure?
- Trusted IPs that have a private IP address range
- Trusted IPs that have a public IP address range
- Named locations that have a public IP address range correct (Correct answer)
- Named locations that have a private IP address range
Correct answer: Named locations that have a public IP address range correct
Named locations defined by the office's public IP address range let Conditional Access recognize Boston sign-ins and apply the correct MFA settings, because Azure AD sees the office's public (not private) egress IP. Trusted IPs are a legacy MFA construct, and private IP ranges are never visible to Azure AD from the internet, so those options can't reliably identify the location.
Question 3: The authentication criteria for credentials that have been disclosed must be met.<br> What should you do?
- Configure Azure AD Password Protection.
- Enable federation with PingFederate in Azure AD Connect.
- Configure an authentication method policy in Azure A
- Enable password hash synchronization in Azure AD Connect.correct (Correct answer)
Correct answer: Enable password hash synchronization in Azure AD Connect.correct
Password hash synchronization sends hashes of on-premises passwords to Azure AD, which is what enables the leaked-credential (Identity Protection) detections that flag disclosed passwords. Azure AD Password Protection only blocks weak/banned passwords, PingFederate federation hands authentication off to a third party, and authentication method policies govern MFA methods—none of which validate against known-breached credentials.
Question 4: Your Microsoft Exchange organization makes use of the contoso.com SMTP address space. <br> Several users use their contoso.com email address for self-service sign-up to Azure Active Directory (Azure AD). <br> You gain global administrator privileges to the Azure AD tenant that contains the self-signed users. <br> You need to prevent the users from creating user accounts in the contoso.com Azure AD tenant for self-service sign-up to Microsoft 365 services <br> <br> Which PowerShell cmdlet should you run?
- Set-MsolCompanySettings
- Update-MsolfederateDomain
- Set-Mso1DomaininFederationSettings
- Set-MsolCompanySettingscorrect (Correct answer)
Correct answer: Set-MsolCompanySettingscorrect
Set-MsolCompanySettings configures tenant-wide properties, including the AllowEmailVerifiedUsers/self-service sign-up behavior, so it's the cmdlet that prevents users from self-creating accounts in the contoso.com tenant. Update-MsolFederatedDomain and Set-MsolDomainFederationSettings manage domain federation, not self-service sign-up.
Question 5: Azure AD Identity Protection is turned on for the Azure Active Directory (Azure AD) tenant conto.so.com. Implementing a sign-in risk remediation policy is necessary without restricting access. <br> What should you do first?
- Enforce Azure AD Password Protection.
- Configure access reviews in Azure A
- Configure self-service password reset (SSPR) for all users.
- Implement multi-factor authentication (MFA) for all users.correct (Correct answer)
Correct answer: Implement multi-factor authentication (MFA) for all users.correct
MFA is the standard remediation action for sign-in risk policies because it lets users prove their identity and self-remediate the risk without being blocked from access. Password Protection, access reviews, and SSPR don't serve as the in-line risk remediation step for a risky sign-in, so MFA must be enabled first.
Question 6: ‥ You have an Azure Active Directory (Azure AD) tenant. <br> ‥ For the tenant, Users can register applications if set to No. <br> ‥ A user named Admin1 must deploy a new cloud app named App1. <br> ‥ You need to ensure that Admin1 can register App1 in Azure AD. The solution must use the principle of least privilege. <br> <br> Which role should you assign to Admin1?
- App Configuration Data Owner for Subscription1.
- Cloud application administrator in Azure AD.
- Managed Application Contributor for Subscription1.
- Application developer in Azure AD. (Correct answer)
Correct answer: Application developer in Azure AD.
The Application Developer role grants exactly the ability to register applications—even when the tenant-wide 'users can register applications' setting is off—while giving no other privileges, satisfying least privilege. Cloud Application Administrator is far broader, and the two Azure RBAC roles (App Configuration Data Owner, Managed Application Contributor) apply to Azure resources/subscriptions, not Azure AD app registration.
Question 7: An Azure Active Directory (Azure AD) tenant with the name contoso.com is connected to the Active Directory forest contoso.com on your network using Azure AD Connect. Users who have the extensionAttribute15 property set to NoSync must not be synchronized. <br> <br> What should you do in Azure AD Connect?
- Configure a Full Import run profile.
- Create an inbound synchronization rule for the Windows Azure Active Directory connector.
- Configure an Export run profile.
- Create an inbound synchronization rule for the Active Directory Domain Services connector. (Correct answer)
Correct answer: Create an inbound synchronization rule for the Active Directory Domain Services connector.
Objects flow from on-premises AD into the metaverse through the Active Directory Domain Services connector, so an inbound rule on that connector is where you filter out users whose extensionAttribute15 equals NoSync. An inbound rule on the Azure AD connector handles objects coming the other direction, and import/export run profiles only move data—they don't define filtering logic.
Free Microsoft Identity and Access Administrator Dumps Questions and Answers
To achieve the monitoring criteria, you must configure the detection of many staged attacks.
What should you do?