MCSE MSCE Identity Management & Access Solutions 3

Question 1

You are configuring Azure AD Connect and need users to sign in with their on-premises UPN suffix, which is non-routable (e.g., corp.local). What should you do?

Accepted Answer

Change the on-premises UPN suffix to match a verified Azure AD domain

Answer

Enable Password Hash Synchronization and ignore the suffix mismatch

Answer

Use the sAMAccountName attribute as the Azure AD UPN

Answer

Configure AD FS to translate the UPN at the federation boundary

Question 2

Which Azure AD Identity Protection signal automatically elevates a sign-in risk level when credentials are detected in a known breach database?

Accepted Answer

Leaked credentials

Answer

Atypical travel

Answer

Anonymous IP address

Answer

Malware-linked IP address

Question 3

An application registered in Azure AD uses the client credentials flow. Which entity authenticates in this flow?

Accepted Answer

The application itself using its own identity

Answer

A delegated user with MFA

Answer

A service account in on-premises AD

Answer

An Azure AD B2B guest user

Question 4

You want to ensure that users in the Sales group can only access Salesforce from managed devices and only during business hours. Which Azure AD feature should you use?

Accepted Answer

Conditional Access policy targeting the Sales group with device and time conditions

Answer

Azure AD group-based licensing

Answer

Azure AD Application Proxy with pre-authentication

Answer

Microsoft Entra Permissions Management

Question 5

When configuring Azure AD Privileged Identity Management for a role, what is the 'activation maximum duration' setting?

Accepted Answer

The maximum time a user can keep a role active after requesting it

Answer

How long a user remains in the eligible assignment list

Answer

The time window in which a user must approve an activation request

Answer

The duration before an access review is triggered

Question 6

A user reports they cannot complete SSPR (Self-Service Password Reset). You confirm the user has a mobile phone registered. What is the most likely reason SSPR fails?

Accepted Answer

SSPR is not licensed or not enabled for that user's group

Answer

The user's account is cloud-only and SSPR requires hybrid writeback

Answer

The user must register at least two authentication methods per SSPR policy

Answer

The mobile phone number format is invalid in Azure AD

Question 7

Which claim in a JSON Web Token (JWT) identifies the intended audience of the token (i.e., the resource it was issued for)?

Accepted Answer

aud

Answer

iss

Answer

sub

Answer

exp