MCSE MSCE Identity Management & Access Solutions 4 — Questions and Answers
Question 1: You need to grant an application permission to read all users' calendars in Microsoft 365 without a signed-in user. Which permission type should you assign?
- Delegated permission with user consent
- Application permission (app role) with admin consent (Correct answer)
- User-impersonation OAuth scope
- Federated identity credential
Correct answer: Application permission (app role) with admin consent
Application permissions allow a service to act without a user context and require admin consent due to their broad scope.
Question 2: An enterprise wants to prevent Azure AD users from consenting to third-party apps that request access to company data. What setting should an admin configure?
- Disable enterprise application SSO
- Set user consent settings to 'Do not allow user consent' (Correct answer)
- Enable Conditional Access for app registration
- Enable Azure AD Identity Protection user risk policy
Correct answer: Set user consent settings to 'Do not allow user consent'
Setting user consent to 'Do not allow user consent' forces all app consent requests to go through admin approval workflows.
Question 3: You are using Azure AD Pass-through Authentication (PTA). Where does the actual password validation occur?
- In Azure AD cloud infrastructure
- On the on-premises Active Directory domain controllers (Correct answer)
- In the Azure AD Connect sync engine
- In an AD FS proxy server
Correct answer: On the on-premises Active Directory domain controllers
PTA forwards the sign-in password validation request to on-premises DCs via lightweight agents; passwords never leave your network.
Question 4: Which Azure AD feature allows an application to verify its identity using a certificate stored in Azure Key Vault instead of a client secret?
- Managed Identity
- Certificate-based app credential (client assertion) (Correct answer)
- Workload Identity Federation
- Service Principal with app role
Correct answer: Certificate-based app credential (client assertion)
Applications can authenticate to Azure AD using a certificate (client assertion) instead of a shared secret, which is more secure.
Question 5: A company runs workloads in Azure and needs the workload to access Key Vault without storing any credentials in code. What is the recommended solution?
- Store a client secret in an environment variable
- Assign a system-assigned managed identity to the resource and grant it Key Vault access (Correct answer)
- Use a service principal with a certificate uploaded to the VM
- Configure B2B direct connect for the workload
Correct answer: Assign a system-assigned managed identity to the resource and grant it Key Vault access
System-assigned managed identities provide an automatically managed credential tied to the Azure resource, eliminating the need to store secrets.
Question 6: During an Azure AD access review of group membership, a reviewer takes no action on a member before the review deadline. The access review is configured to 'Auto-apply results' and the default action is 'Remove access'. What happens?
- The member retains access until manually reviewed
- The member's access is removed automatically at review end (Correct answer)
- The review period is extended by 7 days
- The member is sent an email asking them to self-attest
Correct answer: The member's access is removed automatically at review end
When auto-apply is enabled and no decision is made, the configured default action (Remove access) is applied automatically.
Question 7: Which Azure AD feature enables you to define which attributes are synchronized from on-premises AD to Azure AD, filtering out sensitive attributes like payroll data?
- Azure AD Connect attribute filtering (Correct answer)
- Azure AD Connect Health scoping filters
- Dynamic group membership rules
- Custom security attributes in Azure AD
Correct answer: Azure AD Connect attribute filtering
Azure AD Connect's attribute filtering lets administrators control exactly which object attributes are included in synchronization to the cloud.
MCSE MSCE Identity Management & Access Solutions 4
You need to grant an application permission to read all users' calendars in Microsoft 365 without a signed-in user.
Which permission type should you assign?