MCSE MSCE Identity Management & Access Solutions 5 — Questions and Answers
Question 1: You need to configure Azure AD so that users who sign in from a risky IP address are automatically required to change their password. Which feature combination achieves this?
- Conditional Access policy + Azure AD SSPR
- Azure AD Identity Protection user risk policy set to require password change (Correct answer)
- Azure AD Identity Protection sign-in risk policy set to block
- Named locations + MFA registration policy
Correct answer: Azure AD Identity Protection user risk policy set to require password change
An Identity Protection user risk policy can require a secure password change when user risk (elevated by risky sign-ins) meets the threshold.
Question 2: An organization wants to use Azure AD as an identity provider for a SaaS app that supports SAML 2.0. What must be configured in the SaaS app to trust Azure AD?
- Azure AD's OAuth 2.0 authorization endpoint URL
- Azure AD's SAML signing certificate and issuer URI (Correct answer)
- Azure AD's OpenID Connect discovery document
- Azure AD B2C user flow endpoint
Correct answer: Azure AD's SAML signing certificate and issuer URI
For SAML federation, the relying party (SaaS app) must be configured with Azure AD's signing certificate and the issuer (Entity ID) so it can validate SAML assertions.
Question 3: A company needs to provide secure remote access to an on-premises web app without opening firewall ports. Which Azure AD solution enables this?
- Azure VPN Gateway with P2S
- Azure AD Application Proxy (Correct answer)
- Azure AD B2B collaboration
- AD FS Web Application Proxy
Correct answer: Azure AD Application Proxy
Azure AD Application Proxy uses outbound connections from an on-premises connector to publish internal apps securely without inbound firewall rules.
Question 4: Which Azure AD Conditional Access session control limits the duration of browser sessions so users must re-authenticate after a specified period of inactivity?
- Sign-in frequency control (Correct answer)
- Persistent browser session control set to 'Never persistent'
- Continuous access evaluation (CAE)
- Token lifetime policy via PowerShell
Correct answer: Sign-in frequency control
The sign-in frequency session control in Conditional Access forces re-authentication after a configurable period, regardless of persistent session state.
Question 5: You need to implement entitlement management so that external users can request access to a set of SharePoint sites, Teams, and an app registration as a bundle. What Azure AD object should you create?
- An access package in Azure AD Entitlement Management (Correct answer)
- A dynamic group with external user membership rules
- A Conditional Access policy scoped to guest accounts
- An Azure AD B2C user flow with custom policies
Correct answer: An access package in Azure AD Entitlement Management
Access packages in Entitlement Management bundle multiple resources (groups, apps, SharePoint sites) and allow external users to request access through a self-service workflow.
Question 6: Which protocol does Azure AD use when an application requests a token on behalf of a signed-in user to call a downstream API?
- OAuth 2.0 Authorization Code flow
- OAuth 2.0 On-Behalf-Of (OBO) flow (Correct answer)
- SAML 2.0 assertion bearer grant
- OpenID Connect hybrid flow
Correct answer: OAuth 2.0 On-Behalf-Of (OBO) flow
The On-Behalf-Of flow allows a middle-tier API to exchange an incoming access token for a new token scoped to a downstream API while preserving the user's identity.
Question 7: An Azure AD tenant has Continuous Access Evaluation (CAE) enabled. A user's account is disabled in Azure AD. Which of the following best describes what happens to an active CAE-capable session?
- The session continues until the access token's standard 1-hour lifetime expires
- The resource provider is notified and revokes the session within minutes (Correct answer)
- The user must manually sign out before access is terminated
- CAE only applies to risky sign-ins, not account disablement
Correct answer: The resource provider is notified and revokes the session within minutes
CAE enables near-real-time revocation; when an account is disabled, Azure AD sends a critical event to CAE-capable resource providers that immediately terminates active sessions.
MCSE MSCE Identity Management & Access Solutions 5
You need to configure Azure AD so that users who sign in from a risky IP address are automatically required to change their password.
Which feature combination achieves this?