MCSE MSCE Identity Management & Access Solutions 2 — Questions and Answers
Question 1: A company needs to allow external partners to access internal SharePoint sites without creating AD accounts for them. Which Azure AD feature should you configure?
- Azure AD B2C
- Azure AD B2B collaboration (Correct answer)
- Azure AD Domain Services
- AD FS claim rules
Correct answer: Azure AD B2B collaboration
Azure AD B2B collaboration lets you invite external users using their own identity provider without managing their credentials.
Question 2: You want to enforce that users can only register MFA methods from a corporate network. Which Azure AD feature enforces this?
- Conditional Access policy with network location condition (Correct answer)
- Azure AD Identity Protection risk policy
- MFA trusted IPs in legacy MFA settings
- Authentication strengths policy
Correct answer: Conditional Access policy with network location condition
A Conditional Access policy with a named location (network) condition can restrict MFA registration to trusted networks.
Question 3: An administrator needs to review which users have been assigned the Global Administrator role over the last 90 days. Where is this information found?
- Azure AD Sign-in logs
- Azure AD Audit logs
- Azure AD Privileged Identity Management — Role assignment history (Correct answer)
- Microsoft Entra Permissions Management
Correct answer: Azure AD Privileged Identity Management — Role assignment history
PIM maintains a detailed history of role assignments and activations, making it the correct source for this audit.
Question 4: Which token type does Azure AD issue that contains a user's group memberships and is used by resource applications to make authorization decisions?
- Refresh token
- ID token
- Access token (Correct answer)
- SAML assertion
Correct answer: Access token
Access tokens contain claims such as group memberships and are presented to resource APIs to authorize requests.
Question 5: Your organization uses AD FS. You want to migrate relying party trusts to Azure AD without disrupting users. Which tool automates the compatibility assessment?
- Azure AD Connect Health
- AD FS Migration Toolkit (AD FS application activity report) (Correct answer)
- Microsoft Entra Application Proxy
- Azure Migrate
Correct answer: AD FS Migration Toolkit (AD FS application activity report)
The AD FS application activity report in Azure AD analyzes relying party trusts and flags any that need remediation before migration.
Question 6: A Conditional Access policy is set to require a compliant device. A user with a non-compliant device tries to access Exchange Online. What is the result?
- The user is prompted for MFA and then granted access
- Access is blocked regardless of MFA completion (Correct answer)
- The user is redirected to Intune enrollment automatically
- The user receives a time-limited access token
Correct answer: Access is blocked regardless of MFA completion
When a Conditional Access grant control requires device compliance, non-compliant devices are blocked even if MFA is satisfied.
Question 7: You need to synchronize on-premises AD password hashes to Azure AD so users can sign in to cloud apps with the same password. Which sync method should you enable?
- Pass-through Authentication
- Password Hash Synchronization (Correct answer)
- AD FS federation
- Azure AD Seamless SSO only
Correct answer: Password Hash Synchronization
Password Hash Synchronization (PHS) copies hashed password hashes to Azure AD, enabling cloud authentication with on-premises credentials.
MCSE MSCE Identity Management & Access Solutions 2
A company needs to allow external partners to access internal SharePoint sites without creating AD accounts for them.
Which Azure AD feature should you configure?