MCSE MSCE Identity Management & Access Solutions 3 — Questions and Answers
Question 1: You are configuring Azure AD Connect and need users to sign in with their on-premises UPN suffix, which is non-routable (e.g., corp.local). What should you do?
- Change the on-premises UPN suffix to match a verified Azure AD domain (Correct answer)
- Enable Password Hash Synchronization and ignore the suffix mismatch
- Use the sAMAccountName attribute as the Azure AD UPN
- Configure AD FS to translate the UPN at the federation boundary
Correct answer: Change the on-premises UPN suffix to match a verified Azure AD domain
Azure AD requires a routable, verified domain for UPNs; the on-premises suffix must be updated to a domain verified in Azure AD.
Question 2: Which Azure AD Identity Protection signal automatically elevates a sign-in risk level when credentials are detected in a known breach database?
- Atypical travel
- Leaked credentials (Correct answer)
- Anonymous IP address
- Malware-linked IP address
Correct answer: Leaked credentials
The 'Leaked credentials' detection fires when Azure AD finds a user's credentials in publicly exposed breach data.
Question 3: An application registered in Azure AD uses the client credentials flow. Which entity authenticates in this flow?
- A delegated user with MFA
- The application itself using its own identity (Correct answer)
- A service account in on-premises AD
- An Azure AD B2B guest user
Correct answer: The application itself using its own identity
Client credentials flow is a daemon/service pattern where the application authenticates as itself using a client secret or certificate.
Question 4: You want to ensure that users in the Sales group can only access Salesforce from managed devices and only during business hours. Which Azure AD feature should you use?
- Azure AD group-based licensing
- Conditional Access policy targeting the Sales group with device and time conditions (Correct answer)
- Azure AD Application Proxy with pre-authentication
- Microsoft Entra Permissions Management
Correct answer: Conditional Access policy targeting the Sales group with device and time conditions
Conditional Access policies support targeting specific groups and combining device compliance with named location/time-based conditions.
Question 5: When configuring Azure AD Privileged Identity Management for a role, what is the 'activation maximum duration' setting?
- How long a user remains in the eligible assignment list
- The maximum time a user can keep a role active after requesting it (Correct answer)
- The time window in which a user must approve an activation request
- The duration before an access review is triggered
Correct answer: The maximum time a user can keep a role active after requesting it
Activation maximum duration limits how many hours an eligible user can hold a role active before it automatically deactivates.
Question 6: A user reports they cannot complete SSPR (Self-Service Password Reset). You confirm the user has a mobile phone registered. What is the most likely reason SSPR fails?
- The user's account is cloud-only and SSPR requires hybrid writeback
- SSPR is not licensed or not enabled for that user's group (Correct answer)
- The user must register at least two authentication methods per SSPR policy
- The mobile phone number format is invalid in Azure AD
Correct answer: SSPR is not licensed or not enabled for that user's group
SSPR must be enabled and scoped to the user's group; if the user's group is not in the SSPR-enabled scope, they cannot use it.
Question 7: Which claim in a JSON Web Token (JWT) identifies the intended audience of the token (i.e., the resource it was issued for)?
- iss
- sub
- aud (Correct answer)
- exp
Correct answer: aud
The 'aud' (audience) claim specifies the resource or application the token is intended for, and resource APIs should validate it.
MCSE MSCE Identity Management & Access Solutions 3
You are configuring Azure AD Connect and need users to sign in with their on-premises UPN suffix, which is non-routable (e.g., corp.local).
What should you do?