Practice Exams:

View All

Microsoft 365 Copilot AB-900 Security Objects Sign In Troubleshooting Identity Secure Score Practice Test

Skills 1.3 • 30 original questions

This Microsoft AB-900 Microsoft 365 Copilot and Agent Administration Fundamentals practice test focuses on security objects sign in troubleshooting identity secure score and audit logs through original scenario-based questions aligned to the Skills measured as of July 22, 2026. Use the full ExamSnap AB-900 collection for broader practice across all current skill areas. For broader exam preparation, review the Microsoft AB-900 Exam Dumps page.

Instructions: Select the best answer for each question. Review the explanation after answering; each distractor includes a reason it is not the best choice for that scenario.

Question 1

A design review at Fabrikam identifies one specific goal: represent one human identity that signs in to Microsoft 365. Which option best matches that goal? The solution should preserve least privilege and existing governance where possible.

Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Evaluate authorization after authentication to determine what the identity is allowed to access or do
Use the Microsoft 365 admin center to review the tenant domain names and organization settings

Correct answer: A

Why: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This directly addresses the stated requirement.

Option review:

A: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This directly addresses the stated requirement.

B: An app registration creates or represents the application object; an enterprise application is the tenant service principal used for local access and sign-in configuration. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to represent one human identity that signs in to Microsoft 365.

C: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to represent one human identity that signs in to Microsoft 365.

D: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to represent one human identity that signs in to Microsoft 365.

E: The Microsoft 365 admin center provides tenant-level configuration, including domains and organization settings. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to represent one human identity that signs in to Microsoft 365.

Learning point: Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities. Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported.

Question 2

The IT team at Wingtip Toys wants to inspect a failed sign-in before changing tenant-wide access policy. Which Microsoft 365 capability should it use? The team wants the smallest change that directly addresses the requirement.

Review Microsoft Entra sign-in information and the relevant Conditional Access, MFA, or risk details for the affected attempt
Use SharePoint administration and the appropriate site, library, or folder object for the requirement
Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Assign the appropriate Microsoft 365 license to the user or eligible group that needs the feature

Correct answer: A

Why: Microsoft Entra sign-in data exposes the authentication result, Conditional Access evaluation, and risk information needed for targeted troubleshooting. This directly addresses the stated requirement.

Option review:

A: Microsoft Entra sign-in data exposes the authentication result, Conditional Access evaluation, and risk information needed for targeted troubleshooting. This directly addresses the stated requirement.

B: SharePoint content is organized into sites, libraries, folders, and items; choosing the correct scope avoids applying a control too broadly or too narrowly. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to inspect a failed sign-in before changing tenant-wide access policy.

C: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to inspect a failed sign-in before changing tenant-wide access policy.

D: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to inspect a failed sign-in before changing tenant-wide access policy.

E: Feature access depends on the services included in the assigned license. Group-based licensing can simplify assignment for changing groups of users. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to inspect a failed sign-in before changing tenant-wide access policy.

Learning point: Review Microsoft Entra sign-in information and the relevant Conditional Access, MFA, or risk details for the affected attempt. Microsoft Entra sign-in data exposes the authentication result, Conditional Access evaluation, and risk information needed for targeted troubleshooting.

Question 3

While handling a identity hardening effort, the IT administrator needs to prioritize recommended changes that can improve the tenant identity security posture. Which answer most directly addresses the stated need? The decision must address the stated requirement rather than a different Microsoft 365 control.

Use Identity Secure Score to review identity-security recommendations and track posture improvements
Assign the appropriate Microsoft 365 license to the user or eligible group that needs the feature
Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity
Use the Microsoft 365 admin center to review the tenant domain names and organization settings
Use Microsoft Defender XDR to correlate alerts and investigate incidents across supported Microsoft security workloads

Correct answer: A

Why: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This directly addresses the stated requirement.

Option review:

A: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This directly addresses the stated requirement.

B: Feature access depends on the services included in the assigned license. Group-based licensing can simplify assignment for changing groups of users. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to prioritize recommended changes that can improve the tenant identity security posture.

C: Threat protection and intelligence provide detections, context, and indicators that help security teams investigate and respond to attacks. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to prioritize recommended changes that can improve the tenant identity security posture.

D: The Microsoft 365 admin center provides tenant-level configuration, including domains and organization settings. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to prioritize recommended changes that can improve the tenant identity security posture.

E: Defender XDR provides cross-domain detection, incident correlation, investigation, and response across Microsoft security signals. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to prioritize recommended changes that can improve the tenant identity security posture.

Learning point: Use Identity Secure Score to review identity-security recommendations and track posture improvements. Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure.

Question 4

A new administrator at Bellows College asks which Microsoft 365 feature is intended to review recorded user or administrator activity for an investigation. What is the best answer? The team will validate the result immediately after the change.

Use Microsoft Entra Privileged Identity Management to provide eligible, time-bound, and governed privileged-role activation
Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity

Correct answer: E

Why: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This directly addresses the stated requirement.

Option review:

A: PIM reduces standing privilege by governing when privileged roles are activated and can enforce approval, MFA, justification, and time limits. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review recorded user or administrator activity for an investigation.

B: Threat protection and intelligence provide detections, context, and indicators that help security teams investigate and respond to attacks. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review recorded user or administrator activity for an investigation.

C: An app registration creates or represents the application object; an enterprise application is the tenant service principal used for local access and sign-in configuration. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review recorded user or administrator activity for an investigation.

D: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review recorded user or administrator activity for an investigation.

E: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This directly addresses the stated requirement.

Learning point: Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity. Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations.

Question 5

Tailspin Toys is preparing a oversharing investigation. The team needs to choose between an individual user object and a group for a security assignment. What should the SharePoint administrator choose? No unrelated tenant settings should be changed.

Assign the appropriate Microsoft 365 license to the user or eligible group that needs the feature
Use Microsoft Entra ID for cloud identity, authentication, and access management
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity
Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities
Use the Exchange admin center to configure the required mailbox or distribution group

Correct answer: D

Why: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This directly addresses the stated requirement.

Option review:

A: Feature access depends on the services included in the assigned license. Group-based licensing can simplify assignment for changing groups of users. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to choose between an individual user object and a group for a security assignment.

B: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to choose between an individual user object and a group for a security assignment.

C: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to choose between an individual user object and a group for a security assignment.

D: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This directly addresses the stated requirement.

E: Mailboxes and distribution groups are Exchange Online recipient objects and are administered through Exchange management experiences. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to choose between an individual user object and a group for a security assignment.

Question 6

A support case at Coho Winery says administrators must find why a user was blocked by Conditional Access during sign-in. Which option is the best fit? The environment uses current Microsoft 365 services and the July 2026 AB-900 scope.

Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Use SharePoint administration and the appropriate site, library, or folder object for the requirement
Review Microsoft Entra sign-in information and the relevant Conditional Access, MFA, or risk details for the affected attempt
Use the Microsoft 365 admin center to review the tenant domain names and organization settings
Use Microsoft Entra Privileged Identity Management to provide eligible, time-bound, and governed privileged-role activation

Correct answer: C

Option review:

A: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to find why a user was blocked by Conditional Access during sign-in.

B: SharePoint content is organized into sites, libraries, folders, and items; choosing the correct scope avoids applying a control too broadly or too narrowly. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to find why a user was blocked by Conditional Access during sign-in.

C: Microsoft Entra sign-in data exposes the authentication result, Conditional Access evaluation, and risk information needed for targeted troubleshooting. This directly addresses the stated requirement.

D: The Microsoft 365 admin center provides tenant-level configuration, including domains and organization settings. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to find why a user was blocked by Conditional Access during sign-in.

E: PIM reduces standing privilege by governing when privileged roles are activated and can enforce approval, MFA, justification, and time limits. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to find why a user was blocked by Conditional Access during sign-in.

Question 7

For a production readiness check at Humongous Insurance, which Microsoft 365 approach correctly addresses the need to interpret a score that summarizes identity-related security recommendations? The choice should follow normal Microsoft 365 administrative practice.

Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Use the Exchange admin center to configure the required mailbox or distribution group
Use Identity Secure Score to review identity-security recommendations and track posture improvements

Correct answer: E

Why: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This directly addresses the stated requirement.

Option review:

A: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to interpret a score that summarizes identity-related security recommendations.

B: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to interpret a score that summarizes identity-related security recommendations.

C: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to interpret a score that summarizes identity-related security recommendations.

D: Mailboxes and distribution groups are Exchange Online recipient objects and are administered through Exchange management experiences. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to interpret a score that summarizes identity-related security recommendations.

E: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This directly addresses the stated requirement.

Question 8

A new administrator at Adventure Works asks which Microsoft 365 feature is intended to verify whether a tenant configuration change occurred. What is the best answer? The administrator must choose the Microsoft 365 feature that matches the stated goal.

Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Use the Exchange admin center to configure the required mailbox or distribution group
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity
Use Identity Secure Score to review identity-security recommendations and track posture improvements

Correct answer: A

Why: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This directly addresses the stated requirement.

Option review:

A: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This directly addresses the stated requirement.

B: Mailboxes and distribution groups are Exchange Online recipient objects and are administered through Exchange management experiences. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to verify whether a tenant configuration change occurred.

C: An app registration creates or represents the application object; an enterprise application is the tenant service principal used for local access and sign-in configuration. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to verify whether a tenant configuration change occurred.

D: Threat protection and intelligence provide detections, context, and indicators that help security teams investigate and respond to attacks. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to verify whether a tenant configuration change occurred.

E: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to verify whether a tenant configuration change occurred.

Question 9

Blue Yonder Airlines has validated the surrounding services. The remaining requirement is to apply an access assignment to a reusable set of employees rather than each person individually. Which choice is correct? The team needs a direct administrative answer, not a broad redesign.

Use the Microsoft 365 admin center to review the tenant domain names and organization settings
Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Evaluate authorization after authentication to determine what the identity is allowed to access or do
Use the Exchange admin center to configure the required mailbox or distribution group
Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities

Correct answer: E

Why: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This directly addresses the stated requirement.

Option review:

A: The Microsoft 365 admin center provides tenant-level configuration, including domains and organization settings. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to apply an access assignment to a reusable set of employees rather than each person individually.

B: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to apply an access assignment to a reusable set of employees rather than each person individually.

C: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to apply an access assignment to a reusable set of employees rather than each person individually.

D: Mailboxes and distribution groups are Exchange Online recipient objects and are administered through Exchange management experiences. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to apply an access assignment to a reusable set of employees rather than each person individually.

E: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This directly addresses the stated requirement.

Question 10

An administrator reviewing agent governance review for Relecloud must determine whether MFA, a policy, or sign-in risk affected authentication. Which Microsoft 365 control or object should be used? The administrator wants an action that is easy to audit later.

Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities
Use Microsoft Entra Privileged Identity Management to provide eligible, time-bound, and governed privileged-role activation
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity
Review Microsoft Entra sign-in information and the relevant Conditional Access, MFA, or risk details for the affected attempt

Correct answer: E

Option review:

A: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to determine whether MFA, a policy, or sign-in risk affected authentication.

B: PIM reduces standing privilege by governing when privileged roles are activated and can enforce approval, MFA, justification, and time limits. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to determine whether MFA, a policy, or sign-in risk affected authentication.

C: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to determine whether MFA, a policy, or sign-in risk affected authentication.

D: Threat protection and intelligence provide detections, context, and indicators that help security teams investigate and respond to attacks. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to determine whether MFA, a policy, or sign-in risk affected authentication.

E: Microsoft Entra sign-in data exposes the authentication result, Conditional Access evaluation, and risk information needed for targeted troubleshooting. This directly addresses the stated requirement.

Question 11

A design review at Lamna Healthcare identifies one specific goal: track progress after implementing identity protection recommendations. Which option best matches that goal? The solution should preserve least privilege and existing governance where possible.

Use Microsoft Entra Privileged Identity Management to provide eligible, time-bound, and governed privileged-role activation
Use SharePoint administration and the appropriate site, library, or folder object for the requirement
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity
Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities
Use Identity Secure Score to review identity-security recommendations and track posture improvements

Correct answer: E

Why: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This directly addresses the stated requirement.

Option review:

A: PIM reduces standing privilege by governing when privileged roles are activated and can enforce approval, MFA, justification, and time limits. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to track progress after implementing identity protection recommendations.

B: SharePoint content is organized into sites, libraries, folders, and items; choosing the correct scope avoids applying a control too broadly or too narrowly. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to track progress after implementing identity protection recommendations.

C: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to track progress after implementing identity protection recommendations.

D: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to track progress after implementing identity protection recommendations.

E: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This directly addresses the stated requirement.

Question 12

A new administrator at Proseware asks which Microsoft 365 feature is intended to find who changed an administrative setting and when. What is the best answer? The team wants the smallest change that directly addresses the requirement.

Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Use Microsoft Entra ID for cloud identity, authentication, and access management
Use Microsoft Defender XDR to correlate alerts and investigate incidents across supported Microsoft security workloads
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach

Correct answer: A

Why: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This directly addresses the stated requirement.

Option review:

A: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This directly addresses the stated requirement.

B: An app registration creates or represents the application object; an enterprise application is the tenant service principal used for local access and sign-in configuration. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to find who changed an administrative setting and when.

C: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to find who changed an administrative setting and when.

D: Defender XDR provides cross-domain detection, incident correlation, investigation, and response across Microsoft security signals. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to find who changed an administrative setting and when.

E: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to find who changed an administrative setting and when.

Question 13

While handling a licensing change, the SharePoint administrator needs to represent one human identity that signs in to Microsoft 365. Which answer most directly addresses the stated need? The decision must address the stated requirement rather than a different Microsoft 365 control.

Use SharePoint administration and the appropriate site, library, or folder object for the requirement
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Use Microsoft Defender XDR to correlate alerts and investigate incidents across supported Microsoft security workloads
Assign the appropriate Microsoft 365 license to the user or eligible group that needs the feature
Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities

Correct answer: E

Why: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This directly addresses the stated requirement.

Option review:

A: SharePoint content is organized into sites, libraries, folders, and items; choosing the correct scope avoids applying a control too broadly or too narrowly. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to represent one human identity that signs in to Microsoft 365.

B: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to represent one human identity that signs in to Microsoft 365.

C: Defender XDR provides cross-domain detection, incident correlation, investigation, and response across Microsoft security signals. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to represent one human identity that signs in to Microsoft 365.

D: Feature access depends on the services included in the assigned license. Group-based licensing can simplify assignment for changing groups of users. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to represent one human identity that signs in to Microsoft 365.

E: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This directly addresses the stated requirement.

Question 14

During a governance workshop at City Power & Light, the Microsoft 365 administrator must inspect a failed sign-in before changing tenant-wide access policy. Which Microsoft 365 action or concept most directly satisfies the requirement? The team will validate the result immediately after the change.

Review Microsoft Entra sign-in information and the relevant Conditional Access, MFA, or risk details for the affected attempt
Assign the least-privileged SharePoint site role or permission level that satisfies the user requirement
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity
Use the Teams admin center and configure the relevant team, channel, or Teams policy

Correct answer: A

Option review:

B: SharePoint site roles and permissions should be scoped to the content and actions the user actually needs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to inspect a failed sign-in before changing tenant-wide access policy.

C: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to inspect a failed sign-in before changing tenant-wide access policy.

D: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to inspect a failed sign-in before changing tenant-wide access policy.

E: Teams administration covers collaboration objects and policies that govern Teams behavior and access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to inspect a failed sign-in before changing tenant-wide access policy.

Question 15

Northwind Traders is preparing a pilot rollout. The team needs to prioritize recommended changes that can improve the tenant identity security posture. What should the security administrator choose? No unrelated tenant settings should be changed.

Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities
Use the Exchange admin center to configure the required mailbox or distribution group
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Use Identity Secure Score to review identity-security recommendations and track posture improvements

Correct answer: E

Why: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This directly addresses the stated requirement.

Option review:

A: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to prioritize recommended changes that can improve the tenant identity security posture.

B: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to prioritize recommended changes that can improve the tenant identity security posture.

C: Mailboxes and distribution groups are Exchange Online recipient objects and are administered through Exchange management experiences. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to prioritize recommended changes that can improve the tenant identity security posture.

D: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to prioritize recommended changes that can improve the tenant identity security posture.

E: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This directly addresses the stated requirement.

Question 16

A new administrator at Fourth Coffee asks which Microsoft 365 feature is intended to review recorded user or administrator activity for an investigation. What is the best answer? The environment uses current Microsoft 365 services and the July 2026 AB-900 scope.

Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity
Review Microsoft Entra sign-in information and the relevant Conditional Access, MFA, or risk details for the affected attempt
Use the Microsoft 365 admin center to review the tenant domain names and organization settings
Use Identity Secure Score to review identity-security recommendations and track posture improvements
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity

Correct answer: E

Why: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This directly addresses the stated requirement.

Option review:

A: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review recorded user or administrator activity for an investigation.

B: Microsoft Entra sign-in data exposes the authentication result, Conditional Access evaluation, and risk information needed for targeted troubleshooting. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review recorded user or administrator activity for an investigation.

C: The Microsoft 365 admin center provides tenant-level configuration, including domains and organization settings. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review recorded user or administrator activity for an investigation.

D: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review recorded user or administrator activity for an investigation.

E: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This directly addresses the stated requirement.

Question 17

For a Copilot adoption project at Alpine Ski House, which Microsoft 365 approach correctly addresses the need to choose between an individual user object and a group for a security assignment? The choice should follow normal Microsoft 365 administrative practice.

Use Microsoft Defender XDR to correlate alerts and investigate incidents across supported Microsoft security workloads
Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity
Evaluate authorization after authentication to determine what the identity is allowed to access or do
Use the Exchange admin center to configure the required mailbox or distribution group
Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities

Correct answer: E

Why: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This directly addresses the stated requirement.

Option review:

A: Defender XDR provides cross-domain detection, incident correlation, investigation, and response across Microsoft security signals. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to choose between an individual user object and a group for a security assignment.

B: Threat protection and intelligence provide detections, context, and indicators that help security teams investigate and respond to attacks. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to choose between an individual user object and a group for a security assignment.

C: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to choose between an individual user object and a group for a security assignment.

D: Mailboxes and distribution groups are Exchange Online recipient objects and are administered through Exchange management experiences. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to choose between an individual user object and a group for a security assignment.

E: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This directly addresses the stated requirement.

Question 18

The compliance administrator at Contoso is asked to find why a user was blocked by Conditional Access during sign-in. What is the most appropriate next step? The administrator must choose the Microsoft 365 feature that matches the stated goal.

Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Evaluate authorization after authentication to determine what the identity is allowed to access or do
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Review Microsoft Entra sign-in information and the relevant Conditional Access, MFA, or risk details for the affected attempt
Use Microsoft Entra ID for cloud identity, authentication, and access management

Correct answer: D

Option review:

B: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to find why a user was blocked by Conditional Access during sign-in.

C: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to find why a user was blocked by Conditional Access during sign-in.

D: Microsoft Entra sign-in data exposes the authentication result, Conditional Access evaluation, and risk information needed for targeted troubleshooting. This directly addresses the stated requirement.

E: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to find why a user was blocked by Conditional Access during sign-in.

Question 19

Litware has validated the surrounding services. The remaining requirement is to interpret a score that summarizes identity-related security recommendations. Which choice is correct? The team needs a direct administrative answer, not a broad redesign.

Use Identity Secure Score to review identity-security recommendations and track posture improvements
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity
Evaluate authorization after authentication to determine what the identity is allowed to access or do

Correct answer: A

Why: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This directly addresses the stated requirement.

Option review:

A: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This directly addresses the stated requirement.

C: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to interpret a score that summarizes identity-related security recommendations.

D: Threat protection and intelligence provide detections, context, and indicators that help security teams investigate and respond to attacks. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to interpret a score that summarizes identity-related security recommendations.

E: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to interpret a score that summarizes identity-related security recommendations.

Question 20

A new administrator at Trey Research asks which Microsoft 365 feature is intended to verify whether a tenant configuration change occurred. What is the best answer? The administrator wants an action that is easy to audit later.

Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Use Microsoft Defender XDR to correlate alerts and investigate incidents across supported Microsoft security workloads
Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities
Use SharePoint administration and the appropriate site, library, or folder object for the requirement
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach

Correct answer: A

Why: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This directly addresses the stated requirement.

Option review:

A: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This directly addresses the stated requirement.

B: Defender XDR provides cross-domain detection, incident correlation, investigation, and response across Microsoft security signals. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to verify whether a tenant configuration change occurred.

C: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to verify whether a tenant configuration change occurred.

D: SharePoint content is organized into sites, libraries, folders, and items; choosing the correct scope avoids applying a control too broadly or too narrowly. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to verify whether a tenant configuration change occurred.

E: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to verify whether a tenant configuration change occurred.

Question 21

A design review at Consolidated Messenger identifies one specific goal: apply an access assignment to a reusable set of employees rather than each person individually. Which option best matches that goal? The solution should preserve least privilege and existing governance where possible.

Assign the least-privileged SharePoint site role or permission level that satisfies the user requirement
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Use SharePoint administration and the appropriate site, library, or folder object for the requirement
Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach

Correct answer: D

Why: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This directly addresses the stated requirement.

Option review:

A: SharePoint site roles and permissions should be scoped to the content and actions the user actually needs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to apply an access assignment to a reusable set of employees rather than each person individually.

B: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to apply an access assignment to a reusable set of employees rather than each person individually.

C: SharePoint content is organized into sites, libraries, folders, and items; choosing the correct scope avoids applying a control too broadly or too narrowly. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to apply an access assignment to a reusable set of employees rather than each person individually.

D: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This directly addresses the stated requirement.

E: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to apply an access assignment to a reusable set of employees rather than each person individually.

Question 22

The IT team at Woodgrove Bank wants to determine whether MFA, a policy, or sign-in risk affected authentication. Which Microsoft 365 capability should it use? The team wants the smallest change that directly addresses the requirement.

Review Microsoft Entra sign-in information and the relevant Conditional Access, MFA, or risk details for the affected attempt
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Use Identity Secure Score to review identity-security recommendations and track posture improvements

Correct answer: A

Option review:

B: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to determine whether MFA, a policy, or sign-in risk affected authentication.

C: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to determine whether MFA, a policy, or sign-in risk affected authentication.

D: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to determine whether MFA, a policy, or sign-in risk affected authentication.

E: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to determine whether MFA, a policy, or sign-in risk affected authentication.

Question 23

While handling a security review, the security administrator needs to track progress after implementing identity protection recommendations. Which answer most directly addresses the stated need? The decision must address the stated requirement rather than a different Microsoft 365 control.

Use Identity Secure Score to review identity-security recommendations and track posture improvements
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Assign the least-privileged SharePoint site role or permission level that satisfies the user requirement
Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials

Correct answer: A

Why: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This directly addresses the stated requirement.

Option review:

A: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This directly addresses the stated requirement.

B: An app registration creates or represents the application object; an enterprise application is the tenant service principal used for local access and sign-in configuration. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to track progress after implementing identity protection recommendations.

C: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to track progress after implementing identity protection recommendations.

D: SharePoint site roles and permissions should be scoped to the content and actions the user actually needs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to track progress after implementing identity protection recommendations.

E: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to track progress after implementing identity protection recommendations.

Question 24

A new administrator at Southridge Video asks which Microsoft 365 feature is intended to find who changed an administrative setting and when. What is the best answer? The team will validate the result immediately after the change.

Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Assign the appropriate Microsoft 365 license to the user or eligible group that needs the feature
Use SharePoint administration and the appropriate site, library, or folder object for the requirement
Evaluate authorization after authentication to determine what the identity is allowed to access or do
Use Identity Secure Score to review identity-security recommendations and track posture improvements

Correct answer: A

Why: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This directly addresses the stated requirement.

Option review:

A: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This directly addresses the stated requirement.

B: Feature access depends on the services included in the assigned license. Group-based licensing can simplify assignment for changing groups of users. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to find who changed an administrative setting and when.

C: SharePoint content is organized into sites, libraries, folders, and items; choosing the correct scope avoids applying a control too broadly or too narrowly. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to find who changed an administrative setting and when.

D: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to find who changed an administrative setting and when.

E: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to find who changed an administrative setting and when.

Question 25

Fabrikam is preparing a agent governance review. The team needs to represent one human identity that signs in to Microsoft 365. What should the Copilot administrator choose? No unrelated tenant settings should be changed.

Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities
Assign the least-privileged SharePoint site role or permission level that satisfies the user requirement
Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Use SharePoint administration and the appropriate site, library, or folder object for the requirement

Correct answer: A

Why: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This directly addresses the stated requirement.

Option review:

A: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This directly addresses the stated requirement.

B: SharePoint site roles and permissions should be scoped to the content and actions the user actually needs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to represent one human identity that signs in to Microsoft 365.

D: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to represent one human identity that signs in to Microsoft 365.

E: SharePoint content is organized into sites, libraries, folders, and items; choosing the correct scope avoids applying a control too broadly or too narrowly. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to represent one human identity that signs in to Microsoft 365.

Question 26

A support case at Wingtip Toys says administrators must inspect a failed sign-in before changing tenant-wide access policy. Which option is the best fit? The environment uses current Microsoft 365 services and the July 2026 AB-900 scope.

Use the Exchange admin center to configure the required mailbox or distribution group
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Evaluate authorization after authentication to determine what the identity is allowed to access or do
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Review Microsoft Entra sign-in information and the relevant Conditional Access, MFA, or risk details for the affected attempt

Correct answer: E

Option review:

A: Mailboxes and distribution groups are Exchange Online recipient objects and are administered through Exchange management experiences. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to inspect a failed sign-in before changing tenant-wide access policy.

B: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to inspect a failed sign-in before changing tenant-wide access policy.

C: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to inspect a failed sign-in before changing tenant-wide access policy.

D: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to inspect a failed sign-in before changing tenant-wide access policy.

Question 27

For a admin-center audit at VanArsdel, which Microsoft 365 approach correctly addresses the need to prioritize recommended changes that can improve the tenant identity security posture? The choice should follow normal Microsoft 365 administrative practice.

Use SharePoint administration and the appropriate site, library, or folder object for the requirement
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Use Identity Secure Score to review identity-security recommendations and track posture improvements
Use Microsoft Defender XDR to correlate alerts and investigate incidents across supported Microsoft security workloads

Correct answer: D

Why: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This directly addresses the stated requirement.

Option review:

A: SharePoint content is organized into sites, libraries, folders, and items; choosing the correct scope avoids applying a control too broadly or too narrowly. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to prioritize recommended changes that can improve the tenant identity security posture.

B: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to prioritize recommended changes that can improve the tenant identity security posture.

C: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to prioritize recommended changes that can improve the tenant identity security posture.

D: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This directly addresses the stated requirement.

Question 28

A new administrator at Bellows College asks which Microsoft 365 feature is intended to review recorded user or administrator activity for an investigation. What is the best answer? The administrator must choose the Microsoft 365 feature that matches the stated goal.

Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities
Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity
Use the Microsoft 365 admin center to review the tenant domain names and organization settings
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity

Correct answer: E

Why: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This directly addresses the stated requirement.

Option review:

A: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review recorded user or administrator activity for an investigation.

D: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review recorded user or administrator activity for an investigation.

E: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This directly addresses the stated requirement.

Question 29

Tailspin Toys has validated the surrounding services. The remaining requirement is to choose between an individual user object and a group for a security assignment. Which choice is correct? The team needs a direct administrative answer, not a broad redesign.

Use Microsoft Entra Privileged Identity Management to provide eligible, time-bound, and governed privileged-role activation
Use Microsoft Entra ID for cloud identity, authentication, and access management
Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities
Use the Microsoft 365 admin center to review the tenant domain names and organization settings
Assign the appropriate Microsoft 365 license to the user or eligible group that needs the feature

Correct answer: C

Why: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This directly addresses the stated requirement.

Option review:

A: PIM reduces standing privilege by governing when privileged roles are activated and can enforce approval, MFA, justification, and time limits. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to choose between an individual user object and a group for a security assignment.

C: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This directly addresses the stated requirement.

D: The Microsoft 365 admin center provides tenant-level configuration, including domains and organization settings. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to choose between an individual user object and a group for a security assignment.

E: Feature access depends on the services included in the assigned license. Group-based licensing can simplify assignment for changing groups of users. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to choose between an individual user object and a group for a security assignment.

Question 30

An administrator reviewing pilot rollout for Coho Winery must find why a user was blocked by Conditional Access during sign-in. Which Microsoft 365 control or object should be used? The administrator wants an action that is easy to audit later.

Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities
Assign the least-privileged SharePoint site role or permission level that satisfies the user requirement
Evaluate authorization after authentication to determine what the identity is allowed to access or do
Review Microsoft Entra sign-in information and the relevant Conditional Access, MFA, or risk details for the affected attempt
Use Identity Secure Score to review identity-security recommendations and track posture improvements

Correct answer: D

Option review:

A: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to find why a user was blocked by Conditional Access during sign-in.

B: SharePoint site roles and permissions should be scoped to the content and actions the user actually needs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to find why a user was blocked by Conditional Access during sign-in.

C: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to find why a user was blocked by Conditional Access during sign-in.

E: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to find why a user was blocked by Conditional Access during sign-in.

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

Question 26

Question 27

Question 28

Question 29

Question 30

Related posts: