Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft 365 Certified: Endpoint Administrator Associate · Microsoft
Hot Area / Sentence Completion
Select the appropriate option to complete the statement. Click Check Answer below to see the marked solution.
Hotspot Solution:
Statement Analysis: When User1 connects to App1 from 131.107.50.10, User1 must use MFA. User1's MFA is Disabled, so even if the policy applies, it won't enforce MFA. However, Azure AD cannot enforce MFA if it’s not registered/enabled for the user. ✅ Answer: No When User2 connects to App1 from 131.107.20.15, User2 must use MFA. User2 has Enforced MFA. The location (131.107.20.15) is in a trusted location, and the policy includes trusted locations. Policy triggers MFA even from trusted locations because the policy includes them and requires MFA. ✅ Answer: Yes When User2 connects to App1 from 131.107.5.5, User2 must use MFA. 131.107.5.0/24 is configured as a trusted IP range for MFA. Since the policy includes all trusted locations, MFA is required for this range as well. User2 has MFA enforced, so the requirement is effective. ✅ Answer: Yes Final Answers: User1 from 131.107.50.10: ❌ No User2 from 131.107.20.15: ✅ Yes User2 from 131.107.5.5: ✅ Yes
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
YYY https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-userstates The CA policy controls access to APP1. Trusted locations is a condition. Policy doesn't change the Disabled state of User1, which means that if User1 logs on anywhere else or tries to access any other application, he will not be prompted for MFA. But, to access APP1, he must be logging in from a trusted location (this is a condition in order to access App1), and he WILL be prompted for MFA (this is the Grant access control). User2 will be prompted for MFA whether there is a CA policy or not.
Y, Y, N The trusted IPs feature of Microsoft Entra multifactor authentication also bypasses MFA prompts for users who sign in from a defined IP address range. If both per-user MFA and Conditional Access policies are configured in the tenant, you need to add trusted IPs to the Conditional Access policy and update the MFA service settings. https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-mfasettings#trusted-ips
YYN or YYY? I am torn about the last one. (new to this and Mac user if this is a silly question sorry) Can the list of IPs that MFA can be skipped from be edited? If it can be edited, what in the question indicates that it has been added to the list?