Identify the core features and objects of Microsoft 365 services

An administrator must change the retention setting for deleted mailbox items and adjust an email transport rule for the whole organisation. Which admin centre is designed for these mailbox and mail-flow tasks?

• AThe Microsoft 365 admin center
• BThe SharePoint admin center
• CThe Teams admin center
• DThe Exchange admin centercheck_circle Correct

Why A is wrong: This is tempting because it is the top-level portal for tenant-wide settings, but mailbox retention and transport rules are managed in the dedicated Exchange admin center, not the general admin centre.

Why B is wrong: This is tempting because it also handles content and retention, but the SharePoint admin center governs sites and files, not mailbox items or email transport rules.

Why C is wrong: This is tempting because Teams uses Exchange for some data, but the Teams admin center manages meetings, messaging policies and calling, not mailbox retention or mail-flow rules.

Why D is correct: Correct, because mailbox item retention and mail transport (flow) rules are Exchange Online workloads, and the Exchange admin center is the console that configures mailboxes and mail flow.

A governance lead wants administrators to hold privileged roles such as Global Administrator only for the limited time they are actively performing an administrative task, rather than permanently. Which Microsoft Entra ID capability is purpose-built to provide this time-bound, on-demand role activation?

• AMultifactor authentication, which requires a second form of verification during sign-in
• BPrivileged Identity Management, which provides just-in-time, time-bound activation of eligible rolescheck_circle Correct
• CConditional access, which grants or blocks access based on sign-in signals
• DIdentity Secure Score, which reports on the tenant's identity security posture

Why A is wrong: MFA is tempting because privileged access should also require it, but MFA strengthens the sign-in check itself and does not make a role assignment temporary.

Why B is correct: PIM is designed exactly for this: administrators are made eligible for a role and activate it just in time for a limited period, reducing standing privileged access.

Why C is wrong: Conditional access can add controls for administrators, but it governs access decisions at sign-in and does not activate or deactivate a privileged role for a limited window.

Why D is wrong: Identity Secure Score may recommend reducing standing privilege, but it only measures and advises; it cannot itself grant a role on a temporary basis.

A security analyst reports that several user accounts show sign-ins from atypical locations that the system has flagged as potentially compromised. The organisation wants a single place to review these flagged sign-ins, see the calculated risk level for each, and confirm whether automated remediation was applied. Which Microsoft Entra ID capability presents this information?

• AIdentity Secure Score recommendations
• BPrivileged Identity Management activation history
• CConditional access policy report-only insights
• DIdentity Protection risky sign-ins reportingcheck_circle Correct

Why A is wrong: Identity Secure Score is tempting because it also concerns identity risk, but it measures the tenant's overall security posture against recommended actions rather than reporting individual flagged sign-ins and their risk levels.

Why B is wrong: PIM audits just-in-time activations of privileged roles, so it seems relevant to account risk, but it does not detect or report anomalous sign-ins for ordinary user accounts.

Why C is wrong: Report-only conditional access shows what a policy would have done had it been enforced, which sounds like risk reporting, but it evaluates policy impact and does not itself calculate or list per-sign-in risk levels.

Why D is correct: Identity Protection detects and reports risky sign-ins, assigns each a risk level, and shows whether policy-driven remediation such as a forced password reset was applied, which is exactly what the analyst needs.

A developer registers a custom line-of-business application so it can authenticate against Microsoft Entra ID, and later an administrator notices a matching Enterprise application object appears in the tenant. Which statement correctly distinguishes an app registration from an Enterprise application?

• ABoth objects are identical copies, so removing either one has no effect on how the application signs in.
• BThe app registration lists the users assigned to the application, while the Enterprise application stores the application's redirect URIs and API permissions.
• CThe app registration applies only to Microsoft-published applications, while the Enterprise application applies only to third-party software as a service apps.
• DThe app registration defines the application's identity and configuration, while the Enterprise application is the service principal used to sign in and be assigned access within the tenant.check_circle Correct

Why A is wrong: This is tempting because they share a name and are linked, but they are distinct object types with different roles, and deleting one does affect the application.

Why B is wrong: This reverses the responsibilities: redirect URIs and requested permissions live on the registration, whereas user assignment is managed on the Enterprise application.

Why C is wrong: Publisher origin does not determine the object type; both custom and gallery applications can have registrations and Enterprise application objects depending on how they are onboarded.

Why D is correct: Correct: the registration is the global definition of the app, and the Enterprise application (service principal) is the local instance that a tenant uses for sign-in, user assignment, and consent.