Module Assessment

1.

You added 'Relecloud' to the custom banned password list two days ago. A user attempts to change their password to 'Relecloud2026Widget!' and the change is accepted. What's the most accurate explanation?

The custom banned password list only blocks exact-match passwords, so any password that includes a banned term as a substring rather than the whole password is always accepted

Microsoft Entra Password Protection scores passwords rather than filtering them: each banned term is worth one point and each remaining character is worth one point, and a password needs at least five points to be accepted—'Relecloud2026Widget!' scores twelve, so it's accepted even though it contains a banned term

The custom banned password list only applies to password resets initiated from aka.ms/sspr, not to voluntary password changes made from a user's security info page

2.

Relecloud enables self-service password reset for Group1 with a two-method registration requirement, but help-desk tickets increase instead of dropping. Group2 is nested inside Group1. Which statement about this scenario is accurate?

Group2's members can't complete SSPR because enablement never extends through nested groups

Group2's members can complete SSPR because SSPR enablement supports nested groups, so the ticket spike has a different cause, such as a registered-vs-required method mismatch

Group2's members can complete SSPR only if an administrator manually adds each one to Group1 directly

3.

An administrator builds a Conditional Access policy requiring MFA for Microsoft 365 apps, but a user signs in without ever being prompted for MFA using an older mail protocol. What's the most likely explanation?

MFA prompts only appear the first time a user ever signs in, so subsequent sign-ins are automatically exempt

Conditional Access policies only apply to guest users by default, so an internal user's sign-in bypasses every policy

The sign-in used a legacy authentication client that the MFA policy doesn't correctly cover, and legacy authentication doesn't support MFA prompts in the first place

4.

An administrator suspects a sign-in was never interrupted by Conditional Access even though it should have been. Which tool is purpose-built to confirm that a sign-in event should have triggered a policy but didn't?

The Sign-in diagnostic, using its scenario for sign-ins that should be interrupted but aren't

The Conditional Access Insights and Reporting workbook, because it's the only surface that stores sign-in history

The Conditional Access What If tool, because it only evaluates sign-ins that already occurred

5.

The same compliant, Intune-managed laptop signs in to SharePoint successfully in Microsoft Edge, then is blocked using Chrome on the same device. What's the most likely cause?

The device's compliance status in Intune changed between the two sign-in attempts

Chrome hasn't been configured with the Microsoft Single Sign On extension or the CloudApAuthEnabled policy, so it can't pass device-state information to Entra ID the way Edge does natively

Conditional Access policies apply only to the first browser a user signs in with each day

6.

Relecloud wants a Conditional Access policy that requires a secure password change when a user's account is suspected of being compromised based on leaked credentials, separate from a policy that challenges suspicious sign-in attempts with MFA. How should this be configured?

As two separate Conditional Access policies—one for sign-in risk requiring MFA, and one for user risk requiring a secure password change

As a single Conditional Access policy combining both sign-in risk and user risk conditions

Through Microsoft Entra Password Protection instead of Conditional Access, since password changes are involved

Check your knowledge

Feedback