Correct Answer:

Explanation:
Answer Area
Correct Selection
A user that is assigned the Global Administrator role as active
will lose the role after 15 days
You can make the Global Administrator role available to activation requests for up to three months Microsoft Entra Privileged Identity Management (PIM) distinguishes between active role assignments, eligible role assignments, and temporary role activation.
First selection: will lose the role after 15 days.
The exhibit specifies:
* Allow permanent active assignment: No
* Expire active assignments after: 15 days
An active assignment grants Global Administrator permissions without requiring the user to activate the role.
Because permanent active assignments are disabled, PIM requires time-bound assignments. The maximum assignment duration is 15 days. Once an assignment expires, the user loses the assigned administrative privileges unless the assignment is renewed.
The eight-hour activation limit does not apply to directly assigned active roles.
Second selection: for up to three months.
The exhibit also specifies:
* Allow permanent eligible assignment: No
* Expire eligible assignments after: 3 months
An eligible assignment allows a user to request activation of the Global Administrator role during the eligibility period.
Therefore, the role can remain available for activation requests for up to three months.
Each individual activation can last a maximum of eight hours, as specified by the separate Activation maximum duration setting.
The 15-day limit applies to active assignments, not eligible assignments.
Microsoft References:
* Microsoft Learn - Configure Microsoft Entra role settings in PIM .
* Microsoft Learn - Assign Microsoft Entra roles in PIM .

Correct Answer:

Explanation:
You can add a Microsoft Entra cloud user to: Group1, Group2, and Group3; You can add Group5 to: Group1 and 3 only Microsoft Entra group membership is governed by group type, membership assignment method, and source of authority.
First selection: Group1, Group2, and Group3.
The exhibit identifies Group1 and Group2 as cloud-managed Microsoft 365 groups using assigned membership. Microsoft 365 groups support user membership regardless of whether the group ' s Security enabled property is set to Yes or No.
Group3 is a cloud-managed security group with assigned membership, so administrators can also add a Microsoft Entra user directly.
Group4 uses dynamic membership, meaning users are included automatically according to configured rules rather than manually assigned.
Group5 originates from Windows Server Active Directory. Its membership is managed by the authoritative on- premises directory.
Second selection: Group1 and Group3 only.
Microsoft Entra supports nesting security groups within other compatible security groups. Consequently, Group5 can be added as a member of Group3.
Microsoft 365 groups do not support groups as members, and dynamic group membership cannot be manually modified.
The first answer above reflects Microsoft ' s documented group membership behavior rather than simply reproducing the recording ' s selected response.
Microsoft References:
https://learn.microsoft.com/en-us/graph/api/group-post-members

Correct Answer:

Explanation:
Microsoft Entra administrative units support dynamic device membership based on device attributes. AU1 uses the following membership rule:
(device.deviceTrustType -eq " Workplace " ) -and
(device.deviceOSType -in [ " Windows " , " Android " ])
Statement 1: No.
Admin1 holds the Global Administrator role. However, AU1 uses dynamic membership, which prevents administrators from manually adding or removing members. Membership is determined exclusively by the configured rule.
Additionally, Device1 is Microsoft Entra joined, corresponding to deviceTrustType = AzureAD, rather than Workplace. Therefore, Device1 does not satisfy the rule.
Statement 2: Yes.
Device2 runs Windows 11 and is Microsoft Entra registered.
Microsoft Entra registered devices have a deviceTrustType value of Workplace, and Windows matches the permitted operating system list. Therefore, Device2 satisfies both conditions and is automatically included in AU1.
Statement 3: Yes.
The planned Android devices must be Microsoft Entra registered. Registered Android devices satisfy the Workplace trust condition and, when their recorded operating system value is Android, also satisfy the OS condition.
Consequently, they are automatically added to AU1 through dynamic membership processing. Group1 membership itself does not determine AU1 membership.
Administrators should verify the actual deviceOSType value because some Android Enterprise registrations use more specific operating system identifiers.
Microsoft References:
* Manage dynamic membership in administrative units .
* Microsoft Entra dynamic membership rules and device attributes .

Correct Answer:

Explanation:
Answer Area
Correct Selection
Agents flagged by aggregated security and compliance signals
Agents at risk
Agents that lack accountable lifecycle management
Agents without owners
Microsoft Agent 365 provides centralized governance action cards within the Microsoft 365 admin center to identify security risks, ownership gaps, and agent lifecycle issues.
First selection: Agents at risk.
The Agents at risk card identifies agents associated with aggregated security and compliance risk signals from Microsoft Entra, Microsoft Defender, and Microsoft Purview.
Administrators can select Manage agent risks to open the Agent Registry with the relevant agents filtered by identified risk.
This enables security teams to investigate potentially compromised agents, inappropriate permissions, data exposure concerns, and other detected security issues.
Second selection: Agents without owners.
The Agents without owners card identifies agents that do not have an assigned owner responsible for governance and lifecycle management.
Administrators can select Assign Owner to review affected agents and establish ownership accountability.
An assigned owner helps ensure ongoing technical maintenance, appropriate access management, and governance oversight.
The remaining action cards address different scenarios. Agents with exceptions identifies agents experiencing operational errors, while Pending requests for agents identifies agent deployment requests awaiting administrative approval.
Microsoft documents that AI Administrators and Global Administrators can perform the relevant governance actions.
Therefore, Agents at risk and Agents without owners are the correct selections.
Microsoft References:
* Microsoft Learn - Agent 365 overview and governance action cards .
* Microsoft Learn - Agent Registry and security risk management .

Correct Answer: D  🗳️

Explanation: Only visible for PracticeDump members. You can sign-up / login (it's free).