Microsoft ENTRA-CA-TS Practice Test

ENTRA-CA-TS practice test: what's covered

• Report-only mode, sign-in logs, What If, grant controls and rollout evidence

Free ENTRA-CA-TS sample questions

1. A new policy requiring phishing-resistant authentication for finance users is in report-only mode. Several finance sign-ins show "Report-only: User action required" but users did not receive any prompt. Which interpretation should the admin use before enabling the policy?

   • A. The policy matched the sign-ins and would require user interaction if enforced
   • B. The policy failed because report-only mode cannot evaluate authentication controls
   • C. The policy is already enforcing prompts but browser cache is hiding the challenge
   • D. The users are excluded because report-only results are never written to sign-in logs
   Show answer

   Correct: A. Report-only evaluates most Conditional Access policies and writes results without enforcing prompts. The first option correctly treats the result as a future enforcement impact. The other options confuse report-only with enforcement, ignore log evidence, or claim a limitation that does not apply to this result.

2. An identity engineer is validating a copied Conditional Access policy before replacing the enforced version. Which two evidence sources best support a safe comparison?

   • A. Conditional Access tabs on individual sign-in log details
   • B. Conditional Access insights workbook for a matching time range and population
   • C. Browser screenshots from two users who signed in successfully
   • D. A count of how many policies exist in the Policies blade
   Show answer

   Correct: A and B. Sign-in details show policy evaluation for specific events, and the workbook helps compare report-only and enforced outcomes over a population. Screenshots and policy counts do not prove policy matching, grant-control results, or whether the copied policy changes real access decisions.

3. A report-only policy requiring compliant devices causes repeated certificate selection prompts on iOS and macOS during evaluation. Which adjustment best reduces user disruption while preserving test intent?

   • A. Exclude macOS, iOS and Android platforms from the report-only compliant-device test policy
   • B. Turn the policy on immediately because prompts prove the device compliance control works
   • C. Remove all sign-in log collection because report-only policies should be invisible to users
   • D. Replace compliant-device requirements with country blocking for the same user group
   Show answer

   Correct: A. Microsoft documents that report-only compliant-device checks can prompt users on macOS, iOS, and Android, so excluding those platforms from that test policy is the targeted mitigation. Enforcing immediately increases risk, log removal hides evidence, and changing to location blocking no longer tests device compliance.

4. A security manager asks for classical A/B testing between two enforced Conditional Access policies. Which response is most accurate?

   • A. Conditional Access does not support classical A/B testing; compare report-only results or use supported phased rollout options
   • B. Conditional Access randomly splits every app sign-in between enabled policies when both are scoped to all users
   • C. The What If tool permanently assigns users to the control or treatment cohort
   • D. A/B testing is enabled by placing both policies in block mode with identical exclusions
   Show answer

   Correct: A. The safe answer reflects Microsoft guidance: use report-only comparison, workbook evidence, or supported phased rollout behavior where available. The other choices invent random assignment, misuse What If, or create blocking policies that could disrupt users without proving comparative impact.

5. A user says SharePoint is blocked only from home Wi-Fi. The sign-in event shows the policy result as "Failure" for a named-location block policy. What should the analyst inspect next?

   • A. The location fields, named-location match and excluded networks on the same sign-in event
   • B. Only the user's password age because Conditional Access ignores network location
   • C. The HTML source of SharePoint because policy results are stored inside the web page
   • D. A different user's successful sign-in because one event cannot include Conditional Access data
   Show answer

   Correct: A. The blocked event is the right evidence anchor because it contains Conditional Access results and location context. Password age, page source, and another user's unrelated success do not explain whether the named location, trusted IP range, or exclusions caused this user's block.

Last updated: 2026-10-19

ENTRA-CA-TS practice test FAQ

Related practice tests

• Microsoft SC-300 practice test
• Entra Workload ID Conditional Access practice test
• Entra Global Secure Access practice test
• Defender for Cloud Apps session control practice test
• Microsoft MD-102 practice test
• Okta Certified Professional practice test