Microsoft MS-GSA Practice Test

MS-GSA practice test: what's covered

• Internet Access
• Private Access
• Traffic Forwarding
• Quick Access
• Conditional Access
• Source IP Restoration

Free MS-GSA sample questions

1. A security architect is replacing legacy VPN and proxy controls with Microsoft's identity-aware SSE service. Which design statement is the BEST fit?

   • A. Use Global Secure Access as the unified Entra experience for Internet Access and Private Access
   • B. Use Global Secure Access only as a DNS registrar for public application names
   • C. Deploy Private Access without identity because network location is always sufficient
   • D. Forward every packet to a legacy VPN before applying Entra policy decisions
   Show answer

   Correct: A. Global Secure Access is the Microsoft Entra umbrella for Internet Access and Private Access, built around Zero Trust principles. The DNS registrar, identity-free private access, and VPN-first answers miss the service model and would preserve the old network perimeter pattern.

2. A project sponsor asks why both Internet Access and Private Access are needed in the same roadmap. Which response is the BEST fit?

   • A. Internet Access secures public internet and SaaS traffic, while Private Access secures internal resources
   • B. Internet Access is only for datacenter servers, while Private Access is only for guest Wi-Fi
   • C. Both services perform the same function and should never be deployed together
   • D. Private Access replaces Conditional Access for all Microsoft 365 sign-in decisions
   Show answer

   Correct: A. Microsoft positions Internet Access for outbound internet and SaaS access, and Private Access for private apps and resources. Treating them as duplicates, guest Wi-Fi tools, or replacements for Conditional Access confuses traffic direction and control layers.

3. A tenant is starting a controlled Global Secure Access pilot. Which TWO planning choices should the engineer select? (Choose TWO)

   • A. Define a small user group and a clear traffic profile scope before broad rollout
   • B. Confirm the required administrator roles and service activation before configuration
   • C. Enable all profiles for all users before any logging baseline exists
   • D. Treat the client install as optional for every private application use case
   Show answer

   Correct: A and B. A pilot should start with scoped users, profiles, administrator roles, and activation checks so policy impact can be measured. Enabling all traffic immediately or assuming the client is optional for every private access path creates troubleshooting and access risk.

4. An operations team wants least-privilege administration for traffic profile work. Which role assignment is the BEST starting point?

   • A. Assign Global Secure Access Administrator to the operators who manage the profiles
   • B. Assign Billing Administrator because traffic forwarding is a subscription invoice task
   • C. Assign all operators as Global Administrator for daily traffic policy changes
   • D. Assign no Entra role because traffic profiles are edited from Windows settings
   Show answer

   Correct: A. Global Secure Access Administrator is the appropriate scoped role for managing Global Secure Access settings. Billing Administrator does not manage traffic profiles, routine Global Administrator use is excessive, and the profiles are not managed only from Windows settings.

5. A CIO asks how Global Secure Access supports Zero Trust rather than a flat trusted network. Which response is the BEST fit?

   • A. It evaluates access with identity, device, traffic profile, and Conditional Access context
   • B. It makes all corporate traffic trusted after the first successful VPN connection
   • C. It removes the need for user authentication when traffic is from a known subnet
   • D. It hides applications from search engines but permits anonymous internal access
   Show answer

   Correct: A. Global Secure Access supports Zero Trust by combining traffic acquisition with identity-aware policy signals and Conditional Access. The other options describe perimeter trust, anonymous access, or obscurity, which are the opposite of verify explicitly and least privilege.

Last updated: 2026-10-19

MS-GSA practice test FAQ

Related practice tests

• Microsoft SC-300 practice test
• Entra Conditional Access troubleshooting practice test
• Entra Workload ID Conditional Access practice test
• Defender for Cloud Apps session control practice test
• Azure AZ-700 practice test
• ZPA administrator practice test