Microsoft ENTRA-WI-CA Practice Test

ENTRA-WI-CA practice test: what's covered

• Service principals, risk, named locations, report-only rollout and sign-in evidence

Free ENTRA-WI-CA sample questions

1. A team wants Conditional Access to restrict a payroll integration that authenticates as a service principal from a build runner. Which assignment choice matches the workload identity feature?

   • A. Assign the policy directly to the service principal under workload identities
   • B. Assign the policy to a group that contains the service principal object
   • C. Assign the policy to all human users who can open the payroll portal
   • D. Assign the policy to the managed identity created for every Azure VM
   Show answer

   Correct: A. Conditional Access for workload identities is enforced when the service principal is assigned directly as a workload identity. Group assignment that happens to contain a service principal does not enforce the policy for that service principal, while user and managed-identity targeting solve different problems.

2. A security lead is documenting limits before a pilot. Which two statements should be included so engineers do not overpromise the control?

   • A. Single-tenant service principals registered in the tenant can be targeted
   • B. Managed identities are not covered by these Conditional Access policies
   • C. Every third-party multitenant SaaS application service principal is automatically covered
   • D. A service principal receives the policy when it is only a member of a targeted group
   Show answer

   Correct: A and B. Microsoft documents the feature for organization-owned single-tenant service principals and separately notes that managed identities are not covered. Multitenant SaaS apps and group-only service-principal membership are common assumptions, but they do not provide the enforcement path this feature requires.

3. A policy was created against the object ID copied from App registrations, but the expected service principal is still not evaluated. What should the engineer correct?

   • A. Use the Enterprise applications object ID for the service principal
   • B. Use the application client secret value as the Conditional Access object ID
   • C. Use the tenant display name because policies resolve objects by name
   • D. Use the redirect URI because token requests include that field
   Show answer

   Correct: A. For workload identity Conditional Access, the service principal object ID from Enterprise applications identifies the calling app. The app registration object ID is a different object, and secrets, tenant names, or redirect URIs are not reliable policy assignment identifiers.

4. An admin asks why a human MFA requirement is not offered when the policy targets a daemon app service principal. Which explanation is most accurate?

   • A. Workload identities cannot perform multifactor authentication, so the workload policy uses block-style enforcement
   • B. The service principal must register Microsoft Authenticator before the next token request
   • C. MFA prompts are sent to the owner of the application registration by default
   • D. The daemon app can complete MFA only after adding a browser redirect URI
   Show answer

   Correct: A. Workload identities differ from user accounts because they cannot complete user-interactive controls such as MFA. The practical workload identity Conditional Access pattern is to block token requests under location or risk conditions, not to prompt the app or its owner for MFA.

5. A finance API service principal should only request tokens from two corporate egress ranges. Which two settings are central to the location-based policy?

   • A. Include any location so all token requests are evaluated
   • B. Exclude selected named locations that represent the approved public egress ranges
   • C. Require device compliance because service principals always present Intune device state
   • D. Select individual SharePoint sites as the only target resources for the policy
   Show answer

   Correct: A and B. The standard location pattern includes any location and excludes named locations that are allowed, leaving token requests from outside the known ranges to be blocked. Device compliance and individual SharePoint site selection do not express the public egress restriction for a service principal token request.

Last updated: 2026-10-19

ENTRA-WI-CA practice test FAQ

Related practice tests

• Microsoft SC-300 practice test
• Entra Conditional Access troubleshooting practice test
• Entra Global Secure Access practice test
• Azure AZ-104 practice test
• Microsoft SC-100 practice test
• Azure AZ-500 practice test