Users in an on-premises Active Directory can authenticate to Azure AD through federation, but they cannot access an Azure application that requires MFA. The on-premises administrator confirms MFA is enabled for the users in Azure AD. What is the most likely cause?

The Azure AD Connect sync is not replicating the users' group memberships

The federated domain's MFA settings are not configured to enforce MFA for federated users

The application does not support federated authentication

The users' passwords are expired in the on-premises Active Directory

A scheduled job that uses a service principal to call the Azure Resource Manager API started failing this morning with a '401 Unauthorized' error. The service principal's credentials were rotated last week. What should you check first?

Check whether the service principal's sign-in is blocked by a conditional access policy

Verify that the client secret stored in the job's configuration matches the current secret for the service principal

Confirm the service principal still has the 'Contributor' role on the target subscription

Ensure the service principal is assigned an Azure AD license

A user is blocked from accessing a resource even though they meet the basic requirements. What should be checked?

Whether a conditional access policy is blocking access

Whether the user's device has a camera

Whether the user's account is new

Whether the user's password is strong enough

When troubleshooting access to encrypted data, which of the following should be checked?

Key policies and permissions for the encryption key

A user cannot access a compute instance. What should be checked?

The user's screen saver settings

The network security group rules

Palo Alto NetworksCertified Cloud Security Engineer

Domain 6Objective 6

6.6 Identify and Describe Access and Permissions Troubleshooting Issues CLOUD-SECURITY-ENGINEER Practice Questions (Page 7)

Part of the Troubleshooting domain, which accounts for 16% of the CLOUD-SECURITY-ENGINEER exam.

40questions here

8free pages

13concepts

16%of the exam

Questions 31–35

31application · medium
Users in an on-premises Active Directory can authenticate to Azure AD through federation, but they cannot access an Azure application that requires MFA. The on-premises administrator confirms MFA is enabled for the users in Azure AD. What is the most likely cause?
Select an answer first
32application · medium
A scheduled job that uses a service principal to call the Azure Resource Manager API started failing this morning with a '401 Unauthorized' error. The service principal's credentials were rotated last week. What should you check first?
Select an answer first
33foundation · easy
A user is blocked from accessing a resource even though they meet the basic requirements. What should be checked?
Select an answer first
34foundation · easy
When troubleshooting access to encrypted data, which of the following should be checked?
Select an answer first
35foundation · easy
A user cannot access a compute instance. What should be checked?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CLOUD-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “CLOUD-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.