MS-102 Exam Questions and Answers

Microsoft 365 Defender portal

Microsoft 365 Defender portal unifies signals from Defender for Endpoint, Defender for Office 365, and Microsoft Entra ID Protection into one incident view, enabling cross-domain investigation and response. This single console satisfies the requirement to correlate endpoint, email, and identity alerts for a complex incident.

Microsoft Defender for Cloud Apps

Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that discovers sanctioned and unsanctioned cloud apps, assesses risk via the Cloud App Catalog, and enforces real-time session and access policies. It can restrict risky app usage using conditional access app controls, block downloads, or apply DLP checks across thousands of third-party SaaS services — capabilities no workload-specific Defender product can provide.

Attack surface reduction rules

Attack surface reduction (ASR) rules are a Windows Defender Exploit Guard capability that can specifically block process creation from common temporary folders (such as %Temp% and %AppData%) using a predefined rule like 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' or the explicit temp-folder rule, preventing malware from launching from file paths where droppers commonly execute. ASR rules are client-side, configured via Microsoft Intune, Configuration Manager, or GPO, and operate before the executable is allowed to spawn by intercepting process creation in the kernel and user-mode. This makes ASR the correct choice because it directly restricts executable execution based on file location and reputation, rather than merely restricting network or data access.

Automated investigation and response (AIR)

Automated investigation and response (AIR) in Microsoft Defender XDR automatically investigates alerts across endpoints, email, and identities, then applies remediation actions without analyst input. This directly satisfies the stem's requirement for hands-off response spanning all three workloads, unlike standalone playbooks or manual triage.

User reported settings in the Microsoft 365 Defender portal

User reported settings in the Microsoft 365 Defender portal, found under Settings > Email & collaboration, are the native control plane that connects end-user report actions to backend automation. An admin can route reported messages to Microsoft for analysis, to a custom mailbox, or directly into automated investigation and response, and can enable the automatically block sender rule so that confirmed phishing verdicts instantly update the tenant block list. This is precisely the kind of correlated, report-initiated blocking that the other options lack, making it the correct choice for this scenario.

Exchange Online Protection (EOP)

Exchange Online Protection (EOP) is the correct answer because its connection filtering feature evaluates the source IP address of every inbound SMTP connection against Microsoft's default and tenant-specific IP allow/block lists and real-time reputation data. Malicious IPs are rejected at the transport layer before the message is accepted, and admins can explicitly add IPs to the block list in the anti-spam policy to enforce a custom allow/deny set for inbound mail flow.

Add the domain in the Microsoft 365 admin center

The first step in onboarding a custom email domain is to add it in the Microsoft 365 admin center (Settings > Domains > Add domain). This action registers the domain with your tenant and generates the necessary verification token, allowing you to proceed to the next step of proving ownership. This must occur before any TXT record or DNS changes can be associated with the domain.

External Identities – External collaboration settings

In Entra ID (Azure AD), navigate to External Identities > External collaboration settings and change the Guest invite settings to 'Only users assigned to specific admin roles can invite guests' (or 'No one can invite guests'). This is the administrative toggle that directly restricts who can issue B2B invitations, so it is the correct control to prevent the tenant from broadcasting external-user invitation privileges.

Exchange Hybrid Configuration Wizard

The Exchange Hybrid Configuration Wizard automates creation of the hybrid configuration, including connectors, accepted domains, OAuth and the free/busy sharing needed for coexistence. It is the supported tool for establishing mail flow between on-premises Exchange and Exchange Online during migration.

Microsoft 365 admin center

The Microsoft 365 admin center is the designated operational hub for managing Microsoft 365 user accounts, including creating new users, resetting passwords, adding users from a CSV, and assigning or revoking Microsoft 365 subscription licenses. It provides a service-aware view of all M365 workloads and is the primary portal for common administrative tasks like user lifecycle management and billing. While identity data resides in Microsoft Entra ID, the M365 admin center is the intended interface for day-to-day account administration.

Assign an Exchange Online license to the user

In Microsoft Entra ID (Azure AD), a user object does not automatically have an Exchange Online mailbox until a license that contains the Exchange Online service plan (e.g., Microsoft 365 E3/E5, Exchange Online Plan 1/2) is assigned. Once assigned, the Exchange Online provisioning service creates the mailbox automatically, usually within minutes to a few hours, and the user can log in to Outlook or Outlook on the web. This is the only supported, self-service method for creating a mailbox for a standard user in a cloud-only environment.

Add a DNS TXT record provided by Microsoft to the domain registrar

Domain ownership verification in Microsoft 365 is performed by adding the exact TXT record—containing a unique verification string generated in the Microsoft 365 admin center—to the domain's public DNS zone at the registrar. Microsoft periodically queries the TXT record for that domain; when the value matches, the domain is marked as verified and becomes an accepted domain. This must complete successfully before any user accounts, mail routing, or other service records can be associated with the custom domain.

Auto-apply retention labels based on sensitive information types

Auto-apply retention labels are content-aware and can be configured to trigger whenever a sensitive information type—such as a credit card number, passport number, or other PII—is detected in an email. Once the label is applied, its retention settings enforce the 10-year retention period and, at the end of that period, automatically dispose of the item. This satisfies the requirement to selectively retain emails based on content, not just location or folder.

Sensitivity labels with encryption and usage rights

Sensitivity labels with encryption and usage rights directly enforce document-level restrictions by applying Azure Rights Management (RMS) protection. When an external user opens the document, the RMS client enforces usage rights that explicitly deny actions such as printing, copying, and editing, regardless of where the file is stored or how it is shared. These restrictions travel with the file itself, making them effective even after the file leaves your tenant, and they can be scoped to specific external users or groups.

Sensitivity labels

Sensitivity labels are the core classification mechanism in Microsoft Purview Information Protection. When applied, they embed metadata into the document and enforce protection settings such as encryption, rights management restrictions, and visual markings like headers, footers, or watermarks. The label persists with the content even when it leaves the organization, ensuring classification and protection follow the file. This directly satisfies the compliance officer's need to classify documents, especially when combined with auto-labeling for full automation.

Auto-labeling policies

Auto-labeling policies automate the assignment of sensitivity labels by scanning content against conditions such as sensitive info types, keywords, or trainable classifiers. They can run in simulation mode to assess impact before enforcement, and they are able to label documents at rest in SharePoint/OneDrive as well as emails in transit in Exchange. This is the direct mechanism that lets a compliance officer automatically classify documents at scale without requiring manual user effort. Auto-labeling works hand-in-hand with sensitivity labels, making the classification process consistent and policy-driven.

Create a retention label with a retention period of 7 years and enable disposition review

A retention label with a 7-year period and disposition review is the correct choice because it retains the document for the full regulatory period, yet the disposition review step triggers a manual approval workflow at the end of the retention period. During that review, an authorized user can approve early disposal, satisfying the requirement that documents be manually dispose-able if approved, rather than being automatically deleted or locked indefinitely.

Endpoint DLP

Endpoint DLP is the correct selection because it monitors Windows and macOS devices and can inspect user activities such as copying sensitive content to the clipboard. When a user attempts to paste that data into a web form, Endpoint DLP in Microsoft Edge or another supported Chromium-based browser can evaluate the policy condition and block the paste action. The capability relies on the Microsoft Purview endpoint agent being onboarded on the device, and it is the only option that controls clipboard operations at the endpoint itself.

Litigation Hold

Litigation Hold is the correct mechanism because it places a preservation hold on an entire mailbox and OneDrive for Business site in-place, preventing items from being permanently deleted or altered. Every version of a document and every mailbox item, including deleted items and items edited by users, is retained in the Recoverable Items folder until the hold is released. Deletion by users, as well as cleanup by retention policies, is blocked for held content, ensuring all communications related to the legal matter remain discoverable in their original location.

Set 'Users can register applications' to 'No' in User settings

The 'Users can register applications' setting, found under Microsoft Entra ID > User settings, is the directory-wide toggle that controls whether non-admin users can create application registrations in the tenant. Setting it to 'No' revokes the default user permission to self-register apps, ensuring only users with applicable administrative roles (such as Application Administrator) can register applications. This directly satisfies the requirement to prevent user app registration.

Pass-through Authentication with Seamless SSO

Pass-through Authentication with Seamless SSO is not the best option because it uses lightweight agents on-premises to validate passwords directly against Active Directory in real time, rather than synchronizing any password hash to Entra ID. While PTA avoids storing password hashes in the cloud, it introduces a dependency on on-premises agent availability, requires agent high availability planning, and Seamless SSO only provides silent sign-in on domain-joined devices. For a simple migration to cloud authentication, PTA is operationally more complex than PHS and does not allow cloud-based sign-in if the on-premises directory becomes unreachable.

The Conditional Access policy has a session control that requires sign-in frequency

Sign-in frequency is a Conditional Access session control that configures how often a user must re-authenticate, regardless of whether their device is compliant. Once the configured time window expires, the session's refresh token is no longer valid for re-authentication, forcing the user to provide MFA again. This exactly matches the reported behavior—repeated MFA prompts on a compliant device—because the policy is not checking device health but enforcing token lifetime limits.

User risk policy

User risk policy targets the user account itself, so its remediation action is a password change, satisfying the stem's requirement. Sign-in risk policy instead blocks or demands MFA at authentication, which cannot force a credential reset. Configuring user risk to High and allowing password change enforces the required response.

A credential manifest in the Microsoft Entra admin center

A credential manifest is the core configuration artifact for issuing a verifiable credential in Microsoft Entra Verified ID. Defined in the Microsoft Entra admin center, it combines rules and display information: the rules definition specifies required claims, such as user attributes and optional validation logic, while the display definition controls the JSON schema and the visual layout of the credential. This manifest is what transforms a user's claim data into a signed verifiable credential, making it essential for any issuance scenario. Without it, the right issuance API calls would lack the necessary structure and would fail.

Deploy Microsoft Entra Connect cloud sync

Deploying Microsoft Entra Cloud Sync is correct because the cloud sync agent can be configured to synchronize identity changes—including the userAccountControl disabled flag—as frequently as every 1 minute, which satisfies the 5-minute latency requirement. Unlike Entra Connect Sync's 30-minute default cycle, Cloud Sync uses a lightweight agent that can run in parallel with Connect Sync (for non-overlapping scopes) or as a replacement, enabling near-real-time propagation of account disables for security and compliance.