How to use MS-102 flashcards effectively
Flashcards work through active recall — the process of retrieving information from memory rather than passively re-reading it. Research consistently shows that active recall produces stronger, longer-lasting memory than re-reading study guides. For MS-102 preparation, this means flashcards are one of the highest-return study tools available.
Attempt recall first
Read the MS-102 question on each card, pause, and attempt to formulate the answer in your own words before revealing. This retrieval attempt — even if wrong — dramatically strengthens memory compared to immediately reading the answer.
Review wrong cards again
When you get a card wrong, note it and add it back to your review pile. Spaced repetition — seeing difficult cards more frequently — is the mechanism that makes flashcard study far more efficient than linear reading.
Study by domain
Group your MS-102 flashcard sessions by domain for the first 3–4 weeks. Master one domain before moving to the next. In the final week, shuffle all cards together to test cross-domain recall — which is what the real MS-102 exam requires.
Short sessions beat marathon reviews
20–30 flashcard cards per session, done daily, produces better retention than a single 200-card marathon session. Five short daily sessions per week over 4 weeks gives you over 400 total card reviews — enough to reliably pass MS-102.
MS-102 flashcard preview
Sample cards from the MS-102 flashcard bank. Read the question, think of the answer, then read the explanation below.
An administrator is onboarding a new custom domain for email in a Microsoft 365 tenant. Which step should be performed first?
Add the domain in the Microsoft 365 admin center
The correct first step is to add the custom domain in the Microsoft 365 admin center. After adding the domain, you must verify ownership by adding a TXT record in your DNS hosting provider. Only after verification can you configure other DNS records and set the domain as the primary email domain.
An organization with Microsoft Entra ID P2 licenses wants to require multi-factor authentication (MFA) for all users but allow them to register their authentication methods before being forced to use MFA. Which configuration should they implement?
Conditional Access policy with MFA grant and a registration campaign
Conditional Access policies can include a registration campaign for combined security info registration, allowing users to preregister MFA methods before the policy requiring MFA is enforced. This provides a smooth user experience. Security defaults enforce MFA immediately without a pre-registration period. Per-user MFA requires enabling MFA per user and does not include a registration campaign. Identity Protection user risk policy triggers MFA based on risk, not a blanket requirement.
A security administrator needs a single console to investigate and respond to a complex incident involving alerts from endpoints, email, and identities. Which Microsoft portal should they use?
Microsoft 365 Defender portal
Microsoft 365 Defender portal (also known as the Microsoft Defender XDR portal) provides a unified experience for managing security across Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. It correlates alerts into incidents and enables cross-domain investigation. Microsoft Sentinel is a SIEM for broader security data, Microsoft Defender for Cloud is for cloud infrastructure, and the Microsoft 365 compliance center focuses on compliance and data governance.
A compliance officer needs to automatically retain emails that contain personally identifiable information (PII) for 10 years and then permanently delete them. Which Microsoft Purview feature should be configured?
Auto-apply retention labels based on sensitive information types
Retention labels can be auto-applied to emails based on sensitive information types (e.g., credit card numbers, social security numbers) using an auto-labeling policy. When the label is applied, the retention period of 10 years starts. After 10 years, the label's action (delete) is executed. Retention policies apply to all content in a location and cannot be scoped to specific sensitive content. Data classification discovers but does not enforce retention. eDiscovery is for search and hold, not lifecycle.
A company recently added the custom domain 'contoso.com' to their Microsoft 365 tenant. Users report that they cannot receive external email sent to their new domain addresses. The administrator confirmed that the domain status shows 'Active' in the Microsoft 365 admin center. What is the most likely cause of this issue?
The MX record for the domain is missing or points to an incorrect mail server.
After adding a custom domain to Microsoft 365, you must update the DNS records for email delivery. Even though the domain is verified and active, the MX record must point to Exchange Online (contoso-com.mail.protection.outlook.com) for email to flow correctly. Without the correct MX record, external senders cannot deliver mail.
A company has 500 users across Sales, Marketing, and IT departments. User objects are synced from on-premises Active Directory to Microsoft Entra ID using Azure AD Connect. Each department requires different Microsoft 365 license plans (e.g., Sales needs E3, Marketing needs Business Premium, IT needs E5). The administrator wants to automatically assign the appropriate license based on the department attribute without manual intervention. Which approach should the administrator use?
Configure group-based licensing using Microsoft Entra dynamic groups with rules based on the department attribute.
Group-based licensing with dynamic groups allows automatic assignment of licenses based on user attributes like department. You create dynamic groups with membership rules (e.g., user.department -eq "Sales") and assign the appropriate license plan to each group. Licenses will be automatically assigned to new users and removed when the attribute changes.
A company has purchased 1000 Microsoft 365 E5 licenses and wants to automatically assign licenses to users based on their department attribute, which is synchronized from on-premises Active Directory. The department attribute is stored in Azure AD. Which automated method should the administrator use to achieve this?
Group-based licensing with dynamic groups
Group-based licensing with Azure AD dynamic groups allows automatic assignment of licenses based on user attributes like department. The administrator can create a dynamic group that includes users with a specific department value, then assign the license to that group. PowerShell scripts or manual assignment are not fully automated or scalable for this purpose.
A company has just purchased Microsoft 365 Business Standard and added the custom domain 'fabrikam.com' to the tenant. They want to verify domain ownership. Which DNS record type must they add to their DNS provider?
TXT record
To verify ownership of a custom domain in Microsoft 365, you need to add a TXT record provided by the Microsoft 365 admin center to your DNS hosting provider. This TXT record contains a unique verification string.
A company plans to migrate their email from an on-premises Exchange server to Exchange Online. They want to ensure that during the migration, mail sent to users who have already been migrated is delivered to Exchange Online, while mail for non-migrated users is delivered to on-premises. Which type of domain configuration should they use?
Split domain
A split domain configuration allows the MX record to point to Exchange Online, which then routes mail to the appropriate mailbox based on the recipient's location (cloud or on-premises). This enables a phased migration while maintaining mail flow. Coexistence is a general concept but not a specific domain type; shared domain is not a standard term; forwarding domain does not exist as a domain type.
A company has registered the custom domain 'contoso.com' and wants to host email for the subdomain 'sales.contoso.com' in Exchange Online. They have already verified the root domain. What additional step is required?
Add 'sales.contoso.com' as a custom domain and verify ownership by adding a DNS TXT record.
Each subdomain must be added and verified separately in Microsoft 365 if it will be used for services like Exchange or SharePoint. Verification proves ownership and enables DNS routing.
A company (Contoso) frequently collaborates with a partner company (Fabrikam) via B2B collaboration. Contoso wants to require Fabrikam's guest users to perform MFA using Contoso's MFA policies, ignoring any MFA claims from the Fabrikam home tenant. However, Fabrikam's users already have MFA enabled in their home tenant. What should Contoso configure in their cross-tenant access settings?
Disable trust for MFA from the external tenant in the cross-tenant access settings
In Microsoft Entra cross-tenant access settings, you can configure which claims (MFA, device compliance, etc.) you trust from external tenants. By default, B2B collaboration trusts MFA claims from the home tenant. To require the resource tenant's MFA, you must disable trust for MFA from the external tenant. Then, if Conditional Access policy requires MFA, the guest user will be prompted for MFA by Contoso.
A company uses Azure AD Connect with password hash synchronization. They want to enable Azure AD Seamless Single Sign-On (SSO) for users accessing Microsoft 365 from domain-joined devices on the corporate network. Which configuration is required on the on-premises Active Directory?
Create a computer account named AZUREADSSOACC in each AD forest
Seamless SSO requires creating a computer account named AZUREADSSOACC in each on-premises Active Directory forest. This account represents the cloud authentication service. No additional servers or connection points are needed.
A company uses Azure AD Identity Protection. The security administrator wants to block user sign-ins when the sign-in risk level is detected as 'High' for a custom SaaS application. Which Conditional Access policy configuration should the administrator use?
Create a Conditional Access policy set to block access when sign-in risk is high
Conditional Access policies can use 'Sign-in risk' as a condition. By setting the sign-in risk level to 'High' and the access control to 'Block access', the policy will block sign-ins matching that risk. Grant controls like 'Require MFA' would be used for lower risk levels but not block. Session controls are for controlling sessions after access. The policy must be scoped to the specific cloud app. Therefore, the correct approach is a Conditional Access policy that blocks access when sign-in risk is high.
A company uses Microsoft Entra ID P1 licenses. They want to enforce multi-factor authentication (MFA) for all users accessing a critical cloud application. However, they have a group of service accounts that cannot perform MFA and must be excluded. What is the recommended approach?
Create a Conditional Access policy that targets the application, requires MFA, and excludes the service account group
Conditional Access policies allow you to target specific applications and user groups, and exclude groups from the policy. This is the most flexible and recommended method. Per-user MFA is legacy and less manageable; Security Defaults enforces MFA for all without exclusion; Identity Protection risk policies focus on risk rather than access control.
A company has an on-premises Active Directory environment and wants to sync user identities to Microsoft Entra ID while avoiding storing password hashes in the cloud. The company wants to provide seamless single sign-on (SSO) for domain-joined devices. Which authentication method should be chosen?
Pass-Through Authentication (PTA) with Seamless SSO
Pass-Through Authentication (PTA) validates passwords against on-premises Active Directory without storing password hashes in Azure AD. Combined with Seamless SSO, it provides the required SSO experience. Password Hash Sync stores hashes in the cloud. Federation requires additional infrastructure.
A company has a hybrid identity with password hash synchronization. They want to ensure that any user whose account is disabled in on-premises Active Directory is automatically prevented from signing in to Microsoft 365. How can this be achieved?
Ensure Microsoft Entra Connect is configured to synchronize the disabled status; this happens automatically.
By default, Microsoft Entra Connect synchronizes the accountEnabled attribute from on-premises Active Directory. When an on-premises user is disabled, the attribute is set to false in the cloud, which blocks sign-ins. No additional configuration is needed beyond ensuring the synchronization is correctly configured. Dynamic groups or PowerShell scripts are unnecessary because the sync handles this automatically.
A company has purchased Microsoft 365 Business Standard and added the custom domain 'fabrikam.com' to the tenant. The company wants all new users to have 'fabrikam.com' as their default email domain instead of the onmicrosoft.com domain. How should the administrator achieve this?
In the admin center, go to Settings > Domains, select the custom domain, and click 'Set as default'.
In the Microsoft 365 admin center, under Settings > Domains, you can set a custom domain as the default. This ensures that when new users are created, they are assigned the custom domain as their primary email domain. Changing the MX record or using PowerShell aliases does not change the default domain for new users.
A company uses Azure AD Connect with password hash synchronization. They want to allow users to reset their on-premises Active Directory passwords from the cloud Self-Service Password Reset (SSPR) portal. Which additional configuration is required in Azure AD Connect?
Enable password writeback
Password writeback must be enabled in Azure AD Connect to write password changes back to on-premises Active Directory. Enabling SSPR in Azure AD is necessary but without writeback, only cloud passwords can be reset. Federation Services or Application Proxy are not required for this scenario.
A company plans to enable Self-Service Password Reset (SSPR) for all users. The administrator needs to ensure that users are required to register at least two authentication methods before they can use SSPR. Which configuration setting should the administrator modify?
Set the 'Number of methods required to reset' to 2 in the SSPR authentication methods settings.
SSPR authentication methods are configured in the Microsoft Entra admin center under Password reset > Authentication methods. The administrator sets the 'Number of methods required to reset' to 2. This forces users to register two methods (e.g., phone and email) during registration.
A company has a Microsoft 365 tenant with domain contoso.com. They own an additional domain fabrikam.com and have already added and verified it with a TXT record. Now they need to configure email to be routed to Exchange Online for fabrikam.com. Which DNS record must they create?
MX record pointing to contoso-com.mail.protection.outlook.com
To route email to Exchange Online, an MX record must be created pointing to the tenant's mail exchanger (e.g., contoso-com.mail.protection.outlook.com). The CNAME for Autodiscover, SPF TXT record, and SRV record are supplementary but not the primary record for mail routing.
A company uses Azure AD Privileged Identity Management (PIM) for role activation. They want to require that any activation of the Security Administrator role be approved by a designated group of approvers called 'Security Approvers'. Activations must include a ticket number and expire after 8 hours. Which PIM configuration should the administrator modify?
Role settings for Security Administrator
Role settings in PIM control activation requirements, including approval, justification, and maximum activation duration. Role assignments define who is eligible. Access reviews are for periodic reviews. Alerts notify of suspicious activities. Therefore, the administrator should modify the role settings for Security Administrator.
A company uses Azure AD Identity Protection. The security team wants to automatically block sign-ins that are detected as coming from a known malicious IP address. Which policy should be configured?
Sign-in risk policy
Sign-in risk policy can block sign-ins based on risk levels. Known malicious IP addresses are detected as sign-in risk events (e.g., sign-ins from anonymous IP addresses or known malicious IPs). User risk policy deals with user account compromise.
MS-102 flashcards by domain
The MS-102 flashcard bank covers all 4 official blueprint domains published by Microsoft. Cards are distributed proportionally, so domains with higher exam weight have more cards.
Domain Coverage
Deploy and manage a Microsoft 365 tenant
Implement and manage identity and access in Microsoft Entra ID
Manage security and threats by using Microsoft Defender XDR
Manage compliance by using Microsoft Purview
Flashcards vs practice tests: which is better for MS-102?
Both flashcards and practice questions are evidence-based study tools. The difference is in what they train:
Flashcards — concept retention
Best for memorising definitions, acronyms, protocol behaviours, command syntax, and conceptual distinctions. Use flashcards to build the foundational vocabulary that MS-102 questions assume you know.
Best in: weeks 1–3
Practice tests — application
Best for applying concepts to realistic scenarios, eliminating distractors, and building exam stamina.MS-102 questions test scenario reasoning — not just recall — so practice tests are essential.
Best in: weeks 3–6
The most effective MS-102 study plan combines both: use flashcards for the first 2–3 weeks to build conceptual foundations, then shift to practice tests and mock exams in the final 2–3 weeks to apply and benchmark that knowledge. Most candidates who pass on their first attempt use both tools.
MS-102 flashcards — frequently asked questions
Are the MS-102 flashcards free?
Yes — all MS-102 flashcards on Courseiva are completely free, no account required. Every card includes the question, correct answer, and a full explanation. Create a free account to track which cards you have studied and get spaced repetition recommendations.
How many MS-102 flashcards are on Courseiva?
Courseiva has 300+ original MS-102 flashcards across all 4 exam blueprint domains. New cards are added regularly as the question bank grows. All cards are written by certified engineers against the official Microsoft exam objectives.
How are Courseiva flashcards different from Anki or Quizlet?
Courseiva flashcards are purpose-built for IT certification exams. Unlike generic flashcard platforms where content quality varies, every Courseiva card is mapped to the official MS-102 exam blueprint, written by engineers who hold the certification, and includes a full explanation of the correct answer and why the distractors are wrong. This explanation quality is what separates genuine learning from rote memorisation.
Can I use MS-102 flashcards offline?
Courseiva is a web platform — an internet connection is required. For offline study, we recommend creating free Courseiva account, using the platform in your browser, and using your device's offline capabilities if your browser supports offline web apps.
Track your MS-102 flashcard progress
Save your results, see which domains need more work, and get spaced repetition recommendations — all free.
Sign Up FreeFree forever · Every certification included