MS-102 Practice Test 1 — 10 Questions

Question 1

Which THREE steps are required to enable group-based licensing?

Accepted Answer

Add members to the group. Group-based licensing in Azure AD requires that you add members to the security group that will have the license assigned. Without members, the license assignment has no effect, as the license is applied to all users in the group. This step ensures that the intended users receive the license automatically based on group membership.

Answer

Configure Azure AD Connect

Answer

Ensure group is mail-enabled

Question 2

Your organization has Microsoft Defender for Cloud Apps (MCAS) deployed. You need to create a policy that automatically blocks downloads of files classified as 'Highly Confidential' from SharePoint Online to unmanaged devices. Which policy type should you use?

Accepted Answer

Session policy. A session policy in Microsoft Defender for Cloud Apps (MCAS) is the correct choice because it enables real-time monitoring and control of user activities in cloud apps, such as blocking downloads based on file sensitivity labels. This policy type uses reverse proxy architecture to inspect and intervene in user sessions, allowing you to block downloads of 'Highly Confidential' files from SharePoint Online to unmanaged devices.

Answer

Access policy

Answer

Activity policy

Answer

App discovery policy

Question 3

Your Microsoft 365 tenant has 50,000 users. You are planning to migrate mailboxes from on-premises Exchange Server 2019 to Exchange Online using a full hybrid configuration. During the migration, you must ensure that free/busy information is synchronized between on-premises and Exchange Online. Which component is required for free/busy synchronization in a hybrid deployment?

Accepted Answer

Exchange Hybrid Server (or Hybrid Agent). In a full hybrid configuration, free/busy synchronization between on-premises Exchange and Exchange Online is handled by the Exchange Hybrid Server (or the newer Hybrid Agent). This component acts as a bridge, using the Exchange Web Services (EWS) and Autodiscover service to securely relay free/busy data between the two organizations. Without it, the Availability service cannot query the remote forest for calendar information.

Answer

Azure AD Connect

Answer

Exchange Online connector (Outbound to on-premises)

Answer

Hybrid Configuration Wizard

Question 4

A company uses Microsoft Entra ID P1 licenses. They want to enforce multi-factor authentication (MFA) for all users accessing a critical cloud application. However, they have a group of service accounts that cannot perform MFA and must be excluded. What is the recommended approach?

Accepted Answer

Create a Conditional Access policy that targets the application, requires MFA, and excludes the service account group. Conditional Access policies allow granular control by targeting specific cloud applications and requiring MFA, while excluding groups like service accounts that cannot perform MFA. This approach is the recommended method because it avoids the limitations of per-user MFA (which is deprecated) and Security Defaults (which cannot exclude specific accounts).

Answer

Enable per-user MFA for all users, then disable it for each service account

Answer

Enable Security Defaults

Answer

Use Identity Protection risk policies

Question 5

A company plans to enable Self-Service Password Reset (SSPR) for all users. The administrator needs to ensure that users are required to register at least two authentication methods before they can use SSPR. Which configuration setting should the administrator modify?

Accepted Answer

Set the 'Number of methods required to reset' to 2 in the SSPR authentication methods settings.. The 'Number of methods required to reset' setting directly controls how many authentication methods a user must provide during the SSPR reset process. By setting this value to 2, the administrator ensures that users must register at least two methods (e.g., phone and email) before they can reset their password, as SSPR requires the registered methods to match the reset requirement.

Answer

Enable combined registration for SSPR and Microsoft Entra ID Multi-Factor Authentication.

Answer

Configure a Conditional Access policy requiring MFA registration for SSPR.

Answer

Set the 'Number of questions required to register' to 2 in the security questions settings.

Question 6

You are reviewing a Conditional Access policy in Microsoft Entra ID. The exhibit shows the policy configuration. You need to allow users to access Office 365 applications from personal devices that are not enrolled in Microsoft Intune. However, the policy currently blocks access because it requires a compliant device. Users are prompted for MFA but then blocked due to device compliance. What should you modify in the policy?

Accepted Answer

Remove "compliantDevice" from the builtInControls grant control list.. The policy currently uses the 'Require compliant device' grant control, which blocks access from devices not enrolled in Intune or not meeting compliance policies. Removing 'compliantDevice' from the builtInControls list allows access from personal, non-enrolled devices while still enforcing MFA. This directly resolves the scenario where users pass MFA but are blocked by device compliance.

Answer

Add a session control for sign-in frequency.

Answer

Remove the cloudAppSecurity session control.

Answer

Change cloudAppSecurityType to "blockDownloads".

Question 7

A company has a Microsoft 365 tenant with the domain contoso.com. They acquire a subsidiary with the domain fabrikam.com and want to add it as an additional domain to the same tenant. The domain is already purchased and DNS management is available. What is the first step the administrator should take in the Microsoft 365 admin center?

Accepted Answer

Add the domain and verify ownership by adding a TXT record. To add an existing domain like fabrikam.com to a Microsoft 365 tenant, the first step is to add the domain in the Microsoft 365 admin center and then verify ownership by adding a TXT record to the domain's DNS zone. This verification proves the administrator controls the domain, which is a prerequisite for using it with Microsoft 365 services such as Exchange Online or SharePoint.

Answer

Create a new tenant for fabrikam.com

Answer

Set up email forwarding from contoso.com to fabrikam.com

Answer

Convert fabrikam.com to a federated domain

Question 8

A compliance officer needs to automatically identify and label content that is conceptually similar to existing sensitive documents, such as internal strategy memos or proprietary technical specifications, without relying on explicit keywords or recognized sensitive information types. Which Microsoft Purview solution should the officer use to achieve this?

Accepted Answer

trainable classifier. A trainable classifier uses machine learning to identify content based on patterns and context learned from sample documents, making it ideal for recognizing conceptually similar content without relying on explicit keywords or predefined sensitive information types. This allows the compliance officer to automatically label internal strategy memos or proprietary technical specifications that share conceptual similarity with existing sensitive documents.

Answer

sensitive information type

Answer

An auto-labeling policy with a retention label

Answer

Data Loss Prevention (DLP) policy that blocks sharing

Question 9

A compliance officer needs to automatically apply a retention label to all documents in SharePoint Online that contain the exact phrase 'Contract'. The label must retain the documents for 10 years. Which Microsoft Purview feature should the officer configure?

Accepted Answer

An auto-apply retention label using a content query (KQL). An auto-apply retention label using a content query (KQL) allows you to define a specific keyword or phrase (e.g., 'Contract') to automatically label documents in SharePoint Online that contain that exact text. This meets the requirement to retain documents for 10 years by applying the label based on content matching, without needing a pre-trained classifier.

Answer

retention policy applied to the entire site

Answer

Data Loss Prevention (DLP) policy

Answer

An auto-apply retention label using a trainable classifier

Question 10

A compliance officer needs to prevent users from sending emails that contain sensitive information, such as social security numbers, to external recipients. If a user attempts to send such an email, the action should be blocked and a policy tip should be displayed to the user. Which Microsoft Purview solution should the officer configure?

Accepted Answer

Data Loss Prevention (DLP) policy. A Data Loss Prevention (DLP) policy in Microsoft Purview is designed to inspect email content for sensitive information (e.g., social security numbers) and can block the message while displaying a policy tip to the user. This matches the requirement exactly, as DLP policies enforce actions on data in transit (email) with user notifications.

Answer

sensitivity label with encryption

Answer

Information Rights Management (IRM)

Answer

retention label with deletion