MS-102 Practice Test 11 — 15 Questions

Question 1

A company wants to implement just-in-time (JIT) privileged access for the Security Administrator role. Users must be able to activate the role with a business justification, and the activation must be approved by a designated group of approvers. The role activation should expire after 4 hours. Which Privileged Identity Management (PIM) configuration should the administrator modify?

Accepted Answer

Role settings for the Security Administrator role. To configure just-in-time (JIT) privileged access with approval, expiration, and justification requirements, you must modify the Role settings for the Security Administrator role in Privileged Identity Management (PIM). Role settings control activation parameters such as maximum activation duration (4 hours), whether approval is required, and whether justification is mandatory. This is the only place where these activation policies are defined.

Answer

Assignments (Eligible) for the Security Administrator role

Answer

Assignments (Active) for the Security Administrator role

Answer

Notifications settings under PIM

Question 2

A company wants to require MFA for all users when they access Office 365 from any network location that is not the company's trusted IP ranges. Which Conditional Access policy configuration should be applied?

Accepted Answer

A: Include all users, exclude none, grant access require MFA with condition 'Location not in trusted locations'.. Option A correctly configures a Conditional Access policy that targets all users and applies the 'Require MFA' grant control when the location condition is set to 'Any location' except the company's trusted IP ranges. This ensures MFA is enforced for all access attempts originating from outside the trusted network, meeting the requirement precisely.

Answer

B: Include all users, exclude none, block access with condition 'Location not in trusted locations'.

Answer

C: Include all users, exclude trusted locations as a group, grant access require MFA.

Answer

D: Include all users, exclude all locations, grant access require MFA.

Question 3

A company uses Password Hash Synchronization (PHS) to synchronize identities to Microsoft Entra ID. They want to enable users to access Microsoft 365 applications from their domain-joined work devices without being prompted to re-enter their credentials. Which feature should they enable in addition to PHS?

Accepted Answer

Seamless Single Sign-On. Seamless Single Sign-On (SSO) is the correct feature to enable alongside Password Hash Synchronization (PHS) because it allows users on domain-joined devices to automatically authenticate to Microsoft 365 applications without being prompted for credentials. It works by integrating with Kerberos authentication, using a computer account in the on-premises Active Directory to issue a Kerberos ticket that Microsoft Entra ID can validate, eliminating the need for re-authentication.

Answer

Pass-through Authentication

Answer

Azure AD Connect Health

Answer

Conditional Access

Question 4

A company uses Microsoft Entra ID with conditional access policies. They need to ensure that all external users who are invited via B2B collaboration must perform multi-factor authentication (MFA) when accessing the corporate SharePoint Online site. Which two configurations are required? (Choose two.)

Accepted Answer

Create a conditional access policy targeting all guest users, requiring MFA, and scope to SharePoint Online.. Option A is correct because a conditional access policy in Microsoft Entra ID can be configured to target 'Guest or external users' (the 'All guest users' scope) and require multi-factor authentication (MFA) when accessing SharePoint Online. This directly enforces MFA for B2B collaboration users accessing the corporate SharePoint site, as the policy is evaluated at the resource tenant (the tenant hosting SharePoint).

Answer

Configure the SharePoint Online external sharing settings to require MFA for guest users.

Answer

Set the guest user access level in the SharePoint admin center to require MFA.

Question 5

A company uses Microsoft Entra ID P2 licenses. The security team wants to automatically block sign-ins for users with high sign-in risk, but only when the sign-in originates from outside the corporate network. For sign-ins from the corporate network, they want to require a password change for medium sign-in risk. A group of emergency access accounts (break-glass) must be excluded from all policies. What should the administrator implement?

Accepted Answer

Two Conditional Access policies: one for external locations that blocks high risk, and one for internal locations that requires password change for medium risk. Both exclude the break-glass group.. Option B is correct because Conditional Access policies evaluate conditions like location and sign-in risk separately, and combining both conditions (external vs. internal) with different grant controls (block vs. require password change) in a single policy is not supported. Two separate policies are required: one for external locations with high risk to block, and one for internal locations with medium risk to require password change. Both must exclude the break-glass group to ensure emergency access is never blocked.

Answer

single Conditional Access policy that blocks access for high risk from external locations and requires password change for medium risk from internal locations, excluding the break-glass group.

Answer

An Identity Protection user risk policy that blocks high-risk users and prompts for password change for medium-risk users, configured to exclude the break-glass group.

Answer

Conditional Access policy that requires multi-factor authentication for all users except break-glass, and a separate sign-in risk policy for blocking high risk from external locations.

Question 6

A company uses Microsoft Entra ID P2 licenses. They want to create a Conditional Access policy that requires MFA for all users, but the policy should only be enforced when the sign-in risk is medium or higher. Additionally, they need to exclude a group named 'Emergency Access' from this policy. Which configuration is correct?

Accepted Answer

Assign policy to 'All users', exclude 'Emergency Access' group, set 'Sign-in risk' condition to 'High and Medium'. Option A is correct because it assigns the Conditional Access policy to 'All users' (ensuring universal coverage), excludes the 'Emergency Access' group (to prevent lockout of break-glass accounts), and sets the 'Sign-in risk' condition to 'High and Medium' — which matches the requirement to enforce MFA only when sign-in risk is medium or higher. Sign-in risk is the correct condition for real-time risk during authentication, while user risk tracks historical compromise likelihood.

Answer

Assign policy to 'All users', exclude 'Emergency Access' group, set 'User risk' condition to 'High and Medium'

Answer

Assign policy to 'Emergency Access' group, set 'Device state' condition to 'All device states'

Answer

Assign policy to 'All users', exclude 'Emergency Access' group, set 'Locations' condition to 'All trusted locations'

Question 7

A company wants to reduce help desk calls by allowing users to reset their own passwords securely. Users should be able to reset their passwords using a mobile phone number or email as verification. Which Microsoft Entra ID feature should be enabled?

Accepted Answer

Self-Service Password Reset (SSPR). Self-Service Password Reset (SSPR) is the Microsoft Entra ID feature specifically designed to allow users to reset their own passwords without help desk intervention. It supports verification methods such as mobile phone number (via SMS or phone call) and email, meeting the company's requirement for secure, user-driven password resets.

Answer

Conditional Access

Answer

Password Protection

Answer

Identity Protection

Question 8

A compliance officer needs to automatically retain documents in a SharePoint Online document library for 7 years and then automatically delete them. The retention must be applied based on when the document is created. Which Microsoft Purview feature should be configured?

Accepted Answer

Data Lifecycle Management. Data Lifecycle Management (DLM) in Microsoft Purview allows you to create retention labels that automatically retain content for a specified period (e.g., 7 years) based on the date the document was created, and then trigger a disposal action such as deletion. This feature is designed specifically for managing the lifecycle of data in SharePoint Online, including automatic retention and deletion based on metadata like creation date.

Answer

Records Management

Answer

eDiscovery

Answer

Communication Compliance

Question 9

A company wants to use Azure AD Identity Protection features such as user risk policies and sign-in risk policies to automatically respond to risky behavior. Which Azure AD license is required to enable these capabilities?

Accepted Answer

Azure AD Premium P2. Azure AD Identity Protection features like user risk policies and sign-in risk policies require Azure AD Premium P2. This is because P2 includes Identity Protection, which provides risk-based conditional access policies that automatically respond to detected risks. Azure AD Premium P1 supports Conditional Access but lacks the risk detection and automated remediation capabilities of Identity Protection.

Answer

Azure AD Free

Answer

Azure AD Premium P1

Answer

Microsoft 365 E3

Question 10

A company uses password hash synchronization with Microsoft Entra Connect. The security team wants to enable self-service password reset (SSPR) so that users can reset their own passwords, and the password changes must be written back to the on-premises Active Directory. Which additional configuration is required to achieve password writeback?

Accepted Answer

Install Microsoft Entra Connect with password writeback enabled. Password writeback requires the installation of Microsoft Entra Connect with the password writeback feature explicitly enabled during setup. This allows password changes initiated via SSPR to be written back to on-premises Active Directory. Option C is correct because it directly addresses the necessary infrastructure component.

Answer

Configure SSPR to use federation with on-premises AD FS

Answer

Enable password hash synchronization in Microsoft Entra Connect

Answer

Set the SSPR property 'Password writeback' to 'Yes' in the Microsoft Entra admin center

Question 11

A compliance officer needs to ensure that all outbound emails containing credit card numbers sent to external recipients are automatically encrypted without requiring user intervention. Which Microsoft Purview feature should be configured?

Accepted Answer

Data Loss Prevention (DLP) policy with a rule that encrypts the message when credit card numbers are detected.. Option A is correct because a Data Loss Prevention (DLP) policy in Microsoft Purview can be configured with a rule that automatically detects credit card numbers (using a built-in sensitive info type) and applies encryption via Transport Layer Security (TLS) or Information Rights Management (IRM) to outbound emails sent to external recipients. This meets the compliance officer's requirement for automatic encryption without user intervention, as the DLP rule triggers encryption at the transport level in Exchange Online.

Answer

Sensitivity label with auto-labeling based on credit card numbers.

Answer

Retention policy for Exchange Online.

Answer

eDiscovery case for content search.

Question 12

A junior administrator needs permission to view sign-in logs, audit logs, and security recommendations in the Microsoft Entra admin center, but must not be able to reset passwords, modify settings, or manage roles. Which built-in Microsoft Entra role should the administrator assign?

Accepted Answer

Security Reader. The Security Reader role grants read-only access to security-related data, including sign-in logs, audit logs, and security recommendations, without permitting any write operations such as password resets, setting modifications, or role management. This aligns precisely with the junior administrator's required permissions.

Answer

Global Reader

Answer

Reports Reader

Answer

Security Administrator

Question 13

A compliance officer wants to automatically apply a 'Confidential' sensitivity label to documents in SharePoint Online that contain credit card numbers. Which two Microsoft Purview features must be configured together? (Choose two.)

Accepted Answer

Data Loss Prevention (DLP) policy. To automatically apply a 'Confidential' sensitivity label to documents containing credit card numbers in SharePoint Online, you must configure a sensitivity label with auto-labeling (client-side or service-side) to detect the sensitive content, and a Data Loss Prevention (DLP) policy to enforce the labeling action. The DLP policy can be set to automatically apply the sensitivity label when credit card patterns are matched, using the same sensitive info types as auto-labeling. Together, they ensure that content is both classified and protected at rest.

Answer

Retention label policy

Answer

Microsoft Purview Information Protection scanner

Question 14

A user receives an email from an unknown sender with a .zip attachment. The attachment contains a potentially malicious executable file. Microsoft Defender for Office 365 is enabled. Which feature dynamically detonates the attachment in a sandbox environment and blocks it if malicious behavior is detected?

Accepted Answer

Safe Attachments. Safe Attachments is the correct feature because it specifically detonates email attachments in a dynamic sandbox environment, analyzing behavior in real time. If the .zip file contains a malicious executable, Safe Attachments will block the email before delivery, preventing the user from accessing the threat. This is distinct from other Defender for Office 365 features that focus on URLs, phishing content, or spam filtering.

Answer

Safe Links

Answer

Anti-phishing

Answer

Anti-spam

Question 15

A company wants to allow users to reset their own passwords without administrator intervention. They need to configure Self-Service Password Reset (SSPR) for all cloud-only users. Which Azure AD license is required for all users to enable SSPR?

Accepted Answer

Azure AD Premium P1. Azure AD Premium P1 includes the Self-Service Password Reset (SSPR) capability for cloud-only users. Azure AD Free only supports SSPR for cloud users if the tenant has at least one Azure AD Premium P1 license assigned, but the feature itself is a Premium P1 benefit. Microsoft 365 Business Basic does not include SSPR; it provides basic identity features without password reset self-service. Azure AD Premium P2 includes all P1 features plus Identity Protection and Privileged Identity Management, but SSPR does not require P2.

Answer

Azure AD Free

Answer

Microsoft 365 Business Basic

Answer

Azure AD Premium P2