MS-102 Practice Test 12 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps. A user reports receiving a suspicious email with a link to a known phishing site. You need to prevent other users from clicking similar links in the future. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the URL to the Tenant Allow/Block List in Microsoft 365 Defender. The Tenant Allow/Block List in Microsoft 365 Defender allows you to block specific URLs across the organization, preventing users from accessing known phishing sites. Option A is incorrect because attack simulation training is for user education, not blocking links. Option B is incorrect because Safe Attachments policies only handle email attachments, not URLs. Option C is incorrect because spam filter policies manage spam classification, not specific URLs.

Answer

Use the attack simulation training to educate users

Answer

Create a Safe Attachments policy to block the attachment

Answer

Configure a spam filter policy to block the sender

Question 2

Your organization is implementing Microsoft Purview Communication Compliance to detect potential insider trading. You need to scan internal emails for specific patterns and assign reviewers from the legal team. What is the minimum number of policies required?

Accepted Answer

One policy with multiple conditions.. A single Communication Compliance policy can contain multiple conditions (such as sensitive info types, keyword dictionaries, and trainable classifiers) and can define multiple reviewers or reviewer groups within the same policy. Since the requirement is to scan internal emails for specific patterns AND assign legal reviewers, both can be configured inside one policy, making one the minimum number required.

Answer

Three policies: one for patterns, one for reviewers, and one for storage.

Answer

Zero, as Communication Compliance does not support custom policies.

Answer

Two policies: one for each pattern.

Question 3

A company has a Microsoft 365 tenant with domain contoso.com. They own an additional domain fabrikam.com and have already added and verified it with a TXT record. Now they need to configure email to be routed to Exchange Online for fabrikam.com. Which DNS record must they create?

Accepted Answer

MX record pointing to contoso-com.mail.protection.outlook.com. To route email for fabrikam.com to Exchange Online, you must create an MX record that points to the Exchange Online mail exchanger. The correct target is contoso-com.mail.protection.outlook.com, where 'contoso-com' is the hashed version of the primary domain (contoso.com) used by Microsoft 365. This MX record tells the internet's mail servers to deliver messages addressed to @fabrikam.com into the tenant's Exchange Online environment.

Answer

CNAME record for autodiscover

Answer

TXT record for SPF

Answer

SRV record for SIP

Question 4

You are a Microsoft 365 administrator. A user reports that they cannot send emails to a specific external domain. You check the Exchange Admin Center and see that the domain is not blocked. What should you check next?

Accepted Answer

Check the mail flow rules (transport rules) in Exchange Online.. Mail flow rules (transport rules) in Exchange Online can block or redirect messages based on conditions like sender, recipient domain, or message content, even if the domain is not listed in any block list. Since the domain is not blocked in the spam filter or outbound policies, a transport rule is the most likely cause of the issue, as it can silently reject or quarantine messages without appearing in the standard block lists.

Answer

Verify that the user has a full mailbox and is not over the send limit.

Answer

Review the outbound spam filter policy.

Answer

Check the spam filter policy to see if the domain is on the blocked sender list.

Question 5

Your organization wants to use Microsoft Intune to manage devices. You need to ensure that only corporate-owned devices can enroll. What configuration should you use?

Accepted Answer

Configure enrollment restrictions to block personally owned devices.. Enrollment restrictions in Microsoft Intune allow you to block personally owned devices by setting the 'Allow personally owned devices' option to 'No' for the platform. This ensures that only corporate-owned devices, which are identified by their corporate enrollment token or IMEI/MEID numbers, can enroll. This is the direct and intended method to restrict enrollment to corporate-owned devices only.

Answer

Use a conditional access policy to require device compliance.

Answer

Set a compliance policy requiring devices to be marked as corporate.

Answer

Create a device type restriction for iOS and Android.

Question 6

You are configuring Microsoft Defender for Office 365 anti-phish policy. You want to protect against user impersonation attacks. The CEO and CFO are frequent targets. What should you configure in the anti-phish policy?

Accepted Answer

Enable user impersonation protection and add the CEO and CFO as protected users. User impersonation protection in anti-phish policies allows you to add specific users (e.g., CEO and CFO) as protected users. This protects against attacks where an attacker impersonates those users. Option A is incorrect because spoof intelligence protects against domain spoofing, not user impersonation. Option B is incorrect because domain impersonation protects against impersonation of entire domains, not individual users. Option D is incorrect because mailbox intelligence is a feature that learns user communication patterns to detect impersonation, but it is not the configuration to protect specific users.

Answer

Configure spoof intelligence

Answer

Add the CEO and CFO's domains to domain impersonation

Answer

Enable mailbox intelligence

Question 7

Your organization has a hybrid identity setup with Azure AD Connect. You need to ensure that users can reset their passwords from the cloud and have the changes synchronized back to on-premises Active Directory. Which feature must you enable?

Accepted Answer

Password writeback.. Password writeback is the Microsoft Entra Connect feature that enables password changes performed in the cloud (e.g., via Microsoft Entra ID SSPR) to be written back to on-premises Active Directory. This ensures the on-premises password stays synchronized with the cloud, which is required for hybrid identity scenarios where users reset passwords from the cloud.

Answer

Seamless single sign-on.

Answer

Pass-through authentication.

Answer

Password hash synchronization.

Question 8

You are a Microsoft 365 administrator. A user reports that they received a Microsoft Teams message from an external user containing a link to a malicious website. The user clicked the link but did not enter any credentials. You need to prevent similar incidents in the future. What should you configure?

Accepted Answer

Enable Safe Links for Microsoft Teams in Defender for Office 365.. Enabling Safe Links for Microsoft Teams in Defender for Office 365 provides time-of-click protection for links shared in Teams. Option A is wrong because blocking all external messages would hinder collaboration. Option B is wrong because Safe Attachments scans files, not links. Option D is wrong because anti-phishing policies protect against impersonation, not malicious links.

Answer

Configure a Teams messaging policy to block all messages from external users.

Answer

Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams.

Answer

Configure an anti-phishing policy to protect against impersonation in Teams.

Question 9

You are the Microsoft 365 administrator for a company that uses Microsoft Entra ID P1 and Microsoft 365 E3. A new security policy requires that when users sign in from outside the corporate network, they must use Microsoft Entra multifactor authentication. However, users signing in from the corporate office network must not be prompted for MFA. The corporate office has a public IP address range of 203.0.113.0/24. You create a named location called 'Corporate Office' with this IP range. What should you do next to meet the requirement?

Accepted Answer

Create a conditional access policy that targets all users and all cloud apps, set the condition to exclude the 'Corporate Office' named location, and require multifactor authentication.. A conditional access policy is the correct tool to enforce MFA based on network location. By excluding a named location containing the corporate IP range, the policy applies MFA only when users sign in from outside that range. This satisfies the security policy while avoiding unnecessary prompts for on-premises users.

Answer

Create a conditional access policy that targets all users and all cloud apps, set the condition to include the 'Corporate Office' named location, and require multifactor authentication.

Answer

Configure the 'Corporate Office' named location as trusted and enable security defaults.

Answer

Enable Microsoft Entra multifactor authentication per user for all users, and configure the corporate IP range as trusted IPs in the MFA service settings.

Question 10

A security administrator wants to configure Microsoft Defender for Cloud Apps to block downloads of sensitive files from Salesforce to unmanaged devices in real time. Which Defender for Cloud Apps component must be configured?

Accepted Answer

Conditional Access App Control. Conditional Access App Control (CAAC) is the correct component because it enables real-time session-level monitoring and control of user activities in SaaS apps like Salesforce. By integrating with Microsoft Entra Conditional Access, CAAC can enforce policies to block downloads of sensitive files to unmanaged devices at the moment of access, using reverse proxy architecture to inspect and intervene in the traffic.

Answer

Cloud Discovery

Answer

App Connectors

Answer

Activity policies

Question 11

A security administrator needs to discover which cloud apps are being used in the organization and then block usage of unsanctioned apps in real time using a reverse proxy. Which two Microsoft Defender for Cloud Apps features must be configured to meet these requirements? (Select all that apply.)

Accepted Answer

Cloud Discovery. Cloud Discovery (A) is correct because it analyzes traffic logs from your network to identify all cloud apps in use, providing visibility into sanctioned and unsanctioned apps. Conditional Access App Control (C) is correct because it enforces real-time access controls via a reverse proxy, allowing you to block unsanctioned apps as users attempt to access them.

Answer

App Connectors

Answer

API connectors

Question 12

Your organization has a Microsoft 365 E5 tenant. You need to ensure that users are prompted to register for multifactor authentication (MFA) the first time they sign in. Which Microsoft Entra ID policy should you configure?

Accepted Answer

Create a Conditional Access policy requiring MFA and enable Microsoft Entra ID Identity Protection to enforce MFA registration. Combining a Conditional Access policy that requires MFA with Identity Protection's MFA registration policy ensures users are prompted to register for MFA at first sign-in. The MFA registration policy in Identity Protection specifically enforces that users must register their authentication methods before accessing applications, which triggers the registration prompt on initial authentication.

Answer

Enable Security defaults

Answer

Enable combined registration for SSPR and MFA

Answer

Configure MFA service settings per-user

Question 13

You need to prevent users from registering security information for Microsoft Entra self-service password reset (SSPR) if they are not in a specific group. What should you configure?

Accepted Answer

SSPR scope setting to require group membership. The SSPR scope setting in Microsoft Entra ID allows you to restrict self-service password reset registration and usage to a specific group of users. By configuring the scope to 'Selected' and choosing the group, only members of that group can register security information for SSPR. This directly prevents users outside the group from registering.

Answer

Microsoft Entra Identity Protection user risk policy

Answer

Combined registration for SSPR and Microsoft Entra multifactor authentication

Answer

Conditional Access policy to block registration for non-group members

Question 14

Contoso frequently collaborates with a partner company (Fabrikam) via B2B collaboration. Contoso uses Microsoft Entra ID P2 licenses and wants to require Fabrikam's guest users to authenticate using Contoso's MFA policies, ignoring any MFA claims from the Fabrikam home tenant. Fabrikam already has MFA enabled for its users. What configuration should Contoso make in their cross-tenant access settings?

Accepted Answer

Configure inbound trust settings to uncheck 'Trust multi-factor authentication from Microsoft Entra tenants' for Fabrikam. Contoso wants to ignore MFA claims from Fabrikam's home tenant and enforce its own MFA policies on Fabrikam guest users. In cross-tenant access settings, the 'Trust multi-factor authentication from Microsoft Entra tenants' checkbox controls whether inbound MFA claims from the external tenant are accepted. By unchecking this for Fabrikam, Contoso ensures that Fabrikam's MFA claims are ignored, and Contoso's Conditional Access policies (including MFA requirements) apply to those guest users.

Answer

Configure outbound access settings to require MFA for Fabrikam users

Answer

Create a Conditional Access policy targeting all guest users from Fabrikam that requires MFA

Answer

Configure B2B direct connect for Fabrikam and require MFA

Question 15

You are configuring Microsoft Defender for Office 365 to protect against business email compromise (BEC) attacks. Which policy setting should you enable to analyze email sender behavior and detect impersonation attempts?

Accepted Answer

Anti-phishing policy - Impersonation protection. Anti-phishing policies in Microsoft Defender for Office 365 include impersonation protection settings that analyze sender behavior and detect attempts to impersonate users, domains, or trusted senders. Enabling impersonation protection specifically addresses BEC by using mailbox intelligence and spoof intelligence to identify anomalous sender patterns.

Answer

Safe Attachments policy - Dynamic Delivery

Answer

Safe Links policy - URL scan

Answer

Anti-malware policy - Malware filter