MS-102 Practice Test 12 — 15 Questions

Question 1

Your Microsoft 365 tenant contains sensitive financial data that must be retained for 7 years. You configure a retention policy in Microsoft Purview compliance portal. After 7 years, the data is still accessible to users. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The retention policy does not include a deletion action.. A retention policy in Microsoft Purview can be configured to only retain data without a deletion action. If the policy lacks a deletion action, data will be preserved for the specified period but will not be automatically removed after that period expires, leaving it accessible to users. The scenario describes data still being accessible after 7 years, which directly indicates that no deletion action was configured to remove the data at the end of the retention period.

Answer

A litigation hold is applied to the data.

Answer

The retention policy is configured to retain data for 7 years and then delete it.

Answer

The data is marked as a record and requires disposition review.

Question 2

An organization is involved in a legal case and needs to preserve all emails in a user's mailbox, including future emails, without deleting or modifying them. The user must continue to work normally. Which Microsoft Purview feature should be applied to the user's mailbox?

Accepted Answer

Litigation Hold. Litigation Hold (option A) is the correct feature because it preserves all mailbox content, including future emails, in its original state without allowing deletion or modification by users or automated processes. Unlike a retention policy, Litigation Hold places the entire mailbox on indefinite hold, ensuring that any item changed or deleted by the user is retained in the Recoverable Items folder, while the user continues to work normally. This meets the legal preservation requirement without disrupting daily operations.

Answer

Retention policy

Answer

Sensitivity label

Answer

Data Loss Prevention (DLP)

Question 3

A compliance officer needs to ensure that all documents in a SharePoint Online library are automatically labeled with a 'Confidential' sensitivity label if they contain at least one of a predefined list of sensitive information types such as credit card numbers or social security numbers. Users should be able to override the label with a business justification. Which Microsoft Purview feature should the officer configure?

Accepted Answer

Auto-labeling policy for SharePoint Online. Auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels to documents in SharePoint Online based on the detection of sensitive information types (e.g., credit card numbers, SSNs). This policy supports user override with a business justification, meeting the compliance officer's requirement exactly. Manual classification (Option D) would not automate the labeling, and DLP policies (Option B) focus on preventing data loss, not applying sensitivity labels.

Answer

Data Loss Prevention (DLP) policy

Answer

Retention label policy

Answer

Sensitivity label with manual classification

Question 4

A compliance officer needs to automatically detect documents in SharePoint Online that contain a custom pattern (e.g., employee ID in the format EMP-12345). The pattern will be used to apply a sensitivity label. Which Microsoft Purview feature should the officer use to define the pattern?

Accepted Answer

Sensitive information types. Sensitive information types (SITs) in Microsoft Purview are specifically designed to define custom patterns, such as regular expressions for employee IDs like EMP-12345. Once defined, these SITs can be used in sensitivity labels to automatically classify and protect documents in SharePoint Online. This is the correct feature because it directly supports pattern-based detection for labeling.

Answer

Data Loss Prevention (DLP) policies

Answer

Content search

Answer

Data classification reports

Question 5

A company has an on-premises Active Directory environment and wants to sync user identities to Microsoft Entra ID while avoiding storing password hashes in the cloud. The company wants to provide seamless single sign-on (SSO) for domain-joined devices. Which authentication method should be chosen?

Accepted Answer

Pass-Through Authentication (PTA) with Seamless SSO. Pass-Through Authentication (PTA) with Seamless SSO is the correct choice because it validates user passwords directly against on-premises Active Directory without storing any password hashes in the cloud. Seamless SSO provides automatic sign-in for domain-joined devices using Kerberos delegation, meeting the requirement for a seamless SSO experience without password hash storage.

Answer

Password Hash Synchronization (PHS)

Answer

Federation with Active Directory Federation Services (AD FS)

Answer

Cloud-only authentication

Question 6

A security analyst has identified a new malware sample with SHA256 hash 'abc123...'. They need to immediately block this file from executing on any managed endpoint across the organization. Which Microsoft Defender for Endpoint capability should they use?

Accepted Answer

Indicators (IoC). Indicators of Compromise (IoC) in Microsoft Defender for Endpoint allow security analysts to create custom indicators (such as file hashes, IPs, or URLs) that are immediately enforced across all managed endpoints. This capability enables blocking execution of a specific SHA256 hash at the kernel level via the Microsoft Defender Antivirus driver, providing near-instant protection without requiring a signature update or policy change.

Answer

Attack surface reduction rules

Answer

Automated investigation and response

Answer

Threat analytics

Question 7

A compliance officer needs to ensure that all emails containing sensitive information (e.g., passport numbers) are automatically encrypted when sent to external recipients. The encryption should be enforced without requiring users to manually select an option. Which Microsoft Purview feature should they configure?

Accepted Answer

Data Loss Prevention (DLP) policy with encryption action. A Data Loss Prevention (DLP) policy with encryption action is correct because it automatically detects sensitive information (e.g., passport numbers) using sensitive info types and enforces encryption via Microsoft Purview Message Encryption (OME) as a rule action. This ensures that when an email containing such data is sent to an external recipient, the email is automatically encrypted without requiring user intervention, meeting the compliance officer's requirement.

Answer

Sensitivity labels with auto-labeling

Answer

Message Encryption (OME) policies

Answer

Communication Compliance

Question 8

An organization uses a third-party SaaS application that supports SAML-based single sign-on. The application is not in the Azure AD gallery. What is the first step to configure SSO?

Accepted Answer

Create a new enterprise application from the 'Non-gallery application' option in Azure AD. The correct first step is to create a new enterprise application from the 'Non-gallery application' option in Azure AD. This allows you to configure SAML-based SSO for any third-party application that supports SAML 2.0, even if it is not listed in the Azure AD gallery. The non-gallery application template provides the necessary endpoints and metadata to establish trust between Azure AD and the SaaS application.

Answer

Configure Azure AD Connect to sync on-premises users

Answer

Add the application in the Microsoft 365 admin center under 'Integrated apps'

Answer

Create a custom role in Azure AD for the application

Question 9

An organization uses Microsoft Defender for Cloud Apps to monitor shadow IT. They want to enforce policies that block downloads from risky cloud apps. Which Microsoft Defender XDR component provides this capability?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps is the correct component because it is specifically designed to provide visibility into shadow IT and enforce policies on cloud applications. Its 'Governance' actions include blocking downloads from risky apps by integrating with the cloud app's API to prevent data exfiltration, which directly addresses the requirement.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Office 365

Question 10

Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM) to manage administrative roles. You need to ensure that when a user activates the Global Administrator role, they must provide a justification and the activation is time-bound. Additionally, you want to require approval from the security team for this activation. What should you configure?

Accepted Answer

Modify the PIM role settings for Global Administrator to require justification, set maximum activation duration, and require approval. Privileged Identity Management (PIM) role settings allow you to enforce activation requirements such as justification, maximum activation duration, and approval. These settings are configured directly in the PIM role settings for the Global Administrator role, ensuring that every activation request is justified, time-bound, and requires approval from designated approvers (e.g., the security team).

Answer

Configure an Identity Protection user risk policy for Global Administrators

Answer

Create an Access Review for Global Administrator role

Answer

Configure a Conditional Access policy requiring MFA for Global Administrator activation

Question 11

A security analyst wants to create a custom detection rule in Microsoft 365 Defender that triggers when a PowerShell process with suspicious command-line arguments is detected on a device, and within 5 minutes, an outbound network connection to a known malicious IP occurs. Which two advanced hunting tables must be joined in the KQL query?

Accepted Answer

DeviceProcessEvents and DeviceNetworkEvents. The detection rule requires correlating a PowerShell process event with an outbound network connection to a known malicious IP within 5 minutes. The correct approach is to join DeviceProcessEvents (for process details) with DeviceNetworkEvents (for network connections) on device ID and timestamp within the time window. Option C is incorrect because DeviceEvents does not reliably contain network connection data; it is intended for other event types. Option B is incorrect because EmailEvents is for email events, not endpoint process or network data. Option D is incorrect because IdentityLogonEvents covers authentication events, not process or network activities.

Answer

EmailEvents and DeviceNetworkEvents

Answer

DeviceEvents and DeviceProcessEvents

Answer

IdentityLogonEvents and DeviceNetworkEvents

Question 12

A compliance officer needs to ensure that no user can permanently delete a document from a specific SharePoint Online site. The document must be kept for at least 5 years. Which Microsoft Purview solution should the officer configure?

Accepted Answer

B: Retention policy for the site with retention period of 5 years and action set to 'Retain'.. A retention policy with the 'Retain' action ensures that documents in the SharePoint site are preserved for the specified period and cannot be permanently deleted by users or system processes. This meets the compliance requirement of a 5-year minimum retention and prevents permanent deletion, as retained items are moved to the Preservation Hold library.

Answer

A: Sensitivity label with a retention period of 5 years.

Answer

C: DLP policy to prevent deletion of documents.

Answer

D: eDiscovery hold on the site.

Question 13

Your organization uses Microsoft Entra ID to manage user identities. You need to ensure that users can sign in using their existing social media accounts, such as Microsoft, Google, or Facebook. What should you configure?

Accepted Answer

Configure External Identities and add identity providers for social networks. Microsoft Entra ID supports External Identities, which allow you to add social identity providers (Microsoft, Google, Facebook) as external authentication sources. This enables users to sign in with their existing social accounts by configuring federation with those providers using OAuth 2.0 or OpenID Connect protocols, without needing to create separate Entra ID accounts.

Answer

Configure Conditional Access policies for social identity providers

Answer

Configure Microsoft Entra Connect to sync social account attributes

Answer

Configure self-service password reset (SSPR)

Question 14

A company wants to require MFA for all users when they access Office 365 from any network location that is not the company's trusted IP ranges. Which Conditional Access policy configuration should be applied?

Accepted Answer

A: Include all users, exclude none, grant access require MFA with condition 'Location not in trusted locations'.. Ly configures a Conditional Access policy that targets all users and applies the 'Require MFA' grant control when the location condition is set to 'Any location' except the company's trusted IP ranges. This ensures MFA is enforced for all access attempts originating from outside the trusted network, meeting the requirement precisely.

Answer

B: Include all users, exclude none, block access with condition 'Location not in trusted locations'.

Answer

C: Include all users, exclude trusted locations as a group, grant access require MFA.

Answer

D: Include all users, exclude all locations, grant access require MFA.

Question 15

Match each Microsoft 365 threat scenario to the appropriate protection.

Accepted Answer

Phishing email with malicious link: Microsoft Defender for Office 365 Safe Links. Correct matches: Phishing links → Safe Links; Malware attachments → Safe Attachments; Data leaks → DLP; Ransomware → Anti-ransomware policies. Common mistakes include confusing Safe Links with Safe Attachments and DLP with Defender protections.

Answer

Phishing email with malicious link: Microsoft Defender for Office 365 Safe Attachments

Answer

Accidental data leak via email: Microsoft Defender for Office 365 Safe Links