MS-102 Practice Test 13 — 15 Questions

Question 1

You are investigating an incident in Microsoft Defender XDR. The incident involves multiple alerts from different sources. Which THREE actions should you take during the investigation?

Accepted Answer

Review the incident timeline to understand the sequence of events.. Option A is correct because reviewing the incident timeline in Microsoft Defender XDR lets you correlate the multiple alerts from different sources into a chronological sequence, revealing the initial access, lateral movement, and impact so you can scope the incident accurately. Option C is correct because advanced hunting uses Kusto Query Language (KQL) against the unified schema (DeviceEvents, IdentityLogonEvents, EmailEvents, etc.) to pivot beyond the original alerts and uncover related activity across devices and identities that the incident view may not surface. Option D is correct because isolating affected devices via Microsoft Defender for Endpoint (through the device page or the 'Isolate device' action) contains the threat, prevents further lateral movement or command-and-control communication, and preserves forensic evidence while investigation continues. Option B is not appropriate as a standard investigation step because bulk-deleting emails destroys evidence and is a remediation action (soft delete/hard delete via Purview) that should only follow confirmed scope, not precede it. Option E is also not a default investigation action because mass password resets can disrupt business operations and lock out users; credential remediation should be targeted based on confirmed compromise rather than applied to all involved accounts.

Answer

Delete all emails related to the incident from all mailboxes.

Answer

Reset the passwords of all user accounts involved.

Question 2

A compliance officer wants to automatically apply a 'Confidential' sensitivity label to documents in SharePoint Online that contain credit card numbers. The label should be applied when the documents are created or modified. Which Microsoft Purview feature should be configured?

Accepted Answer

Create an auto-labeling policy for sensitivity labels. Auto-labeling policies for sensitivity labels in Microsoft Purview can automatically apply a sensitivity label to documents in SharePoint Online based on sensitive information types, such as credit card numbers. This policy scans documents when they are created or modified and applies the label without user intervention, meeting the compliance officer's requirement.

Answer

Create a retention label policy

Answer

Create a Data Loss Prevention (DLP) policy

Answer

Configure a default sensitivity label

Question 3

A company has purchased Microsoft 365 Business Premium and added a custom domain 'contoso.com' to the tenant. They want all new users to have email addresses like user@contoso.com instead of the default onmicrosoft.com domain. What should the administrator do in the Microsoft 365 admin center?

Accepted Answer

Set the custom domain as the default domain in the Domains settings.. Setting the custom domain as the default domain in the Domains settings ensures that any new user created in the Microsoft 365 admin center automatically receives an email address ending with @contoso.com instead of the default @<tenant>.onmicrosoft.com. This is the correct administrative action because the default domain setting controls the domain suffix applied to new user principal names (UPNs) and email addresses during user creation.

Answer

Add a DNS TXT record for the custom domain.

Answer

Change the primary domain in the tenant's organization profile.

Answer

Update the MX record for the custom domain to point to Exchange Online.

Question 4

A company wants to block access to Exchange Online from devices that are not compliant with Intune compliance policies. Which Conditional Access grant control should be used?

Accepted Answer

Require device to be marked as compliant. To block access to Exchange Online from non-compliant devices, you need to enforce a Conditional Access policy that evaluates device compliance status. The 'Require device to be marked as compliant' grant control checks the device's compliance state reported by Microsoft Intune before granting access. If the device is not compliant, access to Exchange Online is blocked, ensuring only managed and compliant devices can connect.

Answer

Require MFA

Answer

Require approved client app

Answer

Require all conditions

Question 5

A security administrator needs to view a unified incident queue that correlates alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. Which console should the administrator open?

Accepted Answer

Microsoft 365 Defender portal (security.microsoft.com). The Microsoft 365 Defender portal (security.microsoft.com) provides a unified incident queue that aggregates and correlates alerts from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This single-pane-of-glass view enables security administrators to investigate and respond to cross-domain threats without switching between separate consoles.

Answer

Azure Security Center

Answer

Microsoft Endpoint Manager admin center

Answer

Microsoft Purview compliance portal

Question 6

A company wants to require that all users accessing a critical cloud application for the first time must accept a company terms of use before they are granted access. Which Conditional Access policy grant control should be added?

Accepted Answer

Require terms of use. The 'Require terms of use' grant control in a Conditional Access policy is specifically designed to force a user to accept a company's terms of use (TOU) before accessing a cloud application. When this control is enabled, Microsoft Entra ID presents the TOU document to the user on first access, and access is blocked until the user explicitly accepts the terms. This directly meets the requirement of requiring acceptance before granting access.

Answer

Require multi-factor authentication

Answer

Require device to be marked as compliant

Answer

Require approved client app

Question 7

Your company is planning to adopt Microsoft Copilot for Microsoft 365. The security team is concerned about data leakage. What must you implement to ensure that Copilot respects your organization's sensitivity labels and data classification?

Accepted Answer

Deploy Microsoft Purview Information Protection with sensitivity labels. Microsoft Purview Information Protection with sensitivity labels is the correct answer because Copilot for Microsoft 365 uses these labels to enforce data governance at the content level. When a sensitivity label is applied to a document or email, Copilot respects that label's encryption, marking, and access restrictions, preventing the model from generating responses that leak classified data. This is the foundational mechanism for ensuring Copilot adheres to your organization's data classification policies.

Answer

Use Microsoft Defender for Cloud Apps to control Copilot

Answer

Configure Data Loss Prevention (DLP) policies

Answer

Enable Customer Lockbox

Question 8

Your organization is planning to deploy Microsoft 365 Copilot. You need to ensure that all prerequisites are met. Which of the following is a mandatory prerequisite for enabling Microsoft 365 Copilot?

Accepted Answer

Microsoft Entra ID P2 licenses.. None of the listed options are mandatory prerequisites for Microsoft 365 Copilot. The actual mandatory requirements are a qualifying Microsoft 365 license (E3, E5, or Business Premium) and the Microsoft 365 Copilot add-on license. Microsoft Entra ID P2 is not required; a basic Entra ID (free) is sufficient. Purview DLP, an Azure subscription, and Exchange Online Plan 2 are also not mandatory.

Answer

Microsoft Purview Data Loss Prevention policies.

Answer

An active Azure subscription.

Answer

Exchange Online Plan 2 licenses.

Question 9

Your organization uses Microsoft Purview Records Management. You need to ensure that records are marked as regulatory records and cannot be deleted or modified by any user, including administrators. The records must be retained for 10 years. What should you do?

Accepted Answer

Use a retention label marked as a regulatory record.. A retention label configured as a regulatory record provides the highest level of immutability: it prevents any user, including administrators, from deleting or modifying the item, and the label itself cannot be removed or changed once applied. This meets the requirement that records cannot be deleted or modified by anyone. The 10-year retention period is set on the label.

Answer

Create a retention policy with a preservation lock.

Answer

Use a retention label marked as a record.

Answer

Apply a default retention label to the SharePoint library.

Question 10

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that automatically alerts when a user downloads more than 100 files from SharePoint Online in 10 minutes. What type of policy should you create?

Accepted Answer

Anomaly detection policy. An anomaly detection policy in Microsoft Defender for Cloud Apps is designed to identify unusual user behavior, such as a user downloading over 100 files from SharePoint Online within 10 minutes. This policy type uses machine learning and predefined thresholds to detect deviations from baseline activity, making it the correct choice for this scenario.

Answer

Session policy

Answer

App discovery policy

Answer

OAuth app policy

Question 11

A company is planning to migrate from on-premises Exchange to Exchange Online and needs to ensure that mail flow can coexist between the two environments during the transition. Which tool should the administrator use to configure this hybrid deployment?

Accepted Answer

Exchange Hybrid Configuration Wizard. The Exchange Hybrid Configuration Wizard (HCW) is the correct tool because it automates the configuration of coexistence features between on-premises Exchange and Exchange Online, including mail flow routing, free/busy sharing, and OAuth authentication. It generates the necessary connectors and settings to support a hybrid deployment, ensuring seamless mail flow during migration.

Answer

Azure AD Connect

Answer

Microsoft 365 Admin Center

Answer

Exchange Admin Center

Question 12

Your organization uses Microsoft Entra ID with P2 licenses. You need to identify and remediate users who are at risk due to leaked credentials or anomalous sign-in activity. You want to automate the response to high-risk users by requiring a password change. Which feature should you use?

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra Identity Protection provides risk-based conditional access policies that can automatically require a password change for high-risk users. Option B is wrong because Microsoft Defender for Cloud Apps focuses on cloud application security, not identity risk. Option C is wrong because Microsoft Entra Identity Governance handles access reviews and entitlement management. Option D is wrong because Microsoft Entra Privileged Identity Management (PIM) manages privileged roles, not user risk.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra Identity Governance

Answer

Microsoft Entra Privileged Identity Management (PIM)

Question 13

Your organization needs to implement a Microsoft Purview data classification solution that scans data in Microsoft 365, Azure SQL Database, and Amazon S3. Which Microsoft Purview feature should you use?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is the foundational metadata and scanning service that discovers and classifies data across sources including Microsoft 365, Azure SQL Database, and Amazon S3. It registers sources, runs scans, applies classification rules, and builds the data estate catalog that other Purview solutions consume. Because the requirement spans multi-cloud and on-prem sources, the Data Map is the correct feature.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Information Protection sensitivity labels

Answer

Microsoft Purview eDiscovery

Question 14

You are configuring Microsoft Entra ID provisioning for a SaaS application that supports SCIM 2.0. The app requires the 'manager' attribute to be mapped. However, the manager attribute is not populated for all users. What should you do to avoid provisioning failures?

Accepted Answer

Configure the attribute mapping to 'Ignore it if null' for the manager attribute. When the 'manager' attribute is not populated for all users, configuring the attribute mapping to 'Ignore it if null' prevents provisioning failures by allowing the provisioning service to skip the attribute when its value is null, rather than attempting to send an empty or invalid value that the SCIM 2.0 endpoint might reject. This setting ensures that only users with a manager value trigger the mapping, avoiding errors for users without a manager.

Answer

Modify the SCIM schema in the application to make manager optional

Answer

Use the expression language to set a default value for the manager attribute

Answer

Delete the manager attribute mapping from the provisioning configuration

Question 15

An organization plans to automatically assign Microsoft 365 E3 licenses to all users in the 'Finance' department. The Finance department is identified by the 'Department' attribute in Azure AD. Which method should the administrator use to minimize manual effort?

Accepted Answer

Group-based licensing using a dynamic group with the rule 'user.department -eq "Finance"'. Dynamic group licensing in Microsoft Entra ID uses attribute-based membership rules, so a rule like 'user.department -eq "Finance"' automatically adds all Finance users to the group. Assigning the Microsoft 365 E3 license to that group means every current and future Finance user receives the license without manual intervention, which is the lowest-effort, most scalable approach.

Answer

Manual assignment using PowerShell

Answer

Bulk assignment using a CSV file

Answer

Self-service licensing portal