MS-102 Practice Test 13 — 15 Questions

Question 1

You need to ensure that all users in your Microsoft 365 tenant are automatically enrolled in Microsoft Intune when they sign up for Microsoft 365. You want to use the default enrollment policy. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the MDM authority to Microsoft Intune and configure automatic MDM enrollment via Azure AD.. Setting the MDM authority to Microsoft Intune and configuring automatic MDM enrollment via Azure AD enables the default enrollment policy. This ensures that when users sign up for Microsoft 365, they are automatically enrolled in Intune without manual intervention, leveraging Azure AD's built-in MDM enrollment integration.

Answer

Create a conditional access policy that requires device compliance and block access if not enrolled.

Answer

Configure a PowerShell script to run daily that adds all users to Intune.

Answer

Ensure that the Microsoft Intune license is assigned to each user and enable the 'Enroll automatically' setting in the Microsoft 365 admin center.

Question 2

A compliance officer needs to automatically detect and apply a sensitivity label to documents in SharePoint Online that contain a custom sensitive information type (e.g., employee ID pattern). The label must be applied automatically, and users must be prompted to provide a justification when attempting to remove the label. Which combination of configurations should the officer implement?

Accepted Answer

Create a sensitivity label with an auto-labeling policy that uses a custom sensitive info type, and configure the label's protection settings to require user justification to remove the label.. Microsoft Purview sensitivity labels support auto-labeling policies that can automatically apply a label based on custom sensitive information types (e.g., employee ID patterns). Additionally, the label's protection settings include an option to require user justification when removing the label, which meets the compliance officer's requirement for both automatic detection and removal justification.

Answer

Create a retention label and publish it to the site via auto-labeling policy.

Answer

Use a Data Loss Prevention (DLP) policy to apply the label and configure the policy to block removal.

Answer

Deploy the Azure Information Protection scanner to scan SharePoint Online documents.

Question 3

An administrator needs to open a Microsoft 365 support request because a critical service issue is affecting all users. Which two pieces of information should the administrator have readily available before contacting support? (Choose two.)

Accepted Answer

Tenant ID. The Tenant ID (A) is a unique, immutable identifier for the Microsoft 365 tenant, required by Microsoft Support to locate the tenant in their systems and verify administrative access. The current service health status (C) is critical because the support engineer will first check the Microsoft 365 Service Health Dashboard (admin.microsoft.com/Adminportal/Home?source=applauncher#/servicehealth) to confirm the issue is a known service incident; having this information ready avoids redundant troubleshooting and speeds up the creation of a service request.

Answer

User principal names of affected users

Answer

Billing contact information

Question 4

Match each Microsoft 365 compliance feature to its purpose.

Accepted Answer

Data Loss Prevention (DLP): Prevents accidental sharing of sensitive information.. Correct matches: DLP prevents accidental sharing, eDiscovery searches for legal needs, and Sensitivity Labels classify/protect data. Common confusions include mixing DLP with retention policies and eDiscovery with automatic classification.

Answer

Data Loss Prevention (DLP): Manages data retention and deletion policies.

Answer

eDiscovery: Applies automatic classification based on content patterns.

Question 5

A security administrator needs to block outbound network connections from a compromised Windows device to command-and-control servers. The solution must work at the network layer and be centrally managed via Microsoft 365 Defender. Which feature should the administrator enable?

Accepted Answer

Network Protection. Network Protection in Microsoft Defender for Endpoint blocks outbound connections to command-and-control (C2) servers at the network layer by inspecting traffic using the Windows Filtering Platform (WFP). It is centrally managed via Microsoft 365 Defender policies and does not require per-device firewall rule configuration, making it the correct choice for this scenario.

Answer

Attack Surface Reduction rules

Answer

Session control in Defender for Cloud Apps

Answer

Windows Firewall with Advanced Security

Question 6

Your company uses Microsoft Entra ID P2. You need to configure Identity Protection to automatically remediate high-risk users. Which THREE actions can you configure?

Accepted Answer

Require password change. Identity Protection's automated remediation for high-risk users can be configured to require a password change as a risk-based policy action. This forces the user to reset their password, which invalidates any compromised credentials and reduces the risk level. In Microsoft Entra ID P2, this is a native remediation action available in Conditional Access policies integrated with Identity Protection.

Answer

Send email to user

Answer

Require re-registration of MFA

Question 7

A security administrator wants to prevent Microsoft Office applications (Word, Excel, PowerPoint) from creating child processes, which is a common technique used by malware to execute malicious code. Which attack surface reduction (ASR) rule should be enabled?

Accepted Answer

Block all Office applications from creating child processes. The ASR rule 'Block all Office applications from creating child processes' (GUID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A) specifically prevents Word, Excel, and PowerPoint from spawning child processes such as cmd.exe, PowerShell, or wscript.exe. This directly mitigates a common malware technique where Office macros or exploits launch malicious executables. The rule is part of Microsoft Defender for Endpoint's attack surface reduction capabilities and is designed to stop process injection and lateral movement without blocking legitimate Office functionality.

Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criteria

Answer

Block Office applications from creating executable content

Answer

Block Win32 API calls from Office macros

Question 8

Your organization has a Microsoft 365 tenant configured with a custom domain. You need to verify domain ownership using a TXT record. Where in the Microsoft 365 admin center would you initiate this process?

Accepted Answer

Settings > Domains. To verify domain ownership in Microsoft 365, you must add a TXT record provided by Microsoft to your domain's DNS zone. The process is initiated in the Microsoft 365 admin center under Settings > Domains, where you select the domain and click 'Start setup' to receive the verification TXT record value. This is the only location in the admin center that directly manages domain verification and DNS record validation for custom domains.

Answer

Setup > Org-wide settings

Answer

Users > Active Users

Answer

Admin centers > Azure Active Directory

Question 9

You are the Microsoft 365 administrator for a multinational company. The company has deployed Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps. Recently, the security team detected that a user's credentials were compromised and used to access SharePoint Online from an unusual location. You need to investigate the incident and determine the full scope of the breach. The solution must use Microsoft 365 Defender to correlate events. What should you do first?

Accepted Answer

Use advanced hunting in Microsoft 365 Defender portal to query for events related to the user across workloads.. Advanced hunting in the Microsoft 365 Defender portal allows you to query raw, cross-workload telemetry (e.g., from Identity, Exchange Online, SharePoint Online, and Defender for Cloud Apps) in a single Kusto Query Language (KQL) query. This is the most efficient first step to correlate events such as sign-ins, mailbox access, file downloads, and app sessions related to the compromised user, enabling you to determine the full scope of the breach across all Microsoft 365 services.

Answer

Use the Microsoft Purview compliance portal to search for the user's activity in audit logs.

Answer

Use Microsoft Defender for Cloud Apps to investigate the user's activity log.

Answer

Use Microsoft Sentinel to query the user's events from the workspace.

Question 10

A company uses Azure AD Identity Protection. The security administrator wants to block user sign-ins when the sign-in risk level is detected as 'High' for a custom SaaS application. Which Conditional Access policy configuration should the administrator use?

Accepted Answer

Create a Conditional Access policy set to block access when sign-in risk is high. The requirement is to block sign-ins when the sign-in risk level is 'High' for a custom SaaS application. In Microsoft Entra ID (formerly Azure AD), a Conditional Access policy can be configured with a 'Block access' grant control, which directly denies authentication when the specified condition (sign-in risk level equals High) is met. This is the most straightforward and secure approach to prevent access without relying on additional authentication factors or session controls.

Answer

Create a Conditional Access policy with a grant control to require MFA when sign-in risk is high

Answer

Configure a session control in Conditional Access to sign out users when risk is high

Answer

Enable Identity Protection risk policy to automatically block users

Question 11

An administrator has configured group-based licensing in Azure AD. After adding users to the group, some users do not receive licenses. The users are in the group and have an assigned usage location. What is a possible reason?

Accepted Answer

The users have conflicting license assignments from another source. Group-based licensing in Azure AD can fail when a user already has a license assigned from another source, such as direct assignment or another group. Azure AD's group-based licensing processes assignments in a deterministic order, and if a conflict arises (e.g., different service plans or SKUs), the system may skip the user and log an error in the audit logs. This is a common scenario when users are migrated from direct licensing to group-based licensing without removing the existing assignments.

Answer

The group is a mail-enabled security group, which is not supported for group-based licensing

Answer

The license product name in the group setting does not match the available licenses in the tenant

Answer

The users have not accepted the Microsoft Online Service Terms

Question 12

A security team wants to automatically investigate and respond to security incidents across endpoints, email, and identities without manual intervention. Which Microsoft Defender XDR capability provides this automation?

Accepted Answer

Automated investigation and response (AIR). Automated investigation and response (AIR) is the Microsoft Defender XDR capability that automatically investigates alerts and takes remediation actions across endpoints, email, and identities without manual intervention. It uses playbooks and machine learning to triage incidents, determine scope, and apply actions like isolating devices or deleting malicious emails.

Answer

Advanced hunting

Answer

Threat analytics

Answer

Attack surface reduction rules

Question 13

A company has recently signed up for Microsoft 365 Business Premium. They want to change the default domain from onmicrosoft.com to a custom domain they own. Which step must be completed first before the custom domain can be used for user email addresses?

Accepted Answer

Add the custom domain in the Microsoft 365 admin center. Before a custom domain can be used for user email addresses in Microsoft 365, the domain must first be added to the tenant in the Microsoft 365 admin center. This step creates a domain object in Azure AD that allows Microsoft to associate the domain with your tenant and prepare for ownership verification. Without adding the domain first, subsequent steps like DNS verification or user creation cannot proceed because the system has no record of the domain.

Answer

Verify domain ownership by adding a TXT record to the domain's DNS

Answer

Create user accounts with the new domain as their primary email

Answer

Configure email exchange records (MX)

Question 14

The security team at Contoso wants to require that any activation of the Global Administrator role in Azure AD Privileged Identity Management (PIM) must be approved by members of a security group named 'GA-Approvers'. Activations must require a business justification and expire after 4 hours. Which PIM configuration should the administrator modify to achieve this?

Accepted Answer

The role settings for Global Administrator, on the Activation tab. The Activation tab in the role settings for Global Administrator allows you to configure approval requirements, justification, and maximum activation duration. By setting 'Require approval to activate' to 'Enabled' and specifying the 'GA-Approvers' group as the approver, requiring a business justification, and setting the activation maximum duration to 4 hours, you meet all the stated requirements.

Answer

The role settings for Global Administrator, on the Assignment tab

Answer

The role settings for Global Administrator, on the Notification tab

Answer

The role settings for Global Administrator, on the Alert tab

Question 15

A compliance administrator needs to automatically apply a retention label to all documents in a SharePoint Online site that contain Social Security numbers. The label should retain the documents for 5 years and then automatically delete them. Which feature should they configure?

Accepted Answer

retention label with auto-labeling. Retention labels with auto-labeling are designed to automatically apply retention settings based on sensitive information types, such as Social Security numbers, and can enforce a retention period (5 years) followed by automatic deletion. This feature is part of Microsoft Purview's records management and uses trainable classifiers or sensitive info types to trigger the label assignment on SharePoint Online documents.

Answer

Data Loss Prevention (DLP) policy

Answer

sensitivity label with auto-labeling

Answer

An information barrier policy