MS-102 Practice Test 14 — 15 Questions

Question 1

An organization wants to configure Self-Service Password Reset (SSPR) for all users. The administrator must ensure that users register two authentication methods: one from the mobile app category (e.g., notification or code) and one from the phone call category (e.g., office phone or mobile phone). Which combination of methods should the administrator select in the SSPR settings?

Accepted Answer

Mobile app notification and Office phone. Option A is correct because the SSPR policy requires users to register two authentication methods from distinct categories. The mobile app notification (from the mobile app category) and office phone (from the phone call category) satisfy this requirement. This combination ensures that users have one method from the mobile app category and one from the phone call category, as specified in the question.

Answer

Mobile app code and Security questions

Answer

Email and Mobile phone

Answer

Security questions and Office phone

Question 2

Contoso frequently collaborates with a partner company (Fabrikam) via B2B collaboration. Contoso uses Microsoft Entra ID P2 licenses and wants to require Fabrikam's guest users to authenticate using Contoso's MFA policies, ignoring any MFA claims from the Fabrikam home tenant. Fabrikam already has MFA enabled for its users. What configuration should Contoso make in their cross-tenant access settings?

Accepted Answer

Configure inbound trust settings to uncheck 'Trust multi-factor authentication from Microsoft Entra tenants' for Fabrikam. Option B is correct because Contoso wants to ignore MFA claims from Fabrikam's home tenant and enforce its own MFA policies on Fabrikam guest users. In cross-tenant access settings, the 'Trust multi-factor authentication from Microsoft Entra tenants' checkbox controls whether inbound MFA claims from the external tenant are accepted. By unchecking this for Fabrikam, Contoso ensures that Fabrikam's MFA claims are ignored, and Contoso's Conditional Access policies (including MFA requirements) apply to those guest users.

Answer

Configure outbound access settings to require MFA for Fabrikam users

Answer

Create a Conditional Access policy targeting all guest users from Fabrikam that requires MFA

Answer

Configure B2B direct connect for Fabrikam and require MFA

Question 3

Contoso uses Microsoft Entra ID P1 licenses and has a dedicated corporate office with static public IP addresses. The company wants to require MFA for all users, but exempt users when they connect from the corporate office. Which configuration should the administrator implement?

Accepted Answer

Create a Conditional Access policy that targets all users, grant access requiring MFA, and exclude the corporate office location from the policy.. Option B is correct because a Conditional Access policy can target all users, require MFA as a grant control, and exclude the corporate office location (defined by static public IP addresses as a named location). This ensures MFA is enforced for all connections except those originating from the trusted corporate network, aligning with the requirement to exempt users at the office.

Answer

Create a Conditional Access policy that targets all users, grant access requiring MFA, and include the corporate office location as a condition.

Answer

Configure a Per-User MFA policy and add the corporate office IPs to a list of trusted IPs in the MFA settings.

Answer

Create a Conditional Access policy that targets the corporate office location and grant access with MFA for all other locations.

Question 4

Contoso wants to require multi-factor authentication (MFA) for all users when accessing cloud applications from any network except the corporate headquarters (trusted IP range). They plan to use Azure AD Conditional Access. Which two components must be configured to achieve this requirement? (Select all that apply.)

Accepted Answer

Conditional Access policy targeting all users and cloud apps, with conditions for locations. Option A is correct because a Conditional Access policy must be created to enforce MFA based on location conditions. The policy targets all users and cloud apps, and uses the 'locations' condition to exclude the trusted IP range (corporate headquarters) while requiring MFA for all other locations. This ensures MFA is triggered only when access originates from outside the trusted network.

Answer

An Identity Protection user risk policy

Answer

An MFA registration policy requiring users to register for MFA

Question 5

An administrator who is not a Global Administrator needs to manage just-in-time privileged access to Azure resources using Microsoft Entra Privileged Identity Management (PIM). Which built-in role must be assigned to the administrator to allow PIM management for Azure resources?

Accepted Answer

Privileged Role Administrator. The Privileged Role Administrator role is the only built-in role that grants permissions to manage all aspects of Privileged Identity Management (PIM) for Azure resources, including configuring just-in-time access, managing role assignments, and approving activation requests. This role is specifically designed for administrators who need to oversee PIM without requiring Global Administrator privileges, as it provides full control over PIM policies and role settings across Azure AD and Azure resources.

Answer

User Administrator

Answer

Security Administrator

Answer

Application Administrator

Question 6

An organization has Microsoft Entra ID P2 licenses and wants to configure a Conditional Access policy to restrict access to Microsoft 365 services. Which of the following can be used as conditions in the policy? (Choose two that apply)

Accepted Answer

Device platform. Device platform is a valid condition in Microsoft Entra Conditional Access policies, allowing administrators to target specific operating systems such as Windows, macOS, iOS, or Android. This enables granular control over access based on the device type, which is essential for enforcing security requirements like requiring compliant devices on certain platforms.

Answer

Authentication strength

Answer

Application ID

Question 7

An organization uses Microsoft Entra ID with Pass-through Authentication (PTA) and Seamless Single Sign-On (SSO). They notice that password changes in on-premises Active Directory are not reflecting immediately in Microsoft Entra ID for some users. What is the most likely cause?

Accepted Answer

The user's password change has not replicated to all domain controllers. In a Pass-through Authentication environment, password changes are processed by on-premises Active Directory. The password change must replicate to all domain controllers before Microsoft Entra ID can authenticate the new password via the PTA agent. If replication is incomplete, the PTA agent may contact a domain controller that still has the old password, causing the delay.

Answer

The PTA agents are overloaded

Answer

The Seamless SSO feature is disabled

Answer

Microsoft Entra ID has a password hash sync delay

Question 8

An organization uses Microsoft Entra ID P2 licenses. They want to implement a policy that forces users to perform multi-factor authentication (MFA) only when they sign in from an untrusted location. The trusted locations include the corporate office IP range. Which type of policy should they create?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID allow administrators to enforce MFA based on conditions like location. By configuring a policy that targets all users and cloud apps, with a condition excluding trusted IP ranges (corporate office), MFA is only triggered when sign-ins originate from untrusted locations. This is the precise mechanism for location-based MFA enforcement.

Answer

Identity Protection user risk policy

Answer

MFA registration policy

Answer

Authentication methods policy

Question 9

A company uses Microsoft Entra ID P2 licenses. The security team wants to automatically require a password change for users with medium sign-in risk, but only when the sign-in originates from outside the corporate network. Users with high sign-in risk should be blocked entirely. A group of break-glass accounts must be excluded from all policies. Which feature should the administrator implement?

Accepted Answer

Conditional Access policies with sign-in risk and location conditions. Option A is correct because Conditional Access policies in Microsoft Entra ID allow combining sign-in risk conditions with location conditions (e.g., 'Not trusted IPs' or 'All trusted locations' set to false) to target only sign-ins from outside the corporate network. The policy can be configured to require a password change for medium risk and block access for high risk, while excluding break-glass accounts via the 'Exclude' tab using a dedicated group.

Answer

Identity Protection risk policies

Answer

Privileged Identity Management (PIM)

Answer

Azure AD Identity Governance

Question 10

A company uses Azure AD Identity Protection. The security team wants to automatically block users from signing in when the user risk level is 'High'. Which policy should they configure?

Accepted Answer

User risk policy. The User risk policy in Azure AD Identity Protection is specifically designed to automatically block sign-ins when the user risk level is 'High'. This policy evaluates the probability that a user's identity has been compromised based on signals like leaked credentials or anomalous behavior, and can enforce actions such as blocking access or requiring password change. Option C is correct because it directly targets user risk, not sign-in risk or other conditions.

Answer

Conditional Access policy with user risk condition

Answer

Sign-in risk policy

Answer

MFA registration policy

Question 11

An administrator wants to configure automated investigation and response (AIR) in Microsoft 365 Defender so that when a high-severity malware alert is generated for a device from Microsoft Defender for Endpoint, the device is automatically isolated from the network without requiring a security analyst to approve the action. Which configuration step is required?

Accepted Answer

Set the automation level for device isolation to 'Full - remediate threats automatically'. Option B is correct because setting the automation level for device isolation to 'Full - remediate threats automatically' in Microsoft Defender for Endpoint's automated investigation and response (AIR) configuration allows the system to automatically isolate a device when a high-severity malware alert is triggered, without requiring analyst approval. This automation level is specifically designed to execute remediation actions like device isolation immediately based on the alert's severity and the device's risk level.

Answer

Set the automation level for device isolation to 'Semi - require approval for any remediation'

Answer

Create a custom detection rule that automatically isolates the device

Answer

Enable 'Automated device isolation' in the Microsoft 365 Defender settings

Question 12

A user reports they cannot access SharePoint Online but can access Outlook. The admin verifies the user has an E3 license assigned. What is the most likely cause?

Accepted Answer

SharePoint Online service plan is disabled. The user can access Outlook (Exchange Online) but not SharePoint Online, which indicates that the user's E3 license is assigned and the account is active. The most likely cause is that the SharePoint Online service plan within the E3 license is disabled. Each Microsoft 365 license includes multiple service plans (e.g., Exchange Online, SharePoint Online, Teams), and an admin can disable individual plans while keeping the license assigned. If the SharePoint Online service plan is disabled, the user will be blocked from accessing SharePoint Online despite having a valid license.

Answer

License not assigned

Answer

MFA challenge failing

Answer

User account is disabled

Question 13

An admin needs to provide a vendor with temporary access to a SharePoint site. What should the admin create?

Accepted Answer

Guest user in Azure AD. A is correct because creating a guest user in Azure AD is the proper method to grant external users access to SharePoint Online resources with controlled permissions. Guest users are invited via Azure AD B2B collaboration, which allows the admin to assign specific SharePoint site permissions while maintaining oversight and the ability to revoke access. This approach ensures the vendor has a distinct identity for auditing and conditional access policies.

Answer

Anonymous sharing link

Answer

Security group

Answer

New user in your domain

Question 14

An admin needs to bulk assign licenses to 200 users based on department. Which method is most efficient?

Accepted Answer

Use group-based licensing in Azure AD. Group-based licensing in Azure AD is the most efficient method for bulk-assigning licenses to 200 users based on department because it automates license assignment and removal based on group membership. Once a user is added to or removed from a department-specific group, Azure AD automatically applies or revokes the corresponding license, eliminating manual intervention and ensuring consistency across large-scale deployments.

Answer

Use Azure AD PowerShell script

Answer

Use Azure admin center bulk operations

Answer

Assign licenses one by one in admin center

Question 15

Which TWO actions can an admin take to reduce the number of passwords in use for end users?

Accepted Answer

Enable Windows Hello for Business. Windows Hello for Business replaces traditional password authentication with strong two-factor authentication tied to a user's device, using biometrics or a PIN. This directly reduces the reliance on passwords for end users by enabling passwordless sign-in to Windows devices and integrated applications.

Answer

Enforce complex password policies

Answer

Configure self-service password reset

Answer

Implement password hash sync