MS-102 Practice Test 14 — 15 Questions

Question 1

An administrator wants to receive real-time notifications for service incidents in Microsoft 365. The notifications must be sent to a Microsoft Teams channel instead of email. Which configuration should the administrator set up?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a webhook connector in Microsoft Teams to subscribe to the Office 365 Service Communications API.. The Office 365 Service Communications API provides real-time webhook-based notifications for service incidents. By configuring a webhook connector in Microsoft Teams, the administrator can subscribe to this API and receive incident alerts directly in a Teams channel without polling or email forwarding.

Answer

Configure an email notification rule in the Microsoft 365 admin center and forward it to a Teams email address.

Answer

Use Power Automate to check service health and post to Teams every 5 minutes.

Answer

Configure a message center alert to email and then use a third-party integration to post to Teams.

Question 2

A user account was accidentally deleted 10 days ago. The administrator needs to restore the user's mailbox and OneDrive for Business content. Which method should the administrator use?

Accepted Answer

Restore the user from the 'Deleted users' page in the Microsoft 365 admin center.. Microsoft 365 retains deleted user objects, including their Exchange Online mailbox and OneDrive for Business data, for 30 days in the 'Deleted users' list. Restoring the user from this page within the retention period automatically recovers the associated mailbox and OneDrive content without requiring separate tools or support requests.

Answer

Recreate the user account with the same name, and the data will be automatically restored.

Answer

Use the Exchange admin center to recover the mailbox only.

Answer

Submit a support request to Microsoft to recover the deleted data.

Question 3

A company wants to implement just-in-time (JIT) privileged access for the Global Administrator role in Microsoft Entra ID. Users must request activation and provide a business justification. The request must be approved by a separate group of approvers, and the role activation should expire after 4 hours. Which Microsoft Entra feature should the administrator configure?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access by allowing users to activate roles like Global Administrator with a business justification, requiring approval from a designated group of approvers, and setting a configurable activation duration (e.g., 4 hours). This directly matches the company's requirements for time-bound, approved role activation.

Answer

Identity Protection

Answer

Conditional Access

Answer

Access Reviews

Question 4

An administrator is setting up a new Microsoft 365 tenant and has added the custom domain 'contoso.com'. The domain status shows 'Pending verification'. Which type of DNS record must the administrator add to the public DNS zone to complete domain ownership verification?

Accepted Answer

TXT record. To verify domain ownership in Microsoft 365, you must add a TXT record containing the unique verification string provided by the Microsoft 365 admin center to the public DNS zone. The TXT record proves you control the domain by allowing Microsoft to query the DNS and match the value. This is the standard method defined by RFC 1035 for domain validation.

Answer

MX record

Answer

CNAME record

Answer

SPF record

Question 5

An administrator wants to add custom branding to the Microsoft 365 sign-in page, including company logo and colors. Which section of the Microsoft 365 admin center should they navigate to?

Accepted Answer

Settings > Org settings > Organization profile. The custom branding for the Microsoft 365 sign-in page, including company logo and colors, is configured under Settings > Org settings > Organization profile in the Microsoft 365 admin center. This section provides a dedicated 'Custom branding' tab where administrators can upload a logo, set a background image, and choose accent colors that are applied to the sign-in page for all users in the tenant.

Answer

Users > Active users

Answer

Admin centers > Azure Active Directory

Answer

Billing > Licenses

Question 6

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. What is the effect of this policy?

Accepted Answer

All users on iOS or Android devices accessing Office 365 must use MFA and a compliant device. The policy shown in the exhibit explicitly targets 'All users' and 'Office 365' as the cloud app, with conditions for 'iOS' and 'Android' device platforms. The grant controls require both 'Require multi-factor authentication' and 'Require device to be marked as compliant', meaning any user on an iOS or Android device accessing Office 365 must satisfy both MFA and device compliance. This is a common Conditional Access policy to enforce secure access from mobile devices.

Answer

All users accessing all cloud apps are required to use MFA

Answer

Access to Office 365 from iOS and Android is blocked

Answer

Users on mobile devices are required to use hybrid Azure AD joined devices

Question 7

A security administrator needs to block executable files (e.g., .exe, .ps1) from running from the %TEMP% folder on Windows devices to prevent common malware execution. Which attack surface reduction (ASR) rule should be enabled?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion. ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) is designed specifically to block executables (including .exe, .ps1, .scr, .dll) from launching from locations like %TEMP%, %APPDATA%, and the Windows folder, which are common malware staging areas. This rule uses cloud-delivered reputation (prevalence and age) and a Microsoft-managed trusted list to allow legitimate files while blocking unknown or suspicious ones, directly addressing the requirement to prevent malware execution from %TEMP%.

Answer

Block executable content from email client and webmail

Answer

Block Office applications from creating child processes

Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Question 8

A security team wants to automatically investigate and remediate alerts generated from Microsoft Defender for Endpoint, Office 365, and Microsoft Entra ID. Which Microsoft Defender XDR capability should be configured?

Accepted Answer

Automated Investigation and Response. Automated Investigation and Response (AIR) in Microsoft Defender XDR is the correct capability because it automatically triggers playbooks to investigate and remediate alerts across Microsoft Defender for Endpoint, Office 365, and Microsoft Entra ID. AIR uses predefined or custom automation rules to correlate signals from these sources, run investigations, and apply remediation actions like isolating devices or blocking accounts without manual intervention.

Answer

Threat Analytics

Answer

Advanced Hunting

Answer

Secure Score

Question 9

An organization has just purchased Microsoft 365 subscriptions and wants to add their custom domain 'fabrikam.com' to the tenant. Which record must they add to their DNS provider to verify domain ownership?

Accepted Answer

TXT record. To verify domain ownership in Microsoft 365, you must add a TXT record provided by the Microsoft 365 admin center to your DNS hosting provider. This TXT record contains a unique verification string that Microsoft checks to confirm you control the domain. MX, CNAME, and SRV records are used for mail routing, service aliasing, and service location, respectively, but they do not serve the purpose of domain ownership verification.

Answer

MX record

Answer

CNAME record

Answer

SRV record

Question 10

A compliance administrator needs to automatically apply a retention label to documents in a SharePoint Online site that contain the keyword 'Project Alpha'. The label should retain the documents for 5 years and then delete them. Which two Microsoft Purview features must be configured to achieve this? (Choose two.)

Accepted Answer

Auto-labeling policy for SharePoint Online. An auto-labeling policy for SharePoint Online (option B) is required because it can automatically apply a retention label to documents based on conditions such as the presence of specific keywords. The sensitive info type with a keyword dictionary (option D) defines the condition by creating a custom sensitive information type that matches the exact phrase 'Project Alpha', which the auto-labeling policy then uses to trigger the label application.

Answer

Trainable classifiers

Answer

Document Fingerprinting

Question 11

A company uses Microsoft Entra ID P1 licenses. They want to enforce multi-factor authentication (MFA) for all users when accessing any cloud application from networks that are not trusted corporate locations. A group named 'Emergency' must be excluded from MFA requirements. Which Conditional Access policy configuration should the administrator use?

Accepted Answer

Assign the policy to all users, exclude the Emergency group, include all cloud apps, grant MFA, and set location condition to any network or location except trusted networks.. The requirement is to enforce MFA for all users from untrusted networks, while excluding the Emergency group. The Conditional Access policy must be assigned to all users, exclude the Emergency group, include all cloud apps, require MFA as a grant control, and use a location condition set to 'any network or location except trusted networks' to target only untrusted locations. This configuration ensures MFA is triggered only when access originates from networks not defined as trusted corporate locations.

Answer

Assign the policy to all users, exclude the Emergency group, include all cloud apps, grant access (not MFA), and set location condition to trusted networks only.

Answer

Assign the policy to all users, exclude the Emergency group, include all cloud apps, grant MFA, and set location condition to any network or location.

Answer

Assign the policy to all users, exclude the Emergency group, include all cloud apps, grant MFA, and set location condition to trusted networks only.

Question 12

Your organization, Fabrikam Inc., uses Microsoft Entra ID with a hybrid identity configuration. You have 500 cloud-only users and 5,000 synced users from on-premises Active Directory. The company wants to implement a passwordless authentication strategy. The following requirements must be met: 1) All users must be able to sign in without a password on Windows 10/11 devices that are Microsoft Entra joined. 2) Users who are not assigned a mobile phone must be able to use a security key (FIDO2). 3) The solution must work for both cloud-only and synced users. 4) The passwordless method should require the lowest administrative overhead for enrollment. Which passwordless authentication method should you recommend?

Accepted Answer

FIDO2 security keys. FIDO2 security keys (option C) meet all requirements: they work on Microsoft Entra joined Windows 10/11 devices without a password, support both cloud-only and synced users, and provide a security key option for users without mobile phones as required. Enrollment is simple (plug in and register via Windows Settings) with low administrative overhead (can be pre-provisioned or self-enrolled). Option D (Windows Hello for Business) is incorrect because it uses PIN or biometric on the device, not a separate security key, so it fails requirement 2. Option A (certificate-based authentication) requires PKI infrastructure and certificate enrollment, increasing administrative overhead. Option B (Microsoft Authenticator app) requires a mobile phone, which conflicts with requirement 2.

Answer

Certificate-based authentication

Answer

Microsoft Authenticator app

Answer

Windows Hello for Business

Question 13

You are deploying Microsoft 365 for a new subsidiary. The subsidiary has a single domain subsidiary.com. You need to configure a hybrid identity solution with Microsoft Entra ID. The on-premises Active Directory has a single domain and all user accounts are synchronized using Microsoft Entra Connect. You want to ensure that users can sign in to Microsoft 365 using their on-premises credentials without exposing the password hash to Microsoft. What should you do?

Accepted Answer

Enable pass-through authentication (PTA) with Microsoft Entra Connect.. Pass-through authentication (PTA) allows users to sign in to Microsoft 365 using their on-premises credentials without storing password hashes in Microsoft Entra ID. PTA validates passwords directly against on-premises Active Directory via an agent, ensuring no password hash is exposed to Microsoft, which meets the stated requirement.

Answer

Configure password hash synchronization.

Answer

Create cloud-only user accounts and disable on-premises authentication.

Answer

Implement Active Directory Federation Services (AD FS) with Microsoft Entra ID.

Question 14

A compliance administrator needs to ensure that all documents in a SharePoint library are retained for exactly 7 years and then allow users to manually dispose of them sooner after a review. What should they configure in Microsoft Purview?

Accepted Answer

Create a retention label with a retention period of 7 years and enable disposition review. The requirement specifies a fixed 7-year retention period followed by user-initiated disposal after a review. A retention label with a retention period of 7 years and disposition review enabled allows content to be retained for exactly 7 years, after which a disposition review triggers a manual approval process for disposal. This matches the need for both mandatory retention and manual disposal after review.

Answer

Create a retention label with a retention period of 7 years and no additional action

Answer

Create a sensitivity label that restricts access

Answer

Create a record label

Question 15

You need to configure self-service password reset (SSPR) for users in Microsoft Entra ID. Which license is required?

Accepted Answer

Microsoft Entra ID P1. Self-service password reset (SSPR) requires a Microsoft Entra ID P1 or P2 license. Both Microsoft 365 F3 and Microsoft 365 E3 include Microsoft Entra ID P1 licenses, which support SSPR. However, the question directly asks which license is required for SSPR, and the correct answer is the standalone Microsoft Entra ID P1 license. While F3 and E3 include this license, they are suite licenses and not the specific license component being asked for.

Answer

Microsoft 365 F3

Answer

Microsoft 365 E3

Answer

Microsoft Entra ID Free