MS-102 Practice Test 16 — 15 Questions

Question 1

A security analyst has identified a new malware sample with SHA256 hash 'abc123...'. They need to immediately block this file from executing on any managed endpoint across the organization. Which Microsoft Defender for Endpoint capability should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Indicators (IoC). Indicators of Compromise (IoC) in Microsoft Defender for Endpoint allow security analysts to create custom indicators (such as file hashes, IPs, or URLs) that are immediately enforced across all managed endpoints. This capability enables blocking execution of a specific SHA256 hash at the kernel level via the Microsoft Defender Antivirus driver, providing near-instant protection without requiring a signature update or policy change.

Answer

Attack surface reduction rules

Answer

Automated investigation and response

Answer

Threat analytics

Question 2

A compliance officer needs to ensure that all emails containing sensitive information (e.g., passport numbers) are automatically encrypted when sent to external recipients. The encryption should be enforced without requiring users to manually select an option. Which Microsoft Purview feature should they configure?

Accepted Answer

Data Loss Prevention (DLP) policy with encryption action. A Data Loss Prevention (DLP) policy with encryption action is correct because it automatically detects sensitive information (e.g., passport numbers) using sensitive info types and enforces encryption via Microsoft Purview Message Encryption (OME) as a rule action. This ensures that when an email containing such data is sent to an external recipient, the email is automatically encrypted without requiring user intervention, meeting the compliance officer's requirement.

Answer

Sensitivity labels with auto-labeling

Answer

Message Encryption (OME) policies

Answer

Communication Compliance

Question 3

An organization uses a third-party SaaS application that supports SAML-based single sign-on. The application is not in the Azure AD gallery. What is the first step to configure SSO?

Accepted Answer

Create a new enterprise application from the 'Non-gallery application' option in Azure AD. The correct first step is to create a new enterprise application from the 'Non-gallery application' option in Microsoft Entra ID. This allows you to configure SAML-based SSO for any third-party application that supports SAML 2.0, even if it is not listed in the Microsoft Entra ID gallery. The non-gallery application template provides the necessary endpoints and metadata to establish trust between Microsoft Entra ID and the SaaS application.

Answer

Configure Azure AD Connect to sync on-premises users

Answer

Add the application in the Microsoft 365 admin center under 'Integrated apps'

Answer

Create a custom role in Azure AD for the application

Question 4

An organization uses Microsoft Defender for Cloud Apps to monitor shadow IT. They want to enforce policies that block downloads from risky cloud apps. Which Microsoft Defender XDR component provides this capability?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps is the correct component because it is specifically designed to provide visibility into shadow IT and enforce policies on cloud applications. Its 'Governance' actions include blocking downloads from risky apps by integrating with the cloud app's API to prevent data exfiltration, which directly addresses the requirement.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Office 365

Question 5

Refer to the exhibit. The Contoso tenant has a cross-tenant access policy configured for Fabrikam. Users from Fabrikam are unable to access resources in Contoso via B2B collaboration. What is the most likely reason?

Accepted Answer

The B2BCollaborationInbound setting for Fabrikam does not allow any identities or applications. The B2BCollaborationInbound setting for Fabrikam controls which external users and applications are allowed to access Contoso resources via B2B collaboration. If this setting does not allow any identities or applications, all inbound B2B collaboration attempts from Fabrikam will be blocked, even if the default cross-tenant access policy is permissive.

Answer

The B2BCollaborationOutbound setting is blocking access

Answer

The default cross-tenant access policy is set to block all

Answer

The B2BDirectConnectInbound setting is empty

Question 6

A company wants to allow users to reset their own forgotten passwords using a mobile app notification as the verification method. Which Microsoft Entra feature should be enabled and configured?

Accepted Answer

Self-service password reset. Self-service password reset (SSPR) is the Microsoft Entra feature that allows users to reset their own forgotten passwords. To use a mobile app notification as the verification method, the administrator must enable SSPR and configure the 'Mobile app notification' authentication method under the 'Authentication methods' policy. This satisfies the requirement for a password reset triggered by a mobile app notification.

Answer

Azure AD Password Protection

Answer

Privileged Identity Management

Answer

Identity Protection

Question 7

A compliance officer needs to identify documents in SharePoint Online that contain confidential business information by using a machine learning model. Which Microsoft Purview solution should be configured?

Accepted Answer

B: Information Protection (trainable classifiers). Trainable classifiers in Microsoft Purview Information Protection use machine learning models to identify documents containing sensitive or confidential business information based on content patterns and context. Unlike simple keyword matching, trainable classifiers learn from sample documents to accurately detect specific types of confidential data, such as intellectual property or financial reports, in SharePoint Online.

Answer

A: Data Lifecycle Management

Answer

C: eDiscovery

Answer

D: Communication Compliance

Question 8

You are implementing Microsoft Entra Identity Protection. You need to configure automated responses to medium and high user risk. Which policy should you create?

Accepted Answer

User risk policy. User risk policy in Microsoft Entra Identity Protection is specifically designed to automatically respond to user risk levels (low, medium, high) by triggering remediation actions such as requiring a password change or blocking sign-in. Since the question asks for automated responses to medium and high user risk, the correct policy is the User risk policy, which evaluates risk based on user behavior and leaked credentials.

Answer

Sign-in risk policy

Answer

Conditional Access policy with grant controls

Answer

MFA registration policy

Question 9

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only compliant devices can access Microsoft 365 resources. What should you configure?

Accepted Answer

Create a conditional access policy in Microsoft Entra ID requiring compliant devices.. Conditional Access policies in Microsoft Entra ID (formerly Azure AD) are the mechanism that enforces access controls based on signals such as device compliance. By creating a policy that requires compliant devices, you ensure that only devices meeting your compliance standards can access Microsoft 365 resources. This works in conjunction with Intune compliance policies, but the enforcement point is the Conditional Access policy.

Answer

Configure an app protection policy in Intune.

Answer

Create a device compliance policy in Intune.

Answer

Configure a Windows Hello for Business policy in Intune.

Question 10

Contoso is a multinational company with 50,000 users. They have a Microsoft 365 E5 subscription and use Microsoft Entra ID for identity. They recently deployed Microsoft Copilot for Microsoft 365 to 10,000 users. The security team wants to ensure that Copilot responses do not expose sensitive information. They also need to monitor Copilot usage for unusual activity. The company uses Microsoft Purview Information Protection and Microsoft Defender for Cloud Apps. You need to configure the environment to meet these requirements. Which action should you take?

Accepted Answer

Create a Microsoft Purview DLP policy that includes Copilot as a location.. Microsoft Purview Data Loss Prevention (DLP) policies can include Microsoft Copilot for Microsoft 365 as a location, allowing the security team to detect and prevent sensitive information from being exposed in Copilot responses. This directly addresses the requirement to ensure Copilot responses do not expose sensitive data by scanning and blocking content based on sensitivity labels or sensitive info types.

Answer

Configure a Conditional Access policy to restrict Copilot to managed devices.

Answer

Enable session monitoring in Microsoft Defender for Cloud Apps for Copilot.

Answer

Create sensitivity labels and auto-labeling policies for Copilot.

Question 11

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP) policies to protect sensitive data in Microsoft Teams. You need to ensure that DLP policies apply to both chat and channel messages. What should you configure?

Accepted Answer

Create a single DLP policy with the Teams location selected.. Microsoft Purview DLP policies can be configured to include the Teams location, which automatically covers both chat and channel messages. When you select the Teams location in a single DLP policy, it applies to all Teams communications, including 1:1 chats, group chats, and channel conversations, without needing separate policies.

Answer

Configure a DLP policy for Exchange Online to cover Teams messages.

Answer

Assign a sensitivity label to the Teams with a DLP policy attached.

Answer

Create two separate DLP policies: one for chat and one for channels.

Question 12

Your organization has a hybrid identity deployment with Microsoft Entra Connect. You have synchronized all on-premises Active Directory users to Microsoft Entra ID. You need to enable Microsoft Entra ID Password Protection to automatically block weak passwords. You have installed the Password Protection proxy on a server and registered it. You also need to enforce the password protection policy for on-premises users. What additional step is required?

Accepted Answer

Install the Password Protection DC agent on each domain controller.. The Password Protection DC agent is required on each domain controller to intercept and validate password changes against the Microsoft Entra ID Password Protection policy. Without this agent, the proxy server alone cannot enforce the policy for on-premises users, as the DC agent is the component that applies the password filter during password change operations.

Answer

Install the Password Protection proxy on all domain controllers.

Answer

Enable the password filter in the Microsoft Entra Connect configuration.

Answer

Configure a Group Policy to require password complexity.

Question 13

Your organization uses Microsoft Purview Compliance Manager. You need to assign a control to a specific user for implementation. What should you do?

Accepted Answer

Edit the control and assign a new owner.. In Microsoft Purview Compliance Manager, each control within an assessment has an 'Assigned to' field that designates the individual responsible for implementing and documenting that control. Editing the control and assigning a new owner is the correct way to delegate accountability for a specific control to a user. This assignment is purely for tracking and workflow purposes and does not grant any permissions to the user.

Answer

Assign the user the Compliance Manager role.

Answer

Create a DLP policy to enforce the control.

Answer

Modify the assessment to include the user.

Question 14

Your organization has deployed Microsoft Defender for Cloud Apps. You need to ensure that all external file sharing to untrusted domains is automatically blocked. The solution must not affect internal sharing. What should you configure?

Accepted Answer

Create a file policy in Microsoft Defender for Cloud Apps with a governance action to remove external users.. A file policy in Microsoft Defender for Cloud Apps can be configured with a governance action to remove external users from shared files when sharing is detected with untrusted domains. This action automatically blocks external sharing without affecting internal sharing, as it targets only external collaborators from domains not on the trusted list.

Answer

Create an access policy in Microsoft Defender for Cloud Apps to block access from untrusted domains.

Answer

Configure an app connector for the cloud app to enforce DLP policies.

Answer

Create a session policy in Microsoft Defender for Cloud Apps to monitor external sharing.

Question 15

You are a security administrator for an organization that uses Microsoft Defender XDR. You want to provide your security operations team with a unified view of all incidents across endpoints, email, and identities. You also want to automate the creation of incidents when correlated alerts are detected. What should you do?

Accepted Answer

Navigate to the Microsoft Defender XDR portal (security.microsoft.com) and use the Incidents view.. The Microsoft Defender XDR portal (security.microsoft.com) provides a unified incident view and automatically correlates alerts from multiple workloads (endpoints, email, identities) into incidents. Option B is incorrect because Microsoft Defender for Endpoint portal focuses only on endpoint data, not the unified view across all services. Option C is incorrect because while Microsoft Sentinel can provide a unified view, it requires additional licensing, configuration, and does not automatically create incidents from correlated alerts without custom analytics rules. Option D is incorrect because custom KQL queries and workbooks provide visibility but do not automate incident creation; that requires built-in correlation from Microsoft Defender XDR.

Answer

Open the Microsoft Defender for Endpoint portal and create a dashboard for all alerts.

Answer

Install Microsoft Sentinel and configure data connectors for all workloads.

Answer

Create a custom KQL query that correlates alerts from different sources and create a workbook.