MS-102 Practice Test 16 — 15 Questions

Question 1

Refer to the exhibit. The conditional access policy JSON shown above is applied to all users. A user authenticates from a trusted location and wants to access a cloud app. Which combination of controls will be enforced?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

MFA, terms of use acceptance, sign-in frequency of 1 hour, and persistent browser never. The conditional access policy JSON explicitly defines three grant controls: 'mfa' (require multi-factor authentication), 'termsOfUse' (require terms of use acceptance), and 'signInFrequency' (value 3600 seconds = 1 hour) combined with 'persistentBrowser' set to 'never'. Since the policy is applied to all users and the user authenticates from a trusted location, all specified controls are enforced simultaneously, as conditional access policies apply all grant controls in the 'grantControls' block unless overridden by session controls.

Answer

Terms of use acceptance and persistent browser never only

Answer

MFA and terms of use acceptance only

Answer

MFA and sign-in frequency of 1 hour only

Question 2

A company invites external partners as B2B guest users in Microsoft Entra ID. The partners' home tenants do not support MFA. The company wants to require MFA when guests access an internal application. What should the company configure?

Accepted Answer

Configure a Conditional Access policy that targets all guest users, require MFA, and enable MFA registration for guests in the resource tenant.. When guest users' home tenants do not support MFA, the resource tenant must enforce MFA directly. A Conditional Access policy targeting all guest users with 'Require MFA' grant control, combined with enabling MFA registration for guests in the resource tenant, allows guests to register and use MFA methods (e.g., Microsoft Authenticator) within the resource tenant. This ensures MFA is enforced regardless of the home tenant's capabilities.

Answer

Ask the partners to configure MFA in their home tenant, then trust their MFA claims.

Answer

Use a Per-User MFA policy for guest users, but guests cannot register for MFA in the resource tenant.

Answer

Create a Conditional Access policy requiring MFA for all external users, but exclude guests from known networks.

Question 3

You need to enforce multifactor authentication (MFA) for all users in a Microsoft Entra ID tenant. The solution must not require users to register security info if they already have it. Which approach should you use?

Accepted Answer

Create a Conditional Access policy that requires MFA for all users. A Conditional Access policy can require MFA for all users while respecting existing security info registration. The policy triggers MFA during sign-in but does not force re-registration if the user has already registered. This meets the requirement of not requiring users to register security info if they already have it.

Answer

Use identity protection to enforce MFA for risky sign-ins

Answer

Assign MFA per user in the Microsoft Entra admin center

Answer

Enable security defaults

Question 4

A compliance officer needs to prevent users from sending emails that contain credit card numbers to external recipients. When a user attempts to send such an email, the action should be blocked and a policy tip should be displayed in Outlook telling them why the email was blocked. Which Microsoft Purview solution should be configured?

Accepted Answer

Data Loss Prevention (DLP) policy. A Data Loss Prevention (DLP) policy in Microsoft Purview is designed to detect and block sensitive information, such as credit card numbers, from being sent to external recipients. When configured with a 'Block' action and a policy tip, it prevents the email from being sent and displays a customizable notification in Outlook explaining the reason. This directly meets the compliance officer's requirement to block the email and show a policy tip.

Answer

Retention label policy

Answer

Microsoft Purview Information Protection sensitivity label

Answer

Compliance Manager

Question 5

Your company is implementing a Microsoft Entra ID Governance solution. You need to ensure that access reviews are performed for all guest users in the Finance department. The review must be conducted by the guest user's manager. Which THREE actions should you take?

Accepted Answer

Create an access review for the dynamic group with scope 'All guest users'.. A review of groups with guest members, creation of an access review for all guests in Finance, and assignment of reviewers to managers are required. Setting a self-review is not correct because the requirement is for manager review. Disabling automatic application of results is unnecessary and could prevent enforcement.

Answer

Disable the 'Auto apply results to resource' setting.

Answer

Set the access review to self-review for guest users.

Question 6

An administrator wants to configure automated investigation and response (AIR) in Microsoft 365 Defender so that when a high-severity malware alert is generated for a device from Microsoft Defender for Endpoint, the device is automatically isolated from the network without requiring a security analyst to approve the action. Which configuration step is required?

Accepted Answer

Set the automation level for device isolation to 'Full - remediate threats automatically'. Setting the automation level for device isolation to 'Full - remediate threats automatically' in Microsoft Defender for Endpoint's automated investigation and response (AIR) configuration allows the system to automatically isolate a device when a high-severity malware alert is triggered, without requiring analyst approval. This automation level is specifically designed to execute remediation actions like device isolation immediately based on the alert's severity and the device's risk level.

Answer

Set the automation level for device isolation to 'Semi - require approval for any remediation'

Answer

Create a custom detection rule that automatically isolates the device

Answer

Enable 'Automated device isolation' in the Microsoft 365 Defender settings

Question 7

An administrator has added a custom domain 'contoso.com' to their Microsoft 365 tenant and verified ownership. However, users are unable to receive emails sent to their custom domain. Which type of DNS record must the administrator add in the public DNS zone to route emails to Exchange Online?

Accepted Answer

MX record. The MX (Mail Exchange) record is the DNS record type that directs email messages to a specific mail server. For Exchange Online, the MX record must point to the tenant's mail exchanger (e.g., contoso-com.mail.protection.outlook.com) with a priority value (typically 0). Without this record, sending mail servers cannot route inbound emails to the custom domain's mailbox store in Exchange Online.

Answer

TXT record

Answer

CNAME record

Answer

SPF record

Question 8

A company has just signed up for Microsoft 365 Business Standard without adding a custom domain. An administrator needs to create the first user accounts. What will be the default email address format for these new users?

Accepted Answer

username@.onmicrosoft.com. When a Microsoft 365 tenant is created without adding a custom domain, the default domain is the `.onmicrosoft.com` domain. New user accounts are automatically assigned an email address in the format `username@.onmicrosoft.com`, as this is the initial domain provisioned for the tenant. Option C correctly reflects this default behavior.

Answer

username@contoso.com

Answer

username@onmicrosoft.com

Answer

username@microsoftonline.com

Question 9

A compliance officer needs to prevent external users from printing or copying content from documents stored in a SharePoint Online site. Which Microsoft Purview feature should be configured to enforce this restriction?

Accepted Answer

Sensitivity labels with encryption and usage rights. Sensitivity labels with encryption and usage rights allow administrators to apply Azure Rights Management (Azure RMS) protection to documents, which can restrict actions such as printing and copying. By configuring a sensitivity label with specific usage rights (e.g., 'View Only' or disabling 'Extract' and 'Print'), external users are prevented from printing or copying content even after the document is downloaded or accessed in SharePoint Online. This is the only Purview feature that directly enforces persistent content-level restrictions on external users.

Answer

Data Loss Prevention (DLP) policy

Answer

Information Barriers

Answer

Microsoft Purview Information Protection without encryption

Question 10

You run the above KQL query in Microsoft Defender for Endpoint advanced hunting. What is the purpose of this query?

Accepted Answer

To identify the top 10 devices with the most suspicious process injection alerts. The query filters for alerts specifically related to suspicious process injection (e.g., AlertType == 'SuspiciousProcessInjection'), then groups by DeviceName and counts the alerts per device. It orders the results by count descending and returns the top 10 devices. This identifies the devices with the most suspicious process injection alerts, making Option A correct. Option B is incorrect because the query does not correlate with user activities. Option C is incorrect because it does not filter by severity but by a specific alert type. Option D is incorrect because it only counts a specific category of alerts, not all alert types.

Answer

To correlate device alerts with user activities

Answer

To list all devices with high severity alerts

Answer

To find the top 10 devices with the most alerts of any type

Question 11

Match each Microsoft 365 plan to its included services.

Accepted Answer

Microsoft 365 Business Basic: Includes Exchange Online, SharePoint, Teams, and web versions of Office apps.. Correct matches: Business Basic = web apps only, Business Standard = desktop apps added, Business Premium = security features added, E3 = enterprise compliance. Common mistakes: confusing Business Basic with Business Standard or attributing Intune to Business Standard.

Answer

Microsoft 365 Business Basic: Includes everything in Business Standard plus advanced security.

Answer

Microsoft 365 Business Standard: Includes Desktop Office apps and Intune.

Question 12

A security administrator wants to ensure that all email attachments are scanned in a sandbox environment and blocked if malicious, with email delivery delayed until scanning completes. Which Microsoft 365 Defender policy should the administrator configure?

Accepted Answer

Safe Attachments policy. Safe Attachments policy is the correct choice because it provides sandbox scanning of email attachments. It can be configured to delay email delivery until scanning is complete, blocking malicious attachments. This directly meets the requirement.

Answer

Safe Links policy

Answer

Anti-spam policy

Answer

Anti-phishing policy

Question 13

A company plans to migrate their email from an on-premises Exchange server to Exchange Online. They want to ensure that during the migration, mail sent to users who have already been migrated is delivered to Exchange Online, while mail for non-migrated users is delivered to on-premises. Which type of domain configuration should they use?

Accepted Answer

Split domain. A split domain configuration is required when some mailboxes reside on-premises and others in Exchange Online during a migration. It uses MX records pointing to Exchange Online Protection (EOP) and internal mail flow connectors to route messages for migrated users to Exchange Online and non-migrated users to on-premises, ensuring each mailbox receives mail at its current location.

Answer

Coexistence domain

Answer

Shared domain

Answer

Forwarding domain

Question 14

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should detect when a user receives a malicious email attachment and then opens the attachment, resulting in a process being created (e.g., .exe file). Which two Advanced Hunting tables must be joined to correlate the email attachment with the resulting process?

Accepted Answer

EmailAttachmentInfo and DeviceProcessEvents. Only option B (EmailAttachmentInfo and DeviceProcessEvents) is valid for directly correlating the email attachment with the resulting process. EmailAttachmentInfo contains attachment-specific details like file hash and name, which can be joined with the SHA256 hash or file name in DeviceProcessEvents to track execution. Option A joins EmailEvents with DeviceProcessEvents, but EmailEvents lacks attachment details, making it impossible to directly link the attachment to the executed process.

Answer

EmailEvents and DeviceProcessEvents

Answer

EmailAttachmentInfo and DeviceFileEvents

Answer

DeviceProcessEvents and IdentityLogonEvents

Question 15

A compliance officer needs to ensure that any email sent from the organization that contains personally identifiable information (PII) such as social security numbers is automatically encrypted when the recipient is outside the organization. Which Microsoft Purview solution should the officer configure?

Accepted Answer

Data Loss Prevention (DLP) policy with encryption action. A Data Loss Prevention (DLP) policy in Microsoft Purview can be configured with an 'Encrypt email messages' action that automatically applies Office 365 Message Encryption (OME) to emails containing sensitive information types (e.g., Social Security Number) when sent to external recipients. This meets the compliance requirement for automatic encryption based on content detection, without requiring user intervention or manual label application.

Answer

Sensitivity labels with auto-labeling

Answer

Office 365 Message Encryption (OME) configuration

Answer

Retention policy and labels