MS-102 Practice Test 17 — 15 Questions

Question 1

An organization is involved in litigation and needs to search for all communications containing a specific keyword across Exchange Online, SharePoint Online, and OneDrive for Business. The results must be preserved as evidence without allowing deletion. Which Microsoft Purview solution should the compliance officer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

eDiscovery (Premium). eDiscovery (Premium) is the correct solution because it provides end-to-end workflow for identifying, preserving, collecting, reviewing, and exporting content across Exchange Online, SharePoint Online, and OneDrive for Business. It supports legal hold to preserve data in-place, preventing deletion or alteration, and can search all communications for specific keywords using advanced query capabilities.

Answer

Data Loss Prevention

Answer

Communication Compliance

Answer

Retention Labels

Question 2

You need to ensure that only users from your organization's on-premises Active Directory can access Microsoft 365 services. You have Microsoft Entra Connect configured. What is the simplest way to prevent cloud-only user accounts from signing in?

Accepted Answer

Set the 'Block sign in' option to 'Yes' for all cloud-only users in the Microsoft Entra admin center.. Setting the 'Block sign in' option to 'Yes' for cloud-only users in the Microsoft Entra admin center directly prevents those accounts from signing in without deleting them or affecting licensed users. This is the simplest and most targeted method. It does not require conditional access policies or license changes.

Answer

Configure a conditional access policy that blocks all users.

Answer

Delete the cloud-only users from Microsoft Entra ID.

Answer

Remove all licenses from cloud-only users.

Question 3

Your company is required to retain all emails sent to and from executives for 7 years due to regulatory compliance. You need to implement this with minimal administrative overhead. What should you use?

Accepted Answer

Create a Microsoft Purview retention policy for the executive mailboxes. A Microsoft Purview retention policy applied to the executive mailboxes retains all emails for 7 years with minimal administrative overhead. It is a centralized, policy-based solution that does not require per-mailbox configuration or external systems. This meets the regulatory requirement efficiently.

Answer

Configure Exchange journaling to export to an external system

Answer

Place each executive mailbox on Litigation Hold

Answer

Enable the archive mailbox for each executive

Question 4

You are configuring Microsoft Entra ID Protection. You want to automatically respond to a specific risk level by requiring the user to change their password. Which risk policy should you configure?

Accepted Answer

User risk policy. The user risk policy in Microsoft Entra ID Protection is designed to respond to user risk detections such as leaked credentials, and it can be configured to require a password change (password reset) when a specified user risk level is reached. This directly matches the requirement to automatically respond to a risk level by requiring a password change.

Answer

MFA registration policy

Answer

Sign-in risk policy

Answer

Session risk policy

Question 5

Your organization has Microsoft Defender for Office 365. Users report that legitimate emails from a partner domain are being quarantined. You need to ensure these emails are delivered while maintaining security. What should you do?

Accepted Answer

Add the partner domain to the Allow list in the Tenant Allow/Block List.. The Tenant Allow/Block List in Microsoft Defender for Office 365 is the supported, granular mechanism for allowing specific senders or domains that are being incorrectly quarantined. Adding the partner domain as an allow entry tells Exchange Online Protection (EOP) to skip filtering actions (quarantine, junk, etc.) for messages from that domain while still applying other protections like malware scanning and Safe Links. This preserves security posture because only the specific false-positive source is exempted, not the entire filtering pipeline.

Answer

Disable spam filtering for the partner domain.

Answer

Lower the spam confidence level (SCL) threshold for the organization.

Answer

Create a mail flow rule to bypass spam filtering for the partner domain.

Question 6

A company wants to require MFA for all users when they access Office 365 from any network location that is not the company's trusted IP ranges. Which Conditional Access policy configuration should be applied?

Accepted Answer

A: Include all users, exclude none, grant access require MFA with condition 'Location not in trusted locations'.. Ly configures a Conditional Access policy that targets all users and applies the 'Require MFA' grant control when the location condition is set to 'Any location' except the company's trusted IP ranges. This ensures MFA is enforced for all access attempts originating from outside the trusted network, meeting the requirement precisely.

Answer

B: Include all users, exclude none, block access with condition 'Location not in trusted locations'.

Answer

C: Include all users, exclude trusted locations as a group, grant access require MFA.

Answer

D: Include all users, exclude all locations, grant access require MFA.

Question 7

Match each Microsoft 365 threat scenario to the appropriate protection.

Accepted Answer

Phishing email with malicious link: Microsoft Defender for Office 365 Safe Links. Correct matches: Phishing links → Safe Links; Malware attachments → Safe Attachments; Data leaks → DLP; Ransomware → Anti-ransomware policies. Common mistakes include confusing Safe Links with Safe Attachments and DLP with Defender protections.

Answer

Phishing email with malicious link: Microsoft Defender for Office 365 Safe Attachments

Answer

Accidental data leak via email: Microsoft Defender for Office 365 Safe Links

Question 8

Your organization uses Microsoft Defender for Cloud Apps. You need to generate alerts when a user downloads more than 100 files from SharePoint Online within 10 minutes. What should you configure?

Accepted Answer

Create an activity policy. Activity policies in Microsoft Defender for Cloud Apps are designed to monitor user activities across connected apps and generate alerts when specific conditions are met, such as a user downloading more than 100 files from SharePoint Online within 10 minutes. This is a classic anomaly detection scenario that activity policies handle natively. The other policy types serve different purposes: app discovery for shadow IT, session policies for conditional access, and OAuth app policies for app permissions.

Answer

Create an app discovery policy

Answer

Create a session policy

Answer

Create an OAuth app policy

Question 9

Your organization uses Microsoft Defender for Endpoint (Plan 2) and Microsoft Defender for Identity. A user reports that their device is running slowly and exhibiting unusual network traffic. You investigate in Microsoft Defender XDR and see a high number of alerts for the device. You need to determine if the device is compromised and, if so, initiate an automated investigation. What should you do first?

Accepted Answer

Use the Microsoft Defender XDR portal to trigger an automated investigation on the device. Using the Microsoft Defender XDR portal to trigger an automated investigation leverages the full XDR capabilities to analyze the device and determine if it is compromised. Option A is incorrect because isolating the device is a containment action, not the first step to determine compromise. Option B is incorrect because Live Response is a manual forensic tool, not an automated investigation. Option D is incorrect because running a full antivirus scan is not an automated investigation and may not detect advanced threats.

Answer

Isolate the device from the network immediately

Answer

Initiate a Live Response session to gather forensic data

Answer

Run a full antivirus scan from Microsoft Defender Antivirus

Question 10

Your company has a Microsoft 365 E5 subscription. You need to prevent users from sharing files containing credit card numbers with external users. What should you configure?

Accepted Answer

A DLP policy that blocks sharing of content with sensitive info type.. A Data Loss Prevention (DLP) policy in Microsoft 365 can detect sensitive information types such as credit card numbers and block sharing with external users. DLP policies are designed to prevent accidental or intentional sharing of sensitive data across Exchange, SharePoint, OneDrive, and Teams, making it the correct control for this requirement.

Answer

A retention policy for SharePoint sites.

Answer

An information barrier policy.

Answer

A sensitivity label with encryption.

Question 11

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. What is the effect of this policy?

Accepted Answer

All users on iOS or Android devices accessing Office 365 must use MFA and a compliant device. The policy shown in the exhibit explicitly targets 'All users' and 'Office 365' as the cloud app, with conditions for 'iOS' and 'Android' device platforms. The grant controls require both 'Require multi-factor authentication' and 'Require device to be marked as compliant', meaning any user on an iOS or Android device accessing Office 365 must satisfy both MFA and device compliance. This is a common Conditional Access policy to enforce secure access from mobile devices.

Answer

All users accessing all cloud apps are required to use MFA

Answer

Access to Office 365 from iOS and Android is blocked

Answer

Users on mobile devices are required to use hybrid Azure AD joined devices

Question 12

Your company is implementing Microsoft Purview Audit (Standard). You need to search for activities performed by a specific user in Exchange Online. Which log should you query?

Accepted Answer

Unified audit log.. Microsoft Purview Audit (Standard) stores all audit events — including Exchange Online user activities — in the Unified audit log, which is queried via the Microsoft Purview compliance portal or the Search-UnifiedAuditLog PowerShell cmdlet. To find activities performed by a specific user in Exchange Online, you search the Unified audit log and filter by the user's UPN and the relevant Exchange workloads/activities. This is the single centralized log for Purview Audit (Standard) across Microsoft 365 services.

Answer

DLP incident reports.

Answer

Azure AD audit logs.

Answer

Mailbox audit logs only.

Question 13

A company is planning to deploy Microsoft Defender for Endpoint to its Windows 10 devices. The devices are managed by Microsoft Intune. The security team wants to ensure that the MDE sensor is installed automatically on new devices that are enrolled in Intune. Which method should the team use?

Accepted Answer

Create an Endpoint security policy in Intune to deploy MDE.. The correct method is to create an Endpoint security policy in Intune specifically for Microsoft Defender for Endpoint. This policy type allows you to configure the MDE onboarding blob and automatically deploy the MDE sensor to Windows 10 devices enrolled in Intune. It is the native, cloud-based approach that ensures new devices receive the sensor without manual intervention or on-premises infrastructure.

Answer

Manually install MDE on each device.

Answer

Use Group Policy to deploy the MDE installation package.

Answer

Deploy MDE using Microsoft Configuration Manager.

Question 14

A security administrator needs to block outbound network connections from a compromised Windows device to command-and-control servers. The solution must work at the network layer and be centrally managed via Microsoft 365 Defender. Which feature should the administrator enable?

Accepted Answer

Network Protection. Network Protection in Microsoft Defender for Endpoint blocks outbound connections to command-and-control (C2) servers at the network layer by inspecting traffic using the Windows Filtering Platform (WFP). It is centrally managed via Microsoft 365 Defender policies and does not require per-device firewall rule configuration, making it the correct choice for this scenario.

Answer

Attack Surface Reduction rules

Answer

Session control in Defender for Cloud Apps

Answer

Windows Firewall with Advanced Security

Question 15

Your organization has a Microsoft 365 E5 tenant with Microsoft Defender for Cloud Apps. You need to discover and control the use of unsanctioned cloud apps. Which TWO actions should you take? (Choose two.)

Accepted Answer

Define sanctioned and unsanctioned app categories in Microsoft Defender for Cloud Apps. Option D is correct because Cloud Discovery in Microsoft Defender for Cloud Apps is the feature that ingests and analyzes traffic logs (from firewalls, proxies, or Defender for Endpoint) to identify which cloud apps are being used in the organization, which is the required first step for discovering unsanctioned apps. Option A is correct because after discovery, you use the app catalog to tag apps as Sanctioned or Unsanctioned (and assign categories/risk scores), which is how Defender for Cloud Apps enforces the governance decision and drives downstream controls like blocking or alerting. Option B is not correct because Microsoft Purview DLP policies protect sensitive data in sanctioned workloads; they do not discover or sanction/unsanction cloud apps. Option C is not correct because Entra ID App Registrations are for registering and permissioning your own applications with the identity platform, not for logging or discovering third-party cloud app usage. Option E is not correct because Conditional Access cannot target 'all unsanctioned apps' generically; enforcement against unsanctioned apps is done via Defender for Cloud Apps app governance and Conditional Access App Control (session/access policies) after apps are tagged, not by a blanket CA policy.

Answer

Deploy Microsoft Purview Data Loss Prevention policies

Answer

Configure Microsoft Entra ID App Registrations to log app usage

Answer

Create a Conditional Access policy to block all unsanctioned apps