MS-102 Practice Test 18 — 15 Questions

Question 1

Which THREE actions can be taken by a Microsoft Purview Data Loss Prevention (DLP) policy in Exchange Online?

Accepted Answer

Block the email from being sent. DLP policies in Exchange Online can block sending, encrypt the message, and notify the sender with a policy tip. Justifying override is not an action; it's a user response. Blocking all emails is not granular; DLP actions are rule-based.

Answer

Allow the sender to override the block

Answer

Block all emails from the sender

Question 2

A security administrator wants to automatically block malicious IP addresses from sending email to Exchange Online mailboxes. Which Microsoft Defender component should be configured?

Accepted Answer

Exchange Online Protection (EOP). Exchange Online Protection (EOP) is the cloud-based email filtering service that protects Exchange Online mailboxes from spam, malware, and malicious IP addresses. It includes connection filtering, which can automatically block messages from specified IP addresses by using the default connection filter policy or custom IP Allow/Block lists. This makes EOP the correct component for blocking malicious IPs from sending email to Exchange Online.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Question 3

A user receives an email from an unknown sender with a .zip attachment. The attachment contains a potentially malicious executable file. Microsoft Defender for Office 365 is enabled. Which feature dynamically detonates the attachment in a sandbox environment and blocks it if malicious behavior is detected?

Accepted Answer

Safe Attachments. Safe Attachments is the correct feature because it specifically detonates email attachments in a dynamic sandbox environment, analyzing behavior in real time. If the .zip file contains a malicious executable, Safe Attachments will block the email before delivery, preventing the user from accessing the threat. This is distinct from other Defender for Office 365 features that focus on URLs, phishing content, or spam filtering.

Answer

Safe Links

Answer

Anti-phishing

Answer

Anti-spam

Question 4

Refer to the exhibit. You run the KQL query in advanced hunting. What is the primary purpose of this query?

Accepted Answer

Identify devices with high use of encoded commands, which may indicate malicious activity. The KQL query filters for DeviceProcessEvents where the command line contains 'powershell' and the process command line includes '-EncodedCommand', which is a known technique used by attackers to obfuscate malicious scripts. The query then counts such events per device and filters for devices with more than 10 occurrences, indicating a high volume of encoded PowerShell commands that may signal malicious activity.

Answer

Identify devices with outbound connections to malicious IPs

Answer

Identify devices with PowerShell execution policy set to bypass

Answer

Identify devices where a user deleted system files using cmd

Question 5

You are planning a Microsoft 365 tenant migration from an on-premises Exchange environment. You need to minimize the impact on end users during the migration. Which migration approach should you use?

Accepted Answer

Perform a staged migration to move mailboxes in batches.. A staged migration allows you to move mailboxes in batches, which minimizes end-user disruption by spreading the migration workload over time and enabling you to test and validate each batch before proceeding. This approach is ideal for organizations with many mailboxes that need to maintain continuity, as users in later batches remain fully functional in the on-premises environment until their turn.

Answer

Deploy a hybrid Exchange configuration.

Answer

Perform a cutover migration to move all mailboxes at once.

Answer

Use an IMAP migration to migrate only email data.

Question 6

A compliance officer needs to prevent users from sharing confidential documents with external users outside the organization. The policy should block sharing via email attachments or sharing links from SharePoint Online. Which Microsoft Purview solution should be configured?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) in Microsoft Purview is designed to identify, monitor, and automatically protect sensitive information across Exchange Online, SharePoint Online, and OneDrive for Business. By creating a DLP policy with a rule that blocks sharing of confidential documents via email attachments or sharing links to external users, the compliance officer can enforce the required restriction. DLP policies can inspect content for sensitive data types (e.g., credit card numbers, custom confidential labels) and apply actions such as blocking the sharing action or sending a notification.

Answer

Sensitivity labels

Answer

Retention policies

Answer

Information barriers

Question 7

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that automatically alerts when a user downloads more than 100 files from SharePoint Online in 10 minutes. What type of policy should you create?

Accepted Answer

Anomaly detection policy. An anomaly detection policy in Microsoft Defender for Cloud Apps is designed to identify unusual user behavior, such as a user downloading over 100 files from SharePoint Online within 10 minutes. This policy type uses machine learning and predefined thresholds to detect deviations from baseline activity, making it the correct choice for this scenario.

Answer

Session policy

Answer

App discovery policy

Answer

OAuth app policy

Question 8

A company wants to use Azure AD Identity Protection features such as user risk policies and sign-in risk policies to automatically respond to risky behavior. Which Azure AD license is required to enable these capabilities?

Accepted Answer

Azure AD Premium P2. Azure AD Identity Protection features like user risk policies and sign-in risk policies require Azure AD Premium P2. This is because P2 includes Identity Protection, which provides risk-based conditional access policies that automatically respond to detected risks. Azure AD Premium P1 supports Conditional Access but lacks the risk detection and automated remediation capabilities of Identity Protection.

Answer

Azure AD Free

Answer

Azure AD Premium P1

Answer

Microsoft 365 E3

Question 9

Your organization has Microsoft 365 E5 licenses and uses Microsoft Defender for Office 365. You need to ensure that users are warned before clicking on malicious URLs in email messages, even if the URL is clicked after the email is delivered. Which policy should you configure?

Accepted Answer

Safe Links policy. Safe Links policy is correct because it provides time-of-click protection, which scans URLs in email messages at the moment the user clicks them, even after delivery. This ensures users are warned or blocked from accessing malicious URLs that may have been benign at the time of delivery but later weaponized. Anti-malware, Safe Attachments, and Anti-phishing policies do not offer this post-delivery click-time verification.

Answer

Anti-malware policy

Answer

Safe Attachments policy

Answer

Anti-phishing policy

Question 10

You are reviewing the following Conditional Access policy JSON in Microsoft Entra ID. What does this policy do?

Accepted Answer

Requires MFA for all users except Admin@contoso.com when accessing any app from mobile apps or desktop clients. The Conditional Access policy JSON targets all users except a specific group containing Admin@contoso.com, applies to all cloud apps, and requires MFA for the 'Browser' and 'Mobile apps and desktop clients' client app types. This effectively enforces MFA for all users except the excluded admin when accessing any app from either web browsers or native/mobile clients, as defined by the 'clientAppTypes' condition.

Answer

Requires MFA for all users accessing all apps from any client type

Answer

Blocks access for all users except Admin@contoso.com when accessing from mobile apps

Answer

Requires MFA for all users accessing all apps from any device

Question 11

You run the KQL query shown in the exhibit in Microsoft Defender XDR advanced hunting. What is the primary purpose of this query?

Accepted Answer

Detect potentially malicious PowerShell commands that are obfuscated. The query filters for powershell.exe processes with an encoded command, which is commonly used to obfuscate malicious commands. Option A is wrong because the query does not filter for specific users. Option C is wrong because the query does not filter by device. Option D is wrong because the query does not filter by time other than the last 7 days.

Answer

Identify all PowerShell activity from a specific user

Answer

Find PowerShell processes running on a specific device

Answer

List all PowerShell executions in the last 7 days

Question 12

Your company, Northwind Traders, uses Microsoft Entra ID P1. You need to allow employees to reset their own passwords without help desk intervention. The company policy requires that password resets be secured with two verification methods. Additionally, users must not be able to reuse the last 10 passwords. The solution must minimize administrative effort. What should you configure?

Accepted Answer

Enable Microsoft Entra self-service password reset (SSPR) and configure the number of methods required to reset to 2, and set password history to enforce last 10 passwords. Microsoft Entra self-service password reset (SSPR) allows users to reset their own passwords without help desk intervention. By configuring the number of methods required to reset to 2, you meet the two-verification-method policy requirement. Setting the password history to enforce the last 10 passwords prevents reuse, and since SSPR is a cloud-native feature, it minimizes administrative effort by avoiding on-premises dependencies.

Answer

Enable Privileged Identity Management (PIM) for all users

Answer

Enable Microsoft Entra password protection and configure password history in the on-premises policy

Answer

Configure a conditional access policy to require MFA during password change

Question 13

A junior administrator needs permission to view sign-in logs, audit logs, and security recommendations in the Microsoft Entra admin center, but must not be able to reset passwords, modify settings, or manage roles. Which built-in Microsoft Entra role should the administrator assign?

Accepted Answer

Security Reader. The Security Reader role grants read-only access to security-related data, including sign-in logs, audit logs, and security recommendations, without permitting any write operations such as password resets, setting modifications, or role management. This aligns precisely with the junior administrator's required permissions.

Answer

Global Reader

Answer

Reports Reader

Answer

Security Administrator

Question 14

A company uses password hash synchronization with Microsoft Entra Connect. The security team wants to enable self-service password reset (SSPR) so that users can reset their own passwords, and the password changes must be written back to the on-premises Active Directory. Which additional configuration is required to achieve password writeback?

Accepted Answer

Install Microsoft Entra Connect with password writeback enabled. Password writeback requires the installation of Microsoft Entra Connect with the password writeback feature explicitly enabled during setup. This allows password changes initiated via SSPR to be written back to on-premises Active Directory. Option C is correct because it directly addresses the necessary infrastructure component.

Answer

Configure SSPR to use federation with on-premises AD FS

Answer

Enable password hash synchronization in Microsoft Entra Connect

Answer

Set the SSPR property 'Password writeback' to 'Yes' in the Microsoft Entra admin center

Question 15

A compliance officer wants to prevent users from sending emails that contain personally identifiable information (PII), such as social security numbers, to external recipients. If a user attempts to send such an email from Outlook, the email should be blocked and a policy tip explaining the block should be displayed. Which Microsoft Purview solution should the officer configure?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) policy. Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to detect and block sensitive information, such as PII (e.g., social security numbers), in transit. When a DLP rule matches, it can block the email and display a policy tip in Outlook, informing the user why the message was blocked. This meets the compliance officer's requirement to prevent external sending of PII with real-time user notification.

Answer

Microsoft Purview Information Protection sensitivity label

Answer

Microsoft Purview Records Management retention label

Answer

Microsoft Purview eDiscovery case