MS-102 Practice Test 18 — 15 Questions

Question 1

Drag and drop the steps to deploy Microsoft Defender for Office 365 policies in the correct order.

Accepted Answer

Create the policy, configure protection settings, specify recipients, enable the policy. Defender for Office 365 policies are created in the Defender portal, configured with threat protection settings, and applied to recipients.

Answer

Create the policy, specify recipients, configure protection settings, enable the policy

Answer

Configure protection settings, create the policy, specify recipients, enable the policy

Answer

Create the policy, enable the policy, configure protection settings, specify recipients

Question 2

An organization has registered the domain contoso.com and added it to their Microsoft 365 tenant. What is the next step to use this domain for user email addresses?

Accepted Answer

Add a DNS TXT record provided by Microsoft to the domain registrar. After adding a custom domain to Microsoft 365, the domain's ownership must be verified by adding a specific DNS TXT record provided by Microsoft at the domain registrar. This verification proves you control the domain and is a prerequisite before you can assign user email addresses or configure other DNS records like MX. Without this step, Microsoft 365 will not trust the domain for email routing.

Answer

Create user accounts with the new domain

Answer

Configure Exchange Online connectors

Answer

Set up MX records for email routing

Question 3

Drag and drop the steps to configure Data Loss Prevention (DLP) policies in Microsoft Purview in the correct order.

Accepted Answer

Create DLP policy, Define conditions and actions, Test the policy, Deploy the policy. DLP policies are created in Purview, conditions and actions defined, and then deployed after testing.

Answer

Define conditions and actions, Create DLP policy, Test the policy, Deploy the policy

Answer

Create DLP policy, Define conditions and actions, Deploy the policy, Test the policy

Answer

Create DLP policy, Test the policy, Define conditions and actions, Deploy the policy

Question 4

You are the Microsoft 365 administrator for a company that uses Microsoft 365 E3. The company wants to allow users to reset their own passwords without contacting the help desk. You need to enable self-service password reset (SSPR) for all users. What should you do?

Accepted Answer

In the Microsoft Entra admin center, enable password reset for all users and require users to register authentication methods.. To enable self-service password reset, you must configure it in the Microsoft Entra admin center and require users to register authentication methods. This allows users to reset their own passwords without help desk intervention. SSPR is included in all Microsoft Entra ID editions, so no additional licensing is needed. Conditional access password change and on-premises writeback are not prerequisites for cloud-only SSPR.

Answer

Configure a conditional access policy that requires password change on next sign-in for all users.

Answer

Enable Azure AD Connect password writeback and configure password reset in the on-premises Active Directory.

Answer

Assign Microsoft 365 E5 licenses to all users to enable self-service password reset.

Question 5

A security administrator wants to prevent Microsoft Office applications (Word, Excel, PowerPoint) from creating child processes, which is a common technique used by malware to execute malicious code. Which attack surface reduction (ASR) rule should be enabled?

Accepted Answer

Block all Office applications from creating child processes. The ASR rule 'Block all Office applications from creating child processes' (GUID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A) specifically prevents Word, Excel, and PowerPoint from spawning child processes such as cmd.exe, PowerShell, or wscript.exe. This directly mitigates a common malware technique where Office macros or exploits launch malicious executables. The rule is part of Microsoft Defender for Endpoint's attack surface reduction capabilities and is designed to stop process injection and lateral movement without blocking legitimate Office functionality.

Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criteria

Answer

Block Office applications from creating executable content

Answer

Block Win32 API calls from Office macros

Question 6

Your organization has a Microsoft 365 tenant configured with a custom domain. You need to verify domain ownership using a TXT record. Where in the Microsoft 365 admin center would you initiate this process?

Accepted Answer

Settings > Domains. To verify domain ownership in Microsoft 365, you must add a TXT record provided by Microsoft to your domain's DNS zone. The process is initiated in the Microsoft 365 admin center under Settings > Domains, where you select the domain and click 'Start setup' to receive the verification TXT record value. This is the only location in the admin center that directly manages domain verification and DNS record validation for custom domains.

Answer

Setup > Org-wide settings

Answer

Users > Active Users

Answer

Admin centers > Azure Active Directory

Question 7

You are the Microsoft 365 administrator for a multinational company. The company has deployed Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps. Recently, the security team detected that a user's credentials were compromised and used to access SharePoint Online from an unusual location. You need to investigate the incident and determine the full scope of the breach. The solution must use Microsoft 365 Defender to correlate events. What should you do first?

Accepted Answer

Use advanced hunting in Microsoft 365 Defender portal to query for events related to the user across workloads.. Advanced hunting in the Microsoft 365 Defender portal allows you to query raw, cross-workload telemetry (e.g., from Identity, Exchange Online, SharePoint Online, and Defender for Cloud Apps) in a single Kusto Query Language (KQL) query. This is the most efficient first step to correlate events such as sign-ins, mailbox access, file downloads, and app sessions related to the compromised user, enabling you to determine the full scope of the breach across all Microsoft 365 services.

Answer

Use the Microsoft Purview compliance portal to search for the user's activity in audit logs.

Answer

Use Microsoft Defender for Cloud Apps to investigate the user's activity log.

Answer

Use Microsoft Sentinel to query the user's events from the workspace.

Question 8

A company uses Azure AD Identity Protection. The security administrator wants to block user sign-ins when the sign-in risk level is detected as 'High' for a custom SaaS application. Which Conditional Access policy configuration should the administrator use?

Accepted Answer

Create a Conditional Access policy set to block access when sign-in risk is high. The requirement is to block sign-ins when the sign-in risk level is 'High' for a custom SaaS application. In Microsoft Entra ID (formerly Azure AD), a Conditional Access policy can be configured with a 'Block access' grant control, which directly denies authentication when the specified condition (sign-in risk level equals High) is met. This is the most straightforward and secure approach to prevent access without relying on additional authentication factors or session controls.

Answer

Create a Conditional Access policy with a grant control to require MFA when sign-in risk is high

Answer

Configure a session control in Conditional Access to sign out users when risk is high

Answer

Enable Identity Protection risk policy to automatically block users

Question 9

You are reviewing a Conditional Access policy in Microsoft Entra ID. The exhibit shows the policy configuration. You need to allow users to access Office 365 applications from personal devices that are not enrolled in Microsoft Intune. However, the policy currently blocks access because it requires a compliant device. Users are prompted for MFA but then blocked due to device compliance. What should you modify in the policy?

Accepted Answer

Remove "compliantDevice" from the builtInControls grant control list.. The policy currently uses the 'Require compliant device' grant control, which blocks access from devices not enrolled in Intune or not meeting compliance policies. Removing 'compliantDevice' from the builtInControls list allows access from personal, non-enrolled devices while still enforcing MFA. This directly resolves the scenario where users pass MFA but are blocked by device compliance.

Answer

Add a session control for sign-in frequency.

Answer

Remove the cloudAppSecurity session control.

Answer

Change cloudAppSecurityType to "blockDownloads".

Question 10

Your company uses Microsoft Defender for Endpoint and wants to perform a live response on a device. Which THREE prerequisites must be met?

Accepted Answer

The user must be assigned a role that includes live response permissions. Live response in Microsoft Defender for Endpoint requires the user to be assigned a role that includes specific live response permissions, such as 'Live response' or 'Live response advanced' under the Microsoft 365 Defender role-based access control (RBAC). Without these permissions, the user cannot initiate a live response session, regardless of other configurations.

Answer

The device must be managed by Microsoft Intune

Answer

The device must have Microsoft Defender Antivirus as the primary antivirus solution

Question 11

A security administrator wants to prevent attackers from stealing credentials by blocking access to the Local Security Authority Subsystem Service (LSASS) from untrusted processes. Which Attack Surface Reduction (ASR) rule should the administrator enable to meet this requirement?

Accepted Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe).. The ASR rule 'Block credential stealing from the Windows local security authority subsystem (lsass.exe)' (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2) directly prevents untrusted processes from accessing LSASS memory, which is a common technique used by attackers to dump credentials via tools like Mimikatz. This rule blocks attempts to open lsass.exe with specific access rights (e.g., PROCESS_VM_READ) from non-trusted processes, thereby protecting credential material stored in LSASS.

Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion.

Answer

Block Office applications from creating child processes.

Answer

Block persistence through Windows Management Instrumentation (WMI) event subscription.

Question 12

An administrator has configured group-based licensing in Azure AD. After adding users to the group, some users do not receive licenses. The users are in the group and have an assigned usage location. What is a possible reason?

Accepted Answer

The users have conflicting license assignments from another source. Group-based licensing in Microsoft Entra ID can fail when a user already has a license assigned from another source, such as direct assignment or another group. Microsoft Entra ID's group-based licensing processes assignments in a deterministic order, and if a conflict arises (e.g., different service plans or SKUs), the system may skip the user and log an error in the audit logs. This is a common scenario when users are migrated from direct licensing to group-based licensing without removing the existing assignments.

Answer

The group is a mail-enabled security group, which is not supported for group-based licensing

Answer

The license product name in the group setting does not match the available licenses in the tenant

Answer

The users have not accepted the Microsoft Online Service Terms

Question 13

A company has recently signed up for Microsoft 365 Business Premium. They want to change the default domain from onmicrosoft.com to a custom domain they own. Which step must be completed first before the custom domain can be used for user email addresses?

Accepted Answer

Add the custom domain in the Microsoft 365 admin center. Before a custom domain can be used for user email addresses in Microsoft 365, the domain must first be added to the tenant in the Microsoft 365 admin center. This step creates a domain object in Microsoft Entra ID that allows Microsoft to associate the domain with your tenant and prepare for ownership verification. Without adding the domain first, subsequent steps like DNS verification or user creation cannot proceed because the system has no record of the domain.

Answer

Verify domain ownership by adding a TXT record to the domain's DNS

Answer

Create user accounts with the new domain as their primary email

Answer

Configure email exchange records (MX)

Question 14

The security team at Contoso wants to require that any activation of the Global Administrator role in Azure AD Privileged Identity Management (PIM) must be approved by members of a security group named 'GA-Approvers'. Activations must require a business justification and expire after 4 hours. Which PIM configuration should the administrator modify to achieve this?

Accepted Answer

The role settings for Global Administrator, on the Activation tab. The Activation tab in the role settings for Global Administrator allows you to configure approval requirements, justification, and maximum activation duration. By setting 'Require approval to activate' to 'Enabled' and specifying the 'GA-Approvers' group as the approver, requiring a business justification, and setting the activation maximum duration to 4 hours, you meet all the stated requirements.

Answer

The role settings for Global Administrator, on the Assignment tab

Answer

The role settings for Global Administrator, on the Notification tab

Answer

The role settings for Global Administrator, on the Alert tab

Question 15

An administrator wants to receive real-time notifications for service incidents in Microsoft 365. The notifications must be sent to a Microsoft Teams channel instead of email. Which configuration should the administrator set up?

Accepted Answer

Configure a webhook connector in Microsoft Teams to subscribe to the Office 365 Service Communications API.. The Office 365 Service Communications API provides real-time webhook-based notifications for service incidents. By configuring a webhook connector in Microsoft Teams, the administrator can subscribe to this API and receive incident alerts directly in a Teams channel without polling or email forwarding.

Answer

Configure an email notification rule in the Microsoft 365 admin center and forward it to a Teams email address.

Answer

Use Power Automate to check service health and post to Teams every 5 minutes.

Answer

Configure a message center alert to email and then use a third-party integration to post to Teams.