MS-102 Practice Test 19 — 15 Questions

Question 1

A user account was accidentally deleted 10 days ago. The administrator needs to restore the user's mailbox and OneDrive for Business content. Which method should the administrator use?

Accepted Answer

Restore the user from the 'Deleted users' page in the Microsoft 365 admin center.. Microsoft 365 retains deleted user objects, including their Exchange Online mailbox and OneDrive for Business data, for 30 days in the 'Deleted users' list. Restoring the user from this page within the retention period automatically recovers the associated mailbox and OneDrive content without requiring separate tools or support requests.

Answer

Recreate the user account with the same name, and the data will be automatically restored.

Answer

Use the Exchange admin center to recover the mailbox only.

Answer

Submit a support request to Microsoft to recover the deleted data.

Question 2

Your organization has Microsoft 365 E5 licenses and uses Microsoft Defender for Office 365. You need to ensure that users are warned before clicking on malicious URLs in email messages, even if the URL is clicked after the email is delivered. Which policy should you configure?

Accepted Answer

Safe Links policy. Safe Links policy is correct because it provides time-of-click protection, which scans URLs in email messages at the moment the user clicks them, even after delivery. This ensures users are warned or blocked from accessing malicious URLs that may have been benign at the time of delivery but later weaponized. Anti-malware, Safe Attachments, and Anti-phishing policies do not offer this post-delivery click-time verification.

Answer

Anti-malware policy

Answer

Safe Attachments policy

Answer

Anti-phishing policy

Question 3

A company wants to implement just-in-time (JIT) privileged access for the Global Administrator role in Microsoft Entra ID. Users must request activation and provide a business justification. The request must be approved by a separate group of approvers, and the role activation should expire after 4 hours. Which Microsoft Entra feature should the administrator configure?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access by allowing users to activate roles like Global Administrator with a business justification, requiring approval from a designated group of approvers, and setting a configurable activation duration (e.g., 4 hours). This directly matches the company's requirements for time-bound, approved role activation.

Answer

Identity Protection

Answer

Conditional Access

Answer

Access Reviews

Question 4

A company wants to reduce help desk calls by allowing users to reset their own passwords securely. Users should be able to reset their passwords using a mobile phone number or email as verification. Which Microsoft Entra ID feature should be enabled?

Accepted Answer

Self-Service Password Reset (SSPR). Self-Service Password Reset (SSPR) is the Microsoft Entra ID feature specifically designed to allow users to reset their own passwords without help desk intervention. It supports verification methods such as mobile phone number (via SMS or phone call) and email, meeting the company's requirement for secure, user-driven password resets.

Answer

Conditional Access

Answer

Password Protection

Answer

Identity Protection

Question 5

Your organization is deploying Microsoft 365 and needs to ensure that all new users are automatically assigned a Microsoft 365 Business Basic license. You want to use a group-based licensing strategy with an Azure AD security group. What should you do first?

Accepted Answer

Create a new Azure AD security group and assign the license to the group.. Group-based licensing in Microsoft Entra ID requires you to first create a security group (which can be cloud-only or synced) and then assign the Microsoft 365 Business Basic license directly to that group. Once the license is assigned to the group, all members automatically receive the license, including new users added to the group. This approach centralizes license management and ensures automatic assignment without manual intervention.

Answer

Configure directory synchronization and create the group in on-premises Active Directory.

Answer

Create a dynamic Azure AD group with a rule for user attributes and enable self-service group management.

Answer

Assign the license directly to each user via the Microsoft 365 admin center.

Question 6

You need to allow external users from a specific partner organization to access a SharePoint Online site using their own Microsoft Entra ID credentials. Which feature should you configure?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is the correct feature because it allows you to invite external users from a partner organization to access your SharePoint Online site using their own Microsoft Entra ID (or other identity provider) credentials. B2B collaboration uses cross-tenant trust to authenticate the external user against their home tenant, enabling seamless access without creating local accounts.

Answer

Direct Federation

Answer

Self-service password reset

Answer

Microsoft Entra B2C

Question 7

Your organization has a Microsoft 365 tenant with 10,000 users. You are configuring Microsoft Entra ID Identity Protection to detect risky sign-ins. You need to ensure that when a sign-in risk level of 'High' is detected, the user is blocked from signing in and an administrator is notified. What should you configure?

Accepted Answer

Create a Conditional Access policy with 'Sign-in risk' condition set to 'High' and 'Block access', and configure alert notifications in Identity Protection. It combines a Conditional Access policy that blocks access when the sign-in risk level is 'High' with an alert notification configured in Identity Protection. The Conditional Access policy enforces the block at the authentication level, while the Identity Protection alert ensures administrators are notified of the high-risk sign-in event. This directly meets the requirement to both block the user and notify an admin.

Answer

Create a user risk policy in Identity Protection to block high-risk users

Answer

Create an MFA registration policy in Identity Protection

Answer

Enable Security defaults and configure notifications

Question 8

An organization has a legal requirement to preserve certain contracts as immutable records. Once a contract is declared as a record, it must not be editable or deletable by users, including administrators. Which Microsoft Purview solution should be configured?

Accepted Answer

Records Management. Records Management in Microsoft Purview is designed to declare items as immutable records, locking them against editing or deletion by any user, including administrators. This satisfies the legal requirement for preserving contracts as unchangeable records by applying retention labels that enforce strict regulatory compliance.

Answer

Data Loss Prevention

Answer

eDiscovery (Premium)

Answer

Communication Compliance

Question 9

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You plan to use Microsoft Entra Connect Sync to synchronize user accounts. The security team requires that all cloud-only users must be blocked from syncing to on-premises AD. What should you do to meet this requirement?

Accepted Answer

Configure attribute mapping to filter out cloud-only users from writeback. Configuring attribute mapping to filter out cloud-only users from writeback directly prevents those users from being written back to on-premises Active Directory. In Microsoft Entra Connect Sync, attribute mapping rules can include scoping filters that exclude objects based on specific attributes, such as a custom attribute or the cloud-only user indicator. This ensures that only synchronized users are written back, meeting the security requirement without affecting other sync operations.

Answer

Use the cloudFilter attribute to mark cloud-only users as false

Answer

Disable directory writeback in Microsoft Entra Connect Sync

Answer

Configure Selective Password Hash Sync to exclude cloud-only users

Question 10

Your organization uses Microsoft Defender for Endpoint. You need to ensure that when a device is onboarded, it automatically receives all current threat intelligence signatures. What should you verify is configured?

Accepted Answer

Cloud-delivered protection is enabled in the Microsoft 365 Defender portal.. Cloud-delivered protection in the Microsoft 365 Defender portal ensures that devices receive the latest threat intelligence signatures in near real-time. When enabled, Defender for Endpoint uses the Microsoft Intelligent Security Graph to push updated signatures and machine learning models to onboarded devices automatically, without relying on manual update cycles.

Answer

The device is configured to receive updates from Microsoft Update.

Answer

Network protection is enabled in the attack surface reduction rules.

Answer

Sample submission is enabled in the advanced features.

Question 11

Your organization plans to use Microsoft Entra ID as the identity provider for a third-party SaaS application that supports SAML 2.0. You need to configure single sign-on (SSO) for the application. What should you create in Microsoft Entra ID?

Accepted Answer

An enterprise application with SAML-based sign-on. To configure SSO for a third-party SaaS application that supports SAML 2.0, you must create an enterprise application in Microsoft Entra ID and configure it with SAML-based sign-on. Enterprise applications are designed for integrating third-party applications, and SAML-based sign-on allows Entra ID to act as the identity provider, exchanging SAML assertions for authentication.

Answer

An Application Proxy connector group

Answer

A service principal for Microsoft Graph

Answer

An app registration with OpenID Connect

Question 12

A compliance officer wants to automatically apply a retention label to documents that contain SWIFT codes (financial identifiers) when uploaded to SharePoint Online. Which two Microsoft Purview features are required for this configuration? (Choose two.)

Accepted Answer

Trainable classifier. A trainable classifier is required to identify content containing SWIFT codes based on pattern recognition and machine learning. Option C is correct because an auto-apply retention label policy is the mechanism that automatically assigns the retention label to documents when the classifier detects SWIFT codes in SharePoint Online.

Answer

Sensitivity label

Answer

Data Loss Prevention (DLP) policy

Question 13

An administrator has created a new user account in Microsoft Entra ID. To ensure the user has a mailbox in Exchange Online, what is the next step?

Accepted Answer

Assign an Exchange Online license to the user. In Microsoft 365, a user must be assigned an Exchange Online license (part of an E3, E5, or standalone plan) before a mailbox is automatically provisioned in Exchange Online. Without a license, the user object exists in Entra ID but has no mailbox; the license assignment triggers the mailbox creation process within 24 hours.

Answer

Create an Exchange mailbox manually

Answer

Run the Microsoft 365 Setup wizard

Answer

Configure DNS records for the domain

Question 14

A compliance officer needs to automatically classify documents in SharePoint Online that contain credit card numbers. The classification should apply a label that restricts access and adds a header. Which two Microsoft Purview features must be configured? (Choose two.)

Accepted Answer

Sensitivity labels. Sensitivity labels are correct because they are the Microsoft Purview feature that applies classification markings (such as headers and footers) and encryption or access restrictions to documents. For this scenario, a sensitivity label must be configured to enforce the required header and access restrictions on content containing credit card numbers.

Answer

Retention labels

Answer

Data Loss Prevention (DLP) policies

Question 15

Your organization has a Microsoft 365 E5 subscription. You want to enable Microsoft Defender for Office 365 to protect against malicious attachments in email. Which policy should you configure?

Accepted Answer

Safe Attachments policy. Safe Attachments policy is the correct choice because Microsoft Defender for Office 365's Safe Attachments feature specifically protects against malicious attachments in email by detonating them in a virtual sandbox environment before delivery. This policy allows you to configure actions for detected malware, such as blocking, replacing, or dynamically delivering attachments based on threat analysis.

Answer

Anti-phishing policy

Answer

Anti-malware policy

Answer

Safe Links policy