MS-102 Practice Test 2 — 10 Questions

Question 1

A company uses Azure AD Privileged Identity Management (PIM) to manage role activations. They have an Azure AD Premium P2 license. The security team wants to require that any activation of the Exchange Administrator role must be approved by a specific group named 'Exchange Approvers'. Additionally, activations must require a ticket number and expire after 6 hours. Which PIM configuration should the administrator modify?

Accepted Answer

Configure the 'Role settings' for the Exchange Administrator role to require approval and set the approvers group. Option A is correct because in Azure AD PIM, the 'Role settings' for a specific role (like Exchange Administrator) allow you to configure activation requirements, including requiring approval, specifying approvers (such as the 'Exchange Approvers' group), requiring a ticket number, and setting a maximum activation duration (e.g., 6 hours). This directly meets all the security team's requirements.

Answer

Add the Exchange Administrator role to the 'Exchange Approvers' group's eligible assignments

Answer

Create a PIM alert for activations without a ticket number and set a 6-hour alert threshold

Answer

Define an access review for the Exchange Administrator role with a 6-hour review duration

Question 2

A company has just purchased Microsoft 365 E3 licenses. They want to configure the default mailbox storage limit for all new users. Which setting should they modify?

Accepted Answer

Exchange Online PowerShell: Set-OrganizationConfig -DefaultMailboxSize. Option C is correct because the default mailbox storage limit for all new users in Exchange Online is configured via the Set-OrganizationConfig cmdlet with the -DefaultMailboxSize parameter. This setting applies to mailboxes created after the change, overriding the default 50 GB limit for Microsoft 365 E3 licenses. The Exchange admin center and Microsoft 365 admin center do not expose this specific default quota setting for new mailboxes.

Answer

Exchange admin center -> recipients -> mailboxes -> default mailbox quota

Answer

Microsoft 365 admin center -> Users -> Active users -> default storage limit

Answer

Microsoft 365 admin center -> Org settings -> Mailbox storage

Question 3

A company uses Microsoft Entra ID P2 licenses and wants to block all authentication attempts from an internal legacy application that uses POP3 and SMTP protocols. The application cannot be updated and must be blocked from accessing Exchange Online. Which Conditional Access policy setting should the administrator configure?

Accepted Answer

Under 'Conditions' > 'Client apps', configure to block 'Exchange ActiveSync clients and other clients'. Option B is correct because the legacy application uses POP3 and SMTP, which are non-modern authentication protocols. In Conditional Access, the 'Client apps' condition includes a setting to block 'Exchange ActiveSync clients and other clients', which specifically targets legacy authentication protocols like POP3, SMTP, and IMAP. This allows the administrator to block all authentication attempts from such clients without affecting modern authentication flows.

Answer

Under 'Grant', select 'Block access'

Answer

Under 'Conditions' > 'Device platforms', select 'Android' and 'iOS' and block them

Answer

Under 'Conditions' > 'Locations', select 'All trusted locations' and block

Question 4

A company is planning to migrate from on-premises Exchange to Exchange Online and needs to ensure that mail flow can coexist between the two environments during the transition. Which tool should the administrator use to configure this hybrid deployment?

Accepted Answer

Exchange Hybrid Configuration Wizard. The Exchange Hybrid Configuration Wizard (HCW) is the correct tool because it automates the configuration of coexistence features between on-premises Exchange and Exchange Online, including mail flow routing, free/busy sharing, and OAuth authentication. It generates the necessary connectors and settings to support a hybrid deployment, ensuring seamless mail flow during migration.

Answer

Azure AD Connect

Answer

Microsoft 365 Admin Center

Answer

Exchange Admin Center

Question 5

A company uses Microsoft Entra ID P2 licenses. The security team wants to require multi-factor authentication (MFA) for all users when accessing any cloud application from networks that are not trusted corporate locations. A group named 'BreakGlass' must be excluded from MFA requirements. Additionally, the company wants to block legacy authentication protocols. Which approach should the administrator use?

Accepted Answer

Create one Conditional Access policy for MFA (targeting all users, excluding BreakGlass, with location condition) and another policy to block legacy authentication (targeting all users, with client apps condition). Option A is correct because it separates the MFA requirement and legacy authentication block into two distinct Conditional Access policies, which is the recommended approach for granular control. The MFA policy targets all users except the BreakGlass group and uses the location condition to require MFA only from untrusted networks. The second policy blocks legacy authentication by targeting all users with the client apps condition set to 'Exchange ActiveSync clients' and 'Other clients', effectively preventing protocols like POP3, IMAP, and SMTP from bypassing modern authentication.

Answer

Create a single Conditional Access policy that grants access only if MFA is performed and block legacy client apps in the same policy

Answer

Enable Security defaults in Entra ID

Answer

Use baseline Conditional Access policies

Question 6

A company uses Microsoft Entra ID Governance to automate the lifecycle of user access. They want to automatically remove a user's group membership for a critical application 30 days after the user's employment end date is captured from the HR system. Which feature should be configured to meet this requirement?

Accepted Answer

Lifecycle Workflows. Lifecycle Workflows (LCW) in Microsoft Entra ID Governance are specifically designed to automate joiner, mover, and leaver processes triggered by HR data. A 'leaver' workflow can be configured to remove group memberships a defined number of days after the employee's employment end date is captured from the HR system, meeting the 30-day requirement precisely.

Answer

Access Reviews

Answer

Entitlement management

Answer

Privileged Identity Management

Question 7

A company uses Microsoft Entra ID P2 licenses. A security administrator needs to grant a user temporary elevation to the Global Administrator role for a specific task. The elevation should require approval from a designated group and be time-limited. Which Microsoft Entra feature should be configured?

Accepted Answer

Privileged Identity Management. Privileged Identity Management (PIM) in Microsoft Entra ID P2 provides just-in-time (JIT) privileged access with time-bound activation, approval workflows, and audit logging. This directly meets the requirement for temporary elevation to Global Administrator with approval from a designated group and a time limit.

Answer

Conditional Access

Answer

Identity Protection

Answer

Access Reviews

Question 8

A company invites external partners as B2B guest users in Microsoft Entra ID. The partners' home tenants do not support MFA. The company wants to require MFA when guests access an internal application. What should the company configure?

Accepted Answer

Configure a Conditional Access policy that targets all guest users, require MFA, and enable MFA registration for guests in the resource tenant.. Option A is correct because when guest users' home tenants do not support MFA, the resource tenant must enforce MFA directly. A Conditional Access policy targeting all guest users with 'Require MFA' grant control, combined with enabling MFA registration for guests in the resource tenant, allows guests to register and use MFA methods (e.g., Microsoft Authenticator) within the resource tenant. This ensures MFA is enforced regardless of the home tenant's capabilities.

Answer

Ask the partners to configure MFA in their home tenant, then trust their MFA claims.

Answer

Use a Per-User MFA policy for guest users, but guests cannot register for MFA in the resource tenant.

Answer

Create a Conditional Access policy requiring MFA for all external users, but exclude guests from known networks.

Question 9

A company uses Microsoft Entra ID with password hash synchronization. The security team wants to prevent users from setting passwords that include their username or common terms from a custom dictionary (e.g., company name, product names). Which feature should be configured?

Accepted Answer

Configure a custom banned passwords list in Microsoft Entra ID Password Protection.. Option B is correct because Microsoft Entra ID Password Protection allows administrators to enforce custom banned password lists that prevent users from including specific terms (e.g., company name, product names) or their username in passwords. This feature works with password hash synchronization to block weak passwords at the cloud level, directly addressing the security team's requirement.

Answer

Enable Azure AD Identity Protection with user risk policies.

Answer

Set a fine-grained password policy in on-premises Active Directory and sync it to Azure AD.

Answer

Enable MFA registration campaign to force users to register for MFA.

Question 10

A security administrator needs to block users from running portable executable files (e.g., .exe, .scr) that were downloaded from the internet on Windows devices. Which Attack Surface Reduction (ASR) rule should the administrator enable to meet this requirement?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion. Option A is correct because the ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) specifically targets executable files (e.g., .exe, .scr) that have been downloaded from the internet by checking their Mark-of-the-Web (MoTW) attribute. When enabled, this rule prevents execution of such files unless they meet criteria like high prevalence, sufficient age, or inclusion in a trusted list, directly addressing the requirement to block internet-downloaded portable executables.

Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Answer

Block Adobe Reader from creating child processes

Answer

Block persistence through WMI event subscription