MS-102 Practice Exam 1 — 20 Questions

Question 1

Which THREE steps are required to enable group-based licensing?

Accepted Answer

Add members to the group. Group-based licensing in Azure AD requires that you add members to the security group that will have the license assigned. Without members, the license assignment has no effect, as the license is applied to all users in the group. This step ensures that the intended users receive the license automatically based on group membership.

Answer

Configure Azure AD Connect

Answer

Ensure group is mail-enabled

Question 2

Your organization has Microsoft Defender for Cloud Apps (MCAS) deployed. You need to create a policy that automatically blocks downloads of files classified as 'Highly Confidential' from SharePoint Online to unmanaged devices. Which policy type should you use?

Accepted Answer

Session policy. A session policy in Microsoft Defender for Cloud Apps (MCAS) is the correct choice because it enables real-time monitoring and control of user activities in cloud apps, such as blocking downloads based on file sensitivity labels. This policy type uses reverse proxy architecture to inspect and intervene in user sessions, allowing you to block downloads of 'Highly Confidential' files from SharePoint Online to unmanaged devices.

Answer

Access policy

Answer

Activity policy

Answer

App discovery policy

Question 3

Your Microsoft 365 tenant has 50,000 users. You are planning to migrate mailboxes from on-premises Exchange Server 2019 to Exchange Online using a full hybrid configuration. During the migration, you must ensure that free/busy information is synchronized between on-premises and Exchange Online. Which component is required for free/busy synchronization in a hybrid deployment?

Accepted Answer

Exchange Hybrid Server (or Hybrid Agent). In a full hybrid configuration, free/busy synchronization between on-premises Exchange and Exchange Online is handled by the Exchange Hybrid Server (or the newer Hybrid Agent). This component acts as a bridge, using the Exchange Web Services (EWS) and Autodiscover service to securely relay free/busy data between the two organizations. Without it, the Availability service cannot query the remote forest for calendar information.

Answer

Azure AD Connect

Answer

Exchange Online connector (Outbound to on-premises)

Answer

Hybrid Configuration Wizard

Question 4

A company uses Microsoft Entra ID P1 licenses. They want to enforce multi-factor authentication (MFA) for all users accessing a critical cloud application. However, they have a group of service accounts that cannot perform MFA and must be excluded. What is the recommended approach?

Accepted Answer

Create a Conditional Access policy that targets the application, requires MFA, and excludes the service account group. Conditional Access policies allow granular control by targeting specific cloud applications and requiring MFA, while excluding groups like service accounts that cannot perform MFA. This approach is the recommended method because it avoids the limitations of per-user MFA (which is deprecated) and Security Defaults (which cannot exclude specific accounts).

Answer

Enable per-user MFA for all users, then disable it for each service account

Answer

Enable Security Defaults

Answer

Use Identity Protection risk policies

Question 5

A company plans to enable Self-Service Password Reset (SSPR) for all users. The administrator needs to ensure that users are required to register at least two authentication methods before they can use SSPR. Which configuration setting should the administrator modify?

Accepted Answer

Set the 'Number of methods required to reset' to 2 in the SSPR authentication methods settings.. The 'Number of methods required to reset' setting directly controls how many authentication methods a user must provide during the SSPR reset process. By setting this value to 2, the administrator ensures that users must register at least two methods (e.g., phone and email) before they can reset their password, as SSPR requires the registered methods to match the reset requirement.

Answer

Enable combined registration for SSPR and Microsoft Entra ID Multi-Factor Authentication.

Answer

Configure a Conditional Access policy requiring MFA registration for SSPR.

Answer

Set the 'Number of questions required to register' to 2 in the security questions settings.

Question 6

You are reviewing a Conditional Access policy in Microsoft Entra ID. The exhibit shows the policy configuration. You need to allow users to access Office 365 applications from personal devices that are not enrolled in Microsoft Intune. However, the policy currently blocks access because it requires a compliant device. Users are prompted for MFA but then blocked due to device compliance. What should you modify in the policy?

Accepted Answer

Remove "compliantDevice" from the builtInControls grant control list.. The policy currently uses the 'Require compliant device' grant control, which blocks access from devices not enrolled in Intune or not meeting compliance policies. Removing 'compliantDevice' from the builtInControls list allows access from personal, non-enrolled devices while still enforcing MFA. This directly resolves the scenario where users pass MFA but are blocked by device compliance.

Answer

Add a session control for sign-in frequency.

Answer

Remove the cloudAppSecurity session control.

Answer

Change cloudAppSecurityType to "blockDownloads".

Question 7

A company has a Microsoft 365 tenant with the domain contoso.com. They acquire a subsidiary with the domain fabrikam.com and want to add it as an additional domain to the same tenant. The domain is already purchased and DNS management is available. What is the first step the administrator should take in the Microsoft 365 admin center?

Accepted Answer

Add the domain and verify ownership by adding a TXT record. To add an existing domain like fabrikam.com to a Microsoft 365 tenant, the first step is to add the domain in the Microsoft 365 admin center and then verify ownership by adding a TXT record to the domain's DNS zone. This verification proves the administrator controls the domain, which is a prerequisite for using it with Microsoft 365 services such as Exchange Online or SharePoint.

Answer

Create a new tenant for fabrikam.com

Answer

Set up email forwarding from contoso.com to fabrikam.com

Answer

Convert fabrikam.com to a federated domain

Question 8

A compliance officer needs to automatically identify and label content that is conceptually similar to existing sensitive documents, such as internal strategy memos or proprietary technical specifications, without relying on explicit keywords or recognized sensitive information types. Which Microsoft Purview solution should the officer use to achieve this?

Accepted Answer

trainable classifier. A trainable classifier uses machine learning to identify content based on patterns and context learned from sample documents, making it ideal for recognizing conceptually similar content without relying on explicit keywords or predefined sensitive information types. This allows the compliance officer to automatically label internal strategy memos or proprietary technical specifications that share conceptual similarity with existing sensitive documents.

Answer

sensitive information type

Answer

An auto-labeling policy with a retention label

Answer

Data Loss Prevention (DLP) policy that blocks sharing

Question 9

A compliance officer needs to automatically apply a retention label to all documents in SharePoint Online that contain the exact phrase 'Contract'. The label must retain the documents for 10 years. Which Microsoft Purview feature should the officer configure?

Accepted Answer

An auto-apply retention label using a content query (KQL). An auto-apply retention label using a content query (KQL) allows you to define a specific keyword or phrase (e.g., 'Contract') to automatically label documents in SharePoint Online that contain that exact text. This meets the requirement to retain documents for 10 years by applying the label based on content matching, without needing a pre-trained classifier.

Answer

retention policy applied to the entire site

Answer

Data Loss Prevention (DLP) policy

Answer

An auto-apply retention label using a trainable classifier

Question 10

A compliance officer needs to prevent users from sending emails that contain sensitive information, such as social security numbers, to external recipients. If a user attempts to send such an email, the action should be blocked and a policy tip should be displayed to the user. Which Microsoft Purview solution should the officer configure?

Accepted Answer

Data Loss Prevention (DLP) policy. A Data Loss Prevention (DLP) policy in Microsoft Purview is designed to inspect email content for sensitive information (e.g., social security numbers) and can block the message while displaying a policy tip to the user. This matches the requirement exactly, as DLP policies enforce actions on data in transit (email) with user notifications.

Answer

sensitivity label with encryption

Answer

Information Rights Management (IRM)

Answer

retention label with deletion

Question 11

A company recently added the custom domain 'contoso.com' to their Microsoft 365 tenant. Users report that they cannot receive external email sent to their new domain addresses. The administrator confirmed that the domain status shows 'Active' in the Microsoft 365 admin center. What is the most likely cause of this issue?

Accepted Answer

The MX record for the domain is missing or points to an incorrect mail server.. The domain status 'Active' in the Microsoft 365 admin center indicates that the domain has been successfully verified and added to the tenant. However, for external email to be delivered to users at that domain, the public MX record in DNS must point to Microsoft 365's mail servers (e.g., contoso-com.mail.protection.outlook.com). If the MX record is missing or points to an incorrect server, external senders cannot route email to the tenant, even though the domain is verified and active.

Answer

The domain was not verified with a TXT record.

Answer

The SPF record for the domain is missing or incorrectly configured.

Answer

The custom domain was not added to the user's primary email address.

Question 12

A company with 200 on-premises Exchange mailboxes plans to migrate to Exchange Online. They want to use a Microsoft-provided tool that supports granular control over mailbox migrations, allows batch migrations, and provides detailed reporting. Which migration method should the administrator choose?

Accepted Answer

Exchange Admin Center (EAC) migration dashboard. The Exchange Admin Center (EAC) migration dashboard is the correct choice because it is a Microsoft-provided tool that supports granular control over mailbox migrations (e.g., selecting specific users, setting migration endpoints, and configuring throttling), allows batch migrations with the ability to start, stop, and monitor multiple batches simultaneously, and provides detailed reporting on migration status, errors, and sync progress. This method is specifically designed for migrating on-premises Exchange mailboxes to Exchange Online in a controlled, staged manner, making it ideal for the scenario described.

Answer

Azure AD Connect

Answer

Third-party migration tool (e.g., BitTitan MigrationWiz)

Answer

IMAP migration

Question 13

A company plans to enable Self-Service Password Reset (SSPR) for all users. The administrator must ensure that users are required to register at least two authentication methods: one from the 'mobile app' category and one from the 'phone call' category. Which combination of methods should the administrator select in the SSPR registration settings?

Accepted Answer

Mobile app notification and office phone. The SSPR registration policy requires users to select at least two distinct authentication methods from the allowed list. By choosing 'Mobile app notification' (from the mobile app category) and 'Office phone' (from the phone call category), the administrator satisfies the requirement of one method from each specified category. The 'Office phone' option is classified under the 'phone call' category in Microsoft Entra ID SSPR settings.

Answer

Mobile app notification and mobile app code

Answer

Office phone and mobile phone

Answer

Mobile phone and email

Question 14

A company wants to automatically assign Microsoft 365 E5 licenses to all users in the Sales department. The department is identified by the department attribute in Microsoft Entra ID. The administrator needs to configure a method where licenses are assigned based on group membership, and the group membership is automatically updated based on user attributes. Which licensing approach should the administrator use?

Accepted Answer

Group-based licensing with a dynamic group that uses the department attribute.. Group-based licensing in Microsoft Entra ID allows automatic license assignment based on group membership, and a dynamic group can automatically update its membership using the department attribute rule (e.g., `user.department -eq "Sales"`). This meets the requirement for both automated license assignment and attribute-driven membership updates without manual intervention.

Answer

Per-user licensing with a PowerShell script.

Answer

Subscription-based licensing via the Microsoft 365 admin center.

Answer

Group-based licensing with an assigned group that must be manually updated.

Question 15

A company uses Microsoft Entra ID P2 licenses. They want to block all authentication attempts from an internal app that uses legacy authentication protocols (POP3, IMAP, SMTP) because these protocols cannot enforce multi-factor authentication. Which Conditional Access policy setting should be used?

Accepted Answer

Block access for apps using legacy authentication. The scenario explicitly requires blocking authentication attempts from an internal app using legacy protocols (POP3, IMAP, SMTP) that cannot enforce multi-factor authentication. The 'Block access for apps using legacy authentication' Conditional Access setting targets client apps that use legacy authentication protocols, effectively preventing any authentication from those apps regardless of user or device compliance.

Answer

Grant access requiring multi-factor authentication

Answer

Require compliant device

Answer

Require approved client app

Question 16

An organization has multiple Microsoft Entra ID tenants and wants to allow partner users to access internal applications using their own corporate credentials. Which feature should be used to enable this?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is the correct feature because it allows partner users to access internal applications using their own corporate credentials (their home tenant identity) without requiring any external accounts or local user management. B2B collaboration uses cross-tenant trust relationships, enabling seamless single sign-on (SSO) via SAML/WS-Fed or OIDC protocols, which aligns with the requirement to use existing partner credentials.

Answer

Microsoft Entra B2C

Answer

Azure AD Connect

Answer

Tenant-to-tenant migration

Question 17

A company uses Azure AD Identity Protection. The security team wants to automatically block users from signing in when the user risk level is 'High'. Which policy should they configure?

Accepted Answer

User risk policy. The User risk policy in Azure AD Identity Protection is specifically designed to automatically block sign-ins when the user risk level is 'High'. This policy evaluates the probability that a user's identity has been compromised based on signals like leaked credentials or anomalous behavior, and can enforce actions such as blocking access or requiring password change. Option C is correct because it directly targets user risk, not sign-in risk or other conditions.

Answer

Conditional Access policy with user risk condition

Answer

Sign-in risk policy

Answer

MFA registration policy

Question 18

A compliance officer needs to automatically retain emails that contain personally identifiable information (PII) for 10 years and then permanently delete them. Which Microsoft Purview feature should be configured?

Accepted Answer

Auto-apply retention labels based on sensitive information types. Auto-apply retention labels based on sensitive information types allow you to automatically classify and retain emails containing PII for a specified period (10 years) and then permanently delete them. This feature uses sensitive information types (e.g., Social Security Number, Credit Card Number) to detect PII and applies a retention label that enforces the retention and deletion actions at the item level, which is required for targeted compliance scenarios.

Answer

Data Lifecycle Management retention policy

Answer

Data classification

Answer

eDiscovery

Question 19

Your organization has a Microsoft 365 E5 tenant with 10,000 users. You need to ensure that when a user is detected as high-risk by Microsoft Entra ID Protection, the user is automatically blocked from accessing sensitive SharePoint sites. The solution should minimize administrative overhead. What should you do?

Accepted Answer

Create a Conditional Access policy targeting high-risk users, apply to SharePoint, and set 'Block access' or 'Use app enforced restrictions'.. A Conditional Access (CA) policy can directly target 'High risk' users (via Microsoft Entra ID Protection risk detection) and apply to SharePoint. By setting the grant control to 'Block access' or 'Use app enforced restrictions', you automatically block or restrict access to sensitive SharePoint sites without manual intervention, minimizing administrative overhead. This integrates natively with Microsoft 365 and requires no additional services or custom scripting.

Answer

Create a session policy in Microsoft Defender for Cloud Apps to block high-risk users from accessing SharePoint.

Answer

Configure a user risk policy in Microsoft Entra ID Protection to block sign-ins for high-risk users.

Answer

Deploy Microsoft Sentinel and create a custom analytics rule to trigger an automated response via Logic App.

Question 20

A company uses Azure AD Connect with password hash synchronization. They want to allow users to reset their on-premises Active Directory passwords from the cloud Self-Service Password Reset (SSPR) portal. Which additional configuration is required in Azure AD Connect?

Accepted Answer

Enable password writeback. Password writeback is the specific feature in Azure AD Connect that enables password changes performed in the cloud (via SSPR) to be written back to the on-premises Active Directory. Without this feature enabled and configured, the SSPR portal can only reset cloud-only passwords, not synchronized on-premises passwords. Therefore, enabling password writeback is the additional configuration required beyond the existing password hash synchronization.

Answer

Enable self-service password reset in Azure AD

Answer

Configure Federation Services (AD FS)

Answer

Install Azure AD Application Proxy