MS-102 Practice Exam 2 — 20 Questions

Question 1

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that detects when a user signs in from an unknown IP address and then downloads a large number of files. Which THREE components should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Scope (users and groups). The policy must be scoped to specific users or groups to ensure that the anomaly detection rule (unknown IP followed by mass download) applies only to the intended set of accounts. Without scoping, the policy would evaluate all users, which may generate excessive noise or miss targeted monitoring. In Microsoft Defender for Cloud Apps, the Scope (users and groups) setting is a required component when creating an anomaly detection policy to define which identities are monitored.

Answer

IP address range category

Answer

Session policy

Question 2

Your organization is planning to migrate from on-premises Exchange to Exchange Online. You need to choose a migration strategy. Which TWO statements about migration methods are correct?

Accepted Answer

A minimal hybrid deployment allows you to manage mailboxes in both on-premises and Exchange Online.. A minimal hybrid deployment uses Microsoft Entra Connect to synchronize on-premises Active Directory with Microsoft Entra ID, enabling centralized management of mailboxes across both environments. This allows administrators to manage on-premises and Exchange Online mailboxes from a single Exchange admin center, making option B correct.

Answer

A hybrid migration requires that you do not synchronize on-premises Active Directory with Microsoft Entra ID.

Answer

A staged migration can be used to migrate mailboxes from Exchange 2019 to Exchange Online.

Answer

An IMAP migration migrates email, contacts, and calendar data.

Question 3

A company plans to enable Self-Service Password Reset (SSPR) for all users. The administrator needs to ensure that users are required to register at least two authentication methods before they can use SSPR. Which configuration setting should the administrator modify?

Accepted Answer

Set the 'Number of methods required to reset' to 2 in the SSPR authentication methods settings.. The 'Number of methods required to reset' setting directly controls how many authentication methods a user must provide during the SSPR reset process. By setting this value to 2, the administrator ensures that users must register at least two methods (e.g., phone and email) before they can reset their password, as SSPR requires the registered methods to match the reset requirement.

Answer

Enable combined registration for SSPR and Microsoft Entra ID Multi-Factor Authentication.

Answer

Configure a Conditional Access policy requiring MFA registration for SSPR.

Answer

Set the 'Number of questions required to register' to 2 in the security questions settings.

Question 4

An organization wants to delegate user creation to help desk staff without granting global admin rights. Which role should be assigned?

Accepted Answer

User Administrator. The User Administrator role is the correct choice because it grants the specific permissions needed to create and manage users and groups, including resetting passwords, without the broad privileges of Global Administrator. This role aligns with the principle of least privilege for help desk staff who need to perform user creation tasks.

Answer

Global Administrator

Answer

Helpdesk Administrator

Answer

License Administrator

Question 5

You are a security administrator for a company that uses Microsoft Defender XDR. You need to integrate Microsoft Defender XDR with Microsoft Sentinel to create a unified incident view. You want to ensure that incidents from Defender XDR are automatically created in Sentinel. What should you do?

Accepted Answer

Enable the Microsoft Defender XDR connector in Microsoft Sentinel and turn on incident creation. Enabling the Microsoft Defender XDR connector in Microsoft Sentinel and turning on incident creation is the correct method to ensure incidents from Defender XDR are automatically created in Sentinel. This provides a unified incident view and enables Sentinel's SOAR capabilities on Defender XDR incidents.

Answer

In Microsoft Defender XDR settings, enable the Microsoft Sentinel integration and select the Sentinel workspace

Answer

Configure a custom detection rule in Defender XDR that calls the Microsoft Sentinel API

Answer

Install the Microsoft Sentinel solution for Microsoft Defender XDR from the Content Hub

Question 6

Your organization uses Microsoft Defender for Endpoint. You need to configure advanced hunting to query device information. Which TWO tables contain device-related data?

Accepted Answer

DeviceInfo. DeviceInfo is correct because it is the primary table in Microsoft Defender for Endpoint advanced hunting that stores comprehensive device metadata, including OS version, device name, and sensor health. This table is essential for querying device-related information such as device inventory, onboarding status, and configuration details.

Answer

AlertInfo

Answer

EmailEvents

Answer

IdentityLogonEvents

Question 7

Which THREE features are part of Microsoft Defender XDR? (Select THREE.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender XDR is a unified security solution that integrates signals from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and others. The correct answers are B, C, and E. Option A (Microsoft Purview) is a data governance and compliance solution, not part of Defender XDR. Option D (Microsoft Sentinel) is a separate cloud-native SIEM and SOAR solution.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Question 8

Your organization wants to use Microsoft Defender for Office 365 to protect against malicious links and attachments in email. Which Defender plan is required?

Accepted Answer

Microsoft Defender for Office 365 Plan 1.. Microsoft Defender for Office 365 Plan 1 includes Safe Links and Safe Attachments, which are the specific features required to protect against malicious links and attachments in email. These features scan URLs and attachments in real time to block malicious content before it reaches users.

Answer

Exchange Online Protection.

Answer

Microsoft Defender for Endpoint.

Answer

Microsoft Defender for Office 365 Plan 2.

Question 9

Which THREE are features of Microsoft Entra ID Governance? (Choose three.)

Accepted Answer

Entitlement management. Entitlement management is a core feature of Microsoft Entra ID Governance that enables organizations to manage the lifecycle of access for internal and external users through access packages, catalogs, and policies. It automates access requests, approvals, and assignments, ensuring users have the right access to resources like groups, apps, and SharePoint sites.

Answer

Password protection

Answer

Conditional access policies

Question 10

Which THREE conditions can be used in a dynamic group rule for a device?

Accepted Answer

deviceModel. `deviceModel` is a valid attribute that can be used in a dynamic group rule for devices in Microsoft Entra ID (formerly Azure AD). Dynamic group rules for devices support attributes such as `deviceModel`, `deviceCategory`, and `deviceOSVersion` to automatically include or exclude devices based on their hardware or software characteristics.

Answer

lastLogonTimestamp

Answer

passwordLastSet

Question 11

A security analyst needs to create a custom detection rule in Microsoft 365 Defender that triggers when a suspicious PowerShell process (e.g., using -EncodedCommand) is detected on a device, and within 5 minutes, an outbound network connection to a known malicious IP address occurs. Which two advanced hunting tables must be joined?

Accepted Answer

DeviceProcessEvents and DeviceNetworkEvents. The custom detection rule requires correlating a suspicious PowerShell process event with a subsequent outbound network connection to a malicious IP within a 5-minute window. DeviceProcessEvents contains process creation data (e.g., command line, process name) for detecting encoded PowerShell commands, while DeviceNetworkEvents logs network connections (destination IP, port, protocol). Joining these two tables on DeviceId and a time range allows the rule to identify the sequence of a process event followed by a network event from the same device.

Answer

DeviceEvents and DeviceFileCertificateInfo

Answer

IdentityLogonEvents and CloudAppEvents

Answer

EmailEvents and EmailAttachmentInfo

Question 12

Match each PowerShell command to its function in Microsoft 365.

Accepted Answer

Connect-ExchangeOnline: Connects to Exchange Online PowerShell. Correct matches: Connect-ExchangeOnline for Exchange Online, Get-Mailbox for mailbox properties, Get-MgUser for Microsoft Entra ID users. Common confusion: mixing Exchange and Microsoft Entra ID commands.

Answer

Connect-ExchangeOnline: Connects to Azure AD PowerShell

Answer

Get-Mailbox: Retrieves user objects from Azure AD

Question 13

An organization wants to configure Self-Service Password Reset (SSPR) for all users. The administrator must ensure that users register two authentication methods: one from the mobile app category (e.g., notification or code) and one from the phone call category (e.g., office phone or mobile phone). Which combination of methods should the administrator select in the SSPR settings?

Accepted Answer

Mobile app notification and Office phone. The SSPR policy requires users to register two authentication methods from distinct categories. The mobile app notification (from the mobile app category) and office phone (from the phone call category) satisfy this requirement. This combination ensures that users have one method from the mobile app category and one from the phone call category, as specified in the question.

Answer

Mobile app code and Security questions

Answer

Email and Mobile phone

Answer

Security questions and Office phone

Question 14

You are a security administrator for a company that uses Microsoft Defender XDR. You need to investigate an incident that involves multiple alerts across different workloads. Which feature in Microsoft Defender XDR should you use to view the full attack story and related entities?

Accepted Answer

Incident details page. The incident details page in Microsoft Defender XDR is designed to provide a comprehensive view of an incident, including all related alerts, entities, and the attack story. This allows security administrators to understand the full scope and progression of the attack.

Answer

Advanced hunting

Answer

Threat analytics

Answer

Incident queue

Question 15

A compliance officer needs to automatically identify and label content that is conceptually similar to existing sensitive documents, such as internal strategy memos or proprietary technical specifications, without relying on explicit keywords or recognized sensitive information types. Which Microsoft Purview solution should the officer use to achieve this?

Accepted Answer

trainable classifier. A trainable classifier uses machine learning to identify content based on patterns and context learned from sample documents, making it ideal for recognizing conceptually similar content without relying on explicit keywords or predefined sensitive information types. This allows the compliance officer to automatically label internal strategy memos or proprietary technical specifications that share conceptual similarity with existing sensitive documents.

Answer

sensitive information type

Answer

An auto-labeling policy with a retention label

Answer

Data Loss Prevention (DLP) policy that blocks sharing

Question 16

A compliance officer needs to automatically apply a retention label to all documents in SharePoint Online that contain the exact phrase 'Contract'. The label must retain the documents for 10 years. Which Microsoft Purview feature should the officer configure?

Accepted Answer

An auto-apply retention label using a content query (KQL). An auto-apply retention label using a content query (KQL) allows you to define a specific keyword or phrase (e.g., 'Contract') to automatically label documents in SharePoint Online that contain that exact text. This meets the requirement to retain documents for 10 years by applying the label based on content matching, without needing a pre-trained classifier.

Answer

retention policy applied to the entire site

Answer

Data Loss Prevention (DLP) policy

Answer

An auto-apply retention label using a trainable classifier

Question 17

A compliance officer needs to prevent users from sending emails that contain sensitive information, such as social security numbers, to external recipients. If a user attempts to send such an email, the action should be blocked and a policy tip should be displayed to the user. Which Microsoft Purview solution should the officer configure?

Accepted Answer

Data Loss Prevention (DLP) policy. A Data Loss Prevention (DLP) policy in Microsoft Purview is designed to inspect email content for sensitive information (e.g., social security numbers) and can block the message while displaying a policy tip to the user. This matches the requirement exactly, as DLP policies enforce actions on data in transit (email) with user notifications.

Answer

sensitivity label with encryption

Answer

Information Rights Management (IRM)

Answer

retention label with deletion

Question 18

A company recently added the custom domain 'contoso.com' to their Microsoft 365 tenant. Users report that they cannot receive external email sent to their new domain addresses. The administrator confirmed that the domain status shows 'Active' in the Microsoft 365 admin center. What is the most likely cause of this issue?

Accepted Answer

The MX record for the domain is missing or points to an incorrect mail server.. The domain status 'Active' in the Microsoft 365 admin center indicates that the domain has been successfully verified and added to the tenant. However, for external email to be delivered to users at that domain, the public MX record in DNS must point to Microsoft 365's mail servers (e.g., contoso-com.mail.protection.outlook.com). If the MX record is missing or points to an incorrect server, external senders cannot route email to the tenant, even though the domain is verified and active.

Answer

The domain was not verified with a TXT record.

Answer

The SPF record for the domain is missing or incorrectly configured.

Answer

The custom domain was not added to the user's primary email address.

Question 19

A company with 200 on-premises Exchange mailboxes plans to migrate to Exchange Online. They want to use a Microsoft-provided tool that supports granular control over mailbox migrations, allows batch migrations, and provides detailed reporting. Which migration method should the administrator choose?

Accepted Answer

Exchange Admin Center (EAC) migration dashboard. The Exchange Admin Center (EAC) migration dashboard is the correct choice because it is a Microsoft-provided tool that supports granular control over mailbox migrations (e.g., selecting specific users, setting migration endpoints, and configuring throttling), allows batch migrations with the ability to start, stop, and monitor multiple batches simultaneously, and provides detailed reporting on migration status, errors, and sync progress. This method is specifically designed for migrating on-premises Exchange mailboxes to Exchange Online in a controlled, staged manner, making it ideal for the scenario described.

Answer

Azure AD Connect

Answer

Third-party migration tool (e.g., BitTitan MigrationWiz)

Answer

IMAP migration

Question 20

A company plans to enable Self-Service Password Reset (SSPR) for all users. The administrator must ensure that users are required to register at least two authentication methods: one from the 'mobile app' category and one from the 'phone call' category. Which combination of methods should the administrator select in the SSPR registration settings?

Accepted Answer

Mobile app notification and office phone. The SSPR registration policy requires users to select at least two distinct authentication methods from the allowed list. By choosing 'Mobile app notification' (from the mobile app category) and 'Office phone' (from the phone call category), the administrator satisfies the requirement of one method from each specified category. The 'Office phone' option is classified under the 'phone call' category in Microsoft Entra ID SSPR settings.

Answer

Mobile app notification and mobile app code

Answer

Office phone and mobile phone

Answer

Mobile phone and email