MS-102 Practice Exam 4 — 20 Questions

Question 1

You are investigating an alert in Microsoft Defender XDR that indicates a user clicked a malicious link in an email. You need to gather additional information to determine the scope of the attack. Which three sources should you examine?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Email entity page. To fully investigate a phishing incident, you should examine the alert timeline for related events, the email entity page for email details, and the user entity page for user actions. Device timeline may not be relevant if the user only clicked a link without further action. The incidents page provides a summary but not detailed scope.

Answer

Incidents page

Answer

Device timeline

Question 2

Match each Microsoft 365 service to its primary purpose.

Accepted Answer

Exchange Online: Email hosting and calendaring. The correct matches associate Exchange Online with email and calendaring, SharePoint Online with document management and collaboration, Microsoft Teams with chat and meetings, and OneDrive for Business with personal cloud storage. Common confusions include misassigning Exchange's purpose to OneDrive or OneDrive's purpose to SharePoint.

Answer

OneDrive for Business: Email hosting and calendaring

Answer

SharePoint Online: Personal cloud storage

Question 3

Which THREE features are included in Microsoft Defender for Office 365 Plan 2 but NOT in Plan 1? (Choose three.)

Accepted Answer

Automated Investigation and Response (AIR). Options C, D, and E are correct. Plan 2 includes Automated Investigation and Response (AIR), Threat Explorer, and Attack Simulation Training. Plan 1 includes anti-phishing policies (A) and Safe Links (B), so they are not correct.

Answer

Anti-phishing policies

Answer

Safe Links

Question 4

Which THREE components are required to implement Microsoft Purview Data Lifecycle Management for Microsoft 365? (Choose three.)

Accepted Answer

Retention labels. Options A, B, and E are correct because retention labels, retention policies, and a file plan are core components for Data Lifecycle Management. Option C is incorrect because sensitivity labels are part of Information Protection, not Data Lifecycle Management. Option D is incorrect because DLP is a separate solution.

Answer

Sensitivity labels

Answer

Data loss prevention policies

Question 5

A compliance officer needs to ensure that all outbound emails containing credit card numbers sent to external recipients are automatically encrypted without requiring user intervention. Which Microsoft Purview feature should be configured?

Accepted Answer

Data Loss Prevention (DLP) policy with a rule that encrypts the message when credit card numbers are detected.. A Data Loss Prevention (DLP) policy in Microsoft Purview can be configured with a rule that automatically detects credit card numbers (using a built-in sensitive info type) and applies encryption via Transport Layer Security (TLS) or Information Rights Management (IRM) to outbound emails sent to external recipients. This meets the compliance officer's requirement for automatic encryption without user intervention, as the DLP rule triggers encryption at the transport level in Exchange Online.

Answer

Sensitivity label with auto-labeling based on credit card numbers.

Answer

Retention policy for Exchange Online.

Answer

eDiscovery case for content search.

Question 6

Your organization uses Microsoft Defender for Office 365. You need to ensure that users are warned before opening potentially malicious attachments in Outlook on the web. Which policy setting should you configure?

Accepted Answer

Open in protected view. The 'Open in protected view' policy setting in Microsoft Defender for Office 365 ensures that when a user opens an email attachment in Outlook on the web, the file is opened in a sandboxed, read-only environment that warns the user of potential risks before allowing full interaction. This directly addresses the requirement to warn users before opening potentially malicious attachments, as it triggers a warning banner and restricts editing capabilities until the user explicitly enables editing.

Answer

Attachments in email are blocked

Answer

Attachments are held and scanned

Answer

Dynamic Delivery

Question 7

A security administrator needs to block executable files from running from the %TEMP% folder on Windows devices to prevent common malware execution. Which attack surface reduction (ASR) rule should be enabled?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criteria. The ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criteria' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) specifically targets executables launched from locations commonly used by malware, such as the %TEMP% folder. This rule uses cloud-delivered reputation data to allow only executables that are prevalent, have sufficient age, or are on a trusted list, effectively blocking unknown or suspicious binaries from running in temporary directories.

Answer

Block credential stealing from the Windows local security authority subsystem

Answer

Block all Office applications from creating child processes

Answer

Block JavaScript or VBScript from launching downloaded executable content

Question 8

A security analyst needs to create a custom detection rule in Microsoft Defender XDR that triggers when a device communicates with a new, unclassified IP address flagged by Microsoft threat intelligence as potentially malicious. The rule must run every hour and create an incident if the count of such communications exceeds 10 in a 24-hour window. Which type of rule should the analyst create?

Accepted Answer

custom detection rule using advanced hunting. A custom detection rule using advanced hunting is the correct choice because Microsoft Defender XDR allows you to create custom detection rules based on Kusto Query Language (KQL) queries that run on a scheduled interval (e.g., every hour). This rule can query the `DeviceNetworkEvents` table to identify communications with IP addresses flagged as malicious by Microsoft threat intelligence, aggregate the count over a 24-hour sliding window, and trigger an incident when the threshold of 10 is exceeded. This directly meets the requirement for a scheduled, threshold-based detection within Defender XDR.

Answer

scheduled alert rule in Microsoft Sentinel

Answer

An incident creation rule in Microsoft Defender for Cloud Apps

Answer

custom remediation action rule

Question 9

A new administrator needs to automatically assign Microsoft 365 E5 licenses to all users in the Sales department. The Sales department is identified by the 'department' attribute in Azure AD. Which licensing method should the administrator use to minimize manual effort?

Accepted Answer

Group-based licensing using a dynamic group. Group-based licensing using a dynamic group is the correct method because it automatically assigns Microsoft 365 E5 licenses to all users in the Sales department based on the 'department' attribute in Azure AD. Dynamic groups evaluate membership rules in real time, so when a user's department attribute is set to 'Sales', the license is assigned without manual intervention. This minimizes administrative effort by eliminating the need for per-user or batch operations.

Answer

Manual license assignment per user

Answer

PowerShell script to assign licenses

Answer

Bulk license assignment via CSV file

Question 10

Contoso uses Microsoft Entra ID P1 licenses and has a dedicated corporate office with static public IP addresses. The company wants to require MFA for all users, but exempt users when they connect from the corporate office. Which configuration should the administrator implement?

Accepted Answer

Create a Conditional Access policy that targets all users, grant access requiring MFA, and exclude the corporate office location from the policy.. A Conditional Access policy can target all users, require MFA as a grant control, and exclude the corporate office location (defined by static public IP addresses as a named location). This ensures MFA is enforced for all connections except those originating from the trusted corporate network, aligning with the requirement to exempt users at the office.

Answer

Create a Conditional Access policy that targets all users, grant access requiring MFA, and include the corporate office location as a condition.

Answer

Configure a Per-User MFA policy and add the corporate office IPs to a list of trusted IPs in the MFA settings.

Answer

Create a Conditional Access policy that targets the corporate office location and grant access with MFA for all other locations.

Question 11

A security administrator needs a single console to investigate and respond to a complex incident involving alerts from endpoints, email, and identities. Which Microsoft portal should they use?

Accepted Answer

Microsoft 365 Defender portal. The Microsoft 365 Defender portal (security.microsoft.com) is the correct choice because it provides a unified incident management console that correlates alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. This allows the security administrator to investigate and respond to a complex incident spanning endpoints, email, and identities from a single pane of glass, leveraging automated investigation and response (AIR) capabilities.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Answer

Microsoft 365 compliance center

Question 12

A company uses Microsoft Entra ID P2 licenses. The security team wants to automatically require a password change for users with medium sign-in risk, but only when the sign-in originates from outside the corporate network. Users with high sign-in risk should be blocked entirely. A group of break-glass accounts must be excluded from all policies. Which feature should the administrator implement?

Accepted Answer

Conditional Access policies with sign-in risk and location conditions. Conditional Access policies in Microsoft Entra ID allow combining sign-in risk conditions with location conditions (e.g., 'Not trusted IPs' or 'All trusted locations' set to false) to target only sign-ins from outside the corporate network. The policy can be configured to require a password change for medium risk and block access for high risk, while excluding break-glass accounts via the 'Exclude' tab using a dedicated group.

Answer

Identity Protection risk policies

Answer

Privileged Identity Management (PIM)

Answer

Azure AD Identity Governance

Question 13

A company uses Microsoft Entra ID P2 licenses. The security team wants to automatically block sign-ins for users with high sign-in risk, but only when the sign-in originates from outside the corporate network. For sign-ins from the corporate network, they want to require a password change for medium sign-in risk. A group of emergency access accounts (break-glass) must be excluded from all policies. What should the administrator implement?

Accepted Answer

Two Conditional Access policies: one for external locations that blocks high risk, and one for internal locations that requires password change for medium risk. Both exclude the break-glass group.. Conditional Access policies evaluate conditions like location and sign-in risk separately, and combining both conditions (external vs. internal) with different grant controls (block vs. require password change) in a single policy is not supported. Two separate policies are required: one for external locations with high risk to block, and one for internal locations with medium risk to require password change. Both must exclude the break-glass group to ensure emergency access is never blocked.

Answer

single Conditional Access policy that blocks access for high risk from external locations and requires password change for medium risk from internal locations, excluding the break-glass group.

Answer

An Identity Protection user risk policy that blocks high-risk users and prompts for password change for medium-risk users, configured to exclude the break-glass group.

Answer

Conditional Access policy that requires multi-factor authentication for all users except break-glass, and a separate sign-in risk policy for blocking high risk from external locations.

Question 14

An administrator is managing a Microsoft 365 tenant and needs to delegate the ability to reset user passwords to a group of helpdesk staff. The helpdesk staff should not have any other administrative privileges. Which built-in role should the administrator assign?

Accepted Answer

Password Administrator. The Password Administrator role is the correct choice because it grants the specific ability to reset passwords for non-administrator users and manage service requests, without providing broader administrative privileges like managing users, groups, or licensing. This aligns with the principle of least privilege, ensuring helpdesk staff can perform password resets without accessing other sensitive areas of the tenant.

Answer

Global Administrator

Answer

User Administrator

Answer

Helpdesk Administrator

Question 15

A compliance officer needs to ensure that all documents containing a custom sensitive info type (Employee ID with pattern EMP-####) are automatically labeled with a retention label that retains the documents for 3 years. Which two Microsoft Purview components must be configured? (Choose two.)

Accepted Answer

retention label. A retention label is required to specify the retention period (3 years) for the documents. An auto-labeling policy for retention labels is needed to automatically apply that retention label based on the detection of the custom sensitive info type (Employee ID pattern EMP-####). Together, these two components enable automatic classification and retention without manual user intervention.

Answer

sensitivity label

Answer

data loss prevention (DLP) policy

Question 16

A company must ensure that all outgoing emails containing credit card numbers are blocked from being sent to external recipients. When a user attempts to send such an email, it should be blocked immediately, and the user should see a policy tip explaining the rule. Which Microsoft Purview solution should the administrator configure?

Accepted Answer

Data Loss Prevention (DLP) policy. A Data Loss Prevention (DLP) policy is the correct solution because it is specifically designed to detect sensitive information, such as credit card numbers, in transit (email) and enforce real-time actions like blocking the message and displaying a policy tip to the user. DLP policies in Microsoft Purview can be configured with conditions that match credit card number patterns using built-in sensitive info types, and the action 'Block messages' with a policy tip notification is available for Exchange Online mail flow. This ensures immediate blocking and user notification without requiring any manual labeling or classification.

Answer

Sensitivity labels

Answer

Retention labels

Answer

Communication compliance

Question 17

Your organization uses Microsoft Entra ID and has strict security requirements. You need to implement a Zero Trust security model. Which THREE of the following are foundational principles of Zero Trust that should be implemented?

Accepted Answer

Use least privilege access. Least privilege access is a foundational principle of Zero Trust, ensuring users and devices are granted only the minimum permissions necessary to perform their tasks. In Microsoft Entra ID, this is implemented through features like Privileged Identity Management (PIM) and conditional access policies that restrict access based on role and context, reducing the attack surface.

Answer

Assume trust based on location

Answer

Segment access

Question 18

A company has a Microsoft 365 tenant with domain contoso.com. They own an additional domain fabrikam.com and have already added and verified it with a TXT record. Now they need to configure email to be routed to Exchange Online for fabrikam.com. Which DNS record must they create?

Accepted Answer

MX record pointing to contoso-com.mail.protection.outlook.com. To route email for fabrikam.com to Exchange Online, you must create an MX record that points to the Exchange Online mail exchanger. The correct target is contoso-com.mail.protection.outlook.com, where 'contoso-com' is the hashed version of the primary domain (contoso.com) used by Microsoft 365. This MX record tells the internet's mail servers to deliver messages addressed to @fabrikam.com into the tenant's Exchange Online environment.

Answer

CNAME record for autodiscover

Answer

TXT record for SPF

Answer

SRV record for SIP

Question 19

You are a Microsoft 365 administrator. A user reports that they cannot send emails to a specific external domain. You check the Exchange Admin Center and see that the domain is not blocked. What should you check next?

Accepted Answer

Check the mail flow rules (transport rules) in Exchange Online.. Mail flow rules (transport rules) in Exchange Online can block or redirect messages based on conditions like sender, recipient domain, or message content, even if the domain is not listed in any block list. Since the domain is not blocked in the spam filter or outbound policies, a transport rule is the most likely cause of the issue, as it can silently reject or quarantine messages without appearing in the standard block lists.

Answer

Verify that the user has a full mailbox and is not over the send limit.

Answer

Review the outbound spam filter policy.

Answer

Check the spam filter policy to see if the domain is on the blocked sender list.

Question 20

Your organization plans to migrate from on-premises Exchange to Exchange Online. You need to ensure minimal disruption during the migration. Which approach should you recommend?

Accepted Answer

Deploy a hybrid configuration and migrate mailboxes in batches.. A hybrid migration allows you to gradually move mailboxes while maintaining coexistence, minimizing disruption. Option B (cutover migration) is disruptive and only suitable for small organizations. Option C (IMAP migration) does not fully migrate calendar or contacts. Option D (third-party tool) is unnecessary for standard migrations.

Answer

Perform a cutover migration during a weekend.

Answer

Use IMAP migration to migrate all mailboxes in parallel.

Answer

Use a third-party migration tool for a one-time bulk migration.