MS-102 Practice Test 21 — 15 Questions

Question 1

You are implementing Microsoft Entra Verified ID. Which identity verification method uses a decentralized identity standard?

Accepted Answer

Decentralized identifiers (DIDs). Microsoft Entra Verified ID is built on open standards for decentralized identity, specifically using Decentralized Identifiers (DIDs) as defined by the W3C. DIDs enable verifiable, self-sovereign identity without relying on a central authority, which is the core requirement for a decentralized identity verification method. This allows users to control their own identifiers and present verifiable credentials that can be cryptographically verified.

Answer

SAML 2.0

Answer

OAuth 2.0

Answer

Federation with Azure AD

Question 2

Your company uses Microsoft Entra ID and has an app named App1 that requires permissions to read all user profiles. You need to grant admin consent for App1 to read profiles without requiring each user to consent. What should you do?

Accepted Answer

From Microsoft Entra ID, go to Enterprise applications, select App1, and grant admin consent.. Granting admin consent for an enterprise application in Microsoft Entra ID allows a tenant administrator to pre-approve permissions for all users, eliminating the need for individual user consent. This is done by navigating to Enterprise applications, selecting App1, and using the 'Grant admin consent' option, which sends an OAuth 2.0 authorization request with the required permissions (e.g., User.Read.All) on behalf of the entire organization.

Answer

Create a Conditional Access policy that requires consent for App1.

Answer

Register a new application in App registrations and assign the required permissions.

Answer

Configure the user consent settings to allow users to consent for themselves.

Question 3

Which TWO actions are required to configure a custom domain for your Microsoft 365 tenant?

Accepted Answer

Add the domain name in the Microsoft 365 admin center.. Adding the custom domain name in the Microsoft 365 admin center is the first step to register the domain with the tenant. Option E is correct because Microsoft requires you to prove ownership of the domain by adding a specific TXT record (or sometimes a CNAME or MX record) to the public DNS zone; this verification step ensures only the domain owner can configure it for the tenant.

Answer

Add an SPF TXT record in the public DNS zone.

Answer

Add a CNAME record for autodiscover.

Answer

Add an MX record in the public DNS zone.

Question 4

You are a Microsoft 365 administrator for a small business with 50 users. The company is using Microsoft 365 Business Basic. You need to configure email for the custom domain contoso.com. You have added the domain in the Microsoft 365 admin center and verified ownership. Users currently have onmicrosoft.com email addresses. You need to change the primary email address for all users to their custom domain (e.g., user@contoso.com). What should you do?

Accepted Answer

Change the primary email address for each user to user@contoso.com in the admin center.. In Microsoft 365, after adding and verifying a custom domain, you must manually update each user's primary email address (User Principal Name and primary SMTP address) from the default onmicrosoft.com domain to the custom domain. This is done in the Microsoft 365 admin center under Users > Active Users, by editing the username and email fields. Simply adding the domain does not automatically change existing user addresses.

Answer

Remove the onmicrosoft.com domain from the tenant.

Answer

Convert all mailboxes to shared mailboxes and reassign licenses.

Answer

Configure the MX record for contoso.com to point to Exchange Online.

Question 5

Your company is deploying Microsoft Defender for Office 365. The security team wants to automatically remove messages identified as malware from all mailboxes after delivery. What should you configure?

Accepted Answer

Enable Zero-hour auto purge (ZAP) in the anti-malware policy.. Zero-hour auto purge (ZAP) is the correct feature because it automatically detects and removes messages that are identified as malware after they have already been delivered to a user's mailbox. By enabling ZAP in the anti-malware policy, the system retroactively moves malicious messages to the user's Junk Email folder or quarantines them, ensuring post-delivery protection without manual intervention.

Answer

Configure an anti-malware policy with a high-confidence verdict.

Answer

Set up a mailbox intelligence policy.

Answer

Create an anti-phishing policy to block spoofed senders.

Question 6

Your organization uses Microsoft Entra ID and requires users to authenticate using FIDO2 security keys. You need to ensure that users can register and manage their security keys through the My Security Info portal. Which authentication method policy setting should you enable?

Accepted Answer

Security keys (FIDO2). The Security keys (FIDO2) authentication method policy must be enabled to allow users to register and manage FIDO2 security keys through the My Security Info portal. This policy controls the registration, key restrictions, and user targeting for FIDO2 authentication in Microsoft Entra ID, directly enabling the self-service management experience.

Answer

Temporary Access Pass

Answer

Certificate-based authentication

Answer

Microsoft Authenticator

Question 7

An administrator runs the Azure CLI command shown in the exhibit. What is the result of this command?

Accepted Answer

A new application registration is created with requested permissions to Graph. The Azure CLI command `az ad app create --display-name 'MyApp' --required-resource-accesses '[{"resourceAppId":"00000003-0000-0000-c000-000000000000","resourceAccess":[{"id":"e1fe6dd8-ba31-4d61-89e7-88639da4923c","type":"Scope"}]}]'` creates a new application registration in Microsoft Entra ID. The `--required-resource-accesses` parameter specifies the Microsoft Graph (resourceAppId `00000003-0000-0000-c000-000000000000`) and the permission with ID `e1fe6dd8-ba31-4d61-89e7-88639da4923c` (which corresponds to the `User.Read` delegated permission). This registers the app with requested permissions to Microsoft Graph, but does not grant admin consent or configure sign-in audience.

Answer

An existing application registration is updated

Answer

The application is configured with single-tenant sign-in audience

Answer

An admin consent is granted for the Microsoft Graph permissions

Question 8

Your organization uses Microsoft Entra ID and has a custom role that grants 'microsoft.directory/applications/credentials/update' permission. A security audit reveals that a user assigned this role has modified credentials for an application. You need to prevent such actions while allowing other application updates. What should you do?

Accepted Answer

Create a custom role that excludes the 'microsoft.directory/applications/credentials/update' permission and assign it to the user.. The custom role currently includes the 'microsoft.directory/applications/credentials/update' permission, which allows modifying application credentials. To prevent credential updates while still permitting other application updates, you must create a new custom role that explicitly excludes this permission and assign it to the user. This approach preserves granular control without granting unnecessary privileges, unlike built-in roles that would either over-scope or under-scope permissions.

Answer

Assign the user the built-in Application Administrator role instead.

Answer

Enable multi-factor authentication for the user.

Answer

Remove the user from the custom role and assign them another role with fewer permissions.

Question 9

Your company is deploying Microsoft 365 for a new subsidiary with 500 users. You need to configure the initial tenant with a custom domain (contoso.com) and verify ownership. What is the first step you must perform?

Accepted Answer

Add a TXT record provided by Microsoft 365 to the contoso.com DNS zone.. To verify ownership of a custom domain in Microsoft 365, you must prove you control the domain's DNS zone. Microsoft provides a unique TXT record value that you add to the public DNS zone of contoso.com. Once the TXT record propagates, Microsoft queries it and confirms ownership, allowing you to proceed with domain configuration.

Answer

Delegate the contoso.com zone to Microsoft 365 DNS servers.

Answer

Create user accounts with the custom domain before verification.

Answer

Set contoso.com as the default domain in the Microsoft 365 admin center.

Question 10

Your organization uses Microsoft Sentinel for security operations. You need to ensure that Sentinel can ingest logs from Microsoft 365 Defender (XDR) and Microsoft Entra ID. Which THREE data connectors should you enable? (Choose three.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint is a correct data connector because it ingests endpoint detection and response (EDR) logs from Windows, macOS, and Linux devices into Microsoft Sentinel. This integration allows security operations to correlate endpoint alerts with other signals, enabling advanced hunting and automated incident response across the Microsoft 365 Defender ecosystem.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Intune

Question 11

An admin needs to bulk assign licenses to 200 users based on department. Which method is most efficient?

Accepted Answer

Use group-based licensing in Azure AD. Group-based licensing in Microsoft Entra ID is the most efficient method for bulk-assigning licenses to 200 users based on department because it automates license assignment and removal based on group membership. Once a user is added to or removed from a department-specific group, Microsoft Entra ID automatically applies or revokes the corresponding license, eliminating manual intervention and ensuring consistency across large-scale deployments.

Answer

Use Azure AD PowerShell script

Answer

Use Azure admin center bulk operations

Answer

Assign licenses one by one in admin center

Question 12

Your organization uses Microsoft Entra ID. You need to ensure that users can only access company resources from trusted networks. Which Conditional Access condition should you configure?

Accepted Answer

Locations. The Locations condition in a Conditional Access policy allows you to define trusted network locations using named locations (IP ranges or country/region). By configuring a policy that grants access only from these trusted locations, you ensure users can only access company resources from networks you have explicitly approved, such as corporate offices or VPN egress IPs.

Answer

Sign-in risk

Answer

Device platforms

Answer

Client apps

Question 13

Your organization is planning to migrate from on-premises Active Directory to Microsoft Entra ID using Azure AD Connect. You need to ensure that password synchronization is enabled. Which TWO components are required for password synchronization to work?

Accepted Answer

Azure AD Connect with password hash synchronization selected.. Microsoft Entra Connect with password hash synchronization (PHS) selected is the component that hashes the on-premises Active Directory password and synchronizes it to Microsoft Entra ID. Option E is correct because the Microsoft Entra ID service must process the incoming password hashes and store them in the cloud directory, enabling authentication against Entra ID. Without both the local sync engine (Microsoft Entra Connect) and the cloud-side service, password synchronization cannot function.

Answer

Active Directory Federation Services (AD FS).

Answer

Password Writeback enabled.

Answer

Microsoft Identity Manager (MIM).

Question 14

A user reports they cannot access SharePoint Online but can access Outlook. The admin verifies the user has an E3 license assigned. What is the most likely cause?

Accepted Answer

SharePoint Online service plan is disabled. The user can access Outlook (Exchange Online) but not SharePoint Online, which indicates that the user's E3 license is assigned and the account is active. The most likely cause is that the SharePoint Online service plan within the E3 license is disabled. Each Microsoft 365 license includes multiple service plans (e.g., Exchange Online, SharePoint Online, Teams), and an admin can disable individual plans while keeping the license assigned. If the SharePoint Online service plan is disabled, the user will be blocked from accessing SharePoint Online despite having a valid license.

Answer

License not assigned

Answer

MFA challenge failing

Answer

User account is disabled

Question 15

Your organization uses Microsoft Entra Connect Sync. You need to ensure that specific on-premises Active Directory groups are synchronized to Microsoft Entra ID. What should you configure?

Accepted Answer

Set the sync scope to 'Synchronize selected groups'. Microsoft Entra Connect Sync allows you to scope synchronization to specific groups by selecting 'Synchronize selected groups' in the Microsoft Entra Connect configuration. This setting, available during installation or via the 'Customize synchronization options' task, restricts synchronization to only the on-premises Active Directory groups you explicitly choose, ensuring that only those groups are synced to Microsoft Entra ID.

Answer

Configure attribute-based filtering in Microsoft Entra Connect

Answer

Create a security group in Microsoft Entra ID and add members

Answer

Use the Synchronization Service Manager to select groups