MS-102 Practice Test 22 — 15 Questions

Question 1

Which TWO actions are required to enable Microsoft 365 Copilot for all users in your tenant?

Accepted Answer

Ensure users have a qualifying Microsoft 365 license (e.g., E3, E5, Business Standard).. Microsoft 365 Copilot requires users to have a qualifying base license such as Microsoft 365 E3, E5, or Business Standard. Without one of these base licenses, the Copilot add-on license cannot be assigned or function properly, as Copilot relies on the underlying Microsoft 365 services (e.g., Exchange Online, SharePoint, Teams) that these plans provide.

Answer

Run a PowerShell script to enable Copilot in the tenant.

Answer

Ensure the tenant is on a Microsoft 365 E5 plan.

Answer

Provision an Azure subscription for Copilot services.

Question 2

You are reviewing directory settings for Microsoft 365 Groups. Based on the exhibit, which statement is true?

Accepted Answer

All users in the tenant can create Microsoft 365 Groups. The exhibit shows that under 'Group creation settings,' the option 'Set which users can create Microsoft 365 Groups' is configured to 'Everyone.' This means all users in the tenant are permitted to create groups, regardless of membership in any security group. Therefore, option D is correct because the setting explicitly allows all users to create Microsoft 365 Groups.

Answer

Only users in a specific security group can create Microsoft 365 Groups

Answer

A naming policy is enforced for new groups

Answer

Groups must have a classification label

Question 3

You are implementing Microsoft Entra Verified ID. Which technology does it use to create decentralized digital identities?

Accepted Answer

Decentralized Identifiers (DIDs). Microsoft Entra Verified ID uses Decentralized Identifiers (DIDs) as the core technology to create decentralized digital identities. DIDs are globally unique identifiers that are cryptographically verifiable and do not rely on a centralized registry, enabling self-sovereign identity scenarios where users control their own identity data.

Answer

OpenID Connect

Answer

OAuth 2.0

Answer

Security Assertion Markup Language (SAML)

Question 4

You have a Microsoft 365 E5 tenant. Users report that they cannot access the Microsoft 365 admin center (https://admin.microsoft.com). You verify that they have the Global Administrator role assigned. You check the sign-in logs in Microsoft Entra ID and see that the sign-in was blocked by a Conditional Access policy. The policy requires MFA and a compliant device. The users are using personal devices that are not enrolled. What should you do to allow access while maintaining security?

Accepted Answer

Modify the Conditional Access policy to exclude the Microsoft 365 admin center from the device compliance requirement, but keep MFA.. It allows users to access the Microsoft 365 admin center by removing the device compliance requirement for that specific cloud app while still enforcing MFA. This maintains security through MFA and avoids blocking access for users on personal, unenrolled devices. Disabling the policy entirely or requiring enrollment would either weaken security or be impractical for personal devices.

Answer

Disable the Conditional Access policy.

Answer

Ask users to enroll their personal devices in Microsoft Intune.

Answer

Remove the Global Administrator role from the users and assign a lower privilege role.

Question 5

Your organization requires that all administrators use phishing-resistant authentication methods. Which Microsoft Entra ID authentication method meets this requirement?

Accepted Answer

FIDO2 security key. FIDO2 security keys are phishing-resistant because they use public-key cryptography and are bound to a specific website origin, preventing credential reuse on fake sites. This meets Microsoft's requirement for phishing-resistant authentication under Entra ID, as it satisfies the 'something you have' factor without exposing secrets to the relying party.

Answer

SMS-based verification

Answer

Microsoft Authenticator push notification

Answer

Temporary Access Pass

Question 6

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos ticket request. You need to investigate which user account is potentially compromised. Which tool should you use to correlate the alert with user activity?

Accepted Answer

Microsoft Defender XDR portal. The Microsoft Defender XDR portal (security.microsoft.com) provides a unified incident queue that correlates alerts from Defender for Identity with user activity, including Kerberos ticket requests. This allows you to investigate the specific user account involved by examining the alert timeline, related events, and entity details such as the account's authentication patterns and potential lateral movement.

Answer

Microsoft Intune admin center

Answer

Microsoft Purview compliance portal

Answer

Microsoft Entra admin center

Question 7

Your organization uses Microsoft Defender for Office 365 and wants to simulate a phishing attack to train users. You need to configure a simulation that uses a URL link to a credential harvesting page. Which feature should you use?

Accepted Answer

Attack simulation training. Attack simulation training in Microsoft Defender for Office 365 is the dedicated feature for creating and launching realistic phishing simulations, including those that use a URL link to a credential harvesting page. It allows administrators to configure payloads, target users, and track training completion, directly meeting the requirement to simulate a phishing attack for user education.

Answer

Anti-phish policies

Answer

Safe Links policies

Answer

Safe Attachments policies

Question 8

Your company uses Microsoft Entra ID for identity management. You are planning to implement Conditional Access policies. Which TWO components are required to create a Conditional Access policy?

Accepted Answer

Assignments (users, groups, cloud apps, conditions). A Conditional Access policy in Microsoft Entra ID requires two core components: Assignments and Access controls. Assignments define the scope of the policy by specifying users, groups, cloud apps, and conditions (e.g., location, device state). Access controls determine the enforcement action, such as granting access (optionally requiring MFA or compliant device) or blocking access, along with session controls like app-enforced restrictions. Without both components, the policy cannot be created.

Answer

MFA registration status

Answer

Identity Protection risk policies

Answer

Azure AD roles

Question 9

Which TWO of the following are valid methods to enforce device compliance in a Conditional Access policy? (Select two.)

Accepted Answer

Require Microsoft Entra hybrid joined device. Requiring a Microsoft Entra hybrid joined device ensures the device is joined to both on-premises Active Directory and Microsoft Entra ID, which allows Conditional Access to enforce compliance based on the device's identity and configuration. Option E is correct because requiring the device to be marked as compliant relies on Microsoft Intune (or another MDM) to evaluate device health and policy adherence, and then Conditional Access blocks access if the device is not compliant.

Answer

Require Microsoft Authenticator

Answer

Require session persistence

Answer

Require approved client app

Question 10

You are a Microsoft 365 administrator. You run the Get-MgPolicyCrossTenantAccessPolicyDefault cmdlet and see the exhibit output. What does this configuration imply?

Accepted Answer

Your tenant will accept MFA claims from all external Microsoft Entra tenants. The Get-MgPolicyCrossTenantAccessPolicyDefault cmdlet retrieves the default cross-tenant access policy settings. The exhibit output shows that the InboundTrust property is configured to accept MFA claims from all external Microsoft Entra tenants, meaning your tenant will trust MFA claims made by users from any external Entra tenant without requiring them to re-authenticate.

Answer

Your tenant will accept compliant device claims from external tenants

Answer

Your tenant will accept MFA claims from a specific partner tenant

Answer

Your tenant blocks all inbound B2B collaboration

Question 11

You run the Azure CLI command shown in the exhibit. What does the output represent?

Accepted Answer

The application ID for Microsoft Graph. The Azure CLI command `az ad sp show --id 00000003-0000-0000-c000-000000000000` retrieves the service principal for the Microsoft Graph API. The GUID `00000003-0000-0000-c000-000000000000` is the well-known application ID for Microsoft Graph in Microsoft Entra ID (formerly Azure AD). This ID is used to grant permissions and consent for Microsoft Graph API access.

Answer

The application ID for Microsoft Entra ID

Answer

The application ID for Exchange Online

Answer

The application ID for SharePoint Online

Question 12

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP). You need to ensure that sensitive data such as credit card numbers cannot be shared externally via email. Which THREE components should you configure?

Accepted Answer

Define sensitive information types for credit card numbers. A is correct because sensitive information types (SITs) are predefined or custom patterns that detect specific data like credit card numbers (e.g., regex matching major credit card formats). Defining the SIT for credit card numbers allows the DLP policy to identify this sensitive content in emails, which is the first step before any action can be taken.

Answer

Enable Microsoft Purview Insider Risk Management

Answer

Configure a retention policy for email

Question 13

Refer to the exhibit. You are reviewing a Microsoft Entra ID Governance access review. The JSON shows an access review scope for a SharePoint site. What does the 'isExternallyAccessible': false setting indicate about the site?

Accepted Answer

External users cannot access the site.. The 'isExternallyAccessible': false setting in the access review scope JSON indicates that the SharePoint site is not configured to allow external sharing. This means external users cannot access the site, making option B correct. The setting directly controls whether the site is visible to external identities in the access review, not the review process itself.

Answer

The site's external sharing settings are not reviewed.

Answer

The site is configured to allow sharing with anyone.

Answer

External users are automatically granted access.

Question 14

Your organization uses Microsoft Entra ID and wants to implement a passwordless authentication strategy. Which TWO authentication methods are considered passwordless by Microsoft? (Choose two.)

Accepted Answer

Windows Hello for Business. Windows Hello for Business is a passwordless authentication method that uses biometric or PIN-based credentials tied to a user's device, leveraging asymmetric key pairs to authenticate against Microsoft Entra ID without transmitting a password. It satisfies Microsoft's definition of passwordless because the private key never leaves the device, and authentication is performed via a cryptographic challenge-response protocol.

Answer

Microsoft Authenticator with notification

Answer

Password Hash Synchronization

Answer

SMS-based one-time passcode

Question 15

Your organization is deploying Windows 11 using Microsoft Intune. You need to ensure that devices are automatically enrolled in Intune when users sign in with their Microsoft Entra ID credentials. Which THREE prerequisites must be met?

Accepted Answer

Microsoft Entra ID P1 or P2 license.. Microsoft Entra ID P1 or P2 licenses are required to enable automatic MDM enrollment via Intune. Without these licenses, the MDM authority cannot be set to Intune, and the automatic enrollment policy in Microsoft Entra ID will not function. This licensing requirement ensures that the tenant has the necessary features for conditional access and device management policies.

Answer

Devices must run Windows 10/11 Home edition.

Answer

Microsoft Configuration Manager must be deployed.