MS-102 Practice Test 22 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID to manage user identities. You need to ensure that users can sign in using their existing social media accounts, such as Microsoft, Google, or Facebook. What should you configure?

Accepted Answer

Configure External Identities and add identity providers for social networks. Option B is correct because Microsoft Entra ID supports External Identities, which allow you to add social identity providers (Microsoft, Google, Facebook) as external authentication sources. This enables users to sign in with their existing social accounts by configuring federation with those providers using OAuth 2.0 or OpenID Connect protocols, without needing to create separate Entra ID accounts.

Answer

Configure Conditional Access policies for social identity providers

Answer

Configure Microsoft Entra Connect to sync social account attributes

Answer

Configure self-service password reset (SSPR)

Question 2

Your organization uses Microsoft Entra ID and has a Conditional Access policy that requires MFA for all external users. However, guest users from a partner organization are being blocked when they try to access a SharePoint Online site. You need to ensure that guest users can access the site without being prompted for MFA if they have already satisfied MFA in their home tenant. What should you configure?

Accepted Answer

Enable the trust MFA for external users setting in cross-tenant access settings. Option C is correct because the cross-tenant access settings in Microsoft Entra ID include a 'Trust MFA from external tenants' option. When enabled, this setting allows guest users who have already satisfied MFA in their home tenant to access resources in your tenant without being prompted for MFA again. This respects the partner's MFA claims and avoids redundant authentication, which directly resolves the blocking issue caused by the Conditional Access policy requiring MFA for all external users.

Answer

Disable MFA requirement for guest users in Conditional Access

Answer

Configure authentication methods policy to accept MFA from external identities

Answer

Use B2B direct connect instead of B2B collaboration

Question 3

Your organization has a hybrid identity environment with Microsoft Entra Connect. You are planning to migrate to cloud-only authentication using Microsoft Entra Cloud Sync. However, some legacy applications still require NTLM authentication. What should you do to ensure those applications can authenticate after the migration?

Accepted Answer

Use Microsoft Entra Application Proxy to publish the legacy applications. Option C is correct because Microsoft Entra Application Proxy can provide secure access to legacy on-premises apps and support NTLM. Option A is wrong because cloud sync does not support NTLM. Option B is wrong because PHS supports modern auth, not NTLM. Option D is wrong because PTA does not support NTLM directly.

Answer

Enable pass-through authentication (PTA)

Answer

Configure Microsoft Entra Cloud Sync with password hash sync

Answer

Deploy Microsoft Entra Password Protection

Question 4

Which THREE of the following are valid permissions in Microsoft Entra ID custom roles? (Choose three.)

Accepted Answer

microsoft.directory/applications/delete. Option A is correct because 'microsoft.directory/applications/delete' is a valid permission in Microsoft Entra ID custom roles. Custom roles allow granular permissions defined by the 'microsoft.directory' namespace, and deleting applications is a supported action under the 'applications' resource type.

Answer

microsoft.directory/applications/credentials/update

Answer

microsoft.directory/roles/assign

Answer

microsoft.directory/groups/members/update

Question 5

Your company uses Microsoft Entra ID for identity management. You are planning to implement Conditional Access policies. Which TWO components are required to create a Conditional Access policy?

Accepted Answer

Assignments (users, groups, cloud apps, conditions). A Conditional Access policy requires assignments (users/groups, cloud apps, conditions) and access controls (grant or block, session controls). Option B (assignments) and Option C (access controls) are the two main components. Option A (identity protection) is a separate service, not a required component. Option D (Azure AD roles) are not part of policy creation. Option E (MFA registration) is a prerequisite but not a component of the policy.

Answer

MFA registration status

Answer

Identity Protection risk policies

Answer

Azure AD roles

Question 6

You need to grant a vendor access to a specific SharePoint Online site for a limited time. The vendor does not have an account in your Microsoft Entra ID. What should you use?

Accepted Answer

Use Microsoft Entra B2B collaboration and set an expiration for the guest user. Microsoft Entra B2B collaboration allows you to invite external users (vendors) as guest users to access your organization's resources, including SharePoint Online sites, without requiring them to have an existing account in your tenant. You can configure an expiration policy for the guest user account to automatically remove access after a specified period, meeting the requirement for limited-time access.

Answer

Create a user account via Microsoft Entra Connect

Answer

Configure self-service sign-up user flow

Answer

Assign the vendor a guest user account with no expiration

Question 7

Which TWO of the following are features of Microsoft Entra ID Identity Protection? (Choose two.)

Accepted Answer

Sign-in risk policy that can block risky sign-ins.. Option A is correct because Microsoft Entra ID Identity Protection includes a sign-in risk policy that can automatically block risky sign-ins based on real-time risk levels (e.g., high, medium, low). This policy evaluates sign-in risk detections and enforces actions such as blocking access or requiring multi-factor authentication (MFA) without manual intervention.

Answer

Risk detections such as leaked credentials and anonymous IP address.

Answer

Conditional Access policies integration.

Answer

Advanced Threat Protection (ATP) for identities.

Question 8

Your organization uses Microsoft Entra ID and has an application that requires the 'User.Read.All' permission. You need to grant this permission to the application but ensure that only an administrator can consent, not users. What should you do?

Accepted Answer

Grant admin consent for the application from the Enterprise applications blade.. Option A is correct because granting admin consent from the Enterprise applications blade explicitly authorizes the application to access the 'User.Read.All' permission without requiring individual user consent. This is the only way to satisfy the requirement that only an administrator can consent, as admin consent bypasses user consent policies entirely and applies tenant-wide.

Answer

Enable user consent for this application in the enterprise application settings.

Answer

Configure the user consent settings to allow user consent for low-risk permissions.

Answer

Set the 'Consent and permissions' settings to block user consent.

Question 9

Your organization uses Microsoft Entra ID with P2 licenses. You need to identify and remediate users who are at risk due to leaked credentials or anomalous sign-in activity. You want to automate the response to high-risk users by requiring a password change. Which feature should you use?

Accepted Answer

Microsoft Entra Identity Protection. Option B is correct because Identity Protection provides risk-based conditional access policies to automatically remediate high-risk users. Option A is wrong because Privileged Identity Management (PIM) manages privileged roles, not user risk. Option C is wrong because Identity Governance handles access reviews and entitlement management. Option D is wrong because Microsoft Defender for Cloud Apps focuses on cloud app security, not identity risk.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra Identity Governance

Answer

Microsoft Entra Privileged Identity Management (PIM)

Question 10

Your organization uses Microsoft Entra ID and has a hybrid identity setup with password hash synchronization. You need to ensure that when a user's on-premises Active Directory account is disabled, their Microsoft Entra ID account is also disabled within 30 minutes. What should you do?

Accepted Answer

Configure Azure AD Connect to sync the 'userAccountControl' attribute and set the sync frequency to 30 minutes.. Option D is correct because you need to enable password hash sync (which is already enabled) and also enable Azure AD Connect sync for account status changes. Option A is wrong because that only changes password behavior. Option B is wrong because that does not affect account status. Option C is wrong because that is for writing back password resets, not sync.

Answer

Enable Azure AD Connect cloud sync.

Answer

Configure password hash synchronization to run every 30 minutes.

Answer

Enable password writeback.

Question 11

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can access internal applications using single sign-on (SSO) without storing passwords in the cloud. Which authentication method should you implement?

Accepted Answer

Windows Hello for Business. Windows Hello for Business is correct because it enables passwordless single sign-on (SSO) to internal applications using biometric or PIN credentials, with the private key stored on the user's device rather than in the cloud. This meets the requirement of no passwords stored in the cloud while still providing seamless SSO access.

Answer

Federation with AD FS

Answer

Password hash synchronization

Answer

Pass-through authentication

Question 12

Your company has a Microsoft 365 E5 subscription and uses Microsoft Entra ID. You need to configure a conditional access policy that blocks access from devices that are not compliant with your organization's device compliance policies, as defined by Microsoft Intune. Which assignment should you configure in the policy?

Accepted Answer

Grant > Require device to be marked as compliant. Option C is correct because the 'Require device to be marked as compliant' grant control in a Conditional Access policy enforces access decisions based on the compliance status reported by Microsoft Intune. When a device is marked as non-compliant by Intune (e.g., missing required updates or having an unapproved app), the policy blocks access. This directly meets the requirement to block devices that do not meet the organization's device compliance policies.

Answer

Grant > Require hybrid Azure AD joined device

Answer

Grant > Require multifactor authentication

Answer

Grant > Require approved client app

Question 13

You are implementing Microsoft Entra Identity Protection. You need to configure automated responses to medium and high user risk. Which policy should you create?

Accepted Answer

User risk policy. User risk policy in Microsoft Entra Identity Protection is specifically designed to automatically respond to user risk levels (low, medium, high) by triggering remediation actions such as requiring a password change or blocking sign-in. Since the question asks for automated responses to medium and high user risk, the correct policy is the User risk policy, which evaluates risk based on user behavior and leaked credentials.

Answer

Sign-in risk policy

Answer

Conditional Access policy with grant controls

Answer

MFA registration policy

Question 14

Refer to the exhibit. You run the KQL query in Microsoft Sentinel. The query returns zero results even though you know user@contoso.com has had failed sign-in attempts in the last 30 days. What is the most likely reason?

Accepted Answer

The query filters on UserPrincipalName incorrectly. Option D is correct because the query filters by UserPrincipalName, which may not match the actual data field (e.g., it could be UserId or different format). Option A is wrong because the query uses ago(30d). Option B is wrong because the query includes all results. Option C is wrong because the query uses summarize correctly.

Answer

The query uses ago(30d) but the data retention is only 7 days

Answer

The summarize statement is incorrect

Answer

The query excludes successful sign-ins

Question 15

Which TWO permissions are required for a custom role to manage Conditional Access policies in Microsoft Entra ID?

Accepted Answer

microsoft.directory/conditionalAccessPolicies/read. To manage Conditional Access policies in Microsoft Entra ID, a custom role requires both the read and update permissions. The 'read' permission (option B) is necessary to view existing policies, while the 'update' permission (option D) is required to modify or configure policy settings. Without both, the role cannot effectively manage policies, as management implies the ability to change them.

Answer

microsoft.directory/conditionalAccessPolicies/allProperties/read

Answer

microsoft.directory/conditionalAccessPolicies/delete

Answer

microsoft.directory/conditionalAccessPolicies/create