MS-102 Practice Test 23 — 15 Questions

Question 1

A multinational company uses Microsoft Entra ID with Conditional Access policies. They have a policy that requires multi-factor authentication (MFA) for all users when accessing the company's custom SaaS application. However, users from the European branch are reporting that they are prompted for MFA every time, even though they have already authenticated via a compliant device. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Conditional Access policy has a session control that requires sign-in frequency. The Conditional Access policy includes a session control that requires sign-in frequency, which forces users to re-authenticate with MFA at a specified interval regardless of device compliance or previous authentication. Even if the device is compliant and the user has already authenticated, the sign-in frequency control overrides session persistence and prompts for MFA again based on the configured time period (e.g., every hour). This explains why European branch users are repeatedly prompted for MFA despite having authenticated via a compliant device.

Answer

The user's device is not marked as compliant

Answer

The user has per-user MFA enabled

Answer

The policy includes a location condition that is not met

Question 2

You are troubleshooting why a user cannot access a SharePoint Online site. The user is assigned a Conditional Access policy that requires compliant device, and the device is enrolled in Microsoft Intune but shows as non-compliant. What is the most likely cause?

Accepted Answer

The device is non-compliant due to missing security updates. The user's device is enrolled in Intune but marked as non-compliant, which directly blocks access because the Conditional Access policy requires a compliant device. The most common reason for non-compliance is missing security updates, as Intune evaluates compliance based on configured policies such as required patch levels, encryption status, or threat detection. Since the device is enrolled, the issue is not enrollment or licensing, but a specific compliance rule violation.

Answer

The device is not enrolled in Microsoft Intune

Answer

The Conditional Access policy is not applied to SharePoint Online

Answer

The user does not have an Intune license

Question 3

Your company is implementing Microsoft Entra Conditional Access. You need to require multifactor authentication (MFA) for all users except those accessing from the corporate office. Which TWO components do you need?

Accepted Answer

Conditional Access policy configured with grant control requiring MFA and excluding Named Locations. To require MFA for all users except those accessing from the corporate office, you need a Conditional Access policy that grants access only if MFA is completed, and you must exclude the corporate office location. The 'Named Locations' configuration defines the corporate office IP ranges or trusted locations, and the Conditional Access policy uses that exclusion. Together, these two components enforce the requirement.

Answer

Microsoft Intune compliance policies

Answer

Microsoft Entra multifactor authentication registration policy

Answer

Microsoft Entra Identity Protection

Question 4

Which THREE factors are considered when Microsoft Entra ID evaluates a conditional access policy?

Accepted Answer

User or group membership. Microsoft Entra ID evaluates conditional access policies based on signals from the user, device, and location. User or group membership (Option A) is a primary signal because policies are typically assigned to specific users or groups to control access. Location (Option D) is evaluated using IP ranges or country codes to enforce restrictions like blocking access from untrusted networks. Device platform (Option E) allows policies to target specific operating systems (e.g., Windows, iOS) to enforce compliance requirements like requiring Intune enrollment.

Answer

Mailbox size

Answer

User's department attribute in Microsoft Entra ID

Question 5

Which TWO Microsoft Entra ID features can be used to provide just-in-time (JIT) access to privileged roles?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) provides just-in-time (JIT) access by allowing users to activate eligible role assignments for a limited time, with approval workflows and auditing. Privileged Access Groups extend JIT capabilities by enabling time-bound membership in groups that grant access to Microsoft Entra ID roles or Azure resources, ensuring temporary elevation only when needed.

Answer

Identity Protection

Answer

Conditional Access

Answer

Access Reviews

Question 6

Drag and drop the steps to configure a compliance retention policy in Microsoft Purview in the correct order.

Accepted Answer

Create a retention policy → Select locations → Configure retention settings → Publish the policy. Retention policies are created in Purview, locations selected, retention settings defined, and then published.

Answer

Select locations → Create a retention policy → Configure retention settings → Publish the policy

Answer

Configure retention settings → Create a retention policy → Select locations → Publish the policy

Answer

Create a retention policy → Publish the policy → Select locations → Configure retention settings

Question 7

Your organization uses Microsoft Entra ID Governance. You need to implement an access review for all users who have access to a critical application. The review must be recurring every quarter and require reviewers to provide a justification for their decisions. Which access review settings should you configure?

Accepted Answer

Frequency: Quarterly, Justification required: Yes. The requirement specifies a quarterly recurring access review with mandatory justification. In Microsoft Entra ID Governance, the 'Frequency' setting controls the recurrence interval (e.g., Quarterly), and the 'Justification required' toggle enforces that reviewers must provide a reason for their decision. Setting 'Justification required' to 'Yes' ensures compliance with audit and governance policies.

Answer

Frequency: Quarterly, Justification required: No

Answer

Frequency: Annually, Justification required: Yes

Answer

Frequency: Monthly, Justification required: Yes

Question 8

Your organization has a hybrid identity deployment using Microsoft Entra Connect Sync. You need to ensure that password writeback is enabled so that users can reset their own passwords from the cloud. Which prerequisite must be met?

Accepted Answer

Self-Service Password Reset (SSPR) must be enabled in Microsoft Entra ID. Password writeback requires that Self-Service Password Reset (SSPR) is enabled in Microsoft Entra ID because writeback is a feature of SSPR that allows password changes initiated in the cloud to be written back to the on-premises Active Directory. Without SSPR enabled, the cloud tenant has no mechanism to trigger the writeback operation, even if the Entra Connect Sync configuration is correct.

Answer

Password hash synchronization must be enabled

Answer

Azure MFA must be enabled for all users

Answer

Microsoft Entra ID P2 licenses must be assigned

Question 9

Which TWO of the following are valid conditions that can be used in a Microsoft Entra ID conditional access policy? (Choose two.)

Accepted Answer

Sign-in risk. Sign-in risk (B) and user risk (D) are both valid conditions in Microsoft Entra ID Conditional Access policies. These risk levels are calculated by Microsoft Entra ID Protection using real-time signals such as anonymous IP addresses, atypical travel, or leaked credentials, and can be used to trigger policies like requiring multi-factor authentication or blocking access.

Answer

Network location

Answer

Application sensitivity label

Answer

Device manufacturer

Question 10

Which TWO Microsoft Defender XDR components provide protection for email and collaboration tools? (Choose two.)

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 is the correct choice because it is the dedicated component that protects email and collaboration tools (Exchange Online, SharePoint Online, OneDrive for Business, and Teams) against threats like phishing, malware, and spam. It uses advanced machine learning and detonation analysis in Safe Attachments and Safe Links to inspect attachments and URLs in real time.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Endpoint

Question 11

Your organization uses Microsoft Entra ID and has a hybrid identity configuration with Active Directory Federation Services (AD FS). You are migrating to cloud authentication using Pass-through Authentication (PTA). Which TWO components are required for a PTA deployment?

Accepted Answer

Service Bus endpoints in Azure. Pass-through Authentication (PTA) requires the PTA Agent to be installed on-premises to validate user passwords against Active Directory. It also uses Azure Service Bus endpoints to establish a secure, persistent connection between the on-premises agent and Microsoft Entra ID, enabling authentication requests to flow without storing passwords in the cloud.

Answer

Password Hash Synchronization agent

Answer

Azure AD Connect Health agent

Answer

Seamless Single Sign-On

Question 12

Which TWO tools can be used to manage Microsoft 365 tenant settings and configurations?

Accepted Answer

Microsoft 365 admin center. The Microsoft 365 admin center is the primary web-based portal for managing tenant-wide settings such as user licensing, domain management, service health, and security policies. It provides a unified dashboard for configuring core tenant configurations without requiring role-specific consoles.

Answer

Exchange admin center (EAC)

Answer

SharePoint admin center

Answer

Microsoft Intune admin center

Question 13

Which TWO of the following are benefits of using Microsoft Entra ID Provisioning for cloud HR applications like Workday? (Choose two.)

Accepted Answer

Support for attribute-based provisioning. Microsoft Entra ID Provisioning for cloud HR applications like Workday supports attribute-based provisioning, which allows mapping of HR attributes (e.g., department, location) to Entra ID user attributes using an expression-based mapping engine. This enables dynamic filtering and transformation of user data during synchronization, ensuring that only users meeting specific criteria (e.g., employment status) are provisioned.

Answer

Automatic license assignment

Answer

Automatic password reset for new users

Answer

Automatic creation of user mailboxes in Exchange Online

Question 14

Which TWO are prerequisites for implementing Microsoft Entra ID Identity Protection? (Choose two.)

Accepted Answer

Microsoft Entra ID P2 license. Microsoft Entra ID Identity Protection requires a Microsoft Entra ID P2 license because it uses advanced risk detection and automated remediation capabilities (e.g., risk-based Conditional Access policies, user risk and sign-in risk policies) that are only available in the P2 tier. The P1 license provides basic Conditional Access but lacks the risk detection engine and adaptive policies that Identity Protection relies on.

Answer

Microsoft Entra ID P1 license

Answer

Audit logs enabled for sign-in events

Answer

Self-service password reset configured

Question 15

Your organization uses Microsoft Entra ID. You need to enable users to securely share documents with external partners. Which TWO features should you use?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is correct because it allows you to securely share documents and collaborate with external partners by inviting them as guest users in your Entra ID tenant. This feature leverages existing identities (e.g., Microsoft, Google, or SAML/WS-Fed providers) without requiring external users to create new accounts, enabling controlled access to resources like SharePoint or Teams.

Answer

Azure AD B2C

Answer

Microsoft Purview Information Protection

Answer

Microsoft Defender for Cloud Apps