MS-102 Practice Test 23 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID with Application Proxy to publish on-premises web apps. Users report that they are prompted for credentials multiple times when accessing an app. You need to reduce the number of authentication prompts. What should you configure?

Accepted Answer

Enable Kerberos Constrained Delegation (KCD) for single sign-on. Option B is correct because enabling Kerberos Constrained Delegation (KCD) with single sign-on allows the Application Proxy connector to authenticate users without additional prompts. Option A is wrong because pre-authentication with Entra ID already provides SSO if configured. Option C is wrong because MFA would increase prompts. Option D is wrong because session lifetime settings do not affect the number of prompts per session.

Answer

Enable Azure MFA for the application

Answer

Disable pre-authentication for the application

Answer

Increase the session lifetime in conditional access

Question 2

You need to enforce multifactor authentication (MFA) for all users in a Microsoft Entra ID tenant. The solution must not require users to register security info if they already have it. Which approach should you use?

Accepted Answer

Create a Conditional Access policy that requires MFA for all users. Option C is correct because a Conditional Access policy can require MFA for all users while respecting existing security info registration. The policy triggers MFA during sign-in but does not force re-registration if the user has already registered. This meets the requirement of not requiring users to register security info if they already have it.

Answer

Use identity protection to enforce MFA for risky sign-ins

Answer

Assign MFA per user in the Microsoft Entra admin center

Answer

Enable security defaults

Question 3

A user reports that they cannot access a cloud app that requires MFA. The user's mobile phone is lost. They have no other registered MFA methods. What should the administrator do?

Accepted Answer

Temporarily disable MFA for the user in the Authentication methods policy. Option C is correct because an administrator can temporarily disable MFA for the user in the Authentication methods policy, allowing them to sign in without MFA until they register a new method. Option A is wrong because the user cannot reset MFA themselves without the authenticator app. Option B is wrong because the user cannot register a new method without access. Option D is wrong because the user should not be blocked permanently. Option E is wrong because resetting the user's password does not help with MFA.

Answer

Instruct the user to register a new MFA method using the Microsoft Entra admin center

Answer

Block the user's account until they recover their phone

Answer

Instruct the user to use the Microsoft Authenticator app to reset their MFA

Question 4

You are designing a Microsoft Entra ID tenant for a new subsidiary. You need to ensure that users can authenticate using their existing on-premises Active Directory credentials without synchronizing password hashes to the cloud. Which identity model should you choose?

Accepted Answer

Pass-through authentication (PTA). Pass-through authentication (PTA) allows users to authenticate against on-premises Active Directory directly, without synchronizing password hashes to the cloud. When a user signs in to Microsoft Entra ID, the authentication request is forwarded to an on-premises PTA agent, which validates the credentials against the local domain controller. This meets the requirement of using existing on-premises credentials without storing password hashes in the cloud.

Answer

Federation with AD FS

Answer

Cloud-only identity

Answer

Password hash synchronization (PHS)

Question 5

Your organization uses Microsoft Entra ID. You need to implement a solution that allows users to sign in without a password using their smartphone. Which TWO authentication methods can be used?

Accepted Answer

Microsoft Authenticator app (phone sign-in). The Microsoft Authenticator app supports phone sign-in, which allows users to authenticate by approving a notification or entering a number displayed on the screen, eliminating the need for a password. FIDO2 security keys enable passwordless authentication using hardware-based public/private key cryptography, meeting the requirement for smartphone-based sign-in when the key is connected via USB or NFC. Both methods are supported by Microsoft Entra ID for passwordless authentication.

Answer

Temporary Access Pass

Answer

Windows Hello for Business

Answer

Text message (SMS) verification code

Question 6

An administrator needs to grant a user the ability to reset passwords for other users in Microsoft Entra ID. Which role should be assigned?

Accepted Answer

Helpdesk Administrator. The Helpdesk Administrator role can reset passwords for non-administrators and limited administrators.

Answer

Password Administrator

Answer

Global Administrator

Answer

User Administrator

Question 7

Which TWO of the following are valid conditions that can be used in a Microsoft Entra ID conditional access policy? (Choose two.)

Accepted Answer

Sign-in risk. Sign-in risk (B) and user risk (D) are both valid conditions in Microsoft Entra ID Conditional Access policies. These risk levels are calculated by Microsoft Entra ID Protection using real-time signals such as anonymous IP addresses, atypical travel, or leaked credentials, and can be used to trigger policies like requiring multi-factor authentication or blocking access.

Answer

Network location

Answer

Application sensitivity label

Answer

Device manufacturer

Question 8

Your organization uses Microsoft Entra ID and has a custom role that includes the permission 'microsoft.directory/applications/credentials/update'. You need to create a new role that includes all permissions of the existing role except the credential update permission. What is the best approach?

Accepted Answer

Use the 'Copy role' option from the existing role and then remove the credential update permission.. Option B is correct because you can copy the existing role and remove the unwanted permission. Option A is wrong because you would need to specify all permissions manually. Option C is wrong because you cannot assign a role and then deny a specific permission. Option D is wrong because there is no built-in role that matches.

Answer

Assign the existing role to the user and create a Conditional Access policy that blocks credential update.

Answer

Assign the built-in Application Administrator role instead.

Answer

Create a new custom role and manually add all permissions except credential update.

Question 9

Your organization uses Microsoft Entra ID and has enabled Microsoft Entra ID Protection. You notice that the number of 'Leaked Credentials' detections is high. What action should you take to automatically remediate this risk?

Accepted Answer

Configure a user risk policy in Microsoft Entra ID Protection to require a password change for high-risk users. Option C is correct because a user risk policy in Microsoft Entra ID Protection can be configured to automatically trigger a password change when a user is detected as high risk, such as when leaked credentials are identified. This policy directly remediates the risk by forcing the user to update their compromised credentials, effectively invalidating the leaked password. The other options either do not address the root cause or require manual intervention.

Answer

Use Microsoft Entra ID Protection to automatically reset passwords for all users with leaked credentials

Answer

Configure a conditional access policy to block access for users with high user risk

Answer

Enable Microsoft Entra ID Multifactor Authentication for all users

Question 10

Your company uses Microsoft Entra ID with hybrid joined devices. You need to enforce multi-factor authentication (MFA) for all cloud app access but want to exclude specific locations (trusted IPs). What is the most efficient way to implement this?

Accepted Answer

Create a Conditional Access policy targeting all cloud apps, requiring MFA, with a condition to exclude trusted IPs. Conditional Access is the correct approach to enforce MFA with location exclusions. Option B is wrong because per-user MFA does not support location exclusions. Option C is incorrect because Microsoft Entra ID Protection is for risk-based policies, not trusted IPs. Option D is not a valid MFA enforcement method.

Answer

Use Microsoft Intune to enforce MFA for all corporate devices

Answer

Enable per-user MFA and exclude trusted IPs in the MFA service settings

Answer

Configure a user risk policy in Microsoft Entra ID Protection to require MFA when risk is medium or higher

Question 11

Your company uses Microsoft Entra ID and wants to enforce that all users register for MFA within 14 days of account creation. Which policy should you configure?

Accepted Answer

Authentication methods policy with 'Registration campaign' targeting users. Option B is correct because the Authentication methods policy in Microsoft Entra ID can be used to set a registration campaign that requires users to register for MFA within a specified timeframe. Option A is wrong because conditional access policies enforce MFA during sign-in, not registration. Option C is wrong because Identity Protection policies address risk, not registration. Option D is wrong because the user risk policy is for risk-based remediation. Option E is wrong because MFA registration policy is part of Authentication methods policy.

Answer

Conditional access policy with 'Require multifactor authentication'

Answer

Microsoft Entra ID Protection sign-in risk policy

Answer

Microsoft Entra ID Protection user risk policy

Question 12

You are troubleshooting an issue where users from a partner organization cannot access a shared app in your Microsoft Entra ID tenant. The partner uses Microsoft Entra ID with a custom domain. You have configured cross-tenant access settings. Which setting is most likely misconfigured?

Accepted Answer

Default inbound cross-tenant access settings for the partner's tenant ID. The default inbound cross-tenant access settings control how external users from other tenants access your tenant's resources. Since the partner cannot access the shared app, the most likely misconfiguration is that the default inbound settings for the partner's tenant ID are set to block access, or the partner's tenant ID is not explicitly allowed in the inbound settings. This overrides any app-level permissions, as cross-tenant access settings act as a gate before user assignment is evaluated.

Answer

Outbound cross-tenant access settings for the partner's tenant ID

Answer

The app's user assignment and provisioning configuration

Answer

The partner's inbound cross-tenant access settings for your tenant

Question 13

You are deploying Microsoft Entra ID Governance. Which THREE capabilities should you include to meet compliance requirements for access recertification and lifecycle management?

Accepted Answer

Access Reviews. Access Reviews (B) are a core capability of Microsoft Entra ID Governance that directly enables compliance-driven access recertification. They allow administrators to create recurring reviews of group memberships, application assignments, and privileged roles, ensuring that only authorized users retain access. This satisfies regulatory requirements like SOX, GDPR, or HIPAA by providing attestation workflows and audit trails.

Answer

Identity Protection

Answer

B2B Collaboration

Question 14

Your company, Fabrikam Inc., uses Microsoft Entra ID with hybrid identity. You have an on-premises Active Directory and use Microsoft Entra Connect Sync to synchronize users. You need to configure Microsoft Entra ID Protection to detect leaked credentials and risky sign-ins. Additionally, you must ensure that when a user is detected as high risk, their access is automatically blocked and they are required to change their password. You also need to enable password writeback so that password changes are written back to on-premises AD. You have the following options: A. Enable Identity Protection, configure user risk policy to require password change, and enable password writeback in Microsoft Entra Connect. B. Enable Identity Protection, configure sign-in risk policy to block access, and enable password hash sync. C. Configure Conditional Access policy to require MFA for all users, and enable seamless SSO. D. Deploy Microsoft Defender for Identity and configure automatic remediation. Which option should you choose?

Accepted Answer

Enable Identity Protection, configure user risk policy to require password change, enable password writeback. Option A is correct because it directly addresses all requirements: enabling Identity Protection allows detection of leaked credentials and risky sign-ins; configuring the user risk policy to require a password change automatically blocks high-risk users until they change their password; and enabling password writeback in Microsoft Entra Connect ensures that password changes performed in the cloud are written back to on-premises Active Directory, maintaining hybrid identity synchronization.

Answer

Enable Identity Protection, configure sign-in risk policy to block access, enable password hash sync

Answer

Deploy Microsoft Defender for Identity, configure automatic remediation

Answer

Configure Conditional Access policy to require MFA, enable seamless SSO

Question 15

Your organization uses Microsoft Entra ID P2 and Microsoft Defender for Cloud Apps. You need to protect a custom SaaS application that uses SAML-based SSO. The application does not support Conditional Access. You want to enforce session controls such as blocking downloads of sensitive files. What should you implement?

Accepted Answer

Deploy Microsoft Defender for Cloud Apps Conditional Access App Control and route the application through Defender for Cloud Apps.. Option A is correct because Microsoft Defender for Cloud Apps Conditional Access App Control acts as a reverse proxy that can enforce session policies—such as blocking downloads of sensitive files—on any SAML-based SaaS application, even if the application itself does not support Conditional Access. By routing the application's traffic through Defender for Cloud Apps, you can apply granular session controls at the proxy layer without modifying the application.

Answer

Implement a reverse proxy from a third-party vendor.

Answer

Create a custom application registration and set app roles.

Answer

Configure the application to use Microsoft Entra ID as the identity provider and enable Conditional Access policies.