MS-102 Practice Test 24 — 15 Questions

Question 1

Your company uses Microsoft Entra ID with P2 licenses. You need to configure Privileged Identity Management (PIM) for Azure AD roles. Which THREE actions are possible with PIM?

Accepted Answer

Schedule start and end times for role assignments. PIM allows you to configure time-bound role assignments with specific start and end dates, enabling just-in-time access and reducing standing privileges. This is a core feature of PIM for Microsoft Entra ID roles, supporting both eligible and active assignments with scheduled durations.

Answer

Automatically assign a role to all users in a security group

Answer

Limit role activation to a specific device

Question 2

Your company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft Teams. Users are sharing credit card numbers in Teams chat messages. You have a DLP policy that detects credit card numbers and blocks the message. However, users report that they can still send messages containing credit card numbers without any block. What is the most likely reason?

Accepted Answer

The DLP policy for Teams is only applied when external users are part of the chat.. DLP for Teams chat messages only scans messages that include at least one user from outside the organization (external users). If both sender and recipient are internal, the policy does not apply. Option B is incorrect because DLP policies can be scoped to specific users. Option C is incorrect because Teams DLP policies cover both chat and channel messages. Option D is incorrect because DLP policies apply to both persistent and transient messages.

Answer

The DLP policy does not apply to transient messages like chat.

Answer

The DLP policy is not configured to include the users' group.

Answer

The DLP policy only applies to channel messages, not private chats.

Question 3

A security analyst identifies a malicious file hash on one endpoint. They need to ensure that file is blocked from executing on all other endpoints in the organization immediately. Which Microsoft Defender for Endpoint feature should be used?

Accepted Answer

Indicators of compromise (IOCs). Indicators of compromise (IOCs) in Microsoft Defender for Endpoint allow security analysts to create custom indicators (e.g., file hashes, IPs, URLs) that are enforced across all endpoints in near real-time. By adding the malicious file hash as an IOC with an 'Alert and Block' action, the file is immediately prevented from executing on any managed device, providing a rapid, organization-wide block without waiting for signature updates.

Answer

Attack surface reduction rules

Answer

Automated investigation and response

Answer

Custom detection rules

Question 4

Which TWO actions can an admin take to reduce the number of passwords in use for end users?

Accepted Answer

Enable Windows Hello for Business. Windows Hello for Business replaces traditional password authentication with strong two-factor authentication tied to a user's device, using biometrics or a PIN. This directly reduces the reliance on passwords for end users by enabling passwordless sign-in to Windows devices and integrated applications.

Answer

Enforce complex password policies

Answer

Configure self-service password reset

Answer

Implement password hash sync

Question 5

Match each Microsoft 365 networking port to its protocol.

Accepted Answer

443: HTTPS. Common Microsoft 365 networking ports: 443 (HTTPS), 587 (SMTP submission), 993 (IMAP SSL), 995 (POP3 SSL). Be careful not to confuse port numbers with different protocols.

Answer

443: POP3

Answer

995: SMTP

Question 6

You are designing a Microsoft Entra ID governance strategy. Which THREE features should you use to implement the principle of least privilege for administrative roles?

Accepted Answer

Privileged Access Groups. Privileged Access Groups (B) enable you to grant just-in-time or time-bound access to Microsoft Entra ID roles and other resources by assigning users to a group that is eligible for role activation, directly supporting the principle of least privilege by limiting standing administrative access.

Answer

Microsoft Entra Lifecycle Workflows

Answer

Microsoft Entra Entitlement Management

Question 7

Match each Microsoft 365 migration tool to its use case.

Accepted Answer

Exchange Migration (cutover): Migrate entire on-premises Exchange organization to Exchange Online in a single batch. Correct matches: Exchange Migration (cutover) migrates entire on-premises Exchange organization; SPMT migrates files and SharePoint content; Mover migrates files from cloud storage; Microsoft Entra Connect synchronizes identities. Common confusions include mixing the purpose of Mover with Exchange migration and SPMT with identity synchronization.

Answer

Exchange Migration (cutover): Migrate files from cloud storage providers to OneDrive

Answer

SharePoint Migration Tool: Synchronize on-premises identities

Question 8

As a Microsoft 365 administrator, you need to manage tenant health and adoption effectively. Which three of the following tools or features should you use to monitor and improve your Microsoft 365 tenant's performance and user engagement? (Choose three.)

Accepted Answer

Microsoft 365 Adoption Score (formerly Productivity Score) to track user engagement with Microsoft 365 apps.. The Microsoft 365 admin center dashboard provides a centralized view of service health, message center posts, and usage reports, enabling administrators to monitor service availability, planned changes, and user activity. This is a core tool for maintaining tenant health and tracking adoption.

Answer

Microsoft Purview compliance portal to enforce data loss prevention policies.

Answer

Microsoft 365 network connectivity test tool to evaluate network performance for Microsoft 365 services.

Answer

Azure AD Identity Protection to detect sign-in risks and block compromised accounts.

Question 9

Your organization has a Microsoft 365 E5 tenant. You want to ensure that all users are automatically signed in to Microsoft 365 apps using single sign-on (SSO) when they are on the corporate network. You have Azure AD joined the devices. What additional configuration is required?

Accepted Answer

No additional configuration is required; Azure AD joined devices provide SSO automatically.. Microsoft Entra ID joined devices are already registered with Microsoft Entra ID and use the Primary Refresh Token (PRT) to enable seamless SSO for Microsoft 365 apps without any additional configuration. When a user signs into a Windows 10/11 device that is Microsoft Entra ID joined, the PRT is obtained during the initial authentication and is automatically used for browser and app sign-ins on the corporate network. Therefore, no extra steps like enabling Seamless SSO or deploying certificates are needed.

Answer

Enable Azure AD Seamless Single Sign-On.

Answer

Configure Azure AD Application Proxy for each app.

Answer

Deploy a trusted certificate for the corporate network.

Question 10

Your organization uses Microsoft Entra ID P2 licenses. You need to configure a Conditional Access policy that requires phishing-resistant multifactor authentication (MFA) for all users accessing sensitive applications. Which authentication strength should you select in the policy?

Accepted Answer

Phishing-resistant MFA. The scenario explicitly requires 'phishing-resistant multifactor authentication (MFA).' Microsoft Entra ID authentication strengths allow you to enforce specific authentication methods. The 'Phishing-resistant MFA' strength includes methods like FIDO2 security keys and certificate-based authentication (CBA), which are resistant to phishing attacks. Selecting this strength ensures that only phishing-resistant methods are accepted for the Conditional Access policy.

Answer

Passwordless MFA

Answer

Multifactor authentication

Answer

No authentication strength

Question 11

Refer to the exhibit. You are reviewing an app registration in Microsoft Entra ID for the Microsoft Teams Admin Center. The permission shown is for another resource. What is the consequence of this permission configuration?

Accepted Answer

The app can access Microsoft Graph data without a signed-in user, and admin consent is required. The exhibit shows an application permission (not a delegated permission) for Microsoft Graph, which means the app can access data without a signed-in user. Admin consent is required because application permissions grant tenant-wide access and cannot be consented to by individual users. This is why option A is correct.

Answer

The app can only be used by users who have consented to the permission

Answer

The app can access Teams data but not other Microsoft 365 data

Answer

The app can access Microsoft Graph on behalf of the signed-in user only

Question 12

Your organization, Contoso, has a Microsoft Entra ID tenant with 50,000 users. You are implementing a zero-trust security model. The following requirements must be met: 1) All access to SaaS applications must be restricted based on user, device, and location. 2) Users accessing from unmanaged devices must only be allowed browser-based access and must accept terms of use. 3) The IT team must be able to grant temporary access to the Global Administrator role for up to 8 hours. 4) All external users must have their access reviewed every 6 months. Which combination of Microsoft Entra features should you use?

Accepted Answer

Conditional access policies, Privileged Identity Management (PIM), access reviews, and terms of use. It combines Conditional Access policies to enforce user, device, and location restrictions; Terms of Use to require acceptance for browser-based access from unmanaged devices; Privileged Identity Management (PIM) to grant time-limited Global Administrator access for up to 8 hours; and Access Reviews to ensure external users are reviewed every 6 months. This set directly addresses all four requirements without introducing unnecessary or conflicting features.

Answer

Conditional access policies, entitlement management, Privileged Identity Management (PIM), and access reviews

Answer

Conditional access policies, Microsoft Entra B2B, Privileged Identity Management (PIM), and access reviews

Answer

Conditional access policies, Identity Protection user risk policy, Privileged Identity Management (PIM), and access reviews

Question 13

Your organization uses Microsoft 365 Business Premium with Microsoft Entra ID P1. You have 200 users. You need to enforce multi-factor authentication (MFA) for all users accessing the company's CRM application, which is a third-party SaaS app integrated via SAML. The CRM app does not support modern authentication protocols. You want to use a Microsoft solution that does not require additional licenses. What should you use?

Accepted Answer

Create a Conditional Access policy targeting the CRM application and require MFA.. Conditional Access policies in Microsoft Entra ID P1 allow you to target specific cloud applications (including third-party SAML-integrated SaaS apps) and enforce MFA. Since the CRM app does not support modern authentication protocols, Conditional Access can still enforce MFA by requiring a compliant domain-joined device or by using app-enforced restrictions; however, the key is that Conditional Access works at the authentication plane and can require MFA even for legacy apps when combined with a capable authentication method like a one-time passcode or Microsoft Authenticator. This solution uses existing Microsoft Entra ID P1 licensing without additional costs.

Answer

Enable security defaults in Microsoft Entra ID.

Answer

Deploy Microsoft Entra application proxy for the CRM app.

Answer

Configure per-user MFA for users of the CRM app.

Question 14

You are implementing Microsoft Entra Verified ID to issue verifiable credentials to employees for proof of employment. Which component is required to issue and verify credentials?

Accepted Answer

A decentralized identifier (DID) and a trusted identity system. Microsoft Entra Verified ID uses a decentralized identity model where each issuer and verifier has a unique decentralized identifier (DID) and a trusted identity system (such as a blockchain-based ION network or a web-based DID method) to publish and resolve DID documents. The DID and the trusted identity system are the core components required to cryptographically sign verifiable credentials and verify them without relying on a central authority, making option D correct.

Answer

Microsoft Entra ID P2 licenses for all users

Answer

A certificate from a public certificate authority (CA)

Answer

An Azure AD B2C tenant

Question 15

Your company is implementing a Zero Trust security model. You need to ensure that all user access requests to corporate resources are verified continuously, not just at the initial sign-in. Which Microsoft Entra ID feature should you use?

Accepted Answer

Continuous Access Evaluation (CAE). Continuous Access Evaluation (CAE) is the correct choice because it enforces real-time token validation and policy enforcement for every access request, not just at initial authentication. CAE works by having critical events (e.g., user disablement, IP address change, or risk elevation) trigger a revocation message to the resource provider, which then immediately blocks access—even if the token is still valid. This aligns directly with the Zero Trust principle of 'verify explicitly and continuously' rather than relying on a one-time sign-in.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra Verified ID