MS-102 Practice Test 25 — 15 Questions

Question 1

A company uses dynamic groups based on department attribute. A user moved from Sales to Marketing but the group membership did not update after 48 hours. What should the admin do first?

Accepted Answer

Manually refresh the dynamic group in Azure AD. Microsoft Entra ID dynamic group membership evaluation is not instantaneous; it occurs on a periodic schedule. When a user's attribute changes, the admin can manually trigger a refresh by selecting 'Refresh' on the dynamic group's overview page in the Azure portal, which forces an immediate evaluation of the membership rules. This is the first troubleshooting step before waiting longer or using other methods.

Answer

Delete and recreate the group

Answer

Run a PowerShell script to update membership

Answer

Wait another 24 hours

Question 2

The legal department is investigating a potential data breach involving a specific user. The compliance officer needs to place a hold on all content in the user's Exchange Online mailbox and OneDrive for Business to prevent deletion until the investigation is complete. Which Microsoft Purview solution should the officer use?

Accepted Answer

eDiscovery (Standard). eDiscovery (Standard) allows you to place a hold on Exchange Online mailboxes and OneDrive for Business sites to preserve content from deletion during an investigation. This hold prevents users and automated processes from permanently deleting items, ensuring data integrity for legal or compliance reviews.

Answer

Content Search

Answer

eDiscovery (Premium)

Answer

Audit log

Question 3

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious LDAP query from a domain controller. After investigating, you determine the query is legitimate. How should you prevent future alerts for this activity?

Accepted Answer

Create a suppression rule for that alert type and entity.. Microsoft Defender for Identity suppression rules are the designed mechanism for silencing alerts that have been triaged as benign. A suppression rule scoped to the specific alert type (e.g., 'Suspicious LDAP query') and the specific entity (the domain controller or account) prevents future identical alerts from being raised without weakening detection for the rest of the environment. This preserves the integrity of the detection pipeline while eliminating noise from known-good activity.

Answer

Create a custom detection rule to allow the LDAP query.

Answer

Disable the Defender for Identity sensor on the domain controller.

Answer

Change the alert severity to Low.

Question 4

Refer to the exhibit. You are analyzing a KQL query in Microsoft Defender XDR Advanced Hunting. The query returns a list of devices where PowerShell or cmd.exe with encoded commands executed more than 5 times in the last 7 days. The security team suspects that one of the devices is compromised due to excessive use of encoded commands. However, a legitimate administrative script uses encoded commands regularly. How can you refine the query to reduce false positives while still detecting potentially malicious activity?

Accepted Answer

Add a filter to exclude processes signed by a trusted certificate or running under specific service accounts.. Adding a filter to exclude processes signed by a trusted certificate or running under specific service accounts directly addresses the legitimate administrative script that uses encoded commands. This refinement reduces false positives by allowing trusted, signed executables or known service accounts to bypass detection, while still flagging unsigned or anomalous encoded command executions that are more likely malicious. In Microsoft Defender XDR Advanced Hunting, you can use the `SigningCertificate` or `InitiatingProcessAccountName` fields in the KQL query to implement this exclusion.

Answer

Increase the Count threshold to 10.

Answer

Remove cmd.exe from the FileName filter.

Answer

Change the time range to 1 day instead of 7 days.

Question 5

Your organization uses Microsoft Defender XDR and Microsoft 365 E5 licenses. You need to ensure that when a user is determined to be compromised (e.g., due to a leaked credential), all active sessions are terminated and the user is required to re-authenticate with multi-factor authentication (MFA). You want to automate this process as much as possible. What should you do?

Accepted Answer

In Microsoft Defender for Cloud Apps, create a session policy with the 'Suspend user' governance action and configure it to revoke sessions and require re-authentication.. Microsoft Defender for Cloud Apps can create a session policy with the 'Suspend user' governance action, which integrates with Microsoft Entra ID to revoke all active sessions and require the user to re-authenticate with MFA. This automates the process of terminating sessions and enforcing re-authentication when a user is compromised. Option B is incorrect because disabling the user account terminates sessions but does not require MFA re-authentication for future access. Option C is incorrect because a conditional access policy requiring MFA for all users does not terminate existing sessions; it only applies to new authentication requests. Option D is incorrect because manually resetting the password and signing out of sessions is not automated and does not leverage the capabilities of Microsoft Defender XDR and Microsoft 365 E5 licenses.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Create a conditional access policy that requires MFA for all users.

Answer

Manually reset the user's password and sign out of all sessions.

Question 6

Your organization uses Microsoft Entra ID to manage user identities. You need to ensure that users can sign in using their existing social media accounts, such as Google or Facebook. Which identity solution should you configure?

Accepted Answer

External identities. External identities in Microsoft Entra ID allow you to configure identity providers such as Google and Facebook, enabling users to sign in with their existing social media accounts. This is achieved by setting up federation with OAuth 2.0 and OpenID Connect protocols, which is the correct solution for the scenario described.

Answer

Microsoft Entra B2B collaboration

Answer

Managed identities

Answer

Microsoft Entra Identity Protection

Question 7

You are a Microsoft 365 administrator. Users report that they cannot create Microsoft Teams meetings using the Teams desktop client. They receive an error: 'Meeting creation is disabled by your IT administrator.' You need to enable meeting creation. You check the Teams admin center and find that meeting policies are set to 'Off' for 'Allow private meeting scheduling'. However, after changing it to 'On', users still get the error. What is the most likely cause?

Accepted Answer

The user's mailbox is still on-premises and not migrated to Exchange Online.. The error persists because the user's mailbox is still on-premises and not migrated to Exchange Online. Microsoft Teams relies on Exchange Online for scheduling features, including private meeting creation. Even with the meeting policy set to 'On', if the mailbox is on-premises, the Teams client cannot communicate with Exchange Online to create the meeting, resulting in the error.

Answer

The user does not have an OAuth 2.0 token.

Answer

The global meeting policy is overriding the user-level policy.

Answer

The user does not have a Microsoft Teams license assigned.

Question 8

Your company has a Microsoft 365 E5 tenant. You need to ensure that all external emails are marked with a warning banner at the top of the email body. What should you configure?

Accepted Answer

A mail flow rule (transport rule) to add a disclaimer.. A mail flow rule (transport rule) in Exchange Online can be configured to prepend a disclaimer (warning banner) to the body of all external emails. This is the only mechanism that directly modifies the email body content for inbound or outbound messages based on sender/recipient criteria, such as when the sender is external to the organization.

Answer

A Safe Attachments policy in Microsoft Defender for Office 365.

Answer

External email tagging in the Microsoft 365 Defender portal.

Answer

A DLP policy with a sensitive information type.

Question 9

A company is deploying Microsoft Defender for Office 365 to protect against advanced threats. Which two features are available only in Defender for Office 365 Plan 2 and not in Plan 1? (Choose two.)

Accepted Answer

Automated Investigation & Response. Options A and E are correct. Automated Investigation & Response (AIR) and Threat Explorer are only available in Defender for Office 365 Plan 2. Anti-phishing, Safe Attachments, and Safe Links are available in both Plan 1 and Plan 2.

Answer

Anti-phishing

Answer

Safe Attachments

Answer

Safe Links

Question 10

You are designing an incident response plan using Microsoft Defender XDR. You want to automate the containment of compromised devices when a high-severity incident is detected. What should you configure?

Accepted Answer

Enable automated investigation and response (AIR) in Microsoft Defender XDR. C is correct because automated investigation and response (AIR) in Microsoft Defender XDR can automatically contain devices when a high-severity incident is detected. A is incorrect because custom detection rules in Microsoft Defender for Endpoint only create alerts; they do not automatically contain devices. B is incorrect because device groups are used for management and policy assignment, not for automated containment. D is incorrect because playbooks in Microsoft Sentinel require manual triggering or other automation; they are not configured within Defender XDR.

Answer

Configure custom detection rules in Microsoft Defender for Endpoint

Answer

Configure device groups in Microsoft Defender for Endpoint

Answer

Create a playbook in Microsoft Sentinel

Question 11

You are configuring Microsoft Entra ID for a new organization. The CIO wants to ensure that all external users who are invited to collaborate via Microsoft Entra B2B must go through an approval process before gaining access. Which setting should you configure?

Accepted Answer

Set 'External collaboration settings' to restrict invitations to specific admins. The 'External collaboration settings' in Microsoft Entra ID allow you to restrict who can invite external users. By setting the invitation restriction to 'Only users assigned to specific admin roles can invite', you ensure that all B2B collaboration invitations must be initiated by authorized admins, effectively requiring an approval process before external users gain access.

Answer

Create a Conditional Access policy requiring approval for external users

Answer

Enable guest self-service sign-up via user flows

Answer

Enable Identity Protection for guest users

Question 12

Your organization uses Microsoft Defender for Cloud Apps. You need to generate alerts when a user downloads a large number of files from Microsoft SharePoint Online in a short period. What should you create?

Accepted Answer

Activity policy. Activity policies in Defender for Cloud Apps allow you to create custom rules to detect specific activities like mass download. Option A (App Discovery policy) is used to discover apps in use in your organization. Option C (Anomaly Detection policy) is for pre-built anomalies. Option D (Cloud Discovery policy) is for shadow IT.

Answer

App Discovery policy

Answer

Anomaly Detection policy

Answer

Cloud Discovery policy

Question 13

Your organization uses Microsoft Entra ID and requires that all guest users must have a mobile phone number registered for authentication. You need to enforce this requirement. What should you configure?

Accepted Answer

Configure the Authentication methods policy to require mobile phone registration for guests.. The Authentication methods policy in Microsoft Entra ID allows you to define which authentication methods are available to users, including guest users. By configuring this policy to require mobile phone registration, you enforce that all guest users must register a mobile phone number for authentication, directly addressing the requirement.

Answer

Create a Terms of Use policy that guests must accept.

Answer

Configure a Conditional Access policy requiring multifactor authentication for guest users.

Answer

Create an access review for guest users in Identity Governance.

Question 14

You are configuring Microsoft Defender for Identity. Which THREE capabilities does it provide?

Accepted Answer

Detection of compromised accounts through behavioral analytics.. Options B, C, and E are correct because Microsoft Defender for Identity provides detection of compromised accounts through behavioral analytics (B), detection of reconnaissance activities such as LDAP enumeration (C), and detection of lateral movement between domain-joined machines (E). Option A is incorrect because scanning email attachments for malware is a feature of Microsoft Defender for Office 365, not Defender for Identity. Option D is incorrect because creation of data loss prevention (DLP) policies is a feature of Microsoft Purview, not Defender for Identity.

Answer

Scanning of email attachments for malware.

Answer

Creation of data loss prevention (DLP) policies.

Question 15

A compliance officer needs to automatically apply a sensitivity label to all documents in SharePoint Online that contain a credit card number. The label must mark the document as 'Confidential' and encrypt it. Which two Microsoft Purview components must be configured to achieve automatic labeling based on sensitive content? (Choose two.)

Accepted Answer

Sensitivity label. Sensitivity labels define the classification and protection settings (e.g., 'Confidential' marking and encryption). Auto-labeling policies automatically apply those labels to documents containing sensitive information types, such as credit card numbers, without requiring user intervention. Together, they enable automatic labeling based on sensitive content in SharePoint Online.

Answer

Data Loss Prevention (DLP) policy

Answer

Retention label policy