MS-102 Practice Test 4 — 25 Questions

Question 1

A company uses Microsoft Entra ID P2 licenses and wants to block all authentication attempts from an internal legacy application that uses POP3 and SMTP protocols. The application cannot be updated and must be blocked from accessing Exchange Online. Which Conditional Access policy setting should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Under 'Conditions' > 'Client apps', configure to block 'Exchange ActiveSync clients and other clients'. The legacy application uses POP3 and SMTP, which are non-modern authentication protocols. In Conditional Access, the 'Client apps' condition includes a setting to block 'Exchange ActiveSync clients and other clients', which specifically targets legacy authentication protocols like POP3, SMTP, and IMAP. This allows the administrator to block all authentication attempts from such clients without affecting modern authentication flows.

Answer

Under 'Grant', select 'Block access'

Answer

Under 'Conditions' > 'Device platforms', select 'Android' and 'iOS' and block them

Answer

Under 'Conditions' > 'Locations', select 'All trusted locations' and block

Question 2

A new employee has been hired and their account already exists in the on-premises Active Directory. The administrator needs to provide the employee with access to Microsoft 365 services as quickly as possible. What is the most efficient way to enable the user?

Accepted Answer

Sync the on-premises user using Azure AD Connect and then assign the license.. The user already exists in on-premises Active Directory, and the fastest way to enable Microsoft 365 access is to synchronize that identity using Microsoft Entra Connect. Once synchronized, the user object appears in Microsoft Entra ID (formerly Azure AD), and the administrator can immediately assign a license without re-creating the account. This avoids the delays of manual creation or guest invitations and leverages the existing identity lifecycle.

Answer

Create a new cloud-only user in the Microsoft 365 admin center and assign a license.

Answer

Manually create a user in Microsoft Entra ID with the same name and assign license.

Answer

Use Azure AD B2B collaboration to invite the on-premises user as a guest.

Question 3

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their Google Workspace credentials without creating external identities. What should you configure?

Accepted Answer

Configure SAML/WS-Fed identity provider federation with Google Workspace. Configuring SAML/WS-Fed identity provider federation with Google Workspace allows users to sign in using their Google Workspace credentials directly, without creating external identities. This federation establishes a trust relationship between Microsoft Entra ID and Google Workspace as an identity provider, enabling seamless authentication for users who already have Google accounts.

Answer

Enable Microsoft Entra Verified ID for Google Workspace users

Answer

Configure Google as a social identity provider in Microsoft Entra External ID

Answer

Configure Microsoft Entra B2B collaboration with Google Workspace

Question 4

The exhibit shows a KQL query used in Microsoft 365 Defender. The query returns no results for admin@contoso.com. What is the most likely reason?

Accepted Answer

Microsoft Defender for Identity is not enabled for the tenant.. The KQL query uses the `IdentityLogonEvents` table, which is populated by Microsoft Defender for Identity (MDI). If MDI is not enabled for the tenant, this table contains no data, so the query returns no results regardless of the user's role or query syntax. The query itself is syntactically correct and the role name 'GlobalAdministrator' is valid, but without MDI being provisioned, the table is empty.

Answer

The user does not have the Global Administrator role.

Answer

The KQL query syntax is invalid.

Answer

The role name in the query is misspelled.

Question 5

Your organization has a hybrid identity with Microsoft Entra Connect. You need to migrate from federation to password hash synchronization with seamless single sign-on (SSO). The migration must have minimal user impact. Which tool should you use?

Accepted Answer

Microsoft Entra Connect migration tool (Convert domain from federated to managed). The Microsoft Entra Connect migration tool (Convert domain from federated to managed) is the correct choice because it automates the conversion of federated domains to managed domains while enabling password hash synchronization (PHS) and seamless SSO. This tool minimizes user impact by allowing a staged migration where users can continue authenticating via federation until the conversion is complete, and it handles the necessary configuration changes in Microsoft Entra ID and on-premises Active Directory.

Answer

IdFix tool

Answer

AD FS Management console

Answer

Azure AD Connect wizard

Question 6

Drag and drop the steps to configure Microsoft 365 Groups expiration policy in the correct order.

Accepted Answer

Step 1: Go to Microsoft 365 admin center > Groups > Expiration. Step 2: Set the expiration duration. Step 3: Configure notification settings. Step 4: Save the policy.. Groups expiration policy is set in the admin center with a duration, notification owner, and deletion behavior.

Answer

Step 1: Set the expiration duration. Step 2: Go to Microsoft 365 admin center > Groups > Expiration. Step 3: Configure notification settings. Step 4: Save the policy.

Answer

Step 1: Go to Microsoft 365 admin center > Groups > Expiration. Step 2: Configure notification settings. Step 3: Set the expiration duration. Step 4: Save the policy.

Answer

Step 1: Go to Microsoft 365 admin center > Groups > Expiration. Step 2: Set the expiration duration. Step 3: Save the policy. Step 4: Configure notification settings.

Question 7

You are the Microsoft 365 Administrator for a multinational organization that must comply with various regulatory requirements, including GDPR, SOX, and internal data retention policies. You are deploying Microsoft Purview compliance solutions. Which four of the following actions are valid steps when managing compliance using Microsoft Purview? (Choose all that apply. There are four correct answers.)

Accepted Answer

Configure a sensitivity label with sublabels that apply different markings (e.g., 'Confidential' and 'Highly Confidential') to the same document.. Creating a DLP policy that prevents sharing credit card numbers via email with external recipients is a valid step because Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive information types (e.g., credit card numbers) and enforce actions such as blocking external sharing. This directly supports compliance with regulations like GDPR and SOX by preventing unauthorized data exfiltration.

Answer

Apply a sensitivity label to a SharePoint site that blocks all external sharing of documents stored in that site.

Answer

Assign a retention policy to a user's mailbox that deletes all emails immediately after they are sent.

Question 8

You are planning the initial deployment of a new Microsoft 365 tenant for Contoso Ltd. Which three of the following actions are required or recommended as part of the tenant provisioning and initial configuration process? (Choose three.)

Accepted Answer

Create the initial global administrator account with a strong, unique password and enable multi-factor authentication.. Registering and verifying a custom domain (e.g., contoso.com) via a DNS TXT record is a required step to use your own domain for email and user identities instead of the default onmicrosoft.com domain. Creating the initial global administrator account with a strong password and enabling multi-factor authentication (MFA) is a critical security best practice and is recommended by Microsoft to protect the highest-privileged role. Configuring tenant-wide service settings, such as external sharing for SharePoint and OneDrive, is recommended during initial setup to align with organizational security and collaboration policies before users begin working.

Answer

Set up a secondary domain as the default email domain to avoid conflicts with the initial onmicrosoft.com domain.

Answer

Configure the default tenant-level password expiration policy to 90 days using the Microsoft 365 admin center.

Answer

Assign Microsoft 365 licenses to all user accounts before creating the accounts.

Question 9

Match each Microsoft 365 service to its primary purpose.

Accepted Answer

Exchange Online: Email hosting and calendaring. The correct matches associate Exchange Online with email and calendaring, SharePoint Online with document management and collaboration, Microsoft Teams with chat and meetings, and OneDrive for Business with personal cloud storage. Common confusions include misassigning Exchange's purpose to OneDrive or OneDrive's purpose to SharePoint.

Answer

OneDrive for Business: Email hosting and calendaring

Answer

SharePoint Online: Personal cloud storage

Question 10

An organization needs to restrict access to Microsoft 365 admin center to only specific users. Which approach should be used?

Accepted Answer

Create a Conditional Access policy targeting the Microsoft Admin Portals cloud app. A Conditional Access policy targeting the 'Microsoft Admin Portals' cloud app allows granular control over which users can access the Microsoft 365 admin center. This policy can enforce conditions such as user/group membership, device compliance, or location to restrict access, ensuring only specific authorized users can reach the admin portals.

Answer

Enable MFA for all admins

Answer

Assign Global Admin role only to required users

Answer

Use Privileged Identity Management

Question 11

Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM) to manage administrative roles. You need to ensure that when a user activates the Global Administrator role, they must provide a justification and the activation is time-bound. Additionally, you want to require approval from the security team for this activation. What should you configure?

Accepted Answer

Modify the PIM role settings for Global Administrator to require justification, set maximum activation duration, and require approval. Privileged Identity Management (PIM) role settings allow you to enforce activation requirements such as justification, maximum activation duration, and approval. These settings are configured directly in the PIM role settings for the Global Administrator role, ensuring that every activation request is justified, time-bound, and requires approval from designated approvers (e.g., the security team).

Answer

Configure an Identity Protection user risk policy for Global Administrators

Answer

Create an Access Review for Global Administrator role

Answer

Configure a Conditional Access policy requiring MFA for Global Administrator activation

Question 12

A compliance officer needs to prevent users from sending emails that contain credit card numbers to external recipients. When a user attempts to send such an email, the action should be blocked and a policy tip should be displayed in Outlook telling them why the email was blocked. Which Microsoft Purview solution should be configured?

Accepted Answer

Data Loss Prevention (DLP) policy. A Data Loss Prevention (DLP) policy in Microsoft Purview is designed to detect and block sensitive information, such as credit card numbers, from being sent to external recipients. When configured with a 'Block' action and a policy tip, it prevents the email from being sent and displays a customizable notification in Outlook explaining the reason. This directly meets the compliance officer's requirement to block the email and show a policy tip.

Answer

Retention label policy

Answer

Microsoft Purview Information Protection sensitivity label

Answer

Compliance Manager

Question 13

You manage a Microsoft 365 tenant for a multinational corporation. You need to implement Microsoft Purview Information Protection to automatically classify and protect documents containing credit card numbers. The solution must apply encryption automatically when a document is saved to SharePoint Online. What should you do?

Accepted Answer

Create an auto-labeling policy in Microsoft Purview that uses a sensitivity label configured with encryption.. To automatically classify and protect documents containing credit card numbers with encryption when saved to SharePoint Online, you should create an auto-labeling policy in Microsoft Purview that uses a sensitivity label configured with encryption. Auto-labeling policies can detect sensitive information types (e.g., credit card numbers) and automatically apply the label, which enforces encryption.

Answer

Create a DLP policy in Microsoft Purview that blocks sharing of documents containing credit card numbers.

Answer

Configure client-side labeling via Microsoft 365 Apps to prompt users to label documents.

Answer

Set a default sensitivity label for SharePoint Online document libraries.

Question 14

You are the Microsoft 365 administrator for a company that uses Microsoft 365 E5. The company has a hybrid deployment with Exchange Server 2019 on-premises and Exchange Online. You need to configure a mail flow rule that adds a disclaimer to all emails sent from on-premises mailboxes to external recipients. The disclaimer must be applied only to messages that originate from on-premises and are sent to external domains. What should you do?

Accepted Answer

Create a mail flow rule in the EAC in Exchange Online. Set the rule to apply to messages sent to 'Outside the organization'. Add a condition 'The sender is located' and select 'Inside the organization'. Add an action to prepend a disclaimer. Enable the rule.. In a hybrid deployment, on-premises mailboxes are considered part of the organization by Exchange Online. Therefore, a mail flow rule in Exchange Online that applies to messages sent to 'Outside the organization' and has a condition that the sender is located 'Inside the organization' will correctly match messages originating from on-premises mailboxes and sent to external recipients. The disclaimer action then adds the required text. This is the standard and most reliable method for applying disclaimers to outbound mail from on-premises senders in a hybrid environment.

Answer

Create a mail flow rule in the EAC in Exchange Online. Set the rule to apply to messages sent to 'Outside the organization'. Add a condition 'The sender is located' and select 'Inside the organization'. Add an action to prepend a disclaimer. Then create a second rule that applies to messages sent from on-premises mailboxes using a header condition, and block the first rule.

Answer

Create a mail flow rule in the EAC on the on-premises Exchange Server. Set the rule to apply to messages sent to 'Outside the organization'. Add an action to prepend a disclaimer. Enable the rule.

Answer

Create a mail flow rule in the Exchange admin center (EAC) in Exchange Online. Set the rule to apply to messages sent to 'Outside the organization'. Add a condition 'The sender is located' and select 'Outside the organization'. Add an action to prepend a disclaimer. Enable the rule.

Question 15

You are the Microsoft 365 administrator for a company that uses Microsoft 365 E5. The company has a Microsoft Entra tenant with 10,000 users. You need to ensure that when users sign in to Microsoft 365 from unmanaged devices, they are required to use multi-factor authentication (MFA) and cannot download files from SharePoint Online. Users on managed devices should not be prompted for MFA and should be able to download files. What should you configure?

Accepted Answer

Create a conditional access policy that targets all users and SharePoint Online, set the device state condition to 'Include: Unmanaged', and grant access with 'Require multifactor authentication' and 'Require app enforced restrictions'.. A conditional access policy targeting unmanaged devices with MFA and app enforced restrictions ensures that users on unmanaged devices must use MFA and are subject to restrictions that prevent downloads from SharePoint Online. Managed devices are not targeted by this policy, so they are not prompted for MFA and can download files.

Answer

Create a conditional access policy that targets all users and SharePoint Online, set the device state condition to 'Include: Unmanaged', and grant access with 'Require multifactor authentication' and 'Require device to be marked as compliant'.

Answer

Create a conditional access policy that targets all users and SharePoint Online, set the device state condition to 'Exclude: Unmanaged', and grant access with 'Require multifactor authentication' and 'Require app enforced restrictions'.

Answer

Create a conditional access policy that targets all users and SharePoint Online, set the device state condition to 'Include: Unmanaged', and grant access with 'Require device to be marked as compliant' and 'Require app enforced restrictions'.

Question 16

You are a compliance administrator for Contoso Ltd. The company uses Microsoft Purview Information Protection with sensitivity labels. A new regulation requires that all documents labeled 'Highly Confidential' must be encrypted and only accessible by members of the 'Legal' group, even when shared externally. You have published a label named 'Highly Confidential' with encryption settings. You need to ensure that the label enforces these requirements when applied to documents in Office apps. What should you configure in the label's encryption settings?

Accepted Answer

Assign permissions to the 'Legal' group with 'Viewer' role, and clear the option 'Let users assign permissions'.. To enforce that only the Legal group can access documents labeled 'Highly Confidential', the encryption settings must assign permissions exclusively to that group and prevent users from changing those permissions. Assigning Viewer role limits access to read-only for Legal, and disabling user assignment ensures the label's protection cannot be overridden. This meets the regulatory requirement for encryption and access control.

Answer

Assign permissions to the 'Legal' group with 'Viewer' role and set 'Do not forward' for the content.

Answer

Assign permissions to the 'Legal' group with 'Viewer' role and enable 'Let users assign permissions'.

Answer

Assign permissions to the 'Legal' group with 'Co-Author' role and set an expiration date for the content.

Question 17

You are a security administrator for a company that uses Microsoft Defender XDR. A security incident involving a compromised user account has been escalated. You need to identify all devices where the compromised user account signed in within the last 7 days. Which Microsoft Defender XDR feature should you use?

Accepted Answer

Advanced hunting with the IdentityLogonEvents table. Advanced hunting with the IdentityLogonEvents table provides a comprehensive view of sign-in events across devices, including those from Defender for Identity. By querying this table for the compromised user and a 7-day timeframe, you can accurately list all devices where the account signed in, enabling effective incident response.

Answer

Incident queue filtered by the user's email address

Answer

Device inventory filtered by the user's primary email

Answer

Microsoft Defender for Cloud Apps activity log

Question 18

You have a Microsoft 365 E5 tenant with Microsoft Defender for Cloud Apps. You need to discover unsanctioned cloud apps used by users. What should you configure?

Accepted Answer

Microsoft Defender for Cloud Apps Cloud Discovery. Microsoft Defender for Cloud Apps Cloud Discovery is the correct feature for identifying unsanctioned cloud apps used in your environment. It analyzes traffic logs from your network or endpoints to discover all cloud app usage, categorizes them by risk, and allows you to sanction or unsanction them. This directly fulfills the requirement to discover unsanctioned cloud apps.

Answer

Conditional Access App Control

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Defender for Endpoint App Control

Question 19

Your organization uses Microsoft 365 E5 with Microsoft Entra ID P2. You have a hybrid identity environment with Microsoft Entra Connect Sync. You need to ensure that when a user is disabled in on-premises Active Directory, their Microsoft 365 access is blocked within 5 minutes, and any active refresh tokens are invalidated. You have already configured password hash synchronization. What should you do?

Accepted Answer

Configure Microsoft Entra Connect Sync to synchronize the 'accountEnabled' attribute and enable Continuous Access Evaluation (CAE) in Microsoft Entra ID.. Synchronizing the accountEnabled attribute from on-premises Active Directory ensures that disabled accounts are reflected in Microsoft Entra ID. Enabling Continuous Access Evaluation (CAE) allows Microsoft 365 services to respond to critical events like account disablement in near real-time, invalidating refresh tokens within minutes. Together, they meet the 5-minute blocking requirement.

Answer

Enable Microsoft Entra Password Protection and configure a custom banned password list.

Answer

Enable 'Enable password hash synchronization' and set the 'User must change password at next logon' flag in on-premises Active Directory.

Answer

Configure Microsoft Entra Connect Sync to synchronize the 'accountEnabled' attribute and enable 'Enable soft match' on the connector.

Question 20

You are a security administrator. You need to ensure that email messages containing malicious attachments are automatically removed from all mailboxes in your organization after delivery. Which Microsoft Defender for Office 365 feature should you configure?

Accepted Answer

Zero-hour auto purge (ZAP). Zero-hour auto purge (ZAP) is the Defender for Office 365 feature that retroactively removes malicious messages from Exchange Online mailboxes after delivery. It works with Safe Attachments and Safe Links to detect threats post-delivery and automatically purge them, which is exactly what the administrator needs.

Answer

Safe Links

Answer

Anti-phishing

Answer

Safe Attachments