MS-102 Practice Test 4 — 25 Questions

Question 1

A company must ensure that all outgoing emails containing credit card numbers are blocked from being sent to external recipients. When a user attempts to send such an email, it should be blocked immediately, and the user should see a policy tip explaining the rule. Which Microsoft Purview solution should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data Loss Prevention (DLP) policy. A Data Loss Prevention (DLP) policy is the correct solution because it is specifically designed to detect sensitive information, such as credit card numbers, in transit (email) and enforce real-time actions like blocking the message and displaying a policy tip to the user. DLP policies in Microsoft Purview can be configured with conditions that match credit card number patterns using built-in sensitive info types, and the action 'Block messages' with a policy tip notification is available for Exchange Online mail flow. This ensures immediate blocking and user notification without requiring any manual labeling or classification.

Answer

Sensitivity labels

Answer

Retention labels

Answer

Communication compliance

Question 2

Your organization uses Microsoft Entra ID and has strict security requirements. You need to implement a Zero Trust security model. Which THREE of the following are foundational principles of Zero Trust that should be implemented?

Accepted Answer

Use least privilege access. Least privilege access is a foundational principle of Zero Trust, ensuring users and devices are granted only the minimum permissions necessary to perform their tasks. In Microsoft Entra ID, this is implemented through features like Privileged Identity Management (PIM) and conditional access policies that restrict access based on role and context, reducing the attack surface.

Answer

Assume trust based on location

Answer

Segment access

Question 3

A company has a Microsoft 365 tenant with domain contoso.com. They own an additional domain fabrikam.com and have already added and verified it with a TXT record. Now they need to configure email to be routed to Exchange Online for fabrikam.com. Which DNS record must they create?

Accepted Answer

MX record pointing to contoso-com.mail.protection.outlook.com. To route email for fabrikam.com to Exchange Online, you must create an MX record that points to the Exchange Online mail exchanger. The correct target is contoso-com.mail.protection.outlook.com, where 'contoso-com' is the hashed version of the primary domain (contoso.com) used by Microsoft 365. This MX record tells the internet's mail servers to deliver messages addressed to @fabrikam.com into the tenant's Exchange Online environment.

Answer

CNAME record for autodiscover

Answer

TXT record for SPF

Answer

SRV record for SIP

Question 4

You are a Microsoft 365 administrator. A user reports that they cannot send emails to a specific external domain. You check the Exchange Admin Center and see that the domain is not blocked. What should you check next?

Accepted Answer

Check the mail flow rules (transport rules) in Exchange Online.. Mail flow rules (transport rules) in Exchange Online can block or redirect messages based on conditions like sender, recipient domain, or message content, even if the domain is not listed in any block list. Since the domain is not blocked in the spam filter or outbound policies, a transport rule is the most likely cause of the issue, as it can silently reject or quarantine messages without appearing in the standard block lists.

Answer

Verify that the user has a full mailbox and is not over the send limit.

Answer

Review the outbound spam filter policy.

Answer

Check the spam filter policy to see if the domain is on the blocked sender list.

Question 5

Your organization plans to migrate from on-premises Exchange to Exchange Online. You need to ensure minimal disruption during the migration. Which approach should you recommend?

Accepted Answer

Deploy a hybrid configuration and migrate mailboxes in batches.. A hybrid migration allows you to gradually move mailboxes while maintaining coexistence, minimizing disruption. Option B (cutover migration) is disruptive and only suitable for small organizations. Option C (IMAP migration) does not fully migrate calendar or contacts. Option D (third-party tool) is unnecessary for standard migrations.

Answer

Perform a cutover migration during a weekend.

Answer

Use IMAP migration to migrate all mailboxes in parallel.

Answer

Use a third-party migration tool for a one-time bulk migration.

Question 6

Your company recently deployed Microsoft 365 Copilot. Users report that Copilot occasionally generates responses based on sensitive internal documents that should not be shared broadly. What should you configure to restrict Copilot's access?

Accepted Answer

Apply sensitivity labels to the documents and configure label scopes to exclude Copilot.. Sensitivity labels can be configured with a label scope that excludes Copilot from accessing the labeled content. By applying a 'Confidential' sensitivity label with the 'Copilot' scope deselected, you instruct Microsoft 365 Copilot to ignore those documents during response generation, preventing it from surfacing sensitive internal information.

Answer

Create Data Loss Prevention (DLP) policies to block sharing.

Answer

Remove the sensitive documents from SharePoint Online.

Answer

Configure Microsoft Search to exclude the sensitive documents.

Question 7

A security administrator wants to configure Microsoft Defender for Cloud Apps to block downloads of sensitive files from Salesforce to unmanaged devices in real time. Which Defender for Cloud Apps component must be configured?

Accepted Answer

Conditional Access App Control. Conditional Access App Control (CAAC) is the correct component because it enables real-time session-level monitoring and control of user activities in SaaS apps like Salesforce. By integrating with Azure AD Conditional Access, CAAC can enforce policies to block downloads of sensitive files to unmanaged devices at the moment of access, using reverse proxy architecture to inspect and intervene in the traffic.

Answer

Cloud Discovery

Answer

App Connectors

Answer

Activity policies

Question 8

A company is planning to migrate from on-premises Exchange to Exchange Online and needs to ensure that mail flow can coexist between the two environments during the transition. Which tool should the administrator use to configure this hybrid deployment?

Accepted Answer

Exchange Hybrid Configuration Wizard. The Exchange Hybrid Configuration Wizard (HCW) is the correct tool because it automates the configuration of coexistence features between on-premises Exchange and Exchange Online, including mail flow routing, free/busy sharing, and OAuth authentication. It generates the necessary connectors and settings to support a hybrid deployment, ensuring seamless mail flow during migration.

Answer

Azure AD Connect

Answer

Microsoft 365 Admin Center

Answer

Exchange Admin Center

Question 9

You manage Microsoft Defender for Endpoint. A device is showing as 'Inactive' in the device inventory. The device is turned on and connected to the network. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Endpoint sensor is not reporting. An 'Inactive' status in Microsoft Defender for Endpoint means the sensor has not communicated with the cloud service for a defined period (typically 7 days). Since the device is on and connected, the most likely cause is that the Microsoft Defender for Endpoint sensor is not reporting. Option A is incorrect because the device is explicitly stated as turned on. Option B, while a firewall could potentially block communication, is less likely than sensor failure, and Defender for Endpoint uses HTTPS which is typically allowed. Option D is incorrect because a failed onboarding script would prevent the device from appearing or show it as 'Not onboarded', not 'Inactive'.

Answer

The device is turned off

Answer

A firewall is blocking communication with the Microsoft Defender for Endpoint cloud service

Answer

The onboarding script was not run successfully

Question 10

You are investigating an incident in Microsoft Defender XDR. The incident involves multiple alerts from different sources. Which THREE actions should you take during the investigation?

Accepted Answer

Review the incident timeline to understand the sequence of events.. Options A, C, and D are correct because during investigation, you should analyze alerts, gather evidence, and isolate affected devices. Option B is wrong because immediately deleting all related emails may destroy evidence. Option E is wrong because resetting passwords should be done after analysis.

Answer

Delete all emails related to the incident from all mailboxes.

Answer

Reset the passwords of all user accounts involved.

Question 11

Your organization has Microsoft Defender for Office 365 Plan 2. You need to ensure that when a user reports a phishing email using the Report Message add-in, the email is automatically submitted to Microsoft for analysis and the user is notified of the result. What should you configure?

Accepted Answer

Configure a submission policy in the Microsoft 365 Defender portal. Configuring a submission policy in the Microsoft 365 Defender portal defines the behavior for user-reported messages using the Report Message add-in, including automatic submission to Microsoft for analysis and notification of results. Option A is incorrect because Safe Links policies protect users from malicious links, not handle user submissions. Option B is incorrect because anti-phishing policies detect and mitigate phishing attempts but do not control the submission process. Option C is incorrect because mail flow rules (transport rules) manage message routing and cannot submit messages to Microsoft for analysis or notify users of results.

Answer

Create a Safe Links policy to block the reported email

Answer

Configure an anti-phishing policy to automatically submit reported emails

Answer

Use a mail flow rule to send reported emails to a custom mailbox

Question 12

Your organization uses Microsoft Defender for Cloud Apps. You want to control the use of personal cloud storage apps. Which TWO actions should you take?

Accepted Answer

Create a session policy to monitor and control downloads to personal cloud storage apps.. The correct answers are D and E. Option D is correct because session policies in Microsoft Defender for Cloud Apps (via Conditional Access App Control) allow you to monitor and control downloads to personal cloud storage apps in real time. Option E is correct because app governance provides visibility into app permissions and behaviors, enabling you to monitor and control which apps can access cloud storage. Option A is incorrect because a DLP policy prevents sharing of sensitive data but does not control the use of personal cloud storage apps directly. Option B is incorrect because a conditional access policy requiring managed apps controls access to corporate resources but does not specifically govern personal cloud storage usage. Option C is incorrect because blocking all personal cloud storage apps is overly restrictive; Defender for Cloud Apps supports granular controls through policies rather than blanket blocks.

Answer

Create a DLP policy to prevent sharing of sensitive data to personal cloud storage apps.

Answer

Create a conditional access policy to require managed apps for cloud storage.

Answer

Block all personal cloud storage apps using Defender for Cloud Apps.

Question 13

A new helpdesk administrator needs to be able to reset user passwords and manage user account properties, but should not be able to manage licenses or assign administrative roles. Which built-in role should be assigned?

Accepted Answer

User Administrator. The User Administrator role in Microsoft Entra ID is the correct choice because it includes permissions to reset passwords, manage user account properties (such as display name, job title, and department), and manage user licenses, while explicitly excluding the ability to assign administrative roles. The Helpdesk Administrator role can reset passwords but cannot manage user account properties or licenses, and the License Administrator role can only manage licenses, not user properties. The Global Administrator role has full access, which exceeds the required permissions. Therefore, User Administrator is the appropriate role.

Answer

Global Administrator

Answer

License Administrator

Answer

Helpdesk Administrator

Question 14

A compliance officer needs to ensure that all documents in a Microsoft Teams channel are automatically retained for 3 years after creation and then permanently deleted. The retention policy should apply only to the specific channel, not the entire team. Which approach should the officer use?

Accepted Answer

Publish a retention label to the channel and configure auto-application rules based on creation date. Documents in a Teams channel are stored in SharePoint. To automatically retain and then delete documents, you need a retention label with auto-application rules scoped to the channel's SharePoint site. This ensures documents are retained for 3 years from creation and then permanently deleted, without affecting other content.

Answer

Create a retention policy in Microsoft Purview and select the location 'Teams channel messages', then specify the channel name

Answer

Create a retention policy in Microsoft Purview and select the location 'Teams chats' for the entire team

Answer

Use Exchange Online PowerShell to create a retention policy for the channel mailbox

Question 15

Which TWO Microsoft Purview solutions are primarily used for data classification?

Accepted Answer

Auto-labeling. Auto-labeling applies labels based on sensitive info types. Sensitivity labels are the classification labels themselves. DLP is for protection. Data Lifecycle Management is for retention. Communication Compliance is for monitoring.

Answer

Data Loss Prevention

Answer

Communication Compliance

Answer

Data Lifecycle Management

Question 16

Your organization uses Microsoft Purview Information Protection. You need to ensure that when users manually apply a 'Confidential' label to a document in Word, the document is automatically marked with a footer 'CONFIDENTIAL' and encrypted. What must you configure?

Accepted Answer

Configure the sensitivity label's settings to include the footer and encryption.. D is correct because sensitivity labels include built-in settings for markings (like footers) and encryption, which are configured within the label's properties. Option A is incorrect because the sensitivity label policy determines which labels are published to users, but the actual marking and encryption settings are defined in the label itself, not in the policy. Option B is incorrect because DLP rules apply to data loss prevention scenarios, not to sensitivity label application; they cannot be used to apply footers or encryption when a user manually applies a label. Option C is incorrect because auto-labeling is used for automatically applying labels based on conditions, not for manual labeling scenarios.

Answer

Modify the sensitivity label policy to include the footer.

Answer

Create a DLP rule that applies the footer and encryption.

Answer

Set up auto-labeling to apply the footer and encryption.

Question 17

You are planning a Microsoft 365 tenant migration from another tenant. You need to migrate email, OneDrive, and SharePoint content. Which THREE tools or methods can you use to migrate data?

Accepted Answer

Microsoft 365 Migration Manager. Microsoft 365 Migration Manager (A) is a native tool in the admin center that supports cross-tenant migrations for Exchange Online, OneDrive, and SharePoint, making it suitable for this scenario. Third-party tools like BitTitan MigrationWiz (C) are widely used for tenant-to-tenant migrations and can handle all three workloads. PowerShell scripts using Microsoft Graph API (E) allow custom migration scripts to migrate email, OneDrive, and SharePoint data, providing flexibility. Option B (Microsoft Teams admin center) is incorrect because it is for managing Teams settings, not migrating content. Option D (Exchange Admin Center migration tools) is incorrect because those tools are limited to mailbox migrations and do not cover OneDrive or SharePoint.

Answer

Microsoft Teams admin center

Answer

Exchange Admin Center migration tools

Question 18

Your company recently merged with another company that uses Microsoft 365. Both tenants have the same primary domain, contoso.com. You need to merge the two tenants into a single tenant while preserving user email addresses. What should you do?

Accepted Answer

Remove the domain from the source tenant and add it to the target tenant, then migrate users.. To merge two Microsoft 365 tenants with the same domain, you must remove the domain from the source tenant, add it to the target tenant, and then migrate users' data. This preserves user email addresses because the domain is added to the target tenant before migration. Option B is the correct approach.

Answer

Use cross-tenant collaboration settings to share the domain.

Answer

Configure a domain sharing agreement between both tenants.

Answer

Set up a federation trust between the two tenants.

Question 19

A security administrator needs to view a unified incident queue that correlates alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. Which console should the administrator open?

Accepted Answer

Microsoft 365 Defender portal (security.microsoft.com). The Microsoft 365 Defender portal (security.microsoft.com) provides a unified incident queue that aggregates and correlates alerts from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This single-pane-of-glass view enables security administrators to investigate and respond to cross-domain threats without switching between separate consoles.

Answer

Azure Security Center

Answer

Microsoft Endpoint Manager admin center

Answer

Microsoft Purview compliance portal

Question 20

Your organization uses Microsoft Defender for Office 365. You have configured a safe attachment policy that should automatically detonate attachments in a sandbox before delivery. However, some users still receive malicious attachments. What should you check first?

Accepted Answer

Verify that the Safe Attachments policy is applied to the affected users and that the action is set to 'Dynamic Delivery' or 'Replace' (not 'Monitor').. Safe Attachments policies can be configured with actions like 'Dynamic Delivery' or 'Replace' to actively block or detonate attachments before delivery. If the action is set to 'Monitor', attachments are delivered first and only monitored, which can allow malicious attachments to reach users. Therefore, verifying the policy action is the first step to ensure detonation occurs before delivery.

Answer

Check whether a mail flow rule (transport rule) is bypassing Safe Attachments.

Answer

Check the Safe Links policy configuration.

Answer

Review the mailbox audit log for each affected user.