MS-102 Practice Test 26 — 15 Questions

Question 1

An administrator wants to prevent users from inviting guest users from the domain 'contoso.com' to the tenant. The administrator needs to block all invitations for that specific domain while allowing invitations from all other external domains. Which setting in Microsoft Entra ID should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

External collaboration settings. External collaboration settings in Microsoft Entra ID (formerly Azure AD) allow administrators to configure domain-based restrictions for B2B collaboration invitations. By adding 'contoso.com' to the 'Deny list' under 'Cross-tenant access settings' or specifically within the 'External collaboration settings' blade, invitations to that domain are blocked while all other external domains remain allowed. This setting directly controls the guest invitation behavior at the domain level.

Answer

Cross-tenant access settings

Answer

User settings

Answer

Domain federation

Question 2

Your company is implementing Microsoft Purview Records Management. You need to ensure that invoices are retained for seven years after they are paid, and then automatically deleted. Which type of label should you create?

Accepted Answer

Retention label with disposition review after the trigger event. A retention label with a disposition review after a trigger event can automate deletion after a specified period (7 years) triggered by an event (invoice payment). Option A is incorrect because a disposition review label requires manual review before deletion, whereas the requirement is automatic deletion. Option B is incorrect because a retention policy applies to all documents in a location and cannot be scoped to specific items based on metadata like payment date. Option D is incorrect because sensitivity labels are for classification and protection, not retention management.

Answer

Disposition review label assigned to invoices

Answer

Retention policy applied to all documents in SharePoint

Answer

Sensitivity label with auto-labeling

Question 3

A compliance officer needs to mark documents in a SharePoint Online library as regulatory records. These records must be immutable (cannot be modified or deleted) for 3 years. After 3 years, a disposition review must be initiated to decide if the records can be deleted. Which Microsoft Purview solution should the officer configure?

Accepted Answer

Retention label configured to mark items as records with a retention period of 3 years and disposition review. A retention label configured to mark items as regulatory records enforces immutability (no modification or deletion) for the specified retention period of 3 years. After the retention period expires, the disposition review triggers a workflow where a reviewer must approve or reject deletion, meeting the compliance officer's requirement exactly.

Answer

Data Lifecycle Management retention policy with disposition review

Answer

Sensitivity label with encryption

Answer

eDiscovery case with hold

Question 4

An organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to create a policy that blocks users from pasting credit card numbers into web forms in Microsoft Edge. Which type of DLP policy should they configure?

Accepted Answer

Endpoint DLP. Endpoint DLP is correct because it monitors and controls activities on Windows 10/11 and macOS endpoints, including the ability to block pasting sensitive data like credit card numbers into web forms in Microsoft Edge. This policy extends DLP protection to unmanaged browsers and specific user actions, such as paste, clipboard, and print, which are not covered by cloud-based DLP policies.

Answer

Exchange DLP

Answer

SharePoint DLP

Answer

Teams DLP

Question 5

Your company uses Microsoft Entra ID and wants to use Microsoft's recommendation to protect against password spray attacks. Which feature should you enable?

Accepted Answer

Smart Lockout. Smart Lockout is Microsoft's recommended feature to protect against password spray attacks because it intelligently locks out bad actors after a threshold of failed attempts while allowing legitimate users to continue. It uses adaptive logic to distinguish between real users and attackers by considering the sign-in pattern and IP address, making it the correct choice for this specific threat.

Answer

Identity Protection

Answer

Password Hash Synchronization

Answer

Multifactor Authentication

Question 6

Your company uses Microsoft Intune for mobile device management. You need to ensure that only compliant devices can access corporate email in Microsoft 365. Which Microsoft Entra ID feature should you combine with Intune compliance policies?

Accepted Answer

Conditional Access. Conditional Access is the correct answer because it is the Microsoft Entra ID feature that enforces access controls based on signals such as device compliance. When combined with Intune compliance policies, Conditional Access can block or allow access to corporate email in Microsoft 365 based on whether the device is marked as compliant by Intune. This integration ensures that only devices meeting your organization's security requirements can access corporate resources.

Answer

Microsoft Entra Application Proxy

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Question 7

Your organization uses Microsoft Entra ID P2 licensing. You need to ensure that when a user's risk level is detected as 'high' by Identity Protection, the user is automatically required to perform a password change during their next sign-in. Which conditional access policy configuration should you use?

Accepted Answer

Assign 'User risk policy' with grant 'Require password change'. The 'User risk policy' in Microsoft Entra ID Conditional Access is specifically designed to respond to user-level risk detections from Identity Protection. When a user's risk level is 'high', the policy can enforce a 'Require password change' grant, which forces the user to change their password at next sign-in to remediate the compromised account. This aligns with the requirement to automatically trigger a password change based on user risk.

Answer

Assign 'Sign-in risk policy' with session control 'Sign-in frequency'

Answer

Assign 'User risk policy' with grant 'Require multifactor authentication'

Answer

Assign 'User risk policy' with grant 'Block access'

Question 8

A company uses Password Hash Synchronization (PHS) to synchronize identities to Microsoft Entra ID. They want to enable users to access Microsoft 365 applications from their domain-joined work devices without being prompted to re-enter their credentials. Which feature should they enable in addition to PHS?

Accepted Answer

Seamless Single Sign-On. Seamless Single Sign-On (SSO) is the correct feature to enable alongside Password Hash Synchronization (PHS) because it allows users on domain-joined devices to automatically authenticate to Microsoft 365 applications without being prompted for credentials. It works by integrating with Kerberos authentication, using a computer account in the on-premises Active Directory to issue a Kerberos ticket that Microsoft Entra ID can validate, eliminating the need for re-authentication.

Answer

Pass-through Authentication

Answer

Azure AD Connect Health

Answer

Conditional Access

Question 9

Your organization uses Microsoft Entra ID and has enabled Microsoft Entra ID Protection. You notice that the number of 'Leaked Credentials' detections is high. What action should you take to automatically remediate this risk?

Accepted Answer

Configure a user risk policy in Microsoft Entra ID Protection to require a password change for high-risk users. A user risk policy in Microsoft Entra ID Protection can be configured to automatically trigger a password change when a user is detected as high risk, such as when leaked credentials are identified. This policy directly remediates the risk by forcing the user to update their compromised credentials, effectively invalidating the leaked password. The other options either do not address the root cause or require manual intervention.

Answer

Use Microsoft Entra ID Protection to automatically reset passwords for all users with leaked credentials

Answer

Configure a conditional access policy to block access for users with high user risk

Answer

Enable Microsoft Entra ID Multifactor Authentication for all users

Question 10

A security administrator needs to block unsanctioned cloud apps in real time using a reverse proxy. Which two Microsoft Defender for Cloud Apps components must be configured?

Accepted Answer

Conditional Access App Control. Conditional Access App Control (B) is the reverse proxy component in Microsoft Defender for Cloud Apps that enforces real-time session-level monitoring and control of cloud app access. Session control policies (D) are the specific policy objects that define the actions (e.g., block download, block access) applied through that reverse proxy. Together, they enable blocking unsanctioned cloud apps in real time by intercepting user traffic via the reverse proxy architecture.

Answer

Cloud Discovery

Answer

App governance

Question 11

A security administrator wants to create a custom detection rule in Microsoft Defender XDR that alerts when a device initiates an outbound TCP connection to a known malicious IP address on a non-standard port (e.g., port 4444). Which advanced hunting table should be queried to find these network connections?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the correct table because it specifically captures network connection events, including outbound TCP connections to IP addresses and ports. This table contains fields like RemoteIP, RemotePort, and Protocol, making it ideal for detecting connections to known malicious IPs on non-standard ports such as 4444.

Answer

DeviceProcessEvents

Answer

EmailEvents

Answer

IdentityLogonEvents

Question 12

Your organization has a Microsoft 365 E5 subscription and uses Microsoft Entra ID. You are implementing Privileged Identity Management (PIM) to manage access to Azure AD roles. You need to ensure that when a user activates a privileged role, the activation request must be approved by their manager and must include a ticket number. What should you configure?

Accepted Answer

Modify the role settings in PIM to require approval and justification with ticket number. PIM role settings allow you to configure activation requirements, including requiring approval and mandating a justification field. By enabling 'Require approval to activate' and configuring the approver as the user's manager, and by setting 'Require ticket information on activation', you enforce that every activation request includes a ticket number and is routed to the manager for approval.

Answer

Create an access review for the role

Answer

Configure an access package in Entitlement Management

Answer

Use Conditional Access policy with session controls

Question 13

A security analyst is using Microsoft 365 Defender Advanced Hunting to investigate a potential malware outbreak. The analyst needs to find all devices where a specific signed executable (known to be malicious) was created in the past 24 hours. Which Advanced Hunting table should be queried to detect the creation of the executable file?

Accepted Answer

DeviceFileEvents. The DeviceFileEvents table in Microsoft 365 Defender Advanced Hunting captures file creation, modification, and deletion events. Since the question specifically asks for detecting the creation of a signed executable file, this table provides the necessary data, including file name, path, and timestamp, to identify when and where the malicious executable was created.

Answer

DeviceProcessEvents

Answer

DeviceNetworkEvents

Answer

DeviceRegistryEvents

Question 14

Your organization uses Microsoft Defender for Office 365. Users report that legitimate emails from a specific partner domain are being moved to Junk Email folder. You verify that the partner's SPF, DKIM, and DMARC records are correctly configured. Which two actions should you take to resolve this issue?

Accepted Answer

Review the Anti-Phishing policy's spoof intelligence settings.. Legitimate emails from a partner domain are being moved to Junk Email folder despite correct SPF, DKIM, and DMARC records. This typically indicates that the emails are being misclassified as spoofed or phishing. Reviewing the Anti-Phishing policy's spoof intelligence settings (Option B) allows you to check if the partner domain is being incorrectly treated as a spoof sender and adjust the settings accordingly. Additionally, adding the partner domain to the Tenant Allow/Block List as an allowed domain (Option E) explicitly permits emails from that domain, overriding any false positive filtering. Option A (increasing spam threshold) may reduce spam filtering effectiveness and does not address the root cause. Option C (Outbound spam filter policy) affects outgoing emails, not inbound. Option D (disabling spam filter) is too aggressive and removes protection for the affected users. Therefore, the correct actions are B and E.

Answer

Modify the Anti-Spam policy to increase the spam threshold.

Answer

Configure the Outbound spam filter policy.

Answer

Disable the Spam filter for the affected users.

Question 15

You are a Microsoft 365 administrator. Users report that they cannot access Microsoft Teams. You check the Microsoft 365 admin center and see that the service health for Microsoft Teams shows a 'Service degradation' incident. What is the most appropriate initial action?

Accepted Answer

Review the incident details in the service health dashboard for an estimated resolution time and workaround.. The most appropriate initial action when a service degradation incident is already visible in the Microsoft 365 admin center is to review the incident details in the service health dashboard. This provides the estimated resolution time, current status, and any available workarounds published by Microsoft, allowing you to inform users and mitigate impact without immediately escalating or opening a support request.

Answer

Contact the Microsoft regional escalation engineer immediately.

Answer

Open a support request with Microsoft to report the outage.

Answer

Restart the Microsoft Teams service on all client machines.