MS-102 Practice Test 27 — 15 Questions

Question 1

An administrator is onboarding a new custom domain for email in a Microsoft 365 tenant. Which step should be performed first?

Accepted Answer

Add the domain in the Microsoft 365 admin center. Before you can use a custom domain for email or any other service in Microsoft 365, you must first add the domain to the tenant in the Microsoft 365 admin center. This creates the domain object in Microsoft Entra ID and initiates the verification process. Only after the domain is added can you proceed to verify ownership and configure DNS records.

Answer

Verify domain ownership by adding a TXT record

Answer

Configure DNS records for Microsoft services

Answer

Set the domain as the primary email domain

Question 2

Your organization uses Microsoft Entra ID and has enabled Microsoft Entra Domain Services (Azure AD DS). You need to ensure that legacy applications that require NTLM authentication can still authenticate against the managed domain. What should you configure?

Accepted Answer

Enable NTLM v1 authentication on the managed domain. Legacy applications that require NTLM authentication must have NTLM v1 enabled on the managed domain because Microsoft Entra Domain Services, by default, disables NTLM v1 for security reasons. Enabling NTLM v1 allows these older applications to authenticate against the managed domain using the NTLM protocol, which is necessary when Kerberos is not supported.

Answer

Configure Kerberos delegation

Answer

Disable NTLM v1 authentication on the managed domain

Answer

Enable password hash synchronization for the managed domain

Question 3

Your organization uses Microsoft Defender for Endpoint (MDE). You need to configure an automated investigation and response (AIR) capability that will automatically remediate a confirmed malware infection on endpoints. Which action should you enable?

Accepted Answer

Automatically resolve alerts. Enabling 'Automatically resolve alerts' in Microsoft Defender for Endpoint's automated investigation and response (AIR) capabilities allows the system to automatically remediate confirmed malware infections by resolving the alert and applying the appropriate remediation actions (e.g., quarantining files, terminating processes) without manual intervention. This setting ensures that once an investigation confirms a threat, the response is executed automatically, aligning with the requirement for automated remediation.

Answer

Run antivirus scan

Answer

Notify users via email

Answer

Isolate device

Question 4

Drag and drop the steps to configure a Conditional Access policy in Microsoft Entra ID in the correct order.

Accepted Answer

1. Create a new Conditional Access policy, 2. Assign users and groups, 3. Configure conditions (cloud apps, locations, etc.), 4. Configure access controls (Grant/Block) and enable policy. Conditional Access policies are created in Entra ID, assigned to users, conditions defined, and access controls applied.

Answer

1. Configure access controls, 2. Assign users and groups, 3. Configure conditions, 4. Create a new Conditional Access policy

Answer

1. Create a new Conditional Access policy, 2. Configure conditions, 3. Assign users and groups, 4. Configure access controls and enable policy

Answer

1. Assign users and groups, 2. Create a new Conditional Access policy, 3. Configure access controls, 4. Enable policy

Question 5

Contoso wants to require multi-factor authentication (MFA) for all users when accessing cloud applications from any network except the corporate headquarters (trusted IP range). They plan to use Azure AD Conditional Access. Which two components must be configured to achieve this requirement? (Select all that apply.)

Accepted Answer

Conditional Access policy targeting all users and cloud apps, with conditions for locations. A Conditional Access policy must be created to enforce MFA based on location conditions. The policy targets all users and cloud apps, and uses the 'locations' condition to exclude the trusted IP range (corporate headquarters) while requiring MFA for all other locations. This ensures MFA is triggered only when access originates from outside the trusted network.

Answer

An Identity Protection user risk policy

Answer

An MFA registration policy requiring users to register for MFA

Question 6

You need to configure Microsoft Purview Data Loss Prevention (DLP) to prevent sensitive data from being shared via email. Which THREE elements can you use to define the policy?

Accepted Answer

Actions. Actions are a required element in a Microsoft Purview DLP policy because they define what happens when sensitive data is detected—such as blocking the email, sending a notification, or applying encryption. Without specifying actions, the policy would have no enforcement mechanism to prevent data sharing.

Answer

Sensitivity labels

Answer

Exceptions

Question 7

Your organization has a Microsoft 365 tenant with a custom domain contoso.com. You have configured Exchange Online to accept emails for contoso.com. You now need to add a subdomain sales.contoso.com and ensure that email sent to sales.contoso.com is delivered to a specific shared mailbox. What should you do?

Accepted Answer

Add sales.contoso.com as an accepted domain in Exchange Online and create a transport rule to redirect emails to the shared mailbox.. To route email for a subdomain to a specific mailbox, you must first add the subdomain as an accepted domain in Exchange Online (not as a custom domain in the admin center, since the parent domain is already verified). Then, you create a transport rule that matches recipients in that accepted domain and redirects the messages to the target shared mailbox. This ensures that all emails sent to sales.contoso.com are delivered to the designated mailbox without requiring additional MX records or domain verification.

Answer

Add sales.contoso.com as a custom domain in the Microsoft 365 admin center and verify ownership.

Answer

Configure an auto-expanding archive for the shared mailbox.

Answer

Create a distribution group named sales@contoso.com and add the shared mailbox as a member.

Question 8

Your organization has 5,000 users and uses Microsoft 365 E3. You are planning to migrate from on-premises Exchange to Exchange Online. You have already synchronized identities using Microsoft Entra Connect. The CIO wants to ensure that users can continue to access their email if the internet connection to Microsoft 365 is temporarily lost. You need to recommend a solution that provides offline access while minimizing cost and administrative overhead. What should you recommend?

Accepted Answer

Configure Outlook to use Cached Exchange Mode.. Cached Exchange Mode (CEM) downloads a copy of the user's mailbox to a local .ost file, allowing full access to email, calendar, and contacts even when the internet connection to Microsoft 365 is temporarily lost. This meets the CIO's requirement for offline access with zero additional cost and no administrative overhead, as CEM is a built-in feature of Outlook that is already available with Microsoft 365 E3.

Answer

Implement a hybrid deployment and keep some mailboxes on-premises.

Answer

Deploy a VPN to ensure connectivity.

Answer

Enable Exchange Online Archiving for all users.

Question 9

A company uses Azure AD and SharePoint Online. They want to allow users from a partner organization (which also uses Azure AD) to access a specific SharePoint Online site using their existing partner credentials. The partner users should not require new accounts to be created. Which Azure AD feature should be configured?

Accepted Answer

Azure AD B2B collaboration. Microsoft Entra B2B collaboration allows you to invite external users from a partner organization to access your Microsoft Entra ID-integrated applications, such as SharePoint Online, using their own existing Microsoft Entra ID credentials. This feature leverages cross-tenant trust and does not require creating new user accounts in your tenant, fulfilling the requirement exactly.

Answer

Azure AD B2C

Answer

Azure AD Domain Services

Answer

Organizational Relationships

Question 10

An administrator needs to add a custom domain 'contoso.org' to their Microsoft 365 tenant. They have already purchased the domain and have access to the DNS registrar. What is the first step the administrator should perform in the Microsoft 365 admin center?

Accepted Answer

Add the domain in the Microsoft 365 admin center. The first step to add a custom domain to a Microsoft 365 tenant is to initiate the domain addition process in the Microsoft 365 admin center. This triggers Microsoft to generate the unique verification TXT record that must be published in the public DNS zone. Without first adding the domain in the admin center, the administrator would not know the specific verification string required for the TXT record.

Answer

Add a TXT record in the public DNS zone

Answer

Configure email routing (MX record)

Answer

Create user accounts with the new domain

Question 11

A company wants to enable self-service password reset (SSPR) for all users. Which two configurations are mandatory to allow users to reset their own passwords? (Choose two.)

Accepted Answer

A: Enable SSPR for 'All' users.. Enabling SSPR for 'All' users is a mandatory configuration that ensures every user in the tenant is licensed and permitted to use self-service password reset. Without this setting, SSPR would not be activated for the intended user population, even if authentication methods are configured.

Answer

C: Configure a custom helpdesk URL.

Answer

D: Enforce registration after 30 days.

Question 12

A company uses Microsoft Entra ID P2 licenses. A security administrator needs to grant a user temporary elevation to the Global Administrator role for a specific task. The elevation should require approval from a designated group and be time-limited. Which Microsoft Entra feature should be configured?

Accepted Answer

Privileged Identity Management. Privileged Identity Management (PIM) in Microsoft Entra ID P2 provides just-in-time (JIT) privileged access with time-bound activation, approval workflows, and audit logging. This directly meets the requirement for temporary elevation to Global Administrator with approval from a designated group and a time limit.

Answer

Conditional Access

Answer

Identity Protection

Answer

Access Reviews

Question 13

An administrator is creating a Microsoft Purview auto-labeling policy for documents containing personally identifiable information. Before turning the policy on automatically, what should the administrator do to reduce false positives?

Accepted Answer

Run the auto-labeling policy in simulation mode and review matches. Running the auto-labeling policy in simulation mode allows the administrator to review which documents would be matched by the policy without actually applying labels. This enables analysis of the detection results to identify and reduce false positives before enabling automatic application, ensuring the policy accurately targets only documents containing the specified PII.

Answer

Publish the label directly to all users and enable automatic application immediately

Answer

Create an eDiscovery hold for the SharePoint locations

Answer

Configure a retention policy before creating the sensitivity label

Question 14

An administrator wants to configure the company's organization profile in Microsoft 365, including the display name, technical contact, and privacy settings. Where should the administrator go in the Microsoft 365 admin center?

Accepted Answer

Org settings > Organization profile. The organization profile, which includes the display name, technical contact, and privacy settings, is managed under 'Org settings' in the Microsoft 365 admin center. Specifically, the 'Organization profile' tab within 'Org settings' provides the interface to update these tenant-wide properties, such as the organization's display name (used in Microsoft 365 services and notifications) and the technical contact email (used for service communications). This is the correct location because these settings are tenant-level configurations, not user-specific or billing-related.

Answer

User management > Active users

Answer

Setup > Onboarding

Answer

Billing > Licenses

Question 15

A compliance officer needs to retain all documents in a SharePoint Online site associated with the Finance department for 10 years, after which the documents must be automatically deleted. During the retention period, users must be allowed to edit the documents but not delete them. Which Microsoft Purview solution should the officer configure?

Accepted Answer

retention policy with a retention period of 10 years and an action to delete at the end of the period. A retention policy can be applied to a SharePoint site to enforce a 10-year retention period with a deletion action at the end, while allowing users to edit documents during that period. This meets the compliance requirement because retention policies preserve content from deletion by users, but still permit editing. The 'delete at end of retention period' action ensures automatic removal after 10 years.

Answer

retention label auto-applied to all documents in the site

Answer

Litigation hold on the site

Answer

Data Loss Prevention (DLP) policy with a retention action