MS-102 Practice Test 29 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Office 365. You need to configure a policy that automatically redirects emails containing malicious attachments to a quarantine folder for admin review. What type of policy should you create?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Anti-malware policy.. B is correct because the Anti-malware policy in Microsoft Defender for Office 365 is specifically designed to handle malware detected in email messages, including attachments. When configured, it can automatically redirect messages containing malicious attachments to a quarantine folder for admin review, providing a controlled remediation workflow.

Answer

Safe Attachments policy.

Answer

Anti-spam policy.

Answer

Safe Links policy.

Question 2

Your organization's Microsoft Intune environment enforces device compliance policies for iOS devices. You need to ensure that only devices with a passcode that is at least 6 characters and have jailbreak detection enabled are considered compliant. What should you configure?

Accepted Answer

Create a device compliance policy for iOS with required passcode length and jailbreak detection.. Device compliance policies in Microsoft Intune define the rules that devices must meet to be considered compliant, such as minimum OS version, passcode length, and jailbreak detection. Option D correctly specifies creating a compliance policy for iOS that requires a passcode of at least 6 characters and enables jailbreak detection, which directly enforces the stated requirements. Compliance policies are evaluated before granting access, and non-compliant devices can be blocked or marked for remediation.

Answer

Configure a conditional access policy to require compliant devices.

Answer

Create a device configuration profile for iOS with the required settings.

Answer

Create an app protection policy for iOS to require passcode.

Question 3

Your organization has a hybrid identity environment with Microsoft Entra Connect. You are planning to migrate to cloud-only authentication using Microsoft Entra Cloud Sync. However, some legacy applications still require NTLM authentication. What should you do to ensure those applications can authenticate after the migration?

Accepted Answer

Use Microsoft Entra Application Proxy to publish the legacy applications. Microsoft Entra Application Proxy allows you to publish on-premises legacy applications that rely on NTLM authentication without requiring any changes to the application itself. It acts as a reverse proxy, terminating the external connection and then forwarding the request to the internal application using Kerberos or NTLM, thus enabling cloud-only authentication while preserving NTLM support for legacy apps.

Answer

Enable pass-through authentication (PTA)

Answer

Configure Microsoft Entra Cloud Sync with password hash sync

Answer

Deploy Microsoft Entra Password Protection

Question 4

A security administrator wants to prevent malware from using Office macros to spawn malicious processes. Specifically, they want to block Excel, Word, and PowerPoint from creating child processes. Which Microsoft Defender for Endpoint capability should be configured?

Accepted Answer

Attack Surface Reduction (ASR) rules. Attack Surface Reduction (ASR) rules are a Microsoft Defender for Endpoint capability specifically designed to block common malware behaviors, such as Office applications (Excel, Word, PowerPoint) from creating child processes. This rule (GUID: 26190899-1602-49e8-8b27-eb1d0a1ce869) prevents macros from spawning cmd.exe, powershell.exe, or other executables, directly addressing the administrator's requirement.

Answer

Threat & Vulnerability Management

Answer

Web Protection

Answer

Network Protection

Question 5

An organization has just signed up for Microsoft 365 E3 with the initial domain 'contoso.onmicrosoft.com'. They need to create the first user accounts. What will be the default email address format for these new users if no custom domain is added yet?

Accepted Answer

user@contoso.onmicrosoft.com. When a new Microsoft 365 tenant is created with the initial domain 'contoso.onmicrosoft.com' and no custom domain has been added, the default email address format for new users is user@contoso.onmicrosoft.com. This is because the onmicrosoft.com domain is the default tenant domain provisioned by Microsoft Entra ID, and all user principal names (UPNs) and email addresses are automatically assigned this suffix until a custom domain is verified and set as the primary domain.

Answer

user@contoso.com

Answer

user@microsoft.com

Answer

user@contoso.microsoft.com

Question 6

You are the Microsoft 365 administrator for Contoso Ltd., a company with 500 users. The company uses a hybrid identity with Azure AD Connect. You have a dynamic group named 'SalesGroup' that includes all users with department attribute equal to 'Sales'. Recently, the HR system updated the department for 20 users from 'Sales' to 'Marketing'. The Azure AD Connect sync completed successfully, and the attribute changes are reflected in Azure AD. However, after 48 hours, these users are still members of 'SalesGroup'. You need to ensure that the group membership accurately reflects the department attribute within the next hour. The solution must use minimal administrative effort. What should you do?

Accepted Answer

Trigger a manual evaluation of the dynamic group in Azure AD. Microsoft Entra ID dynamic groups are not automatically re-evaluated immediately after a sync; they rely on a periodic background evaluation process that can take up to 24 hours. By triggering a manual evaluation in the Microsoft Entra ID admin center or via PowerShell (using the `Invoke-MgGraphRequest` or `Update-MgGroup` cmdlet), you force an immediate recalculation of group membership based on the current attribute values, ensuring the 20 users are removed from SalesGroup within the hour with minimal administrative effort.

Answer

Remove the users from the group manually

Answer

Delete and recreate the dynamic group with the same rule

Answer

Wait another 24 hours for the next automatic evaluation

Question 7

You are a compliance administrator. You need to search for emails that contain trade secrets sent by a specific user in the last month. The search must include all mailboxes. What should you use?

Accepted Answer

Content search in Microsoft Purview.. Content search in Microsoft Purview allows searching across all mailboxes for specific keywords and date ranges, making it the appropriate tool to find emails containing trade secrets from a specific user in the last month. Option D is correct. Option A is wrong because eDiscovery (Premium) is designed for complex legal workflows and not for basic content search. Option B is wrong because Audit log search tracks user and admin activities, not email content. Option C is wrong because Data Loss Prevention (DLP) reports show policy matches and alerts, but do not allow searching across mailbox content for specific keywords.

Answer

eDiscovery (Premium) case.

Answer

Data Loss Prevention reports.

Answer

Audit log search.

Question 8

An administrator adds the custom domain 'adatum.com' to a new Microsoft 365 tenant. In the Microsoft 365 admin center, the domain status shows 'Pending verification'. Which type of DNS record must the administrator add to the public DNS zone to complete the domain ownership verification?

Accepted Answer

TXT record. To verify domain ownership in Microsoft 365, you must add a TXT record containing a unique verification string provided by the Microsoft 365 admin center to the public DNS zone. The DNS provider checks for this TXT record, and when found, Microsoft 365 confirms you control the domain. This is a standard domain verification method defined in RFC 1035 and used by many cloud services.

Answer

MX record

Answer

CNAME record

Answer

SPF record

Question 9

Your organization uses Microsoft 365 Business Premium. You need to ensure that when a user is assigned an Intune license, the device automatically enrolls in Microsoft Intune. What should you configure?

Accepted Answer

Configure Microsoft Entra ID device settings to enable MDM automatic enrollment. Microsoft Entra ID (formerly Azure AD) device settings include an option to enable automatic MDM enrollment for users assigned an Intune license. When enabled, any device that signs in with a licensed user account will automatically enroll in Microsoft Intune, satisfying the requirement without additional configuration.

Answer

Create a device compliance policy to require enrollment

Answer

Create a device enrollment restriction in Intune to block personal devices

Answer

Deploy a device configuration profile with enrollment settings

Question 10

A user reports that they cannot access their Microsoft 365 mailbox via Outlook on the web. Other users can access their mailboxes. What is the most likely cause?

Accepted Answer

The user does not have an Exchange Online license assigned. The most likely cause is that the user does not have an Exchange Online license assigned. Without a valid license, the user's mailbox is not provisioned, and Outlook on the Web (OWA) cannot access it. Other users can access their mailboxes because they have licenses, ruling out a service-wide issue.

Answer

The user's password has expired

Answer

The Exchange Online service is experiencing an outage

Answer

The user's browser cache needs to be cleared

Question 11

Refer to the exhibit. What is the effect of this session policy?

Accepted Answer

Blocks download of files from SharePoint Online and OneDrive on unmanaged devices. The session policy shown in the exhibit is configured to block downloads from SharePoint Online and OneDrive for unmanaged devices. This is achieved by applying a conditional access policy that targets unmanaged devices and restricts the download action specifically, while still allowing view-only access. The correct answer is D because the policy explicitly blocks the download of files, not uploads or all access.

Answer

Allows viewing but blocks downloading files on managed devices

Answer

Blocks all access to SharePoint and OneDrive from unmanaged native clients only

Answer

Blocks upload of files to SharePoint Online and OneDrive from unmanaged devices

Question 12

The exhibit shows the output of a PowerShell command for a user. The user reports that they cannot access Microsoft Teams, although they have an E3 license (ENTERPRISEPACK). What is the most likely cause?

Accepted Answer

The Teams service plan is disabled in the user's license.. The PowerShell output shows the user has an E3 license (ENTERPRISEPACK) assigned, but the Teams service plan is disabled. Even with an active E3 license, if the Teams service plan is explicitly turned off in the license assignment, the user cannot access Microsoft Teams. This is a common configuration where an admin disables specific service plans to control feature access.

Answer

The user's license is suspended.

Answer

The user's license has expired.

Answer

The user does not have a license assigned.

Question 13

A company wants to display a custom help desk phone number and email on the Microsoft 365 sign-in page so that users can contact support easily. Which area of the Microsoft 365 admin center should the administrator use to configure this?

Accepted Answer

Settings > Org settings > Organization profile. The custom help desk contact information (phone number and email) for the Microsoft 365 sign-in page is configured under Settings > Org settings > Organization profile, specifically in the 'Custom branding' section. This setting allows administrators to add custom support contact details that appear on the sign-in page, enhancing user self-service and support accessibility.

Answer

Settings > Org settings > Security & privacy

Answer

Billing > Licenses

Answer

Health > Service Health

Question 14

Your organization uses Microsoft Defender for Office 365. You need to configure a policy that automatically redirects emails containing malicious attachments to a quarantine folder for admin review. What type of policy should you create?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IdentityLogonEvents, EmailEvents, and DeviceProcessEvents. IdentityLogonEvents (from Microsoft Defender for Identity) provide logon activities, EmailEvents (from Microsoft Defender for Office 365) show email sending patterns, and DeviceProcessEvents (from Microsoft Defender for Endpoint) reveal process creations that may indicate lateral movement (e.g., PsExec, WMI). Together, these three data sources allow correlation of identity, email, and device events to confirm a compromise and detect lateral movement. Option A is incorrect because EmailEvents and EmailAttachmentInfo cover only email context, lacking identity and lateral movement data. Option B is incorrect because DeviceNetworkEvents and DeviceProcessEvents lack identity and email context. Option C is incorrect because DeviceEvents and DeviceNetworkEvents also miss identity and email context.

Answer

EmailEvents and EmailAttachmentInfo

Answer

DeviceNetworkEvents and DeviceProcessEvents

Answer

DeviceEvents and DeviceNetworkEvents

Question 15

Your organization is implementing a hybrid identity solution. You want to synchronize on-premises Active Directory users to Microsoft Entra ID. Which tool should you use?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect (formerly Azure AD Connect) is the correct tool for synchronizing on-premises Active Directory users to Microsoft Entra ID in a hybrid identity solution. It supports both password hash synchronization, pass-through authentication, and federation with Active Directory Federation Services (AD FS), making it the primary and most feature-rich sync tool for complex hybrid environments.

Answer

Microsoft Identity Manager

Answer

Microsoft Entra Cloud Sync

Answer

Microsoft Entra Connect Sync