MS-102 Practice Test 30 — 15 Questions

Question 1

Your organization uses Microsoft 365 E5 licenses. You need to implement a secure score improvement plan. After reviewing the Secure Score, you notice a recommendation to 'Enable sign-in risk policy' in Microsoft Entra ID. However, you want to ensure that users who sign in from trusted locations are not challenged. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a conditional access policy that targets sign-in risk: medium and above, require MFA, and exclude trusted named locations.. It creates a Conditional Access policy that targets sign-in risk at medium and above, requiring MFA, while excluding trusted named locations. This ensures users from trusted IPs are not challenged, directly addressing the requirement to avoid unnecessary prompts for trusted sign-ins while still enforcing risk-based policies.

Answer

Configure named locations in Microsoft Entra ID for trusted IPs.

Answer

Enable the 'Sign-in risk' policy in Identity Protection and set 'Exclude trusted locations'.

Answer

Enable the 'Require MFA for all users' conditional access policy.

Question 2

You are reviewing a conditional access policy in Microsoft Entra ID as shown in the exhibit. The policy is intended to block sign-ins that are considered risky. However, some high-risk users are still able to sign in. What is the most likely reason?

Accepted Answer

The policy requires both user risk and sign-in risk to be at specified levels simultaneously. The conditional access policy only blocks sign-ins when both user risk is high AND sign-in risk is medium or high. If a user has high user risk but low sign-in risk, the policy does not apply, allowing them to sign in. Options A, B, and C are incorrect: A states both must be high, but the policy may require medium or high for sign-in risk; B is not about MFA; C is wrong because sign-in risk levels are included.

Answer

The policy requires user risk and sign-in risk to both be high

Answer

The policy requires multi-factor authentication instead of blocking

Answer

The policy does not include sign-in risk levels

Question 3

A user in your organization receives a 'Message blocked' notification when trying to send an email with a credit card number. The DLP policy is configured to block such emails. The user claims the credit card number is a valid test number used for training. What should you do to allow the email while maintaining security?

Accepted Answer

Configure a policy tip to allow override with a business justification.. Configuring a policy tip with override allows the user to justify the override with a business justification, which is audited. This maintains security by notifying the user and recording the override for compliance. Option B (excluding the user) removes DLP protection entirely for that user, which is insecure. Option C (disabling the policy) disables protection for all users. Option D (adding to super user group) bypasses all DLP checks for the user, which is too permissive.

Answer

Exclude the user from the DLP policy.

Answer

Disable the DLP policy temporarily.

Answer

Add the user to the DLP policy's super user group.

Question 4

A company uses Microsoft Entra ID for identity management. The security team wants to ensure that users cannot register applications in the tenant to prevent potential data leakage. Which setting should be configured?

Accepted Answer

Set 'Users can register applications' to 'No' in User settings. Setting 'Users can register applications' to 'No' in the Microsoft Entra ID User settings explicitly prevents non-admin users from creating application registrations in the tenant. This directly addresses the security team's goal of blocking users from registering apps, which could otherwise expose tenant data through misconfigured or malicious applications.

Answer

Set the 'Admin consent requests' setting to 'Allow'

Answer

Enable the 'Admin consent workflow'

Answer

Set 'Users can consent to apps accessing company data' to 'No'

Question 5

Your company has a Microsoft 365 E5 subscription and uses Microsoft Entra ID. You need to configure a conditional access policy that blocks access from devices that are not compliant with your organization's device compliance policies, as defined by Microsoft Intune. Which assignment should you configure in the policy?

Accepted Answer

Grant > Require device to be marked as compliant. The 'Require device to be marked as compliant' grant control in a Conditional Access policy enforces access decisions based on the compliance status reported by Microsoft Intune. When a device is marked as non-compliant by Intune (e.g., missing required updates or having an unapproved app), the policy blocks access. This directly meets the requirement to block devices that do not meet the organization's device compliance policies.

Answer

Grant > Require hybrid Azure AD joined device

Answer

Grant > Require multifactor authentication

Answer

Grant > Require approved client app

Question 6

A company uses Azure AD Conditional Access. The security team wants to require multi-factor authentication (MFA) for all users when accessing the Azure portal, except when they are connecting from the corporate network (which is defined as a trusted location). How should the Conditional Access policy be configured?

Accepted Answer

Create a Conditional Access policy with all users, cloud apps = Microsoft Azure Management, Conditions > Locations = all locations, exclude the corporate network, Grant = Require multi-factor authentication.. It targets only the Azure Portal (Microsoft Azure Management cloud app), applies MFA to all locations except the trusted corporate network, and excludes the corporate network from the policy. This ensures MFA is required for all access attempts from untrusted locations while allowing direct access from the corporate network without MFA.

Answer

Create a Conditional Access policy with all users, cloud apps = All cloud apps, Conditions > Locations = all locations, exclude the corporate network, Grant = Require multi-factor authentication.

Answer

Create a Conditional Access policy with all users, cloud apps = Microsoft Azure Management, Conditions > Locations = Corporate network, Grant = Block.

Answer

Create a Conditional Access policy with all users, cloud apps = Microsoft Azure Management, Conditions > Locations = Corporate network, Grant = Require multi-factor authentication.

Question 7

A company wants to ensure that all new users register for multi-factor authentication (MFA) within 14 days of account creation. Which Microsoft Entra ID feature should be used?

Accepted Answer

MFA registration campaign. The MFA registration campaign in Microsoft Entra ID is specifically designed to enforce user registration for MFA within a defined time frame, such as 14 days. It targets new users and sends them reminders to register, blocking access until registration is completed, which directly meets the company's requirement.

Answer

Conditional Access policy

Answer

Identity Protection

Answer

Access Reviews

Question 8

A company is deploying Microsoft 365 and wants to ensure that users in the finance department have access to only the apps they need. You need to recommend a licensing strategy that minimizes administrative overhead while enforcing access restrictions. What should you do?

Accepted Answer

Create a dynamic Azure AD group based on department attribute and assign licenses using group-based licensing.. Using a dynamic Microsoft Entra ID group based on the department attribute automates membership updates as users change departments, and group-based licensing assigns the appropriate licenses to all members without manual intervention. This minimizes administrative overhead by eliminating the need to manually add or remove users from the group or assign licenses individually, while enforcing access restrictions by ensuring only finance users receive the licensed apps.

Answer

Create a security group with explicit membership and assign licenses to the group.

Answer

Assign licenses to users one by one in the Microsoft 365 admin center.

Answer

Use PowerShell to assign licenses based on user department attribute.

Question 9

You are troubleshooting an issue where users from a partner organization cannot access a shared app in your Microsoft Entra ID tenant. The partner uses Microsoft Entra ID with a custom domain. You have configured cross-tenant access settings. Which setting is most likely misconfigured?

Accepted Answer

Default inbound cross-tenant access settings for the partner's tenant ID. The default inbound cross-tenant access settings control how external users from other tenants access your tenant's resources. Since the partner cannot access the shared app, the most likely misconfiguration is that the default inbound settings for the partner's tenant ID are set to block access, or the partner's tenant ID is not explicitly allowed in the inbound settings. This overrides any app-level permissions, as cross-tenant access settings act as a gate before user assignment is evaluated.

Answer

Outbound cross-tenant access settings for the partner's tenant ID

Answer

The app's user assignment and provisioning configuration

Answer

The partner's inbound cross-tenant access settings for your tenant

Question 10

Refer to the exhibit. You need to ensure that users accessing Exchange Online from unmanaged devices are blocked. What should you modify in the policy?

Accepted Answer

Change the operator from OR to AND. The exhibit shows a conditional access policy with two grant controls: 'Require multi-factor authentication' and 'Require device to be marked as compliant', connected by OR. With OR, users can satisfy either control, so unmanaged devices can still authenticate via MFA alone. Changing the operator to AND forces both MFA and device compliance, blocking access from unmanaged devices that cannot be compliant.

Answer

Remove the MFA control

Answer

Add the 'approvedClientApp' grant control with OR

Answer

Add a session control for app protection policies

Question 11

You are a security administrator. You need to configure Microsoft Defender for Cloud Apps to detect anomalous user activities such as impossible travel. Which feature should you enable?

Accepted Answer

Anomaly Detection policies. Anomaly Detection policies in Microsoft Defender for Cloud Apps are specifically designed to identify user behavior anomalies, such as impossible travel (a user logging in from two geographically distant locations within an impossible timeframe). These policies leverage machine learning and user entity behavior analytics (UEBA) to establish a baseline and flag deviations, making them the correct feature for detecting impossible travel.

Answer

App Discovery

Answer

Cloud Discovery

Answer

Conditional Access App Control

Question 12

A company uses Microsoft Entra ID and has enabled self-service password reset (SSPR). Users are required to register for SSPR. Management wants to ensure that users from the HR department, who handle sensitive data, must use two methods for authentication during SSPR, while other users can use one method. What is the best way to achieve this?

Accepted Answer

This is not possible because SSPR authentication method requirements are tenant-wide. SSPR authentication method requirements in Microsoft Entra ID are configured at the tenant level, not per user or group. This means you cannot specify that one group of users must use two methods while others use one; the number of methods required applies uniformly to all users enabled for SSPR. Therefore, option D is correct because the requirement cannot be differentiated by department or group.

Answer

Create a separate SSPR policy for the HR department using PowerShell

Answer

Use Microsoft Entra ID Governance to create an access package that requires two methods

Answer

Assign the HR users to a group and configure the SSPR policy for that group in the Entra admin center

Question 13

Your organization is deploying Microsoft 365 Copilot. You need to ensure that data security is maintained. Which THREE actions should you take?

Accepted Answer

Enable audit logging in Microsoft 365.. Enabling audit logging in Microsoft 365 is essential for tracking user interactions with Microsoft 365 Copilot, including prompts, responses, and data access events. This provides a forensic trail to detect unauthorized data exposure or misuse, which is a foundational requirement for maintaining data security in AI-powered workloads.

Answer

Disable Microsoft 365 Copilot for all users.

Answer

Block all external sharing for SharePoint and OneDrive.

Question 14

You are a security administrator. You need to configure a policy that automatically blocks sign-ins from anonymous IP addresses for all users in your Microsoft 365 tenant. Which policy should you configure in Microsoft Entra ID?

Accepted Answer

Conditional Access policy with sign-in risk condition. Anonymous IP address sign-ins are a sign-in risk detection in Microsoft Entra ID Protection. To automatically block them for all users, you configure a Conditional Access policy that targets All users and uses the sign-in risk condition set to High (or the specific 'Anonymous IP address' risk), with the access control set to Block. Sign-in risk evaluates the authentication attempt itself, which is exactly what anonymous IP represents.

Answer

Password protection policy

Answer

Conditional Access policy with user risk condition

Answer

Identity Protection user risk policy

Question 15

Your company uses Microsoft Defender XDR. You need to review the list of incidents that were investigated automatically by the system. Where should you navigate in the Microsoft Defender portal?

Accepted Answer

Incidents & alerts > Incidents. The 'Incidents & alerts > Incidents' section in the Microsoft Defender portal is the dedicated location where all incidents, including those automatically investigated by Microsoft Defender XDR's automated investigation and response (AIR) capabilities, are listed and managed. This view shows the incident queue, including the 'Investigation state' column that indicates whether an investigation was initiated automatically or manually, allowing you to filter and review system-initiated investigations.

Answer

Hunting

Answer

Action center

Answer

Reports