MS-102 Practice Test 31 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID and has a Conditional Access policy that requires MFA for all external users. However, guest users from a partner organization are being blocked when they try to access a SharePoint Online site. You need to ensure that guest users can access the site without being prompted for MFA if they have already satisfied MFA in their home tenant. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the trust MFA for external users setting in cross-tenant access settings. The cross-tenant access settings in Microsoft Entra ID include a 'Trust MFA from external tenants' option. When enabled, this setting allows guest users who have already satisfied MFA in their home tenant to access resources in your tenant without being prompted for MFA again. This respects the partner's MFA claims and avoids redundant authentication, which directly resolves the blocking issue caused by the Conditional Access policy requiring MFA for all external users.

Answer

Disable MFA requirement for guest users in Conditional Access

Answer

Configure authentication methods policy to accept MFA from external identities

Answer

Use B2B direct connect instead of B2B collaboration

Question 2

As a Microsoft 365 administrator, you need to ensure that sensitive data is not shared externally via email. You configure Data Loss Prevention (DLP) policies in Microsoft Purview. What is the primary purpose of a DLP policy?

Accepted Answer

Detect and prevent the sharing of sensitive information via email and other channels.. Data Loss Prevention (DLP) policies in Microsoft Purview are designed to detect and prevent the sharing of sensitive information via email, Microsoft Teams, SharePoint, and other channels. Option A is incorrect because DLP does not block all external emails; it only blocks specific sensitive data. Option B is incorrect because blocking inbound emails from untrusted domains is typically handled by anti-spam or anti-phishing policies in Exchange Online Protection. Option C is incorrect because email encryption is provided by Azure Information Protection or Office 365 Message Encryption, not DLP.

Answer

Prevent users from sending any external email.

Answer

Block all inbound emails from untrusted domains.

Answer

Encrypt all outgoing emails automatically.

Question 3

A company uses hybrid identity with Azure AD Connect and password hash synchronization. They want to enable Self-Service Password Reset (SSPR) with password writeback so that users can reset their on-premises Active Directory passwords. Which Azure AD license is required?

Accepted Answer

Azure AD Premium P1. Microsoft Entra ID P1 is required for Self-Service Password Reset (SSPR) with password writeback. Password writeback is a premium feature that enables password changes in Microsoft Entra ID to be written back to on-premises Active Directory via Microsoft Entra Connect. Microsoft Entra ID Free does not include SSPR with writeback, and Microsoft Entra ID P2 includes additional features like Identity Protection but is not necessary for this scenario.

Answer

Azure AD Free

Answer

Azure AD Premium P2

Answer

Microsoft 365 E3

Question 4

Your organization uses Microsoft Defender for Identity (MDI) and Microsoft Defender for Cloud Apps. You receive an alert about a user account that is exhibiting suspicious behavior: unusual login times from an IP address that is not in the user's typical location. The alert recommends action. You need to determine if the account is compromised. What is the best next step?

Accepted Answer

Initiate an automated investigation in Microsoft Defender XDR. Initiating an automated investigation in Microsoft Defender XDR correlates signals across MDI, Defender for Cloud Apps, and other Microsoft 365 services to determine if the account is compromised. Option B is wrong because configuring a conditional access policy is a preventive measure, not an investigative step to confirm compromise. Option C is wrong because disabling the account immediately might be premature and could disrupt legitimate access without confirming the threat. Option D is wrong because resetting the password alone does not investigate other potential malicious activity or identify the scope of compromise.

Answer

Configure a conditional access policy in Microsoft Entra ID to block the IP

Answer

Immediately disable the user account

Answer

Reset the user's password

Question 5

Refer to the exhibit. You are reviewing a Microsoft Purview auto-labeling policy configuration. The SensitivityTypes GUID corresponds to a sensitive info type that detects credit card numbers. The LabelId is for a 'Confidential' label. Users report that documents containing credit card numbers are not being automatically labeled. What is the most likely reason?

Accepted Answer

The auto-labeling policy is not scoped to the correct locations (e.g., SharePoint, Exchange).. Auto-labeling policies in Microsoft Purview must be scoped to the locations where the sensitive data resides (Exchange, SharePoint, OneDrive, etc.). If the policy is not scoped to the correct locations, documents containing credit card numbers in those locations will never be evaluated, so no automatic labeling occurs. This is the most common configuration oversight when auto-labeling appears to do nothing.

Answer

The 'Confidential' label is not published to users.

Answer

The sensitive info type GUID is incorrect.

Answer

Users do not have the appropriate license for auto-labeling.

Question 6

Your organization uses Microsoft Defender XDR. You are configuring a custom detection rule to detect a specific behavior: a user runs a PowerShell script that connects to a known malicious IP address. Which TWO advanced hunting tables should you use in your KQL query to detect this behavior?

Accepted Answer

DeviceProcessEvents. To detect a user running a PowerShell script that connects to a known malicious IP address, you need to correlate process creation events (to capture the PowerShell script execution) with network connection events (to capture the outbound connection to the IP address). DeviceProcessEvents tracks process creation, including PowerShell.exe. DeviceNetworkEvents tracks network connections to remote IP addresses. Therefore, the correct tables are DeviceProcessEvents (A) and DeviceNetworkEvents (E).

Answer

DeviceRegistryEvents

Answer

DeviceLogonEvents

Answer

DeviceFileEvents

Question 7

You are configuring Microsoft Purview Information Protection for your tenant. You need to ensure that documents containing credit card numbers are automatically labeled as 'Highly Confidential' and encrypted. Which two components must you configure?

Accepted Answer

A sensitive info type for credit card numbers.. To automatically label and encrypt documents containing credit card numbers, you need a sensitive info type that detects credit card numbers and an auto-labeling policy for sensitivity labels that applies the 'Highly Confidential' label with encryption. The sensitive info type defines what to look for, and the auto-labeling policy defines the label to apply and the conditions.

Answer

A data loss prevention (DLP) policy.

Answer

A retention label.

Question 8

An administrator wants to add custom branding to the Microsoft 365 sign-in page, including company logo and colors. Which section of the Microsoft 365 admin center should they navigate to?

Accepted Answer

Settings > Org settings > Organization profile. The custom branding for the Microsoft 365 sign-in page, including company logo and colors, is configured under Settings > Org settings > Organization profile in the Microsoft 365 admin center. This section provides a dedicated 'Custom branding' tab where administrators can upload a logo, set a background image, and choose accent colors that are applied to the sign-in page for all users in the tenant.

Answer

Users > Active users

Answer

Admin centers > Azure Active Directory

Answer

Billing > Licenses

Question 9

A security administrator needs to block executable files (e.g., .exe, .ps1) from running from the %TEMP% folder on Windows devices to prevent common malware execution. Which attack surface reduction (ASR) rule should be enabled?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion. ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) is designed specifically to block executables (including .exe, .ps1, .scr, .dll) from launching from locations like %TEMP%, %APPDATA%, and the Windows folder, which are common malware staging areas. This rule uses cloud-delivered reputation (prevalence and age) and a Microsoft-managed trusted list to allow legitimate files while blocking unknown or suspicious ones, directly addressing the requirement to prevent malware execution from %TEMP%.

Answer

Block executable content from email client and webmail

Answer

Block Office applications from creating child processes

Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Question 10

A company uses Azure AD Identity Protection. The security team wants to automatically block sign-ins that are detected as coming from a known malicious IP address. Which policy should be configured?

Accepted Answer

Sign-in risk policy. The Sign-in risk policy in Microsoft Entra ID Protection is specifically designed to respond to risks detected during the authentication attempt, such as sign-ins from known malicious IP addresses. When a sign-in is flagged as having a high risk level (e.g., from a known malicious IP), the policy can be configured to automatically block the sign-in. This directly addresses the security team's requirement to block sign-ins from malicious IPs.

Answer

User risk policy

Answer

MFA registration policy

Answer

Identity Protection vulnerabilities policy

Question 11

A security team wants to automatically investigate and remediate alerts generated from Microsoft Defender for Endpoint, Office 365, and Microsoft Entra ID. Which Microsoft Defender XDR capability should be configured?

Accepted Answer

Automated Investigation and Response. Automated Investigation and Response (AIR) in Microsoft Defender XDR is the correct capability because it automatically triggers playbooks to investigate and remediate alerts across Microsoft Defender for Endpoint, Office 365, and Microsoft Entra ID. AIR uses predefined or custom automation rules to correlate signals from these sources, run investigations, and apply remediation actions like isolating devices or blocking accounts without manual intervention.

Answer

Threat Analytics

Answer

Advanced Hunting

Answer

Secure Score

Question 12

An organization has just purchased Microsoft 365 subscriptions and wants to add their custom domain 'fabrikam.com' to the tenant. Which record must they add to their DNS provider to verify domain ownership?

Accepted Answer

TXT record. To verify domain ownership in Microsoft 365, you must add a TXT record provided by the Microsoft 365 admin center to your DNS hosting provider. This TXT record contains a unique verification string that Microsoft checks to confirm you control the domain. MX, CNAME, and SRV records are used for mail routing, service aliasing, and service location, respectively, but they do not serve the purpose of domain ownership verification.

Answer

MX record

Answer

CNAME record

Answer

SRV record

Question 13

Which TWO actions can you perform using Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Automate user access reviews. Microsoft Entra ID Governance includes automated user access reviews, which allow organizations to periodically certify that users still need access to applications, groups, and roles. These reviews can be scheduled, recurring, and delegated to reviewers, with automated actions like removing access when a reviewer does not respond. This directly supports compliance and least-privilege principles.

Answer

Manage device compliance policies

Answer

Configure single sign-on for SaaS apps

Answer

Delegate administrative roles

Question 14

A compliance administrator needs to automatically apply a retention label to documents in a SharePoint Online site that contain the keyword 'Project Alpha'. The label should retain the documents for 5 years and then delete them. Which two Microsoft Purview features must be configured to achieve this? (Choose two.)

Accepted Answer

Auto-labeling policy for SharePoint Online. An auto-labeling policy for SharePoint Online (option B) is required because it can automatically apply a retention label to documents based on conditions such as the presence of specific keywords. The sensitive info type with a keyword dictionary (option D) defines the condition by creating a custom sensitive information type that matches the exact phrase 'Project Alpha', which the auto-labeling policy then uses to trigger the label application.

Answer

Trainable classifiers

Answer

Document Fingerprinting

Question 15

You are a Microsoft 365 administrator. Your organization uses Microsoft Entra ID and Microsoft Intune for device management. You need to ensure that only compliant devices can access corporate email via Microsoft Outlook on mobile devices. What should you configure?

Accepted Answer

Create a Conditional Access policy with 'Require device to be marked as compliant'. Conditional Access policies in Microsoft Entra ID can enforce 'Require device to be marked as compliant' as a grant control. This ensures that only devices meeting your Intune compliance policies (e.g., encryption, OS version, threat level) are allowed to access corporate email via Outlook on mobile devices. The policy evaluates device compliance status reported by Intune and blocks access if the device is non-compliant.

Answer

Deploy app protection policies (MAM) for Outlook

Answer

Enable Microsoft Entra device registration

Answer

Create a device compliance policy in Intune