MS-102 Practice Test 32 — 15 Questions

Question 1

A company uses Microsoft Entra ID P1 licenses. They want to enforce multi-factor authentication (MFA) for all users when accessing any cloud application from networks that are not trusted corporate locations. A group named 'Emergency' must be excluded from MFA requirements. Which Conditional Access policy configuration should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign the policy to all users, exclude the Emergency group, include all cloud apps, grant MFA, and set location condition to any network or location except trusted networks.. The requirement is to enforce MFA for all users from untrusted networks, while excluding the Emergency group. The Conditional Access policy must be assigned to all users, exclude the Emergency group, include all cloud apps, require MFA as a grant control, and use a location condition set to 'any network or location except trusted networks' to target only untrusted locations. This configuration ensures MFA is triggered only when access originates from networks not defined as trusted corporate locations.

Answer

Assign the policy to all users, exclude the Emergency group, include all cloud apps, grant access (not MFA), and set location condition to trusted networks only.

Answer

Assign the policy to all users, exclude the Emergency group, include all cloud apps, grant MFA, and set location condition to any network or location.

Answer

Assign the policy to all users, exclude the Emergency group, include all cloud apps, grant MFA, and set location condition to trusted networks only.

Question 2

Your organization uses Microsoft Purview Communication Compliance to detect inappropriate messages in Microsoft Teams. You need to configure a policy that monitors for potential harassment based on a built-in classifier. The policy should alert designated reviewers when a match is found. What is the minimum configuration required?

Accepted Answer

Create a communication compliance policy, select the built-in harassment classifier, specify the users to monitor, and assign reviewers.. The minimum configuration to monitor for potential harassment using Communication Compliance is to create a communication compliance policy, select the built-in harassment classifier, specify the users to monitor, and assign reviewers. No retention policy, DLP policy, or sensitivity label is required.

Answer

Create a retention policy for Teams messages, then create a communication compliance policy with the harassment classifier.

Answer

Create a DLP policy that blocks harassment, then configure communication compliance to review DLP alerts.

Answer

Apply a sensitivity label to all Teams messages, then create a communication compliance policy that scans for the label.

Question 3

Your company is deploying Microsoft Copilot for Microsoft 365. You need to ensure that only users who have completed a specific training course can use Copilot. What should you configure?

Accepted Answer

Create a Conditional Access policy that requires a custom attribute indicating training completion. A Conditional Access policy can evaluate a custom security attribute assigned to a user or group to enforce access controls. By requiring a custom attribute that indicates training completion, you can block or grant access to Copilot for Microsoft 365 based on that attribute. This approach integrates directly with Microsoft Entra ID's policy engine, allowing granular, attribute-based access control without relying on license assignment or user acceptance.

Answer

Use Terms of Use to require acceptance of training policy

Answer

Configure Authentication strengths to require training certificate

Answer

Assign Copilot licenses only to users who completed training

Question 4

A compliance officer needs to prevent users from sending emails that contain social security numbers to external recipients. When a user attempts to send such an email from Outlook, the email should be blocked and a policy tip should be displayed explaining why the email was blocked. Which Microsoft Purview solution should the officer configure?

Accepted Answer

Data Loss Prevention (DLP) policy. A Data Loss Prevention (DLP) policy in Microsoft Purview is designed to detect sensitive information, such as social security numbers, in emails and enforce actions like blocking the message and displaying a policy tip. This meets the compliance officer's requirement to prevent external sending of sensitive data while providing user notification.

Answer

Sensitivity labels

Answer

Communication compliance

Answer

eDiscovery

Question 5

Refer to the exhibit. You are configuring permissions for a daemon application that runs without a user. Which permission should you request?

Accepted Answer

User.Read.All application permission with admin consent.. For a daemon application that runs without a user, you must request an application permission (not delegated) because there is no signed-in user to delegate permissions. User.Read.All application permission allows the app to read all users' full profiles without a user context, and admin consent is required because this permission grants access to data across the entire organization.

Answer

Mail.Read delegated permission with admin consent.

Answer

Delegated permission type for User.Read.All.

Answer

User.Read.All delegated permission with user consent.

Question 6

You are the Microsoft 365 administrator for Fabrikam Inc. The compliance team needs to investigate a suspected data leak involving a former employee. They must preserve all mailbox content and SharePoint Online documents related to the employee for litigation. They also need to search for specific keywords across these locations. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview eDiscovery (Standard) with a case hold and a search.. The requirement is to preserve mailbox and SharePoint content and search for keywords as part of a litigation investigation. Microsoft Purview eDiscovery (Standard) provides case management, hold capabilities for Exchange and SharePoint, and search functionality. It is designed for legal investigations, unlike DLP, Records Management, or Communication Compliance, which serve different purposes.

Answer

Microsoft Purview Records Management with a retention label applied to the employee's content.

Answer

Microsoft Purview Data Loss Prevention (DLP) with a policy for the employee's mailbox.

Answer

Microsoft Purview Communication Compliance with a policy monitoring the employee's communications.

Question 7

A compliance administrator needs to ensure that all documents in a SharePoint library are retained for exactly 7 years and then allow users to manually dispose of them sooner after a review. What should they configure in Microsoft Purview?

Accepted Answer

Create a retention label with a retention period of 7 years and enable disposition review. The requirement specifies a fixed 7-year retention period followed by user-initiated disposal after a review. A retention label with a retention period of 7 years and disposition review enabled allows content to be retained for exactly 7 years, after which a disposition review triggers a manual approval process for disposal. This matches the need for both mandatory retention and manual disposal after review.

Answer

Create a retention label with a retention period of 7 years and no additional action

Answer

Create a sensitivity label that restricts access

Answer

Create a record label

Question 8

Your organization uses Microsoft Defender for Identity and has enabled Microsoft Secure Score. You notice that the Secure Score for Identity has dropped significantly after a recent configuration change. Which action is most likely to have caused the decrease?

Accepted Answer

Disabling password hash synchronization in Microsoft Entra Connect.. Disabling password hash synchronization (PHS) in Microsoft Entra Connect removes the ability for Microsoft Defender for Identity to correlate on-premises Active Directory credential exposure events with cloud authentication attempts. Without PHS, Defender for Identity cannot detect when leaked credentials are used against Microsoft Entra ID, causing the Secure Score for Identity to drop because key detection capabilities are no longer available.

Answer

Changing password expiration policy to 180 days.

Answer

Enabling MFA for all users.

Answer

Implementing a conditional access policy blocking legacy authentication.

Question 9

A company wants to use Microsoft Defender XDR to automatically investigate and remediate threats across email, endpoints, and identities. Which role is required to configure automation settings in the Microsoft 365 Defender portal?

Accepted Answer

Security Administrator. The Security Administrator role in Microsoft Entra ID (Azure AD) grants the permissions needed to configure automation settings, including automated investigation and remediation (AIR) policies, in the Microsoft 365 Defender portal. This role is purpose-built for managing security features across Defender workloads without granting full tenant administrative rights.

Answer

Global Reader

Answer

Compliance Administrator

Answer

Security Reader

Question 10

You are a Microsoft 365 administrator. You need to allow external users to access a SharePoint Online site without requiring them to sign in. Which sharing setting should you enable?

Accepted Answer

Set the sharing option to 'Anyone' (Anonymous) for the site.. Setting the SharePoint Online site sharing option to 'Anyone' (Anonymous) allows external users to access the site without signing in. This creates an anonymous access link that bypasses authentication, meeting the requirement of no sign-in for external users.

Answer

Set the sharing option to 'Existing guests' and send an invitation.

Answer

Set the sharing option to 'Only people in your organization' and use a direct link.

Answer

Set the sharing option to 'New and existing guests' and require guest sign-in.

Question 11

A compliance officer needs to preserve all communications (email and Teams messages) for employees in the legal department for a minimum of 7 years. Additionally, any deletion (by users or system) must be blocked, and after the retention period, the items must be disposed of automatically. The solution must also ensure that the communications are marked as 'records' to prevent tampering. Which Microsoft Purview solution should the officer configure?

Accepted Answer

retention label configured with 'Mark items as a record' and a retention period of 7 years, then delete automatically. A retention label with 'Mark items as a record' enforces immutability (prevents tampering) and, when configured with a 7-year retention period followed by automatic deletion, meets the compliance officer's requirements for preservation, blocking deletion, and automatic disposal. This label can be applied to both Exchange Online mailboxes (email) and Teams messages via auto-labeling policies, covering all communications for the legal department.

Answer

Litigation hold on the legal department's mailboxes and Teams

Answer

Preservation hold library in SharePoint Online

Answer

Data Loss Prevention (DLP) policy with retention action

Question 12

You need to configure Microsoft Teams to allow external access for federation with another organization. The other organization uses a different domain. Which setting must you enable in the Teams admin center?

Accepted Answer

External access with the domain of the other organization.. To enable federation with another organization that uses a different domain, you must configure External access (also known as federation) in the Teams admin center. Specifically, you need to add the external domain to the allowed domain list under Teams > External access. This allows users in your tenant to communicate with users in the other organization via Teams, using the Session Initiation Protocol (SIP) federation protocol.

Answer

Network roaming policy for the external users.

Answer

Guest access in Teams settings.

Answer

Emergency calling policies.

Question 13

A company is experiencing a significant number of phishing attempts that target high-level executives by impersonating their email addresses. The security team wants to configure protection against user impersonation in Microsoft Defender for Office 365. Which setting must be enabled in the anti-phishing policy to protect these specific users?

Accepted Answer

Enable users to protect against impersonation. The 'Enable users to protect against impersonation' setting in an anti-phishing policy allows you to specify a list of users (such as high-level executives) whose email identities will be monitored for impersonation attempts. When enabled, Defender for Office 365 analyzes inbound messages for display name and email address matches against the protected users, and if a match is found with a suspicious sender, the message is flagged or quarantined. This directly addresses the scenario of attackers spoofing executive email addresses.

Answer

Enable domains to protect against impersonation

Answer

Mailbox intelligence

Answer

Spoofed sender posture

Question 14

A security administrator wants to configure Microsoft Defender for Cloud Apps so that when a user accesses a sensitive file in a sanctioned cloud app from an unmanaged device, the user is blocked from downloading the file and a block action is logged in real time. Which type of policy should the administrator configure?

Accepted Answer

Create a session policy with the action 'Block' on the download action for files with a specific sensitivity label. A session policy in Microsoft Defender for Cloud Apps allows real-time control over user activities within a sanctioned cloud app. By configuring the action 'Block' on the download action for files with a specific sensitivity label, the administrator can block the download when the session is initiated from an unmanaged device, and the block action is logged in real time. This meets the requirement of blocking the download and logging the action simultaneously.

Answer

Create a file policy that monitors for sensitive files being accessed from unmanaged devices and generates an alert

Answer

Configure an access policy that blocks access to the cloud app from unmanaged devices

Answer

Configure an activity policy that monitors download activities from unmanaged devices and triggers automatic remediation

Question 15

Which TWO settings must be configured to set up a hybrid identity deployment using password hash synchronization?

Accepted Answer

Install and configure Microsoft Entra Connect.. Option A is correct because Microsoft Entra Connect is the required synchronization tool that connects your on-premises Active Directory to Microsoft Entra ID and provides the wizard where directory synchronization and sign-in methods are configured. Option C is correct because password hash synchronization is a sign-in method that must be explicitly enabled in Entra Connect (on the "User sign-in" page, select "Password Hash Synchronization") for the hybrid identity deployment to work as described. Option B is not required because Seamless SSO is an optional feature that can be enabled alongside password hash synchronization but is not necessary to set up the deployment itself. Option D is incorrect because AD FS is a separate federated authentication method, not part of a password hash synchronization deployment. Option E is incorrect because Pass-Through Authentication is an alternative sign-in method that validates passwords directly against on-premises AD and is mutually exclusive with password hash synchronization as the primary sign-in method.

Answer

Configure Seamless Single Sign-On (SSO).

Answer

Deploy Active Directory Federation Services (AD FS).

Answer

Configure Pass-Through Authentication.