MS-102 Practice Test 33 — 15 Questions

Question 1

Which TWO features in Microsoft Defender for Office 365 help protect against zero-day malware in email attachments?

Accepted Answer

Safe Attachments. Safe Attachments (Option A) is correct because it uses a detonation chamber environment to open email attachments in a virtualized sandbox, analyzing behavior for zero-day malware before delivery. This process catches unknown threats by executing the attachment and observing malicious actions, unlike signature-based detection.

Answer

Mail flow rules

Answer

Anti-spam policies

Answer

Anti-phishing policies

Question 2

A company uses Microsoft Entra ID P2 licenses. They want to require multi-factor authentication (MFA) for all users when accessing the Azure Management portal, but only from devices that are not marked as compliant. Additionally, a group named 'BreakGlass' must be excluded from this requirement. Which Conditional Access policy configuration should be applied?

Accepted Answer

Assign to 'All users', condition: 'Device state (preview) is not compliant', grant: 'Require MFA', exclude: 'BreakGlass group'. It directly maps the requirement: assign the policy to 'All users', use the 'Device state (preview) is not compliant' condition to target only non-compliant devices, grant 'Require MFA' for the Azure Management portal (selected via the 'Cloud apps' condition), and exclude the 'BreakGlass' group. This ensures MFA is enforced only when accessing the Azure Management portal from non-compliant devices, while break-glass accounts are exempt.

Answer

Assign to 'All users', condition: 'Sign-in risk is medium or higher', grant: 'Require MFA', exclude: 'BreakGlass group'

Answer

Assign to 'All users', condition: 'Client apps: Browser and Mobile apps', grant: 'Block access', exclude: 'BreakGlass group'

Answer

Assign to 'All users', condition: 'Device platform: Android, iOS, Windows, macOS', grant: 'Require MFA', exclude: 'BreakGlass group'

Question 3

A security administrator needs to create an automated investigation and response (AIR) playbook that automatically isolates a device whenever a high-severity alert from Microsoft Defender for Endpoint is generated. The playbook should run without requiring manual approval. Which capability in Microsoft 365 Defender should the administrator configure?

Accepted Answer

Automated investigation and response (AIR) action policy. Automated Investigation and Response (AIR) action policies in Microsoft 365 Defender allow administrators to define automated remediation actions—such as device isolation—that execute automatically when specific alert conditions are met, without requiring manual approval. The policy can be configured to trigger on high-severity alerts from Microsoft Defender for Endpoint, enabling fully automated containment of compromised devices.

Answer

Custom detection rule

Answer

Threat analytics

Answer

Attack simulation training

Question 4

A security administrator is configuring Microsoft Defender for Cloud Apps. The administrator needs to discover which cloud apps are being used in the organization and then block usage of unsanctioned apps in real time using a reverse proxy. Which two Defender for Cloud Apps features must be configured? (Select the two correct options.)

Accepted Answer

Cloud Discovery. Cloud Discovery is the correct feature because it identifies which cloud apps are in use by analyzing traffic logs from the organization's network. This provides the visibility needed to determine which apps are unsanctioned. Conditional Access App Control is the correct feature because it uses a reverse proxy to enforce real-time access controls, blocking unsanctioned apps at the session level.

Answer

App governance

Answer

OAuth app permissions

Question 5

You are configuring Microsoft Entra ID to allow external users from a partner organization to access a specific SharePoint Online site. You need to ensure that the external users authenticate using their own corporate credentials and are automatically invited when they first access the resource. What should you configure?

Accepted Answer

Microsoft Entra entitlement management access packages. Microsoft Entra entitlement management access packages allow you to create a policy that automatically sends an invitation to external users when they request access to a resource, such as a SharePoint Online site. This policy can be configured to require that external users authenticate using their own corporate credentials (via their home tenant) and be automatically added to the resource upon first access, without manual invitation. Entitlement management integrates with B2B collaboration under the hood, but adds the automation and approval workflows needed for this scenario.

Answer

Microsoft Entra External ID (B2C)

Answer

Microsoft Entra B2B direct connect

Answer

Microsoft Entra B2B collaboration with manual invitation

Question 6

You are configuring Microsoft Defender for Identity (MDI) to monitor for lateral movement attacks. Which of the following activities would MDI alert on as a potential lateral movement?

Accepted Answer

A user logging into multiple servers using a compromised account.. Microsoft Defender for Identity (MDI) can detect lateral movement when a compromised account is used to log into multiple servers, which indicates an attacker moving laterally within the network. Option B is incorrect because DCSync is a domain replication attack that targets the domain controller to extract credentials, not lateral movement. Option C is incorrect because password spray is a type of brute force attack that tries common passwords against many accounts, not lateral movement. Option D is incorrect because executing a privilege escalation tool on a workstation is a local privilege escalation attempt, not lateral movement between systems. Option E is incorrect because brute force attacks on a domain controller are authentication attacks, not lateral movement.

Answer

A user performing a DCSync attack.

Answer

A user conducting a password spray attack.

Answer

A user executing a privilege escalation tool on their workstation.

Answer

A user performing a brute force attack on a domain controller.

Question 7

Which THREE conditions must be met for a tenant-to-tenant migration of SharePoint Online content?

Accepted Answer

The destination site collection or OneDrive must already exist in the target tenant.. SharePoint Online tenant-to-tenant migration requires the destination site collection or OneDrive to already exist in the target tenant. The migration process copies content into a pre-provisioned container; it does not create the site or OneDrive automatically. This ensures that the target structure is ready to receive the migrated data without requiring dynamic provisioning during the migration.

Answer

The source user performing the migration must be a global admin in the target tenant.

Answer

Both tenants must have at least one user with PowerShell access.

Question 8

Your organization uses Microsoft Defender for Cloud Apps. You want to set up a policy that automatically suspends a user if they download more than 100 files from SharePoint Online within 10 minutes. Which type of policy should you create?

Accepted Answer

Activity policy. An Activity policy in Microsoft Defender for Cloud Apps monitors user activities across connected apps and can trigger automated actions, such as suspending a user, when a specific threshold of downloads from SharePoint Online is exceeded within a defined time window. This policy type is designed to detect anomalous behavior patterns like mass file downloads, making it the correct choice for this scenario.

Answer

Session policy

Answer

File policy

Answer

App discovery policy

Question 9

You are implementing Microsoft Entra ID Governance. You need to automate the creation of guest user accounts when employees submit a request through the company's HR system. What should you use?

Accepted Answer

Lifecycle Workflows. Lifecycle Workflows (D) is the correct choice because it is the Microsoft Entra ID Governance feature designed to automate identity lifecycle processes, including the creation of guest user accounts triggered by events such as HR system submissions. It uses built-in or custom workflows with tasks like 'Create user' and 'Send email' to handle the entire provisioning flow without manual intervention.

Answer

Microsoft Entra Verified ID

Answer

Access Reviews

Answer

Microsoft Entra ID Protection

Question 10

A compliance officer needs to monitor employee communications across Microsoft Teams and Outlook for potential insider trading, using predefined policies. The solution must detect keywords like 'insider tip' and 'stock' and allow designated reviewers to take action. Which Microsoft Purview solution should the officer use?

Accepted Answer

Communication Compliance. Communication Compliance is the correct Microsoft Purview solution because it is specifically designed to detect sensitive keywords (e.g., 'insider tip' and 'stock') in Microsoft Teams chats, channel messages, and Outlook emails using predefined or customizable policies. It enables designated reviewers to investigate and take remediation actions such as removing messages or escalating for legal review, directly addressing the insider trading monitoring requirement.

Answer

Data Loss Prevention

Answer

eDiscovery (Premium)

Answer

Records Management

Question 11

You need to grant a vendor access to a specific SharePoint Online site for a limited time. The vendor does not have an account in your Microsoft Entra ID. What should you use?

Accepted Answer

Use Microsoft Entra B2B collaboration and set an expiration for the guest user. Microsoft Entra B2B collaboration allows you to invite external users (vendors) as guest users to access your organization's resources, including SharePoint Online sites, without requiring them to have an existing account in your tenant. You can configure an expiration policy for the guest user account to automatically remove access after a specified period, meeting the requirement for limited-time access.

Answer

Create a user account via Microsoft Entra Connect

Answer

Configure self-service sign-up user flow

Answer

Assign the vendor a guest user account with no expiration

Question 12

Your organization uses Microsoft Entra ID and has strict security requirements. You need to implement a Zero Trust security model. Which THREE of the following are foundational principles of Zero Trust that should be implemented?

Accepted Answer

Use least privilege access. Option E (Verify explicitly) is correct because Zero Trust requires that every access request be authenticated and authorized based on all available data points, including user identity, device health, location, and resource sensitivity, rather than granting implicit trust. Option C (Use least privilege access) is correct because Zero Trust mandates just-in-time and just-enough-access (JIT/JEA), risk-based adaptive policies, and data protection to limit each user's access to only what is needed for the task. Option D (Assume breach) is correct because Zero Trust operates on the assumption that the network is already compromised, so organizations must minimize blast radius, segment access, verify end-to-end encryption, and use analytics to detect and respond to threats. Option A (Assume trust based on location) does not belong because Zero Trust explicitly rejects implicit trust from network location such as a corporate LAN or VPN, which is a core tenet of the traditional perimeter model. Option B (Segment access) is a related implementation tactic rather than one of the three foundational principles, which Microsoft defines as Verify explicitly, Use least privilege access, and Assume breach.

Answer

Assume trust based on location

Answer

Segment access

Question 13

Your organization is implementing a zero-trust security model. Which TWO Microsoft Entra ID features should you enable to enforce least-privilege access and continuous verification?

Accepted Answer

Conditional Access. Conditional Access (A) is correct because it enforces least-privilege access by applying policies that require specific conditions (e.g., device compliance, location, risk level) before granting access to resources. It also enables continuous verification by evaluating signals in real time during each authentication request, ensuring that access is revoked if conditions change (e.g., user risk increases). This aligns directly with the zero-trust principle of 'never trust, always verify.'

Answer

Self-service password reset (SSPR)

Answer

Application Proxy

Answer

Microsoft Entra Join

Question 14

A company (Contoso) frequently collaborates with a partner company (Fabrikam) via B2B collaboration. Contoso wants to require Fabrikam's guest users to perform MFA using Contoso's MFA policies, ignoring any MFA claims from the Fabrikam home tenant. However, Fabrikam's users already have MFA enabled in their home tenant. What should Contoso configure in their cross-tenant access settings?

Accepted Answer

Disable trust for MFA from the external tenant in the cross-tenant access settings. Contoso wants to ignore MFA claims from Fabrikam's home tenant and enforce its own MFA policies on Fabrikam's guest users. In cross-tenant access settings, disabling trust for MFA from the external tenant ensures that Contoso does not honor any MFA claims issued by Fabrikam, thereby requiring Fabrikam's users to perform MFA again according to Contoso's conditional access policies.

Answer

Set the inbound trust settings to accept MFA claims from Fabrikam

Answer

Set the inbound trust settings to accept compliant device claims

Answer

Set the inbound trust settings to block MFA and require Contoso's MFA

Question 15

Your organization uses Microsoft Defender XDR. You need to configure automatic attack disruption for SaaS applications. Which Microsoft 365 security solution provides this capability?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (Option B) provides automatic attack disruption for SaaS applications by using risk indicators and automation to stop attacks in real time. Option A (Microsoft Defender for Identity) focuses on on-premises Active Directory and identity threats, not SaaS apps. Option C (Microsoft Defender for Office 365) protects email and collaboration tools. Option D (Microsoft Defender for Endpoint) secures endpoints like desktops and servers. Therefore, only option B delivers the required capability.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Endpoint