MS-102 Practice Test 35 — 15 Questions

Question 1

Your company has a Microsoft 365 E5 subscription and uses Microsoft Entra ID. Users report that they are frequently prompted for multi-factor authentication (MFA) even after signing in successfully. You want to minimize these prompts while maintaining security. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Authentication Session Management. Configuring Authentication Session Management in a Conditional Access policy allows you to control how often users are prompted for MFA by setting the sign-in frequency (e.g., every 24 hours) or persistent browser session (e.g., 'Remember MFA for 14 days'). This directly addresses the user complaint of frequent MFA prompts while maintaining security by enforcing reauthentication at defined intervals.

Answer

Modify the Conditional Access policy to require MFA for all apps

Answer

Change the per-user MFA state to Disabled

Answer

Adjust Identity Protection user risk policy

Question 2

Your organization uses Microsoft Entra ID to manage user identities. You need to ensure that users can reset their own passwords without administrator intervention, but only if they have registered for self-service password reset (SSPR). What should you configure?

Accepted Answer

Enable SSPR for a selected security group containing registered users. Enabling SSPR for a selected security group ensures that only users who have been explicitly added to that group (and thus have registered for SSPR) can reset their own passwords without administrator intervention. This meets the requirement of restricting self-service password reset to registered users only, while still allowing password changes without admin approval.

Answer

Configure a conditional access policy requiring admin approval for password changes

Answer

Configure Microsoft Entra ID Protection user risk policy

Answer

Enable SSPR for All users

Question 3

An administrator has added the custom domain 'contoso.co.uk' to their Microsoft 365 tenant and verified ownership. Users now need to receive email at @contoso.co.uk. Which DNS record must the administrator add in the public DNS zone to route emails to Exchange Online?

Accepted Answer

Add an MX record pointing to .mail.protection.outlook.com. To route email for a custom domain to Exchange Online, you must add an MX record in the public DNS zone that points to the Exchange Online mail exchanger. The correct target is .mail.protection.outlook.com, where is your initial tenant name (e.g., contoso-com). This MX record tells sending mail servers to deliver messages for @contoso.co.uk to Microsoft's email infrastructure.

Answer

Add a CNAME record for autodiscover

Answer

Add an SPF record

Answer

Add a DKIM record

Question 4

A user reports that they are unable to access a file in SharePoint Online. You check the audit log and see that the file was quarantined by Microsoft Defender for Office 365. What is the most likely reason?

Accepted Answer

The file was detected as malware by Safe Attachments.. Microsoft Defender for Office 365 uses Safe Attachments to detect and quarantine malicious files in SharePoint Online. Option A is wrong because overwriting by a previous version does not trigger quarantine. Option C is wrong because retention policies move files to Preservation Hold library, not quarantine. Option D is wrong because sensitivity labels classify files but do not quarantine them. Option E is wrong because DLP policies block sharing or apply protections, but do not quarantine files.

Answer

The file was overwritten by a previous version.

Answer

The file has a retention policy that moved it to the Preservation Hold library.

Answer

The file was labeled as highly confidential by Microsoft Purview Information Protection.

Answer

The file contains sensitive information and triggered a Data Loss Prevention (DLP) policy.

Question 5

A security administrator wants to reduce the risk of credential dumping from LSASS on managed Windows endpoints. Which Attack Surface Reduction rule should be enabled?

Accepted Answer

Block credential stealing from the Windows Local Security Authority Subsystem. The 'Block credential stealing from the Windows Local Security Authority Subsystem' ASR rule (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2) specifically prevents credential dumping from LSASS by blocking access to the process memory via common techniques like Mimikatz or direct API calls (e.g., OpenProcess, ReadProcessMemory). This directly reduces the risk of credential theft on managed Windows endpoints.

Answer

Block executable files from running unless they meet prevalence, age, or trusted list criteria

Answer

Block untrusted and unsigned processes that run from USB

Answer

Block JavaScript or VBScript from launching downloaded executable content

Question 6

A company has just signed up for Microsoft 365 Business Standard without adding a custom domain. An administrator needs to create the first user accounts. What will be the default email address format for these new users?

Accepted Answer

username@.onmicrosoft.com. When a Microsoft 365 tenant is created without adding a custom domain, the default domain is the `.onmicrosoft.com` domain. New user accounts are automatically assigned an email address in the format `username@.onmicrosoft.com`, as this is the initial domain provisioned for the tenant. Option C correctly reflects this default behavior.

Answer

username@contoso.com

Answer

username@onmicrosoft.com

Answer

username@microsoftonline.com

Question 7

A user reports that they cannot access a legitimate external website because Microsoft Defender for Endpoint is blocking it. The website is required for business. What should you do to allow access while maintaining security?

Accepted Answer

Add the URL to the custom indicators allow list. Adding the URL to the custom indicators allow list in Microsoft Defender for Endpoint allows the specific URL while maintaining network protection for all other traffic. This is the granular approach to permit a legitimate business site without disabling security controls. The allow list overrides block actions for that indicator.

Answer

Exclude the device from the policy

Answer

Disable network protection for the device

Answer

Add the user to a custom group with lower security

Question 8

Your organization uses Microsoft Defender XDR. You want to create a custom detection rule that triggers an alert when a specific process is created on multiple endpoints. Which advanced hunting table should you use?

Accepted Answer

DeviceProcessEvents. DeviceProcessEvents. This table captures process creation events, which is the required data for a detection rule on a specific process being created.

Option A (DeviceNetworkEvents) is incorrect because it logs network connections, not process creation. 
Option B (DeviceFileEvents) is incorrect because it logs file operations. 
Option C (DeviceLogonEvents) is incorrect because it logs logon events. 
Option D (DeviceRegistryEvents) is incorrect because it logs registry changes.

Answer

DeviceNetworkEvents

Answer

DeviceFileEvents

Answer

DeviceLogonEvents

Answer

DeviceRegistryEvents

Question 9

A compliance officer needs to prevent external users from printing or copying content from documents stored in a SharePoint Online site. Which Microsoft Purview feature should be configured to enforce this restriction?

Accepted Answer

Sensitivity labels with encryption and usage rights. Sensitivity labels with encryption and usage rights allow administrators to apply Azure Rights Management (Azure RMS) protection to documents, which can restrict actions such as printing and copying. By configuring a sensitivity label with specific usage rights (e.g., 'View Only' or disabling 'Extract' and 'Print'), external users are prevented from printing or copying content even after the document is downloaded or accessed in SharePoint Online. This is the only Purview feature that directly enforces persistent content-level restrictions on external users.

Answer

Data Loss Prevention (DLP) policy

Answer

Information Barriers

Answer

Microsoft Purview Information Protection without encryption

Question 10

Your organization uses Microsoft Defender for Cloud Apps. You need to be alerted when a user accesses a cloud app from an anonymous IP address. Which type of policy should you create?

Accepted Answer

Activity policy. An activity policy in Microsoft Defender for Cloud Apps can detect access from anonymous IP addresses by monitoring user activities. Option A is incorrect because a session policy controls user sessions in real-time but does not specifically alert on anonymous IP access. Option B is incorrect because a file policy focuses on monitoring and protecting files, not on access from anonymous IPs. Option D is incorrect because an app discovery policy is used to discover shadow IT and unsanctioned apps, not to alert on anonymous IP access.

Answer

Session policy

Answer

File policy

Answer

App discovery policy

Question 11

Your organization has Microsoft Defender for Office 365 Plan 2. You need to ensure that when a user reports a phishing email using the Report Message add-in, the email is automatically submitted to Microsoft for analysis and the user is notified of the result. What should you configure?

Accepted Answer

Configure a submission policy in the Microsoft 365 Defender portal. In Microsoft 365 Defender, user-reported messages are handled through the Submissions page, governed by a user submission policy. Configuring this policy in the Defender portal lets you route reported phish to Microsoft for analysis, set the user-reported mailbox, and enable result notifications back to the reporting user. This is the native mechanism for the Report Message/Report Phishing add-ins.

Answer

Create a Safe Links policy to block the reported email

Answer

Configure an anti-phishing policy to automatically submit reported emails

Answer

Use a mail flow rule to send reported emails to a custom mailbox

Question 12

Your company is migrating from an on-premises file server to SharePoint Online. You need to ensure that files containing personally identifiable information (PII) are automatically detected and classified with a sensitivity label. What should you use?

Accepted Answer

Auto-labeling for sensitivity labels in Microsoft 365.. Auto-labeling for sensitivity labels in Microsoft 365 uses the same sensitive information types (SITs) and trainable classifiers that power DLP, but its purpose is to apply a sensitivity label rather than block or retain content. When files are uploaded to SharePoint Online, the service-side auto-labeling policy evaluates them against the configured rules and stamps the matching label, which then drives encryption, watermarking, and access controls. This is the only option that both detects PII and applies a sensitivity label automatically.

Answer

A retention label auto-applied by a trainable classifier.

Answer

Microsoft Information Protection scanner.

Answer

A DLP policy to block sharing of PII.

Question 13

An administrator wants to add a custom domain 'contoso.com' to a new Microsoft 365 tenant. The domain is already registered and available. What is the first step the administrator should perform in the Microsoft 365 admin center?

Accepted Answer

Add the domain and verify ownership by creating a TXT record. The first step when adding a custom domain to a Microsoft 365 tenant is to add the domain in the admin center and then verify ownership by creating a TXT record in the domain's DNS zone. This proves you control the domain before any services (like email or SharePoint) can be configured. Without verification, Microsoft 365 will not allow further domain-related setup.

Answer

Create user accounts with the new domain

Answer

Configure email routing with MX records

Answer

Set up SharePoint Online with the new domain

Question 14

You are configuring Microsoft Defender for Identity to monitor on-premises Active Directory. You need to ensure that honeytoken accounts are configured to detect attackers attempting to use them. What is a honeytoken account?

Accepted Answer

A fake user account created to attract attackers. A honeytoken account is a fake user account created to lure attackers. When an attacker tries to use it, Defender for Identity triggers an alert. Option A is incorrect because honeytoken accounts are not real service accounts. Option B is incorrect because they are not necessarily disabled; they can be enabled but with no real privileges. Option D is incorrect because they are not real high-privilege accounts, but fake decoys.

Answer

A service account used for application authentication

Answer

A disabled user account that cannot be used for sign-in

Answer

A real user account with high privileges used for monitoring

Question 15

Your company has deployed Microsoft Defender for Endpoint on all Windows devices. You are investigating an alert for a suspicious PowerShell command that was blocked by Attack Surface Reduction (ASR) rules. The alert shows the command was executed from a script embedded in a Word document. You need to identify the ASR rule that blocked this activity. Which rule is most likely responsible?

Accepted Answer

Block Office applications from creating child processes. The ASR rule 'Block Office applications from creating child processes' is designed to stop Office apps (Word, Excel, PowerPoint) from spawning processes like powershell.exe, cmd.exe, or wscript.exe. A malicious macro in a Word document that launches PowerShell is the textbook trigger for this rule, which is why it is the most likely blocker.

Answer

Block Office applications from making Win32 API calls

Answer

Block Office applications from injecting code into other processes

Answer

Block Office applications from creating executable content