MS-102 Practice Test 37 — 15 Questions

Question 1

A company needs to automatically retain all emails sent to or from external partners for 7 years. They also need to ensure that after 7 years, the emails are permanently deleted. What should you configure in Microsoft Purview?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a retention policy for Exchange email with a retention period of 7 years, followed by deletion.. A retention policy in Microsoft Purview can be scoped to Exchange email and configured with a 7-year retention period followed by permanent deletion. This automatically applies to all mailboxes and meets both the retain and delete requirements without user action.

Answer

Create a retention label with a retention period of 7 years and publish it to all users.

Answer

Create an eDiscovery hold for all external partner communications.

Answer

Create a data loss prevention (DLP) policy to block deletion of emails after 7 years.

Question 2

A security analyst needs to search for devices that have been communicating with a known malicious command-and-control server over the past 7 days. The analyst wants to identify the process that initiated the connection. Which advanced hunting query would be most efficient?

Accepted Answer

DeviceNetworkEvents | where RemoteIP == 'malicious IP' and Timestamp > ago(7d) | project DeviceName, InitiatingProcessFileName, Timestamp. DeviceNetworkEvents contains network connection data including the remote IP and the initiating process details. Filtering by RemoteIP and Timestamp directly retrieves the required information without unnecessary joins or subqueries, making it the most efficient query for identifying the process that initiated the connection to a known malicious C2 server.

Answer

DeviceProcessEvents | where ProcessId in (select ProcessId from DeviceNetworkEvents where RemoteIP == 'malicious IP' and Timestamp > ago(7d)) | project DeviceName, ProcessFileName, Timestamp

Answer

DeviceNetworkEvents | where Timestamp > ago(7d) | join DeviceProcessEvents on ProcessId | where RemoteIP == 'malicious IP' | project DeviceName, ProcessFileName, Timestamp

Answer

IdentityLogonEvents | where IPAddress == 'malicious IP' | project DeviceName, Timestamp

Question 3

Which TWO roles can manage user licenses without being able to create users?

Accepted Answer

License Administrator. The License Administrator role in Microsoft 365 is specifically designed to allow users to manage licenses assigned to users and groups without having permissions to create new user accounts. This role grants access to the Microsoft 365 admin center's Billing > Licenses section and the Microsoft Entra ID Licenses blade, enabling license assignment, removal, and consumption monitoring, but it explicitly excludes user creation or deletion capabilities.

Answer

Global Administrator

Answer

User Administrator

Answer

Helpdesk Administrator

Question 4

Your organization needs to prevent users from sharing documents containing personally identifiable information (PII) with external users. You have Microsoft Purview Data Loss Prevention (DLP) deployed. What should you configure?

Accepted Answer

Create a DLP policy that detects PII and restricts sharing to external users.. Microsoft Purview DLP is specifically designed to detect sensitive information types (like PII) in documents and apply protective actions, such as blocking external sharing. A DLP policy can be scoped to locations like SharePoint, OneDrive, Exchange, and Teams, and can enforce rules that prevent users from sharing content containing PII with external users. This directly addresses the requirement by combining detection and enforcement.

Answer

Apply a sensitivity label that blocks external sharing.

Answer

Configure a conditional access policy in Microsoft Entra ID to block external sharing.

Answer

Enable auditing for all document sharing activities.

Question 5

A security analyst wants to create a custom detection rule in Microsoft Defender XDR that triggers when a user receives a phishing email (delivered to inbox) and later clicks a link from that email that leads to a known malicious domain. The rule will be based on an advanced hunting query. Which two tables should the analyst join in the query to capture both the email delivery event and the link click event? (Choose two.)

Accepted Answer

EmailEvents. EmailEvents contains records of email delivery events, including phishing emails that were delivered to the inbox. UrlClickEvents captures user clicks on URLs in emails, including the target domain. Joining these two tables on the email's network message ID allows the analyst to correlate the specific phishing email delivery with the subsequent link click to a known malicious domain, which is the exact scenario described.

Answer

DeviceEvents

Answer

IdentityLogonEvents

Question 6

A company adds and verifies the custom domain 'contoso.com' in their Microsoft 365 tenant. However, emails sent to new users at user@contoso.com bounce back. The existing MX record for contoso.com points to the on-premises mail server. What is the most likely cause of the bounce?

Accepted Answer

The MX record must be updated to point to Exchange Online. B is correct because the MX record for contoso.com still points to the on-premises mail server. When a user is created in Exchange Online with the domain contoso.com, inbound email is routed according to the MX record. Since the MX record directs mail to the on-premises server, which does not have a mailbox for the new user, the message bounces. To deliver mail to Exchange Online, the MX record must be updated to point to Exchange Online (e.g., contoso-com.mail.protection.outlook.com).

Answer

The domain verification failed and needs to be repeated

Answer

Users must be added to the domain in the admin center

Answer

The SPF record is missing or misconfigured

Question 7

Your company is implementing Microsoft 365 Copilot for Microsoft 365. You need to ensure that Copilot can access data from across the organization, but only for users who have the appropriate permissions. What is the primary security boundary for Copilot data access?

Accepted Answer

Microsoft 365 permissions and sensitivity labels. Microsoft 365 Copilot respects the existing Microsoft 365 permissions and sensitivity labels as its primary security boundary. Copilot only surfaces data that the signed-in user already has permission to access, and sensitivity labels govern how that data can be used or shared. This means Copilot inherits the tenant's existing security model rather than introducing a separate one.

Answer

A dedicated Copilot security group in Microsoft Entra ID

Answer

Microsoft Purview Information Protection labels

Answer

The geographic location of the data

Question 8

Your organization uses Microsoft Defender for Endpoint (MDE). A security analyst needs to investigate a file that was detected as malicious on several devices. The analyst wants to see the file's prevalence across the organization and other related events. Which feature in MDE should the analyst use?

Accepted Answer

File page. The File page in Microsoft Defender for Endpoint provides a comprehensive view of a specific file, including its prevalence across the organization, a list of devices where it was observed, and related events such as alerts and detections. This allows the security analyst to investigate the file's spread and associated incidents in one centralized location.

Answer

Alert page

Answer

Device page

Answer

Investigation page

Question 9

Your organization uses Microsoft Defender for Endpoint. A user reports that their device is not receiving security updates. You need to ensure that the device is properly onboarded to Defender for Endpoint. Which log should you check first?

Accepted Answer

Microsoft Defender for Endpoint client logs. The Microsoft Defender for Endpoint client logs (option C) are the primary source for troubleshooting onboarding issues because they contain detailed records of the client's registration, communication with the cloud service, and policy application. If a device is not receiving security updates, it often indicates a failure in the onboarding process or a connectivity problem, which these logs directly capture. Checking these logs first allows you to verify the device's enrollment status and identify any errors in the initial connection or certificate exchange.

Answer

Event Viewer Application logs

Answer

System logs

Answer

Windows Update logs

Question 10

Your organization uses Microsoft Defender for Endpoint. You need to configure a rule that automatically isolates a device from the network when a specific threat is detected, but only if the device is in a specific device group. Which approach should you use?

Accepted Answer

Automation rule. Automation rules in Microsoft Defender for Endpoint allow you to define automated actions, such as isolating a device, based on specific conditions like threat severity and device group membership. This directly meets the requirement to isolate only devices in a specific group when a specific threat is detected, as automation rules support granular scoping by device group.

Answer

Indicator of compromise (IoC)

Answer

Custom detection rule

Answer

Group policy in Intune

Question 11

Your organization uses Microsoft Entra ID. You want to enforce Multi-Factor Authentication (MFA) for all users. You have already configured Conditional Access policies. However, some users are still able to sign in without MFA. What should you check first?

Accepted Answer

Confirm that all users are included in the policy's user assignment.. The most common reason a Conditional Access policy fails to enforce MFA is that not all users are included in the policy's user assignment. If the policy targets only a subset of users (e.g., a test group), users outside that scope will bypass MFA entirely. The first troubleshooting step is to verify that the policy's 'Users and groups' assignment includes 'All users' or the specific groups covering all users.

Answer

Ensure all users have registered for MFA.

Answer

Verify that the Conditional Access policy is enabled.

Answer

Check if there are any exclusions configured.

Question 12

Your company has a hybrid identity configuration with Microsoft Entra Connect Sync. You need to enable password hash synchronization (PHS) for hybrid users. What is the prerequisite?

Accepted Answer

Hybrid Identity Administrator role in Microsoft Entra ID. The Hybrid Identity Administrator role in Microsoft Entra ID is required to enable password hash synchronization (PHS) because this role grants the necessary permissions to configure directory synchronization settings, including the PHS feature, within the Entra ID tenant. Without this role, the synchronization account used by Microsoft Entra Connect Sync cannot modify the tenant-level PHS toggle, even if the local service account has sufficient permissions on-premises.

Answer

Pass-through authentication agent installed

Answer

Password writeback enabled

Answer

Federation with AD FS

Question 13

Refer to the exhibit. You run the PowerShell command shown. The output shows no results. The user confirms they downloaded files from SharePoint last week. What is the most likely cause?

Accepted Answer

Audit logging is not enabled for the user.. The PowerShell command shown is likely Search-UnifiedAuditLog, which queries the unified audit log. If the output is empty despite the user having downloaded files from SharePoint, the most likely cause is that audit logging (specifically, mailbox or SharePoint audit logging) is not enabled for that user or workload. Without audit logging turned on, no events are recorded, so the search returns nothing.

Answer

The UserIds parameter is misspelled.

Answer

The RecordType parameter is incorrect.

Answer

The Operations parameter is incorrect.

Question 14

Refer to the exhibit. You are creating a custom role in Microsoft Entra ID for helpdesk staff. What can users assigned this role do?

Accepted Answer

Read user properties and reset passwords. The custom role shown in the exhibit includes only the 'Users' > 'Basic' > 'Read' permission and the 'Authentication' > 'Passwords' > 'Reset password' permission. This combination allows helpdesk staff to read basic user properties (such as display name, user principal name, and job title) and reset user passwords. It does not grant write access to other user attributes, security groups, or license assignments.

Answer

Read security groups and reset passwords

Answer

Create new users and reset passwords

Answer

Read user properties and assign licenses

Question 15

Match each Microsoft 365 compliance feature to its purpose.

Accepted Answer

Data Loss Prevention (DLP): Prevents accidental sharing of sensitive information.. Correct matches: DLP prevents accidental sharing, eDiscovery searches for legal needs, and Sensitivity Labels classify/protect data. Common confusions include mixing DLP with retention policies and eDiscovery with automatic classification.

Answer

Data Loss Prevention (DLP): Manages data retention and deletion policies.

Answer

eDiscovery: Applies automatic classification based on content patterns.