MS-102 Practice Test 38 — 15 Questions

Question 1

Your organization uses Microsoft 365 and wants to implement a passwordless authentication strategy. Which THREE methods are supported natively in Microsoft Entra ID for passwordless sign-in?

Accepted Answer

Microsoft Authenticator app (phone sign-in). Microsoft Entra ID natively supports three passwordless authentication methods: Windows Hello, FIDO2 security keys, and the Microsoft Authenticator app (phone sign-in), so option B is correct because Authenticator phone sign-in lets users sign in by approving a notification with a biometric or PIN instead of a password. Option C is correct because Temporary Access Pass is a native passwordless method that issues a time-limited passcode used to register other passwordless methods or recover access. Option E is correct because FIDO2 security keys are native passwordless credentials that use WebAuthn for phishing-resistant sign-in. Options A and D are not correct because smart cards and certificate-based authentication, while supported for authentication in Entra ID, are not classified as native passwordless sign-in methods in the passwordless authentication strategy.

Answer

Smart cards (physical or virtual)

Answer

Certificate-based authentication

Question 2

Your organization uses Microsoft 365 and wants to ensure that only compliant devices can access Exchange Online. You have Microsoft Intune for device management. What should you configure?

Accepted Answer

Create a Conditional Access policy with 'Require device to be marked as compliant'. To enforce that only compliant devices can access Exchange Online, you need a Conditional Access policy that includes the 'Require device to be marked as compliant' grant control. This policy evaluates the device compliance status reported by Intune and blocks or grants access accordingly. Without this Conditional Access policy, even compliant devices are not forced to meet compliance requirements before accessing Exchange Online.

Answer

Configure devices to be Azure AD Joined

Answer

Create an app protection policy in Intune

Answer

Create a device compliance policy in Intune

Question 3

A security analyst wants to create a custom detection rule in Microsoft Defender XDR that triggers when a user receives a phishing email and clicks a link to a known malicious domain. Which advanced hunting table should the analyst query to track the clicked URL?

Accepted Answer

EmailUrlInfo. The EmailUrlInfo table in Advanced Hunting for Microsoft Defender XDR contains records of URLs that were present in emails, including the URL domain and whether the link was clicked. By joining EmailEvents with EmailUrlInfo on the NetworkMessageId, the analyst can identify when a user clicked a URL that leads to a known malicious domain, making it the correct table for tracking clicked URLs.

Answer

EmailEvents

Answer

EmailAttachmentInfo

Answer

DeviceEvents

Question 4

An organization wants to prevent users from running executable files from the Windows Temp folder. Which Microsoft Defender for Endpoint capability should be configured?

Accepted Answer

Attack surface reduction rules. Attack surface reduction (ASR) rules are a Microsoft Defender for Endpoint capability that can block executable files from running from specific locations, such as the Windows Temp folder. Rule GUID 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 specifically targets this behavior by preventing executables and scripts from launching from temporary folders. This is the correct capability because ASR rules are designed to reduce the attack surface by controlling common malware entry points and persistence mechanisms.

Answer

Network protection

Answer

Exploit protection

Answer

Controlled folder access

Question 5

Your company is deploying Microsoft 365 Copilot for all users. You need to ensure that Copilot responses are grounded only in organizational data that users already have permission to access. Additionally, you must comply with data residency requirements in the European Union. Which THREE actions should you take?

Accepted Answer

Apply sensitivity labels to restrict Copilot from accessing specific files.. Sensitivity labels can be configured to block Copilot from accessing files with specific labels, ensuring that Copilot responses are grounded only in organizational data that users already have permission to access. This is done by using Microsoft Purview Information Protection to define label-based restrictions that Copilot respects, preventing it from surfacing content from labeled files even if the user has direct access.

Answer

Block Copilot for all users outside the EU using conditional access policies.

Answer

Enable Copilot caching in Microsoft Purview to control data storage locations.

Question 6

Your organization receives a data subject request (DSR) to export personal data of a user. Which Microsoft Purview solution should you use to search for and export the data?

Accepted Answer

Microsoft Purview eDiscovery. Microsoft Purview eDiscovery allows you to search for content across Microsoft 365 and export it, which is necessary to fulfill a data subject request (DSR) to export personal data. Option A is incorrect because retention policies are used to retain data for a specified period, not to export it. Option B is incorrect because audit logs track activities but do not provide content search or export capabilities. Option D is incorrect because Data Loss Prevention (DLP) is designed to prevent data leaks, not to export data.

Answer

Microsoft Purview retention policies

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Data Loss Prevention

Question 7

Your organization uses Microsoft Defender for Cloud Apps. You need to generate a report of all external users who have shared sensitive files from SharePoint Online. Which feature should you use?

Accepted Answer

Activity log. The Activity log in Microsoft Defender for Cloud Apps captures detailed records of user activities across connected apps, including file-sharing events in SharePoint Online. By filtering the log for external users and sensitive file types, you can generate a precise report of external sharing activities. This is the correct feature because it directly records the specific actions needed for the report.

Answer

OAuth app policies

Answer

App permissions report

Answer

Cloud Discovery

Question 8

A security administrator needs to block users from running portable executable files (e.g., .exe, .scr) that were downloaded from the internet on Windows devices. Which Attack Surface Reduction (ASR) rule should the administrator enable to meet this requirement?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion. The ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) specifically targets executable files (e.g., .exe, .scr) that have been downloaded from the internet by checking their Mark-of-the-Web (MoTW) attribute. When enabled, this rule prevents execution of such files unless they meet criteria like high prevalence, sufficient age, or inclusion in a trusted list, directly addressing the requirement to block internet-downloaded portable executables.

Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Answer

Block Adobe Reader from creating child processes

Answer

Block persistence through WMI event subscription

Question 9

An organization wants to receive email notifications for all service health incidents. Which role must an administrator have to configure service health notifications in the Microsoft 365 admin center?

Accepted Answer

Global Administrator. Only the Global Administrator role has the necessary permissions to access and modify the Service Health section in the Microsoft 365 admin center, including configuring email notifications for service health incidents. This is because the Global Administrator role is the highest privileged role and is required to manage tenant-wide settings such as service health alerts, which are not delegated to lower-level administrative roles.

Answer

Service Support Administrator

Answer

Helpdesk Administrator

Answer

Billing Administrator

Question 10

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that detects when a user shares a file containing sensitive data with an external domain. Which three components must you configure in the policy? (Choose three.)

Accepted Answer

A content inspection method (e.g., DLP). The correct components for a file policy in Microsoft Defender for Cloud Apps are: a filter to specify the scope (e.g., sharing with external users), a content inspection method (e.g., DLP) to detect sensitive data, and a governance action (e.g., alert or block). Option D is incorrect because session control actions are used in session policies, not file policies. Option E is incorrect because access token conditions are not a component of file policies.

Answer

A session control action

Answer

An access token condition

Question 11

Refer to the exhibit. You are configuring a session policy in Microsoft Defender for Cloud Apps. The policy must block downloads when both the app risk is high and the user risk is high. Based on the exhibit, which additional condition should you add to ensure the policy only applies to unsanctioned apps?

Accepted Answer

Add a condition for app tag to be 'unsanctioned'.. In Microsoft Defender for Cloud Apps session policies, to restrict the policy to unsanctioned apps, you must add a condition on the app tag. Unsanctioned apps are those that have been marked as unsanctioned in Cloud App Catalog. The condition 'app tag equals unsanctioned' ensures the policy only applies to those apps. The other conditions (app risk score, user risk score, activity) do not filter by sanction status.

Answer

Add a condition for app risk score to be medium or low.

Answer

Add a condition for user risk score to be medium.

Answer

Add a condition for activity to include upload.

Question 12

Refer to the exhibit. You have two DLP compliance rules as shown. A user sends an email containing both PII and credit card numbers. Which rule will be applied?

Accepted Answer

Both rules will be evaluated, and the most restrictive action will be applied.. When multiple DLP rules match the same email, Microsoft Purview evaluates all matching rules and applies the most restrictive action among them. In this case, both the PII rule and the Credit Cards rule match, so the action with the highest restriction (e.g., Block over Notify) is enforced. This ensures that sensitive data is protected even when multiple policies overlap.

Answer

Block PII rule only

Answer

Block Credit Cards rule only

Answer

Neither rule will apply because they conflict.

Question 13

An administrator wants to add a second custom domain, 'contoso-europe.com', to their existing Microsoft 365 tenant. The domain 'contoso.com' is already verified. What is the first step the administrator should take?

Accepted Answer

Add the domain in the Microsoft 365 admin center. Before any DNS records can be created or users can be assigned the new domain, the domain must first be added to the tenant in the Microsoft 365 admin center (or via the Microsoft Graph/Exchange admin center). This step registers the domain in the tenant and generates the required verification TXT record values. Only after the domain is added can the administrator proceed to DNS verification and then configure services.

Answer

Create a DNS TXT verification record

Answer

Update the UPN suffixes for users

Answer

Create a new Microsoft 365 tenant

Question 14

You run the above KQL query in Microsoft Defender XDR Advanced Hunting. The query returns no results. What is the most likely reason?

Accepted Answer

The column name SenderDomain does not exist in EmailEvents.. The most likely reason is that the column name 'SenderDomain' does not exist in the EmailEvents table. In Microsoft Defender XDR Advanced Hunting, the EmailEvents table contains columns like 'SenderFromDomain' or 'SenderMailFromDomain', but not 'SenderDomain'. Therefore, the query would fail to return results because of an invalid column reference.

Answer

The EmailDirection filter should be 'Outbound'.

Answer

No inbound emails were blocked in the last 30 days.

Answer

The time range should be 7 days instead of 30 days.

Question 15

An organization with Microsoft Entra ID P2 licenses wants to require multi-factor authentication (MFA) for all users but allow them to register their authentication methods before being forced to use MFA. Which configuration should they implement?

Accepted Answer

Conditional Access policy with MFA grant and a registration campaign. A Conditional Access policy with an MFA grant control enforces MFA for all users, and a registration campaign (or the combined registration experience) allows users to register their authentication methods before enforcement kicks in. This satisfies both the requirement to require MFA and the requirement to let users register first. Entra ID P2 licensing supports Conditional Access and the registration campaign feature.

Answer

Security defaults

Answer

Per-user MFA

Answer

Identity Protection user risk policy