MS-102 Practice Test 39 — 15 Questions

Question 1

Your company has a Microsoft 365 E5 tenant with Microsoft Entra ID P2. You are the security administrator. You need to implement a solution that automatically detects and remediates identity risks. Requirements:
- Risky sign-ins (e.g., from anonymous IP addresses) should be automatically blocked.
- Users with confirmed compromised credentials should be forced to reset their password at next sign-in.
- You need to receive alerts when high-risk events occur.
- The solution must minimize false positives.

Which Microsoft Entra ID features should you combine?

Accepted Answer

Enable Microsoft Entra Identity Protection, configure a sign-in risk policy to block high-risk sign-ins, and a user risk policy to require password reset for high-risk users. Set up alerts for risk events.. The correct combination is Microsoft Entra Identity Protection with a sign-in risk policy to block high-risk sign-ins and a user risk policy to require password reset for high-risk users, plus alerts for risk events. Identity Protection uses machine learning to detect risky sign-ins and compromised credentials, and the risk policies automatically remediate based on risk level. This minimizes false positives by using risk-based conditional access.

Answer

Set up Microsoft Entra Identity Governance access reviews and enable self-service password reset.

Answer

Configure Conditional Access policies to block sign-ins from anonymous IP addresses and require password reset for all users.

Answer

Deploy Microsoft Defender for Cloud Apps to detect risky sign-ins and configure session policies.

Question 2

Your company, Fabrikam Inc., uses Microsoft Entra ID with hybrid identity. You have an on-premises Active Directory and use Microsoft Entra Connect Sync to synchronize users. You need to configure Microsoft Entra ID Protection to detect leaked credentials and risky sign-ins. Additionally, you must ensure that when a user is detected as high risk, their access is automatically blocked and they are required to change their password. You also need to enable password writeback so that password changes are written back to on-premises AD. You have the following options: A. Enable Identity Protection, configure user risk policy to require password change, and enable password writeback in Microsoft Entra Connect. B. Enable Identity Protection, configure sign-in risk policy to block access, and enable password hash sync. C. Configure Conditional Access policy to require MFA for all users, and enable seamless SSO. D. Deploy Microsoft Defender for Identity and configure automatic remediation. Which option should you choose?

Accepted Answer

Enable Identity Protection, configure user risk policy to require password change, enable password writeback. It directly addresses all requirements: enabling Identity Protection allows detection of leaked credentials and risky sign-ins; configuring the user risk policy to require a password change automatically blocks high-risk users until they change their password; and enabling password writeback in Microsoft Entra Connect ensures that password changes performed in the cloud are written back to on-premises Active Directory, maintaining hybrid identity synchronization.

Answer

Enable Identity Protection, configure sign-in risk policy to block access, enable password hash sync

Answer

Deploy Microsoft Defender for Identity, configure automatic remediation

Answer

Configure Conditional Access policy to require MFA, enable seamless SSO

Question 3

A security analyst runs the above KQL query in Microsoft 365 Defender. The query returns an empty result set. Which is the most likely reason?

Accepted Answer

No antivirus detection events for files with 'ransomware' or 'encrypt' in the filename occurred in the last 7 days.. The KQL query filters DeviceEvents for antivirus detection events where the filename contains 'ransomware' or 'encrypt' within the last 7 days. An empty result set simply means no such events matched the filter criteria during that period — this is a normal, expected outcome when no ransomware-like files were detected, not an error condition. The query syntax and table are valid; the absence of data is the answer.

Answer

The time range is too wide and the query times out.

Answer

The 'has_any' operator is used incorrectly; it should be 'contains' for each condition.

Answer

The DeviceEvents table does not contain antivirus detection events.

Question 4

You are a security administrator for a company that uses Microsoft Defender XDR. You need to generate a report that shows the number of incidents closed as true positive, false positive, and benign in the last 30 days. You want to use built-in features without writing custom queries. What should you do?

Accepted Answer

In the Microsoft Defender XDR portal, go to Reports > General > Incident summary.. The Microsoft Defender XDR portal includes a built-in Reports section under General with an Incident summary report that shows incident counts by classification (true positive, false positive, benign) over a selected period such as 30 days. This requires no custom queries and directly provides the requested metrics. Navigating to Reports > General > Incident summary is the correct built-in path.

Answer

Use the Microsoft Defender for Endpoint reports section.

Answer

Use the Device health report in Microsoft Defender XDR.

Answer

Navigate to Threat analytics in the Defender XDR portal.

Question 5

Your organization needs to ensure that all emails containing credit card numbers are automatically encrypted before being sent to external recipients. Which Microsoft Purview solution should you configure?

Accepted Answer

Configure a DLP policy that uses the 'Encrypt email messages' action.. A Microsoft Purview DLP policy can detect sensitive information types like credit card numbers (via the Credit Card Number SIT) and apply the 'Encrypt email messages' action, which uses Office 365 Message Encryption (OME) to encrypt the email before it leaves the organization. This directly satisfies the requirement to automatically encrypt emails containing credit card numbers sent to external recipients. DLP policies are evaluated at send time and can enforce encryption without user intervention.

Answer

Create a sensitivity label that applies encryption and auto-labeling.

Answer

Set up a retention policy with encryption.

Answer

Implement a Communication Compliance policy.

Question 6

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that automatically blocks downloads of files containing sensitive information from SharePoint Online to unmanaged devices. What type of policy should you create?

Accepted Answer

Session policy. A session policy in Microsoft Defender for Cloud Apps is used to enforce real-time controls on user sessions, including blocking downloads of files with sensitive information from SharePoint Online to unmanaged devices. Session policies leverage Conditional Access App Control to proxy the session and apply DLP-like controls.

Answer

Microsoft Purview Data Loss Prevention policy

Answer

Activity policy

Answer

File policy

Question 7

Your organization uses Microsoft Defender XDR and Microsoft 365 E5 licenses. You are a security administrator. The security team wants to receive email notifications for high-severity incidents only. You need to configure the notification settings. What should you do?

Accepted Answer

In the Microsoft Defender XDR portal, go to Settings > Microsoft 365 Defender > Email notifications, and create a notification for high-severity incidents.. In Microsoft Defender XDR, email notifications for incidents are configured under Settings > Microsoft 365 Defender > Email notifications. You can create a notification rule that specifies the severity level (e.g., high) and recipients. This directly fulfills the requirement to receive email notifications for high-severity incidents only.

Answer

Create an incident response rule that sends an email when a high-severity incident is created.

Answer

Use the Microsoft Purview compliance portal to create an alert policy.

Answer

Configure a service health notification in the Microsoft 365 admin center.

Question 8

You are a security administrator for a large enterprise with 10,000 users. The company uses Microsoft 365 E5 licenses, which include Microsoft Defender XDR. The company has recently experienced a series of ransomware attacks where attackers gained initial access through phishing emails, then moved laterally using compromised credentials, and finally deployed ransomware on file servers. The CISO wants to implement a comprehensive defense strategy that reduces the attack surface and automates response. The requirements are: 1) Prevent phishing emails from reaching users, especially those targeting executives. 2) Detect and block lateral movement using compromised credentials. 3) Automatically contain compromised devices during an incident. 4) Provide a unified incident view across email, endpoints, and identities. You need to recommend a solution that meets all requirements with minimal manual effort. What should you do?

Accepted Answer

Configure Microsoft Defender XDR by enabling Defender for Office 365 with anti-phish and impersonation protection, Defender for Identity, and Defender for Endpoint with automated investigation and response.. It leverages the native Microsoft Defender XDR suite, which directly addresses all four requirements: Defender for Office 365 with anti-phish and impersonation protection prevents phishing emails (requirement 1); Defender for Identity detects lateral movement using compromised credentials by monitoring on-premises Active Directory signals (requirement 2); Defender for Endpoint with automated investigation and response automatically contains compromised devices (requirement 3); and the integrated Defender XDR portal provides a unified incident view across email, endpoints, and identities (requirement 4). This solution requires minimal manual effort because the components are natively integrated and automation is built-in.

Answer

Use Microsoft Purview to classify and protect sensitive data, and configure data loss prevention policies to block ransomware.

Answer

Deploy Microsoft Sentinel and create analytics rules to detect phishing, lateral movement, and ransomware. Configure automated playbooks to contain devices.

Answer

Upgrade to Microsoft Entra ID P2 and enable Identity Protection for risky sign-ins and user risk. Use Conditional Access to block access from compromised devices.

Question 9

Your organization has a Microsoft 365 E5 subscription and uses Microsoft Teams. You need to prevent external users from being added to sensitive teams that contain financial data. What should you configure?

Accepted Answer

A sensitivity label for containers that blocks guest access.. Sensitivity labels for containers (groups and sites) can be configured to block guest access, which directly prevents external users from being added to Teams that contain sensitive data. This is the most targeted and appropriate control because it enforces protection at the container level based on the label applied to the team. Conditional Access policies control access based on user, device, and location conditions but do not prevent guests from being added to a team. Information barriers prevent specific users from communicating with each other but are not designed to block all external users from a team. DLP policies protect content but do not prevent membership additions.

Answer

Azure AD Conditional Access policy for guest users.

Answer

An information barrier policy between finance and external.

Answer

A DLP policy for Teams chat and channel messages.

Question 10

Your organization plans to migrate from on-premises Exchange to Exchange Online. You need to ensure minimal disruption during the migration. Which approach should you recommend?

Accepted Answer

Deploy a hybrid configuration and migrate mailboxes in batches.. A hybrid configuration with batch migration is the recommended approach for minimal disruption because it allows coexistence between on-premises Exchange and Exchange Online, enabling gradual mailbox moves while maintaining free/busy, calendar sharing, and mail flow. Batch migration lets you schedule and control the pace, reducing user impact and allowing rollback if issues arise.

Answer

Perform a cutover migration during a weekend.

Answer

Use IMAP migration to migrate all mailboxes in parallel.

Answer

Use a third-party migration tool for a one-time bulk migration.

Question 11

You are designing a Microsoft 365 tenant for a multinational organization. You need to ensure compliance with data residency requirements. Which THREE actions should you take?

Accepted Answer

Set data location preferences in the Microsoft 365 admin center.. Setting data location preferences in the Microsoft 365 admin center (under Settings > Org Settings > Organization Information) allows you to specify the primary data residency region for your tenant. This ensures that core data at rest, such as Exchange Online mailboxes and SharePoint sites, is stored in the selected geographic location to meet compliance requirements.

Answer

Disable cross-region replication in Exchange Online.

Answer

Create data loss prevention policies for each region.

Question 12

An administrator who is not a Global Administrator needs to manage just-in-time privileged access to Azure resources using Microsoft Entra Privileged Identity Management (PIM). Which built-in role must be assigned to the administrator to allow PIM management for Azure resources?

Accepted Answer

Privileged Role Administrator. The Privileged Role Administrator role is the only built-in role that grants permissions to manage all aspects of Privileged Identity Management (PIM) for Azure resources, including configuring just-in-time access, managing role assignments, and approving activation requests. This role is specifically designed for administrators who need to oversee PIM without requiring Global Administrator privileges, as it provides full control over PIM policies and role settings across Microsoft Entra ID and Azure resources.

Answer

User Administrator

Answer

Security Administrator

Answer

Application Administrator

Question 13

You are a security administrator. You need to investigate a suspicious logon from an anonymous IP address. Which Microsoft Defender XDR data source should you query first?

Accepted Answer

Identity and authentication events. A suspicious logon from an anonymous IP address is an identity and authentication event. Microsoft Defender XDR's Identity and authentication events data source includes sign-in logs, authentication attempts, and related identity activities. Querying this source first will provide details such as the user account, IP address, location, and success/failure status, which are crucial for investigating the logon.

Answer

Cloud app events

Answer

Endpoint device events

Answer

Vulnerability and compliance events

Answer

Email & collaboration events

Question 14

You are a Microsoft 365 Administrator for a company that is implementing a hybrid identity solution with Active Directory Federation Services (AD FS) for single sign-on (SSO). The company has recently acquired a subsidiary with its own on-premises Active Directory domain. You need to ensure that the identity lifecycle for users from the subsidiary is managed effectively through Microsoft Entra ID (formerly Azure AD) and that licensing is assigned efficiently. Which three of the following actions should you take? (Choose three.)

Accepted Answer

Use Microsoft Entra Connect to implement a filtered synchronization scope so that only users from the subsidiary’s sales department are synchronized initially.. Options A, C, and E are correct. A: Microsoft Entra Connect can synchronize identities from multiple on-premises AD forests into a single Microsoft Entra tenant, and group-based licensing allows automatic assignment of Microsoft 365 licenses based on directory attributes like department, ensuring efficient lifecycle management. C: Filtered synchronization scope (e.g., using OU or attribute filtering) lets you initially synchronize only a subset of users (like sales) to control the rollout and test the hybrid identity configuration. E: Microsoft Entra ID Governance’s Entitlement Management can create access packages that include licenses and assign them via dynamic group membership, providing automated, policy-driven license assignment that integrates with identity lifecycle. B is incorrect because creating a separate tenant for the subsidiary would create administrative overhead and fragmentation; cross-tenant synchronization is not needed for multi-forest sync to a single tenant. D is incorrect because Microsoft Entra cloud sync is for simple sync scenarios and does not support AD FS; in a hybrid environment with AD FS, Microsoft Entra Connect is required. F is incorrect because password hash synchronization is not required to coexist with AD FS; AD FS can be used together with directory synchronization from multiple domains, and PHS is an optional feature.

Answer

Configure Microsoft Entra cloud sync for the subsidiary domain to synchronize users, then assign licenses manually through PowerShell scripts to avoid any inheritance issues.

Answer

Configure password hash synchronization (PHS) for the subsidiary domain because AD FS cannot coexist with directory synchronization on separate domains.

Answer

Create a new Microsoft Entra tenant for the subsidiary and configure cross-tenant synchronization to bring users into the main tenant.

Question 15

A user reports that they cannot access Microsoft Teams from their mobile device. Other Microsoft 365 services work fine. You verify that the device is compliant with Intune policies. What is the most likely cause?

Accepted Answer

A Conditional Access policy requires an approved client app for Teams. A Conditional Access policy requiring an approved client app for Microsoft Teams would block access from a mobile device even if the device is Intune-compliant, as the policy specifically checks for the use of an approved app (e.g., the official Microsoft Teams app) rather than just device compliance. Since the user can access other Microsoft 365 services, the issue is isolated to Teams, and the device compliance status rules out broader device-level blocks.

Answer

The user's authentication method is not registered for Microsoft Entra ID

Answer

The Microsoft Teams service is degraded

Answer

The device is not enrolled in Microsoft Intune