MS-102 Practice Test 40 — 15 Questions

Question 1

Your company has a Microsoft 365 E5 subscription. You need to configure multi-factor authentication (MFA) for all users. However, the CEO insists that he should not be prompted for MFA when connecting from the corporate office. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Conditional Access policy that excludes the corporate office named location from requiring MFA.. Conditional Access is the modern, recommended way to enforce MFA in Microsoft 365 E5, and it supports named locations (trusted IPs) that can be excluded from the MFA requirement. Creating a policy that requires MFA for all users but excludes the corporate office named location satisfies the CEO's requirement while keeping MFA enforced everywhere else.

Answer

Use per-user MFA and set the CEO's account to bypass.

Answer

Disable MFA for the CEO's account.

Answer

Configure trusted IPs in the MFA service settings.

Question 2

Your company has a Microsoft Entra tenant with 5,000 users. You need to delegate the ability to reset user passwords to the helpdesk team, but only for users in the Sales department. What is the most efficient way to achieve this?

Accepted Answer

Create an administrative unit for Sales, add Sales users, then assign a custom role scoped to that administrative unit. Administrative units (AUs) in Microsoft Entra ID are containers specifically designed to scope administrative permissions to a subset of users, groups, or devices. By creating an AU for Sales, adding the Sales users to it, and assigning a custom role (such as Password Administrator or a custom role with microsoft.directory/users/password/update) scoped to that AU, the helpdesk team gains the ability to reset passwords only for Sales users. This is the most efficient and least-privilege approach because it uses built-in scoping mechanisms without needing to manage separate role assignments per user or create complex conditional access policies.

Answer

Create a security group for Sales, then assign a custom role to the group

Answer

Create a custom role with password reset permissions and assign it to helpdesk

Answer

Add helpdesk users to the Global Administrator role

Question 3

You are a Microsoft 365 administrator for a small business with 50 users. The company uses Microsoft 365 Business Premium. You need to ensure that all users have multi-factor authentication (MFA) enabled. The company does not have any custom conditional access policies. You want to implement MFA as quickly as possible with minimal configuration. What should you do?

Accepted Answer

Enable security defaults in the Microsoft Entra admin center.. Security defaults provide a pre-configured set of security policies, including requiring MFA for all users, that can be enabled with a single toggle in the Microsoft Entra admin center. This is the fastest and simplest method for a small business with no existing conditional access policies, as it requires minimal configuration and immediately enforces MFA for every user.

Answer

Configure MFA registration campaign for all users.

Answer

Enable per-user MFA for each user.

Answer

Create a conditional access policy that requires MFA for all users.

Question 4

An administrator is setting up a new Microsoft 365 tenant and has added the custom domain 'contoso.com'. The domain status shows 'Pending verification'. Which type of DNS record must the administrator add to the public DNS zone to complete domain ownership verification?

Accepted Answer

TXT record. To verify domain ownership in Microsoft 365, you must add a TXT record containing the unique verification string provided by the Microsoft 365 admin center to the public DNS zone. The TXT record proves you control the domain by allowing Microsoft to query the DNS and match the value. This is the standard method defined by RFC 1035 for domain validation.

Answer

MX record

Answer

CNAME record

Answer

SPF record

Question 5

An organization uses Microsoft Entra ID P2 licenses. They want to implement a policy that forces users to perform multi-factor authentication (MFA) only when they sign in from an untrusted location. The trusted locations include the corporate office IP range. Which type of policy should they create?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID allow administrators to enforce MFA based on conditions like location. By configuring a policy that targets all users and cloud apps, with a condition excluding trusted IP ranges (corporate office), MFA is only triggered when sign-ins originate from untrusted locations. This is the precise mechanism for location-based MFA enforcement.

Answer

Identity Protection user risk policy

Answer

MFA registration policy

Answer

Authentication methods policy

Question 6

Your organization uses Microsoft Defender for Identity (MDI) and Microsoft Defender for Cloud Apps. You receive an alert about a user who is performing an unusual number of failed logon attempts from a non-corporate IP address. The user is a member of the Finance group. What is the recommended first step?

Accepted Answer

Contact the user to verify if the activity is legitimate.. When an alert indicates unusual failed logon attempts from a non-corporate IP address, the recommended first step is to contact the user to verify if the activity is legitimate. This follows the principle of verification before action, as the activity could be due to a forgotten password or a misconfigured application. Option B is correct. Option A (resetting password and requiring MFA) is premature without verification, as it may disrupt legitimate access. Option C (disabling the account) could be too disruptive and should only be done after confirming malicious intent. Option D (blocking the IP) might block legitimate users or shared IPs. Option E (closing as false positive) skips investigation and could miss a real threat.

Answer

Reset the user's password and require MFA.

Answer

Disable the user account immediately.

Answer

Block the IP address in the firewall.

Answer

Close the alert as a false positive.

Question 7

A compliance officer needs to automatically apply a sensitivity label named 'Confidential' to documents stored in SharePoint Online whenever the documents contain social security numbers. Users must be prevented from removing the label. Which configuration should the officer implement?

Accepted Answer

Create a sensitivity label with auto-labeling and set 'Require justification to remove the label'. Sensitivity labels support auto-labeling based on sensitive info types (e.g., social security numbers). To prevent users from removing the label, configure the label policy setting 'Require justification to remove a label or lower classification label'. Option B correctly combines auto-labeling with this protection setting. Retention labels (A) manage lifecycle, the MIP unified labeling client (C) is outdated, and DLP policies (D) can apply labels but do not inherently prevent label removal.

Answer

Create a retention label with auto-labeling based on sensitive info types

Answer

Use Microsoft Information Protection (MIP) unified labeling client to apply labels

Answer

Configure Data Loss Prevention (DLP) policy to apply the label

Question 8

Refer to the exhibit. You run the PowerShell commands shown. The output displays 10 mailboxes with various RecipientTypeDetails, including UserMailbox, SharedMailbox, and RoomMailbox. You need to ensure that only user mailboxes are returned. What should you modify?

Accepted Answer

Add the parameter -Filter "RecipientTypeDetails -eq 'UserMailbox'". The Get-Mailbox cmdlet returns all mailbox types by default. To filter only user mailboxes, you must use the -Filter parameter with the condition 'RecipientTypeDetails -eq 'UserMailbox''. This ensures that only mailboxes with RecipientTypeDetails set to UserMailbox are returned, excluding shared, room, and other mailbox types.

Answer

Use the -Properties parameter to specify additional attributes

Answer

Change RecipientTypeDetails to RecipientType in the Select-Object

Answer

Remove the -ShowProgress parameter

Question 9

Contoso uses Microsoft Entra ID P2. Users report that password reset self-service does not work. You verify that the users have the required license. What should you check next?

Accepted Answer

Verify SSPR is enabled in Microsoft Entra ID. The users already have the required Microsoft Entra ID P2 license, which includes SSPR functionality. However, SSPR must be explicitly enabled at the tenant level in Microsoft Entra ID under 'Password reset' settings before users can use the self-service password reset feature. Without this tenant-wide enablement, even licensed users cannot reset their passwords.

Answer

Ensure the users are in a group scoped for SSPR

Answer

Check that the users have registered for SSPR

Answer

Confirm the users have Microsoft Entra ID P1 licenses

Question 10

Your organization uses Microsoft Purview eDiscovery (Premium) for a legal investigation. You need to collect data from Microsoft Teams chat messages and channel conversations. The case manager wants to search for specific keywords and exclude irrelevant content. What should you do?

Accepted Answer

Create a collection in eDiscovery (Premium) with a KQL query to search Teams data.. EDiscovery (Premium) collections allow searching Microsoft Teams chat messages and channel conversations using KQL queries with conditions to include specific keywords and exclude irrelevant content. Option A is incorrect because Content Search (Standard) is less powerful and lacks advanced filtering capabilities for Teams data. Option B is incorrect because DLP policies are designed for data loss prevention, not legal discovery. Option C is incorrect because Communication Compliance is for monitoring communications, not for eDiscovery searches.

Answer

Use Content Search (Standard) with keyword queries.

Answer

Create a DLP policy to capture matching content.

Answer

Use Communication Compliance to review messages.

Question 11

You are configuring Microsoft Entra ID for your organization. You need to enable passwordless authentication for users. Which TWO authentication methods are passwordless and supported by Microsoft Entra ID?

Accepted Answer

Microsoft Authenticator app. The Microsoft Authenticator app supports passwordless authentication by allowing users to approve sign-in requests via a notification or a number match on their mobile device, eliminating the need for a password. FIDO2 security keys are also a passwordless method, using public-key cryptography to authenticate users without a password, and are fully supported by Microsoft Entra ID for both Microsoft Entra ID joined and hybrid joined devices.

Answer

SMS-based one-time passcode (OTP)

Answer

Hardware OATH tokens

Answer

OAuth 2.0 device authorization grant

Question 12

Your company is implementing Microsoft Purview Information Protection to classify and protect sensitive documents. You need to ensure that all documents containing personally identifiable information (PII) are automatically labeled. Which TWO actions should you take? (Select TWO.)

Accepted Answer

Define a custom sensitive info type in Microsoft Purview that matches your organization's PII patterns.. Option A is correct because defining a custom sensitive information type in Microsoft Purview lets you match your organization's specific PII patterns (for example, using regular expressions, keywords, and confidence levels) so that the classification engine can reliably detect the PII unique to your environment. Option E is correct because an auto-labeling policy in Microsoft Purview is the mechanism that automatically applies a sensitivity label to documents that match sensitive information types, which is exactly what is required to label PII-containing documents without user intervention. Option B is incorrect because training users to apply labels manually does not provide the automatic labeling the scenario requires. Option C is incorrect because configuring a sensitivity label to encrypt documents only defines the protection action of a label; by itself it does not automatically detect or label PII content. Option D is incorrect because a retention label governs how long content is kept or deleted, not how it is classified and protected for PII.

Answer

Train users to manually apply a sensitivity label to documents containing PII.

Answer

Configure a sensitivity label to encrypt documents containing PII.

Answer

Create a retention label for documents containing PII.

Question 13

Your company has a Microsoft 365 E5 subscription. You need to configure multi-factor authentication (MFA) for all users. However, the CEO insists that he should not be prompted for MFA when connecting from the corporate office. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an access review for all guest users with a recurrence of 90 days and auto-apply results. Creating an access review for all guest users with a recurrence of 90 days and auto-apply results directly meets the requirement: it reviews guest access every 90 days and automatically removes guests who are not approved. Access reviews in Microsoft Entra ID Governance allow you to scope reviews to guest users, set recurrence, and enable auto-apply to enforce removal without manual intervention.

Answer

Configure a Conditional Access policy to block guests after 90 days

Answer

Configure PIM settings for guest users

Answer

Create an access package in entitlement management for guest users

Question 14

You are deploying Microsoft Entra ID Governance. Which THREE capabilities should you include to meet compliance requirements for access recertification and lifecycle management?

Accepted Answer

Access Reviews. Access Reviews (B) is correct because it is the Entra ID Governance capability that drives access recertification, letting reviewers periodically attest to group memberships, application assignments, and privileged role assignments so stale or excessive access is removed. Lifecycle Workflows (D) is correct because it automates joiner, mover, and leaver tasks—such as pre-hire provisioning, attribute-based updates, and post-termination access removal—which is exactly the lifecycle management requirement. Entitlement Management (E) is correct because access packages, catalogs, and assignment policies govern who can request and retain access, with expiration and approval controls that support recertification and lifecycle governance. Identity Protection (A) is not included because it is a risk-detection and conditional access signal service, not a recertification or lifecycle tool, and B2B Collaboration (C) is not included because it only enables external guest access rather than providing the required governance capabilities.

Answer

Identity Protection

Answer

B2B Collaboration

Question 15

Your company is using Microsoft 365 Business Premium. You want to ensure that all company-owned Windows 10 devices are automatically upgraded to Windows 11 when it becomes available through Windows Update. What should you configure?

Accepted Answer

Create a feature update policy for Windows 10 devices in Intune, targeting the Windows 11 version.. A feature update policy in Intune is specifically designed to upgrade Windows devices from one version to another, such as from Windows 10 to Windows 11. By targeting the Windows 11 version in this policy, you ensure that eligible Windows 10 devices automatically receive the upgrade when it becomes available via Windows Update. This is the correct mechanism for controlling OS version upgrades in a Microsoft 365 Business Premium environment.

Answer

Create a Windows 10 update ring policy in Intune that deploys quality updates.

Answer

Create a device compliance policy in Intune that requires Windows 11.

Answer

Configure a Windows 11 readiness assessment in Microsoft Intune.