MS-102 Practice Test 42 — 15 Questions

Question 1

Your organization is implementing Microsoft Defender for Cloud Apps. You need to configure anomaly detection policies to alert when a user downloads an unusually large number of files from SharePoint Online. Which data source should you connect to enable this detection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

App connector for SharePoint Online. To detect anomalous file downloads from SharePoint Online, Microsoft Defender for Cloud Apps requires direct integration with the service via an App connector. The App connector for SharePoint Online (option B) enables the collection of metadata and activity logs necessary for anomaly detection policies, such as the 'Unusual file download by a user' policy. Without this connector, Defender for Cloud Apps cannot monitor SharePoint Online activities.

Answer

API connector for custom apps

Answer

Microsoft 365 Defender portal

Answer

Microsoft Entra ID logs

Question 2

Your company is planning to use Microsoft 365 Copilot for Microsoft 365. Which THREE prerequisites are required for Copilot to function? (Choose three.)

Accepted Answer

Microsoft Entra ID (formerly Azure AD). Microsoft Entra ID (formerly Azure AD) is required because Copilot for Microsoft 365 relies on Entra ID for authentication, identity management, and policy enforcement. Without Entra ID, Copilot cannot verify user identities, apply conditional access policies, or access Microsoft Graph to retrieve user and organizational data.

Answer

Microsoft Sentinel for security monitoring

Answer

Microsoft Intune for mobile device management

Question 3

A compliance officer needs to prevent users from sharing confidential documents with external users outside the organization. The policy should block sharing via email attachments or sharing links from SharePoint Online. Which Microsoft Purview solution should be configured?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) in Microsoft Purview is designed to identify, monitor, and automatically protect sensitive information across Exchange Online, SharePoint Online, and OneDrive for Business. By creating a DLP policy with a rule that blocks sharing of confidential documents via email attachments or sharing links to external users, the compliance officer can enforce the required restriction. DLP policies can inspect content for sensitive data types (e.g., credit card numbers, custom confidential labels) and apply actions such as blocking the sharing action or sending a notification.

Answer

Sensitivity labels

Answer

Retention policies

Answer

Information barriers

Question 4

Your organization uses Microsoft Defender for Cloud Apps. You need to be alerted when a user accesses a cloud app from a risky IP address. What should you configure?

Accepted Answer

Create an anomaly detection policy with the 'Activity from risky IP address' template.. An anomaly detection policy can alert on activities from risky IP addresses. Option B is wrong because session policies control real-time access. Option C is wrong because file policies monitor data. Option D is wrong because access policies control access based on conditions.

Answer

Create a session policy to monitor risky IP addresses.

Answer

Create a file policy to detect access from risky IPs.

Answer

Create an access policy to block risky IPs.

Question 5

You are deploying Microsoft 365 for a new subsidiary. The subsidiary has a single domain subsidiary.com. You need to configure a hybrid identity solution with Microsoft Entra ID. The on-premises Active Directory has a single domain and all user accounts are synchronized using Microsoft Entra Connect. You want to ensure that users can sign in to Microsoft 365 using their on-premises credentials without exposing the password hash to Microsoft. What should you do?

Accepted Answer

Enable pass-through authentication (PTA) with Microsoft Entra Connect.. Pass-through authentication (PTA) allows users to sign in to Microsoft 365 using their on-premises credentials without storing password hashes in Microsoft Entra ID. PTA validates passwords directly against on-premises Active Directory via an agent, ensuring no password hash is exposed to Microsoft, which meets the stated requirement.

Answer

Configure password hash synchronization.

Answer

Create cloud-only user accounts and disable on-premises authentication.

Answer

Implement Active Directory Federation Services (AD FS) with Microsoft Entra ID.

Question 6

You need to integrate Microsoft Defender XDR with Microsoft Sentinel for centralized monitoring. Which data connector should you use?

Accepted Answer

Microsoft Defender XDR connector. The Microsoft Defender XDR connector (option D) is the correct choice because it ingests signals from all Microsoft 365 Defender components—including Defender for Endpoint, Office 365, Identity, and Cloud Apps—into Microsoft Sentinel. This connector uses the Microsoft 365 Defender API to stream unified alerts and incidents, enabling centralized monitoring and correlation across the entire XDR stack.

Answer

Microsoft Defender for Cloud connector

Answer

Azure Security Center connector

Answer

Microsoft 365 Defender connector

Question 7

Which TWO permissions are required for a custom role to manage Conditional Access policies in Microsoft Entra ID?

Accepted Answer

microsoft.directory/conditionalAccessPolicies/read. To manage Conditional Access policies in Microsoft Entra ID, a custom role requires both the read and update permissions. The 'read' permission (option B) is necessary to view existing policies, while the 'update' permission (option D) is required to modify or configure policy settings. Without both, the role cannot effectively manage policies, as management implies the ability to change them.

Answer

microsoft.directory/conditionalAccessPolicies/allProperties/read

Answer

microsoft.directory/conditionalAccessPolicies/delete

Answer

microsoft.directory/conditionalAccessPolicies/create

Question 8

A company wants to use Azure AD Identity Protection features such as user risk policies and sign-in risk policies to automatically respond to risky behavior. Which Azure AD license is required to enable these capabilities?

Accepted Answer

Azure AD Premium P2. Microsoft Entra ID Protection features like user risk policies and sign-in risk policies require Microsoft Entra ID P2. This is because P2 includes Identity Protection, which provides risk-based conditional access policies that automatically respond to detected risks. Microsoft Entra ID P1 supports Conditional Access but lacks the risk detection and automated remediation capabilities of Identity Protection.

Answer

Azure AD Free

Answer

Azure AD Premium P1

Answer

Microsoft 365 E3

Question 9

Your organization plans to allow external users to access a SharePoint Online site using their own Microsoft Entra ID credentials. You need to ensure that external users can authenticate without creating a guest account in your tenant. Which solution should you use?

Accepted Answer

Configure B2B direct connect. Microsoft Entra B2B direct connect allows users from another Microsoft Entra tenant to access SharePoint Online sites and OneDrive using their own home tenant credentials without creating guest accounts in your tenant. It is configured through cross-tenant access settings and supports SharePoint Online and OneDrive in addition to Teams shared channels. B2B collaboration (A) creates guest user objects in your tenant, so it does not meet the requirement. Creating external users as members (B) also provisions user objects in the tenant. Microsoft Entra Verified ID (D) is a decentralized identity verification service and does not by itself grant external users access to SharePoint Online without a guest account.

Answer

Configure B2B collaboration

Answer

Create external users as members

Answer

Use Microsoft Entra Verified ID

Question 10

A security administrator wants to automatically isolate a device in Microsoft Defender for Endpoint whenever a high-severity alert is triggered. The isolation should occur without manual intervention. Which Microsoft Defender XDR feature should be configured?

Accepted Answer

Automated investigation and response. Automated Investigation and Response (AIR) in Microsoft Defender XDR is designed to automatically respond to threats by running playbooks that can take remediation actions, such as isolating a device, without manual intervention. When a high-severity alert triggers, AIR evaluates the alert and, if configured, executes the isolation action as part of its automated response, meeting the requirement for zero-touch isolation.

Answer

Attack surface reduction rules

Answer

Threat analytics

Answer

Vulnerability management

Question 11

You are investigating a phishing campaign targeting your organization. In Microsoft Defender XDR, you run a KQL query in Advanced Hunting to find all email messages that contain a specific phishing URL. Which table should you query?

Accepted Answer

EmailUrlInfo. The EmailUrlInfo table in Advanced Hunting stores URL information extracted from email messages, including the specific URLs found in the body or attachments. To find all email messages containing a specific phishing URL, you must query this table because it directly maps URLs to their associated email identifiers (e.g., NetworkMessageId).

Answer

EmailAttachmentInfo

Answer

UrlClickEvents

Answer

EmailEvents

Question 12

Which THREE are valid Microsoft Entra ID license plans that include Identity Protection?

Accepted Answer

Microsoft 365 E5 Security. Microsoft Entra ID Identity Protection is a premium feature that requires either a Microsoft Entra ID P2 license or inclusion in a suite like Microsoft 365 E5 or Microsoft 365 E5 Security. Option C (Microsoft 365 E5 Security) is correct because it includes Microsoft Entra ID P2, which provides full Identity Protection capabilities including risk-based conditional access and user risk policies.

Answer

Microsoft Entra ID P1

Answer

Microsoft 365 E3

Question 13

Refer to the exhibit. You have a Conditional Access policy as shown. The exhibit shows the policy is in Report-only mode and that Microsoft Azure Management is included as the target cloud app. A Global Administrator reports that they are not prompted for MFA when accessing the Azure portal. Which is the most likely reason?

Accepted Answer

The policy is in Report-only mode.. The policy is set to 'Report-only' mode, which means it evaluates sign-ins and logs results but does not enforce any controls like MFA. Even though the policy targets Microsoft Azure Management (which includes the Azure portal), the enforcement mode must be 'On' to require MFA. Since it is in Report-only mode, the Global Administrator is not prompted for MFA.

Answer

The Global Administrator role is not included in the policy.

Answer

The user is accessing from a trusted IP address.

Answer

The policy does not include the Azure portal as a target cloud app.

Question 14

Refer to the exhibit. You run the Get-RetentionCompliancePolicy cmdlet and see the output. Your organization wants to retain all ProjectX documents for 10 years and then allow users to delete them. However, users complain that documents are being deleted automatically. What is the issue?

Accepted Answer

The policy is disabled, so it should not be enforcing.. The policy is disabled (Enabled: False), so it is not enforcing any retention or deletion actions. However, users are complaining that documents are being deleted automatically, which cannot be caused by this disabled policy. The issue is likely another policy or process. Option A is incorrect because even if the retention action is 'Delete', it has no effect since the policy is disabled. Option C is incorrect because Mode 'Enable' means the policy is active when enabled, but since it is disabled, mode is irrelevant. Option D is incorrect because 'DateCreated' is a valid retention trigger.

Answer

The retention action is set to Delete instead of NoAction.

Answer

The mode is set to Enable, which means the policy is in test mode.

Answer

The retention trigger is set to DateCreated, which is incorrect.

Question 15

Which THREE of the following are valid permissions in Microsoft Entra ID custom roles? (Choose three.)

Accepted Answer

microsoft.directory/applications/delete. Option A, microsoft.directory/applications/delete, is a valid permission for deleting applications. Option B, microsoft.directory/applications/credentials/update, is valid for managing application credentials. Option C, microsoft.directory/users/update, is valid for updating user properties. Option D, microsoft.directory/roles/assign, is not valid; role assignment uses the microsoft.directory/roleAssignments/assign action. Option E, microsoft.directory/groups/members/update, is valid for updating group membership. Therefore, the valid permissions are A, B, C, and E.

Answer

microsoft.directory/roles/assign