MS-102 Practice Test 43 — 15 Questions

Question 1

A compliance officer needs to automatically apply a 'Highly Confidential' sensitivity label to any email in Exchange Online that contains social security numbers. The labeling must happen automatically without user interaction. Which two Microsoft Purview components must be configured? (Select the option that correctly identifies both required components.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

sensitivity label and an auto-labeling policy. To automatically apply a 'Highly Confidential' sensitivity label to emails containing social security numbers in Exchange Online, you must configure a sensitivity label (which defines the label and its protection settings) and an auto-labeling policy (which scans Exchange Online for the sensitive info type and applies the label automatically without user interaction). Data Loss Prevention (DLP) policies can detect sensitive information and take actions such as blocking or alerting, but they cannot directly apply sensitivity labels. Therefore, only option C correctly identifies both required components.

Answer

sensitivity label with auto-labeling rule and a Data Loss Prevention policy

Answer

retention label and a Communication Compliance policy

Answer

unified labeling client and a custom sensitive info type

Question 2

An administrator wants to configure automated investigation and response (AIR) in Microsoft 365 Defender so that when a high-severity malware alert is generated for a device from Microsoft Defender for Endpoint, the device is automatically isolated from the network without requiring a security analyst to approve the action. Which configuration step is required?

Accepted Answer

Set the automation level for device isolation to 'Full - remediate threats automatically'. Setting the automation level for device isolation to 'Full - remediate threats automatically' in Microsoft Defender for Endpoint's automated investigation and response (AIR) configuration allows the system to automatically isolate a device when a high-severity malware alert is triggered, without requiring analyst approval. This automation level is specifically designed to execute remediation actions like device isolation immediately based on the alert's severity and the device's risk level.

Answer

Set the automation level for device isolation to 'Semi - require approval for any remediation'

Answer

Create a custom detection rule that automatically isolates the device

Answer

Enable 'Automated device isolation' in the Microsoft 365 Defender settings

Question 3

A compliance officer needs to automatically apply a 'Highly Confidential' sensitivity label to any email in Exchange Online that contains social security numbers. The labeling must happen automatically without user interaction. Which two Microsoft Purview components must be configured? (Select the option that correctly identifies both required components.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An auto-labeling policy and a sensitivity label with encryption configured. Auto-labeling in Microsoft Purview requires three elements: (1) a custom sensitive info type (SIT) defined with the regex pattern (e.g., employee ID), (2) a sensitivity label configured with encryption, and (3) an auto-labeling policy that uses the SIT as a condition to apply the label without user interaction. Option A is incomplete because it omits the custom SIT needed to detect the regex pattern; without it, the auto-labeling policy has no condition to match. Option D includes the SIT and label but lacks the auto-labeling policy, so it cannot apply labels automatically. The question's framing as 'two components' is flawed; the correct set is the SIT, the label, and the auto-labeling policy.

Answer

Data Loss Prevention (DLP) policy and a sensitivity label

Answer

retention label and an auto-labeling policy

Answer

sensitive info type and a sensitivity label

Question 4

You run the KQL query shown in the exhibit in Microsoft Defender XDR advanced hunting. What is the primary purpose of this query?

Accepted Answer

Detect potentially malicious PowerShell commands that are obfuscated. The query filters for powershell.exe processes with an encoded command, which is commonly used to obfuscate malicious commands. Option A is wrong because the query does not filter for specific users. Option C is wrong because the query does not filter by device. Option D is wrong because the query does not filter by time other than the last 7 days.

Answer

Identify all PowerShell activity from a specific user

Answer

Find PowerShell processes running on a specific device

Answer

List all PowerShell executions in the last 7 days

Question 5

You are implementing Microsoft Defender for Office 365. You need to configure anti-phishing policies to protect against user impersonation. Which THREE settings should you configure?

Accepted Answer

Enable impersonation protection for domains you own.. Enabling impersonation protection for domains you own allows Defender for Office 365 to detect and act on attempts to spoof your organization's domain in the From address. This setting ensures that emails claiming to be from your domain are inspected for impersonation patterns, such as lookalike domains or display name spoofing, and can be automatically quarantined or have safety tips applied.

Answer

Set the bulk email threshold.

Answer

Configure spoof intelligence to allow or block senders.

Question 6

You need to monitor which users have accessed a specific document stored in SharePoint Online over the last 90 days. What should you use?

Accepted Answer

Audit log search in Microsoft Purview.. Audit log search in Microsoft Purview is the correct tool because it queries the unified audit log, which records user activities such as file access, download, and sharing events across SharePoint Online and OneDrive for Business. The 'Accessed file' and 'FileAccessed' operations are captured with the user identity, timestamp, and item path, allowing you to filter by date range (up to 90 days by default, extendable to 1 year with the right license) and by the specific document URL. This directly answers the requirement to see *who* accessed a *specific document* over a defined period.

Answer

Data Loss Prevention reports.

Answer

eDiscovery (Premium) case.

Answer

Content search in Microsoft Purview.

Question 7

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a device makes an outbound connection to a known malicious IP address, and within 10 minutes, a process with suspicious command-line arguments is started on the same device. Which two Advanced Hunting tables must be joined using a KQL query to create this detection?

Accepted Answer

DeviceNetworkEvents and DeviceProcessEvents.. The detection rule correlates an outbound network connection to a known malicious IP with a subsequent process creation on the same device within 10 minutes. This requires joining DeviceNetworkEvents (for network connections) with DeviceProcessEvents (for process creation and command-line arguments). DeviceFileEvents is not needed because the rule does not involve file events. Therefore, only Option A provides the necessary tables.

Answer

DeviceEvents and DeviceLogonEvents.

Answer

DeviceProcessEvents and DeviceFileEvents.

Answer

DeviceNetworkEvents and DeviceRegistryEvents.

Question 8

A security analyst wants to create a custom detection rule that triggers when a user receives a phishing email that bypassed Exchange Online Protection, and then clicks a link that leads to a known malicious domain. Which two advanced hunting tables should the analyst combine to detect this chain of events?

Accepted Answer

EmailEvents and UrlClickEvents. Combining EmailEvents (which captures email delivery) with UrlClickEvents (which records user clicks on URLs in emails) allows the analyst to identify the specific chain: a user received a phishing email and then clicked a link. This pair directly links the email receipt to the user's click action. Option D is incorrect because while UrlClickEvents and DeviceNetworkEvents can correlate a click to a network connection, they do not include the email receipt event (EmailEvents), which is essential to detect the full chain described: receiving a phishing email and then clicking a link. Without EmailEvents, there is no evidence that the click originated from an email.

Answer

EmailEvents and DeviceNetworkEvents

Answer

EmailEvents and IdentityLogonEvents

Answer

UrlClickEvents and DeviceNetworkEvents

Question 9

Refer to the exhibit. You are reviewing a Conditional Access policy JSON. The policy is intended to block legacy authentication. However, users are still able to connect using Exchange ActiveSync. What is the most likely reason?

Accepted Answer

The policy is configured in 'report-only' mode instead of 'enforce'. The policy is configured in 'report-only' mode. In report-only mode, Conditional Access policies are evaluated but not enforced. Users can still connect using legacy authentication because the policy does not block access. To block legacy authentication, the policy must be set to 'enforce' mode. Additionally, the client apps condition should include 'Exchange ActiveSync clients' and 'Other clients' to specifically target legacy authentication protocols.

Answer

The policy is missing the 'browser' and 'mobileAppsAndDesktopClient' client app types

Answer

The grant control operator 'OR' should be 'AND'

Answer

The policy is missing a condition for 'device platforms' to target iOS and Android

Question 10

Your organization uses Microsoft Defender for Endpoint (Plan 2) and Microsoft Defender for Identity. A security analyst reports that several domain controllers are generating alerts for anomalous logon activity. You need to investigate the scope of the potential compromise across the entire environment, including endpoints, identities, and cloud apps. What is the most efficient approach?

Accepted Answer

Use the Microsoft Defender XDR portal to view the unified incident. Microsoft Defender XDR provides a unified incident view that correlates alerts from all workloads. Option A is wrong because checking only endpoints misses identity and cloud app alerts. Option B is wrong because checking only identities misses endpoints. Option C is wrong because using multiple portals is inefficient.

Answer

Check each workload portal individually and correlate manually

Answer

Review the alerts in Microsoft Defender for Identity only

Answer

Review the alerts in Microsoft Defender for Endpoint only

Question 11

A junior administrator needs permission to view sign-in logs, audit logs, and security recommendations in the Microsoft Entra admin center, but must not be able to reset passwords, modify settings, or manage roles. Which built-in Microsoft Entra role should the administrator assign?

Accepted Answer

Security Reader. The Security Reader role grants read-only access to security-related data, including sign-in logs, audit logs, and security recommendations, without permitting any write operations such as password resets, setting modifications, or role management. This aligns precisely with the junior administrator's required permissions.

Answer

Global Reader

Answer

Reports Reader

Answer

Security Administrator

Question 12

A company uses password hash synchronization with Microsoft Entra Connect. The security team wants to enable self-service password reset (SSPR) so that users can reset their own passwords, and the password changes must be written back to the on-premises Active Directory. Which additional configuration is required to achieve password writeback?

Accepted Answer

Install Microsoft Entra Connect with password writeback enabled. Password writeback requires the installation of Microsoft Entra Connect with the password writeback feature explicitly enabled during setup. This allows password changes initiated via SSPR to be written back to on-premises Active Directory. Option C is correct because it directly addresses the necessary infrastructure component.

Answer

Configure SSPR to use federation with on-premises AD FS

Answer

Enable password hash synchronization in Microsoft Entra Connect

Answer

Set the SSPR property 'Password writeback' to 'Yes' in the Microsoft Entra admin center

Question 13

A company with Azure AD Premium P2 licenses wants to enforce that all activations of the Global Administrator role require approval from a designated security group. The activation must also require a business justification and expire after 4 hours. Which Azure AD feature should the administrator configure?

Accepted Answer

Azure AD Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) provides time-bound and approval-based role activation. It allows you to require approval from a designated security group, mandate a business justification, and set a maximum activation duration (e.g., 4 hours) for privileged roles like Global Administrator. This directly matches all the requirements in the question.

Answer

Azure AD Identity Protection

Answer

Azure AD Conditional Access

Answer

Azure AD Multi-Factor Authentication

Question 14

A compliance officer wants to prevent users from sending emails that contain personally identifiable information (PII), such as social security numbers, to external recipients. If a user attempts to send such an email from Outlook, the email should be blocked and a policy tip explaining the block should be displayed. Which Microsoft Purview solution should the officer configure?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) policy. Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to detect and block sensitive information, such as PII (e.g., social security numbers), in transit. When a DLP rule matches, it can block the email and display a policy tip in Outlook, informing the user why the message was blocked. This meets the compliance officer's requirement to prevent external sending of PII with real-time user notification.

Answer

Microsoft Purview Information Protection sensitivity label

Answer

Microsoft Purview Records Management retention label

Answer

Microsoft Purview eDiscovery case

Question 15

Your company uses Microsoft Entra ID. You need to restrict access to a critical application to only users who are in a specific security group and are signing in from a trusted location. You configure a conditional access policy with the following conditions: users (the security group), cloud apps (the critical application), conditions (locations: trusted IP ranges). However, users in the security group are still able to access the app from untrusted locations. What is the most likely reason?

Accepted Answer

The policy is in report-only mode. When a Conditional Access policy is in report-only mode, it evaluates the conditions and logs the result but does not enforce any access controls (grant or block). This explains why users in the security group can still access the app from untrusted locations—the policy is not actively blocking or requiring MFA/location compliance. Report-only mode is commonly used for testing before enabling enforcement.

Answer

The policy is configured as a block policy but is overridden by another policy

Answer

The cloud app is not correctly assigned to the policy

Answer

The policy uses session controls instead of grant controls