MS-102 Practice Test 45 — 15 Questions

Question 1

A compliance officer needs to prevent users from accidentally sharing documents containing credit card numbers with external users via email. The block should occur at the time the user attempts to send the email. Which Microsoft Purview feature should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct feature because it is specifically designed to inspect email content in transit for sensitive data patterns, such as credit card numbers, and enforce policy actions like blocking the message at the transport layer. In Microsoft Purview, DLP policies can be configured to scan Exchange Online messages in real time using sensitive information types (e.g., Credit Card Number) and apply a block action with an optional policy tip to the user before the email leaves the outbound queue.

Answer

Communication compliance

Answer

Records management

Answer

Insider risk management

Question 2

An organization has just purchased Microsoft 365 Business Standard licenses. The administrator adds a new user through the admin center. By default, does the new user receive a welcome email with sign-in instructions?

Accepted Answer

Yes, if the administrator does not clear the 'Send welcome email' checkbox during user creation.. When an administrator adds a new user through the Microsoft 365 admin center, the default behavior is to send a welcome email containing the user's sign-in name and temporary password. The administrator can opt out by clearing the 'Send welcome email in email' checkbox during the creation process. Therefore, the user receives the email unless the administrator explicitly deselects that option.

Answer

Yes, always, regardless of how the user is created.

Answer

No, the administrator must manually send the welcome email using a script.

Answer

No, welcome emails are only sent when using the 'Add multiple users' option.

Question 3

A company wants to prevent their Microsoft 365 tenant from allowing external users to be invited by default. Only specific administrators should be able to invite guests. Which setting should be changed?

Accepted Answer

External Identities – External collaboration settings. The correct setting is under External Identities – External collaboration settings, specifically the 'Guest invite settings' option. By default, this is set to 'Anyone in the organization can invite guest users including guests and non-admins'. Changing it to 'Only users assigned to specific admin roles can invite guest users' restricts guest invitations to designated administrators, meeting the requirement to prevent default external user invitations.

Answer

Conditional Access policy to block external users

Answer

Tenant restrictions

Answer

B2B direct connect

Question 4

Your organization uses Microsoft Defender XDR. You need to configure automatic response actions for a high-severity incident. Which TWO options are available in the Microsoft Defender XDR automated investigation and response capabilities?

Accepted Answer

Isolate a device from the network. Option B (Isolate a device from the network) is correct because Microsoft Defender XDR automated investigation and response (AIR) can automatically contain a compromised endpoint by isolating it from the network, blocking most network traffic while preserving the Defender for Endpoint connection for remediation. Option C (Collect an investigation package from a device) is correct because AIR can automatically gather forensic data from an endpoint into an investigation package, which includes running processes, network connections, scheduled tasks, and other artifacts for analyst review. Option A (Create a mailbox rule to delete suspicious emails) is not an AIR response action; mailbox-level remediation in Defender XDR is performed through actions like soft delete, hard delete, or moving messages to Junk/Deleted Items, not by creating custom mailbox rules. Option D (Delegate mailbox permissions) is an Exchange administrative task unrelated to automated incident response. Option E (Reset user passwords) is not an automated response action provided by Defender XDR AIR; password resets are handled through identity management tools such as Microsoft Entra ID, not as a Defender XDR automated remediation.

Answer

Create a mailbox rule to delete suspicious emails

Answer

Delegate mailbox permissions

Answer

Reset user passwords

Question 5

A compliance officer needs to prevent users from accidentally sharing documents containing credit card numbers with external users via email. The block should occur at the time the user attempts to send the email. Which Microsoft Purview feature should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data Loss Prevention (DLP) policy. A Data Loss Prevention (DLP) policy is the correct solution because it is specifically designed to detect sensitive information, such as credit card numbers, in transit (e.g., email) and enforce actions like blocking the message and displaying a policy tip to the user. DLP policies use sensitive information types (e.g., Credit Card Number) and rules to inspect content in Exchange Online, SharePoint, OneDrive, and Teams, allowing real-time blocking with user notification. This directly meets the compliance officer's requirement to prevent external sharing and provide immediate feedback.

Answer

sensitivity label

Answer

retention label

Answer

An information barrier policy

Question 6

Your organization has Microsoft 365 E5 and uses Microsoft Defender for Cloud Apps. You want to block downloads from an unsanctioned cloud app that is used by some employees. What should you configure?

Accepted Answer

Configure the app as unsanctioned in Defender for Cloud Apps and create a session policy to block downloads.. Marking the app as unsanctioned in Defender for Cloud Apps and creating a session policy allows blocking downloads from that app. Option A is incorrect because a DLP policy protects data but does not block app usage. Option B is incorrect because a conditional access policy can enforce controls like requiring managed apps, but it does not directly block downloads from an unsanctioned app. Option C is incorrect because blocking by IP address is ineffective for cloud apps that use dynamic IP ranges.

Answer

Create a DLP policy to block sharing of sensitive data with the app.

Answer

Create a conditional access policy to require the use of managed apps.

Answer

Block the app by its IP addresses in the firewall.

Question 7

Refer to the exhibit. A Conditional Access policy is created in Microsoft Entra ID. The policy targets the Office 365 app (which includes Exchange Online). You have 1000 users assigned. What is the immediate effect of this policy on users who are currently signed in?

Accepted Answer

No immediate effect; users will be blocked on their next sign-in attempt.. Conditional Access policies in Microsoft Entra ID are evaluated at the time of sign-in. They do not terminate existing sessions. Therefore, users who are already signed in will not be affected until their next authentication attempt, at which point the policy's block action will be enforced.

Answer

All high-risk users are immediately blocked from accessing email.

Answer

The policy is invalid because the Office 365 app does not support block.

Answer

Only users with a sign-in risk of high are blocked.

Question 8

A company has an existing Microsoft 365 tenant with the verified custom domain 'contoso.com'. The administrator now wants to add a second custom domain, 'contoso-europe.com', to the same tenant. What is the first step the administrator should take?

Accepted Answer

Add the domain in the Microsoft 365 admin center.. The first step to add a second custom domain to an existing Microsoft 365 tenant is to initiate the domain addition process in the Microsoft 365 admin center. This triggers the system to generate the unique TXT verification record that must be added to the public DNS zone to prove ownership of the domain. Without first adding the domain in the admin center, the administrator would not know the specific verification value required for the DNS record.

Answer

Add a TXT verification record in the public DNS zone for 'contoso-europe.com'.

Answer

Add an MX record pointing to Exchange Online in the public DNS zone for 'contoso-europe.com'.

Answer

Contact Microsoft support to enable the domain addition feature.

Question 9

An administrator needs to open a Microsoft 365 support request because a critical service issue is affecting all users. Which two pieces of information should the administrator have readily available before contacting support? (Choose two.)

Accepted Answer

Tenant ID. Option A (Tenant ID) is correct because Microsoft 365 support requires the tenant GUID to uniquely identify the organization's directory and route the case to the correct environment. Option C (Current service health status) is correct because checking the Service health dashboard in the Microsoft 365 admin center shows whether the issue is a known incident or advisory, which support uses to correlate the report and avoid duplicate tickets. Option B is not required because support needs the tenant-level scope, not individual UPNs, for a service-wide outage affecting all users. Option D is not required because billing contact information is irrelevant to a technical service incident; support asks for tenant and service health details instead.

Answer

User principal names of affected users

Answer

Billing contact information

Question 10

A company has recently acquired a smaller organization and needs to consolidate both Microsoft 365 tenants. They want to minimize user disruption and retain existing email addresses. Which approach should they use?

Accepted Answer

Perform a cross-tenant mailbox migration. Cross-tenant mailbox migration allows you to move mailboxes between two Microsoft 365 tenants while preserving the users' existing email addresses and minimizing disruption. This approach uses the Microsoft 365 native migration capabilities, specifically the cross-tenant mailbox migration feature, which supports moving mailboxes with their primary SMTP addresses and associated data without requiring on-premises Exchange Server.

Answer

Configure a hybrid deployment with Exchange Server

Answer

Delete all users from the acquired tenant and recreate them in the parent tenant

Answer

Set up a federation trust between the tenants

Question 11

Your organization uses Microsoft Purview Compliance Manager to manage compliance activities. Which TWO actions can be performed directly from Compliance Manager?

Accepted Answer

Assign an improvement action to a user.. Compliance Manager is a solution within Microsoft Purview that provides a centralized dashboard for managing compliance activities. It allows you to assign improvement actions to specific users to track responsibility and progress, and to upload evidence files directly to an improvement action to demonstrate compliance with a control. These are core, direct functions of the Compliance Manager interface.

Answer

View and manage DLP alerts.

Answer

Create a retention policy for Exchange Online.

Answer

Create a sensitivity label.

Question 12

Your organization is a financial services company with 5,000 users. You use Microsoft Defender XDR, including Defender for Endpoint Plan 2, Defender for Identity, Defender for Office 365 Plan 2, and Defender for Cloud Apps. You have recently deployed Microsoft Copilot for Security to assist your security operations center (SOC) analysts. A high-severity incident is generated: 'A user named jdoe accessed a malicious IP address from their device, and then logged into Azure Portal from an anonymous IP address. Defender for Identity detected a suspicious Kerberos ticket request from the same user's domain controller. The SOC analysts are overwhelmed with alerts and need to quickly understand the full scope of the incident, including related alerts, impacted assets, and recommended actions. They also want to use natural language to ask questions about the incident. What should you do to enable the analysts to efficiently investigate this incident?

Accepted Answer

Use Microsoft Copilot for Security integrated with Microsoft Defender XDR to get a natural language summary of the incident, ask follow-up questions, and receive recommended actions.. Microsoft Copilot for Security integrated with Microsoft Defender XDR provides natural language summaries of incidents, allows follow-up questions, and offers recommended actions. This directly addresses the SOC analysts' need to quickly understand the full scope and use natural language, reducing investigation time.

Answer

Train the analysts to use Advanced Hunting to query across all data sources and build custom KQL queries to correlate the alerts.

Answer

Create custom detection rules in Microsoft Defender XDR to generate more specific alerts for similar activity.

Answer

Configure automated investigation and remediation to automatically contain the threat and then review the results.

Question 13

Your company uses Microsoft Entra ID and has a custom line-of-business application that supports SAML-based SSO. You need to configure the application to use Microsoft Entra ID as the identity provider. Which enterprise application configuration should you use?

Accepted Answer

SAML-based Sign-on. The application supports SAML-based SSO, so the correct enterprise application configuration is SAML-based Sign-on. This allows Microsoft Entra ID to act as the identity provider by exchanging SAML assertions with the application, enabling federated authentication.

Answer

Linked Sign-on

Answer

Password-based Sign-on

Answer

OpenID Connect-based Sign-on

Question 14

Your company uses Microsoft Entra ID with hybrid joined devices. You need to enforce multi-factor authentication (MFA) for all cloud app access but want to exclude specific locations (trusted IPs). What is the most efficient way to implement this?

Accepted Answer

Create a Conditional Access policy targeting all cloud apps, requiring MFA, with a condition to exclude trusted IPs. A Conditional Access policy scoped to 'All cloud apps' with a grant control of 'Require multi-factor authentication' and a location condition excluding trusted IPs is the most efficient and granular way to meet the requirement. Conditional Access is the modern, recommended policy engine in Entra ID and supports named locations (trusted IPs) as a first-class condition, so trusted locations bypass MFA while all other access is challenged. This satisfies both the enforcement and exclusion requirements in a single policy.

Answer

Use Microsoft Intune to enforce MFA for all corporate devices

Answer

Enable per-user MFA and exclude trusted IPs in the MFA service settings

Answer

Configure a user risk policy in Microsoft Entra ID Protection to require MFA when risk is medium or higher

Question 15

Which TWO actions can be performed by Microsoft Defender for Identity? (Select TWO.)

Accepted Answer

Monitor domain controller activities and behavior.. Microsoft Defender for Identity is a cloud-based security solution that uses on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions. It monitors domain controller activities and security events to detect suspicious behavior (Option B). It also identifies lateral movement paths by analyzing network activities and user behavior to find potential attack paths (Option C). Option A is incorrect because managing firewall rules on endpoints is not a function of Defender for Identity; that is typically done by Microsoft Defender for Endpoint. Option D is incorrect because real-time file scanning is performed by Microsoft Defender Antivirus, not Defender for Identity. Option E is incorrect because blocking sign-ins from malicious IPs is handled by Microsoft Entra Conditional Access or Identity Protection, not Defender for Identity.

Answer

Manage firewall rules on endpoints.

Answer

Scan files for malware in real time.

Answer

Block sign-in attempts from malicious IP addresses.