MS-102 Practice Test 47 — 15 Questions

Question 1

A company must ensure that all outgoing emails containing credit card numbers are blocked from being sent to external recipients. When a user attempts to send such an email, it should be blocked immediately, and the user should see a policy tip explaining the rule. Which Microsoft Purview solution should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data Loss Prevention (DLP) policy. A Data Loss Prevention (DLP) policy is the correct solution because it is specifically designed to detect sensitive information, such as credit card numbers, in transit (email) and enforce real-time actions like blocking the message and displaying a policy tip to the user. DLP policies in Microsoft Purview can be configured with conditions that match credit card number patterns using built-in sensitive info types, and the action 'Block messages' with a policy tip notification is available for Exchange Online mail flow. This ensures immediate blocking and user notification without requiring any manual labeling or classification.

Answer

Sensitivity labels

Answer

Retention labels

Answer

Communication compliance

Question 2

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that alerts when a user downloads more than 10 files from SharePoint Online within 10 minutes. This activity should be considered anomalous. Which type of policy should you create?

Accepted Answer

Activity policy. An Activity policy in Defender for Cloud Apps triggers alerts based on user activities such as file downloads, and supports thresholds and time windows. To alert when a user downloads more than 10 files from SharePoint Online within 10 minutes, you configure an Activity policy with the 'Download file' activity, a threshold of 10, and a 10-minute window. This matches the requirement exactly.

Answer

Cloud Discovery policy

Answer

Session policy

Answer

App discovery policy

Question 3

A company's security team needs to investigate a suspicious email that was reported by a user. The email was not blocked by Exchange Online Protection (EOP) and was delivered to the user's inbox. The security team wants to use Microsoft Defender XDR to analyze the email and its attachments. Which feature should they use to submit the email for automated investigation?

Accepted Answer

Submissions. Microsoft Defender XDR's Submissions feature (under Email & Collaboration > Submissions) allows security teams to submit suspicious emails, attachments, and URLs to Microsoft for automated analysis. When a user reports a phish that EOP missed, the admin can submit it via Submissions, which triggers automated investigation, detonation, and re-classification. This is the correct tool for analyzing a specific reported email and its attachments.

Answer

Advanced Hunting

Answer

Threat Explorer

Answer

Attack Simulator

Question 4

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the built-in anti-phishing policy. You need to analyze the email headers to determine why it was not detected. What should you use?

Accepted Answer

Threat Explorer in Microsoft Defender for Office 365. Threat Explorer (part of Microsoft 365 Defender's Email & Collaboration section) provides detailed email metadata, including full message headers, delivery action, and the specific policy or filter that processed the message. It lets administrators trace why a message was allowed, blocked, or delivered to junk, and it surfaces the anti-phishing verdict, spoof intelligence, and detection technology that evaluated the message. This is the correct tool for post-incident header analysis of a phishing message that bypassed filtering.

Answer

Attack Simulator in Microsoft Defender for Office 365

Answer

Message trace in Exchange admin center

Answer

Quarantine page in Microsoft Defender for Office 365

Question 5

Your organization uses Microsoft 365 and has strict compliance requirements. The compliance officer has noticed that some users are able to access sensitive documents from unmanaged devices. You need to ensure that all access to sensitive data from unmanaged devices is blocked, while still allowing access from managed devices. The solution must be implemented using Microsoft Entra ID and Microsoft Intune. You have already deployed Microsoft Intune for mobile device management. What should you do?

Accepted Answer

Create a conditional access policy in Microsoft Entra ID that requires device to be marked as compliant, and apply it to all cloud apps.. A Conditional Access policy that requires the device to be marked as compliant enforces that only Intune-managed, compliant devices can access cloud apps. This blocks unmanaged devices because they cannot satisfy the compliance requirement, while managed devices that meet the compliance policy are allowed. This directly satisfies the requirement to block unmanaged device access using Entra ID and Intune.

Answer

Enable device compliance rules in Microsoft Entra ID and assign them to all users.

Answer

Create a device compliance policy in Microsoft Intune that requires a PIN and encryption.

Answer

Create an app protection policy in Microsoft Intune that requires managed apps to be used on unmanaged devices.

Question 6

You need to ensure that only users from your organization can access a SharePoint Online site. Which setting should you configure?

Accepted Answer

Set the SharePoint Online external sharing setting to 'Only people in your organization'. The SharePoint Online external sharing setting 'Only people in your organization' explicitly restricts all sharing and access to users who have a valid identity in your Microsoft Entra ID tenant. This setting prevents any external user (including guests) from accessing the site, regardless of how they were invited or authenticated. It is the most direct and effective control for limiting access to internal users only.

Answer

Create a Conditional Access policy to block external users

Answer

Configure the Microsoft Entra ID external collaboration settings

Answer

Modify the site permissions to remove external users

Question 7

Your organization, Fabrikam Inc., uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft Teams. You have a DLP policy that blocks sharing of credit card numbers in Teams messages. Recently, users have reported that they cannot share legitimate credit card numbers for business purposes, even with customers. You need to allow users to override the block for legitimate sharing, but require them to provide a business justification. What should you configure?

Accepted Answer

Configure the DLP policy to show a policy tip that allows users to override the block with a business justification, and enable audit logging for overrides.. DLP policy tips in Microsoft Teams can be configured to allow users to override a block, and the override can require a business justification that is captured in the audit log. This preserves the protective control while providing a documented exception path for legitimate business scenarios like sharing a customer's own credit card number. Enabling audit logging ensures the override and justification are recorded for compliance review.

Answer

Create a second DLP policy with a lower priority that allows credit card sharing, and assign it to a security group containing authorized users.

Answer

Add the users to an exempt group in the DLP policy so they are not blocked.

Answer

Configure the DLP policy to allow overrides without justification, and monitor usage.

Question 8

You are configuring Microsoft 365 tenant-to-tenant migration. Which THREE tasks must be completed before migrating users?

Accepted Answer

Obtain tenant consent for data migration (e.g., via admin consent). Option B is correct because tenant-to-tenant migrations require explicit authorization between the source and target tenants, typically granted through an admin consent URL that creates an enterprise application/service principal in the source tenant so the migration tool can read and write data. Option D is correct because you must add and verify the source domain (via a TXT record) in the target Microsoft 365 tenant before you can pre-stage or map users, mailboxes, and domains during migration. Option E is correct because directory synchronization (for example, using Microsoft Entra Connect or cross-tenant synchronization/Identity Manager) is needed to establish matching user identities and mail-enabled objects between tenants so migrated users retain proper object references. Option A is not required before migrating users; MX record changes are part of the final cutover and should occur only after mailboxes and mail flow are ready, otherwise mail delivery breaks. Option C is wrong because deleting source mailboxes before migration would destroy the data being migrated; source mailboxes must remain intact until the migration and cutover are complete.

Answer

Change MX records to point to the target tenant

Answer

Delete source tenant user mailboxes

Question 9

You are the Microsoft 365 administrator for a large enterprise. You need to ensure that only users with a valid business justification can access sensitive data stored in SharePoint Online. The solution must enforce access reviews and provide detailed reports for auditors. Which TWO actions should you take?

Accepted Answer

Configure access reviews in Microsoft Entra ID Governance for the SharePoint site.. Option A is correct because Microsoft Entra ID Governance access reviews are the native mechanism to periodically attest who still needs access to a SharePoint site, enforcing the requirement that only users with a valid business justification retain access. Option C is correct because enabling audit logging in Microsoft Purview captures SharePoint Online access and activity events, and the resulting audit log search and reports provide the detailed evidence auditors require. Option B is not correct because Defender for Cloud Apps session policies monitor and control sessions but do not enforce access reviews or produce the required auditor-facing access attestation reports. Option D is not correct because sensitivity labels with justification for label changes govern classification and labeling actions, not recurring access justification or review. Option E is not correct because a DLP policy prevents sharing of sensitive content but does not enforce access reviews or generate the detailed access reports for auditors.

Answer

Deploy Microsoft Defender for Cloud Apps and create a session policy to monitor access.

Answer

Apply a sensitivity label to the SharePoint site and require justification for label change.

Answer

Create a data loss prevention (DLP) policy to block unauthorized sharing.

Question 10

Your organization uses Microsoft Entra ID and has a Conditional Access policy that requires compliant devices for access to corporate resources. You need to ensure that iOS devices are compliant before accessing Exchange Online. Which Microsoft Intune policy should you configure?

Accepted Answer

Device compliance policy. A Device Compliance policy in Microsoft Intune defines the rules a device must meet (OS version, encryption, jailbreak/root detection, password requirements) to be marked compliant. Conditional Access then uses that compliance state as a grant control, so iOS devices must satisfy the compliance policy before accessing Exchange Online. This is the correct policy type to enforce device health for Conditional Access.

Answer

Device configuration policy

Answer

App protection policy

Answer

Enrollment restrictions

Question 11

Your organization uses Microsoft Defender XDR and Microsoft 365 E5 licenses. You need to ensure that when a user reports a phishing email using the Microsoft Report Message add-in, the email is automatically submitted to Microsoft for analysis and the user is notified of the analysis result. You want to minimize administrative effort. What should you do?

Accepted Answer

In Microsoft Defender XDR, go to Settings > Email & collaboration > User reported messages, and enable 'Send reported messages to Microsoft' and 'Notify users when analysis completes'.. The user-reported messages settings in Microsoft Defender XDR (Settings > Email & collaboration > User reported messages) allow you to automatically send reported messages to Microsoft for analysis and notify users when analysis completes, minimizing administrative effort. Option A is wrong because a mail flow rule would only forward messages to a security team mailbox, not to Microsoft, and would not provide automatic analysis or user notification. Option B is wrong because simply configuring the Report Message add-in for all users enables reporting but does not by itself automatically submit to Microsoft or notify users; the Defender XDR settings are required for those actions. Option C is wrong because manually submitting each reported email via the Microsoft 365 Defender portal defeats the goal of minimizing administrative effort and does not automatically notify the user of results.

Answer

Create a mail flow rule that forwards reported messages to a security team mailbox.

Answer

Configure the Microsoft Report Message add-in for all users.

Answer

Use the Microsoft 365 Defender portal to manually submit the email for analysis whenever a user reports it.

Question 12

An organization wants to allow users to sign in to Microsoft 365 using their on-premises Active Directory credentials but does not want to synchronize password hashes to the cloud. They also want to eliminate the need for users to re-enter their credentials when accessing cloud resources from domain-joined devices. Which combination of authentication methods should they implement?

Accepted Answer

Pass-through Authentication (PTA) with Seamless Single Sign-On (SSO). Pass-through Authentication (PTA) validates user passwords directly against on-premises Active Directory without storing password hashes in the cloud, satisfying the requirement to avoid hash synchronization. Seamless SSO eliminates the need for users to re-enter credentials on domain-joined devices by using Kerberos delegation to silently authenticate against Microsoft Entra ID, meeting both stated needs.

Answer

Federation with Active Directory Federation Services (AD FS)

Answer

Password Hash Sync (PHS) with Seamless SSO

Answer

Cloud-only authentication with MFA

Question 13

Your organization uses Microsoft Purview Records Management and has a file plan that categorizes records by department. You need to ensure that HR records are retained for seven years after employee termination, while finance records are retained for ten years after the end of the fiscal year. What is the most efficient way to implement this?

Accepted Answer

Create two retention labels: one for HR with termination trigger and seven-year retention, and one for Finance with end-of-fiscal-year trigger and ten-year retention.. Retention labels in Microsoft Purview Records Management support event-based retention triggers, and each label can have its own retention period and trigger type. Creating one label for HR with a termination trigger and seven-year retention, and another for Finance with an end-of-fiscal-year trigger and ten-year retention, directly maps to the two distinct business requirements. Labels are the correct construct for file-plan-based records management because they can be published to specific locations and applied per-item.

Answer

Create a single retention label with a trigger event and adjust the retention period using PowerShell.

Answer

Define the retention settings in the file plan and apply them to both departments.

Answer

Create two retention policies, one for HR and one for Finance, each with the appropriate retention period.

Question 14

Which TWO features are part of Microsoft Purview Communication Compliance?

Accepted Answer

Policy tips to notify users of policy violations.. Option C is correct because Communication Compliance policies can display policy tips to users in supported clients (for example, Outlook and Teams) to warn them in real time when their message may violate an organizational policy, helping deter risky communications. Option D is correct because Communication Compliance uses trainable classifiers and built-in sensitive information types to detect inappropriate or offensive language, harassment, threats, and other policy-violating content in emails and other communications. Option A is not a Communication Compliance feature; restricting communication between specific groups is handled by Exchange transport rules or information barriers. Option B is not part of Communication Compliance; retention labels are applied through Microsoft Purview Data Lifecycle Management and Records Management. Option E is not part of Communication Compliance; automatic encryption of sensitive communications is provided by sensitivity labels with encryption or Exchange data loss prevention/transport rules.

Answer

Restricting communication between specific groups.

Answer

Applying retention labels to communications.

Answer

Automatic encryption of sensitive communications.

Question 15

An administrator runs the PowerShell command shown in the exhibit. What is the immediate effect on the user?

Accepted Answer

The user is blocked from signing in immediately.. The PowerShell command `Set-MgUser -UserId user@domain.com -BlockCredential $true` immediately blocks the user from signing in by setting the `BlockCredential` property to true. This prevents any new authentication attempts, effectively locking the account without changing the password or deleting the user.

Answer

The user is disabled after 90 days of inactivity.

Answer

The user is deleted after 90 days of inactivity.

Answer

The user's password is reset.