MS-102 Practice Test 49 — 15 Questions

Question 1

You are the Microsoft 365 administrator for a company that uses Microsoft 365 E3. The company has a single Microsoft 365 tenant. The IT manager asks you to create a new user account for a temporary employee who will start next week and will need access to Exchange Online and SharePoint Online. The employee will leave after three months. You need to create the user account with the minimum required licenses. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a new user in the Microsoft 365 admin center and assign an Exchange Online (Plan 1) license and a SharePoint Online (Plan 1) license.. The requirement is to provide access to Exchange Online and SharePoint Online with the minimum required licenses. Assigning standalone Exchange Online (Plan 1) and SharePoint Online (Plan 1) licenses achieves this by providing exactly the needed services without the extra cost and features of a suite license. Using a suite license like Microsoft 365 E3 or Business Premium would grant more services than necessary and does not meet the minimum license requirement. Disabling services within a suite license still consumes the full license.

Answer

Create a new user in the Microsoft 365 admin center and assign a Microsoft 365 Business Premium license.

Answer

Create a new user in the Microsoft 365 admin center and assign a Microsoft 365 E3 license, then disable all services except Exchange Online and SharePoint Online.

Answer

Create a new user in the Microsoft 365 admin center and assign a Microsoft 365 E3 license.

Question 2

You are the Microsoft 365 administrator for a company that uses Microsoft 365 E3. The company has a single Microsoft 365 tenant. The IT manager asks you to create a new user account for a temporary employee who will start next week and will need access to Exchange Online and SharePoint Online. The employee will leave after three months. You need to create the user account with the minimum required licenses. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install the Microsoft Entra Password Protection proxy service on a server in the on-premises network.. To enforce Microsoft Entra Password Protection on-premises, you must deploy both the proxy service and the DC agent. The proxy service enables communication with Microsoft Entra ID to retrieve the password policies, and the DC agent on each domain controller enforces those policies during password changes. Password hash synchronization is not required, and the proxy service must not be installed on a domain controller. These two components work together to extend Microsoft Entra Password Protection to the on-premises AD DS environment.

Answer

Enable password hash synchronization in Microsoft Entra Connect.

Answer

Configure the on-premises domain controllers to use the Microsoft Entra Password Protection proxy service as a forwarder.

Answer

Install the Microsoft Entra Password Protection proxy service on a domain controller.

Question 3

Refer to the exhibit. You run the KQL query in advanced hunting. What is the primary purpose of this query?

Accepted Answer

Identify devices with high use of encoded commands, which may indicate malicious activity. The KQL query filters for DeviceProcessEvents where the command line contains 'powershell' and the process command line includes '-EncodedCommand', which is a known technique used by attackers to obfuscate malicious scripts. The query then counts such events per device and filters for devices with more than 10 occurrences, indicating a high volume of encoded PowerShell commands that may signal malicious activity.

Answer

Identify devices with outbound connections to malicious IPs

Answer

Identify devices with PowerShell execution policy set to bypass

Answer

Identify devices where a user deleted system files using cmd

Question 4

You are the Microsoft 365 administrator for a company that uses Microsoft 365 E3. The company has a single Microsoft 365 tenant. The IT manager asks you to create a new user account for a temporary employee who will start next week and will need access to Exchange Online and SharePoint Online. The employee will leave after three months. You need to create the user account with the minimum required licenses. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the Assignments to All users, All cloud apps, and under Conditions configure Locations to include Any location and exclude the corporate network location, then under Access controls set Grant to Require multifactor authentication, and set Enable policy to On.. The requirement is to enforce MFA only for sign-ins originating outside the corporate network. A Conditional Access policy must include All users and All cloud apps as the assignment scope, then use the Locations condition to exclude the trusted corporate network. With the Grant control set to Require multifactor authentication and the policy enabled, external sign-ins are challenged while internal sign-ins remain unaffected.

Answer

Set the Assignments to All users, All cloud apps, and under Conditions configure Locations to include Any location, then under Access controls set Grant to Require multifactor authentication, and set Enable policy to On.

Answer

Set the Assignments to All users, All cloud apps, and under Conditions configure Client apps to Exchange ActiveSync clients and other clients, then under Access controls set Grant to Require multifactor authentication, and set Enable policy to On.

Answer

Set the Assignments to All users, All cloud apps, and under Conditions configure Locations to include Any location, then under Access controls set Grant to Require multifactor authentication, and set Enable policy to Report-only.

Question 5

You are a security administrator for a company that uses Microsoft Defender XDR. You need to ensure that when a file is detected as malware by Microsoft Defender for Endpoint, the file is automatically blocked and added to the indicator list across all devices in the organization. What should you configure?

Accepted Answer

Create a custom indicator in Microsoft Defender for Endpoint with the action 'Block and remediate' and scope it to all devices.. Custom indicators in Microsoft Defender for Endpoint are the correct way to block files organization-wide. By creating an indicator with the action 'Block and remediate' and setting the scope to all devices, the file is blocked and remediated on any device. Other options either do not add to the indicator list or are not scoped organization-wide.

Answer

Enable the 'Block at first sight' feature in Microsoft Defender for Endpoint.

Answer

Configure an automated investigation and response (AIR) playbook to block the file when malware is detected.

Answer

Set up a Microsoft Defender for Cloud Apps file policy to block the file.

Question 6

You are a security administrator for a company that uses Microsoft Defender XDR. You need to create a custom detection rule that triggers when a process named 'mimikatz.exe' is executed on any device. The rule should run every hour and generate an alert. Which of the following should you use to create this rule?

Accepted Answer

Microsoft Defender for Endpoint advanced hunting with a custom detection rule. Custom detection rules in Microsoft Defender for Endpoint allow security teams to create scheduled KQL queries that run against advanced hunting data and generate alerts when specific conditions are met. This is the appropriate tool for detecting process execution like mimikatz.exe on endpoints, as it provides the necessary data and scheduling capabilities.

Answer

Microsoft Defender for Office 365 threat explorer

Answer

Microsoft 365 Defender incident queue

Answer

Microsoft Defender for Cloud Apps activity log

Question 7

You are a security administrator for a company that uses Microsoft Defender XDR. You need to configure automated investigation and response (AIR) in Microsoft Defender for Endpoint to automatically remediate threats. You want to ensure that when a high-severity alert is triggered, the device is isolated and the malicious file is quarantined without manual intervention. Which setting should you configure?

Accepted Answer

Automation level in Microsoft Defender for Endpoint settings. The automation level setting in Microsoft Defender for Endpoint controls whether automated investigations automatically remediate threats. Setting it to full automation enables the system to isolate devices and quarantine files without human intervention when high-severity alerts occur, meeting the requirement.

Answer

Advanced hunting custom detection rules

Answer

Attack surface reduction rules

Answer

Alert notification rules in Microsoft 365 Defender

Question 8

You are the Microsoft 365 administrator for a company that uses Microsoft 365 E3. The company has a single Microsoft 365 tenant. The IT manager asks you to create a new user account for a temporary employee who will start next week and will need access to Exchange Online and SharePoint Online. The employee will leave after three months. You need to create the user account with the minimum required licenses. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable self-service password reset for all users in the Microsoft Entra admin center.. Enabling SSPR in Microsoft Entra ID allows users to reset their passwords, and enabling password writeback in Microsoft Entra Connect ensures those new passwords are synchronized back to on-premises Active Directory. Together, these actions provide a seamless self-service password reset experience that keeps on-premises and cloud passwords in sync.

Answer

Configure the on-premises Active Directory domain to use fine-grained password policies.

Answer

Enable password hash synchronization and seamless single sign-on.

Answer

Configure Microsoft Entra Connect to use password hash synchronization.

Question 9

You are the Microsoft 365 administrator for a company that uses Microsoft 365 E3. The company has a single Microsoft 365 tenant. The IT manager asks you to create a new user account for a temporary employee who will start next week and will need access to Exchange Online and SharePoint Online. The employee will leave after three months. You need to create the user account with the minimum required licenses. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a retention policy that applies to all SharePoint sites and OneDrive accounts, set the retention period to seven years, and configure the policy to retain items even if users delete them.. A retention policy applied to all SharePoint sites and OneDrive accounts with a seven-year retention period ensures that items are retained even if users delete them. The policy preserves copies in the Preservation Hold library, preventing permanent deletion. This meets the requirement that files must be retained for seven years and cannot be permanently deleted by users before the retention period expires.

Answer

Create a retention policy in Microsoft Purview that retains content in SharePoint and OneDrive for seven years and locks the policy.

Answer

Configure a data loss prevention (DLP) policy that blocks deletion of files in SharePoint and OneDrive for seven years.

Answer

Create a retention label that retains items for seven years and configure a retention label policy to publish the label to all SharePoint sites and OneDrive accounts.

Question 10

You are a Microsoft 365 administrator for Litware Inc. The company uses Microsoft Purview Records Management. A file plan has been created with a retention label named 'Project Alpha'. You need to ensure that documents labeled 'Project Alpha' are retained for five years after the project ends, and then automatically deleted. What should you configure on the retention label?

Accepted Answer

Set the retention period to five years and choose 'When an event occurs' as the retention trigger.. The requirement is to retain documents for five years after the project ends, which is a classic event-based retention scenario. Configuring the retention label to use 'When an event occurs' allows you to define a custom event like project completion, starting the retention period then. The label should also be set to delete items after the retention period to meet the automatic deletion requirement.

Answer

Set the retention period to five years and trigger retention based on 'When items were last modified'.

Answer

Set the retention period to five years and trigger retention based on 'When items were created'.

Answer

Set the retention period to five years and configure a disposition review at the end of the period.

Question 11

You are a security administrator for a company that uses Microsoft Defender XDR. You need to ensure that when a user clicks a malicious link in an email, the URL is automatically blocked and the user is prevented from accessing the site. Which Microsoft Defender XDR component should you configure?

Accepted Answer

Microsoft Defender for Office 365 Safe Links policy. Safe Links in Microsoft Defender for Office 365 is specifically designed to protect users from malicious URLs in emails and documents by scanning and blocking access at click time. Configuring a Safe Links policy ensures that users are prevented from accessing malicious sites when they click links.

Answer

Microsoft Defender for Endpoint web content filtering

Answer

Microsoft Defender for Cloud Apps conditional access app control

Answer

Microsoft Defender for Identity sign-in alerts

Question 12

You are a Microsoft 365 administrator for a company that uses Microsoft Defender for Cloud Apps. The security team wants to detect when users download a large number of files from SharePoint Online in a short period, which could indicate data exfiltration. You need to create a policy to alert on this activity. What should you do?

Accepted Answer

Create an activity policy with a filter for 'Download file' and a threshold for the number of files.. Activity policies in Microsoft Defender for Cloud Apps are designed to monitor user activities and can be configured with filters and thresholds to detect specific behaviors like mass file downloads. This provides the precise alerting needed for potential data exfiltration.

Answer

Set up an anomaly detection policy for unusual file access.

Answer

Configure a session policy to block downloads from SharePoint Online.

Answer

Create a file policy with a filter for file name and a threshold for file size.

Question 13

Your company uses Microsoft Entra ID. You need to ensure that when users are assigned privileged roles, they must activate the role and provide a justification. The solution must minimize the number of standing assignments. What should you implement?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM) with eligible assignments and activation requirements.. Microsoft Entra Privileged Identity Management (PIM) provides just-in-time privileged access. By configuring eligible assignments, users must activate roles when needed, and you can require justification and MFA. This minimizes standing access. Other options do not provide activation workflows or justification requirements.

Answer

Conditional Access policy requiring MFA for all users assigned to privileged roles.

Answer

Microsoft Entra ID Protection risk policies for privileged users.

Answer

Microsoft Entra ID Governance access reviews for privileged roles.

Question 14

A Microsoft 365 tenant uses a custom domain named fabrikam.com for all user principal names and email addresses. The security team requires that any email message sent from an external sender that spoofs fabrikam.com be rejected outright, while legitimate messages from the on-premises mail relay must still be accepted. You configure DKIM signing and SPF with a hard fail. What should you configure next to meet the rejection requirement?

Accepted Answer

Create a DMARC TXT record with p=reject and add the on-premises relay to the SPF record's include list.. Enforcing rejection of spoofed fabrikam.com mail requires a DMARC record with p=reject, because DMARC is the only mechanism that tells receivers to refuse messages failing SPF and DKIM alignment. Legitimate on-premises relay traffic must still authenticate, so the relay's sending infrastructure belongs in the SPF record. Quarantine softens the action, duplicate SPF records are invalid, and transport rules cannot influence external receivers.

Answer

Create a DMARC TXT record with p=quarantine and rely on the existing SPF hard fail to block spoofed messages.

Answer

Add a second SPF record for fabrikam.com that lists only the on-premises relay's public IP address.

Answer

Configure an Exchange Online transport rule that rejects messages where the sender's domain is fabrikam.com and the message originates outside the organization.

Question 15

A company has a Microsoft 365 tenant that uses the default contoso.onmicrosoft.com domain. The IT team wants to add a new custom domain, contoso.com, and ensure that all existing users' primary email addresses automatically change to the new domain. They also want to prevent users from signing in with the onmicrosoft.com domain. What should the administrator do first?

Accepted Answer

Add contoso.com as a custom domain in the Microsoft 365 admin center and verify ownership by adding a TXT record to the public DNS zone.. Before any custom domain can be used in Microsoft 365, it must be added and verified in the admin center. Verification typically involves adding a TXT record to the domain's DNS. Only after verification can the domain be assigned to users, set as default, or used for sign-in. Changing UPNs or email address policies requires the domain to exist first.

Answer

Modify the default email address policy in Exchange Online to use contoso.com as the primary SMTP suffix.

Answer

Create a new mail-enabled security group for all users and assign the contoso.com SMTP address to the group.

Answer

Run the Set-MsolUserPrincipalName PowerShell cmdlet to change each user's UPN to contoso.com.