MS-102 Practice Test 5 — 10 Questions

Question 1

A security administrator wants to configure Automated Investigation and Response (AIR) in Microsoft 365 Defender to automatically isolate a device when a high-severity alert for malware is detected. Which step is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

C: Configure the device to be part of a device group and enable automation level.. To enable Automated Investigation and Response (AIR) in Microsoft Defender for Endpoint, the device must be added to a device group, and the automation level for that group must be set to 'Full – remediate threats automatically' or a similar level. This configuration allows Defender to automatically isolate a device when a high-severity malware alert is triggered, as part of the built-in AIR playbooks.

Answer

A: Create an automation rule in Microsoft Sentinel.

Answer

B: Create a custom detection rule in advanced hunting.

Answer

D: Enable auto-removal of malware from devices.

Question 2

Your organization uses Microsoft Entra ID. You need to implement a solution that allows users to sign in without a password using their smartphone. Which TWO authentication methods can be used?

Accepted Answer

Microsoft Authenticator app (phone sign-in). The Microsoft Authenticator app supports phone sign-in, which allows users to authenticate by approving a notification or entering a number displayed on the screen, eliminating the need for a password. FIDO2 security keys enable passwordless authentication using hardware-based public/private key cryptography, meeting the requirement for smartphone-based sign-in when the key is connected via USB or NFC. Both methods are supported by Microsoft Entra ID for passwordless authentication.

Answer

Temporary Access Pass

Answer

Windows Hello for Business

Answer

Text message (SMS) verification code

Question 3

An administrator needs to configure email notifications for Exchange Online service health incidents to be sent to a specific IT support mailbox. Where should the administrator configure these notifications in the Microsoft 365 admin center?

Accepted Answer

Health > Service health > Customize notifications. The 'Customize notifications' link under Health > Service health in the Microsoft 365 admin center is the dedicated interface for configuring email notifications for service health incidents, including Exchange Online. This allows administrators to specify which email addresses (such as an IT support mailbox) receive alerts for service incidents, advisories, and other health events, with granular control over which services and severity levels trigger notifications.

Answer

Organization profile > Notifications > Service health

Answer

Mail flow connectors

Answer

Settings > Service settings

Question 4

A legal department needs to preserve all communications related to an ongoing lawsuit. They identify specific users and require that their mailbox items and OneDrive files are not altered or deleted. Which Microsoft Purview feature should be used?

Accepted Answer

Litigation Hold. Litigation Hold is the correct feature because it preserves all mailbox items and OneDrive files for specific users in their current state, preventing any alteration or deletion by users or automated processes. This is essential for legal holds where data must be immutable for eDiscovery purposes, and it applies at the user level rather than broadly across the organization.

Answer

Retention Policy

Answer

Data Loss Prevention (DLP)

Answer

eDiscovery

Question 5

A company purchases Microsoft 365 E5 licenses for 500 users. The administrator wants to automatically assign licenses to new users based on their group membership. Which method should the administrator use?

Accepted Answer

Configure group-based licensing in Microsoft Entra ID. Group-based licensing in Microsoft Entra ID (formerly Azure AD) allows automatic assignment and removal of licenses based on group membership. When a user is added to a licensed group, the license is automatically assigned; when removed, the license is revoked. This eliminates manual effort and ensures consistent licensing for all 500 users.

Answer

Run a PowerShell script to assign licenses individually

Answer

Manually assign licenses in the Microsoft 365 admin center for each user

Answer

Use a volume licensing product key to activate licenses

Question 6

A company uses Azure AD Conditional Access to enforce MFA for all cloud apps. They have some users who are physically located in countries that are considered high-risk by the security team. The team wants to require device compliance (as defined by Intune) for sign-ins from those specific countries, while still requiring MFA from all other locations. How should the administrator configure the Conditional Access policy?

Accepted Answer

Create two Conditional Access policies: one for the high-risk countries requiring MFA and device compliance, and another for all other locations requiring only MFA. Conditional Access policies are evaluated independently, and each policy can target specific conditions with distinct grant controls. By creating two separate policies—one for high-risk countries requiring both MFA and device compliance, and another for all other locations requiring only MFA—the administrator can enforce the exact requirements per location group. This approach avoids conflicts and ensures that users in high-risk countries are subject to stricter controls while others are not.

Answer

Create a single Conditional Access policy that includes both conditions (locations) and grant controls (MFA and device compliance) with an 'OR' operator

Answer

Use Azure AD Identity Protection to automatically evaluate location risk, and let Conditional Access apply the same policy to all users

Answer

Configure a single Conditional Access policy with multiple location conditions and multiple grant controls using an 'AND' operator

Question 7

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a custom Line-of-Business (LOB) app to a group of devices. The app is not in the Microsoft Store. What is the recommended method to deploy the app?

Accepted Answer

Upload the app package to Intune as a Line-of-Business app and assign it to the device group.. Intune natively supports deploying custom Line-of-Business (LOB) apps by uploading the app package (e.g., .msi, .exe, .appx) directly into the Intune console and assigning it to a device group. This method is the recommended approach for apps not available in the Microsoft Store, as it leverages Intune's mobile device management (MDM) capabilities to push the app to Windows 10 devices without requiring external infrastructure like Group Policy or the Microsoft Store for Business.

Answer

Add the app as a Microsoft Store app (business) in Intune.

Answer

Use Group Policy to deploy the app via a network share.

Answer

Publish the app to the Microsoft Store for Business and assign it.

Question 8

A company has purchased Microsoft 365 Business Standard and added the custom domain 'fabrikam.com' to the tenant. The company wants all new users to have 'fabrikam.com' as their default email domain instead of the onmicrosoft.com domain. How should the administrator achieve this?

Accepted Answer

In the admin center, go to Settings > Domains, select the custom domain, and click 'Set as default'.. The Microsoft 365 admin center provides a dedicated setting under Settings > Domains to mark a custom domain as the default email domain. Once set as default, all new users will automatically receive a primary email address using that domain instead of the initial onmicrosoft.com domain, without requiring manual changes or additional configuration.

Answer

Update the MX record in the DNS to point to Microsoft 365 with the custom domain.

Answer

Use the Exchange admin center to set the default email address policy to use the custom domain.

Answer

For each new user, manually add an email alias with the custom domain and remove the onmicrosoft.com alias.

Question 9

Your organization has a Microsoft 365 E5 tenant with Microsoft Defender for Cloud Apps. You need to discover and control the use of unsanctioned cloud apps. Which TWO actions should you take? (Choose two.)

Accepted Answer

Define sanctioned and unsanctioned app categories in Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps allows you to define sanctioned and unsanctioned app categories within the Cloud Discovery dashboard. By categorizing apps, you can apply governance actions such as blocking or monitoring, which directly controls the use of unsanctioned cloud apps. This is a foundational step in managing app usage, as it enables automated policies to enforce your organization's cloud app governance.

Answer

Deploy Microsoft Purview Data Loss Prevention policies

Answer

Configure Microsoft Entra ID App Registrations to log app usage

Answer

Create a Conditional Access policy to block all unsanctioned apps

Question 10

A company uses Microsoft Entra ID P2 licenses and wants to block all authentication attempts from an internal legacy application that uses POP3 and SMTP protocols. The application cannot be updated and must be blocked from accessing Exchange Online. Which Conditional Access policy setting should the administrator configure?

Accepted Answer

Under 'Conditions' > 'Client apps', configure to block 'Exchange ActiveSync clients and other clients'. The legacy application uses POP3 and SMTP, which are non-modern authentication protocols. In Conditional Access, the 'Client apps' condition includes a setting to block 'Exchange ActiveSync clients and other clients', which specifically targets legacy authentication protocols like POP3, SMTP, and IMAP. This allows the administrator to block all authentication attempts from such clients without affecting modern authentication flows.

Answer

Under 'Grant', select 'Block access'

Answer

Under 'Conditions' > 'Device platforms', select 'Android' and 'iOS' and block them

Answer

Under 'Conditions' > 'Locations', select 'All trusted locations' and block