MS-102 Practice Test 50 — 15 Questions

Question 1

You are configuring a Microsoft Entra Conditional Access policy to require compliant devices for access to Microsoft 365 apps. You need to ensure that the policy applies to all users except those in the 'BreakGlass' group. The BreakGlass group contains emergency access accounts. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Conditional Access policy that includes all users and excludes the BreakGlass group, and set the grant control to 'Require device to be marked as compliant'.. To enforce device compliance while excluding emergency access accounts, create a Conditional Access policy that targets all users but excludes the BreakGlass group. Then set the grant control to require the device to be marked as compliant. This ensures that only compliant devices can access Microsoft 365 apps, while emergency accounts remain unaffected. The other options either block emergency accounts, apply session restrictions instead of compliance, or require MFA instead of compliance.

Answer

Create a Conditional Access policy that includes the BreakGlass group and set the grant control to 'Block access'.

Answer

Create a Conditional Access policy that includes all users, excludes the BreakGlass group, and set the grant control to 'Require multi-factor authentication'.

Answer

Create a Conditional Access policy that includes all users and excludes the BreakGlass group, and set the session control to 'Use app enforced restrictions'.

Question 2

You are a security administrator for a company that uses Microsoft 365 E5. The security team wants to automatically block malicious files and URLs in email attachments and links based on Microsoft's threat intelligence, without manual intervention. You need to configure this in Microsoft Defender for Office 365. What should you do?

Accepted Answer

Enable Safe Attachments and Safe Links policies with the 'Block' action.. Safe Attachments and Safe Links are Microsoft Defender for Office 365 features that use Microsoft's threat intelligence to automatically block malicious attachments and URLs. They provide real-time protection without manual intervention, aligning with the requirement to automatically block based on threat intelligence.

Answer

Set up a Data Loss Prevention (DLP) policy to block emails containing sensitive information.

Answer

Configure an Exchange Online mail flow rule to reject messages with attachments.

Answer

Create a transport rule to prepend a warning banner to external emails.

Question 3

You are the identity administrator for a Microsoft 365 E5 tenant. The company uses Microsoft Entra ID P2. The security team wants to implement just-in-time role activation for the 'Security Administrator' role. They want to ensure that when a user activates the role, they must provide a justification and approve via multi-factor authentication. They also want the activation to last for a maximum of 4 hours. You configure Privileged Identity Management (PIM). Which setting should you configure to meet the requirement for justification and MFA?

Accepted Answer

In the role settings, enable 'Require justification on activation' and 'Require Microsoft Entra multifactor authentication on activation'.. In PIM, role settings include options to require justification and Microsoft Entra multifactor authentication on activation. Enabling both ensures that when a user activates the Security Administrator role, they must provide a reason and complete MFA. The maximum activation duration is set separately in the same role settings. This configuration satisfies the just-in-time access requirements with the specified controls.

Answer

Assign the role as eligible and set the maximum activation duration to 4 hours.

Answer

Configure a Conditional Access policy that requires MFA for the Security Administrator role.

Answer

In the role settings, enable 'Require approval to activate' and specify approvers.

Question 4

You are a security administrator for Fabrikam, Inc. The company uses Microsoft Defender XDR with Microsoft Defender for Identity, Microsoft Defender for Endpoint, and Microsoft Defender for Cloud Apps onboarded. An analyst is investigating a suspected pass-the-hash attack against a domain controller. The analyst needs to correlate identity signals with device and cloud app activity in the unified incident. You must identify which Defender XDR capabilities the analyst can use to pivot from an identity alert to related device and cloud activity. (Choose two.)

Accepted Answer

Run Advanced Hunting queries against the IdentityLogonEvents and DeviceLogonEvents tables in the Microsoft 365 Defender portal.. Cross-domain correlation in Microsoft Defender XDR is achieved through the unified incident graph and through Advanced Hunting across the Kusto tables exposed by each onboarded workload. The graph links accounts, devices, IP addresses, and cloud apps, while Advanced Hunting allows joining IdentityLogonEvents with DeviceLogonEvents to trace pass-the-hash lateral movement. Health alerts, cloud app activity logs, and device timelines each cover only one domain.

Answer

Use the Microsoft Defender for Endpoint device timeline to review process creation events on the targeted domain controller.

Answer

Use the Microsoft Defender for Cloud Apps activity log to review file downloads from sanctioned cloud applications.

Answer

Use the Microsoft Defender for Identity health alerts page to review sensor configuration issues on the domain controllers.

Question 5

You are a Microsoft 365 administrator for Tailspin Toys. The security team wants to reduce the number of alerts generated by Microsoft Defender for Endpoint on Windows 10 devices that run a custom line-of-business application. The application performs many legitimate network connections that trigger the 'Suspicious network connection' alert. You need to suppress these alerts while still investigating all other alerts. What should you create in the Microsoft 365 Defender portal?

Accepted Answer

An alert suppression rule for the 'Suspicious network connection' alert scoped to the affected devices or application.. Alert suppression rules in Microsoft Defender for Endpoint are designed to reduce alert noise by suppressing specific alerts within a defined scope, such as a device group, file hash, IP address, or URL. Scoping the rule to the line-of-business application and its devices silences the known false positive while preserving visibility into all other alerts. Indicators of compromise change block or allow behavior, and AIR or custom detections act after or alongside alerts rather than suppressing them.

Answer

An automated investigation and response (AIR) playbook that closes the alert automatically.

Answer

An indicator of compromise (IoC) for the application's executable hash with the action Allow.

Answer

A custom detection rule that queries DeviceNetworkEvents and marks the connections as benign.

Question 6

You are the Microsoft 365 administrator for a company with a Microsoft 365 E3 tenant. The security team requires that you reduce the attack surface for email by blocking auto-forwarding to external domains and by ensuring that any email sent from an external sender that spoofs your custom domain is rejected. You must implement the controls natively in Microsoft 365 Defender. Which two actions should you perform? (Choose two.)

Accepted Answer

Create an outbound anti-spam policy and set the Automatic forwarding rule to Off, then apply the policy to all recipients.. Blocking external auto-forwarding is done through the Automatic forwarding setting in an outbound anti-spam policy applied to all recipients. Rejecting spoofed mail that claims to be from your own domain relies on the anti-spoofing intelligence built into the default anti-phishing policy, which acts on your accepted domains, provided no allow entry in the Tenant Allow/Block List overrides the verdict.

Answer

Create an anti-phishing policy and enable the mailbox intelligence setting for all users.

Answer

Configure the anti-phishing policy's Spoof intelligence by adding your custom domain as an allowed sender so that internal spoofing is permitted.

Answer

Add your custom domain to the Domain impersonation section of the anti-phishing policy and set the action to Quarantine the message.

Question 7

You are a compliance administrator for Fabrikam Inc. The company uses Microsoft Purview Information Barriers. You need to prevent users in the Sales department from communicating with users in the Research department in Microsoft Teams. However, both departments must be able to communicate with the Legal department. What should you do first?

Accepted Answer

Create an information barrier segment for each department and define blocked and allowed communication policies between them.. Information barriers are the correct feature to restrict communication between specific groups in Microsoft Teams. The first step is to create segments for each department, then define policies that specify which segments can communicate. This allows blocking Sales-Research while permitting both to communicate with Legal.

Answer

Create a DLP policy that blocks Teams messages between Sales and Research.

Answer

Assign sensitivity labels to users in Sales and Research to prevent collaboration.

Answer

Configure a Teams messaging policy that disables chat for the Sales and Research departments.

Question 8

You are a Microsoft 365 administrator for a company that uses Microsoft Defender XDR. A security analyst needs to view a unified list of incidents and alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. Where should the analyst go to see this unified view?

Accepted Answer

Microsoft 365 Defender portal (security.microsoft.com) under Incidents.. The Microsoft 365 Defender portal at security.microsoft.com is the centralized console for Microsoft Defender XDR. It aggregates alerts and incidents from Defender for Endpoint, Office 365, Identity, and Cloud Apps into a single queue, enabling analysts to investigate and respond across domains without switching portals.

Answer

Azure Sentinel (azure.microsoft.com/services/azure-sentinel) under Incidents.

Answer

Microsoft Defender for Endpoint portal (securitycenter.windows.com) under Alerts.

Answer

Microsoft 365 compliance center (compliance.microsoft.com) under Alerts.

Question 9

You are the Microsoft 365 administrator for a company that has a Microsoft 365 E5 tenant. The legal department requires that all email messages sent to and from the tenant be retained for seven years, and that users cannot permanently delete messages before that period ends. The solution must apply to all mailboxes, including new ones created later, and must not require users to apply retention labels manually. What should you do?

Accepted Answer

Create a retention policy in Microsoft Purview that retains Exchange email for seven years, applies to all Exchange mailboxes, and configure the policy to retain items at the end of the retention period.. A Microsoft Purview retention policy applies retention settings at the workload and location level, so Exchange email can be retained for seven years across all current and future mailboxes without user or administrator action. Configuring the policy to retain items preserves them and prevents permanent deletion during the retention period, which meets the legal department's requirement.

Answer

Enable a litigation hold on each mailbox by using Exchange Online PowerShell for all current users, and repeat the process whenever a new user is created.

Answer

Create a data loss prevention policy that blocks users from deleting email messages that contain sensitive information.

Answer

Create a retention label with a seven-year retention period, publish it to all users, and instruct users to apply it to their messages.

Question 10

You manage a Microsoft 365 tenant for a company that uses Microsoft Defender for Office 365 Plan 2. The security team reports that several users clicked a link in a phishing email and entered credentials on a fake sign-in page. You must identify which users were compromised and remediate their accounts as quickly as possible. What should you do?

Accepted Answer

Use the Compromised users report in Microsoft 365 Defender to identify affected users, then select the users and choose to force a password reset and revoke their sessions.. The Compromised users report in Microsoft 365 Defender uses signals from Defender for Office 365 to detect when a user enters credentials on a phishing site. Because the tenant has Plan 2, the report is available and includes the affected users. From the report, the administrator can force a password reset and revoke sessions, which are the recommended containment actions.

Answer

Run the Get-MessageTraceV2 cmdlet in Exchange Online PowerShell for the phishing message and disable the accounts of every recipient.

Answer

Review the Attack simulation training report for the tenant and export the list of users who failed the simulation.

Answer

Open the Threat Explorer in Microsoft 365 Defender, filter by the sender address, and manually review the message trace for each recipient.

Question 11

You are a security administrator for Northwind Traders. You use Microsoft Defender XDR. You need to identify all devices that have communicated with a specific IP address associated with a known threat in the last 30 days. You want to use advanced hunting to find this information. Which table should you query?

Accepted Answer

DeviceNetworkEvents. Advanced hunting in Microsoft Defender XDR includes the DeviceNetworkEvents table, which logs network connections and associated remote IP addresses. To find devices that communicated with a specific IP, you query DeviceNetworkEvents, filter by the RemoteIP column for the threat IP, and restrict the Timestamp to the last 30 days. This yields the required device list.

Answer

DeviceFileEvents

Answer

DeviceEvents

Answer

DeviceLogonEvents

Question 12

A Microsoft 365 administrator needs to add a new verified domain named tailspintoys.com to the tenant and then configure it as the default domain for new user principal names. Which sequence of actions should the administrator perform in the Microsoft 365 admin center?

Accepted Answer

Add the domain, create the required TXT or MX verification record at the DNS host, verify ownership, then set the domain as default.. Adding a custom domain requires proving DNS ownership through a TXT or MX record generated by the admin center. Only after verification succeeds can the domain be marked as default, which controls the suffix applied to new user principal names and email addresses. Setting default first, pre-creating records, or attempting account-based verification all fail because Microsoft requires DNS proof before the namespace is usable.

Answer

Add the domain, verify it by signing in with a global administrator account from that domain, then set it as default.

Answer

Set the domain as default first, then add the verification TXT record so Microsoft can confirm ownership afterward.

Answer

Create the verification record at the DNS host, then add the domain and set it as default in a single step.

Question 13

You manage a Microsoft 365 E5 tenant with Microsoft Entra ID P2. The security team wants to ensure that when a user is assigned the Global Administrator role, the assignment is time-bound, requires approval, and requires multifactor authentication for activation. You need to configure Privileged Identity Management (PIM). Which setting should you configure?

Accepted Answer

In PIM, for the Global Administrator role, set the assignment type to Eligible, configure activation settings to require approval and Azure MFA, and set the maximum activation duration.. Privileged Identity Management (PIM) enables just-in-time role activation. To meet the requirements, the Global Administrator role must be assigned as eligible, and the role settings must require approval and Azure MFA for activation, with a maximum activation duration. This ensures time-bound, approved, and MFA-protected access, which is the core purpose of PIM.

Answer

In PIM, for the Global Administrator role, configure the role settings to require justification and enable alerts for role activation.

Answer

In Microsoft Entra ID, create a Conditional Access policy that requires MFA for users assigned the Global Administrator role.

Answer

In PIM, for the Global Administrator role, set the assignment type to Active and configure the assignment to expire after 30 days.

Question 14

You are a Microsoft 365 administrator for a company that uses Microsoft Entra ID P2. The company has a requirement that all administrative roles must be activated only after approval by a designated approver. You configure Privileged Identity Management (PIM) for the Global Administrator role. You need to ensure that when a user activates the role, an approver must approve the request before the role is activated. What should you configure in the PIM role settings?

Accepted Answer

Enable 'Require approval to activate' and specify the approvers.. The 'Require approval to activate' setting in PIM role settings enforces an approval workflow. When a user requests activation, the designated approvers receive a notification and must approve the request before the role is activated. This ensures that administrative roles are activated only after explicit approval, meeting the company's requirement. It is configured per role in PIM.

Answer

Enable 'Require multifactor authentication on activation'.

Answer

Set Activation maximum duration to 1 hour.

Answer

Configure 'Require justification on activation'.

Question 15

You are a Microsoft 365 administrator for a company that uses Microsoft Entra ID P1. The company wants to allow users to register for self-service password reset (SSPR) and require them to use two methods for authentication. You need to configure SSPR to require two methods. What should you do?

Accepted Answer

In the Microsoft Entra admin center, go to Password reset > Authentication methods, and set 'Number of methods required to reset' to 2.. Self-service password reset settings in Microsoft Entra ID allow you to specify the number of authentication methods required to reset a password. By navigating to Password reset > Authentication methods and setting 'Number of methods required to reset' to 2, users must register and use two methods. This fulfills the requirement directly without affecting sign-in MFA.

Answer

In the Microsoft Entra admin center, go to Users > Password reset > Properties, and enable 'Require two methods'.

Answer

Enable security defaults in Microsoft Entra ID.

Answer

Configure a Conditional Access policy that requires MFA for all users.