MS-102 Practice Questions 1 — 50 Questions

Question 1

Your company uses Microsoft Entra ID and has a hybrid identity with PHS. You need to ensure that when an on-premises user account is disabled, the corresponding cloud user is also blocked from signing in within 5 minutes. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy Azure AD Connect cloud sync. Microsoft Entra Connect cloud sync can be configured to synchronize the on-premises Active Directory 'userAccountControl' attribute, which includes the 'ACCOUNTDISABLE' flag. When an on-premises user account is disabled, this flag changes, and cloud sync can trigger a block on the corresponding cloud user's sign-in within a few minutes (typically under 5 minutes) due to its near-real-time sync cycle. This meets the requirement without relying on the slower default sync interval of Microsoft Entra Connect.

Answer

Enable password writeback

Answer

Configure Azure AD Connect to sync the 'userAccountControl' attribute

Answer

Configure Microsoft Entra Connect Sync to use filtered synchronization

Question 2

An administrator adds the custom domain 'fabrikam.com' to a new Microsoft 365 tenant. After adding the domain, the status shows 'Pending verification'. Which type of DNS record must be added to the public DNS zone to complete domain ownership verification?

Accepted Answer

TXT record. To verify domain ownership in Microsoft 365, you must add a TXT record with a specific verification value provided by the Microsoft 365 admin center to the public DNS zone. This proves you control the domain because only the domain owner can modify DNS records. Other record types like MX, CNAME, or SPF are used for mail routing or service configuration, not for ownership verification.

Answer

MX record

Answer

CNAME record

Answer

SPF record

Question 3

Your company recently acquired a subsidiary that uses a different Microsoft 365 tenant. You are tasked with merging the two tenants into one. The subsidiary has 1,500 users with unique email domains. You need to migrate all users, mailboxes, and SharePoint data while minimizing downtime and preserving data integrity. You have access to both tenants as global admin. What should you do first?

Accepted Answer

Use a third-party migration tool such as BitTitan MigrationWiz to perform the migration. Microsoft does not provide a native tool for merging two tenants; third-party tools like BitTitan MigrationWiz are designed specifically for cross-tenant migrations, supporting mailbox, SharePoint, and user data migration with minimal downtime and data integrity. These tools handle directory synchronization, mailbox rehydration, and SharePoint content mapping, which are critical for a 1,500-user migration with unique domains.

Answer

Add the subsidiary's domain to the primary tenant, then delete the subsidiary tenant and recreate users

Answer

Use the Microsoft 365 Merger Center in the admin portal

Answer

Use Microsoft's native tenant-to-tenant migration by moving mailboxes via PowerShell and exporting SharePoint content

Question 4

You need to configure self-service password reset (SSPR) for users in Microsoft Entra ID. Which license is required?

Accepted Answer

Microsoft Entra ID P1. Self-service password reset (SSPR) requires a Microsoft Entra ID P1 or P2 license. Both Microsoft 365 F3 and Microsoft 365 E3 include Microsoft Entra ID P1 licenses, which support SSPR. However, the question directly asks which license is required for SSPR, and the correct answer is the standalone Microsoft Entra ID P1 license. While F3 and E3 include this license, they are suite licenses and not the specific license component being asked for.

Answer

Microsoft 365 F3

Answer

Microsoft 365 E3

Answer

Microsoft Entra ID Free

Question 5

You are deploying a new Microsoft 365 tenant for a company that has a single domain, contoso.com. You need to verify domain ownership to enable email routing. Which DNS record type must you add to the public DNS zone?

Accepted Answer

TXT record with a verification code provided by Microsoft 365.. To verify domain ownership in Microsoft 365, you must add a TXT record containing a unique verification code provided by the Microsoft 365 admin center to your public DNS zone. This proves you control the domain, enabling email routing and other services. Other DNS records like CNAME, SPF, or MX are used for service configuration, not ownership verification.

Answer

CNAME record with 'autodiscover' pointing to 'autodiscover.outlook.com'.

Answer

SPF record including Microsoft 365 IP addresses.

Answer

MX record pointing to Microsoft 365.

Question 6

Your organization uses Microsoft 365 E5 licenses for all users. You need to configure role-based access control (RBAC) so that helpdesk staff can reset passwords and manage licenses, but cannot modify user principal names (UPNs) or delete users. Which role assignment should you use?

Accepted Answer

Helpdesk Administrator. The Helpdesk Administrator role is correct because it grants the specific permissions needed to reset passwords and manage licenses, while explicitly preventing modifications to user principal names (UPNs) and user deletions. This role is designed for tier-1 support staff who require these capabilities without elevated user management rights.

Answer

License Administrator

Answer

Password Administrator

Answer

User Administrator

Question 7

A company needs to ensure that only users from specific IP ranges can access Exchange Online. Which tool should be used?

Accepted Answer

Azure AD Conditional Access with Named Locations. Microsoft Entra Conditional Access with Named Locations is the correct tool because it allows administrators to define trusted IP ranges as named locations and then enforce access policies that restrict Exchange Online access to only those IP ranges. This integrates directly with Microsoft Entra ID authentication, evaluating the user's IP address during sign-in to grant or block access based on the policy.

Answer

Security & Compliance Center

Answer

Multi-factor authentication

Answer

Azure AD Connect

Question 8

An admin needs to provide a vendor with temporary access to a SharePoint site. What should the admin create?

Accepted Answer

Guest user in Azure AD. A is correct because creating a guest user in Microsoft Entra ID is the proper method to grant external users access to SharePoint Online resources with controlled permissions. Guest users are invited via Microsoft Entra B2B collaboration, which allows the admin to assign specific SharePoint site permissions while maintaining oversight and the ability to revoke access. This approach ensures the vendor has a distinct identity for auditing and conditional access policies.

Answer

Anonymous sharing link

Answer

Security group

Answer

New user in your domain

Question 9

You are the Microsoft 365 administrator for a company with a hybrid identity configuration using Azure AD Connect. The company has a custom domain 'contoso.com' federated with Active Directory Federation Services (ADFS). All users are synced from on-premises Active Directory. The security team wants to implement Microsoft Entra ID Protection to detect risky sign-ins. However, they are concerned that federated authentication bypasses some risk detection capabilities. You need to ensure that Microsoft Entra ID Protection can evaluate risk for all sign-ins, including federated ones. What should you do?

Accepted Answer

Switch from federated authentication to Pass-through Authentication (PTA) or Password Hash Sync (PHS).. Microsoft Entra ID Protection relies on signals such as IP addresses, device information, and sign-in patterns to calculate risk. In a federated setup with ADFS, the authentication happens on-premises, and Microsoft Entra ID only receives a token—not the raw sign-in details needed for real-time risk evaluation. Switching to Pass-through Authentication (PTA) or Password Hash Sync (PHS) ensures that the authentication process flows through Microsoft Entra ID directly, allowing Entra ID Protection to capture and analyze all sign-in events, including those from federated users.

Answer

Configure the federated trust in Microsoft Entra ID to use the new claims.

Answer

Configure ADFS to send the ipaddr and xms_ep claims to Azure AD.

Answer

Enable Azure AD Application Proxy to publish ADFS internally.

Question 10

Your organization uses Microsoft Entra ID P2 and Microsoft Defender for Cloud Apps. You need to protect a custom SaaS application that uses SAML-based SSO. The application does not support Conditional Access. You want to enforce session controls such as blocking downloads of sensitive files. What should you implement?

Accepted Answer

Deploy Microsoft Defender for Cloud Apps Conditional Access App Control and route the application through Defender for Cloud Apps.. Microsoft Defender for Cloud Apps Conditional Access App Control acts as a reverse proxy that can enforce session policies—such as blocking downloads of sensitive files—on any SAML-based SaaS application, even if the application itself does not support Conditional Access. By routing the application's traffic through Defender for Cloud Apps, you can apply granular session controls at the proxy layer without modifying the application.

Answer

Implement a reverse proxy from a third-party vendor.

Answer

Create a custom application registration and set app roles.

Answer

Configure the application to use Microsoft Entra ID as the identity provider and enable Conditional Access policies.

Question 11

You are reviewing an ARM template that will be used to deploy a storage account for a Microsoft 365 migration project. The template includes 'supportsHttpsTrafficOnly': true. What is the primary benefit of this setting?

Accepted Answer

It enforces secure transfer (HTTPS) for all requests to the storage account.. Setting 'supportsHttpsTrafficOnly' to true enforces secure transfer by requiring all requests to the storage account to use HTTPS (TLS). This ensures data in transit is encrypted, protecting against man-in-the-middle attacks and eavesdropping. It is a critical security control for compliance with standards like PCI-DSS and HIPAA.

Answer

It reduces latency by enabling CDN integration.

Answer

It enables geo-redundant storage.

Answer

It minimizes storage costs by reducing bandwidth usage.

Question 12

Your organization uses Microsoft Defender for Identity. You receive an alert about a potential DCSync attack. What should you do to investigate this alert in Microsoft Defender XDR?

Accepted Answer

Run a KQL query in Advanced Hunting against IdentityLogonEvents to identify suspicious replication attempts.. DCSync attacks are performed by requesting domain replication via the MS-DRSR protocol, which generates specific directory replication events. In Microsoft Defender XDR, these replication attempts are logged in the IdentityLogonEvents table when an account authenticates to a domain controller for replication purposes. Running a KQL query against this table allows you to identify the source account, target domain controller, and the specific replication activity that triggered the alert.

Answer

Review the IdentityDirectoryEvents table for replication-related events.

Answer

Use IdentityQueryEvents to find LDAP queries related to replication.

Answer

Check the IdentityAlertEvents table to see if the alert has additional context.

Question 13

Administrators want to enforce multi-factor authentication (MFA) for all users when accessing cloud applications from untrusted networks. They plan to use Azure AD Conditional Access with named locations. Which two components must be configured to meet this requirement? (Select two.)

Accepted Answer

named location for the corporate network. Option B is correct because a named location must be defined to represent the trusted corporate network, allowing the Conditional Access policy to distinguish trusted from untrusted networks and apply MFA only when users connect from outside that location. Option C is correct because a Conditional Access policy scoped to all cloud apps is required to enforce the MFA requirement across every cloud application users access. Together, the named location and the Conditional Access policy targeting all cloud apps satisfy the scenario's requirement to enforce MFA from untrusted networks. Option A is not a valid Microsoft Entra ID component; location-based conditions are configured within a Conditional Access policy using named locations, not as a standalone 'location policy.' Option D is incorrect because a policy targeting MFA registration addresses the registration experience for authentication methods, not the enforcement of MFA when accessing cloud applications.

Answer

location policy

Answer

Conditional Access policy targeting MFA registration

Question 14

A user reports they cannot access Microsoft Teams. They see a message: 'Your account is not enabled for Teams.' You verify the user has a valid Microsoft 365 E3 license assigned. What is the most likely cause?

Accepted Answer

The Teams service plan is disabled in the user's license.. The error 'Your account is not enabled for Teams' indicates that the Teams service plan is disabled within the user's assigned Microsoft 365 E3 license. Even with a valid license, each service plan (e.g., Teams, Exchange Online, SharePoint) can be individually toggled on or off via the Microsoft 365 admin center or PowerShell. Since the user has a valid license but cannot access Teams, the most likely cause is that the Teams service plan has been explicitly disabled.

Answer

The user does not have the correct Microsoft Entra ID role.

Answer

The user is not assigned a valid license.

Answer

The user is not a global administrator.

Question 15

Refer to the exhibit. You are reviewing the service principal for Microsoft Graph in your tenant. The passwordCredentials array is empty. What does this indicate?

Accepted Answer

No client secret is configured for the service principal.. The passwordCredentials array being empty indicates that no client secret (password) has been configured for the service principal. Client secrets are one method of authentication for service principals, and their absence means that this particular authentication method is not set up. This does not imply the service principal is disabled or that other authentication methods like certificates or federated credentials are in use.

Answer

The service principal is using federated credentials.

Answer

The service principal uses certificate-based authentication.

Answer

The Microsoft Graph application is disabled.

Question 16

The exhibit shows a DLP policy configuration. A user reports that they cannot share a document containing a credit card number from OneDrive for Business. However, the document was shared successfully last week. What is the most likely reason for the change?

Accepted Answer

The DLP policy was recently deployed or updated.. The most likely reason is that the DLP policy was recently deployed or updated. DLP policies in Microsoft 365 are evaluated in near real-time, and a newly deployed or modified policy will immediately enforce its rules on content sharing. Since the document was shared successfully last week, the policy change is the most plausible cause for the sudden block.

Answer

The DLP policy requires administrator override for sharing.

Answer

The DLP policy is applied only to SharePoint Online, not OneDrive.

Answer

The DLP policy does not include Microsoft Teams.

Question 17

An organization is implementing Microsoft Entra Verified ID for verifiable credentials. They want to issue credentials to employees that can be used to prove employment status to third parties. Which component must be created first?

Accepted Answer

A credential manifest in the Microsoft Entra admin center. The credential manifest defines the rules for issuing a verifiable credential, including the claims schema, display information, and issuance policies. In Microsoft Entra Verified ID, you must create the credential manifest in the Entra admin center before any credentials can be issued, as it serves as the template that governs the credential's structure and validation. Without a manifest, there is no definition for what the credential contains or how it should be presented.

Answer

A presentation request policy

Answer

A distributed ledger network

Answer

A decentralized identifier (DID) for the organization

Question 18

Your company uses Microsoft Entra ID and has a hybrid identity with PHS. You need to ensure that when an on-premises user account is disabled, the corresponding cloud user is also blocked from signing in within 5 minutes. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Microsoft Entra ID Protection reports to confirm the user as safe. When a user claims a blocked sign-in was legitimate, the proper action is to confirm the user as safe in the Microsoft Entra ID Protection reports. This action updates the risk state to 'confirmed safe', which resets the user's risk level and allows future sign-ins without lowering security. It also provides feedback to the risk detection algorithm to improve accuracy.

Answer

Create a conditional access policy to bypass MFA for this user

Answer

Suppress the alert in Microsoft Defender XDR

Answer

Dismiss the risk in the Risky users report

Question 19

You need to configure Microsoft Entra ID to allow users to authenticate using their existing social media accounts. Which identity provider type should you add?

Accepted Answer

Google identity provider. To allow users to authenticate using their existing social media accounts, you need to add a Google identity provider in Microsoft Entra ID. Google is explicitly supported as a social identity provider (IdP) for B2B guest user scenarios, enabling users to sign in with their Gmail accounts. This is configured under External Identities > All identity providers, where you select Google and configure the OAuth 2.0 client ID and secret from the Google API Console.

Answer

OpenID Connect identity provider

Answer

Microsoft account identity provider

Answer

SAML/WS-Fed identity provider

Question 20

Refer to the exhibit. You run this PowerShell command in your Microsoft 365 tenant. What is the purpose of the command?

Accepted Answer

To list all unlicensed users in the tenant. The PowerShell command `Get-MgUser -Filter 'assignedLicenses/$count eq 0' -ConsistencyLevel eventual` retrieves all users in the Microsoft 365 tenant who have no licenses assigned. The `assignedLicenses/$count eq 0` filter checks that the count of assigned licenses is zero, and `-ConsistencyLevel eventual` is required for advanced queries on directory objects. This directly corresponds to listing all unlicensed users in the tenant.

Answer

To list all users with sign-in blocked

Answer

To list all unlicensed users with a specific usage location

Answer

To list all users who have a license assigned