MS-102 Practice Questions 2 — 50 Questions

Question 1

A new employee has been hired and their account already exists in the on-premises Active Directory. The administrator needs to provide the employee with access to Microsoft 365 services as quickly as possible. What is the most efficient way to enable the user?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Sync the on-premises user using Azure AD Connect and then assign the license.. The user already exists in on-premises Active Directory, and the fastest way to enable Microsoft 365 access is to synchronize that identity using Azure AD Connect. Once synchronized, the user object appears in Microsoft Entra ID (formerly Azure AD), and the administrator can immediately assign a license without re-creating the account. This avoids the delays of manual creation or guest invitations and leverages the existing identity lifecycle.

Answer

Create a new cloud-only user in the Microsoft 365 admin center and assign a license.

Answer

Manually create a user in Microsoft Entra ID with the same name and assign license.

Answer

Use Azure AD B2B collaboration to invite the on-premises user as a guest.

Question 2

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their Google Workspace credentials without creating external identities. What should you configure?

Accepted Answer

Configure SAML/WS-Fed identity provider federation with Google Workspace. Configuring SAML/WS-Fed identity provider federation with Google Workspace allows users to sign in using their Google Workspace credentials directly, without creating external identities. This federation establishes a trust relationship between Microsoft Entra ID and Google Workspace as an identity provider, enabling seamless authentication for users who already have Google accounts.

Answer

Enable Microsoft Entra Verified ID for Google Workspace users

Answer

Configure Google as a social identity provider in Microsoft Entra External ID

Answer

Configure Microsoft Entra B2B collaboration with Google Workspace

Question 3

The exhibit shows a KQL query used in Microsoft 365 Defender. The query returns no results for admin@contoso.com. What is the most likely reason?

Accepted Answer

Microsoft Defender for Identity is not enabled for the tenant.. The KQL query uses the `IdentityLogonEvents` table, which is populated by Microsoft Defender for Identity (MDI). If MDI is not enabled for the tenant, this table contains no data, so the query returns no results regardless of the user's role or query syntax. The query itself is syntactically correct and the role name 'GlobalAdministrator' is valid, but without MDI being provisioned, the table is empty.

Answer

The user does not have the Global Administrator role.

Answer

The KQL query syntax is invalid.

Answer

The role name in the query is misspelled.

Question 4

Your organization has a hybrid identity with Microsoft Entra Connect. You need to migrate from federation to password hash synchronization with seamless single sign-on (SSO). The migration must have minimal user impact. Which tool should you use?

Accepted Answer

Microsoft Entra Connect migration tool (Convert domain from federated to managed). The Microsoft Entra Connect migration tool (Convert domain from federated to managed) is the correct choice because it automates the conversion of federated domains to managed domains while enabling password hash synchronization (PHS) and seamless SSO. This tool minimizes user impact by allowing a staged migration where users can continue authenticating via federation until the conversion is complete, and it handles the necessary configuration changes in Azure AD and on-premises Active Directory.

Answer

IdFix tool

Answer

AD FS Management console

Answer

Azure AD Connect wizard

Question 5

Drag and drop the steps to configure Microsoft 365 Groups expiration policy in the correct order.

Accepted Answer

Step 1: Go to Microsoft 365 admin center > Groups > Expiration. Step 2: Set the expiration duration. Step 3: Configure notification settings. Step 4: Save the policy.. Groups expiration policy is set in the admin center with a duration, notification owner, and deletion behavior.

Answer

Step 1: Set the expiration duration. Step 2: Go to Microsoft 365 admin center > Groups > Expiration. Step 3: Configure notification settings. Step 4: Save the policy.

Answer

Step 1: Go to Microsoft 365 admin center > Groups > Expiration. Step 2: Configure notification settings. Step 3: Set the expiration duration. Step 4: Save the policy.

Answer

Step 1: Go to Microsoft 365 admin center > Groups > Expiration. Step 2: Set the expiration duration. Step 3: Save the policy. Step 4: Configure notification settings.

Question 6

You are the Microsoft 365 Administrator for a multinational organization that must comply with various regulatory requirements, including GDPR, SOX, and internal data retention policies. You are deploying Microsoft Purview compliance solutions. Which four of the following actions are valid steps when managing compliance using Microsoft Purview? (Choose all that apply. There are four correct answers.)

Accepted Answer

Enable auditing in the Microsoft 365 compliance portal to track user activities such as file downloads and mailbox access.. Creating a DLP policy that prevents sharing credit card numbers via email with external recipients is a valid step because Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive information types (e.g., credit card numbers) and enforce actions such as blocking external sharing. This directly supports compliance with regulations like GDPR and SOX by preventing unauthorized data exfiltration.

Answer

Apply a sensitivity label to a SharePoint site that blocks all external sharing of documents stored in that site.

Answer

Assign a retention policy to a user's mailbox that deletes all emails immediately after they are sent.

Question 7

A global administrator at Fabrikam Inc. plans to implement Microsoft Purview to manage compliance for sensitive information. The solution must include the ability to discover, classify, and protect sensitive data across Microsoft 365 services. Which three of the following should the administrator configure? (Choose three.)

Accepted Answer

Enable auto-labeling policies in Microsoft Purview to automatically apply sensitivity labels to documents containing trade secrets.. Creating a sensitive information type is correct because it allows the administrator to define custom patterns (e.g., employee IDs) that Microsoft Purview can use to discover and classify sensitive data across Microsoft 365 services. This is a foundational step for building compliance policies tailored to the organization's specific data.

Answer

Set up a data loss prevention (DLP) policy to block external sharing of files labeled as 'Highly Confidential'.

Answer

Enable Microsoft Purview Insider Risk Management to scan and label all historical email data.

Answer

Deploy Microsoft Purview eDiscovery to automatically classify all content in Microsoft Teams chats.

Question 8

You are configuring Microsoft Defender for Office 365. Which TWO actions should you take to protect users from phishing attacks that use impersonation?

Accepted Answer

Configure anti-phishing policies to protect users from impersonation of custom domains.. Options C and D are correct because anti-phishing policies can be configured to protect against impersonation of custom domains and internal users. Option A is wrong because DLP policies prevent sharing of sensitive data, not phishing. Option B is wrong because anti-spam policies handle spam, not impersonation. Option E is wrong because Safe Attachments scans files for malware, not phishing impersonation.

Answer

Create a data loss prevention (DLP) policy to prevent sharing of credentials.

Answer

Configure anti-spam policies to increase the spam confidence level.

Answer

Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams.

Question 9

You are planning the initial deployment of a new Microsoft 365 tenant for Contoso Ltd. Which three of the following actions are required or recommended as part of the tenant provisioning and initial configuration process? (Choose three.)

Accepted Answer

Register a custom domain name (e.g., contoso.com) and verify ownership via DNS TXT record.. Registering and verifying a custom domain (e.g., contoso.com) via a DNS TXT record is a required step to use your own domain for email and user identities instead of the default onmicrosoft.com domain. Creating the initial global administrator account with a strong password and enabling multi-factor authentication (MFA) is a critical security best practice and is recommended by Microsoft to protect the highest-privileged role. Configuring tenant-wide service settings, such as external sharing for SharePoint and OneDrive, is recommended during initial setup to align with organizational security and collaboration policies before users begin working.

Answer

Configure the default tenant-level password expiration policy to 90 days using the Microsoft 365 admin center.

Answer

Set up a secondary domain as the default email domain to avoid conflicts with the initial onmicrosoft.com domain.

Answer

Assign Microsoft 365 licenses to all user accounts before creating the accounts.

Question 10

Which TWO Microsoft Purview solutions can be used to detect and prevent the unauthorized sharing of sensitive information in Microsoft Teams messages?

Accepted Answer

Communication Compliance. DLP policies can scan Teams messages for sensitive content and block sharing. Communication Compliance can monitor messages for policy violations and take action. Sensitivity labels are for classification, not detection. Information Barriers restrict communication between groups. eDiscovery is for investigation after the fact.

Answer

eDiscovery (Premium)

Answer

Sensitivity labels

Answer

Information Barriers

Question 11

You are investigating an alert in Microsoft Defender XDR that indicates a user clicked a malicious link in an email. You need to gather additional information to determine the scope of the attack. Which three sources should you examine?

Accepted Answer

Email entity page. To fully investigate a phishing incident, you should examine the alert timeline for related events, the email entity page for email details, and the user entity page for user actions. Device timeline may not be relevant if the user only clicked a link without further action. The incidents page provides a summary but not detailed scope.

Answer

Incidents page

Answer

Device timeline

Question 12

Match each Microsoft 365 service to its primary purpose.

Accepted Answer

Exchange Online: Email hosting and calendaring. The correct matches associate Exchange Online with email and calendaring, SharePoint Online with document management and collaboration, Microsoft Teams with chat and meetings, and OneDrive for Business with personal cloud storage. Common confusions include misassigning Exchange's purpose to OneDrive or OneDrive's purpose to SharePoint.

Answer

OneDrive for Business: Email hosting and calendaring

Answer

SharePoint Online: Personal cloud storage

Question 13

Which THREE features are included in Microsoft Defender for Office 365 Plan 2 but NOT in Plan 1? (Choose three.)

Accepted Answer

Automated Investigation and Response (AIR). Options C, D, and E are correct. Plan 2 includes Automated Investigation and Response (AIR), Threat Explorer, and Attack Simulation Training. Plan 1 includes anti-phishing policies (A) and Safe Links (B), so they are not correct.

Answer

Anti-phishing policies

Answer

Safe Links

Question 14

Which THREE components are required to implement Microsoft Purview Data Lifecycle Management for Microsoft 365? (Choose three.)

Accepted Answer

Retention labels. Options A, B, and E are correct because retention labels, retention policies, and a file plan are core components for Data Lifecycle Management. Option C is incorrect because sensitivity labels are part of Information Protection, not Data Lifecycle Management. Option D is incorrect because DLP is a separate solution.

Answer

Sensitivity labels

Answer

Data loss prevention policies

Question 15

A compliance officer needs to ensure that all outbound emails containing credit card numbers sent to external recipients are automatically encrypted without requiring user intervention. Which Microsoft Purview feature should be configured?

Accepted Answer

Data Loss Prevention (DLP) policy with a rule that encrypts the message when credit card numbers are detected.. A Data Loss Prevention (DLP) policy in Microsoft Purview can be configured with a rule that automatically detects credit card numbers (using a built-in sensitive info type) and applies encryption via Transport Layer Security (TLS) or Information Rights Management (IRM) to outbound emails sent to external recipients. This meets the compliance officer's requirement for automatic encryption without user intervention, as the DLP rule triggers encryption at the transport level in Exchange Online.

Answer

Sensitivity label with auto-labeling based on credit card numbers.

Answer

Retention policy for Exchange Online.

Answer

eDiscovery case for content search.

Question 16

Your organization uses Microsoft Defender for Office 365. You need to ensure that users are warned before opening potentially malicious attachments in Outlook on the web. Which policy setting should you configure?

Accepted Answer

Open in protected view. The 'Open in protected view' policy setting in Microsoft Defender for Office 365 ensures that when a user opens an email attachment in Outlook on the web, the file is opened in a sandboxed, read-only environment that warns the user of potential risks before allowing full interaction. This directly addresses the requirement to warn users before opening potentially malicious attachments, as it triggers a warning banner and restricts editing capabilities until the user explicitly enables editing.

Answer

Attachments in email are blocked

Answer

Attachments are held and scanned

Answer

Dynamic Delivery

Question 17

A security administrator needs to block executable files from running from the %TEMP% folder on Windows devices to prevent common malware execution. Which attack surface reduction (ASR) rule should be enabled?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criteria. The ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criteria' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) specifically targets executables launched from locations commonly used by malware, such as the %TEMP% folder. This rule uses cloud-delivered reputation data to allow only executables that are prevalent, have sufficient age, or are on a trusted list, effectively blocking unknown or suspicious binaries from running in temporary directories.

Answer

Block credential stealing from the Windows local security authority subsystem

Answer

Block all Office applications from creating child processes

Answer

Block JavaScript or VBScript from launching downloaded executable content

Question 18

A security analyst needs to create a custom detection rule in Microsoft Defender XDR that triggers when a device communicates with a new, unclassified IP address flagged by Microsoft threat intelligence as potentially malicious. The rule must run every hour and create an incident if the count of such communications exceeds 10 in a 24-hour window. Which type of rule should the analyst create?

Accepted Answer

custom detection rule using advanced hunting. A custom detection rule using advanced hunting is the correct choice because Microsoft Defender XDR allows you to create custom detection rules based on Kusto Query Language (KQL) queries that run on a scheduled interval (e.g., every hour). This rule can query the `DeviceNetworkEvents` table to identify communications with IP addresses flagged as malicious by Microsoft threat intelligence, aggregate the count over a 24-hour sliding window, and trigger an incident when the threshold of 10 is exceeded. This directly meets the requirement for a scheduled, threshold-based detection within Defender XDR.

Answer

scheduled alert rule in Microsoft Sentinel

Answer

An incident creation rule in Microsoft Defender for Cloud Apps

Answer

custom remediation action rule

Question 19

A new administrator needs to automatically assign Microsoft 365 E5 licenses to all users in the Sales department. The Sales department is identified by the 'department' attribute in Azure AD. Which licensing method should the administrator use to minimize manual effort?

Accepted Answer

Group-based licensing using a dynamic group. Group-based licensing using a dynamic group is the correct method because it automatically assigns Microsoft 365 E5 licenses to all users in the Sales department based on the 'department' attribute in Azure AD. Dynamic groups evaluate membership rules in real time, so when a user's department attribute is set to 'Sales', the license is assigned without manual intervention. This minimizes administrative effort by eliminating the need for per-user or batch operations.

Answer

Manual license assignment per user

Answer

PowerShell script to assign licenses

Answer

Bulk license assignment via CSV file

Question 20

Contoso uses Microsoft Entra ID P1 licenses and has a dedicated corporate office with static public IP addresses. The company wants to require MFA for all users, but exempt users when they connect from the corporate office. Which configuration should the administrator implement?

Accepted Answer

Create a Conditional Access policy that targets all users, grant access requiring MFA, and exclude the corporate office location from the policy.. A Conditional Access policy can target all users, require MFA as a grant control, and exclude the corporate office location (defined by static public IP addresses as a named location). This ensures MFA is enforced for all connections except those originating from the trusted corporate network, aligning with the requirement to exempt users at the office.

Answer

Create a Conditional Access policy that targets all users, grant access requiring MFA, and include the corporate office location as a condition.

Answer

Configure a Per-User MFA policy and add the corporate office IPs to a list of trusted IPs in the MFA settings.

Answer

Create a Conditional Access policy that targets the corporate office location and grant access with MFA for all other locations.