MS-102 Practice Questions 2 — 50 Questions

Question 1

The security team wants to require approval for any activation of the Global Administrator role in Azure AD Privileged Identity Management (PIM). The approvers must be members of a security group named 'GA-Approvers'. Activations must require a business justification and expire after 4 hours. Which PIM configuration should the administrator modify?

Accepted Answer

Both A and C. Option D is correct because configuring PIM role settings for Global Administrator requires both enabling approval (with the 'GA-Approvers' group as designated approvers) and setting the activation parameters (maximum duration of 4 hours and justification requirement). Option A alone only sets the role settings but does not specify which group serves as approvers; Option C alone adds the approvers group but does not configure the activation duration or justification. Both A and C together fulfill the full requirement.

Answer

Role settings for Global Administrator: require approval, set maximum activation duration to 4 hours, and require justification

Answer

Role settings for Global Administrator: require MFA, set maximum activation duration to 4 hours, and require justification

Answer

In the eligible assignments for Global Administrator, add 'GA-Approvers' as approvers

Question 2

An organization with Microsoft Entra ID P2 licenses needs to enforce that all users accessing the Azure portal must use FIDO2 security keys for multi-factor authentication. Which configuration should be implemented?

Accepted Answer

Configure an authentication strength policy that requires FIDO2 and assign it to a Conditional Access policy. Option C is correct because in Microsoft Entra ID, authentication strengths allow you to define a specific set of authentication methods (e.g., FIDO2 security keys) and then assign that strength to a Conditional Access policy. This ensures that only FIDO2 security keys are accepted for MFA when accessing the Azure portal, meeting the requirement precisely.

Answer

Create a Conditional Access policy that requires MFA and select FIDO2 as the authentication strength in the grant controls

Answer

Create a Conditional Access policy that requires MFA and set the grant control to require a specific device platform

Answer

Configure an authentication methods policy that allows only FIDO2 security keys

Question 3

An organization has registered the domain contoso.com and added it to their Microsoft 365 tenant. What is the next step to use this domain for user email addresses?

Accepted Answer

Add a DNS TXT record provided by Microsoft to the domain registrar. After adding a custom domain to Microsoft 365, the domain's ownership must be verified by adding a specific DNS TXT record provided by Microsoft at the domain registrar. This verification proves you control the domain and is a prerequisite before you can assign user email addresses or configure other DNS records like MX. Without this step, Microsoft 365 will not trust the domain for email routing.

Answer

Create user accounts with the new domain

Answer

Configure Exchange Online connectors

Answer

Set up MX records for email routing

Question 4

A company has a Microsoft 365 tenant with the domain contoso.com. They acquire a subsidiary with the domain fabrikam.com and want to add it as an additional domain to the same tenant. The domain is already purchased and DNS management is available. What is the first step the administrator should take in the Microsoft 365 admin center?

Accepted Answer

Add the domain and verify ownership by adding a TXT record. To add an existing domain like fabrikam.com to a Microsoft 365 tenant, the first step is to add the domain in the Microsoft 365 admin center and then verify ownership by adding a TXT record to the domain's DNS zone. This verification proves the administrator controls the domain, which is a prerequisite for using it with Microsoft 365 services such as Exchange Online or SharePoint.

Answer

Create a new tenant for fabrikam.com

Answer

Set up email forwarding from contoso.com to fabrikam.com

Answer

Convert fabrikam.com to a federated domain

Question 5

A company has just signed up for Microsoft 365 Business Standard without adding a custom domain. An administrator needs to create the first user accounts. What will be the default email address format for these new users?

Accepted Answer

username@.onmicrosoft.com. When a Microsoft 365 tenant is created without adding a custom domain, the default domain is the `.onmicrosoft.com` domain. New user accounts are automatically assigned an email address in the format `username@.onmicrosoft.com`, as this is the initial domain provisioned for the tenant. Option C correctly reflects this default behavior.

Answer

username@contoso.com

Answer

username@onmicrosoft.com

Answer

username@microsoftonline.com

Question 6

A security administrator needs to block outbound network connections from a compromised Windows device to command-and-control servers. The solution must work at the network layer and be centrally managed via Microsoft 365 Defender. Which feature should the administrator enable?

Accepted Answer

Network Protection. Network Protection in Microsoft Defender for Endpoint blocks outbound connections to command-and-control (C2) servers at the network layer by inspecting traffic using the Windows Filtering Platform (WFP). It is centrally managed via Microsoft 365 Defender policies and does not require per-device firewall rule configuration, making it the correct choice for this scenario.

Answer

Attack Surface Reduction rules

Answer

Session control in Defender for Cloud Apps

Answer

Windows Firewall with Advanced Security

Question 7

A company uses Azure AD Connect with password hash synchronization. They want to allow users to reset their on-premises Active Directory passwords from the cloud Self-Service Password Reset (SSPR) portal. Which additional configuration is required in Azure AD Connect?

Accepted Answer

Enable password writeback. Password writeback is the specific feature in Azure AD Connect that enables password changes performed in the cloud (via SSPR) to be written back to the on-premises Active Directory. Without this feature enabled and configured, the SSPR portal can only reset cloud-only passwords, not synchronized on-premises passwords. Therefore, enabling password writeback is the additional configuration required beyond the existing password hash synchronization.

Answer

Enable self-service password reset in Azure AD

Answer

Configure Federation Services (AD FS)

Answer

Install Azure AD Application Proxy

Question 8

A company uses Microsoft Entra ID P2 licenses and wants to implement just-in-time (JIT) privileged access for administrators. Security requirements state that Global Administrator role members must request approval and provide a business justification before their role activation expires after 4 hours. Which Microsoft Entra feature should be configured?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access, requiring approval and a business justification for role activation, with configurable maximum activation durations (e.g., 4 hours). This directly meets the security requirement for Global Administrator role members to request approval and provide justification before activation expires after 4 hours.

Answer

Conditional Access

Answer

Identity Protection

Answer

Self-Service Password Reset (SSPR)

Question 9

A company uses Microsoft Entra ID P2 licenses. They want to require multi-factor authentication (MFA) for all users when accessing the Azure Management portal, but only from devices that are not marked as compliant. Additionally, a group named 'BreakGlass' must be excluded from this requirement. Which Conditional Access policy configuration should be applied?

Accepted Answer

Assign to 'All users', condition: 'Device state (preview) is not compliant', grant: 'Require MFA', exclude: 'BreakGlass group'. Option A is correct because it directly maps the requirement: assign the policy to 'All users', use the 'Device state (preview) is not compliant' condition to target only non-compliant devices, grant 'Require MFA' for the Azure Management portal (selected via the 'Cloud apps' condition), and exclude the 'BreakGlass' group. This ensures MFA is enforced only when accessing the Azure Management portal from non-compliant devices, while break-glass accounts are exempt.

Answer

Assign to 'All users', condition: 'Sign-in risk is medium or higher', grant: 'Require MFA', exclude: 'BreakGlass group'

Answer

Assign to 'All users', condition: 'Client apps: Browser and Mobile apps', grant: 'Block access', exclude: 'BreakGlass group'

Answer

Assign to 'All users', condition: 'Device platform: Android, iOS, Windows, macOS', grant: 'Require MFA', exclude: 'BreakGlass group'

Question 10

A company uses Microsoft Entra ID P1 licenses. They want to enforce multi-factor authentication (MFA) for all users when accessing any cloud application from networks that are not trusted corporate locations. A group named 'Emergency' must be excluded from MFA requirements. Which Conditional Access policy configuration should the administrator use?

Accepted Answer

Assign the policy to all users, exclude the Emergency group, include all cloud apps, grant MFA, and set location condition to any network or location except trusted networks.. Option C is correct because the requirement is to enforce MFA for all users from untrusted networks, while excluding the Emergency group. The Conditional Access policy must be assigned to all users, exclude the Emergency group, include all cloud apps, require MFA as a grant control, and use a location condition set to 'any network or location except trusted networks' to target only untrusted locations. This configuration ensures MFA is triggered only when access originates from networks not defined as trusted corporate locations.

Answer

Assign the policy to all users, exclude the Emergency group, include all cloud apps, grant access (not MFA), and set location condition to trusted networks only.

Answer

Assign the policy to all users, exclude the Emergency group, include all cloud apps, grant MFA, and set location condition to any network or location.

Answer

Assign the policy to all users, exclude the Emergency group, include all cloud apps, grant MFA, and set location condition to trusted networks only.

Question 11

Match each Microsoft 365 networking port to its protocol.

Question 12

Match each Microsoft 365 compliance feature to its purpose.

Question 13

Match each Microsoft 365 threat scenario to the appropriate protection.

Question 14

Match each Microsoft 365 Defender portal component to its function.

Question 15

Match each PowerShell command to its function in Microsoft 365.

Question 16

Match each Microsoft 365 service to its primary purpose.

Question 17

A user with an E5 license is unable to use Azure Information Protection (AIP). The admin confirms the license is assigned. What is the most likely cause?

Accepted Answer

AIP service plan is disabled in the license. Even with an E5 license assigned, the Azure Information Protection (AIP) service plan must be explicitly enabled for the user. By default, some service plans within an E5 license may be disabled, and the AIP service plan (commonly labeled as 'Azure Information Protection' or 'Information Protection for Office 365') must be toggled on in the user's license settings in the Microsoft 365 admin center. Without this, the user cannot activate AIP features regardless of license assignment.

Answer

AIP requires an additional subscription

Answer

AIP client is not installed

Answer

User account is blocked

Question 18

A company has a hybrid identity setup. A new employee is created in on-premises AD but does not appear in Azure AD after sync. What should the admin check first?

Accepted Answer

Azure AD Connect synchronization status. When a new user is created in on-premises Active Directory but does not appear in Azure AD after synchronization, the first troubleshooting step is to check the Azure AD Connect synchronization status. This is because Azure AD Connect is the service responsible for synchronizing objects from on-premises AD to Azure AD, and any sync failure, delay, or misconfiguration (such as a stopped sync cycle or filtering rules) would prevent the user from appearing. Checking the sync status via the Azure AD Connect wizard or the Synchronization Service Manager can immediately reveal whether the object was exported, skipped, or errored.

Answer

Organizational unit filtering

Answer

DNS configuration

Answer

License assignment

Question 19

An organization needs to restrict access to Microsoft 365 admin center to only specific users. Which approach should be used?

Accepted Answer

Create a Conditional Access policy targeting the Microsoft Admin Portals cloud app. Option B is correct because a Conditional Access policy targeting the 'Microsoft Admin Portals' cloud app allows granular control over which users can access the Microsoft 365 admin center. This policy can enforce conditions such as user/group membership, device compliance, or location to restrict access, ensuring only specific authorized users can reach the admin portals.

Answer

Enable MFA for all admins

Answer

Assign Global Admin role only to required users

Answer

Use Privileged Identity Management

Question 20

Which THREE steps are required to enable group-based licensing?

Accepted Answer

Add members to the group. Option B is correct because group-based licensing in Azure AD requires that you add members to the security group that will have the license assigned. Without members, the license assignment has no effect, as the license is applied to all users in the group. This step ensures that the intended users receive the license automatically based on group membership.

Answer

Configure Azure AD Connect

Answer

Ensure group is mail-enabled