MS-102 Practice Exam 54 — 20 Questions

Question 1

A security analyst wants to create a custom detection rule in Microsoft Defender XDR that triggers when a device establishes a network connection to an IP address that has been recently observed in threat intelligence feeds as a new, malicious command-and-control server. The rule should analyze network communication events. Which advanced hunting table should be the primary data source for the Kusto Query Language (KQL) query?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the correct primary data source because it captures network connection events, including source and destination IP addresses, ports, and protocols. To detect a device connecting to a newly observed malicious command-and-control server, the KQL query must analyze network communication events, which are stored exclusively in this table.

Answer

DeviceProcessEvents

Answer

EmailEvents

Answer

AlertEvidence

Question 2

Refer to the exhibit. A Conditional Access policy is created in Microsoft Entra ID. The policy targets the Office 365 app (which includes Exchange Online). You have 1000 users assigned. What is the immediate effect of this policy on users who are currently signed in?

Accepted Answer

No immediate effect; users will be blocked on their next sign-in attempt.. Conditional Access policies in Microsoft Entra ID are evaluated at the time of sign-in. They do not terminate existing sessions. Therefore, users who are already signed in will not be affected until their next authentication attempt, at which point the policy's block action will be enforced.

Answer

All high-risk users are immediately blocked from accessing email.

Answer

The policy is invalid because the Office 365 app does not support block.

Answer

Only users with a sign-in risk of high are blocked.

Question 3

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a device makes an outbound connection to a known malicious IP address, and within 10 minutes, a process with suspicious command-line arguments is started on the same device. Which two Advanced Hunting tables must be joined using a KQL query to create this detection?

Accepted Answer

DeviceNetworkEvents and DeviceProcessEvents.. Option A is correct because the detection rule requires correlating outbound network connections (DeviceNetworkEvents) with process creation events (DeviceProcessEvents) on the same device within a 10-minute window. The KQL query would join these two tables on the DeviceId field and use a time filter to ensure the process event occurs within 10 minutes after the network event, enabling the detection of post-connection malicious activity.

Answer

DeviceEvents and DeviceLogonEvents.

Answer

DeviceNetworkEvents and DeviceRegistryEvents.

Question 4

Refer to the exhibit. You are reviewing an app registration in Microsoft Entra ID for the Microsoft Teams Admin Center. The permission shown is for another resource. What is the consequence of this permission configuration?

Accepted Answer

The app can access Microsoft Graph data without a signed-in user, and admin consent is required. The exhibit shows an application permission (not a delegated permission) for Microsoft Graph, which means the app can access data without a signed-in user. Admin consent is required because application permissions grant tenant-wide access and cannot be consented to by individual users. This is why option A is correct.

Answer

The app can only be used by users who have consented to the permission

Answer

The app can access Teams data but not other Microsoft 365 data

Answer

The app can access Microsoft Graph on behalf of the signed-in user only

Question 5

Your organization has a Microsoft 365 E5 subscription. You need to enforce that all users must use multi-factor authentication (MFA) when accessing Microsoft 365 services. Which TWO components should you configure?

Accepted Answer

Security defaults.. Security defaults (option B) is correct because it provides a pre-configured set of security policies that enforce MFA for all users accessing Microsoft 365 services, including requiring MFA registration and blocking legacy authentication. Conditional Access policy (option E) is correct because it allows granular control to require MFA based on specific conditions such as user, location, or device state, which is the modern, recommended approach for enforcing MFA in a Microsoft 365 E5 subscription.

Answer

Microsoft Defender for Identity.

Answer

Azure AD Identity Protection user risk policy.

Answer

Per-user MFA (legacy).

Question 6

Your organization uses Microsoft Entra ID and has strict security requirements. You need to implement a Zero Trust security model. Which THREE of the following are foundational principles of Zero Trust that should be implemented?

Accepted Answer

Use least privilege access. Option C is correct because least privilege access is a foundational principle of Zero Trust, ensuring users and devices are granted only the minimum permissions necessary to perform their tasks. In Microsoft Entra ID, this is implemented through features like Privileged Identity Management (PIM) and conditional access policies that restrict access based on role and context, reducing the attack surface.

Answer

Assume trust based on location

Answer

Segment access

Question 7

Refer to the exhibit. You manage an application registration in Microsoft Entra ID. The JSON shows the current state of the app's password credentials. The application is used by a daemon to acquire tokens. The certificate used for authentication expires on 2025-12-31. The application is currently using a client secret. The security policy requires rotating secrets every 6 months. What is the best course of action?

Accepted Answer

Create a new client secret, update the daemon to use the new secret, then delete the old secret. Option C is correct because the security policy requires rotating secrets every 6 months, and the current secret's endDateTime is set to 2025-12-31, which exceeds that interval. Creating a new client secret, updating the daemon to use it, and then deleting the old secret ensures compliance with the rotation policy while maintaining uninterrupted token acquisition. This approach follows the least-privilege and secret rotation best practices for application credentials in Microsoft Entra ID.

Answer

Switch the daemon to use certificate-based authentication and remove the secret

Answer

Do nothing; the secret does not expire until 2025-12-31

Answer

Extend the endDateTime of the existing secret to 2026-12-31

Question 8

Refer to the exhibit. You run this PowerShell script to disable high-risk users. However, some high-risk users remain enabled. What is the most likely reason?

Accepted Answer

The Get-AzureADIdentityRiskyUser cmdlet does not support the -Filter parameter. The Get-AzureADIdentityRiskyUser cmdlet does not support the -Filter parameter. This means the script's attempt to filter for high-risk users using -Filter "riskLevel eq high" will fail, returning no users or an error, so the subsequent Set-AzureADUser cmdlet never runs against the intended high-risk users, leaving them enabled.

Answer

The Set-AzureADUser cmdlet fails for disabled users

Answer

The script does not have permission to read risky users

Answer

High-risk users are protected by a Conditional Access policy

Question 9

Which THREE settings must be configured to set up a hybrid identity deployment using password hash synchronization?

Accepted Answer

Install and configure Microsoft Entra Connect.. Option A is correct because Microsoft Entra Connect (formerly Azure AD Connect) is the essential tool that bridges on-premises Active Directory with Microsoft Entra ID. It must be installed and configured to enable directory synchronization, which is the foundation for any hybrid identity deployment, including password hash synchronization.

Answer

Deploy Active Directory Federation Services (AD FS).

Answer

Configure Pass-Through Authentication.

Question 10

Which TWO tools can be used to manage Microsoft 365 tenant settings and configurations?

Accepted Answer

Microsoft 365 admin center. The Microsoft 365 admin center is the primary web-based portal for managing tenant-wide settings such as user licensing, domain management, service health, and security policies. It provides a unified dashboard for configuring core tenant configurations without requiring role-specific consoles.

Answer

Exchange admin center (EAC)

Answer

SharePoint admin center

Answer

Microsoft Intune admin center

Question 11

You are a Microsoft 365 administrator. A user reports that they cannot send emails to a specific external domain. You check the Exchange Admin Center and see that the domain is not blocked. What should you check next?

Accepted Answer

Check the mail flow rules (transport rules) in Exchange Online.. Mail flow rules (transport rules) in Exchange Online can block or redirect messages based on conditions like sender, recipient domain, or message content, even if the domain is not listed in any block list. Since the domain is not blocked in the spam filter or outbound policies, a transport rule is the most likely cause of the issue, as it can silently reject or quarantine messages without appearing in the standard block lists.

Answer

Verify that the user has a full mailbox and is not over the send limit.

Answer

Review the outbound spam filter policy.

Answer

Check the spam filter policy to see if the domain is on the blocked sender list.

Question 12

A company uses Microsoft Entra ID for identity management. The security team wants to ensure that users cannot register applications in the tenant to prevent potential data leakage. Which setting should be configured?

Accepted Answer

Set 'Users can register applications' to 'No' in User settings. Option C is correct because setting 'Users can register applications' to 'No' in the Microsoft Entra ID User settings explicitly prevents non-admin users from creating application registrations in the tenant. This directly addresses the security team's goal of blocking users from registering apps, which could otherwise expose tenant data through misconfigured or malicious applications.

Answer

Set the 'Admin consent requests' setting to 'Allow'

Answer

Enable the 'Admin consent workflow'

Answer

Set 'Users can consent to apps accessing company data' to 'No'

Question 13

Refer to the exhibit. You are configuring consent for the Microsoft Graph application. Which of the following statements is true based on the JSON?

Accepted Answer

The User.Read.All permission requires admin consent.. The JSON shows the User.Read.All permission has the 'AdminConsentRequired' property set to true, meaning it requires admin consent. The Mail.Read permission has 'AdminConsentRequired' set to false, so users can consent to it without admin involvement. Option D correctly identifies that User.Read.All requires admin consent.

Answer

Users can consent to the User.Read.All permission.

Answer

The Mail.Read permission requires admin consent.

Answer

No consent is required for either permission.

Question 14

A user reports they cannot access Microsoft Teams. They see a message: 'Your account is not enabled for Teams.' You verify the user has a valid Microsoft 365 E3 license assigned. What is the most likely cause?

Accepted Answer

The Teams service plan is disabled in the user's license.. The error 'Your account is not enabled for Teams' indicates that the Teams service plan is disabled within the user's assigned Microsoft 365 E3 license. Even with a valid license, each service plan (e.g., Teams, Exchange Online, SharePoint) can be individually toggled on or off via the Microsoft 365 admin center or PowerShell. Since the user has a valid license but cannot access Teams, the most likely cause is that the Teams service plan has been explicitly disabled.

Answer

The user does not have the correct Microsoft Entra ID role.

Answer

The user is not assigned a valid license.

Answer

The user is not a global administrator.

Question 15

Your organization plans to use Microsoft 365 Copilot. To ensure compliance, you need to prevent Copilot from accessing sensitive content in SharePoint Online document libraries that are labeled as 'Highly Confidential'. What should you configure?

Accepted Answer

Configure a sensitivity label with encryption and apply it to the documents.. Option D is correct because sensitivity labels with encryption can restrict access to documents based on their classification. When a document is labeled 'Highly Confidential' and encrypted, Microsoft 365 Copilot cannot process it because Copilot respects the encryption applied by the label, effectively preventing it from accessing the sensitive content. This is the only configuration that directly controls Copilot's ability to read the content at the file level.

Answer

Configure a retention policy to prevent Copilot from accessing older content.

Answer

Create a conditional access policy to block Copilot from accessing SharePoint.

Answer

Create a DLP policy to block Copilot from processing 'Highly Confidential' content.

Question 16

A company plans to enable Self-Service Password Reset (SSPR) for all users. The administrator needs to ensure that users are required to register at least two authentication methods before they can use SSPR. Which configuration setting should the administrator modify?

Accepted Answer

Set the 'Number of methods required to reset' to 2 in the SSPR authentication methods settings.. Option A is correct because the 'Number of methods required to reset' setting directly controls how many authentication methods a user must provide during the SSPR reset process. By setting this value to 2, the administrator ensures that users must register at least two methods (e.g., phone and email) before they can reset their password, as SSPR requires the registered methods to match the reset requirement.

Answer

Enable combined registration for SSPR and Microsoft Entra ID Multi-Factor Authentication.

Answer

Configure a Conditional Access policy requiring MFA registration for SSPR.

Answer

Set the 'Number of questions required to register' to 2 in the security questions settings.

Question 17

Your company recently deployed Microsoft 365 Copilot. Users report that Copilot occasionally generates responses based on sensitive internal documents that should not be shared broadly. What should you configure to restrict Copilot's access?

Accepted Answer

Apply sensitivity labels to the documents and configure label scopes to exclude Copilot.. Option C is correct because sensitivity labels can be configured with a label scope that excludes Copilot from accessing the labeled content. By applying a 'Confidential' sensitivity label with the 'Copilot' scope deselected, you instruct Microsoft 365 Copilot to ignore those documents during response generation, preventing it from surfacing sensitive internal information.

Answer

Create Data Loss Prevention (DLP) policies to block sharing.

Answer

Remove the sensitive documents from SharePoint Online.

Answer

Configure Microsoft Search to exclude the sensitive documents.

Question 18

Your organization uses Microsoft 365 E5 licenses. You need to implement a solution to protect against ransomware attacks. Which TWO features should you configure?

Accepted Answer

Configure Microsoft Defender for Office 365 policies.. Option C is correct because Microsoft Defender for Office 365 includes anti-phishing, anti-spam, anti-malware, and Safe Attachments/Safe Links policies that directly block ransomware delivery vectors such as malicious email attachments and URLs. Option D is correct because Microsoft Defender for Cloud Apps provides visibility into cloud app usage, anomaly detection, and the ability to apply session policies (e.g., block download of sensitive files) to prevent ransomware from exfiltrating or encrypting data stored in SaaS apps.

Answer

Enable Microsoft Entra ID Protection.

Answer

Implement Microsoft Purview Information Protection.

Answer

Use Microsoft Intune to enforce device compliance.

Question 19

Your organization needs to manage guest access to Microsoft Teams. Which TWO methods can you use to control guest access?

Accepted Answer

Enable guest access in the Teams admin center.. Option C is correct because enabling guest access in the Teams admin center is a required step to allow guest users to join Teams. Without this toggle enabled, guest access is blocked at the Teams level regardless of other settings. This setting works in conjunction with Microsoft Entra ID external collaboration settings to control guest access.

Answer

Use sensitivity labels to restrict guest access.

Answer

Configure SharePoint Online external sharing settings.

Answer

Set conditional access policies for guest users.

Question 20

Your organization uses Microsoft Entra ID. You want to enforce Multi-Factor Authentication (MFA) for all users. You have already configured Conditional Access policies. However, some users are still able to sign in without MFA. What should you check first?

Accepted Answer

Confirm that all users are included in the policy's user assignment.. Option C is correct because the most common reason a Conditional Access policy fails to enforce MFA is that not all users are included in the policy's user assignment. If the policy targets only a subset of users (e.g., a test group), users outside that scope will bypass MFA entirely. The first troubleshooting step is to verify that the policy's 'Users and groups' assignment includes 'All users' or the specific groups covering all users.

Answer

Ensure all users have registered for MFA.

Answer

Verify that the Conditional Access policy is enabled.

Answer

Check if there are any exclusions configured.