MS-102 Practice Exam 55 — 20 Questions

Question 1

You are deploying a new Microsoft 365 tenant for a company that has a single domain, contoso.com. You need to verify domain ownership to enable email routing. Which DNS record type must you add to the public DNS zone?

Accepted Answer

TXT record with a verification code provided by Microsoft 365.. To verify domain ownership in Microsoft 365, you must add a TXT record containing a unique verification code provided by the Microsoft 365 admin center to your public DNS zone. This proves you control the domain, enabling email routing and other services. Other DNS records like CNAME, SPF, or MX are used for service configuration, not ownership verification.

Answer

CNAME record with 'autodiscover' pointing to 'autodiscover.outlook.com'.

Answer

SPF record including Microsoft 365 IP addresses.

Answer

MX record pointing to Microsoft 365.

Question 2

Your organization uses Microsoft 365 E5 licenses. You need to implement a secure score improvement plan. After reviewing the Secure Score, you notice a recommendation to 'Enable sign-in risk policy' in Microsoft Entra ID. However, you want to ensure that users who sign in from trusted locations are not challenged. What should you configure?

Accepted Answer

Create a conditional access policy that targets sign-in risk: medium and above, require MFA, and exclude trusted named locations.. Option D is correct because it creates a Conditional Access policy that targets sign-in risk at medium and above, requiring MFA, while excluding trusted named locations. This ensures users from trusted IPs are not challenged, directly addressing the requirement to avoid unnecessary prompts for trusted sign-ins while still enforcing risk-based policies.

Answer

Configure named locations in Microsoft Entra ID for trusted IPs.

Answer

Enable the 'Sign-in risk' policy in Identity Protection and set 'Exclude trusted locations'.

Answer

Enable the 'Require MFA for all users' conditional access policy.

Question 3

Your organization wants to use Microsoft Defender for Office 365 to protect against malicious links and attachments in email. Which Defender plan is required?

Accepted Answer

Microsoft Defender for Office 365 Plan 1.. Microsoft Defender for Office 365 Plan 1 includes Safe Links and Safe Attachments, which are the specific features required to protect against malicious links and attachments in email. These features scan URLs and attachments in real time to block malicious content before it reaches users.

Answer

Exchange Online Protection.

Answer

Microsoft Defender for Endpoint.

Answer

Microsoft Defender for Office 365 Plan 2.

Question 4

Your company is deploying Microsoft Defender for Office 365. The security team wants to automatically remove messages identified as malware from all mailboxes after delivery. What should you configure?

Accepted Answer

Enable Zero-hour auto purge (ZAP) in the anti-malware policy.. Zero-hour auto purge (ZAP) is the correct feature because it automatically detects and removes messages that are identified as malware after they have already been delivered to a user's mailbox. By enabling ZAP in the anti-malware policy, the system retroactively moves malicious messages to the user's Junk Email folder or quarantines them, ensuring post-delivery protection without manual intervention.

Answer

Configure an anti-malware policy with a high-confidence verdict.

Answer

Set up a mailbox intelligence policy.

Answer

Create an anti-phishing policy to block spoofed senders.

Question 5

Your organization is deploying Microsoft 365 and needs to ensure that all new users are automatically assigned a Microsoft 365 Business Basic license. You want to use a group-based licensing strategy with an Azure AD security group. What should you do first?

Accepted Answer

Create a new Azure AD security group and assign the license to the group.. Option D is correct because group-based licensing in Azure AD requires you to first create a security group (which can be cloud-only or synced) and then assign the Microsoft 365 Business Basic license directly to that group. Once the license is assigned to the group, all members automatically receive the license, including new users added to the group. This approach centralizes license management and ensures automatic assignment without manual intervention.

Answer

Configure directory synchronization and create the group in on-premises Active Directory.

Answer

Create a dynamic Azure AD group with a rule for user attributes and enable self-service group management.

Answer

Assign the license directly to each user via the Microsoft 365 admin center.

Question 6

You are a Microsoft 365 administrator. Users report that they cannot access Microsoft Teams. You check the Microsoft 365 admin center and see that the service health for Microsoft Teams shows a 'Service degradation' incident. What is the most appropriate initial action?

Accepted Answer

Review the incident details in the service health dashboard for an estimated resolution time and workaround.. Option C is correct because the most appropriate initial action when a service degradation incident is already visible in the Microsoft 365 admin center is to review the incident details in the service health dashboard. This provides the estimated resolution time, current status, and any available workarounds published by Microsoft, allowing you to inform users and mitigate impact without immediately escalating or opening a support request.

Answer

Contact the Microsoft regional escalation engineer immediately.

Answer

Open a support request with Microsoft to report the outage.

Answer

Restart the Microsoft Teams service on all client machines.

Question 7

An administrator creates a Conditional Access policy as shown in the exhibit. A user reports that they can still access Exchange Online using Outlook (modern authentication). Why does the policy not block the user?

Accepted Answer

The client app type for modern authentication is not specified in the policy.. Option C is correct because the Conditional Access policy does not include the 'Modern authentication clients' client app type. Without this selection, the policy does not apply to modern authentication protocols like OAuth 2.0, which Outlook (modern authentication) uses. The policy only targets the default 'Browser' and 'Mobile apps and desktop clients' categories, but the specific 'Modern authentication clients' toggle must be enabled to enforce controls on apps using modern auth.

Answer

The policy is not assigned to any users or groups.

Answer

The grant control is set to 'Require multi-factor authentication' instead of 'Block'.

Answer

Exchange ActiveSync is not included in the policy.

Question 8

Your company has a Microsoft 365 tenant with a custom domain (contoso.com). You need to verify domain ownership before enabling email routing. Which DNS record type should you add?

Accepted Answer

Add an MX record pointing to contoso-com.mail.protection.outlook.com.. Option C is correct because when you add a custom domain to Microsoft 365 and need to enable email routing, you must prove domain ownership and configure mail flow. The MX record with the value 'contoso-com.mail.protection.outlook.com' is the specific record that Microsoft 365 requires to route incoming email for your domain to Exchange Online. This record is added after domain ownership is verified (usually via a TXT record), but the question asks which record type enables email routing, which is the MX record.

Answer

Add a TXT record with the verification code.

Answer

Add a CNAME record pointing to autodiscover.outlook.com.

Answer

Add an SPF record for contoso.com.

Question 9

Your organization's Microsoft Intune environment enforces device compliance policies for iOS devices. You need to ensure that only devices with a passcode that is at least 6 characters and have jailbreak detection enabled are considered compliant. What should you configure?

Accepted Answer

Create a device compliance policy for iOS with required passcode length and jailbreak detection.. Device compliance policies in Microsoft Intune define the rules that devices must meet to be considered compliant, such as minimum OS version, passcode length, and jailbreak detection. Option D correctly specifies creating a compliance policy for iOS that requires a passcode of at least 6 characters and enables jailbreak detection, which directly enforces the stated requirements. Compliance policies are evaluated before granting access, and non-compliant devices can be blocked or marked for remediation.

Answer

Configure a conditional access policy to require compliant devices.

Answer

Create a device configuration profile for iOS with the required settings.

Answer

Create an app protection policy for iOS to require passcode.

Question 10

Your organization is planning to deploy Microsoft 365 Copilot. You need to ensure that all prerequisites are met. Which of the following is a mandatory prerequisite for enabling Microsoft 365 Copilot?

Accepted Answer

Microsoft Entra ID P2 licenses.. Microsoft Entra ID P2 licenses are mandatory because Microsoft 365 Copilot requires Azure AD P2 (now Entra ID P2) for features like identity protection, privileged identity management, and conditional access policies that govern Copilot's data access and security. Without P2, the tenant cannot enforce the necessary identity-based controls for Copilot's AI-driven data retrieval and summarization.

Answer

Microsoft Purview Data Loss Prevention policies.

Answer

An active Azure subscription.

Answer

Exchange Online Plan 2 licenses.

Question 11

Your organization wants to use Microsoft Intune to manage devices. You need to ensure that only corporate-owned devices can enroll. What configuration should you use?

Accepted Answer

Configure enrollment restrictions to block personally owned devices.. Option B is correct because enrollment restrictions in Microsoft Intune allow you to block personally owned devices by setting the 'Allow personally owned devices' option to 'No' for the platform. This ensures that only corporate-owned devices, which are identified by their corporate enrollment token or IMEI/MEID numbers, can enroll. This is the direct and intended method to restrict enrollment to corporate-owned devices only.

Answer

Use a conditional access policy to require device compliance.

Answer

Set a compliance policy requiring devices to be marked as corporate.

Answer

Create a device type restriction for iOS and Android.

Question 12

You need to ensure that guest users who are invited to your Microsoft Entra ID tenant can access resources without needing to accept an invitation. What should you configure?

Accepted Answer

Enable 'Email one-time passcode for guests' and set 'Allow invitations to be sent to any user' to Yes.. Option D is correct because enabling 'Email one-time passcode for guests' and setting 'Allow invitations to be sent to any user' to Yes allows guest users to redeem an invitation without needing to accept it interactively. This configuration leverages the email one-time passcode (OTP) authentication flow, which bypasses the need for the guest to click an acceptance link, enabling direct resource access after the OTP is verified.

Answer

Configure the 'External collaboration settings' to allow invitations to specific domains only.

Answer

Set the 'Guest invite settings' to 'Anyone in the organization can invite guest users'.

Answer

Set the 'Guest invite settings' to 'Only users assigned to specific admin roles can invite'.

Question 13

Your organization uses Microsoft 365 and has enabled Microsoft Entra ID P2 licenses. You need to configure automatic user provisioning for a third-party SaaS application that supports SCIM 2.0. What should you do first in the Microsoft Entra admin center?

Accepted Answer

Add the application from the gallery, then configure provisioning.. To configure automatic user provisioning for a third-party SaaS application that supports SCIM 2.0, you must first add the application from the Microsoft Entra gallery. This action creates an enterprise application object in your tenant, which is required to access the provisioning configuration blade. Only after adding the gallery application can you configure the provisioning settings, including the SCIM endpoint URL and token, to enable automated user lifecycle management.

Answer

Configure provisioning in 'App registrations'.

Answer

Navigate to 'Enterprise applications' and create a new application.

Answer

Use the 'App registrations' blade to register the app.

Question 14

Which TWO actions are required to enable Microsoft 365 Copilot for your organization?

Accepted Answer

Ensure users have a Microsoft 365 E3 or E5 license with the Copilot add-on.. Microsoft 365 Copilot requires users to have a qualifying license such as Microsoft 365 E3 or E5, plus the Copilot add-on license. Without this specific licensing, the Copilot features cannot be activated or used within the tenant.

Answer

Deploy a third-party AI gateway.

Answer

Assign the Global Administrator role to all users.

Answer

Disable legacy authentication protocols.

Question 15

Your organization uses Microsoft 365 E5 licenses for all users. You need to configure role-based access control (RBAC) so that helpdesk staff can reset passwords and manage licenses, but cannot modify user principal names (UPNs) or delete users. Which role assignment should you use?

Accepted Answer

Helpdesk Administrator. The Helpdesk Administrator role is correct because it grants the specific permissions needed to reset passwords and manage licenses, while explicitly preventing modifications to user principal names (UPNs) and user deletions. This role is designed for tier-1 support staff who require these capabilities without elevated user management rights.

Answer

License Administrator

Answer

Password Administrator

Answer

User Administrator

Question 16

You are reviewing a conditional access policy in Microsoft Entra ID. The policy is intended to block legacy authentication. However, users are still able to connect using Exchange ActiveSync without modern authentication. What is the most likely reason?

Accepted Answer

The policy does not include the 'All' client apps condition; it only includes specific client app types.. Option A is correct because Conditional Access policies that block legacy authentication must include the 'All' client apps condition to cover Exchange ActiveSync (EAS). If the policy only targets specific client app types (e.g., browser or mobile apps and desktop clients) but omits 'All', EAS traffic using legacy authentication bypasses the policy. EAS is a separate client app type that requires explicit inclusion via the 'All' option to enforce blocking.

Answer

The policy is not assigned to the affected users.

Answer

The grant control 'Block' is not supported for legacy authentication.

Answer

The policy is in report-only mode.

Question 17

You are configuring Microsoft Purview for your organization. You need to ensure that all external emails are automatically tagged with an 'External' label in the subject line. Which feature should you configure?

Accepted Answer

Mail flow rule (transport rule) to prepend '[External]' to subject lines.. To automatically prepend a text tag like '[External]' to the subject line of all incoming external emails, you must use a Mail flow rule (also known as a transport rule) in Exchange Online. This rule can be configured with the condition 'The sender is located outside the organization' and the action 'Prepend the subject line with the string [External]'. This is the only mechanism that directly modifies the subject line of emails in transit.

Answer

Anti-phishing policy in Defender for Office 365.

Answer

Sensitivity label policy to automatically apply an 'External' label.

Answer

Data loss prevention (DLP) policy for external emails.

Question 18

Your company uses Microsoft 365 and has recently deployed Microsoft Intune for mobile device management. You need to ensure that corporate data on iOS devices is protected by preventing users from copying data from managed apps to unmanaged apps. What should you configure?

Accepted Answer

App protection policies.. App protection policies (APP) are the correct choice because they provide mobile application management (MAM) controls that specifically prevent data transfer between managed and unmanaged apps on iOS devices. Unlike device-level policies, APP operates at the application layer, allowing you to restrict copy/paste, cut, and data sharing actions without requiring device enrollment. This directly addresses the requirement to protect corporate data on iOS devices by blocking data leakage to unmanaged apps.

Answer

Mobile application management (MAM) without enrollment.

Answer

Device compliance policies.

Answer

Conditional Access policies.

Question 19

Your organization uses Microsoft Defender for Office 365. You need to configure a policy that automatically redirects emails containing malicious attachments to a quarantine folder for admin review. What type of policy should you create?

Accepted Answer

Anti-malware policy.. B is correct because the Anti-malware policy in Microsoft Defender for Office 365 is specifically designed to handle malware detected in email messages, including attachments. When configured, it can automatically redirect messages containing malicious attachments to a quarantine folder for admin review, providing a controlled remediation workflow.

Answer

Safe Attachments policy.

Answer

Anti-spam policy.

Answer

Safe Links policy.

Question 20

You need to ensure that all users in your Microsoft 365 tenant are automatically enrolled in Microsoft Intune when they sign up for Microsoft 365. You want to use the default enrollment policy. What should you do?

Accepted Answer

Set the MDM authority to Microsoft Intune and configure automatic MDM enrollment via Azure AD.. Option A is correct because setting the MDM authority to Microsoft Intune and configuring automatic MDM enrollment via Azure AD enables the default enrollment policy. This ensures that when users sign up for Microsoft 365, they are automatically enrolled in Intune without manual intervention, leveraging Azure AD's built-in MDM enrollment integration.

Answer

Create a conditional access policy that requires device compliance and block access if not enrolled.

Answer

Configure a PowerShell script to run daily that adds all users to Intune.

Answer

Ensure that the Microsoft Intune license is assigned to each user and enable the 'Enroll automatically' setting in the Microsoft 365 admin center.