MS-102 Practice Exam 56 — 20 Questions

Question 1

Your company is migrating from on-premises Exchange to Exchange Online. You have configured a hybrid deployment. During testing, you notice that free/busy information is not being shared between on-premises and cloud users. All other hybrid features work. What is the most likely cause?

Accepted Answer

The organization relationship between the on-premises and cloud tenants is missing or misconfigured.. The organization relationship defines the trust and sharing settings between on-premises Exchange and Exchange Online tenants, specifically for free/busy information. Since all other hybrid features (e.g., mail flow, mailbox moves) work, the issue is isolated to the organization relationship, which must be configured on both sides to enable cross-premises calendar availability queries.

Answer

Azure AD Connect has not been configured with the correct synchronization scope.

Answer

The on-premises firewall is blocking traffic to the Exchange Online endpoints.

Answer

OAuth authentication is not configured between on-premises and Exchange Online.

Question 2

Your organization uses Microsoft 365 Defender for Office 365. You need to ensure that phishing emails reported by users are automatically submitted for analysis in Microsoft Defender XDR. What should you configure?

Accepted Answer

Configure the User-reported messages settings in the Microsoft 365 Defender portal.. The User-reported messages settings in the Microsoft 365 Defender portal allow you to configure how user-reported phishing emails are handled. By enabling automatic submission to Microsoft for analysis, you ensure that reported messages are sent directly to the Microsoft security team for threat intelligence and policy tuning. This is the correct setting because it specifically controls the submission behavior for user-reported messages in Defender for Office 365.

Answer

Modify the anti-phishing policy to include user-reported submissions.

Answer

Use the Attack simulation training to collect user reports.

Answer

Enable Safe Attachments policy to automatically submit reported messages.

Question 3

Your company is using Microsoft 365 Business Premium. You want to ensure that all company-owned Windows 10 devices are automatically upgraded to Windows 11 when it becomes available through Windows Update. What should you configure?

Accepted Answer

Create a feature update policy for Windows 10 devices in Intune, targeting the Windows 11 version.. A feature update policy in Intune is specifically designed to upgrade Windows devices from one version to another, such as from Windows 10 to Windows 11. By targeting the Windows 11 version in this policy, you ensure that eligible Windows 10 devices automatically receive the upgrade when it becomes available via Windows Update. This is the correct mechanism for controlling OS version upgrades in a Microsoft 365 Business Premium environment.

Answer

Create a Windows 10 update ring policy in Intune that deploys quality updates.

Answer

Create a device compliance policy in Intune that requires Windows 11.

Answer

Configure a Windows 11 readiness assessment in Microsoft Intune.

Question 4

Your organization is deploying Microsoft 365 Copilot. You need to ensure that data security is maintained. Which THREE actions should you take?

Accepted Answer

Enable audit logging in Microsoft 365.. Option C is correct because enabling audit logging in Microsoft 365 is essential for tracking user interactions with Microsoft 365 Copilot, including prompts, responses, and data access events. This provides a forensic trail to detect unauthorized data exposure or misuse, which is a foundational requirement for maintaining data security in AI-powered workloads.

Answer

Disable Microsoft 365 Copilot for all users.

Answer

Block all external sharing for SharePoint and OneDrive.

Question 5

You run the PowerShell command shown in the exhibit for a Microsoft 365 tenant. The output shows DisplayName as 'Contoso', DefaultDomainName as 'contoso.onmicrosoft.com', and InitialDomain as 'contoso.onmicrosoft.com'. What does this indicate about the tenant?

Accepted Answer

The tenant is using the initial .onmicrosoft.com domain as the default domain.. The output shows DefaultDomainName and InitialDomain both set to 'contoso.onmicrosoft.com', which means the tenant is using its initial Microsoft-provided domain as the default domain. The Get-MgDomain cmdlet retrieves domain objects, and the DefaultDomainName property indicates which domain is used by default for new users and services. Since no custom domain is set as default, the initial .onmicrosoft.com domain remains the default.

Answer

The command requires global admin privileges.

Answer

The tenant has not been verified.

Answer

The tenant has a custom domain set as the default.

Question 6

You are reviewing an ARM template that will be used to deploy a storage account for a Microsoft 365 migration project. The template includes 'supportsHttpsTrafficOnly': true. What is the primary benefit of this setting?

Accepted Answer

It enforces secure transfer (HTTPS) for all requests to the storage account.. Setting 'supportsHttpsTrafficOnly' to true enforces secure transfer by requiring all requests to the storage account to use HTTPS (TLS). This ensures data in transit is encrypted, protecting against man-in-the-middle attacks and eavesdropping. It is a critical security control for compliance with standards like PCI-DSS and HIPAA.

Answer

It reduces latency by enabling CDN integration.

Answer

It enables geo-redundant storage.

Answer

It minimizes storage costs by reducing bandwidth usage.

Question 7

Your organization is planning to migrate from on-premises Active Directory to Microsoft Entra ID using Azure AD Connect. You need to ensure that password synchronization is enabled. Which TWO components are required for password synchronization to work?

Accepted Answer

Azure AD Connect with password hash synchronization selected.. Option A is correct because Azure AD Connect with password hash synchronization (PHS) selected is the component that hashes the on-premises Active Directory password and synchronizes it to Microsoft Entra ID. Option E is correct because the Microsoft Entra ID service must process the incoming password hashes and store them in the cloud directory, enabling authentication against Entra ID. Without both the local sync engine (Azure AD Connect) and the cloud-side service, password synchronization cannot function.

Answer

Active Directory Federation Services (AD FS).

Answer

Password Writeback enabled.

Answer

Microsoft Identity Manager (MIM).

Question 8

An administrator runs the PowerShell command shown in the exhibit. What is the immediate effect on the user?

Accepted Answer

The user is blocked from signing in immediately.. The PowerShell command `Set-MgUser -UserId user@domain.com -BlockCredential $true` immediately blocks the user from signing in by setting the `BlockCredential` property to true. This prevents any new authentication attempts, effectively locking the account without changing the password or deleting the user.

Answer

The user is disabled after 90 days of inactivity.

Answer

The user is deleted after 90 days of inactivity.

Answer

The user's password is reset.

Question 9

Your organization uses Microsoft Entra ID and wants to implement Identity Protection to detect risky users. Which THREE risk types can be detected by Identity Protection? (Choose three.)

Accepted Answer

Impossible travel. Impossible travel is a risk detection in Microsoft Entra ID Identity Protection that identifies sign-ins originating from geographically distant locations within a time frame that makes physical travel between them impossible. This detection uses the user's previous sign-in locations and the time between sign-ins to calculate the probability of a compromised account being used from a different region.

Answer

Password spray

Answer

Malware

Question 10

Your organization has a hybrid identity setup with Azure AD Connect. You need to ensure that users can reset their passwords from the cloud and have the changes synchronized back to on-premises Active Directory. Which feature must you enable?

Accepted Answer

Password writeback.. Password writeback is the Azure AD Connect feature that enables password changes performed in the cloud (e.g., via Azure AD SSPR) to be written back to on-premises Active Directory. This ensures the on-premises password stays synchronized with the cloud, which is required for hybrid identity scenarios where users reset passwords from the cloud.

Answer

Seamless single sign-on.

Answer

Pass-through authentication.

Answer

Password hash synchronization.

Question 11

Your organization uses Microsoft 365 and wants to ensure that only compliant devices can access Exchange Online. You have Microsoft Intune for device management. What should you configure?

Accepted Answer

Create a Conditional Access policy with 'Require device to be marked as compliant'. To enforce that only compliant devices can access Exchange Online, you need a Conditional Access policy that includes the 'Require device to be marked as compliant' grant control. This policy evaluates the device compliance status reported by Intune and blocks or grants access accordingly. Without this Conditional Access policy, even compliant devices are not forced to meet compliance requirements before accessing Exchange Online.

Answer

Configure devices to be Azure AD Joined

Answer

Create an app protection policy in Intune

Answer

Create a device compliance policy in Intune

Question 12

Your Microsoft 365 tenant contains sensitive financial data that must be retained for 7 years. You configure a retention policy in Microsoft Purview compliance portal. After 7 years, the data is still accessible to users. What is the most likely reason?

Accepted Answer

The retention policy does not include a deletion action.. Option A is correct because a retention policy in Microsoft Purview can be configured to only retain data without a deletion action. If the policy lacks a deletion action, data will be preserved for the specified period but will not be automatically removed after that period expires, leaving it accessible to users. The scenario describes data still being accessible after 7 years, which directly indicates that no deletion action was configured to remove the data at the end of the retention period.

Answer

A litigation hold is applied to the data.

Answer

The retention policy is configured to retain data for 7 years and then delete it.

Answer

The data is marked as a record and requires disposition review.

Question 13

Your organization uses Microsoft Purview to enforce data loss prevention (DLP) policies. You need to block users from sharing credit card numbers via email. Which THREE components are required to implement this policy?

Accepted Answer

The built-in 'Credit Card Number' sensitive info type.. The built-in 'Credit Card Number' sensitive info type is required because Microsoft Purview DLP policies rely on predefined or custom sensitive information types to detect specific data patterns, such as credit card numbers, using regular expressions and checksums. Without this type, the DLP policy would not know what content to scan for in emails.

Answer

Microsoft Defender for Cloud Apps.

Answer

Microsoft Entra ID P2 licenses.

Question 14

Your organization has a Microsoft 365 tenant with 5,000 users. You need to plan for tenant migration from an on-premises Exchange environment. You have a limited maintenance window and want to minimize user impact. Which approach should you recommend?

Accepted Answer

Perform a staged migration.. A staged migration is the best choice because it allows you to move mailboxes in batches over a limited maintenance window, minimizing user impact by keeping the majority of users on-premises until their specific batch is migrated. This approach supports up to 2,000 mailboxes per batch and requires a cutover period of only a few hours per batch, making it ideal for an organization with 5,000 users where a single cutover window is not feasible.

Answer

Perform an IMAP migration.

Answer

Perform a cutover migration.

Answer

Use a hybrid configuration.

Question 15

Your company uses Microsoft Defender for Endpoint and wants to perform a live response on a device. Which THREE prerequisites must be met?

Accepted Answer

The user must be assigned a role that includes live response permissions. Option A is correct because live response in Microsoft Defender for Endpoint requires the user to be assigned a role that includes specific live response permissions, such as 'Live response' or 'Live response advanced' under the Microsoft 365 Defender role-based access control (RBAC). Without these permissions, the user cannot initiate a live response session, regardless of other configurations.

Answer

The device must be managed by Microsoft Intune

Answer

The device must have Microsoft Defender Antivirus as the primary antivirus solution

Question 16

Your company is deploying Microsoft Copilot for Microsoft 365. You need to ensure that only users who have completed a specific training course can use Copilot. What should you configure?

Accepted Answer

Create a Conditional Access policy that requires a custom attribute indicating training completion. Option C is correct because a Conditional Access policy can evaluate a custom security attribute assigned to a user or group to enforce access controls. By requiring a custom attribute that indicates training completion, you can block or grant access to Copilot for Microsoft 365 based on that attribute. This approach integrates directly with Microsoft Entra ID's policy engine, allowing granular, attribute-based access control without relying on license assignment or user acceptance.

Answer

Use Terms of Use to require acceptance of training policy

Answer

Configure Authentication strengths to require training certificate

Answer

Assign Copilot licenses only to users who completed training

Question 17

A company has Microsoft Entra ID P2 licenses. They need to implement a conditional access policy that requires multifactor authentication (MFA) when accessing the Microsoft Entra admin center from a non-compliant device. However, they want to allow access from compliant devices without MFA. What is the best approach?

Accepted Answer

Create two conditional access policies: one for compliant devices requiring only compliant device, and one for non-compliant devices requiring MFA and compliant device. Option C is correct because the requirement is to allow access from compliant devices without MFA while requiring MFA from non-compliant devices. This conditional logic cannot be achieved in a single policy with a single grant block because 'Require compliant device' and 'Require multifactor authentication' are both satisfied by compliant devices (which are already compliant), but you need to differentiate behavior based on device compliance state. By creating two policies—one targeting compliant devices with only 'Require compliant device' as a grant, and another targeting non-compliant devices with both 'Require compliant device' and 'Require multifactor authentication'—you can enforce different access requirements based on the device's compliance status.

Answer

Create one conditional access policy with a grant control that combines 'Require compliant device' and 'Require multifactor authentication' as a single control

Answer

Create one conditional access policy with grant controls set to 'Require one of the selected controls' and select both 'Require compliant device' and 'Require multifactor authentication'

Answer

Create one conditional access policy with grant controls set to 'Require all the selected controls' and select both 'Require compliant device' and 'Require multifactor authentication', and include all devices

Question 18

You are configuring Microsoft Entra ID for a new organization. You need to ensure that users can self-service reset their passwords. Which licensing is required?

Accepted Answer

Microsoft Entra ID P1. Microsoft Entra ID P1 includes the Self-Service Password Reset (SSPR) feature, which allows users to reset their own passwords without administrator intervention. This licensing tier provides the necessary Azure AD Premium P1 capabilities, such as group-based licensing and conditional access, that underpin SSPR. Entra ID Free does not include SSPR, and Entra ID P2, while also including SSPR, is not required for this functionality.

Answer

Microsoft Entra ID Free

Answer

Microsoft Entra ID P2

Answer

Microsoft 365 Business Basic

Question 19

A user reports that they cannot access their Microsoft 365 mailbox via Outlook on the web. Other users can access their mailboxes. What is the most likely cause?

Accepted Answer

The user does not have an Exchange Online license assigned. The most likely cause is that the user does not have an Exchange Online license assigned. Without a valid license, the user's mailbox is not provisioned, and Outlook on the Web (OWA) cannot access it. Other users can access their mailboxes because they have licenses, ruling out a service-wide issue.

Answer

The user's password has expired

Answer

The Exchange Online service is experiencing an outage

Answer

The user's browser cache needs to be cleared

Question 20

Your Microsoft 365 tenant has been configured with Microsoft Entra ID Connect synchronization from on-premises Active Directory. Users are unable to log in to Microsoft 365 services. You check the synchronization status and see that the last sync was successful. What is the most likely cause?

Accepted Answer

The user principal name (UPN) suffix for users is not a verified domain in Microsoft Entra ID.. The most likely cause is that the UPN suffix for users is not a verified domain in Microsoft Entra ID. Even though password hash synchronization is enabled and the last sync was successful, if the UPN suffix (e.g., @contoso.local) does not match a custom domain verified in Entra ID, users cannot sign in because Entra ID cannot route authentication to the correct tenant. The sync process will complete without error, but login fails because the UPN is not recognized as a valid domain in the cloud.

Answer

The firewall is blocking authentication requests to Microsoft 365.

Answer

The on-premises Active Directory is not reachable from the sync server.

Answer

Password hash synchronization is disabled.