MS-102 Practice Exam 57 — 20 Questions

Question 1

Refer to the exhibit. You are reviewing the service principal for Microsoft Graph in your tenant. The passwordCredentials array is empty. What does this indicate?

Accepted Answer

No client secret is configured for the service principal.. The passwordCredentials array being empty indicates that no client secret (password) has been configured for the service principal. Client secrets are one method of authentication for service principals, and their absence means that this particular authentication method is not set up. This does not imply the service principal is disabled or that other authentication methods like certificates or federated credentials are in use.

Answer

The service principal is using federated credentials.

Answer

The service principal uses certificate-based authentication.

Answer

The Microsoft Graph application is disabled.

Question 2

The exhibit shows a DLP policy configuration. A user reports that they cannot share a document containing a credit card number from OneDrive for Business. However, the document was shared successfully last week. What is the most likely reason for the change?

Accepted Answer

The DLP policy was recently deployed or updated.. The most likely reason is that the DLP policy was recently deployed or updated. DLP policies in Microsoft 365 are evaluated in near real-time, and a newly deployed or modified policy will immediately enforce its rules on content sharing. Since the document was shared successfully last week, the policy change is the most plausible cause for the sudden block.

Answer

The DLP policy requires administrator override for sharing.

Answer

The DLP policy is applied only to SharePoint Online, not OneDrive.

Answer

The DLP policy does not include Microsoft Teams.

Question 3

Your organization uses Microsoft 365 Business Premium. You need to ensure that when a user is assigned an Intune license, the device automatically enrolls in Microsoft Intune. What should you configure?

Accepted Answer

Configure Microsoft Entra ID device settings to enable MDM automatic enrollment. Microsoft Entra ID (formerly Azure AD) device settings include an option to enable automatic MDM enrollment for users assigned an Intune license. When enabled, any device that signs in with a licensed user account will automatically enroll in Microsoft Intune, satisfying the requirement without additional configuration.

Answer

Create a device compliance policy to require enrollment

Answer

Create a device enrollment restriction in Intune to block personal devices

Answer

Deploy a device configuration profile with enrollment settings

Question 4

Which TWO actions are required to configure a custom domain for your Microsoft 365 tenant?

Accepted Answer

Add the domain name in the Microsoft 365 admin center.. Option D is correct because adding the custom domain name in the Microsoft 365 admin center is the first step to register the domain with the tenant. Option E is correct because Microsoft requires you to prove ownership of the domain by adding a specific TXT record (or sometimes a CNAME or MX record) to the public DNS zone; this verification step ensures only the domain owner can configure it for the tenant.

Answer

Add an SPF TXT record in the public DNS zone.

Answer

Add a CNAME record for autodiscover.

Answer

Add an MX record in the public DNS zone.

Question 5

Refer to the exhibit. You have a Conditional Access policy configured as shown. What is the effect of this policy?

Accepted Answer

It blocks access from trusted IP addresses.. The policy is configured to 'Block access' for 'All users' and 'All cloud apps' when the location condition is set to 'Trusted IPs'. This means that when a user attempts to access from an IP address defined as trusted in the organization's named locations, access is explicitly blocked. The effect is that trusted IP addresses are blocked, not untrusted ones.

Answer

It requires multi-factor authentication for trusted IPs.

Answer

It blocks access from all locations.

Answer

It blocks access from untrusted IP addresses.

Question 6

Which TWO are valid methods to add users to a Microsoft 365 tenant?

Accepted Answer

Add users individually in the Microsoft 365 admin center.. Option D is correct because the Microsoft 365 admin center provides a native web interface to add users individually, which is the most straightforward method for small-scale user provisioning. Option E is correct because synchronizing users from on-premises Active Directory using Microsoft Entra ID Connect (formerly Azure AD Connect) is the standard hybrid identity method for large-scale user management, ensuring directory objects are replicated to Azure AD.

Answer

Create users by adding a DNS record.

Answer

Add users in the Azure portal.

Answer

Create users in the Exchange admin center.

Question 7

The exhibit shows the output of a PowerShell command for a user. The user reports that they cannot access Microsoft Teams, although they have an E3 license (ENTERPRISEPACK). What is the most likely cause?

Accepted Answer

The Teams service plan is disabled in the user's license.. The PowerShell output shows the user has an E3 license (ENTERPRISEPACK) assigned, but the Teams service plan is disabled. Even with an active E3 license, if the Teams service plan is explicitly turned off in the license assignment, the user cannot access Microsoft Teams. This is a common configuration where an admin disables specific service plans to control feature access.

Answer

The user's license is suspended.

Answer

The user's license has expired.

Answer

The user does not have a license assigned.

Question 8

Your company is deploying Microsoft 365 for a new subsidiary with 500 users. You need to configure the initial tenant with a custom domain (contoso.com) and verify ownership. What is the first step you must perform?

Accepted Answer

Add a TXT record provided by Microsoft 365 to the contoso.com DNS zone.. To verify ownership of a custom domain in Microsoft 365, you must prove you control the domain's DNS zone. Microsoft provides a unique TXT record value that you add to the public DNS zone of contoso.com. Once the TXT record propagates, Microsoft queries it and confirms ownership, allowing you to proceed with domain configuration.

Answer

Delegate the contoso.com zone to Microsoft 365 DNS servers.

Answer

Create user accounts with the custom domain before verification.

Answer

Set contoso.com as the default domain in the Microsoft 365 admin center.

Question 9

The exhibit shows a KQL query used in Microsoft 365 Defender. The query returns no results for admin@contoso.com. What is the most likely reason?

Accepted Answer

Microsoft Defender for Identity is not enabled for the tenant.. The KQL query uses the `IdentityLogonEvents` table, which is populated by Microsoft Defender for Identity (MDI). If MDI is not enabled for the tenant, this table contains no data, so the query returns no results regardless of the user's role or query syntax. The query itself is syntactically correct and the role name 'GlobalAdministrator' is valid, but without MDI being provisioned, the table is empty.

Answer

The user does not have the Global Administrator role.

Answer

The KQL query syntax is invalid.

Answer

The role name in the query is misspelled.

Question 10

You need to delegate the ability to reset user passwords in Microsoft Entra ID to a helpdesk team. However, they should not be able to modify other user attributes. What role should you assign?

Accepted Answer

Helpdesk Administrator. The Helpdesk Administrator role is specifically designed to allow password resets and force password changes for non-administrator users and other helpdesk administrators, while explicitly preventing modifications to other user attributes like group membership or profile details. This role provides the least privilege necessary for the helpdesk team's task, aligning with the principle of role-based access control (RBAC) in Microsoft Entra ID.

Answer

User Administrator

Answer

Global Administrator

Answer

Password Administrator

Question 11

Your organization uses Microsoft 365 and wants to implement a passwordless authentication strategy. Which TWO methods are supported natively in Microsoft Entra ID for passwordless sign-in?

Accepted Answer

Microsoft Authenticator app (phone sign-in). The Microsoft Authenticator app (phone sign-in) is a native passwordless method in Microsoft Entra ID that uses key-based authentication tied to the user's device. It allows users to sign in by approving a notification or entering a number displayed on the screen, eliminating the need for a password. This method is fully integrated into Entra ID's authentication stack and supports both iOS and Android devices.

Answer

Smart cards (physical or virtual)

Answer

Temporary Access Pass

Answer

Certificate-based authentication

Question 12

You need to ensure that all Microsoft 365 users in your organization have a consistent password policy that requires passwords to be at least 12 characters and include complexity requirements. What should you configure?

Accepted Answer

Password policy in Microsoft Entra ID. Microsoft Entra ID (formerly Azure AD) is the identity service that enforces tenant-wide password policies for cloud-only user accounts. Configuring the password policy in Entra ID allows you to set minimum length (e.g., 12 characters) and complexity requirements (e.g., must include uppercase, lowercase, digits, and special characters) that apply to all Microsoft 365 users. This is the correct location because Entra ID is the authoritative source for authentication policies in a Microsoft 365 tenant.

Answer

Device compliance policy in Microsoft Intune

Answer

Outlook on the web mailbox policy

Answer

Data loss prevention policy in Microsoft Purview

Question 13

You need to configure Microsoft Purview Data Loss Prevention (DLP) to prevent sensitive data from being shared via email. Which THREE elements can you use to define the policy?

Accepted Answer

Actions. Actions are a required element in a Microsoft Purview DLP policy because they define what happens when sensitive data is detected—such as blocking the email, sending a notification, or applying encryption. Without specifying actions, the policy would have no enforcement mechanism to prevent data sharing.

Answer

Sensitivity labels

Answer

Exceptions

Question 14

Your company is planning to adopt Microsoft Copilot for Microsoft 365. The security team is concerned about data leakage. What must you implement to ensure that Copilot respects your organization's sensitivity labels and data classification?

Accepted Answer

Deploy Microsoft Purview Information Protection with sensitivity labels. Microsoft Purview Information Protection with sensitivity labels is the correct answer because Copilot for Microsoft 365 uses these labels to enforce data governance at the content level. When a sensitivity label is applied to a document or email, Copilot respects that label's encryption, marking, and access restrictions, preventing the model from generating responses that leak classified data. This is the foundational mechanism for ensuring Copilot adheres to your organization's data classification policies.

Answer

Use Microsoft Defender for Cloud Apps to control Copilot

Answer

Configure Data Loss Prevention (DLP) policies

Answer

Enable Customer Lockbox

Question 15

Refer to the exhibit. You are reviewing a Microsoft Entra ID Governance access review. The JSON shows an access review scope for a SharePoint site. What does the 'isExternallyAccessible': false setting indicate about the site?

Accepted Answer

External users cannot access the site.. The 'isExternallyAccessible': false setting in the access review scope JSON indicates that the SharePoint site is not configured to allow external sharing. This means external users cannot access the site, making option B correct. The setting directly controls whether the site is visible to external identities in the access review, not the review process itself.

Answer

The site's external sharing settings are not reviewed.

Answer

The site is configured to allow sharing with anyone.

Answer

External users are automatically granted access.

Question 16

Your organization has a Microsoft 365 E5 tenant with 10,000 users. You need to ensure that when a user is detected as high-risk by Microsoft Entra ID Protection, the user is automatically blocked from accessing sensitive SharePoint sites. The solution should minimize administrative overhead. What should you do?

Accepted Answer

Create a Conditional Access policy targeting high-risk users, apply to SharePoint, and set 'Block access' or 'Use app enforced restrictions'.. Option A is correct because a Conditional Access (CA) policy can directly target 'High risk' users (via Microsoft Entra ID Protection risk detection) and apply to SharePoint. By setting the grant control to 'Block access' or 'Use app enforced restrictions', you automatically block or restrict access to sensitive SharePoint sites without manual intervention, minimizing administrative overhead. This integrates natively with Microsoft 365 and requires no additional services or custom scripting.

Answer

Create a session policy in Microsoft Defender for Cloud Apps to block high-risk users from accessing SharePoint.

Answer

Configure a user risk policy in Microsoft Entra ID Protection to block sign-ins for high-risk users.

Answer

Deploy Microsoft Sentinel and create a custom analytics rule to trigger an automated response via Logic App.

Question 17

A company has recently acquired a smaller organization and needs to consolidate both Microsoft 365 tenants. They want to minimize user disruption and retain existing email addresses. Which approach should they use?

Accepted Answer

Perform a cross-tenant mailbox migration. Option B is correct because cross-tenant mailbox migration allows you to move mailboxes between two Microsoft 365 tenants while preserving the users' existing email addresses and minimizing disruption. This approach uses the Microsoft 365 native migration capabilities, specifically the cross-tenant mailbox migration feature, which supports moving mailboxes with their primary SMTP addresses and associated data without requiring on-premises Exchange Server.

Answer

Configure a hybrid deployment with Exchange Server

Answer

Delete all users from the acquired tenant and recreate them in the parent tenant

Answer

Set up a federation trust between the tenants

Question 18

Refer to the exhibit. An administrator runs the KQL query in Microsoft Defender for Endpoint. The result set is empty. What is the most likely reason?

Accepted Answer

No logon events with the account name 'admin' exist in the past 7 days.. The KQL query filters for logon events where the AccountName equals 'admin' (lowercase). If no such events occurred in the last 7 days, the result set will be empty. This is the most likely reason because the query explicitly restricts the time range and account name, and an empty result does not indicate a broader issue with onboarding or case sensitivity.

Answer

The device is not onboarded to Microsoft Defender for Endpoint.

Answer

The query is case-sensitive and the account name is 'Admin' with a capital A.

Answer

There are no logon events in the last 7 days.

Question 19

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP). You need to ensure that sensitive data such as credit card numbers cannot be shared externally via email. Which THREE components should you configure?

Accepted Answer

Define sensitive information types for credit card numbers. A is correct because sensitive information types (SITs) are predefined or custom patterns that detect specific data like credit card numbers (e.g., regex matching major credit card formats). Defining the SIT for credit card numbers allows the DLP policy to identify this sensitive content in emails, which is the first step before any action can be taken.

Answer

Enable Microsoft Purview Insider Risk Management

Answer

Configure a retention policy for email

Question 20

Your Microsoft 365 tenant has 50,000 users. You are planning to migrate mailboxes from on-premises Exchange Server 2019 to Exchange Online using a full hybrid configuration. During the migration, you must ensure that free/busy information is synchronized between on-premises and Exchange Online. Which component is required for free/busy synchronization in a hybrid deployment?

Accepted Answer

Exchange Hybrid Server (or Hybrid Agent). In a full hybrid configuration, free/busy synchronization between on-premises Exchange and Exchange Online is handled by the Exchange Hybrid Server (or the newer Hybrid Agent). This component acts as a bridge, using the Exchange Web Services (EWS) and Autodiscover service to securely relay free/busy data between the two organizations. Without it, the Availability service cannot query the remote forest for calendar information.

Answer

Azure AD Connect

Answer

Exchange Online connector (Outbound to on-premises)

Answer

Hybrid Configuration Wizard

MS-102 Practice Exam 57 — 20 Questions

Exhibit

MS-102 Practice Exam 57 — 20 Questions

Exhibit