MS-102 Practice Exam 59 — 20 Questions

Question 1

Your organization has a Microsoft 365 E5 tenant. You need to set up a shared mailbox for the IT help desk (helpdesk@contoso.com). The help desk team needs to monitor the mailbox and respond to emails. What is the recommended way to grant access to the shared mailbox?

Accepted Answer

Add the help desk users as members of the shared mailbox from the Exchange admin center.. Option C is correct because the recommended method to grant access to a shared mailbox in Exchange Online is to add users as members directly from the Exchange admin center (EAC). This automatically assigns the necessary Full Access and Send As permissions without requiring licenses for each user, as shared mailboxes can be accessed by licensed users without needing a separate license for the mailbox itself.

Answer

Assign an Exchange Online license to each help desk user and grant them Full Access via PowerShell.

Answer

Create a security group and add it to the shared mailbox permissions.

Answer

Create a distribution group containing the help desk users and grant the group access to the mailbox.

Question 2

Your company is deploying Microsoft 365 Copilot for all users. You need to ensure that Copilot responses are grounded only in organizational data that users already have permission to access. Additionally, you must comply with data residency requirements in the European Union. Which THREE actions should you take?

Accepted Answer

Apply sensitivity labels to restrict Copilot from accessing specific files.. Option A is correct because sensitivity labels can be configured to block Copilot from accessing files with specific labels, ensuring that Copilot responses are grounded only in organizational data that users already have permission to access. This is done by using Microsoft Purview Information Protection to define label-based restrictions that Copilot respects, preventing it from surfacing content from labeled files even if the user has direct access.

Answer

Block Copilot for all users outside the EU using conditional access policies.

Answer

Enable Copilot caching in Microsoft Purview to control data storage locations.

Question 3

Your organization uses Microsoft Defender for Identity and has enabled Microsoft Secure Score. You notice that the Secure Score for Identity has dropped significantly after a recent configuration change. Which action is most likely to have caused the decrease?

Accepted Answer

Disabling password hash synchronization in Microsoft Entra Connect.. Disabling password hash synchronization (PHS) in Microsoft Entra Connect removes the ability for Microsoft Defender for Identity to correlate on-premises Active Directory credential exposure events with cloud authentication attempts. Without PHS, Defender for Identity cannot detect when leaked credentials are used against Azure AD, causing the Secure Score for Identity to drop because key detection capabilities are no longer available.

Answer

Changing password expiration policy to 180 days.

Answer

Enabling MFA for all users.

Answer

Implementing a conditional access policy blocking legacy authentication.

Question 4

You are implementing Microsoft Entra Verified ID. Which technology does it use to create decentralized digital identities?

Accepted Answer

Decentralized Identifiers (DIDs). Microsoft Entra Verified ID uses Decentralized Identifiers (DIDs) as the core technology to create decentralized digital identities. DIDs are globally unique identifiers that are cryptographically verifiable and do not rely on a centralized registry, enabling self-sovereign identity scenarios where users control their own identity data.

Answer

OpenID Connect

Answer

OAuth 2.0

Answer

Security Assertion Markup Language (SAML)

Question 5

Which THREE of the following are required to configure Microsoft Entra ID Governance for automated user provisioning to a third-party SaaS application? (Select three.)

Accepted Answer

Assign the access package to a catalog. Option A is correct because access packages must be assigned to a catalog in Microsoft Entra ID Governance to define which resources (like the third-party SaaS application) are available for automated provisioning. The catalog acts as a container that groups related resources and access policies, enabling entitlement management to govern provisioning requests.

Answer

Set up Microsoft Entra Connect Sync for the application

Answer

Migrate from Azure AD Connect to Azure AD Connect cloud sync

Question 6

Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM) to manage administrative roles. You need to ensure that when a user activates the Global Administrator role, they must provide a justification and the activation is time-bound. Additionally, you want to require approval from the security team for this activation. What should you configure?

Accepted Answer

Modify the PIM role settings for Global Administrator to require justification, set maximum activation duration, and require approval. Option D is correct because Privileged Identity Management (PIM) role settings allow you to enforce activation requirements such as justification, maximum activation duration, and approval. These settings are configured directly in the PIM role settings for the Global Administrator role, ensuring that every activation request is justified, time-bound, and requires approval from designated approvers (e.g., the security team).

Answer

Configure an Identity Protection user risk policy for Global Administrators

Answer

Create an Access Review for Global Administrator role

Answer

Configure a Conditional Access policy requiring MFA for Global Administrator activation

Question 7

Your organization is migrating from on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can use their existing on-premises passwords to log in to cloud services, while maintaining password policy enforcement on-premises. Which feature should you implement?

Accepted Answer

Password Hash Synchronization (PHS). Password Hash Synchronization (PHS) synchronizes the hash of on-premises Active Directory user passwords to Microsoft Entra ID, enabling users to log in to cloud services with the same password. It enforces password policies on-premises because the on-premises domain controller remains the authoritative source for password complexity, expiration, and lockout rules. PHS does not require additional infrastructure beyond Azure AD Connect and works even if the on-premises network is temporarily unavailable.

Answer

Pass-through Authentication with Seamless SSO

Answer

Active Directory Federation Services (AD FS)

Answer

Install Azure AD Connect with default settings

Question 8

A multinational company uses Microsoft Entra ID with Conditional Access policies. They have a policy that requires multi-factor authentication (MFA) for all users when accessing the company's custom SaaS application. However, users from the European branch are reporting that they are prompted for MFA every time, even though they have already authenticated via a compliant device. What is the most likely cause?

Accepted Answer

The Conditional Access policy has a session control that requires sign-in frequency. Option C is correct because the Conditional Access policy includes a session control that requires sign-in frequency, which forces users to re-authenticate with MFA at a specified interval regardless of device compliance or previous authentication. Even if the device is compliant and the user has already authenticated, the sign-in frequency control overrides session persistence and prompts for MFA again based on the configured time period (e.g., every hour). This explains why European branch users are repeatedly prompted for MFA despite having authenticated via a compliant device.

Answer

The user's device is not marked as compliant

Answer

The user has per-user MFA enabled

Answer

The policy includes a location condition that is not met

Question 9

Your organization uses Microsoft Defender for Cloud Apps. You want to set up a policy that automatically suspends a user if they download more than 100 files from SharePoint Online within 10 minutes. Which type of policy should you create?

Accepted Answer

Activity policy. An Activity policy in Microsoft Defender for Cloud Apps monitors user activities across connected apps and can trigger automated actions, such as suspending a user, when a specific threshold of downloads from SharePoint Online is exceeded within a defined time window. This policy type is designed to detect anomalous behavior patterns like mass file downloads, making it the correct choice for this scenario.

Answer

Session policy

Answer

File policy

Answer

App discovery policy

Question 10

Which TWO of the following are valid methods to enforce device compliance in a Conditional Access policy? (Select two.)

Accepted Answer

Require Microsoft Entra hybrid joined device. Option D is correct because requiring a Microsoft Entra hybrid joined device ensures the device is joined to both on-premises Active Directory and Microsoft Entra ID, which allows Conditional Access to enforce compliance based on the device's identity and configuration. Option E is correct because requiring the device to be marked as compliant relies on Microsoft Intune (or another MDM) to evaluate device health and policy adherence, and then Conditional Access blocks access if the device is not compliant.

Answer

Require Microsoft Authenticator

Answer

Require session persistence

Answer

Require approved client app

Question 11

An organization is implementing Microsoft Entra Verified ID for verifiable credentials. They want to issue credentials to employees that can be used to prove employment status to third parties. Which component must be created first?

Accepted Answer

A credential manifest in the Microsoft Entra admin center. The credential manifest defines the rules for issuing a verifiable credential, including the claims schema, display information, and issuance policies. In Microsoft Entra Verified ID, you must create the credential manifest in the Entra admin center before any credentials can be issued, as it serves as the template that governs the credential's structure and validation. Without a manifest, there is no definition for what the credential contains or how it should be presented.

Answer

A presentation request policy

Answer

A distributed ledger network

Answer

A decentralized identifier (DID) for the organization

Question 12

Your company is implementing a Zero Trust security model. You need to ensure that all user access requests to corporate resources are verified continuously, not just at the initial sign-in. Which Microsoft Entra ID feature should you use?

Accepted Answer

Continuous Access Evaluation (CAE). Continuous Access Evaluation (CAE) is the correct choice because it enforces real-time token validation and policy enforcement for every access request, not just at initial authentication. CAE works by having critical events (e.g., user disablement, IP address change, or risk elevation) trigger a revocation message to the resource provider, which then immediately blocks access—even if the token is still valid. This aligns directly with the Zero Trust principle of 'verify explicitly and continuously' rather than relying on a one-time sign-in.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra Verified ID

Question 13

You are reviewing a Conditional Access policy in JSON format. The policy is applied to all users accessing Office 365 from trusted locations. What is the intended behavior of this policy?

Accepted Answer

Users must provide MFA or use a compliant device. The policy grants access when users are in a trusted location and either provide MFA or use a compliant device. The 'OR' condition between MFA and device compliance means that satisfying either requirement is sufficient, not both. This is the standard behavior when multiple controls are assigned with 'Require one of the selected controls' in Conditional Access.

Answer

Users are blocked if they are not using a compliant device

Answer

Users must provide MFA and use a compliant device

Answer

Users only need to provide MFA regardless of device

Question 14

You are a Microsoft 365 administrator. Your organization uses Microsoft Entra ID and Microsoft Intune for device management. You need to ensure that only compliant devices can access corporate email via Microsoft Outlook on mobile devices. What should you configure?

Accepted Answer

Create a Conditional Access policy with 'Require device to be marked as compliant'. Option A is correct because Conditional Access policies in Microsoft Entra ID can enforce 'Require device to be marked as compliant' as a grant control. This ensures that only devices meeting your Intune compliance policies (e.g., encryption, OS version, threat level) are allowed to access corporate email via Outlook on mobile devices. The policy evaluates device compliance status reported by Intune and blocks access if the device is non-compliant.

Answer

Deploy app protection policies (MAM) for Outlook

Answer

Enable Microsoft Entra device registration

Answer

Create a device compliance policy in Intune

Question 15

Your company uses Microsoft Entra ID and has a custom line-of-business application that supports SAML-based SSO. You need to configure the application to use Microsoft Entra ID as the identity provider. Which enterprise application configuration should you use?

Accepted Answer

SAML-based Sign-on. The application supports SAML-based SSO, so the correct enterprise application configuration is SAML-based Sign-on. This allows Microsoft Entra ID to act as the identity provider by exchanging SAML assertions with the application, enabling federated authentication.

Answer

Linked Sign-on

Answer

Password-based Sign-on

Answer

OpenID Connect-based Sign-on

Question 16

A company uses Microsoft Entra ID and has enabled self-service password reset (SSPR). Users are required to register for SSPR. Management wants to ensure that users from the HR department, who handle sensitive data, must use two methods for authentication during SSPR, while other users can use one method. What is the best way to achieve this?

Accepted Answer

This is not possible because SSPR authentication method requirements are tenant-wide. SSPR authentication method requirements in Microsoft Entra ID are configured at the tenant level, not per user or group. This means you cannot specify that one group of users must use two methods while others use one; the number of methods required applies uniformly to all users enabled for SSPR. Therefore, option D is correct because the requirement cannot be differentiated by department or group.

Answer

Create a separate SSPR policy for the HR department using PowerShell

Answer

Use Microsoft Entra ID Governance to create an access package that requires two methods

Answer

Assign the HR users to a group and configure the SSPR policy for that group in the Entra admin center

Question 17

An administrator runs the Azure CLI command shown in the exhibit. What is the result of this command?

Accepted Answer

A new application registration is created with requested permissions to Graph. The Azure CLI command `az ad app create --display-name 'MyApp' --required-resource-accesses '[{"resourceAppId":"00000003-0000-0000-c000-000000000000","resourceAccess":[{"id":"e1fe6dd8-ba31-4d61-89e7-88639da4923c","type":"Scope"}]}]'` creates a new application registration in Microsoft Entra ID. The `--required-resource-accesses` parameter specifies the Microsoft Graph (resourceAppId `00000003-0000-0000-c000-000000000000`) and the permission with ID `e1fe6dd8-ba31-4d61-89e7-88639da4923c` (which corresponds to the `User.Read` delegated permission). This registers the app with requested permissions to Microsoft Graph, but does not grant admin consent or configure sign-in audience.

Answer

An existing application registration is updated

Answer

The application is configured with single-tenant sign-in audience

Answer

An admin consent is granted for the Microsoft Graph permissions

Question 18

Your company uses Microsoft Entra ID and wants to use Microsoft's recommendation to protect against password spray attacks. Which feature should you enable?

Accepted Answer

Smart Lockout. Smart Lockout is Microsoft's recommended feature to protect against password spray attacks because it intelligently locks out bad actors after a threshold of failed attempts while allowing legitimate users to continue. It uses adaptive logic to distinguish between real users and attackers by considering the sign-in pattern and IP address, making it the correct choice for this specific threat.

Answer

Identity Protection

Answer

Password Hash Synchronization

Answer

Multifactor Authentication

Question 19

Your organization uses Microsoft Entra ID and has a hybrid identity configuration with Active Directory Federation Services (AD FS). You are migrating to cloud authentication using Pass-through Authentication (PTA). Which TWO components are required for a PTA deployment?

Accepted Answer

Service Bus endpoints in Azure. Pass-through Authentication (PTA) requires the PTA Agent to be installed on-premises to validate user passwords against Active Directory. It also uses Azure Service Bus endpoints to establish a secure, persistent connection between the on-premises agent and Microsoft Entra ID, enabling authentication requests to flow without storing passwords in the cloud.

Answer

Password Hash Synchronization agent

Answer

Azure AD Connect Health agent

Answer

Seamless Single Sign-On

Question 20

Your organization uses Microsoft Entra ID and has a custom role that grants 'microsoft.directory/applications/credentials/update' permission. A security audit reveals that a user assigned this role has modified credentials for an application. You need to prevent such actions while allowing other application updates. What should you do?

Accepted Answer

Create a custom role that excludes the 'microsoft.directory/applications/credentials/update' permission and assign it to the user.. The custom role currently includes the 'microsoft.directory/applications/credentials/update' permission, which allows modifying application credentials. To prevent credential updates while still permitting other application updates, you must create a new custom role that explicitly excludes this permission and assign it to the user. This approach preserves granular control without granting unnecessary privileges, unlike built-in roles that would either over-scope or under-scope permissions.

Answer

Assign the user the built-in Application Administrator role instead.

Answer

Enable multi-factor authentication for the user.

Answer

Remove the user from the custom role and assign them another role with fewer permissions.