MS-102 Practice Exam 60 — 20 Questions

Question 1

You run the Azure CLI command shown in the exhibit. What does the output represent?

Accepted Answer

The application ID for Microsoft Graph. The Azure CLI command `az ad sp show --id 00000003-0000-0000-c000-000000000000` retrieves the service principal for the Microsoft Graph API. The GUID `00000003-0000-0000-c000-000000000000` is the well-known application ID for Microsoft Graph in Microsoft Entra ID (formerly Azure AD). This ID is used to grant permissions and consent for Microsoft Graph API access.

Answer

The application ID for Microsoft Entra ID

Answer

The application ID for Exchange Online

Answer

The application ID for SharePoint Online

Question 2

You are a Microsoft 365 administrator. You run the Get-MgPolicyCrossTenantAccessPolicyDefault cmdlet and see the exhibit output. What does this configuration imply?

Accepted Answer

Your tenant will accept MFA claims from all external Microsoft Entra tenants. The Get-MgPolicyCrossTenantAccessPolicyDefault cmdlet retrieves the default cross-tenant access policy settings. The exhibit output shows that the InboundTrust property is configured to accept MFA claims from all external Microsoft Entra tenants, meaning your tenant will trust MFA claims made by users from any external Entra tenant without requiring them to re-authenticate.

Answer

Your tenant will accept compliant device claims from external tenants

Answer

Your tenant will accept MFA claims from a specific partner tenant

Answer

Your tenant blocks all inbound B2B collaboration

Question 3

You are reviewing directory settings for Microsoft 365 Groups. Based on the exhibit, which statement is true?

Accepted Answer

All users in the tenant can create Microsoft 365 Groups. The exhibit shows that under 'Group creation settings,' the option 'Set which users can create Microsoft 365 Groups' is configured to 'Everyone.' This means all users in the tenant are permitted to create groups, regardless of membership in any security group. Therefore, option D is correct because the setting explicitly allows all users to create Microsoft 365 Groups.

Answer

Only users in a specific security group can create Microsoft 365 Groups

Answer

A naming policy is enforced for new groups

Answer

Groups must have a classification label

Question 4

You are configuring Microsoft Entra ID for a new organization. The CIO wants to ensure that all external users who are invited to collaborate via Microsoft Entra B2B must go through an approval process before gaining access. Which setting should you configure?

Accepted Answer

Set 'External collaboration settings' to restrict invitations to specific admins. Option B is correct because the 'External collaboration settings' in Microsoft Entra ID allow you to restrict who can invite external users. By setting the invitation restriction to 'Only users assigned to specific admin roles can invite', you ensure that all B2B collaboration invitations must be initiated by authorized admins, effectively requiring an approval process before external users gain access.

Answer

Create a Conditional Access policy requiring approval for external users

Answer

Enable guest self-service sign-up via user flows

Answer

Enable Identity Protection for guest users

Question 5

Your organization uses Microsoft Entra ID Governance. You need to ensure that access reviews are automatically created for all guest users in the tenant and that reviews are sent to the guest users' managers for approval. You configure an access review policy. Which identity governance feature should you use?

Accepted Answer

Entitlement Management. B is correct because Entitlement Management in Microsoft Entra ID Governance allows you to configure access review policies that automatically create reviews for guest users and assign them to the guest users' managers for approval. This feature integrates with access reviews to enforce governance over external identities, ensuring that guest access is periodically recertified by the appropriate authority.

Answer

Terms of Use

Answer

Access Reviews

Answer

Privileged Identity Management

Question 6

Your company has a Microsoft 365 E5 subscription and uses Microsoft Entra ID. Users report that they are frequently prompted for multi-factor authentication (MFA) even after signing in successfully. You want to minimize these prompts while maintaining security. What should you configure?

Accepted Answer

Configure Authentication Session Management. Option A is correct because configuring Authentication Session Management in a Conditional Access policy allows you to control how often users are prompted for MFA by setting the sign-in frequency (e.g., every 24 hours) or persistent browser session (e.g., 'Remember MFA for 14 days'). This directly addresses the user complaint of frequent MFA prompts while maintaining security by enforcing reauthentication at defined intervals.

Answer

Modify the Conditional Access policy to require MFA for all apps

Answer

Change the per-user MFA state to Disabled

Answer

Adjust Identity Protection user risk policy

Question 7

You are designing a Microsoft Entra ID governance strategy. Which THREE features should you use to implement the principle of least privilege for administrative roles?

Accepted Answer

Privileged Access Groups. Privileged Access Groups (B) enable you to grant just-in-time or time-bound access to Azure AD roles and other resources by assigning users to a group that is eligible for role activation, directly supporting the principle of least privilege by limiting standing administrative access.

Answer

Microsoft Entra Lifecycle Workflows

Answer

Microsoft Entra Entitlement Management

Question 8

Your organization uses Microsoft Entra ID to manage user identities. You need to ensure that users can sign in using their existing social media accounts, such as Google or Facebook. Which identity solution should you configure?

Accepted Answer

External identities. External identities in Microsoft Entra ID allow you to configure identity providers such as Google and Facebook, enabling users to sign in with their existing social media accounts. This is achieved by setting up federation with OAuth 2.0 and OpenID Connect protocols, which is the correct solution for the scenario described.

Answer

Microsoft Entra B2B collaboration

Answer

Managed identities

Answer

Microsoft Entra Identity Protection

Question 9

Your organization uses Microsoft Entra ID and requires that all guest users must have a mobile phone number registered for authentication. You need to enforce this requirement. What should you configure?

Accepted Answer

Configure the Authentication methods policy to require mobile phone registration for guests.. Option C is correct because the Authentication methods policy in Microsoft Entra ID allows you to define which authentication methods are available to users, including guest users. By configuring this policy to require mobile phone registration, you enforce that all guest users must register a mobile phone number for authentication, directly addressing the requirement.

Answer

Create a Terms of Use policy that guests must accept.

Answer

Configure a Conditional Access policy requiring multifactor authentication for guest users.

Answer

Create an access review for guest users in Identity Governance.

Question 10

Your organization uses Microsoft Entra ID and has enabled Microsoft Entra Domain Services (Azure AD DS). You need to ensure that legacy applications that require NTLM authentication can still authenticate against the managed domain. What should you configure?

Accepted Answer

Enable NTLM v1 authentication on the managed domain. Legacy applications that require NTLM authentication must have NTLM v1 enabled on the managed domain because Azure AD DS, by default, disables NTLM v1 for security reasons. Enabling NTLM v1 allows these older applications to authenticate against the managed domain using the NTLM protocol, which is necessary when Kerberos is not supported.

Answer

Configure Kerberos delegation

Answer

Disable NTLM v1 authentication on the managed domain

Answer

Enable password hash synchronization for the managed domain

Question 11

Your company uses Microsoft Entra ID. You need to restrict access to a critical application to only users who are in a specific security group and are signing in from a trusted location. You configure a conditional access policy with the following conditions: users (the security group), cloud apps (the critical application), conditions (locations: trusted IP ranges). However, users in the security group are still able to access the app from untrusted locations. What is the most likely reason?

Accepted Answer

The policy is in report-only mode. When a Conditional Access policy is in report-only mode, it evaluates the conditions and logs the result but does not enforce any access controls (grant or block). This explains why users in the security group can still access the app from untrusted locations—the policy is not actively blocking or requiring MFA/location compliance. Report-only mode is commonly used for testing before enabling enforcement.

Answer

The policy is configured as a block policy but is overridden by another policy

Answer

The cloud app is not correctly assigned to the policy

Answer

The policy uses session controls instead of grant controls

Question 12

Your company uses Microsoft Entra ID and has an app named App1 that requires permissions to read all user profiles. You need to grant admin consent for App1 to read profiles without requiring each user to consent. What should you do?

Accepted Answer

From Microsoft Entra ID, go to Enterprise applications, select App1, and grant admin consent.. Option C is correct because granting admin consent for an enterprise application in Microsoft Entra ID allows a tenant administrator to pre-approve permissions for all users, eliminating the need for individual user consent. This is done by navigating to Enterprise applications, selecting App1, and using the 'Grant admin consent' option, which sends an OAuth 2.0 authorization request with the required permissions (e.g., User.Read.All) on behalf of the entire organization.

Answer

Create a Conditional Access policy that requires consent for App1.

Answer

Register a new application in App registrations and assign the required permissions.

Answer

Configure the user consent settings to allow users to consent for themselves.

Question 13

Your organization has a Microsoft 365 E5 subscription and uses Microsoft Entra ID. You are implementing Privileged Identity Management (PIM) to manage access to Azure AD roles. You need to ensure that when a user activates a privileged role, the activation request must be approved by their manager and must include a ticket number. What should you configure?

Accepted Answer

Modify the role settings in PIM to require approval and justification with ticket number. Option B is correct because PIM role settings allow you to configure activation requirements, including requiring approval and mandating a justification field. By enabling 'Require approval to activate' and configuring the approver as the user's manager, and by setting 'Require ticket information on activation', you enforce that every activation request includes a ticket number and is routed to the manager for approval.

Answer

Create an access review for the role

Answer

Configure an access package in Entitlement Management

Answer

Use Conditional Access policy with session controls

Question 14

Your organization uses Microsoft Entra ID. You need to enable users to reset their own passwords without administrator intervention. Which TWO components must be configured?

Accepted Answer

Microsoft Entra self-service password reset (SSPR). Microsoft Entra self-service password reset (SSPR) is the core feature that allows users to reset their own passwords without administrator intervention. It must be enabled and configured at the tenant level, and it relies on users having registered authentication methods to verify their identity during the reset process.

Answer

Microsoft Entra Identity Protection

Answer

Conditional Access policies

Answer

Microsoft Entra Privileged Identity Management

Question 15

You are planning a migration from on-premises Active Directory to Microsoft Entra ID using cloud sync. You need to synchronize user passwords so that users can authenticate using their existing passwords. Which feature should you enable?

Accepted Answer

Password Hash Synchronization. Password Hash Synchronization (PHS) is the correct feature because it synchronizes the hash of a user's on-premises Active Directory password to Microsoft Entra ID, allowing users to authenticate with the same password without any additional on-premises infrastructure. Cloud sync specifically relies on PHS to replicate password hashes from AD to Entra ID, enabling seamless authentication for cloud-based services.

Answer

Pass-through Authentication

Answer

Federation with AD FS

Answer

Seamless Single Sign-On

Question 16

Your organization uses Microsoft Entra ID and requires users to authenticate using FIDO2 security keys. You need to ensure that users can register and manage their security keys through the My Security Info portal. Which authentication method policy setting should you enable?

Accepted Answer

Security keys (FIDO2). The Security keys (FIDO2) authentication method policy must be enabled to allow users to register and manage FIDO2 security keys through the My Security Info portal. This policy controls the registration, key restrictions, and user targeting for FIDO2 authentication in Microsoft Entra ID, directly enabling the self-service management experience.

Answer

Temporary Access Pass

Answer

Certificate-based authentication

Answer

Microsoft Authenticator

Question 17

Your organization uses Microsoft Entra Conditional Access. You need to block access from countries where your company does not operate. The list of blocked countries changes frequently. What is the most efficient way to manage this?

Accepted Answer

Create Named Locations for blocked countries and use them in Conditional Access. Named Locations in Microsoft Entra Conditional Access allow you to define countries by IP ranges and then use those locations in a policy to block access. This is the most efficient approach because you can update the list of blocked countries in the Named Locations configuration without modifying the Conditional Access policy itself, which is ideal when the list changes frequently.

Answer

Enable Microsoft Entra multifactor authentication for all users from blocked countries

Answer

Create a Conditional Access policy that blocks all locations except the allowed countries

Answer

Use IP ranges in Conditional Access to block specific country IPs

Question 18

Your company uses Microsoft Entra ID with P2 licenses. You need to configure Privileged Identity Management (PIM) for Azure AD roles. Which THREE actions are possible with PIM?

Accepted Answer

Schedule start and end times for role assignments. Option B is correct because PIM allows you to configure time-bound role assignments with specific start and end dates, enabling just-in-time access and reducing standing privileges. This is a core feature of PIM for Azure AD roles, supporting both eligible and active assignments with scheduled durations.

Answer

Automatically assign a role to all users in a security group

Answer

Limit role activation to a specific device

Question 19

Your organization uses Microsoft Entra Connect Sync. You need to ensure that specific on-premises Active Directory groups are synchronized to Microsoft Entra ID. What should you configure?

Accepted Answer

Set the sync scope to 'Synchronize selected groups'. Option A is correct because Microsoft Entra Connect Sync allows you to scope synchronization to specific groups by selecting 'Synchronize selected groups' in the Azure AD Connect configuration. This setting, available during installation or via the 'Customize synchronization options' task, restricts synchronization to only the on-premises Active Directory groups you explicitly choose, ensuring that only those groups are synced to Microsoft Entra ID.

Answer

Configure attribute-based filtering in Microsoft Entra Connect

Answer

Create a security group in Microsoft Entra ID and add members

Answer

Use the Synchronization Service Manager to select groups

Question 20

Your organization uses Microsoft Entra ID. You need to ensure that users cannot reuse their last 5 passwords when changing passwords. What should you configure?

Accepted Answer

Password protection policy - enforce password history.. The password history policy in Microsoft Entra ID (formerly Azure AD) enforces the number of unique passwords a user must use before they can reuse an old password. By setting the password history value to 5, users cannot reuse any of their last 5 passwords when changing their password. This directly meets the requirement to prevent reuse of the last 5 passwords.

Answer

Multi-factor authentication settings.

Answer

Account lockout threshold.

Answer

Smart lockout settings.