MS-102 Practice Exam 63 — 20 Questions

Question 1

Your organization uses Microsoft 365 and has strict compliance requirements. The compliance officer has noticed that some users are able to access sensitive documents from unmanaged devices. You need to ensure that all access to sensitive data from unmanaged devices is blocked, while still allowing access from managed devices. The solution must be implemented using Microsoft Entra ID and Microsoft Intune. You have already deployed Microsoft Intune for mobile device management. What should you do?

Accepted Answer

Create a conditional access policy in Microsoft Entra ID that requires device to be marked as compliant, and apply it to all cloud apps.. Option A is correct: a conditional access policy in Microsoft Entra ID can require that devices be marked as compliant with Intune policies, blocking access from unmanaged devices. Option B is wrong because app protection policies in Intune apply to apps, not device-level access. Option C is wrong because a compliance policy defines what compliant means but does not block access; conditional access does. Option D is wrong because device compliance rules are part of Intune but do not enforce access decisions without conditional access.

Answer

Enable device compliance rules in Microsoft Entra ID and assign them to all users.

Answer

Create a device compliance policy in Microsoft Intune that requires a PIN and encryption.

Answer

Create an app protection policy in Microsoft Intune that requires managed apps to be used on unmanaged devices.

Question 2

Your organization has 5,000 users and uses Microsoft 365 E3. You are planning to migrate from on-premises Exchange to Exchange Online. You have already synchronized identities using Microsoft Entra Connect. The CIO wants to ensure that users can continue to access their email if the internet connection to Microsoft 365 is temporarily lost. You need to recommend a solution that provides offline access while minimizing cost and administrative overhead. What should you recommend?

Accepted Answer

Configure Outlook to use Cached Exchange Mode.. Cached Exchange Mode (CEM) downloads a copy of the user's mailbox to a local .ost file, allowing full access to email, calendar, and contacts even when the internet connection to Microsoft 365 is temporarily lost. This meets the CIO's requirement for offline access with zero additional cost and no administrative overhead, as CEM is a built-in feature of Outlook that is already available with Microsoft 365 E3.

Answer

Implement a hybrid deployment and keep some mailboxes on-premises.

Answer

Deploy a VPN to ensure connectivity.

Answer

Enable Exchange Online Archiving for all users.

Question 3

You are the Microsoft 365 administrator for a large enterprise with 50,000 users. The company is deploying Microsoft 365 Copilot for all users. You need to ensure that the data used by Copilot is protected and that Copilot does not inadvertently expose sensitive information. The company has strict data residency requirements: all data must remain within the European Union (EU). You have already configured data boundaries in Microsoft 365 to keep data in the EU. However, you are concerned about Copilot's AI model training. You need to implement additional controls. The company uses Microsoft Purview Information Protection with sensitivity labels. You have created a sensitivity label "Highly Confidential" that applies encryption and a "Confidential" label that applies visual markings. You also have a DLP policy that prevents sharing of "Highly Confidential" data externally. You need to ensure that when a user uses Copilot with a document labeled "Highly Confidential", the Copilot response does not include any of the sensitive content from that document. What should you do?

Accepted Answer

Ensure that the Highly Confidential sensitivity label includes encryption when applied.. Option B is correct because the 'Highly Confidential' sensitivity label already applies encryption, which prevents Microsoft 365 Copilot from accessing the document's content. Copilot cannot process or include encrypted content in its responses, as encryption blocks the AI model from reading the underlying data. This ensures that sensitive information from encrypted documents is not inadvertently exposed in Copilot outputs.

Answer

Exclude users who handle Highly Confidential data from Copilot licensing.

Answer

Create a DLP policy that blocks Copilot from accessing documents labeled Highly Confidential.

Answer

Configure Microsoft 365 data boundaries to restrict Copilot data processing to the EU.

Question 4

Contoso is a multinational company with 50,000 users. They have a Microsoft 365 E5 subscription and use Microsoft Entra ID for identity. They recently deployed Microsoft Copilot for Microsoft 365 to 10,000 users. The security team wants to ensure that Copilot responses do not expose sensitive information. They also need to monitor Copilot usage for unusual activity. The company uses Microsoft Purview Information Protection and Microsoft Defender for Cloud Apps. You need to configure the environment to meet these requirements. Which action should you take?

Accepted Answer

Create a Microsoft Purview DLP policy that includes Copilot as a location.. Option A is correct because Microsoft Purview Data Loss Prevention (DLP) policies can include Microsoft Copilot for Microsoft 365 as a location, allowing the security team to detect and prevent sensitive information from being exposed in Copilot responses. This directly addresses the requirement to ensure Copilot responses do not expose sensitive data by scanning and blocking content based on sensitivity labels or sensitive info types.

Answer

Configure a Conditional Access policy to restrict Copilot to managed devices.

Answer

Enable session monitoring in Microsoft Defender for Cloud Apps for Copilot.

Answer

Create sensitivity labels and auto-labeling policies for Copilot.

Question 5

You are a Microsoft 365 administrator for a small business with 50 users. The company is using Microsoft 365 Business Basic. You need to configure email for the custom domain contoso.com. You have added the domain in the Microsoft 365 admin center and verified ownership. Users currently have onmicrosoft.com email addresses. You need to change the primary email address for all users to their custom domain (e.g., user@contoso.com). What should you do?

Accepted Answer

Change the primary email address for each user to user@contoso.com in the admin center.. Option C is correct because in Microsoft 365, after adding and verifying a custom domain, you must manually update each user's primary email address (User Principal Name and primary SMTP address) from the default onmicrosoft.com domain to the custom domain. This is done in the Microsoft 365 admin center under Users > Active Users, by editing the username and email fields. Simply adding the domain does not automatically change existing user addresses.

Answer

Remove the onmicrosoft.com domain from the tenant.

Answer

Convert all mailboxes to shared mailboxes and reassign licenses.

Answer

Configure the MX record for contoso.com to point to Exchange Online.

Question 6

You are the Microsoft 365 administrator for a multinational company. The company has deployed Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps. Recently, the security team detected that a user's credentials were compromised and used to access SharePoint Online from an unusual location. You need to investigate the incident and determine the full scope of the breach. The solution must use Microsoft 365 Defender to correlate events. What should you do first?

Accepted Answer

Use advanced hunting in Microsoft 365 Defender portal to query for events related to the user across workloads.. Option B is correct because advanced hunting in the Microsoft 365 Defender portal allows you to query raw, cross-workload telemetry (e.g., from Identity, Exchange Online, SharePoint Online, and Defender for Cloud Apps) in a single Kusto Query Language (KQL) query. This is the most efficient first step to correlate events such as sign-ins, mailbox access, file downloads, and app sessions related to the compromised user, enabling you to determine the full scope of the breach across all Microsoft 365 services.

Answer

Use the Microsoft Purview compliance portal to search for the user's activity in audit logs.

Answer

Use Microsoft Defender for Cloud Apps to investigate the user's activity log.

Answer

Use Microsoft Sentinel to query the user's events from the workspace.

Question 7

Your organization has a hybrid identity deployment with Microsoft Entra Connect. You have synchronized all on-premises Active Directory users to Microsoft Entra ID. You need to enable Microsoft Entra ID Password Protection to automatically block weak passwords. You have installed the Password Protection proxy on a server and registered it. You also need to enforce the password protection policy for on-premises users. What additional step is required?

Accepted Answer

Install the Password Protection DC agent on each domain controller.. The Password Protection DC agent is required on each domain controller to intercept and validate password changes against the Microsoft Entra ID Password Protection policy. Without this agent, the proxy server alone cannot enforce the policy for on-premises users, as the DC agent is the component that applies the password filter during password change operations.

Answer

Install the Password Protection proxy on all domain controllers.

Answer

Enable the password filter in the Microsoft Entra Connect configuration.

Answer

Configure a Group Policy to require password complexity.

Question 8

You are the Microsoft 365 administrator for a company with a hybrid identity configuration using Azure AD Connect. The company has a custom domain 'contoso.com' federated with Active Directory Federation Services (ADFS). All users are synced from on-premises Active Directory. The security team wants to implement Microsoft Entra ID Protection to detect risky sign-ins. However, they are concerned that federated authentication bypasses some risk detection capabilities. You need to ensure that Microsoft Entra ID Protection can evaluate risk for all sign-ins, including federated ones. What should you do?

Accepted Answer

Switch from federated authentication to Pass-through Authentication (PTA) or Password Hash Sync (PHS).. Microsoft Entra ID Protection relies on signals such as IP addresses, device information, and sign-in patterns to calculate risk. In a federated setup with ADFS, the authentication happens on-premises, and Azure AD only receives a token—not the raw sign-in details needed for real-time risk evaluation. Switching to Pass-through Authentication (PTA) or Password Hash Sync (PHS) ensures that the authentication process flows through Azure AD directly, allowing Entra ID Protection to capture and analyze all sign-in events, including those from federated users.

Answer

Configure the federated trust in Microsoft Entra ID to use the new claims.

Answer

Configure ADFS to send the ipaddr and xms_ep claims to Azure AD.

Answer

Enable Azure AD Application Proxy to publish ADFS internally.

Question 9

Your company uses Microsoft 365 Business Premium. You need to ensure that all company-owned Windows 10 devices are automatically enrolled in Microsoft Intune when users sign in with their work account. The devices are Azure AD joined. You have configured automatic enrollment in Intune. However, some devices are not enrolling. You need to troubleshoot the issue. What should you check first?

Accepted Answer

Verify that each user has an appropriate Microsoft Intune license assigned.. Option C is correct because automatic enrollment in Microsoft Intune requires each user to have an appropriate Intune license (e.g., Microsoft 365 Business Premium includes Intune). Without a license, the device will not be able to enroll even if all other prerequisites are met. The license is checked during the enrollment process, and if missing, enrollment fails silently.

Answer

Ensure that devices are Azure AD joined and not domain joined.

Answer

Check the Windows 10 version; version 1607 or later is required.

Answer

Check that the MDM authority is set to Microsoft Intune in Microsoft Entra ID.

Question 10

You are the Microsoft 365 administrator for Fabrikam Inc., a company with 1,000 users. You have been asked to delegate the ability to reset passwords for all users to the help desk team. The help desk team consists of five users. You want to grant them the minimum necessary permissions. Additionally, you need to ensure that the help desk team can only reset passwords for users in the 'Users' organizational unit (OU) in on-premises Active Directory. The company uses Azure AD Connect with password hash sync. You create a security group named 'HelpDeskGroup' and add the help desk users to it. What should you do next?

Accepted Answer

Assign the Helpdesk Administrator role to the group and create an administrative unit scoped to the Users OU. Option C is correct because the Helpdesk Administrator role provides the least-privilege permissions for password resets, and creating an administrative unit (AU) scoped to the 'Users' OU allows you to restrict the role's management scope to only those users synced from that specific on-premises OU. This combination meets the requirement to delegate password reset with minimal permissions and scope limitation.

Answer

Assign the Global Administrator role to the group

Answer

Assign the User Administrator role to the group

Answer

Assign the Password Administrator role to the group and configure Azure AD Connect to restrict OU

Question 11

You are a Microsoft 365 administrator for Contoso Corporation, a multinational company with 20,000 users. The company uses Microsoft 365 E5, Microsoft Entra ID P2, Microsoft Defender XDR, Microsoft Purview, and Microsoft Intune. The security team wants to implement a zero-trust access model. Requirements: 1. All access to corporate resources must require multifactor authentication (MFA) and device compliance. 2. Users must register for MFA before accessing any app. 3. Legacy authentication protocols must be blocked for all users. 4. External collaboration must be governed by identity governance. 5. Sensitive data in SharePoint Online must be protected by DLP. 6. All administrative actions must be audited. You need to design the configuration. Which combination of actions should you take?

Accepted Answer

Create Conditional Access policies requiring MFA and compliant devices, block legacy auth, enforce MFA registration via Identity Protection, set up Microsoft Entra ID Governance for external users, configure Purview DLP for SharePoint, and enable Purview Audit. Option C is correct. A Conditional Access policy requiring MFA and compliant devices, blocking legacy auth, and using Entra ID Identity Protection to enforce MFA registration meets requirements 1,2,3. Microsoft Entra ID Governance (Entitlement Management) handles external collaboration (requirement 4). Microsoft Purview DLP protects SharePoint (requirement 5). Microsoft Purview Audit (Standard or Premium) audits admin actions (requirement 6). Option A is wrong because Security defaults are less granular and may not block legacy auth for all users. Option B is wrong because Intune compliance policies alone do not enforce MFA. Option D is wrong because Microsoft Sentinel is for SIEM, not primary audit logging for admin actions (Purview Audit is correct).

Answer

Enable Security defaults, configure SharePoint DLP, and use Microsoft Purview Audit for admin actions

Answer

Create a Conditional Access policy requiring MFA, block legacy auth, and use Microsoft Defender for Cloud Apps to monitor admin actions

Answer

Use Microsoft Intune compliance policies, enable MFA per-user, and deploy Microsoft Sentinel for auditing

Question 12

You are the Microsoft 365 administrator for Contoso, a company with 5,000 users. The company recently acquired a subsidiary, Fabrikam, which has 2,000 users currently using on-premises Exchange and Active Directory. The goal is to migrate Fabrikam users to Microsoft 365 and merge their identities into the existing Contoso tenant. The migration must minimize user password changes and preserve existing email addresses. You need to plan the identity migration. What should you do first?

Accepted Answer

Create a new Active Directory forest for Fabrikam and configure Azure AD Connect to sync to the existing Contoso tenant.. Option C is correct because creating a new Active Directory forest for Fabrikam and configuring Azure AD Connect to sync to the existing Contoso tenant allows you to merge identities without disrupting the existing Contoso directory. This approach preserves Fabrikam users' existing email addresses (via SMTP matching or custom domain verification) and minimizes password changes by syncing their on-premises passwords to Azure AD. It also avoids the complexity of extending the existing Contoso AD forest, which could cause namespace conflicts or schema issues.

Answer

Create a new Microsoft 365 tenant for Fabrikam and then perform a cross-tenant migration.

Answer

Extend the existing Contoso Active Directory to include Fabrikam objects and use a single Azure AD Connect instance.

Answer

Export Fabrikam users to a CSV and use PowerShell to bulk create users in Microsoft Entra ID.

Question 13

Your organization is planning to deploy Microsoft 365 Copilot for all users. The compliance team has concerns about data leakage through Copilot responses. Specifically, they want to ensure that Copilot does not generate responses based on highly confidential data labeled with the 'Highly Confidential' sensitivity label. Additionally, users must be able to use Copilot for general productivity tasks. You need to configure Microsoft 365 Copilot to meet these requirements. The solution must use Microsoft Purview Information Protection. What should you do?

Accepted Answer

Configure sensitivity labels to apply encryption to 'Highly Confidential' data and use Microsoft Purview DLP to prevent Copilot from using that content.. Option B is correct because it uses Microsoft Purview Information Protection to apply encryption via sensitivity labels to 'Highly Confidential' data, and then leverages Microsoft Purview Data Loss Prevention (DLP) policies to block Copilot from accessing or generating responses based on that encrypted content. This ensures that Copilot cannot use the protected data as a source for its responses, while still allowing users to use Copilot for general productivity tasks with non-protected data.

Answer

Remove the 'Highly Confidential' label from data that needs to be accessed by Copilot.

Answer

Block Copilot for all users who have access to 'Highly Confidential' data.

Answer

Create a conditional access policy to require multi-factor authentication for Copilot access.

Question 14

You are the identity architect for Contoso, a multinational company with 50,000 employees. Contoso uses Microsoft Entra ID with hybrid identity (PHS) and Microsoft Entra ID Protection. The company is deploying Microsoft Copilot for Microsoft 365 and wants to ensure that access to Copilot is controlled based on user risk, device compliance, and location. Additionally, the security team requires that all Copilot interactions are logged and auditable. You need to design a solution that meets these requirements with minimal administrative overhead.

Current environment:
- All users are synced from on-premises AD using Microsoft Entra Connect.
- Devices are either Microsoft Entra hybrid joined or Microsoft Entra registered.
- Microsoft Entra ID Protection is enabled with user risk and sign-in risk policies.
- Microsoft Intune is used for device compliance policies.
- All users have Microsoft 365 E5 licenses.

Requirements:
- Access to Copilot must be blocked for users with high user risk.
- Access from untrusted locations must require MFA.
- Only compliant devices can access Copilot.
- All Copilot interactions must be captured in Microsoft Purview Audit (Standard).

What should you do?

Accepted Answer

Create a Conditional Access policy targeting 'Microsoft Copilot' app. Configure conditions: user risk High to block, locations (untrusted) to require MFA, and device compliance to require compliant device. Ensure Purview Audit is enabled for Copilot.. Option A is correct because Conditional Access policies can enforce risk, location, and device compliance for Copilot as a cloud app, and Copilot interactions are automatically audited in Purview Audit. Option B is wrong because Entra ID Protection does not control device compliance. Option C is wrong because Intune policies do not enforce risk-based access. Option D is wrong because Defender for Cloud Apps would be additional overhead and not directly address the requirements.

Answer

Use Microsoft Defender for Cloud Apps to create session policies for Copilot, and integrate with Entra ID Protection.

Answer

Deploy Microsoft Intune app protection policies for Copilot, and use device compliance policies to block non-compliant devices.

Answer

Use Microsoft Entra ID Protection to block high-risk users, and configure Intune compliance policies to require MFA from untrusted locations.

Question 15

Your company, Alpine Ski House, uses Microsoft Entra ID P2. You have the following requirements: 1) Users in the Finance department must be required to use MFA when accessing the financial application, but only if they are not on the corporate network. 2) All users must be automatically blocked if Identity Protection detects their account as compromised (high user risk). 3) You need to ensure that the password change process after a high-risk detection does not allow users to reuse the last 5 passwords. 4) The solution must minimize false positives and allow users to self-remediate if they believe a risk detection is incorrect. Which configuration should you implement?

Accepted Answer

Create a conditional access policy for Finance requiring MFA from non-corporate networks, create a user risk policy to block high-risk users with user feedback enabled, and configure password protection to enforce the last 5 password history. Option D is correct because it combines a conditional access policy for Finance MFA, a user risk policy with block and user feedback, and custom password protection to enforce history. Option A is wrong because sign-in risk policy is for sign-in risk, not user risk. Option B is wrong because it lacks password history enforcement. Option C is wrong because it does not include user feedback for false positives.

Answer

Create a conditional access policy for Finance requiring MFA from non-corporate networks, create a sign-in risk policy to block high-risk users, and configure password protection to enforce password history

Answer

Create a conditional access policy for Finance requiring MFA from non-corporate networks, create a user risk policy to block high-risk users, and enable user feedback for risk detections

Answer

Create a conditional access policy for Finance requiring MFA from non-corporate networks, create a user risk policy to require password change, and configure password protection to enforce password history

Question 16

Your organization, Contoso Ltd., has a Microsoft 365 E5 tenant with Microsoft Entra ID P2. You are the Global Administrator. The security team reports that several users have been compromised due to weak passwords. You need to implement a solution that enforces strong password policies and blocks common passwords. The solution must also provide users with the ability to reset their own passwords securely if they forget them, without requiring help desk intervention. Additionally, you need to configure risk-based Conditional Access policies to block sign-ins from anonymous IP addresses and require MFA for high-risk sign-ins. You have the following options: A. Configure password protection in Microsoft Entra ID to enforce a custom banned password list and enable self-service password reset (SSPR) with MFA. Then create Conditional Access policies for sign-in risk and anonymous IP. B. Enable password hash sync and configure pass-through authentication. Create a Conditional Access policy to require MFA for all users. C. Implement Microsoft Entra ID Protection and enable MFA registration policy. Configure password expiration to 90 days. D. Use security defaults in Microsoft Entra ID and enable automatic password rollback. Which option should you choose?

Accepted Answer

Configure password protection with custom banned list, SSPR with MFA, and risk-based Conditional Access policies. Option A is correct because it covers all requirements: custom banned password list, SSPR, and risk-based Conditional Access policies. Option B is wrong because it does not address common passwords or SSPR. Option C is wrong because password expiration is not effective and no SSPR. Option D is wrong because security defaults do not allow custom banned password list and risk-based policies.

Answer

Enable password hash sync, pass-through authentication, and require MFA for all

Answer

Implement Identity Protection, enable MFA registration policy, set password expiration to 90 days

Answer

Use security defaults and enable automatic password rollback

Question 17

You are the identity administrator for Contoso Ltd., a multinational company with 10,000 employees. The company uses Microsoft Entra ID P2 licenses for all users. The security team has mandated the following requirements: 1) All users must use multi-factor authentication (MFA) when accessing any cloud app from untrusted networks. 2) Users who are detected as high risk by Identity Protection must be automatically blocked from signing in until an administrator reviews the risk. 3) Guest users from partner organizations must have their access reviewed every 90 days. 4) The IT department must be able to grant temporary administrative access to specific roles for up to 4 hours without requiring approval from a manager. You need to design a solution that meets all requirements with minimal administrative effort. Which combination of actions should you take?

Accepted Answer

Create a conditional access policy requiring MFA from untrusted networks, create a user risk policy to block high-risk users, schedule quarterly access reviews for guests, and configure PIM for time-bound role assignments. Option B is correct because it combines conditional access for MFA, user risk policy for blocking, access reviews for guests, and PIM for temporary assignments. Option A is wrong because sign-in risk policy is not for user risk. Option C is wrong because entitlement management is for access packages, not temporary admin roles. Option D is wrong because identity Protection alone cannot block high-risk users and does not cover guest reviews.

Answer

Create a conditional access policy requiring MFA from untrusted networks, create a sign-in risk policy to block high-risk users, schedule quarterly access reviews for guests, and configure PIM for time-bound role assignments

Answer

Enable Identity Protection to automatically block high-risk users, schedule quarterly access reviews for guests, configure PIM for temporary admin access, and enforce MFA via conditional access

Answer

Create a conditional access policy requiring MFA from untrusted networks, create a user risk policy to block high-risk users, schedule quarterly access reviews for guests, and configure entitlement management for temporary admin access

Question 18

Your organization, Contoso Ltd., has a Microsoft 365 E5 tenant with Microsoft Entra ID P2. You have 10,000 users and 500 applications. You are planning to implement a comprehensive identity security strategy. Your requirements are:
1. All users must use phishing-resistant MFA for accessing business-critical applications.
2. Users accessing sensitive HR data must be required to use a compliant device.
3. Any authentication attempt from an anonymous IP address or from a country where Contoso has no business operations must be blocked.
4. All external collaboration must be governed by access reviews that require sponsor approval.
5. You need to monitor and respond to identity risks in real time.

You need to design a solution using Microsoft Entra ID features. Which combination of features should you implement?

Accepted Answer

Deploy Microsoft Entra ID authentication strengths for phishing-resistant MFA. Create Conditional Access policies requiring compliant device for HR apps and blocking anonymous IPs and non-business countries. Use Microsoft Entra Identity Protection for risk detection and automated response. Implement entitlement management with connected organizations and access reviews requiring sponsor approval.. Option B correctly addresses all requirements: Phishing-resistant MFA (FIDO2/WHfB) via authentication strengths, compliant device via Conditional Access device condition, location-based blocking via Conditional Access location condition, external governance via Entitlement Management and access reviews, and risk monitoring via Identity Protection. Option A uses default MFA which is not phishing-resistant. Option C lacks device compliance. Option D uses self-service access reviews instead of sponsor approval.

Answer

Configure Conditional Access policies with MFA and trusted locations. Use Identity Protection for risk monitoring. Set up access reviews with group owner approval.

Answer

Enable security defaults for all users. Use Microsoft Defender for Cloud Apps to block anonymous IPs. Configure Azure AD access reviews for external users.

Answer

Use certificate-based authentication for all users. Create Conditional Access policies for device compliance. Set up identity protection. Use self-service access reviews for external users.

Question 19

Your company has a Microsoft 365 E5 tenant with Microsoft Entra ID P2. You are the security administrator. You need to implement a solution that automatically detects and remediates identity risks. Requirements:
- Risky sign-ins (e.g., from anonymous IP addresses) should be automatically blocked.
- Users with confirmed compromised credentials should be forced to reset their password at next sign-in.
- You need to receive alerts when high-risk events occur.
- The solution must minimize false positives.

Which Microsoft Entra ID features should you combine?

Accepted Answer

Enable Microsoft Entra Identity Protection, configure a sign-in risk policy to block high-risk sign-ins, and a user risk policy to require password reset for high-risk users. Set up alerts for risk events.. Option C uses Identity Protection's risk policies for sign-in risk (block) and user risk (password reset), along with risk detection alerts. Option A (CA policies with generic conditions) does not use risk detection. Option B (identity governance) is about access reviews. Option D (Defender for Cloud Apps) is more for cloud app discovery.

Answer

Set up Microsoft Entra Identity Governance access reviews and enable self-service password reset.

Answer

Configure Conditional Access policies to block sign-ins from anonymous IP addresses and require password reset for all users.

Answer

Deploy Microsoft Defender for Cloud Apps to detect risky sign-ins and configure session policies.

Question 20

Your organization, Fabrikam Inc., uses Microsoft Entra ID with a hybrid identity configuration. You have 500 cloud-only users and 5,000 synced users from on-premises Active Directory. The company wants to implement a passwordless authentication strategy. The following requirements must be met: 1) All users must be able to sign in without a password on Windows 10/11 devices that are Microsoft Entra joined. 2) Users who are not assigned a mobile phone must be able to use a security key (FIDO2). 3) The solution must work for both cloud-only and synced users. 4) The passwordless method should require the lowest administrative overhead for enrollment. Which passwordless authentication method should you recommend?

Accepted Answer

Windows Hello for Business. Option C is correct because Windows Hello for Business works on Microsoft Entra joined devices and supports both cloud-only and synced users, and can be deployed with minimal enrollment effort. Option A is wrong because FIDO2 security keys require key distribution and enrollment. Option B is wrong because Microsoft Authenticator requires a mobile device. Option D is wrong because certificate-based authentication requires PKI infrastructure.

Answer

Certificate-based authentication

Answer

Microsoft Authenticator app

Answer

FIDO2 security keys