MS-102 Practice Test 7 — 10 Questions

Question 1

A compliance officer needs to retain all documents in a SharePoint Online site associated with the Finance department for 7 years, and after that automatically delete them. During the retention period, users must not be able to edit or delete the documents. Which solution should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a retention label with 'Retain as regulatory records' and publish it to the site, then use auto-apply based on site location. A retention label with 'Retain as regulatory records' locks the document against editing or deletion during the retention period, and auto-applying the label based on site location ensures all documents in the Finance site inherit the 7-year retention and automatic deletion. This meets the compliance officer's requirement for immutable retention and automatic disposal without manual user intervention.

Answer

Create a retention policy scoped to the site with 'Retain as records' action

Answer

Create a sensitivity label with 'Retain as records' and apply it manually

Answer

Create a litigation hold for the site

Question 2

A company uses Microsoft Entra ID with password hash synchronization. The security team wants to prevent users from setting passwords that include their username or common terms from a custom dictionary (e.g., company name, product names). Which feature should be configured?

Accepted Answer

Configure a custom banned passwords list in Microsoft Entra ID Password Protection.. Microsoft Entra ID Password Protection allows administrators to enforce custom banned password lists that prevent users from including specific terms (e.g., company name, product names) or their username in passwords. This feature works with password hash synchronization to block weak passwords at the cloud level, directly addressing the security team's requirement.

Answer

Enable Azure AD Identity Protection with user risk policies.

Answer

Set a fine-grained password policy in on-premises Active Directory and sync it to Azure AD.

Answer

Enable MFA registration campaign to force users to register for MFA.

Question 3

A company uses Azure AD Privileged Identity Management (PIM) to manage role activations. They have an Azure AD Premium P2 license. The security team wants to require that any activation of the Exchange Administrator role must be approved by a specific group named 'Exchange Approvers'. Additionally, activations must require a ticket number and expire after 6 hours. Which PIM configuration should the administrator modify?

Accepted Answer

Configure the 'Role settings' for the Exchange Administrator role to require approval and set the approvers group. In Microsoft Entra PIM, the 'Role settings' for a specific role (like Exchange Administrator) allow you to configure activation requirements, including requiring approval, specifying approvers (such as the 'Exchange Approvers' group), requiring a ticket number, and setting a maximum activation duration (e.g., 6 hours). This directly meets all the security team's requirements.

Answer

Add the Exchange Administrator role to the 'Exchange Approvers' group's eligible assignments

Answer

Create a PIM alert for activations without a ticket number and set a 6-hour alert threshold

Answer

Define an access review for the Exchange Administrator role with a 6-hour review duration

Question 4

A security administrator notices that users are receiving phishing emails that evade built-in anti-spam filters. The administrator wants to enable users to report these suspicious emails from Outlook and have them automatically trigger an investigation and block the sender. Which feature should be configured in Microsoft Defender for Office 365?

Accepted Answer

User reported settings in the Microsoft 365 Defender portal. User reported settings in the Microsoft 365 Defender portal allow administrators to configure how user-reported messages are handled. When enabled, users can report suspicious emails directly from Outlook, and these reports can automatically trigger an investigation and block the sender via automated investigation and response (AIR) policies. This directly addresses the requirement to have user-reported emails initiate security actions.

Answer

Attack simulation training

Answer

Threat Explorer

Answer

Safe Links

Question 5

A company uses Azure AD Connect with password hash synchronization. They want to enable Azure AD Seamless Single Sign-On (SSO) for users accessing Microsoft 365 from domain-joined devices on the corporate network. Which configuration is required on the on-premises Active Directory?

Accepted Answer

Create a computer account named AZUREADSSOACC in each AD forest. Microsoft Entra ID Seamless SSO requires a computer account named AZUREADSSOACC to be created in each on-premises AD forest. This account is used by Microsoft Entra ID to sign Kerberos tickets for users accessing Microsoft 365 resources, enabling automatic sign-in without password prompts. The account must be created in the root domain of each forest and its password is managed automatically by Microsoft Entra Connect.

Answer

Install Azure AD Connect on a separate server

Answer

Enable Passthrough Authentication

Answer

Set the service connection point in Active Directory

Question 6

An organization has just purchased Microsoft 365 Business Standard licenses and has added the custom domain 'contoso.com' to the tenant. The administrator wants all new user email addresses to use '@contoso.com' instead of the default '@contoso.onmicrosoft.com'. How can this be achieved?

Accepted Answer

Set the default domain in the Microsoft 365 admin center to contoso.com. Setting the default domain to 'contoso.com' in the Microsoft 365 admin center ensures that all newly created users automatically receive an email address with the custom domain as their primary SMTP address. This is the standard method because the default domain setting controls the domain appended to new user accounts during creation, eliminating the need for manual changes.

Answer

Change the primary SMTP address for each user manually after creation

Answer

Remove the onmicrosoft.com domain from the tenant

Answer

Edit the user creation PowerShell script to specify the domain

Question 7

Your company uses Microsoft 365 and has recently deployed Microsoft Intune for mobile device management. You need to ensure that corporate data on iOS devices is protected by preventing users from copying data from managed apps to unmanaged apps. What should you configure?

Accepted Answer

App protection policies.. App protection policies (APP) are the correct choice because they provide mobile application management (MAM) controls that specifically prevent data transfer between managed and unmanaged apps on iOS devices. Unlike device-level policies, APP operates at the application layer, allowing you to restrict copy/paste, cut, and data sharing actions without requiring device enrollment. This directly addresses the requirement to protect corporate data on iOS devices by blocking data leakage to unmanaged apps.

Answer

Mobile application management (MAM) without enrollment.

Answer

Device compliance policies.

Answer

Conditional Access policies.

Question 8

A security administrator wants to configure Automated Investigation and Response (AIR) in Microsoft 365 Defender to automatically isolate a device when a high-severity alert for malware is detected. Which step is required?

Accepted Answer

C: Configure the device to be part of a device group and enable automation level.. To enable Automated Investigation and Response (AIR) in Microsoft Defender for Endpoint, the device must be added to a device group, and the automation level for that group must be set to 'Full – remediate threats automatically' or a similar level. This configuration allows Defender to automatically isolate a device when a high-severity malware alert is triggered, as part of the built-in AIR playbooks.

Answer

A: Create an automation rule in Microsoft Sentinel.

Answer

B: Create a custom detection rule in advanced hunting.

Answer

D: Enable auto-removal of malware from devices.

Question 9

An administrator needs to configure email notifications for Exchange Online service health incidents to be sent to a specific IT support mailbox. Where should the administrator configure these notifications in the Microsoft 365 admin center?

Accepted Answer

Health > Service health > Customize notifications. The 'Customize notifications' link under Health > Service health in the Microsoft 365 admin center is the dedicated interface for configuring email notifications for service health incidents, including Exchange Online. This allows administrators to specify which email addresses (such as an IT support mailbox) receive alerts for service incidents, advisories, and other health events, with granular control over which services and severity levels trigger notifications.

Answer

Organization profile > Notifications > Service health

Answer

Mail flow connectors

Answer

Settings > Service settings

Question 10

A legal department needs to preserve all communications related to an ongoing lawsuit. They identify specific users and require that their mailbox items and OneDrive files are not altered or deleted. Which Microsoft Purview feature should be used?

Accepted Answer

Litigation Hold. Litigation Hold is the correct feature because it preserves all mailbox items and OneDrive files for specific users in their current state, preventing any alteration or deletion by users or automated processes. This is essential for legal holds where data must be immutable for eDiscovery purposes, and it applies at the user level rather than broadly across the organization.

Answer

Retention Policy

Answer

Data Loss Prevention (DLP)

Answer

eDiscovery