MS-102 Practice Test 8 — 10 Questions

Question 1

A company purchases Microsoft 365 E5 licenses for 500 users. The administrator wants to automatically assign licenses to new users based on their group membership. Which method should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure group-based licensing in Microsoft Entra ID. Group-based licensing in Microsoft Entra ID (formerly Azure AD) allows automatic assignment and removal of licenses based on group membership. When a user is added to a licensed group, the license is automatically assigned; when removed, the license is revoked. This eliminates manual effort and ensures consistent licensing for all 500 users.

Answer

Run a PowerShell script to assign licenses individually

Answer

Manually assign licenses in the Microsoft 365 admin center for each user

Answer

Use a volume licensing product key to activate licenses

Question 2

A company uses Azure AD Conditional Access to enforce MFA for all cloud apps. They have some users who are physically located in countries that are considered high-risk by the security team. The team wants to require device compliance (as defined by Intune) for sign-ins from those specific countries, while still requiring MFA from all other locations. How should the administrator configure the Conditional Access policy?

Accepted Answer

Create two Conditional Access policies: one for the high-risk countries requiring MFA and device compliance, and another for all other locations requiring only MFA. Conditional Access policies are evaluated independently, and each policy can target specific conditions with distinct grant controls. By creating two separate policies—one for high-risk countries requiring both MFA and device compliance, and another for all other locations requiring only MFA—the administrator can enforce the exact requirements per location group. This approach avoids conflicts and ensures that users in high-risk countries are subject to stricter controls while others are not.

Answer

Create a single Conditional Access policy that includes both conditions (locations) and grant controls (MFA and device compliance) with an 'OR' operator

Answer

Use Azure AD Identity Protection to automatically evaluate location risk, and let Conditional Access apply the same policy to all users

Answer

Configure a single Conditional Access policy with multiple location conditions and multiple grant controls using an 'AND' operator

Question 3

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a custom Line-of-Business (LOB) app to a group of devices. The app is not in the Microsoft Store. What is the recommended method to deploy the app?

Accepted Answer

Upload the app package to Intune as a Line-of-Business app and assign it to the device group.. Intune natively supports deploying custom Line-of-Business (LOB) apps by uploading the app package (e.g., .msi, .exe, .appx) directly into the Intune console and assigning it to a device group. This method is the recommended approach for apps not available in the Microsoft Store, as it leverages Intune's mobile device management (MDM) capabilities to push the app to Windows 10 devices without requiring external infrastructure like Group Policy or the Microsoft Store for Business.

Answer

Add the app as a Microsoft Store app (business) in Intune.

Answer

Use Group Policy to deploy the app via a network share.

Answer

Publish the app to the Microsoft Store for Business and assign it.

Question 4

A company has purchased Microsoft 365 Business Standard and added the custom domain 'fabrikam.com' to the tenant. The company wants all new users to have 'fabrikam.com' as their default email domain instead of the onmicrosoft.com domain. How should the administrator achieve this?

Accepted Answer

In the admin center, go to Settings > Domains, select the custom domain, and click 'Set as default'.. The Microsoft 365 admin center provides a dedicated setting under Settings > Domains to mark a custom domain as the default email domain. Once set as default, all new users will automatically receive a primary email address using that domain instead of the initial onmicrosoft.com domain, without requiring manual changes or additional configuration.

Answer

Update the MX record in the DNS to point to Microsoft 365 with the custom domain.

Answer

Use the Exchange admin center to set the default email address policy to use the custom domain.

Answer

For each new user, manually add an email alias with the custom domain and remove the onmicrosoft.com alias.

Question 5

Your organization uses Microsoft Purview to classify and protect data. You need to create a custom sensitive info type that detects employee IDs formatted as 'EMP-XXXXX' where X is a digit. Which approach should you use?

Accepted Answer

Create a custom sensitive info type using a regular expression.. A custom sensitive info type using a regular expression is the best way to define the pattern 'EMP-XXXXX' (where X is a digit). Option B is incorrect because a keyword dictionary is used for exact word matching, not pattern matching. Option C is incorrect because Exact Data Match (EDM) requires a source of exact data values, not a pattern. Option D is incorrect because the built-in 'Employee ID' sensitive info type may not match this specific format.

Answer

Use a keyword dictionary for the pattern.

Answer

Use exact data match (EDM) based classification.

Answer

Use the built-in 'Employee ID' sensitive info type.

Question 6

A company uses Microsoft Entra ID P2 licenses and wants to block all authentication attempts from an internal legacy application that uses POP3 and SMTP protocols. The application cannot be updated and must be blocked from accessing Exchange Online. Which Conditional Access policy setting should the administrator configure?

Accepted Answer

Under 'Conditions' > 'Client apps', configure to block 'Exchange ActiveSync clients and other clients'. The legacy application uses POP3 and SMTP, which are non-modern authentication protocols. In Conditional Access, the 'Client apps' condition includes a setting to block 'Exchange ActiveSync clients and other clients', which specifically targets legacy authentication protocols like POP3, SMTP, and IMAP. This allows the administrator to block all authentication attempts from such clients without affecting modern authentication flows.

Answer

Under 'Grant', select 'Block access'

Answer

Under 'Conditions' > 'Device platforms', select 'Android' and 'iOS' and block them

Answer

Under 'Conditions' > 'Locations', select 'All trusted locations' and block

Question 7

A new employee has been hired and their account already exists in the on-premises Active Directory. The administrator needs to provide the employee with access to Microsoft 365 services as quickly as possible. What is the most efficient way to enable the user?

Accepted Answer

Sync the on-premises user using Azure AD Connect and then assign the license.. The user already exists in on-premises Active Directory, and the fastest way to enable Microsoft 365 access is to synchronize that identity using Microsoft Entra Connect. Once synchronized, the user object appears in Microsoft Entra ID (formerly Azure AD), and the administrator can immediately assign a license without re-creating the account. This avoids the delays of manual creation or guest invitations and leverages the existing identity lifecycle.

Answer

Create a new cloud-only user in the Microsoft 365 admin center and assign a license.

Answer

Manually create a user in Microsoft Entra ID with the same name and assign license.

Answer

Use Azure AD B2B collaboration to invite the on-premises user as a guest.

Question 8

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their Google Workspace credentials without creating external identities. What should you configure?

Accepted Answer

Configure SAML/WS-Fed identity provider federation with Google Workspace. Configuring SAML/WS-Fed identity provider federation with Google Workspace allows users to sign in using their Google Workspace credentials directly, without creating external identities. This federation establishes a trust relationship between Microsoft Entra ID and Google Workspace as an identity provider, enabling seamless authentication for users who already have Google accounts.

Answer

Enable Microsoft Entra Verified ID for Google Workspace users

Answer

Configure Google as a social identity provider in Microsoft Entra External ID

Answer

Configure Microsoft Entra B2B collaboration with Google Workspace

Question 9

The exhibit shows a KQL query used in Microsoft 365 Defender. The query returns no results for admin@contoso.com. What is the most likely reason?

Accepted Answer

Microsoft Defender for Identity is not enabled for the tenant.. The KQL query uses the `IdentityLogonEvents` table, which is populated by Microsoft Defender for Identity (MDI). If MDI is not enabled for the tenant, this table contains no data, so the query returns no results regardless of the user's role or query syntax. The query itself is syntactically correct and the role name 'GlobalAdministrator' is valid, but without MDI being provisioned, the table is empty.

Answer

The user does not have the Global Administrator role.

Answer

The KQL query syntax is invalid.

Answer

The role name in the query is misspelled.

Question 10

Your organization has a hybrid identity with Microsoft Entra Connect. You need to migrate from federation to password hash synchronization with seamless single sign-on (SSO). The migration must have minimal user impact. Which tool should you use?

Accepted Answer

Microsoft Entra Connect migration tool (Convert domain from federated to managed). The Microsoft Entra Connect migration tool (Convert domain from federated to managed) is the correct choice because it automates the conversion of federated domains to managed domains while enabling password hash synchronization (PHS) and seamless SSO. This tool minimizes user impact by allowing a staged migration where users can continue authenticating via federation until the conversion is complete, and it handles the necessary configuration changes in Microsoft Entra ID and on-premises Active Directory.

Answer

IdFix tool

Answer

AD FS Management console

Answer

Azure AD Connect wizard