MS-102 Practice Test 9 — 10 Questions

Question 1

Drag and drop the steps to configure Microsoft 365 Groups expiration policy in the correct order.

Accepted Answer

Step 1: Go to Microsoft 365 admin center > Groups > Expiration. Step 2: Set the expiration duration. Step 3: Configure notification settings. Step 4: Save the policy.. Groups expiration policy is set in the admin center with a duration, notification owner, and deletion behavior.

Answer

Step 1: Set the expiration duration. Step 2: Go to Microsoft 365 admin center > Groups > Expiration. Step 3: Configure notification settings. Step 4: Save the policy.

Answer

Step 1: Go to Microsoft 365 admin center > Groups > Expiration. Step 2: Configure notification settings. Step 3: Set the expiration duration. Step 4: Save the policy.

Answer

Step 1: Go to Microsoft 365 admin center > Groups > Expiration. Step 2: Set the expiration duration. Step 3: Save the policy. Step 4: Configure notification settings.

Question 2

You are the Microsoft 365 Administrator for a multinational organization that must comply with various regulatory requirements, including GDPR, SOX, and internal data retention policies. You are deploying Microsoft Purview compliance solutions. Which four of the following actions are valid steps when managing compliance using Microsoft Purview? (Choose all that apply. There are four correct answers.)

Accepted Answer

Configure a sensitivity label with sublabels that apply different markings (e.g., 'Confidential' and 'Highly Confidential') to the same document.. Creating a DLP policy that prevents sharing credit card numbers via email with external recipients is a valid step because Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive information types (e.g., credit card numbers) and enforce actions such as blocking external sharing. This directly supports compliance with regulations like GDPR and SOX by preventing unauthorized data exfiltration.

Answer

Assign a retention policy to a user's mailbox that deletes all emails immediately after they are sent.

Answer

Apply a sensitivity label to a SharePoint site that blocks all external sharing of documents stored in that site.

Question 3

You are planning the initial deployment of a new Microsoft 365 tenant for Contoso Ltd. Which three of the following actions are required or recommended as part of the tenant provisioning and initial configuration process? (Choose three.)

Accepted Answer

Register a custom domain name (e.g., contoso.com) and verify ownership via DNS TXT record.. Registering and verifying a custom domain (e.g., contoso.com) via a DNS TXT record is a required step to use your own domain for email and user identities instead of the default onmicrosoft.com domain. Creating the initial global administrator account with a strong password and enabling multi-factor authentication (MFA) is a critical security best practice and is recommended by Microsoft to protect the highest-privileged role. Configuring tenant-wide service settings, such as external sharing for SharePoint and OneDrive, is recommended during initial setup to align with organizational security and collaboration policies before users begin working.

Answer

Set up a secondary domain as the default email domain to avoid conflicts with the initial onmicrosoft.com domain.

Answer

Configure the default tenant-level password expiration policy to 90 days using the Microsoft 365 admin center.

Answer

Assign Microsoft 365 licenses to all user accounts before creating the accounts.

Question 4

Match each Microsoft 365 service to its primary purpose.

Accepted Answer

Exchange Online: Email hosting and calendaring. The correct matches associate Exchange Online with email and calendaring, SharePoint Online with document management and collaboration, Microsoft Teams with chat and meetings, and OneDrive for Business with personal cloud storage. Common confusions include misassigning Exchange's purpose to OneDrive or OneDrive's purpose to SharePoint.

Answer

OneDrive for Business: Email hosting and calendaring

Answer

SharePoint Online: Personal cloud storage

Question 5

An organization needs to restrict access to Microsoft 365 admin center to only specific users. Which approach should be used?

Accepted Answer

Create a Conditional Access policy targeting the Microsoft Admin Portals cloud app. A Conditional Access policy targeting the 'Microsoft Admin Portals' cloud app allows granular control over which users can access the Microsoft 365 admin center. This policy can enforce conditions such as user/group membership, device compliance, or location to restrict access, ensuring only specific authorized users can reach the admin portals.

Answer

Enable MFA for all admins

Answer

Assign Global Admin role only to required users

Answer

Use Privileged Identity Management

Question 6

Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM) to manage administrative roles. You need to ensure that when a user activates the Global Administrator role, they must provide a justification and the activation is time-bound. Additionally, you want to require approval from the security team for this activation. What should you configure?

Accepted Answer

Modify the PIM role settings for Global Administrator to require justification, set maximum activation duration, and require approval. Privileged Identity Management (PIM) role settings allow you to enforce activation requirements such as justification, maximum activation duration, and approval. These settings are configured directly in the PIM role settings for the Global Administrator role, ensuring that every activation request is justified, time-bound, and requires approval from designated approvers (e.g., the security team).

Answer

Configure an Identity Protection user risk policy for Global Administrators

Answer

Create an Access Review for Global Administrator role

Answer

Configure a Conditional Access policy requiring MFA for Global Administrator activation

Question 7

A compliance officer needs to prevent users from sending emails that contain credit card numbers to external recipients. When a user attempts to send such an email, the action should be blocked and a policy tip should be displayed in Outlook telling them why the email was blocked. Which Microsoft Purview solution should be configured?

Accepted Answer

Data Loss Prevention (DLP) policy. A Data Loss Prevention (DLP) policy in Microsoft Purview is designed to detect and block sensitive information, such as credit card numbers, from being sent to external recipients. When configured with a 'Block' action and a policy tip, it prevents the email from being sent and displays a customizable notification in Outlook explaining the reason. This directly meets the compliance officer's requirement to block the email and show a policy tip.

Answer

Retention label policy

Answer

Microsoft Purview Information Protection sensitivity label

Answer

Compliance Manager

Question 8

You manage a Microsoft 365 tenant for a multinational corporation. You need to implement Microsoft Purview Information Protection to automatically classify and protect documents containing credit card numbers. The solution must apply encryption automatically when a document is saved to SharePoint Online. What should you do?

Accepted Answer

Create an auto-labeling policy in Microsoft Purview that uses a sensitivity label configured with encryption.. To automatically classify and protect documents containing credit card numbers with encryption when saved to SharePoint Online, you should create an auto-labeling policy in Microsoft Purview that uses a sensitivity label configured with encryption. Auto-labeling policies can detect sensitive information types (e.g., credit card numbers) and automatically apply the label, which enforces encryption.

Answer

Create a DLP policy in Microsoft Purview that blocks sharing of documents containing credit card numbers.

Answer

Configure client-side labeling via Microsoft 365 Apps to prompt users to label documents.

Answer

Set a default sensitivity label for SharePoint Online document libraries.

Question 9

You are the Microsoft 365 administrator for a company that uses Microsoft 365 E5. The company has a hybrid deployment with Exchange Server 2019 on-premises and Exchange Online. You need to configure a mail flow rule that adds a disclaimer to all emails sent from on-premises mailboxes to external recipients. The disclaimer must be applied only to messages that originate from on-premises and are sent to external domains. What should you do?

Accepted Answer

Create a mail flow rule in the EAC in Exchange Online. Set the rule to apply to messages sent to 'Outside the organization'. Add a condition 'The sender is located' and select 'Inside the organization'. Add an action to prepend a disclaimer. Enable the rule.. In a hybrid deployment, on-premises mailboxes are considered part of the organization by Exchange Online. Therefore, a mail flow rule in Exchange Online that applies to messages sent to 'Outside the organization' and has a condition that the sender is located 'Inside the organization' will correctly match messages originating from on-premises mailboxes and sent to external recipients. The disclaimer action then adds the required text. This is the standard and most reliable method for applying disclaimers to outbound mail from on-premises senders in a hybrid environment.

Answer

Create a mail flow rule in the EAC in Exchange Online. Set the rule to apply to messages sent to 'Outside the organization'. Add a condition 'The sender is located' and select 'Inside the organization'. Add an action to prepend a disclaimer. Then create a second rule that applies to messages sent from on-premises mailboxes using a header condition, and block the first rule.

Answer

Create a mail flow rule in the EAC on the on-premises Exchange Server. Set the rule to apply to messages sent to 'Outside the organization'. Add an action to prepend a disclaimer. Enable the rule.

Answer

Create a mail flow rule in the Exchange admin center (EAC) in Exchange Online. Set the rule to apply to messages sent to 'Outside the organization'. Add a condition 'The sender is located' and select 'Outside the organization'. Add an action to prepend a disclaimer. Enable the rule.

Question 10

You are the Microsoft 365 administrator for a company that uses Microsoft 365 E5. The company has a Microsoft Entra tenant with 10,000 users. You need to ensure that when users sign in to Microsoft 365 from unmanaged devices, they are required to use multi-factor authentication (MFA) and cannot download files from SharePoint Online. Users on managed devices should not be prompted for MFA and should be able to download files. What should you configure?

Accepted Answer

Create a conditional access policy that targets all users and SharePoint Online, set the device state condition to 'Include: Unmanaged', and grant access with 'Require multifactor authentication' and 'Require app enforced restrictions'.. A conditional access policy targeting unmanaged devices with MFA and app enforced restrictions ensures that users on unmanaged devices must use MFA and are subject to restrictions that prevent downloads from SharePoint Online. Managed devices are not targeted by this policy, so they are not prompted for MFA and can download files.

Answer

Create a conditional access policy that targets all users and SharePoint Online, set the device state condition to 'Include: Unmanaged', and grant access with 'Require multifactor authentication' and 'Require device to be marked as compliant'.

Answer

Create a conditional access policy that targets all users and SharePoint Online, set the device state condition to 'Exclude: Unmanaged', and grant access with 'Require multifactor authentication' and 'Require app enforced restrictions'.

Answer

Create a conditional access policy that targets all users and SharePoint Online, set the device state condition to 'Include: Unmanaged', and grant access with 'Require device to be marked as compliant' and 'Require app enforced restrictions'.