MS-102 Practice Test 9 — 10 Questions

Question 1

Your company recently deployed Microsoft 365 Copilot. Users report that Copilot occasionally generates responses based on sensitive internal documents that should not be shared broadly. What should you configure to restrict Copilot's access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply sensitivity labels to the documents and configure label scopes to exclude Copilot.. Sensitivity labels can be configured with a label scope that excludes Copilot from accessing the labeled content. By applying a 'Confidential' sensitivity label with the 'Copilot' scope deselected, you instruct Microsoft 365 Copilot to ignore those documents during response generation, preventing it from surfacing sensitive internal information.

Answer

Create Data Loss Prevention (DLP) policies to block sharing.

Answer

Remove the sensitive documents from SharePoint Online.

Answer

Configure Microsoft Search to exclude the sensitive documents.

Question 2

A security administrator wants to configure Microsoft Defender for Cloud Apps to block downloads of sensitive files from Salesforce to unmanaged devices in real time. Which Defender for Cloud Apps component must be configured?

Accepted Answer

Conditional Access App Control. Conditional Access App Control (CAAC) is the correct component because it enables real-time session-level monitoring and control of user activities in SaaS apps like Salesforce. By integrating with Azure AD Conditional Access, CAAC can enforce policies to block downloads of sensitive files to unmanaged devices at the moment of access, using reverse proxy architecture to inspect and intervene in the traffic.

Answer

Cloud Discovery

Answer

App Connectors

Answer

Activity policies

Question 3

A company is planning to migrate from on-premises Exchange to Exchange Online and needs to ensure that mail flow can coexist between the two environments during the transition. Which tool should the administrator use to configure this hybrid deployment?

Accepted Answer

Exchange Hybrid Configuration Wizard. The Exchange Hybrid Configuration Wizard (HCW) is the correct tool because it automates the configuration of coexistence features between on-premises Exchange and Exchange Online, including mail flow routing, free/busy sharing, and OAuth authentication. It generates the necessary connectors and settings to support a hybrid deployment, ensuring seamless mail flow during migration.

Answer

Azure AD Connect

Answer

Microsoft 365 Admin Center

Answer

Exchange Admin Center

Question 4

You manage Microsoft Defender for Endpoint. A device is showing as 'Inactive' in the device inventory. The device is turned on and connected to the network. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Endpoint sensor is not reporting. An 'Inactive' status in Microsoft Defender for Endpoint means the sensor has not communicated with the cloud service for a defined period (typically 7 days). Since the device is on and connected, the most likely cause is that the Microsoft Defender for Endpoint sensor is not reporting. Option A is incorrect because the device is explicitly stated as turned on. Option B, while a firewall could potentially block communication, is less likely than sensor failure, and Defender for Endpoint uses HTTPS which is typically allowed. Option D is incorrect because a failed onboarding script would prevent the device from appearing or show it as 'Not onboarded', not 'Inactive'.

Answer

The device is turned off

Answer

A firewall is blocking communication with the Microsoft Defender for Endpoint cloud service

Answer

The onboarding script was not run successfully

Question 5

You are investigating an incident in Microsoft Defender XDR. The incident involves multiple alerts from different sources. Which THREE actions should you take during the investigation?

Accepted Answer

Review the incident timeline to understand the sequence of events.. Options A, C, and D are correct because during investigation, you should analyze alerts, gather evidence, and isolate affected devices. Option B is wrong because immediately deleting all related emails may destroy evidence. Option E is wrong because resetting passwords should be done after analysis.

Answer

Delete all emails related to the incident from all mailboxes.

Answer

Reset the passwords of all user accounts involved.

Question 6

Your organization has Microsoft Defender for Office 365 Plan 2. You need to ensure that when a user reports a phishing email using the Report Message add-in, the email is automatically submitted to Microsoft for analysis and the user is notified of the result. What should you configure?

Accepted Answer

Configure a submission policy in the Microsoft 365 Defender portal. Configuring a submission policy in the Microsoft 365 Defender portal defines the behavior for user-reported messages using the Report Message add-in, including automatic submission to Microsoft for analysis and notification of results. Option A is incorrect because Safe Links policies protect users from malicious links, not handle user submissions. Option B is incorrect because anti-phishing policies detect and mitigate phishing attempts but do not control the submission process. Option C is incorrect because mail flow rules (transport rules) manage message routing and cannot submit messages to Microsoft for analysis or notify users of results.

Answer

Create a Safe Links policy to block the reported email

Answer

Configure an anti-phishing policy to automatically submit reported emails

Answer

Use a mail flow rule to send reported emails to a custom mailbox

Question 7

Your organization uses Microsoft Defender for Cloud Apps. You want to control the use of personal cloud storage apps. Which TWO actions should you take?

Accepted Answer

Create a session policy to monitor and control downloads to personal cloud storage apps.. The correct answers are D and E. Option D is correct because session policies in Microsoft Defender for Cloud Apps (via Conditional Access App Control) allow you to monitor and control downloads to personal cloud storage apps in real time. Option E is correct because app governance provides visibility into app permissions and behaviors, enabling you to monitor and control which apps can access cloud storage. Option A is incorrect because a DLP policy prevents sharing of sensitive data but does not control the use of personal cloud storage apps directly. Option B is incorrect because a conditional access policy requiring managed apps controls access to corporate resources but does not specifically govern personal cloud storage usage. Option C is incorrect because blocking all personal cloud storage apps is overly restrictive; Defender for Cloud Apps supports granular controls through policies rather than blanket blocks.

Answer

Create a DLP policy to prevent sharing of sensitive data to personal cloud storage apps.

Answer

Create a conditional access policy to require managed apps for cloud storage.

Answer

Block all personal cloud storage apps using Defender for Cloud Apps.

Question 8

A new helpdesk administrator needs to be able to reset user passwords and manage user account properties, but should not be able to manage licenses or assign administrative roles. Which built-in role should be assigned?

Accepted Answer

User Administrator. The User Administrator role in Microsoft Entra ID is the correct choice because it includes permissions to reset passwords, manage user account properties (such as display name, job title, and department), and manage user licenses, while explicitly excluding the ability to assign administrative roles. The Helpdesk Administrator role can reset passwords but cannot manage user account properties or licenses, and the License Administrator role can only manage licenses, not user properties. The Global Administrator role has full access, which exceeds the required permissions. Therefore, User Administrator is the appropriate role.

Answer

Global Administrator

Answer

License Administrator

Answer

Helpdesk Administrator

Question 9

A compliance officer needs to ensure that all documents in a Microsoft Teams channel are automatically retained for 3 years after creation and then permanently deleted. The retention policy should apply only to the specific channel, not the entire team. Which approach should the officer use?

Accepted Answer

Publish a retention label to the channel and configure auto-application rules based on creation date. Documents in a Teams channel are stored in SharePoint. To automatically retain and then delete documents, you need a retention label with auto-application rules scoped to the channel's SharePoint site. This ensures documents are retained for 3 years from creation and then permanently deleted, without affecting other content.

Answer

Create a retention policy in Microsoft Purview and select the location 'Teams channel messages', then specify the channel name

Answer

Create a retention policy in Microsoft Purview and select the location 'Teams chats' for the entire team

Answer

Use Exchange Online PowerShell to create a retention policy for the channel mailbox

Question 10

Which TWO Microsoft Purview solutions are primarily used for data classification?

Accepted Answer

Auto-labeling. Auto-labeling applies labels based on sensitive info types. Sensitivity labels are the classification labels themselves. DLP is for protection. Data Lifecycle Management is for retention. Communication Compliance is for monitoring.

Answer

Data Loss Prevention

Answer

Communication Compliance

Answer

Data Lifecycle Management