MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 1 — 15 Questions

Question 1

An administrator is onboarding a new custom domain for email in a Microsoft 365 tenant. Which step should be performed first?

Accepted Answer

Add the domain in the Microsoft 365 admin center. Before you can use a custom domain for email or any other service in Microsoft 365, you must first add the domain to the tenant in the Microsoft 365 admin center. This creates the domain object in Azure Active Directory and initiates the verification process. Only after the domain is added can you proceed to verify ownership and configure DNS records.

Answer

Verify domain ownership by adding a TXT record

Answer

Configure DNS records for Microsoft services

Answer

Set the domain as the primary email domain

Question 2

A company wants to prevent their Microsoft 365 tenant from allowing external users to be invited by default. Only specific administrators should be able to invite guests. Which setting should be changed?

Accepted Answer

External Identities – External collaboration settings. The correct setting is under External Identities – External collaboration settings, specifically the 'Guest invite settings' option. By default, this is set to 'Anyone in the organization can invite guest users including guests and non-admins'. Changing it to 'Only users assigned to specific admin roles can invite guest users' restricts guest invitations to designated administrators, meeting the requirement to prevent default external user invitations.

Answer

Conditional Access policy to block external users

Answer

Tenant restrictions

Answer

B2B direct connect

Question 3

A company wants to allow users to log in to Microsoft 365 using their existing on-premises Active Directory credentials and ensure that password changes are reflected immediately in the cloud. Which authentication method should be implemented?

Accepted Answer

Pass-through Authentication (PTA). Both Pass-through Authentication (PTA) and Federation with AD FS authenticate users directly against on-premises Active Directory, so password changes are immediately effective for Microsoft 365 sign-in. Password Hash Synchronization (PHS) has a synchronization delay, and Azure AD Seamless SSO is not an authentication method by itself. The requirement does not distinguish between PTA and federation, so both B and C satisfy the stated requirement.

Answer

Password Hash Synchronization (PHS)

Answer

Azure AD Seamless SSO

Question 4

A newly hired administrator needs to manage user accounts, licenses, and reset passwords. Which portal should they access?

Accepted Answer

Microsoft 365 admin center. The Microsoft 365 admin center (admin.microsoft.com) is the primary portal for day-to-day user administration tasks such as creating and managing user accounts, assigning licenses, and resetting passwords. It provides a unified interface for these common identity and license management operations within a Microsoft 365 tenant.

Answer

Microsoft Entra admin center

Answer

Microsoft 365 Defender

Answer

Azure Active Directory admin center

Question 5

An organization wants to authenticate users using their on-premises Active Directory without synchronizing passwords to Microsoft Entra ID. Which identity model should they choose?

Accepted Answer

Federated identity. Federated identity allows users to authenticate against on-premises Active Directory using protocols such as WS-Federation, SAML 2.0, or AD FS, without synchronizing password hashes to Microsoft Entra ID. This model relies on a trust relationship between the on-premises identity provider and Entra ID, ensuring passwords never leave the local environment.

Answer

Synchronized identity

Answer

Cloud-only identity

Answer

Microsoft-managed identity

Question 6

An administrator has created a new user account in Microsoft Entra ID. To ensure the user has a mailbox in Exchange Online, what is the next step?

Accepted Answer

Assign an Exchange Online license to the user. In Microsoft 365, a user must be assigned an Exchange Online license (part of an E3, E5, or standalone plan) before a mailbox is automatically provisioned in Exchange Online. Without a license, the user object exists in Entra ID but has no mailbox; the license assignment triggers the mailbox creation process within 24 hours.

Answer

Create an Exchange mailbox manually

Answer

Run the Microsoft 365 Setup wizard

Answer

Configure DNS records for the domain

Question 7

An organization has registered the domain contoso.com and added it to their Microsoft 365 tenant. What is the next step to use this domain for user email addresses?

Accepted Answer

Add a DNS TXT record provided by Microsoft to the domain registrar. After adding a custom domain to Microsoft 365, the domain's ownership must be verified by adding a specific DNS TXT record provided by Microsoft at the domain registrar. This verification proves you control the domain and is a prerequisite before you can assign user email addresses or configure other DNS records like MX. Without this step, Microsoft 365 will not trust the domain for email routing.

Answer

Create user accounts with the new domain

Answer

Configure Exchange Online connectors

Answer

Set up MX records for email routing

Question 8

An administrator needs to delegate the ability to manage user licenses and assign roles to a junior admin, but without granting them access to the Microsoft 365 admin center's other settings. Which role should the junior admin be assigned?

Accepted Answer

License Administrator. The License Administrator role is the correct choice because it specifically grants the ability to assign and remove licenses for users, as well as manage their location, without providing access to other Microsoft 365 admin center settings like user creation, role assignment, or security features. This role is designed for delegated license management while maintaining least privilege.

Answer

User Administrator

Answer

Global Administrator

Answer

Helpdesk Administrator

Question 9

A company has purchased Microsoft 365 Business Premium and added a custom domain 'contoso.com' to the tenant. They want all new users to have email addresses like user@contoso.com instead of the default onmicrosoft.com domain. What should the administrator do in the Microsoft 365 admin center?

Accepted Answer

Set the custom domain as the default domain in the Domains settings.. Setting the custom domain as the default domain in the Domains settings ensures that any new user created in the Microsoft 365 admin center automatically receives an email address ending with @contoso.com instead of the default @<tenant>.onmicrosoft.com. This is the correct administrative action because the default domain setting controls the domain suffix applied to new user principal names (UPNs) and email addresses during user creation.

Answer

Add a DNS TXT record for the custom domain.

Answer

Change the primary domain in the tenant's organization profile.

Answer

Update the MX record for the custom domain to point to Exchange Online.

Question 10

An organization has just signed up for Microsoft 365 E3 with the initial domain 'contoso.onmicrosoft.com'. They need to create the first user accounts. What will be the default email address format for these new users if no custom domain is added yet?

Accepted Answer

user@contoso.onmicrosoft.com. When a new Microsoft 365 tenant is created with the initial domain 'contoso.onmicrosoft.com' and no custom domain has been added, the default email address format for new users is user@contoso.onmicrosoft.com. This is because the onmicrosoft.com domain is the default tenant domain provisioned by Azure AD, and all user principal names (UPNs) and email addresses are automatically assigned this suffix until a custom domain is verified and set as the primary domain.

Answer

user@contoso.com

Answer

user@microsoft.com

Answer

user@contoso.microsoft.com

Question 11

A company has just purchased Microsoft 365 Business Standard and added the custom domain 'fabrikam.com' to the tenant. They want to verify domain ownership. Which DNS record type must they add to their DNS provider?

Accepted Answer

TXT record. To verify domain ownership in Microsoft 365, you must add a TXT record containing a unique verification string provided by the Microsoft 365 admin center. The TXT record is the standard DNS record type used for domain validation because it can store arbitrary text data without affecting email routing or other services. Microsoft 365 checks for this specific TXT record to confirm you control the domain.

Answer

MX record

Answer

CNAME record

Answer

SPF record

Question 12

A company wants to display a custom help desk phone number and email on the Microsoft 365 sign-in page so that users can contact support easily. Which area of the Microsoft 365 admin center should the administrator use to configure this?

Accepted Answer

Settings > Org settings > Organization profile. The custom help desk contact information (phone number and email) for the Microsoft 365 sign-in page is configured under Settings > Org settings > Organization profile, specifically in the 'Custom branding' section. This setting allows administrators to add custom support contact details that appear on the sign-in page, enhancing user self-service and support accessibility.

Answer

Settings > Org settings > Security & privacy

Answer

Billing > Licenses

Answer

Health > Service Health

Question 13

An administrator needs to delegate the ability to view service health and manage service requests to a helpdesk team, without granting permissions to reset passwords, manage users, or access billing. Which built-in Microsoft 365 admin role should be assigned?

Accepted Answer

Service Support Administrator. The Service Support Administrator role is the correct built-in role because it grants the specific permissions needed to view service health and manage service requests in the Microsoft 365 admin center, while explicitly excluding permissions to reset passwords, manage users, or access billing. This role is designed for helpdesk teams that need to handle service incidents without broader administrative access.

Answer

Helpdesk Administrator

Answer

Service Administrator

Answer

Security Reader

Question 14

An administrator needs to delegate the ability to view sign-in logs, audit logs, and security recommendations to a junior admin without granting any other administrative permissions. The junior admin should not be able to reset passwords or modify settings. Which built-in Microsoft Entra role should the administrator assign?

Accepted Answer

Security Reader. The Security Reader role in Microsoft Entra ID grants read-only access to security-related data, including sign-in logs, audit logs, and security recommendations, without permissions to modify settings or reset passwords. The Reports Reader role exists but only covers sign-in and audit logs, not security recommendations, making Security Reader the correct choice.

Answer

Global Reader

Answer

Reports Reader

Answer

Security Administrator

Question 15

An administrator wants to customize the Microsoft 365 sign-in page to display the company logo and custom sign-in text. Where in the Microsoft 365 admin center should the administrator go to configure this?

Accepted Answer

Microsoft Entra admin center > User settings > Company branding. Company branding for the Microsoft 365 sign-in page, including logo and sign-in text, is configured in the Microsoft Entra admin center (User settings > Company branding), not in the Microsoft 365 admin center. The question must be rephrased to not restrict to the M365 admin center, or no correct option exists.

Answer

Settings > Org settings > Organization profile

Answer

Security & Compliance center > Data classification

Answer

Exchange admin center > Mail flow > Accepted domains