MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 10 — 15 Questions

Question 1

A global administrator wants to track service health issues and configure notifications for service incidents. Which portal should they use to view the current health status and set up email notifications?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft 365 admin center. The Microsoft 365 admin center provides the Service Health dashboard under Health > Service Health, which displays the current status of all Microsoft 365 services and allows administrators to configure email notifications for service incidents. This is the designated portal for managing tenant-wide service health and notifications, aligning with the role of a global administrator.

Answer

Azure portal

Answer

Microsoft 365 Defender portal

Answer

Microsoft Purview compliance portal

Question 2

A company has a Microsoft 365 tenant with the domain contoso.com. They acquire a subsidiary with the domain fabrikam.com and want to add it as an additional domain to the same tenant. The domain is already purchased and DNS management is available. What is the first step the administrator should take in the Microsoft 365 admin center?

Accepted Answer

Add the domain and verify ownership by adding a TXT record. To add an existing domain like fabrikam.com to a Microsoft 365 tenant, the first step is to add the domain in the Microsoft 365 admin center and then verify ownership by adding a TXT record to the domain's DNS zone. This verification proves the administrator controls the domain, which is a prerequisite for using it with Microsoft 365 services such as Exchange Online or SharePoint.

Answer

Create a new tenant for fabrikam.com

Answer

Set up email forwarding from contoso.com to fabrikam.com

Answer

Convert fabrikam.com to a federated domain

Question 3

A new administrator needs to automatically assign Microsoft 365 E5 licenses to all users in the Sales department. The Sales department is identified by the 'department' attribute in Azure AD. Which licensing method should the administrator use to minimize manual effort?

Accepted Answer

Group-based licensing using a dynamic group. Group-based licensing using a dynamic group is the correct method because it automatically assigns Microsoft 365 E5 licenses to all users in the Sales department based on the 'department' attribute in Microsoft Entra ID. Dynamic groups evaluate membership rules in real time, so when a user's department attribute is set to 'Sales', the license is assigned without manual intervention. This minimizes administrative effort by eliminating the need for per-user or batch operations.

Answer

Manual license assignment per user

Answer

PowerShell script to assign licenses

Answer

Bulk license assignment via CSV file

Question 4

An organization wants to receive email notifications for all service health incidents. Which role must an administrator have to configure service health notifications in the Microsoft 365 admin center?

Accepted Answer

Global Administrator. Only the Global Administrator role has the necessary permissions to access and modify the Service Health section in the Microsoft 365 admin center, including configuring email notifications for service health incidents. This is because the Global Administrator role is the highest privileged role and is required to manage tenant-wide settings such as service health alerts, which are not delegated to lower-level administrative roles.

Answer

Service Support Administrator

Answer

Helpdesk Administrator

Answer

Billing Administrator

Question 5

An administrator wants to add a custom domain 'contoso.com' to a new Microsoft 365 tenant. The domain is already registered and available. What is the first step the administrator should perform in the Microsoft 365 admin center?

Accepted Answer

Add the domain and verify ownership by creating a TXT record. The first step when adding a custom domain to a Microsoft 365 tenant is to add the domain in the admin center and then verify ownership by creating a TXT record in the domain's DNS zone. This proves you control the domain before any services (like email or SharePoint) can be configured. Without verification, Microsoft 365 will not allow further domain-related setup.

Answer

Create user accounts with the new domain

Answer

Configure email routing with MX records

Answer

Set up SharePoint Online with the new domain

Question 6

A company has a Microsoft 365 tenant with domain contoso.com. They own an additional domain fabrikam.com and have already added and verified it with a TXT record. Now they need to configure email to be routed to Exchange Online for fabrikam.com. Which DNS record must they create?

Accepted Answer

MX record pointing to contoso-com.mail.protection.outlook.com. To route email for fabrikam.com to Exchange Online, you must create an MX record that points to the Exchange Online mail exchanger. The correct target is contoso-com.mail.protection.outlook.com, where 'contoso-com' is the hashed version of the primary domain (contoso.com) used by Microsoft 365. This MX record tells the internet's mail servers to deliver messages addressed to @fabrikam.com into the tenant's Exchange Online environment.

Answer

CNAME record for autodiscover

Answer

TXT record for SPF

Answer

SRV record for SIP

Question 7

An administrator needs to add a custom domain 'contoso.org' to their Microsoft 365 tenant. They have already purchased the domain and have access to the DNS registrar. What is the first step the administrator should perform in the Microsoft 365 admin center?

Accepted Answer

Add the domain in the Microsoft 365 admin center. The first step to add a custom domain to a Microsoft 365 tenant is to initiate the domain addition process in the Microsoft 365 admin center. This triggers Microsoft to generate the unique verification TXT record that must be published in the public DNS zone. Without first adding the domain in the admin center, the administrator would not know the specific verification string required for the TXT record.

Answer

Add a TXT record in the public DNS zone

Answer

Configure email routing (MX record)

Answer

Create user accounts with the new domain

Question 8

An organization plans to automatically assign Microsoft 365 E3 licenses to all users in the 'Finance' department. The Finance department is identified by the 'Department' attribute in Azure AD. Which method should the administrator use to minimize manual effort?

Accepted Answer

Group-based licensing using a dynamic group with the rule 'user.department -eq "Finance"'. Dynamic group licensing in Microsoft Entra ID uses attribute-based membership rules, so a rule like 'user.department -eq "Finance"' automatically adds all Finance users to the group. Assigning the Microsoft 365 E3 license to that group means every current and future Finance user receives the license without manual intervention, which is the lowest-effort, most scalable approach.

Answer

Manual assignment using PowerShell

Answer

Bulk assignment using a CSV file

Answer

Self-service licensing portal

Question 9

An administrator recently added a custom domain 'tailspintoys.com' to their Microsoft 365 tenant and verified it. They now need to configure the domain so that all recipient email addresses for 'info@tailspintoys.com' are delivered to a shared mailbox in Exchange Online. The domain is currently set as internal relay. What should the administrator do first to route email for this domain to Exchange Online?

Accepted Answer

Change the domain type from 'Internal relay' to 'Authoritative' in Exchange admin center. When a domain is set to 'Internal relay' in Exchange Online, the service expects to relay messages to an on-premises server for that domain. To have Exchange Online accept and deliver messages directly to a shared mailbox (or any hosted recipient), the domain must be changed to 'Authoritative'. This tells Exchange Online that it is the final destination for all recipients in that domain, enabling local delivery.

Answer

Update the MX record at the DNS registrar to point to Exchange Online

Answer

Create the shared mailbox 'info@tailspintoys.com' in Exchange Online

Answer

Disable the internal relay option for the domain in the Microsoft 365 admin center

Question 10

An administrator wants to verify ownership of a custom domain 'adatum.com' in their Microsoft 365 tenant. They have already added the domain and received the TXT record value. However, the administrator's DNS hosting provider does not support adding a TXT record. Which alternative record type can be used for domain verification?

Accepted Answer

MX record. When a DNS hosting provider does not support TXT records, Microsoft 365 allows the use of an MX record as an alternative for domain verification. The administrator creates an MX record with a specific subdomain (e.g., 'adatum-com.mail.protection.outlook.com') and a custom priority value provided in the TXT record value, which Microsoft's verification system checks to confirm domain ownership. This method is supported because MX records are widely available and can carry the necessary verification data in their format.

Answer

record

Answer

SRV record

Answer

NS record

Question 11

You are planning the initial deployment of a new Microsoft 365 tenant for Contoso Ltd. Which three of the following actions are required or recommended as part of the tenant provisioning and initial configuration process? (Choose three.)

Accepted Answer

Create the initial global administrator account with a strong, unique password and enable multi-factor authentication.. Registering and verifying a custom domain (e.g., contoso.com) via a DNS TXT record is a required step to use your own domain for email and user identities instead of the default onmicrosoft.com domain. Creating the initial global administrator account with a strong password and enabling multi-factor authentication (MFA) is a critical security best practice and is recommended by Microsoft to protect the highest-privileged role. Configuring tenant-wide service settings, such as external sharing for SharePoint and OneDrive, is recommended during initial setup to align with organizational security and collaboration policies before users begin working.

Answer

Assign Microsoft 365 licenses to all user accounts before creating the accounts.

Answer

Set up a secondary domain as the default email domain to avoid conflicts with the initial onmicrosoft.com domain.

Answer

Configure the default tenant-level password expiration policy to 90 days using the Microsoft 365 admin center.

Question 12

As a Microsoft 365 administrator, you need to manage tenant health and adoption effectively. Which three of the following tools or features should you use to monitor and improve your Microsoft 365 tenant's performance and user engagement? (Choose three.)

Accepted Answer

Microsoft 365 usage analytics in Power BI to gain deeper insights into adoption trends.. The Microsoft 365 admin center dashboard provides a centralized view of service health, message center posts, and usage reports, enabling administrators to monitor service availability, planned changes, and user activity. This is a core tool for maintaining tenant health and tracking adoption.

Answer

Microsoft 365 network connectivity test tool to evaluate network performance for Microsoft 365 services.

Answer

Microsoft Purview compliance portal to enforce data loss prevention policies.

Answer

Azure AD Identity Protection to detect sign-in risks and block compromised accounts.

Question 13

Drag and drop the steps to deploy Microsoft Defender for Office 365 policies in the correct order.

Accepted Answer

Create the policy, configure protection settings, specify recipients, enable the policy. Defender for Office 365 policies are created in the Defender portal, configured with threat protection settings, and applied to recipients.

Answer

Create the policy, specify recipients, configure protection settings, enable the policy

Answer

Configure protection settings, create the policy, specify recipients, enable the policy

Answer

Create the policy, enable the policy, configure protection settings, specify recipients

Question 14

Drag and drop the steps to configure role-based access control (RBAC) in Microsoft 365 Defender in the correct order.

Accepted Answer

Create or edit RBAC roles in Microsoft 365 Defender, then assign permissions to the roles, then assign the roles to users or groups.. RBAC roles are created/edited in Defender, permissions assigned, and then assigned to users/groups.

Answer

Assign permissions to the roles, then create or edit RBAC roles, then assign the roles to users or groups.

Answer

Create or edit RBAC roles, then assign the roles to users or groups, then assign permissions to the roles.

Answer

Assign the roles to users or groups, then create or edit RBAC roles, then assign permissions to the roles.

Question 15

Your organization plans to migrate from on-premises Exchange to Exchange Online. You need to ensure minimal disruption during the migration. Which approach should you recommend?

Accepted Answer

Deploy a hybrid configuration and migrate mailboxes in batches.. A hybrid configuration with batch migration is the recommended approach for minimal disruption because it allows coexistence between on-premises Exchange and Exchange Online, enabling gradual mailbox moves while maintaining free/busy, calendar sharing, and mail flow. Batch migration lets you schedule and control the pace, reducing user impact and allowing rollback if issues arise.

Answer

Perform a cutover migration during a weekend.

Answer

Use IMAP migration to migrate all mailboxes in parallel.

Answer

Use a third-party migration tool for a one-time bulk migration.