MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 10 — 15 Questions

Question 1

Your organization has a Microsoft 365 E5 tenant. You need to ensure that users are prompted to register for multifactor authentication (MFA) the first time they sign in. Which Microsoft Entra ID policy should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Conditional Access policy requiring MFA and enable Microsoft Entra ID Identity Protection to enforce MFA registration. Combining a Conditional Access policy that requires MFA with Identity Protection's MFA registration policy ensures users are prompted to register for MFA at first sign-in. The MFA registration policy in Identity Protection specifically enforces that users must register their authentication methods before accessing applications, which triggers the registration prompt on initial authentication.

Answer

Enable Security defaults

Answer

Enable combined registration for SSPR and MFA

Answer

Configure MFA service settings per-user

Question 2

Your company recently acquired a subsidiary that uses a different Microsoft 365 tenant. You are tasked with merging the two tenants into one. The subsidiary has 1,500 users with unique email domains. You need to migrate all users, mailboxes, and SharePoint data while minimizing downtime and preserving data integrity. You have access to both tenants as global admin. What should you do first?

Accepted Answer

Use a third-party migration tool such as BitTitan MigrationWiz to perform the migration. Microsoft does not provide a native tool for merging two tenants; third-party tools like BitTitan MigrationWiz are designed specifically for cross-tenant migrations, supporting mailbox, SharePoint, and user data migration with minimal downtime and data integrity. These tools handle directory synchronization, mailbox rehydration, and SharePoint content mapping, which are critical for a 1,500-user migration with unique domains.

Answer

Add the subsidiary's domain to the primary tenant, then delete the subsidiary tenant and recreate users

Answer

Use the Microsoft 365 Merger Center in the admin portal

Answer

Use Microsoft's native tenant-to-tenant migration by moving mailboxes via PowerShell and exporting SharePoint content

Question 3

Your organization uses Microsoft 365 Copilot for Sales. You need to ensure that only licensed users can access Copilot features, and that usage is monitored for compliance. What should you configure?

Accepted Answer

Assign Copilot licenses to users in the Microsoft 365 admin center and monitor usage via the Reports dashboard. Licensing for Microsoft 365 Copilot for Sales is controlled through the Microsoft 365 admin center by assigning Copilot licenses to individual users. Usage monitoring is then available via the Reports dashboard, which provides adoption and usage metrics for licensed users. This ensures only licensed users access Copilot features and allows compliance monitoring without additional configuration.

Answer

Assign the Copilot Administrator role to users in Microsoft Entra ID

Answer

Configure a Microsoft Purview compliance policy for Copilot

Answer

Use PowerShell to assign Copilot licenses and enable audit logging in Microsoft Sentinel

Question 4

Your company has a Microsoft 365 E3 tenant. You need to enable Microsoft Purview Data Loss Prevention (DLP) to prevent sensitive data from being shared externally via email. What must you do first?

Accepted Answer

Navigate to the Microsoft Purview compliance portal and create a DLP policy. Microsoft 365 E3 includes DLP capabilities for Exchange Online via the Microsoft Purview compliance portal. Therefore, the correct first step is to navigate to the Microsoft Purview compliance portal and create a DLP policy (option B). Upgrading to E5 or purchasing a DLP add-on (option D) is not required for Exchange Online DLP in E3.

Answer

Create a DLP policy in Microsoft Defender XDR

Answer

Use Exchange Online PowerShell to configure DLP rules

Answer

Upgrade to Microsoft 365 E5 or purchase a DLP add-on

Question 5

Your organization has a Microsoft 365 tenant with 10,000 users. You are configuring Microsoft Entra ID Identity Protection to detect risky sign-ins. You need to ensure that when a sign-in risk level of 'High' is detected, the user is blocked from signing in and an administrator is notified. What should you configure?

Accepted Answer

Create a Conditional Access policy with 'Sign-in risk' condition set to 'High' and 'Block access', and configure alert notifications in Identity Protection. It combines a Conditional Access policy that blocks access when the sign-in risk level is 'High' with an alert notification configured in Identity Protection. The Conditional Access policy enforces the block at the authentication level, while the Identity Protection alert ensures administrators are notified of the high-risk sign-in event. This directly meets the requirement to both block the user and notify an admin.

Answer

Create a user risk policy in Identity Protection to block high-risk users

Answer

Create an MFA registration policy in Identity Protection

Answer

Enable Security defaults and configure notifications

Question 6

Your organization uses Microsoft Intune for mobile device management (MDM). You need to enforce that all iOS and Android devices must have a screen lock password of at least 6 characters before they can access corporate email. What should you configure?

Accepted Answer

Create a device configuration profile to set a passcode policy of 6 characters. A device configuration profile (or device restrictions policy) in Microsoft Intune enforces device-level passcode requirements on iOS and Android. By setting the passcode length to at least 6 characters, the policy enforces the screen lock password on the device itself. This is a device-level setting, not an app-level PIN, so it directly meets the requirement for a screen lock password. To access corporate email, the device must have the required screen lock password enforced via configuration.

Answer

Create an app protection policy in Microsoft Intune targeting iOS and Android with a minimum PIN length of 6

Answer

Create a Conditional Access policy requiring compliant devices

Answer

Create a device compliance policy requiring a password length of 6

Question 7

Your company is implementing Microsoft 365 Copilot for Microsoft 365. You need to ensure that Copilot can access data from across the organization, but only for users who have the appropriate permissions. What is the primary security boundary for Copilot data access?

Accepted Answer

Microsoft 365 permissions and sensitivity labels. Microsoft 365 Copilot respects the existing Microsoft 365 permissions model and sensitivity labels. Copilot only surfaces data that the user already has permission to access, using the same permissions and labels that govern access in Microsoft 365. There is no separate Copilot-specific security group (B). Purview Information Protection labels (C) are part of the permissions model but not the primary boundary; the primary boundary is the combination of permissions and sensitivity labels. Geographic location (D) does not determine data access.

Answer

A dedicated Copilot security group in Microsoft Entra ID

Answer

Microsoft Purview Information Protection labels

Answer

The geographic location of the data

Question 8

Your organization recently deployed Microsoft Defender for Office 365. Users report that some legitimate external emails are being quarantined as phishing attempts. You need to reduce false positives without compromising security. What should you do?

Accepted Answer

Add the sender domains to the allowed senders list in the anti-phishing policy. Adding the sender domains to the allowed senders list in the anti-phishing policy explicitly whitelists those domains for phishing checks, reducing false positives while still scanning for other threats. This approach preserves security by not lowering the overall spam filtering threshold or disabling protections, and it targets only the specific domains that are being incorrectly flagged.

Answer

Increase the Spam Confidence Level (SCL) threshold to 9

Answer

Disable the anti-phishing policy and use a custom mail flow rule

Answer

Change the spam filtering action to 'Move message to Junk Email folder' instead of quarantine

Question 9

Your organization uses Microsoft Sentinel for security operations. You need to ensure that Sentinel can ingest logs from Microsoft 365 Defender (XDR) and Microsoft Entra ID. Which THREE data connectors should you enable? (Choose three.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint is a correct data connector because it ingests endpoint detection and response (EDR) logs from Windows, macOS, and Linux devices into Microsoft Sentinel. This integration allows security operations to correlate endpoint alerts with other signals, enabling advanced hunting and automated incident response across the Microsoft 365 Defender ecosystem.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Intune

Question 10

Your company is planning to use Microsoft 365 Copilot for Microsoft 365. Which THREE prerequisites are required for Copilot to function? (Choose three.)

Accepted Answer

Microsoft Entra ID (formerly Azure AD). Microsoft Entra ID (formerly Azure AD) is required because Copilot for Microsoft 365 relies on Entra ID for authentication, identity management, and policy enforcement. Without Entra ID, Copilot cannot verify user identities, apply conditional access policies, or access Microsoft Graph to retrieve user and organizational data.

Answer

Microsoft Sentinel for security monitoring

Answer

Microsoft Intune for mobile device management

Question 11

Refer to the exhibit. You are reviewing an app registration in Microsoft Entra ID for the Microsoft Teams Admin Center. The permission shown is for another resource. What is the consequence of this permission configuration?

Accepted Answer

The app can access Microsoft Graph data without a signed-in user, and admin consent is required. The exhibit shows an application permission (not a delegated permission) for Microsoft Graph, which means the app can access data without a signed-in user. Admin consent is required because application permissions grant tenant-wide access and cannot be consented to by individual users. This is why option A is correct.

Answer

The app can only be used by users who have consented to the permission

Answer

The app can access Teams data but not other Microsoft 365 data

Answer

The app can access Microsoft Graph on behalf of the signed-in user only

Question 12

Refer to the exhibit. You run the PowerShell commands shown. The output displays 10 mailboxes with various RecipientTypeDetails, including UserMailbox, SharedMailbox, and RoomMailbox. You need to ensure that only user mailboxes are returned. What should you modify?

Accepted Answer

Add the parameter -Filter "RecipientTypeDetails -eq 'UserMailbox'". The Get-Mailbox cmdlet returns all mailbox types by default. To filter only user mailboxes, you must use the -Filter parameter with the condition 'RecipientTypeDetails -eq 'UserMailbox''. This ensures that only mailboxes with RecipientTypeDetails set to UserMailbox are returned, excluding shared, room, and other mailbox types.

Answer

Use the -Properties parameter to specify additional attributes

Answer

Change RecipientTypeDetails to RecipientType in the Select-Object

Answer

Remove the -ShowProgress parameter

Question 13

You are a Microsoft 365 administrator for Contoso Corporation, a multinational company with 20,000 users. The company uses Microsoft 365 E5, Microsoft Entra ID P2, Microsoft Defender XDR, Microsoft Purview, and Microsoft Intune. The security team wants to implement a zero-trust access model. Requirements: 1. All access to corporate resources must require multifactor authentication (MFA) and device compliance. 2. Users must register for MFA before accessing any app. 3. Legacy authentication protocols must be blocked for all users. 4. External collaboration must be governed by identity governance. 5. Sensitive data in SharePoint Online must be protected by DLP. 6. All administrative actions must be audited. You need to design the configuration. Which combination of actions should you take?

Accepted Answer

Create Conditional Access policies requiring MFA and compliant devices, block legacy auth, enforce MFA registration via Identity Protection, set up Microsoft Entra ID Governance for external users, configure Purview DLP for SharePoint, and enable Purview Audit. It correctly combines Conditional Access policies requiring MFA and compliant devices, blocking legacy auth, using Identity Protection to enforce MFA registration, Microsoft Entra ID Governance for external users, Purview DLP for SharePoint, and Purview Audit for admin actions, meeting all requirements. Option A is wrong because Security defaults are less granular and may not block legacy auth for all users. Option B is wrong because Intune compliance policies alone do not enforce MFA. Option C is wrong because per-user MFA is less secure and Microsoft Sentinel is not the primary audit log for admin actions (Purview Audit is correct).

Answer

Enable Security defaults, configure SharePoint DLP, and use Microsoft Purview Audit for admin actions

Answer

Create a Conditional Access policy requiring MFA, block legacy auth, and use Microsoft Defender for Cloud Apps to monitor admin actions

Answer

Use Microsoft Intune compliance policies, enable MFA per-user, and deploy Microsoft Sentinel for auditing

Question 14

Your organization uses Microsoft 365 E5 licenses. You need to ensure that all external sharing links for SharePoint Online expire after 30 days by default. You configure this in the SharePoint admin center. However, users report that links created before the change still do not have an expiration. What should you do?

Accepted Answer

Run Set-SPOTenant -DefaultSharingLinkExpirationInDays 30.. The `Set-SPOTenant -DefaultSharingLinkExpirationInDays 30` command sets the default expiration for newly created sharing links to 30 days. However, this setting does not apply retroactively to existing links. Users reporting that pre-existing links lack expiration is expected behavior. To enforce expiration on existing links, you would need to use a PowerShell script to update each link individually. Option A (`-RequireAcceptingAccountMatchInvitedAccount`) immediately invalidates anonymous links by requiring account matching, which is not the same as adding a 30-day expiration. Option B is ineffective, and Option D does not manage link expiration.

Answer

Use the Set-SPOTenant -RequireAcceptingAccountMatchInvitedAccount parameter.

Answer

Reconfigure the setting in SharePoint admin center and save again.

Answer

Create a data loss prevention (DLP) policy in Microsoft Purview to block unexpired links.

Question 15

Your company has a Microsoft 365 E5 subscription. You need to configure multi-factor authentication (MFA) for all users. However, the CEO insists that he should not be prompted for MFA when connecting from the corporate office. What should you do?

Accepted Answer

Create a Conditional Access policy that excludes the corporate office named location from requiring MFA.. Named locations in Microsoft Entra ID Conditional Access allow you to define trusted IP ranges (e.g., corporate office) and exclude them from MFA requirements. Option A is wrong because disabling MFA for the CEO violates the requirement to have MFA for all users. Option B is wrong because per-user MFA does not support location-based exclusions. Option C is wrong because trusted IPs in MFA settings apply to all users and cannot be scoped to a single user.

Answer

Use per-user MFA and set the CEO's account to bypass.

Answer

Disable MFA for the CEO's account.

Answer

Configure trusted IPs in the MFA service settings.