MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 11 — 15 Questions

Question 1

Your organization has a Microsoft 365 tenant configured with a custom domain. You need to verify domain ownership using a TXT record. Where in the Microsoft 365 admin center would you initiate this process?

Accepted Answer

Settings > Domains. To verify domain ownership in Microsoft 365, you must add a TXT record provided by Microsoft to your domain's DNS zone. The process is initiated in the Microsoft 365 admin center under Settings > Domains, where you select the domain and click 'Start setup' to receive the verification TXT record value. This is the only location in the admin center that directly manages domain verification and DNS record validation for custom domains.

Answer

Setup > Org-wide settings

Answer

Users > Active Users

Answer

Admin centers > Azure Active Directory

Question 2

A company has recently acquired a smaller organization and needs to consolidate both Microsoft 365 tenants. They want to minimize user disruption and retain existing email addresses. Which approach should they use?

Accepted Answer

Perform a cross-tenant mailbox migration. Option B is correct because cross-tenant mailbox migration allows you to move mailboxes between two Microsoft 365 tenants while preserving the users' existing email addresses and minimizing disruption. This approach uses the Microsoft 365 native migration capabilities, specifically the cross-tenant mailbox migration feature, which supports moving mailboxes with their primary SMTP addresses and associated data without requiring on-premises Exchange Server.

Answer

Configure a hybrid deployment with Exchange Server

Answer

Delete all users from the acquired tenant and recreate them in the parent tenant

Answer

Set up a federation trust between the tenants

Question 3

You are a Microsoft 365 administrator for a multinational company. The security team reports that a large number of failed sign-in attempts are originating from unexpected IP ranges. The company uses Microsoft Entra ID for identity. What should you configure to automatically block these malicious sign-ins?

Accepted Answer

Create a Conditional Access policy to block access from those IP ranges. The correct solution is a Conditional Access policy with a location condition to block access from those IP ranges. Option A (MFA) does not block by IP. Option B (Identity Protection) can detect risk but does not directly block by IP. Option D (Security defaults) are basic and may not allow custom IP blocking.

Answer

Enable Security defaults in the tenant

Answer

Configure Identity Protection user risk policy to block high-risk users

Answer

Enable Azure AD Multi-Factor Authentication for all users

Question 4

Your organization uses Microsoft 365 and wants to ensure that only compliant devices can access Exchange Online. You have Microsoft Intune for device management. What should you configure?

Accepted Answer

Create a Conditional Access policy with 'Require device to be marked as compliant'. To enforce that only compliant devices can access Exchange Online, you need a Conditional Access policy that includes the 'Require device to be marked as compliant' grant control. This policy evaluates the device compliance status reported by Intune and blocks or grants access accordingly. Without this Conditional Access policy, even compliant devices are not forced to meet compliance requirements before accessing Exchange Online.

Answer

Configure devices to be Azure AD Joined

Answer

Create an app protection policy in Intune

Answer

Create a device compliance policy in Intune

Question 5

A user reports that they cannot access their Microsoft 365 mailbox via Outlook on the web. Other users can access their mailboxes. What is the most likely cause?

Accepted Answer

The user does not have an Exchange Online license assigned. The most likely cause is that the user does not have an Exchange Online license assigned. Without a valid license, the user's mailbox is not provisioned, and Outlook on the Web (OWA) cannot access it. Other users can access their mailboxes because they have licenses, ruling out a service-wide issue.

Answer

The user's password has expired

Answer

The Exchange Online service is experiencing an outage

Answer

The user's browser cache needs to be cleared

Question 6

Your company is planning to adopt Microsoft Copilot for Microsoft 365. The security team is concerned about data leakage. What must you implement to ensure that Copilot respects your organization's sensitivity labels and data classification?

Accepted Answer

Deploy Microsoft Purview Information Protection with sensitivity labels. Microsoft Purview Information Protection with sensitivity labels is the correct answer because Copilot for Microsoft 365 uses these labels to enforce data governance at the content level. When a sensitivity label is applied to a document or email, Copilot respects that label's encryption, marking, and access restrictions, preventing the model from generating responses that leak classified data. This is the foundational mechanism for ensuring Copilot adheres to your organization's data classification policies.

Answer

Use Microsoft Defender for Cloud Apps to control Copilot

Answer

Configure Data Loss Prevention (DLP) policies

Answer

Enable Customer Lockbox

Question 7

You need to delegate the ability to reset user passwords in Microsoft Entra ID to a helpdesk team. However, they should not be able to modify other user attributes. What role should you assign?

Accepted Answer

Helpdesk Administrator. The Helpdesk Administrator role is specifically designed to allow password resets and force password changes for non-administrator users and other helpdesk administrators, while explicitly preventing modifications to other user attributes like group membership or profile details. This role provides the least privilege necessary for the helpdesk team's task, aligning with the principle of role-based access control (RBAC) in Microsoft Entra ID.

Answer

User Administrator

Answer

Global Administrator

Answer

Password Administrator

Question 8

Your organization has a Microsoft 365 E5 subscription. You want to enable Microsoft Defender for Office 365 to protect against malicious attachments in email. Which policy should you configure?

Accepted Answer

Safe Attachments policy. Safe Attachments policy is the correct choice because Microsoft Defender for Office 365's Safe Attachments feature specifically protects against malicious attachments in email by detonating them in a virtual sandbox environment before delivery. This policy allows you to configure actions for detected malware, such as blocking, replacing, or dynamically delivering attachments based on threat analysis.

Answer

Anti-phishing policy

Answer

Anti-malware policy

Answer

Safe Links policy

Question 9

Your company is required to retain all emails sent to and from executives for 7 years due to regulatory compliance. You need to implement this with minimal administrative overhead. What should you use?

Accepted Answer

Create a Microsoft Purview retention policy for the executive mailboxes. Microsoft Purview retention policies and retention labels can automatically retain emails for a specified period. Option B (Litigation Hold) is a manual process for specific users. Option C (Journaling) exports emails to an external system, adding complexity. Option D (Archive mailbox) provides storage but not automatic retention enforcement. A retention policy or label is the most efficient way.

Answer

Configure Exchange journaling to export to an external system

Answer

Place each executive mailbox on Litigation Hold

Answer

Enable the archive mailbox for each executive

Question 10

Your organization uses Microsoft 365 and wants to implement a passwordless authentication strategy. Which TWO methods are supported natively in Microsoft Entra ID for passwordless sign-in?

Accepted Answer

Microsoft Authenticator app (phone sign-in). The Microsoft Authenticator app (phone sign-in) is a native passwordless method in Microsoft Entra ID that uses key-based authentication tied to the user's device. It allows users to sign in by approving a notification or entering a number displayed on the screen, eliminating the need for a password. This method is fully integrated into Entra ID's authentication stack and supports both iOS and Android devices.

Answer

Smart cards (physical or virtual)

Answer

Temporary Access Pass

Answer

Certificate-based authentication

Question 11

Your company uses Microsoft Defender for Endpoint and wants to perform a live response on a device. Which THREE prerequisites must be met?

Accepted Answer

The user must be assigned a role that includes live response permissions. Option A is correct because live response in Microsoft Defender for Endpoint requires the user to be assigned a role that includes specific live response permissions, such as 'Live response' or 'Live response advanced' under the Microsoft 365 Defender role-based access control (RBAC). Without these permissions, the user cannot initiate a live response session, regardless of other configurations.

Answer

The device must be managed by Microsoft Intune

Answer

The device must have Microsoft Defender Antivirus as the primary antivirus solution

Question 12

You need to configure Microsoft Purview Data Loss Prevention (DLP) to prevent sensitive data from being shared via email. Which THREE elements can you use to define the policy?

Accepted Answer

Actions. Actions are a required element in a Microsoft Purview DLP policy because they define what happens when sensitive data is detected—such as blocking the email, sending a notification, or applying encryption. Without specifying actions, the policy would have no enforcement mechanism to prevent data sharing.

Answer

Sensitivity labels

Answer

Exceptions

Question 13

Refer to the exhibit. You are reviewing the service principal for Microsoft Graph in your tenant. The passwordCredentials array is empty. What does this indicate?

Accepted Answer

No client secret is configured for the service principal.. The passwordCredentials array being empty indicates that no client secret (password) has been configured for the service principal. Client secrets are one method of authentication for service principals, and their absence means that this particular authentication method is not set up. This does not imply the service principal is disabled or that other authentication methods like certificates or federated credentials are in use.

Answer

The service principal is using federated credentials.

Answer

The service principal uses certificate-based authentication.

Answer

The Microsoft Graph application is disabled.

Question 14

Refer to the exhibit. An administrator runs the KQL query in Microsoft Defender for Endpoint. The result set is empty. What is the most likely reason?

Accepted Answer

No logon events with the account name 'admin' exist in the past 7 days.. The KQL query filters for logon events where the AccountName equals 'admin' (lowercase). If no such events occurred in the last 7 days, the result set will be empty. This is the most likely reason because the query explicitly restricts the time range and account name, and an empty result does not indicate a broader issue with onboarding or case sensitivity.

Answer

The device is not onboarded to Microsoft Defender for Endpoint.

Answer

The query is case-sensitive and the account name is 'Admin' with a capital A.

Answer

There are no logon events in the last 7 days.

Question 15

Refer to the exhibit. You have a Conditional Access policy configured as shown. What is the effect of this policy?

Accepted Answer

It blocks access from trusted IP addresses.. The policy is configured to 'Block access' for 'All users' and 'All cloud apps' when the location condition is set to 'Trusted IPs'. This means that when a user attempts to access from an IP address defined as trusted in the organization's named locations, access is explicitly blocked. The effect is that trusted IP addresses are blocked, not untrusted ones.

Answer

It requires multi-factor authentication for trusted IPs.

Answer

It blocks access from all locations.

Answer

It blocks access from untrusted IP addresses.