MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 11 — 15 Questions

Question 1

Your organization has a Microsoft 365 tenant with a custom domain contoso.com. You have configured Exchange Online to accept emails for contoso.com. You now need to add a subdomain sales.contoso.com and ensure that email sent to sales.contoso.com is delivered to a specific shared mailbox. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add sales.contoso.com as an accepted domain in Exchange Online and create a transport rule to redirect emails to the shared mailbox.. To route email for a subdomain to a specific mailbox, you must first add the subdomain as an accepted domain in Exchange Online (not as a custom domain in the admin center, since the parent domain is already verified). Then, you create a transport rule that matches recipients in that accepted domain and redirects the messages to the target shared mailbox. This ensures that all emails sent to sales.contoso.com are delivered to the designated mailbox without requiring additional MX records or domain verification.

Answer

Add sales.contoso.com as a custom domain in the Microsoft 365 admin center and verify ownership.

Answer

Configure an auto-expanding archive for the shared mailbox.

Answer

Create a distribution group named sales@contoso.com and add the shared mailbox as a member.

Question 2

You manage a Microsoft 365 tenant for a multinational corporation. You need to implement Microsoft Purview Information Protection to automatically classify and protect documents containing credit card numbers. The solution must apply encryption automatically when a document is saved to SharePoint Online. What should you do?

Accepted Answer

Create an auto-labeling policy in Microsoft Purview that uses a sensitivity label configured with encryption.. Auto-labeling policies in Microsoft Purview can scan documents for sensitive information types (e.g., credit card numbers) and automatically apply a sensitivity label with encryption when documents are saved to SharePoint Online. Option B is incorrect because DLP policies can block sharing or take action but do not automatically apply labels with encryption. Option C is incorrect because client-side labeling requires user interaction, not automatic. Option D is incorrect because a default sensitivity label applies to all documents without specific conditions for sensitive data.

Answer

Create a DLP policy in Microsoft Purview that blocks sharing of documents containing credit card numbers.

Answer

Configure client-side labeling via Microsoft 365 Apps to prompt users to label documents.

Answer

Set a default sensitivity label for SharePoint Online document libraries.

Question 3

Your organization uses Microsoft 365 Business Premium. You need to ensure that all Windows 10 devices are enrolled in Microsoft Intune and comply with a device compliance policy that requires BitLocker encryption and a minimum OS version. What should you do first?

Accepted Answer

Configure automatic enrollment in Microsoft Entra ID for Windows 10 devices.. To enforce Intune compliance policies on Windows 10 devices, the devices must first be enrolled in Intune. Automatic enrollment in Microsoft Entra ID (formerly Azure AD) is the prerequisite step that enables Windows 10 devices to automatically enroll in Intune when they join or are registered with Entra ID. Without this enrollment configured, no Intune policies—including compliance policies—can be applied to the devices.

Answer

Install the Intune Connector for Active Directory on a domain controller.

Answer

Deploy a configuration profile to enable BitLocker.

Answer

Create a device compliance policy in Microsoft Intune.

Question 4

You have a Microsoft 365 E5 tenant. Users report that they cannot access the Microsoft 365 admin center (https://admin.microsoft.com). You verify that they have the Global Administrator role assigned. You check the sign-in logs in Microsoft Entra ID and see that the sign-in was blocked by a Conditional Access policy. The policy requires MFA and a compliant device. The users are using personal devices that are not enrolled. What should you do to allow access while maintaining security?

Accepted Answer

Modify the Conditional Access policy to exclude the Microsoft 365 admin center from the device compliance requirement, but keep MFA.. It allows users to access the Microsoft 365 admin center by removing the device compliance requirement for that specific cloud app while still enforcing MFA. This maintains security through MFA and avoids blocking access for users on personal, unenrolled devices. Disabling the policy entirely or requiring enrollment would either weaken security or be impractical for personal devices.

Answer

Disable the Conditional Access policy.

Answer

Ask users to enroll their personal devices in Microsoft Intune.

Answer

Remove the Global Administrator role from the users and assign a lower privilege role.

Question 5

Your company is deploying Microsoft 365 Copilot. You need to ensure that users can use Copilot in Word, Excel, and PowerPoint. The licensing is in place. However, you are concerned about data leakage. You want to ensure that Copilot does not use sensitive organizational data when generating content. What should you configure in Microsoft 365?

Accepted Answer

Create and assign sensitivity labels with encryption to sensitive documents, and ensure Copilot respects these labels.. Microsoft 365 Copilot respects sensitivity labels that are applied to documents. By creating and assigning sensitivity labels with encryption to sensitive documents, you can prevent Copilot from using that content as source material when generating responses. This is configured via Microsoft Purview Information Protection, where labels can include encryption settings that Copilot will honor, ensuring data leakage is mitigated without blocking Copilot functionality entirely.

Answer

Configure a data loss prevention (DLP) policy to block Copilot from accessing sensitive data.

Answer

Use the Microsoft Purview compliance portal to restrict Copilot data access.

Answer

Disable Copilot for users who handle sensitive data.

Question 6

Your organization has a Microsoft 365 E5 tenant. You need to set up a shared mailbox for the IT help desk (helpdesk@contoso.com). The help desk team needs to monitor the mailbox and respond to emails. What is the recommended way to grant access to the shared mailbox?

Accepted Answer

Add the help desk users as members of the shared mailbox from the Exchange admin center.. The recommended method to grant access to a shared mailbox in Exchange Online is to add users as members directly from the Exchange admin center (EAC). This automatically assigns the necessary Full Access and Send As permissions without requiring licenses for each user, as shared mailboxes can be accessed by licensed users without needing a separate license for the mailbox itself.

Answer

Assign an Exchange Online license to each help desk user and grant them Full Access via PowerShell.

Answer

Create a security group and add it to the shared mailbox permissions.

Answer

Create a distribution group containing the help desk users and grant the group access to the mailbox.

Question 7

Your organization is planning to migrate from on-premises Exchange to Exchange Online. You need to choose a migration strategy. Which TWO statements about migration methods are correct?

Accepted Answer

A minimal hybrid deployment allows you to manage mailboxes in both on-premises and Exchange Online.. A minimal hybrid deployment uses Azure AD Connect to synchronize on-premises Active Directory with Microsoft Entra ID, enabling centralized management of mailboxes across both environments. This allows administrators to manage on-premises and Exchange Online mailboxes from a single Exchange admin center, making option B correct.

Answer

A hybrid migration requires that you do not synchronize on-premises Active Directory with Microsoft Entra ID.

Answer

A staged migration can be used to migrate mailboxes from Exchange 2019 to Exchange Online.

Answer

An IMAP migration migrates email, contacts, and calendar data.

Question 8

You are implementing Microsoft Defender for Office 365. You need to configure anti-phishing policies to protect against user impersonation. Which THREE settings should you configure?

Accepted Answer

Enable impersonation protection for domains you own.. Enabling impersonation protection for domains you own allows Defender for Office 365 to detect and act on attempts to spoof your organization's domain in the From address. This setting ensures that emails claiming to be from your domain are inspected for impersonation patterns, such as lookalike domains or display name spoofing, and can be automatically quarantined or have safety tips applied.

Answer

Set the bulk email threshold.

Answer

Configure spoof intelligence to allow or block senders.

Question 9

Your company uses Microsoft 365 Business Premium. You need to configure Microsoft Entra ID Protection to automatically remediate risks. Which TWO risk remediation actions can be configured?

Accepted Answer

Block sign-in for users with high sign-in risk.. Microsoft Entra ID Protection allows you to configure an automated policy to block sign-ins when the sign-in risk level is assessed as high. This policy directly remediates the risk by preventing the authentication attempt from succeeding, thereby protecting the account from potential compromise.

Answer

Block licensing assignments for users with high risk.

Answer

Configure session timeout for risky sessions.

Answer

Force password change for users with high user risk.

Question 10

You are the Microsoft 365 administrator for a large enterprise with 50,000 users. The company is deploying Microsoft 365 Copilot for all users. You need to ensure that the data used by Copilot is protected and that Copilot does not inadvertently expose sensitive information. The company has strict data residency requirements: all data must remain within the European Union (EU). You have already configured data boundaries in Microsoft 365 to keep data in the EU. However, you are concerned about Copilot's AI model training. You need to implement additional controls. The company uses Microsoft Purview Information Protection with sensitivity labels. You have created a sensitivity label "Highly Confidential" that applies encryption and a "Confidential" label that applies visual markings. You also have a DLP policy that prevents sharing of "Highly Confidential" data externally. You need to ensure that when a user uses Copilot with a document labeled "Highly Confidential", the Copilot response does not include any of the sensitive content from that document. What should you do?

Accepted Answer

Ensure that the Highly Confidential sensitivity label includes encryption when applied.. The 'Highly Confidential' sensitivity label already applies encryption, which prevents Microsoft 365 Copilot from accessing the document's content. Copilot cannot process or include encrypted content in its responses, as encryption blocks the AI model from reading the underlying data. This ensures that sensitive information from encrypted documents is not inadvertently exposed in Copilot outputs.

Answer

Exclude users who handle Highly Confidential data from Copilot licensing.

Answer

Create a DLP policy that blocks Copilot from accessing documents labeled Highly Confidential.

Answer

Configure Microsoft 365 data boundaries to restrict Copilot data processing to the EU.

Question 11

Your organization has a hybrid identity deployment with Microsoft Entra Connect. You have synchronized all on-premises Active Directory users to Microsoft Entra ID. You need to enable Microsoft Entra ID Password Protection to automatically block weak passwords. You have installed the Password Protection proxy on a server and registered it. You also need to enforce the password protection policy for on-premises users. What additional step is required?

Accepted Answer

Install the Password Protection DC agent on each domain controller.. The Password Protection DC agent is required on each domain controller to intercept and validate password changes against the Microsoft Entra ID Password Protection policy. Without this agent, the proxy server alone cannot enforce the policy for on-premises users, as the DC agent is the component that applies the password filter during password change operations.

Answer

Install the Password Protection proxy on all domain controllers.

Answer

Enable the password filter in the Microsoft Entra Connect configuration.

Answer

Configure a Group Policy to require password complexity.

Question 12

You are a Microsoft 365 administrator for a small business with 50 users. The company is using Microsoft 365 Business Basic. You need to configure email for the custom domain contoso.com. You have added the domain in the Microsoft 365 admin center and verified ownership. Users currently have onmicrosoft.com email addresses. You need to change the primary email address for all users to their custom domain (e.g., user@contoso.com). What should you do?

Accepted Answer

Change the primary email address for each user to user@contoso.com in the admin center.. In Microsoft 365, after adding and verifying a custom domain, you must manually update each user's primary email address (User Principal Name and primary SMTP address) from the default onmicrosoft.com domain to the custom domain. This is done in the Microsoft 365 admin center under Users > Active Users, by editing the username and email fields. Simply adding the domain does not automatically change existing user addresses.

Answer

Remove the onmicrosoft.com domain from the tenant.

Answer

Convert all mailboxes to shared mailboxes and reassign licenses.

Answer

Configure the MX record for contoso.com to point to Exchange Online.

Question 13

Contoso recently acquired a company with an existing Microsoft 365 tenant. You need to migrate their user accounts and mailboxes to the Contoso tenant. The acquired company uses a custom domain for email. You must ensure minimal disruption and maintain email flow during migration. What should you do first?

Accepted Answer

Add the custom domain to the Contoso tenant and verify ownership.. Before any migration can proceed, the custom domain used by the acquired company must be added and verified in the Contoso tenant. This is a prerequisite for cross-tenant mailbox migrations because the target domain must be recognized and owned by the destination tenant to route email correctly and assign user principal names (UPNs). Without domain verification, migration tools cannot validate the domain and email flow will fail.

Answer

Perform a cross-tenant mailbox migration using Microsoft 365 migration tools.

Answer

Disable the acquired company's tenant to force all users to the Contoso tenant.

Answer

Create new user accounts in the Contoso tenant using the onmicrosoft.com domain.

Question 14

Your organization uses Microsoft Defender for Identity and has enabled Microsoft Secure Score. You notice that the Secure Score for Identity has dropped significantly after a recent configuration change. Which action is most likely to have caused the decrease?

Accepted Answer

Disabling password hash synchronization in Microsoft Entra Connect.. Disabling password hash synchronization (PHS) in Microsoft Entra Connect removes the ability for Microsoft Defender for Identity to correlate on-premises Active Directory credential exposure events with cloud authentication attempts. Without PHS, Defender for Identity cannot detect when leaked credentials are used against Azure AD, causing the Secure Score for Identity to drop because key detection capabilities are no longer available.

Answer

Changing password expiration policy to 180 days.

Answer

Enabling MFA for all users.

Answer

Implementing a conditional access policy blocking legacy authentication.

Question 15

A user reports that they cannot access their Microsoft 365 mailbox from the Outlook desktop client, but they can access it via Outlook on the web. Other users in the same tenant are not experiencing issues. What is the most likely cause?

Accepted Answer

The user's Outlook profile is corrupted or needs to be re-created.. If a user can access via OWA but not Outlook desktop, it often indicates an authentication or client configuration issue rather than a service outage. Disabled MFA would affect both. A service incident would affect many users. License issues would also affect OWA. The most likely cause is that the user's profile is corrupted or authentication token has expired.

Answer

There is a service incident affecting only the Outlook desktop client.

Answer

The user's account has been disabled.

Answer

The user's Microsoft 365 license has expired.