MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 11 — 15 Questions

Question 1

A user reports they cannot access Microsoft Teams. They see a message: 'Your account is not enabled for Teams.' You verify the user has a valid Microsoft 365 E3 license assigned. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Teams service plan is disabled in the user's license.. The error 'Your account is not enabled for Teams' indicates that the Teams service plan is disabled within the user's assigned Microsoft 365 E3 license. Even with a valid license, each service plan (e.g., Teams, Exchange Online, SharePoint) can be individually toggled on or off via the Microsoft 365 admin center or PowerShell. Since the user has a valid license but cannot access Teams, the most likely cause is that the Teams service plan has been explicitly disabled.

Answer

The user does not have the correct Microsoft Entra ID role.

Answer

The user is not assigned a valid license.

Answer

The user is not a global administrator.

Question 2

Your organization uses Microsoft Entra ID. You want to enforce Multi-Factor Authentication (MFA) for all users. You have already configured Conditional Access policies. However, some users are still able to sign in without MFA. What should you check first?

Accepted Answer

Confirm that all users are included in the policy's user assignment.. The most common reason a Conditional Access policy fails to enforce MFA is that not all users are included in the policy's user assignment. If the policy targets only a subset of users (e.g., a test group), users outside that scope will bypass MFA entirely. The first troubleshooting step is to verify that the policy's 'Users and groups' assignment includes 'All users' or the specific groups covering all users.

Answer

Ensure all users have registered for MFA.

Answer

Verify that the Conditional Access policy is enabled.

Answer

Check if there are any exclusions configured.

Question 3

Your company is deploying Microsoft Defender for Office 365. The security team wants to automatically remove messages identified as malware from all mailboxes after delivery. What should you configure?

Accepted Answer

Enable Zero-hour auto purge (ZAP) in the anti-malware policy.. Zero-hour auto purge (ZAP) is the correct feature because it automatically detects and removes messages that are identified as malware after they have already been delivered to a user's mailbox. By enabling ZAP in the anti-malware policy, the system retroactively moves malicious messages to the user's Junk Email folder or quarantines them, ensuring post-delivery protection without manual intervention.

Answer

Configure an anti-malware policy with a high-confidence verdict.

Answer

Set up a mailbox intelligence policy.

Answer

Create an anti-phishing policy to block spoofed senders.

Question 4

Your organization wants to use Microsoft Intune to manage devices. You need to ensure that only corporate-owned devices can enroll. What configuration should you use?

Accepted Answer

Configure enrollment restrictions to block personally owned devices.. Enrollment restrictions in Microsoft Intune allow you to block personally owned devices by setting the 'Allow personally owned devices' option to 'No' for the platform. This ensures that only corporate-owned devices, which are identified by their corporate enrollment token or IMEI/MEID numbers, can enroll. This is the direct and intended method to restrict enrollment to corporate-owned devices only.

Answer

Use a conditional access policy to require device compliance.

Answer

Set a compliance policy requiring devices to be marked as corporate.

Answer

Create a device type restriction for iOS and Android.

Question 5

Which TWO settings must be configured to set up a hybrid identity deployment using password hash synchronization?

Accepted Answer

Install and configure Microsoft Entra Connect.. Option A is correct because Microsoft Entra Connect is the required synchronization tool that connects your on-premises Active Directory to Microsoft Entra ID and provides the wizard where directory synchronization and sign-in methods are configured. Option C is correct because password hash synchronization is a sign-in method that must be explicitly enabled in Entra Connect (on the "User sign-in" page, select "Password Hash Synchronization") for the hybrid identity deployment to work as described. Option B is not required because Seamless SSO is an optional feature that can be enabled alongside password hash synchronization but is not necessary to set up the deployment itself. Option D is incorrect because AD FS is a separate federated authentication method, not part of a password hash synchronization deployment. Option E is incorrect because Pass-Through Authentication is an alternative sign-in method that validates passwords directly against on-premises AD and is mutually exclusive with password hash synchronization as the primary sign-in method.

Answer

Configure Seamless Single Sign-On (SSO).

Answer

Deploy Active Directory Federation Services (AD FS).

Answer

Configure Pass-Through Authentication.

Question 6

Which TWO tools can be used to manage Microsoft 365 tenant settings and configurations?

Accepted Answer

Microsoft 365 admin center. The Microsoft 365 admin center is the primary web-based portal for managing tenant-wide settings such as user licensing, domain management, service health, and security policies. It provides a unified dashboard for configuring core tenant configurations without requiring role-specific consoles.

Answer

Exchange admin center (EAC)

Answer

SharePoint admin center

Answer

Microsoft Intune admin center

Question 7

Your organization plans to use Microsoft 365 Copilot. To ensure compliance, you need to prevent Copilot from accessing sensitive content in SharePoint Online document libraries that are labeled as 'Highly Confidential'. What should you configure?

Accepted Answer

Configure a sensitivity label with encryption and apply it to the documents.. Sensitivity labels with encryption can restrict access to documents based on their classification. When a document is labeled 'Highly Confidential' and encrypted, Microsoft 365 Copilot cannot process it because Copilot respects the encryption applied by the label, effectively preventing it from accessing the sensitive content. This is the only configuration that directly controls Copilot's ability to read the content at the file level.

Answer

Configure a retention policy to prevent Copilot from accessing older content.

Answer

Create a conditional access policy to block Copilot from accessing SharePoint.

Answer

Create a DLP policy to block Copilot from processing 'Highly Confidential' content.

Question 8

Your organization uses Microsoft 365 E5 licenses. You need to implement a secure score improvement plan. After reviewing the Secure Score, you notice a recommendation to 'Enable sign-in risk policy' in Microsoft Entra ID. However, you want to ensure that users who sign in from trusted locations are not challenged. What should you configure?

Accepted Answer

Create a conditional access policy that targets sign-in risk: medium and above, require MFA, and exclude trusted named locations.. It creates a Conditional Access policy that targets sign-in risk at medium and above, requiring MFA, while excluding trusted named locations. This ensures users from trusted IPs are not challenged, directly addressing the requirement to avoid unnecessary prompts for trusted sign-ins while still enforcing risk-based policies.

Answer

Configure named locations in Microsoft Entra ID for trusted IPs.

Answer

Enable the 'Sign-in risk' policy in Identity Protection and set 'Exclude trusted locations'.

Answer

Enable the 'Require MFA for all users' conditional access policy.

Question 9

You are deploying a new Microsoft 365 tenant for a company that has a single domain, contoso.com. You need to verify domain ownership to enable email routing. Which DNS record type must you add to the public DNS zone?

Accepted Answer

TXT record with a verification code provided by Microsoft 365.. To verify domain ownership in Microsoft 365, you must add a TXT record containing a unique verification code provided by the Microsoft 365 admin center to your public DNS zone. This proves you control the domain, enabling email routing and other services. Other DNS records like CNAME, SPF, or MX are used for service configuration, not ownership verification.

Answer

CNAME record with 'autodiscover' pointing to 'autodiscover.outlook.com'.

Answer

SPF record including Microsoft 365 IP addresses.

Answer

MX record pointing to Microsoft 365.

Question 10

Your organization's Microsoft Intune environment enforces device compliance policies for iOS devices. You need to ensure that only devices with a passcode that is at least 6 characters and have jailbreak detection enabled are considered compliant. What should you configure?

Accepted Answer

Create a device compliance policy for iOS with required passcode length and jailbreak detection.. Device compliance policies in Microsoft Intune define the rules that devices must meet to be considered compliant, such as minimum OS version, passcode length, and jailbreak detection. Option D correctly specifies creating a compliance policy for iOS that requires a passcode of at least 6 characters and enables jailbreak detection, which directly enforces the stated requirements. Compliance policies are evaluated before granting access, and non-compliant devices can be blocked or marked for remediation.

Answer

Configure a conditional access policy to require compliant devices.

Answer

Create a device configuration profile for iOS with the required settings.

Answer

Create an app protection policy for iOS to require passcode.

Question 11

Your organization uses Microsoft Defender for Office 365. You need to configure a policy that automatically redirects emails containing malicious attachments to a quarantine folder for admin review. What type of policy should you create?

Accepted Answer

Anti-malware policy.. B is correct because the Anti-malware policy in Microsoft Defender for Office 365 is specifically designed to handle malware detected in email messages, including attachments. When configured, it can automatically redirect messages containing malicious attachments to a quarantine folder for admin review, providing a controlled remediation workflow.

Answer

Safe Attachments policy.

Answer

Anti-spam policy.

Answer

Safe Links policy.

Question 12

Your organization uses Microsoft 365 and has enabled Microsoft Entra ID P2 licenses. You need to configure automatic user provisioning for a third-party SaaS application that supports SCIM 2.0. What should you do first in the Microsoft Entra admin center?

Accepted Answer

Add the application from the gallery, then configure provisioning.. To configure automatic user provisioning for a third-party SaaS application that supports SCIM 2.0, you must first add the application from the Microsoft Entra gallery. This action creates an enterprise application object in your tenant, which is required to access the provisioning configuration blade. Only after adding the gallery application can you configure the provisioning settings, including the SCIM endpoint URL and token, to enable automated user lifecycle management.

Answer

Configure provisioning in 'App registrations'.

Answer

Navigate to 'Enterprise applications' and create a new application.

Answer

Use the 'App registrations' blade to register the app.

Question 13

Your organization is migrating from on-premises Exchange to Exchange Online. You need to ensure that users can access their mailboxes during the migration with minimal interruption. Which migration method should you use?

Accepted Answer

Minimal hybrid migration.. A minimal hybrid migration is the correct choice because it allows you to synchronize on-premises mailboxes with Exchange Online using the Hybrid Configuration Wizard (HCW) and then move mailboxes in batches with minimal downtime. Users retain access to their existing mailboxes during the migration, and once a mailbox is moved, Outlook automatically reconfigures via Autodiscover, ensuring a seamless transition.

Answer

Cutover migration.

Answer

Staged migration.

Answer

IMAP migration.

Question 14

You are designing a Microsoft 365 tenant for a multinational organization. You need to ensure compliance with data residency requirements. Which THREE actions should you take?

Accepted Answer

Set data location preferences in the Microsoft 365 admin center.. Setting data location preferences in the Microsoft 365 admin center (under Settings > Org Settings > Organization Information) allows you to specify the primary data residency region for your tenant. This ensures that core data at rest, such as Exchange Online mailboxes and SharePoint sites, is stored in the selected geographic location to meet compliance requirements.

Answer

Disable cross-region replication in Exchange Online.

Answer

Create data loss prevention policies for each region.

Question 15

Your organization needs to manage guest access to Microsoft Teams. Which TWO methods can you use to control guest access?

Accepted Answer

Enable guest access in the Teams admin center.. Enabling guest access in the Teams admin center is a required step to allow guest users to join Teams. Without this toggle enabled, guest access is blocked at the Teams level regardless of other settings. This setting works in conjunction with Microsoft Entra ID external collaboration settings to control guest access.

Answer

Use sensitivity labels to restrict guest access.

Answer

Configure SharePoint Online external sharing settings.

Answer

Set conditional access policies for guest users.