MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 12 — 15 Questions

Question 1

You are configuring Microsoft Purview Information Protection for your tenant. You need to ensure that documents containing credit card numbers are automatically labeled as 'Highly Confidential' and encrypted. Which two components must you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A sensitive info type for credit card numbers.. To automatically label documents containing credit card numbers as 'Highly Confidential' and encrypt them, you need a sensitive info type to detect credit card numbers (Option B) and an auto-labeling policy for sensitivity labels to apply the label and encryption (Option C). Option A is incorrect because DLP policies apply actions like blocking, not labeling. Option D is incorrect because retention labels manage retention, not classification and encryption.

Answer

A data loss prevention (DLP) policy.

Answer

A retention label.

Question 2

You need to configure Microsoft Teams to allow external access for federation with another organization. The other organization uses a different domain. Which setting must you enable in the Teams admin center?

Accepted Answer

External access with the domain of the other organization.. To enable federation with another organization that uses a different domain, you must configure External access (also known as federation) in the Teams admin center. Specifically, you need to add the external domain to the allowed domain list under Teams > External access. This allows users in your tenant to communicate with users in the other organization via Teams, using the Session Initiation Protocol (SIP) federation protocol.

Answer

Network roaming policy for the external users.

Answer

Guest access in Teams settings.

Answer

Emergency calling policies.

Question 3

Your organization has a Microsoft 365 E5 subscription. You need to enforce that all users must use multi-factor authentication (MFA) when accessing Microsoft 365 services. Which TWO components should you configure?

Accepted Answer

Security defaults.. Security defaults (option B) is correct because it provides a pre-configured set of security policies that enforce MFA for all users accessing Microsoft 365 services, including requiring MFA registration and blocking legacy authentication. Conditional Access policy (option E) is correct because it allows granular control to require MFA based on specific conditions such as user, location, or device state, which is the modern, recommended approach for enforcing MFA in a Microsoft 365 E5 subscription.

Answer

Microsoft Defender for Identity.

Answer

Azure AD Identity Protection user risk policy.

Answer

Per-user MFA (legacy).

Question 4

Your organization is deploying Windows 11 using Microsoft Intune. You need to ensure that devices are automatically enrolled in Intune when users sign in with their Microsoft Entra ID credentials. Which THREE prerequisites must be met?

Accepted Answer

Microsoft Entra ID P1 or P2 license.. Microsoft Entra ID P1 or P2 licenses are required to enable automatic MDM enrollment via Intune. Without these licenses, the MDM authority cannot be set to Intune, and the automatic enrollment policy in Microsoft Entra ID will not function. This licensing requirement ensures that the tenant has the necessary features for conditional access and device management policies.

Answer

Devices must run Windows 10/11 Home edition.

Answer

Microsoft Configuration Manager must be deployed.

Question 5

You are implementing Microsoft Purview Data Lifecycle Management. You need to retain all emails for a minimum of 5 years but automatically delete them after 7 years. Which TWO actions should you configure?

Accepted Answer

Create a retention policy with 'Delete items after 7 years'.. In Microsoft Purview, retention policies can be configured to retain and/or delete items. To enforce a 5-year minimum and delete after 7 years, you need two separate Purview retention policies: one that retains for 5 years and one that deletes after 7 years. Option B is a valid Purview deletion policy, but option C uses a retention tag, which is part of Messaging Records Management (MRM), not Purview Data Lifecycle Management. Since no option provides the required Purview retain action, the question is flawed as written.

Answer

Use Messaging Records Management (MRM) retention policies.

Answer

Configure a sensitivity label for the emails.

Answer

Place the mailbox on litigation hold.

Question 6

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that automatically blocks downloads of files containing sensitive information from SharePoint Online to unmanaged devices. What type of policy should you create?

Accepted Answer

Session policy. Session policies in Microsoft Defender for Cloud Apps allow real-time monitoring and control of user sessions, including blocking downloads based on sensitive content inspection via integration with Microsoft Purview Information Protection. Option B is incorrect because Microsoft Purview Data Loss Prevention policies are broader and not specifically designed for real-time session control. Option C is incorrect because activity policies trigger alerts or actions based on events but cannot actively block downloads in a session. Option D is incorrect because file policies apply to files at rest, not to user actions during a session.

Answer

Microsoft Purview Data Loss Prevention policy

Answer

Activity policy

Answer

File policy

Question 7

You need to ensure that only users from your organization's on-premises Active Directory can access Microsoft 365 services. You have Microsoft Entra Connect configured. What is the simplest way to prevent cloud-only user accounts from signing in?

Accepted Answer

Set the 'Block sign in' option to 'Yes' for all cloud-only users in the Microsoft Entra admin center.. The simplest way to prevent cloud-only users from signing in is to set the 'Block sign in' option to 'Yes' for each cloud-only user in the Microsoft Entra admin center. This directly prevents authentication without deleting the user or affecting other users. Option A is incorrect because a conditional access policy that blocks all users would also block synchronized users. Option B is incorrect because deleting cloud-only users is permanent and more complex than blocking sign-in. Option D is incorrect because removing licenses prevents access to services but does not block the user from signing in; the user could still sign in and see the tenant with limited functionality.

Answer

Configure a conditional access policy that blocks all users.

Answer

Delete the cloud-only users from Microsoft Entra ID.

Answer

Remove all licenses from cloud-only users.

Question 8

Contoso is a multinational company with 50,000 users. They have a Microsoft 365 E5 subscription and use Microsoft Entra ID for identity. They recently deployed Microsoft Copilot for Microsoft 365 to 10,000 users. The security team wants to ensure that Copilot responses do not expose sensitive information. They also need to monitor Copilot usage for unusual activity. The company uses Microsoft Purview Information Protection and Microsoft Defender for Cloud Apps. You need to configure the environment to meet these requirements. Which action should you take?

Accepted Answer

Create a Microsoft Purview DLP policy that includes Copilot as a location.. Microsoft Purview Data Loss Prevention (DLP) policies can include Microsoft Copilot for Microsoft 365 as a location, allowing the security team to detect and prevent sensitive information from being exposed in Copilot responses. This directly addresses the requirement to ensure Copilot responses do not expose sensitive data by scanning and blocking content based on sensitivity labels or sensitive info types.

Answer

Configure a Conditional Access policy to restrict Copilot to managed devices.

Answer

Enable session monitoring in Microsoft Defender for Cloud Apps for Copilot.

Answer

Create sensitivity labels and auto-labeling policies for Copilot.

Question 9

Your organization has 5,000 users and uses Microsoft 365 E3. You are planning to migrate from on-premises Exchange to Exchange Online. You have already synchronized identities using Microsoft Entra Connect. The CIO wants to ensure that users can continue to access their email if the internet connection to Microsoft 365 is temporarily lost. You need to recommend a solution that provides offline access while minimizing cost and administrative overhead. What should you recommend?

Accepted Answer

Configure Outlook to use Cached Exchange Mode.. Cached Exchange Mode (CEM) downloads a copy of the user's mailbox to a local .ost file, allowing full access to email, calendar, and contacts even when the internet connection to Microsoft 365 is temporarily lost. This meets the CIO's requirement for offline access with zero additional cost and no administrative overhead, as CEM is a built-in feature of Outlook that is already available with Microsoft 365 E3.

Answer

Implement a hybrid deployment and keep some mailboxes on-premises.

Answer

Deploy a VPN to ensure connectivity.

Answer

Enable Exchange Online Archiving for all users.

Question 10

You are the Microsoft 365 administrator for a large enterprise. You need to ensure that only users with a valid business justification can access sensitive data stored in SharePoint Online. The solution must enforce access reviews and provide detailed reports for auditors. Which TWO actions should you take?

Accepted Answer

Configure access reviews in Microsoft Entra ID Governance for the SharePoint site.. Configuring access reviews in Microsoft Entra ID Governance for the SharePoint site directly enforces periodic attestation of user access, ensuring only users with a valid business justification retain access. Enabling audit logging in Microsoft Purview provides the detailed access reports needed for auditors, capturing who accessed what and when. Together, these actions satisfy both requirements: access reviews enforce justification, and audit logging provides the detailed reports.

Answer

Deploy Microsoft Defender for Cloud Apps and create a session policy to monitor access.

Answer

Apply a sensitivity label to the SharePoint site and require justification for label change.

Answer

Create a data loss prevention (DLP) policy to block unauthorized sharing.

Question 11

Your company is deploying Microsoft 365 Copilot for all users. You need to ensure that Copilot responses are grounded only in organizational data that users already have permission to access. Additionally, you must comply with data residency requirements in the European Union. Which THREE actions should you take?

Accepted Answer

Apply sensitivity labels to restrict Copilot from accessing specific files.. Sensitivity labels can be configured to block Copilot from accessing files with specific labels, ensuring that Copilot responses are grounded only in organizational data that users already have permission to access. This is done by using Microsoft Purview Information Protection to define label-based restrictions that Copilot respects, preventing it from surfacing content from labeled files even if the user has direct access.

Answer

Block Copilot for all users outside the EU using conditional access policies.

Answer

Enable Copilot caching in Microsoft Purview to control data storage locations.

Question 12

You are the Microsoft 365 administrator for Contoso, a company with 5,000 users. The company recently acquired a subsidiary, Fabrikam, which has 2,000 users currently using on-premises Exchange and Active Directory. The goal is to migrate Fabrikam users to Microsoft 365 and merge their identities into the existing Contoso tenant. The migration must minimize user password changes and preserve existing email addresses. You need to plan the identity migration. What should you do first?

Accepted Answer

Create a new Active Directory forest for Fabrikam and configure Azure AD Connect to sync to the existing Contoso tenant.. Creating a new Active Directory forest for Fabrikam and configuring Azure AD Connect to sync to the existing Contoso tenant allows you to merge identities without disrupting the existing Contoso directory. This approach preserves Fabrikam users' existing email addresses (via SMTP matching or custom domain verification) and minimizes password changes by syncing their on-premises passwords to Azure AD. It also avoids the complexity of extending the existing Contoso AD forest, which could cause namespace conflicts or schema issues.

Answer

Create a new Microsoft 365 tenant for Fabrikam and then perform a cross-tenant migration.

Answer

Extend the existing Contoso Active Directory to include Fabrikam objects and use a single Azure AD Connect instance.

Answer

Export Fabrikam users to a CSV and use PowerShell to bulk create users in Microsoft Entra ID.

Question 13

Your organization uses Microsoft 365 and has strict compliance requirements. The compliance officer has noticed that some users are able to access sensitive documents from unmanaged devices. You need to ensure that all access to sensitive data from unmanaged devices is blocked, while still allowing access from managed devices. The solution must be implemented using Microsoft Entra ID and Microsoft Intune. You have already deployed Microsoft Intune for mobile device management. What should you do?

Accepted Answer

Create a conditional access policy in Microsoft Entra ID that requires device to be marked as compliant, and apply it to all cloud apps.. A conditional access policy in Microsoft Entra ID can require that devices be marked as compliant with Intune policies, blocking access from unmanaged devices. Option A is wrong because device compliance rules define what compliant means but do not enforce access decisions; conditional access is needed. Option B is wrong because a device compliance policy in Intune sets requirements like PIN and encryption but does not block access by itself. Option C is wrong because app protection policies apply to apps, not device-level access, and they allow access from unmanaged devices with managed apps, which does not block access.

Answer

Enable device compliance rules in Microsoft Entra ID and assign them to all users.

Answer

Create a device compliance policy in Microsoft Intune that requires a PIN and encryption.

Answer

Create an app protection policy in Microsoft Intune that requires managed apps to be used on unmanaged devices.

Question 14

You are the Microsoft 365 administrator for a company with a hybrid identity configuration using Azure AD Connect. The company has a custom domain 'contoso.com' federated with Active Directory Federation Services (ADFS). All users are synced from on-premises Active Directory. The security team wants to implement Microsoft Entra ID Protection to detect risky sign-ins. However, they are concerned that federated authentication bypasses some risk detection capabilities. You need to ensure that Microsoft Entra ID Protection can evaluate risk for all sign-ins, including federated ones. What should you do?

Accepted Answer

Switch from federated authentication to Pass-through Authentication (PTA) or Password Hash Sync (PHS).. Microsoft Entra ID Protection relies on signals such as IP addresses, device information, and sign-in patterns to calculate risk. In a federated setup with ADFS, the authentication happens on-premises, and Azure AD only receives a token—not the raw sign-in details needed for real-time risk evaluation. Switching to Pass-through Authentication (PTA) or Password Hash Sync (PHS) ensures that the authentication process flows through Azure AD directly, allowing Entra ID Protection to capture and analyze all sign-in events, including those from federated users.

Answer

Configure the federated trust in Microsoft Entra ID to use the new claims.

Answer

Configure ADFS to send the ipaddr and xms_ep claims to Azure AD.

Answer

Enable Azure AD Application Proxy to publish ADFS internally.

Question 15

Your company uses Microsoft 365 Business Premium. You need to ensure that all company-owned Windows 10 devices are automatically enrolled in Microsoft Intune when users sign in with their work account. The devices are Azure AD joined. You have configured automatic enrollment in Intune. However, some devices are not enrolling. You need to troubleshoot the issue. What should you check first?

Accepted Answer

Verify that each user has an appropriate Microsoft Intune license assigned.. Automatic enrollment in Microsoft Intune requires each user to have an appropriate Intune license (e.g., Microsoft 365 Business Premium includes Intune). Without a license, the device will not be able to enroll even if all other prerequisites are met. The license is checked during the enrollment process, and if missing, enrollment fails silently.

Answer

Ensure that devices are Azure AD joined and not domain joined.

Answer

Check the Windows 10 version; version 1607 or later is required.

Answer

Check that the MDM authority is set to Microsoft Intune in Microsoft Entra ID.