MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 12 — 15 Questions

Question 1

Your organization has a Microsoft 365 E5 tenant with 10,000 users. You need to ensure that when a user is detected as high-risk by Microsoft Entra ID Protection, the user is automatically blocked from accessing sensitive SharePoint sites. The solution should minimize administrative overhead. What should you do?

Accepted Answer

Create a Conditional Access policy targeting high-risk users, apply to SharePoint, and set 'Block access' or 'Use app enforced restrictions'.. Option A is correct because a Conditional Access (CA) policy can directly target 'High risk' users (via Microsoft Entra ID Protection risk detection) and apply to SharePoint. By setting the grant control to 'Block access' or 'Use app enforced restrictions', you automatically block or restrict access to sensitive SharePoint sites without manual intervention, minimizing administrative overhead. This integrates natively with Microsoft 365 and requires no additional services or custom scripting.

Answer

Create a session policy in Microsoft Defender for Cloud Apps to block high-risk users from accessing SharePoint.

Answer

Configure a user risk policy in Microsoft Entra ID Protection to block sign-ins for high-risk users.

Answer

Deploy Microsoft Sentinel and create a custom analytics rule to trigger an automated response via Logic App.

Question 2

Your company is deploying Microsoft 365 for a new subsidiary with 500 users. You need to configure the initial tenant with a custom domain (contoso.com) and verify ownership. What is the first step you must perform?

Accepted Answer

Add a TXT record provided by Microsoft 365 to the contoso.com DNS zone.. To verify ownership of a custom domain in Microsoft 365, you must prove you control the domain's DNS zone. Microsoft provides a unique TXT record value that you add to the public DNS zone of contoso.com. Once the TXT record propagates, Microsoft queries it and confirms ownership, allowing you to proceed with domain configuration.

Answer

Delegate the contoso.com zone to Microsoft 365 DNS servers.

Answer

Create user accounts with the custom domain before verification.

Answer

Set contoso.com as the default domain in the Microsoft 365 admin center.

Question 3

Your Microsoft 365 tenant has 50,000 users. You are planning to migrate mailboxes from on-premises Exchange Server 2019 to Exchange Online using a full hybrid configuration. During the migration, you must ensure that free/busy information is synchronized between on-premises and Exchange Online. Which component is required for free/busy synchronization in a hybrid deployment?

Accepted Answer

Exchange Hybrid Server (or Hybrid Agent). In a full hybrid configuration, free/busy synchronization between on-premises Exchange and Exchange Online is handled by the Exchange Hybrid Server (or the newer Hybrid Agent). This component acts as a bridge, using the Exchange Web Services (EWS) and Autodiscover service to securely relay free/busy data between the two organizations. Without it, the Availability service cannot query the remote forest for calendar information.

Answer

Azure AD Connect

Answer

Exchange Online connector (Outbound to on-premises)

Answer

Hybrid Configuration Wizard

Question 4

You are a Microsoft 365 administrator. You need to ensure that users can reset their own passwords without contacting the help desk. Which TWO components must be configured?

Accepted Answer

Microsoft Entra ID P1 or P2 licenses assigned to users. Options A and C are correct. SSPR requires Microsoft Entra ID P1 or P2 licensing and the SSPR feature must be enabled. Option B is wrong because Azure AD Connect syncs identities but is not required for SSPR. Option D is wrong because MFA is not mandatory for SSPR, though it can be configured. Option E is wrong because password writeback is for password changes to sync back to on-premises, not required for cloud-only users.

Answer

Configure Microsoft Entra ID Protection user risk policy

Answer

Azure AD Connect with password hash synchronization

Answer

Enable password writeback in Azure AD Connect

Question 5

Your organization is deploying Microsoft 365 Copilot for 200 users. You need to ensure that Copilot can access user data from Microsoft Graph to provide personalized responses. Which THREE permissions must be granted?

Accepted Answer

Chat.ReadWrite (Microsoft Graph). Option A is correct because Chat.ReadWrite is required for Microsoft 365 Copilot to access and process user chat data from Microsoft Graph, enabling personalized responses based on chat history and context. This permission allows Copilot to read and write chat messages, which is essential for generating context-aware replies.

Answer

User.Read.All (Microsoft Graph)

Answer

Mail.Send (Microsoft Graph)

Question 6

You are configuring Microsoft 365 tenant-to-tenant migration. Which THREE tasks must be completed before migrating users?

Accepted Answer

Obtain tenant consent for data migration (e.g., via admin consent). Options A, C, and E are correct. You need to verify the target domain, ensure directory synchronization is set up, and obtain consent for data migration. Option B is wrong because MX record changes happen after migration. Option D is wrong because you should not delete existing mailboxes until after migration.

Answer

Change MX records to point to the target tenant

Answer

Delete source tenant user mailboxes

Question 7

Refer to the exhibit. A Conditional Access policy is created in Microsoft Entra ID. The policy targets the Office 365 app (which includes Exchange Online). You have 1000 users assigned. What is the immediate effect of this policy on users who are currently signed in?

Accepted Answer

No immediate effect; users will be blocked on their next sign-in attempt.. Conditional Access policies in Microsoft Entra ID are evaluated at the time of sign-in. They do not terminate existing sessions. Therefore, users who are already signed in will not be affected until their next authentication attempt, at which point the policy's block action will be enforced.

Answer

All high-risk users are immediately blocked from accessing email.

Answer

The policy is invalid because the Office 365 app does not support block.

Answer

Only users with a sign-in risk of high are blocked.

Question 8

Refer to the exhibit. You run the PowerShell command in a Microsoft 365 tenant. What does the output indicate?

Accepted Answer

The email addresses that receive service health notifications.. The PowerShell command `Get-ExchangeNotification` retrieves the email addresses configured to receive service health notifications for the Microsoft 365 tenant. The output shown lists these notification recipients, which are separate from administrative roles or billing contacts. Option B correctly identifies this as the set of email addresses that receive service health alerts.

Answer

The users who have the Global Administrator role.

Answer

The members of the default Office 365 group.

Answer

The email addresses for billing inquiries.

Question 9

Refer to the exhibit. You are reviewing a Microsoft Entra ID Governance access review. The JSON shows an access review scope for a SharePoint site. What does the 'isExternallyAccessible': false setting indicate about the site?

Accepted Answer

External users cannot access the site.. The 'isExternallyAccessible': false setting in the access review scope JSON indicates that the SharePoint site is not configured to allow external sharing. This means external users cannot access the site, making option B correct. The setting directly controls whether the site is visible to external identities in the access review, not the review process itself.

Answer

The site's external sharing settings are not reviewed.

Answer

The site is configured to allow sharing with anyone.

Answer

External users are automatically granted access.

Question 10

Your organization uses Microsoft 365 Business Premium. You need to configure Windows 365 Cloud PCs for 10 users who require access to a custom line-of-business (LOB) application that is not compatible with Windows 11. The LOB app requires Windows 10 and 8 GB RAM. What is the most cost-effective Cloud PC configuration that meets the requirements?

Accepted Answer

Windows 365 Business Standard license and a custom Windows 10 image.. Option A is correct because Windows 365 Business Standard provides 8 GB RAM and supports custom Windows 10 images, meeting the LOB app's requirements. The Business Standard license is the most cost-effective tier that offers 8 GB RAM, while Basic only offers 4 GB RAM and would not satisfy the app's memory needs. A custom Windows 10 image is necessary since the app is incompatible with Windows 11.

Answer

Windows 365 Business Advanced license and a custom Windows 11 image.

Answer

Windows 365 Enterprise license with GPU.

Answer

Windows 365 Business Basic license and a custom Windows 10 image.

Question 11

You are a Microsoft 365 administrator. Your tenant has a Microsoft Entra ID P2 license. You need to create a dynamic group for all users whose department is 'Engineering' and who are located in the United States. Which rule syntax should you use?

Accepted Answer

user.department -eq "Engineering" and user.country -eq "United States". Option C is correct because dynamic group rules in Microsoft Entra ID require the use of lowercase 'and' as the logical operator, and the country attribute value must match the display name 'United States' as stored in the directory. The rule syntax must follow the property -operator 'value' format exactly, with no capitalization of 'and'.

Answer

user.department -eq "Engineering" and user.country -eq "US"

Answer

user.department -eq "Engineering" And user.country -eq "United States"

Answer

user.department -eq "Engineering" AND user.country -eq "United States"

Question 12

Your company has a Microsoft 365 E5 tenant. You need to ensure that all external emails are marked with a warning banner at the top of the email body. What should you configure?

Accepted Answer

A mail flow rule (transport rule) to add a disclaimer.. Option D is correct because a mail flow rule (transport rule) in Exchange Online can be configured to prepend a disclaimer (warning banner) to the body of all external emails. This is the only mechanism that directly modifies the email body content for inbound or outbound messages based on sender/recipient criteria, such as when the sender is external to the organization.

Answer

A Safe Attachments policy in Microsoft Defender for Office 365.

Answer

External email tagging in the Microsoft 365 Defender portal.

Answer

A DLP policy with a sensitive information type.

Question 13

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a custom PowerShell script that runs in the user context after every device restart. Which Intune policy type should you use?

Accepted Answer

Microsoft Intune PowerShell scripts (Devices > Scripts). Option C is correct because Microsoft Intune PowerShell scripts (Devices > Scripts) allow you to deploy custom PowerShell scripts that run in the user context on Windows 10 devices. By configuring the script with 'Run this script using the logged on credentials' and setting the schedule to 'Run once per device' or 'Run on every device restart', you can ensure the script executes after every restart. This is the only Intune policy type designed specifically for deploying and managing custom PowerShell scripts with user context and restart-triggered execution.

Answer

Compliance policy

Answer

PowerShell script as a 'Run this script using the logged on credentials' assignment.

Answer

Device configuration profile

Question 14

Your Microsoft 365 tenant has a Microsoft Entra ID tenant with custom B2B collaboration settings. You need to allow external users from a specific domain (partner.com) to self-service sign up, but block all other external domains. What should you configure?

Accepted Answer

Configure cross-tenant access settings for partner.com with inbound access enabled and block other domains by default.. Option C is correct because cross-tenant access settings in Microsoft Entra ID allow you to configure inbound access for specific external domains (partner.com) while blocking all others by default. This granular control enables self-service sign-up for allowed domains and prevents external users from unauthorized domains from signing up, directly meeting the requirement.

Answer

Configure SharePoint Online external sharing settings to allow partner.com only.

Answer

Set guest user access permissions to 'Guest user access is restricted'.

Answer

Add partner.com to the B2B collaboration allowlist in Microsoft Entra ID.

Question 15

You need to ensure that all Microsoft 365 users in your organization have a consistent password policy that requires passwords to be at least 12 characters and include complexity requirements. What should you configure?

Accepted Answer

Password policy in Microsoft Entra ID. Microsoft Entra ID (formerly Azure AD) is the identity service that enforces tenant-wide password policies for cloud-only user accounts. Configuring the password policy in Entra ID allows you to set minimum length (e.g., 12 characters) and complexity requirements (e.g., must include uppercase, lowercase, digits, and special characters) that apply to all Microsoft 365 users. This is the correct location because Entra ID is the authoritative source for authentication policies in a Microsoft 365 tenant.

Answer

Device compliance policy in Microsoft Intune

Answer

Outlook on the web mailbox policy

Answer

Data loss prevention policy in Microsoft Purview