MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 12 — 15 Questions

Question 1

Your organization is deploying Microsoft 365 and needs to ensure that all new users are automatically assigned a Microsoft 365 Business Basic license. You want to use a group-based licensing strategy with an Azure AD security group. What should you do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a new Azure AD security group and assign the license to the group.. Group-based licensing in Microsoft Entra ID requires you to first create a security group (which can be cloud-only or synced) and then assign the Microsoft 365 Business Basic license directly to that group. Once the license is assigned to the group, all members automatically receive the license, including new users added to the group. This approach centralizes license management and ensures automatic assignment without manual intervention.

Answer

Configure directory synchronization and create the group in on-premises Active Directory.

Answer

Create a dynamic Azure AD group with a rule for user attributes and enable self-service group management.

Answer

Assign the license directly to each user via the Microsoft 365 admin center.

Question 2

You are a Microsoft 365 administrator. Users report that they cannot access Microsoft Teams. You check the Microsoft 365 admin center and see that the service health for Microsoft Teams shows a 'Service degradation' incident. What is the most appropriate initial action?

Accepted Answer

Review the incident details in the service health dashboard for an estimated resolution time and workaround.. The most appropriate initial action when a service degradation incident is already visible in the Microsoft 365 admin center is to review the incident details in the service health dashboard. This provides the estimated resolution time, current status, and any available workarounds published by Microsoft, allowing you to inform users and mitigate impact without immediately escalating or opening a support request.

Answer

Contact the Microsoft regional escalation engineer immediately.

Answer

Open a support request with Microsoft to report the outage.

Answer

Restart the Microsoft Teams service on all client machines.

Question 3

Your company is migrating from on-premises Exchange to Exchange Online. You have configured a hybrid deployment. During testing, you notice that free/busy information is not being shared between on-premises and cloud users. All other hybrid features work. What is the most likely cause?

Accepted Answer

The organization relationship between the on-premises and cloud tenants is missing or misconfigured.. The organization relationship defines the trust and sharing settings between on-premises Exchange and Exchange Online tenants, specifically for free/busy information. Since all other hybrid features (e.g., mail flow, mailbox moves) work, the issue is isolated to the organization relationship, which must be configured on both sides to enable cross-premises calendar availability queries.

Answer

Azure AD Connect has not been configured with the correct synchronization scope.

Answer

The on-premises firewall is blocking traffic to the Exchange Online endpoints.

Answer

OAuth authentication is not configured between on-premises and Exchange Online.

Question 4

You are a Microsoft 365 administrator. You need to allow external users to access a SharePoint Online site without requiring them to sign in. Which sharing setting should you enable?

Accepted Answer

Set the sharing option to 'Anyone' (Anonymous) for the site.. Setting the SharePoint Online site sharing option to 'Anyone' (Anonymous) allows external users to access the site without signing in. This creates an anonymous access link that bypasses authentication, meeting the requirement of no sign-in for external users.

Answer

Set the sharing option to 'Existing guests' and send an invitation.

Answer

Set the sharing option to 'Only people in your organization' and use a direct link.

Answer

Set the sharing option to 'New and existing guests' and require guest sign-in.

Question 5

Your company is using Microsoft 365 Business Premium. You want to ensure that all company-owned Windows 10 devices are automatically upgraded to Windows 11 when it becomes available through Windows Update. What should you configure?

Accepted Answer

Create a feature update policy for Windows 10 devices in Intune, targeting the Windows 11 version.. A feature update policy in Intune is specifically designed to upgrade Windows devices from one version to another, such as from Windows 10 to Windows 11. By targeting the Windows 11 version in this policy, you ensure that eligible Windows 10 devices automatically receive the upgrade when it becomes available via Windows Update. This is the correct mechanism for controlling OS version upgrades in a Microsoft 365 Business Premium environment.

Answer

Create a Windows 10 update ring policy in Intune that deploys quality updates.

Answer

Create a device compliance policy in Intune that requires Windows 11.

Answer

Configure a Windows 11 readiness assessment in Microsoft Intune.

Question 6

Your organization has a Microsoft 365 E5 tenant. You want to ensure that all users are automatically signed in to Microsoft 365 apps using single sign-on (SSO) when they are on the corporate network. You have Azure AD joined the devices. What additional configuration is required?

Accepted Answer

No additional configuration is required; Azure AD joined devices provide SSO automatically.. Microsoft Entra ID joined devices are already registered with Microsoft Entra ID and use the Primary Refresh Token (PRT) to enable seamless SSO for Microsoft 365 apps without any additional configuration. When a user signs into a Windows 10/11 device that is Microsoft Entra ID joined, the PRT is obtained during the initial authentication and is automatically used for browser and app sign-ins on the corporate network. Therefore, no extra steps like enabling Seamless SSO or deploying certificates are needed.

Answer

Enable Azure AD Seamless Single Sign-On.

Answer

Configure Azure AD Application Proxy for each app.

Answer

Deploy a trusted certificate for the corporate network.

Question 7

You are a Microsoft 365 administrator. A user reports that they cannot send emails to a specific external domain. You check the Exchange Admin Center and see that the domain is not blocked. What should you check next?

Accepted Answer

Check the mail flow rules (transport rules) in Exchange Online.. Mail flow rules (transport rules) in Exchange Online can block or redirect messages based on conditions like sender, recipient domain, or message content, even if the domain is not listed in any block list. Since the domain is not blocked in the spam filter or outbound policies, a transport rule is the most likely cause of the issue, as it can silently reject or quarantine messages without appearing in the standard block lists.

Answer

Verify that the user has a full mailbox and is not over the send limit.

Answer

Review the outbound spam filter policy.

Answer

Check the spam filter policy to see if the domain is on the blocked sender list.

Question 8

Which TWO actions are required to enable Microsoft 365 Copilot for all users in your tenant?

Accepted Answer

Ensure users have a qualifying Microsoft 365 license (e.g., E3, E5, Business Standard).. Microsoft 365 Copilot requires users to have a qualifying base license such as Microsoft 365 E3, E5, or Business Standard. Without one of these base licenses, the Copilot add-on license cannot be assigned or function properly, as Copilot relies on the underlying Microsoft 365 services (e.g., Exchange Online, SharePoint, Teams) that these plans provide.

Answer

Run a PowerShell script to enable Copilot in the tenant.

Answer

Ensure the tenant is on a Microsoft 365 E5 plan.

Answer

Provision an Azure subscription for Copilot services.

Question 9

Which THREE conditions must be met for a tenant-to-tenant migration of SharePoint Online content?

Accepted Answer

The destination site collection or OneDrive must already exist in the target tenant.. SharePoint Online tenant-to-tenant migration requires the destination site collection or OneDrive to already exist in the target tenant. The migration process copies content into a pre-provisioned container; it does not create the site or OneDrive automatically. This ensures that the target structure is ready to receive the migrated data without requiring dynamic provisioning during the migration.

Answer

The source user performing the migration must be a global admin in the target tenant.

Answer

Both tenants must have at least one user with PowerShell access.

Question 10

Which TWO are valid methods for adding custom domains to Microsoft 365?

Accepted Answer

Using the New-MsolDomain PowerShell cmdlet.. Option A is correct because the New-MsolDomain cmdlet from the MSOnline PowerShell module is a supported programmatic way to add a custom domain to a Microsoft 365/Microsoft Entra ID tenant, specifying parameters such as -Name for the domain. Option D is correct because the 'Add domain' wizard in the Microsoft 365 admin center is the primary GUI method for adding a custom domain, after which it provides the required DNS TXT or MX records for verification. Option B is incorrect because the Exchange admin center manages Exchange Online recipients, mailboxes, and accepted domains for mail flow, but it is not the supported tool for adding a new custom domain to the tenant. Option C is incorrect because Azure AD B2C is a separate customer identity service with its own tenant configuration and is unrelated to adding domains to a standard Microsoft 365 tenant. Option E is incorrect because Windows DNS Manager only manages DNS zones and records on a DNS server; it cannot add a domain to Microsoft 365, though it may be used to create the verification records if the domain is hosted on that DNS server.

Answer

Using the Exchange admin center (EAC).

Answer

Using the Azure AD B2C tenant configuration.

Answer

Using the Windows DNS Manager console.

Question 11

You run the PowerShell command shown in the exhibit for a Microsoft 365 tenant. The output shows DisplayName as 'Contoso', DefaultDomainName as 'contoso.onmicrosoft.com', and InitialDomain as 'contoso.onmicrosoft.com'. What does this indicate about the tenant?

Accepted Answer

The tenant is using the initial .onmicrosoft.com domain as the default domain.. The output shows DefaultDomainName and InitialDomain both set to 'contoso.onmicrosoft.com', which means the tenant is using its initial Microsoft-provided domain as the default domain. The Get-MgDomain cmdlet retrieves domain objects, and the DefaultDomainName property indicates which domain is used by default for new users and services. Since no custom domain is set as default, the initial .onmicrosoft.com domain remains the default.

Answer

The command requires global admin privileges.

Answer

The tenant has not been verified.

Answer

The tenant has a custom domain set as the default.

Question 12

You are reviewing an ARM template that will be used to deploy a storage account for a Microsoft 365 migration project. The template includes 'supportsHttpsTrafficOnly': true. What is the primary benefit of this setting?

Accepted Answer

It enforces secure transfer (HTTPS) for all requests to the storage account.. Setting 'supportsHttpsTrafficOnly' to true enforces secure transfer by requiring all requests to the storage account to use HTTPS (TLS). This ensures data in transit is encrypted, protecting against man-in-the-middle attacks and eavesdropping. It is a critical security control for compliance with standards like PCI-DSS and HIPAA.

Answer

It reduces latency by enabling CDN integration.

Answer

It enables geo-redundant storage.

Answer

It minimizes storage costs by reducing bandwidth usage.

Question 13

Your organization uses Microsoft 365 E5 licenses for all users. You need to configure role-based access control (RBAC) so that helpdesk staff can reset passwords and manage licenses, but cannot modify user principal names (UPNs) or delete users. Which role assignment should you use?

Accepted Answer

Helpdesk Administrator. The Helpdesk Administrator role is correct because it grants the specific permissions needed to reset passwords and manage licenses, while explicitly preventing modifications to user principal names (UPNs) and user deletions. This role is designed for tier-1 support staff who require these capabilities without elevated user management rights.

Answer

License Administrator

Answer

Password Administrator

Answer

User Administrator

Question 14

An administrator runs the PowerShell command shown in the exhibit. What is the immediate effect on the user?

Accepted Answer

The user is blocked from signing in immediately.. The PowerShell command `Set-MgUser -UserId user@domain.com -BlockCredential $true` immediately blocks the user from signing in by setting the `BlockCredential` property to true. This prevents any new authentication attempts, effectively locking the account without changing the password or deleting the user.

Answer

The user is disabled after 90 days of inactivity.

Answer

The user is deleted after 90 days of inactivity.

Answer

The user's password is reset.

Question 15

You are a Microsoft 365 administrator. Users report that they cannot create Microsoft Teams meetings using the Teams desktop client. They receive an error: 'Meeting creation is disabled by your IT administrator.' You need to enable meeting creation. You check the Teams admin center and find that meeting policies are set to 'Off' for 'Allow private meeting scheduling'. However, after changing it to 'On', users still get the error. What is the most likely cause?

Accepted Answer

The user's mailbox is still on-premises and not migrated to Exchange Online.. The error persists because the user's mailbox is still on-premises and not migrated to Exchange Online. Microsoft Teams relies on Exchange Online for scheduling features, including private meeting creation. Even with the meeting policy set to 'On', if the mailbox is on-premises, the Teams client cannot communicate with Exchange Online to create the meeting, resulting in the error.

Answer

The user does not have an OAuth 2.0 token.

Answer

The global meeting policy is overriding the user-level policy.

Answer

The user does not have a Microsoft Teams license assigned.