MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 13 — 15 Questions

Question 1

Your organization is planning to deploy Microsoft 365 Copilot. You need to ensure that all prerequisites are met. Which of the following is a mandatory prerequisite for enabling Microsoft 365 Copilot?

Accepted Answer

Microsoft Entra ID P2 licenses.. None of the listed options are mandatory prerequisites for Microsoft 365 Copilot. The actual mandatory requirements are a qualifying Microsoft 365 license (E3, E5, or Business Premium) and the Microsoft 365 Copilot add-on license. Microsoft Entra ID P2 is not required; a basic Entra ID (free) is sufficient. Purview DLP, an Azure subscription, and Exchange Online Plan 2 are also not mandatory.

Answer

Microsoft Purview Data Loss Prevention policies.

Answer

An active Azure subscription.

Answer

Exchange Online Plan 2 licenses.

Question 2

Your company uses Microsoft 365 and has recently deployed Microsoft Intune for mobile device management. You need to ensure that corporate data on iOS devices is protected by preventing users from copying data from managed apps to unmanaged apps. What should you configure?

Accepted Answer

App protection policies.. App protection policies (APP) are the correct choice because they provide mobile application management (MAM) controls that specifically prevent data transfer between managed and unmanaged apps on iOS devices. Unlike device-level policies, APP operates at the application layer, allowing you to restrict copy/paste, cut, and data sharing actions without requiring device enrollment. This directly addresses the requirement to protect corporate data on iOS devices by blocking data leakage to unmanaged apps.

Answer

Mobile application management (MAM) without enrollment.

Answer

Device compliance policies.

Answer

Conditional Access policies.

Question 3

Your organization needs to create a custom domain in Microsoft 365. You have added the domain 'contoso.com' to the tenant. What is the next step to verify domain ownership?

Accepted Answer

Add a TXT record to the public DNS zone.. After adding a custom domain to a Microsoft 365 tenant, the next mandatory step is to prove ownership of the domain by adding a specific TXT record provided by Microsoft to the domain's public DNS zone. Microsoft queries this TXT record to verify that you control the domain before allowing you to use it for services like email or user accounts. This verification step is required by Microsoft's domain onboarding process and must succeed before any other configuration can proceed.

Answer

Create user accounts with the custom domain.

Answer

Configure the email exchange (MX) record.

Answer

Assign licenses to users with the custom domain.

Question 4

Your organization is planning to migrate from on-premises Active Directory to Microsoft Entra ID using Azure AD Connect. You need to ensure that password synchronization is enabled. Which TWO components are required for password synchronization to work?

Accepted Answer

Azure AD Connect with password hash synchronization selected.. Microsoft Entra Connect with password hash synchronization (PHS) selected is the component that hashes the on-premises Active Directory password and synchronizes it to Microsoft Entra ID. Option E is correct because the Microsoft Entra ID service must process the incoming password hashes and store them in the cloud directory, enabling authentication against Entra ID. Without both the local sync engine (Microsoft Entra Connect) and the cloud-side service, password synchronization cannot function.

Answer

Active Directory Federation Services (AD FS).

Answer

Password Writeback enabled.

Answer

Microsoft Identity Manager (MIM).

Question 5

Your organization is deploying Microsoft 365 Copilot. You need to ensure that data security is maintained. Which THREE actions should you take?

Accepted Answer

Enable audit logging in Microsoft 365.. Enabling audit logging in Microsoft 365 is essential for tracking user interactions with Microsoft 365 Copilot, including prompts, responses, and data access events. This provides a forensic trail to detect unauthorized data exposure or misuse, which is a foundational requirement for maintaining data security in AI-powered workloads.

Answer

Disable Microsoft 365 Copilot for all users.

Answer

Block all external sharing for SharePoint and OneDrive.

Question 6

Your organization has a hybrid identity setup with Azure AD Connect. You need to ensure that users can reset their passwords from the cloud and have the changes synchronized back to on-premises Active Directory. Which feature must you enable?

Accepted Answer

Password writeback.. Password writeback is the Microsoft Entra Connect feature that enables password changes performed in the cloud (e.g., via Microsoft Entra ID SSPR) to be written back to on-premises Active Directory. This ensures the on-premises password stays synchronized with the cloud, which is required for hybrid identity scenarios where users reset passwords from the cloud.

Answer

Seamless single sign-on.

Answer

Pass-through authentication.

Answer

Password hash synchronization.

Question 7

Your organization wants to use Microsoft Defender for Office 365 to protect against malicious links and attachments in email. Which Defender plan is required?

Accepted Answer

Microsoft Defender for Office 365 Plan 1.. Microsoft Defender for Office 365 Plan 1 includes Safe Links and Safe Attachments, which are the specific features required to protect against malicious links and attachments in email. These features scan URLs and attachments in real time to block malicious content before it reaches users.

Answer

Exchange Online Protection.

Answer

Microsoft Defender for Endpoint.

Answer

Microsoft Defender for Office 365 Plan 2.

Question 8

Your organization is deploying Microsoft 365 for a multinational company. You need to ensure users in different regions authenticate against the nearest Microsoft Entra ID endpoint for performance. What should you configure?

Accepted Answer

No additional configuration is required; Microsoft Entra ID automatically routes to the nearest endpoint.. Microsoft Entra ID (formerly Azure AD) uses a global anycast network to automatically route authentication requests to the nearest available endpoint based on DNS resolution and network latency. No additional configuration is required because Entra ID's infrastructure is designed to provide optimal performance globally without manual traffic management.

Answer

Add the appropriate regional subdomain (e.g., us.contoso.com) as a custom domain.

Answer

Create a conditional access policy to route authentication to the nearest region.

Answer

Configure a traffic manager profile in Azure to route authentication requests.

Question 9

Your organization uses Microsoft 365 Defender for Office 365. You need to ensure that phishing emails reported by users are automatically submitted for analysis in Microsoft Defender XDR. What should you configure?

Accepted Answer

Configure the User-reported messages settings in the Microsoft 365 Defender portal.. The User-reported messages settings in the Microsoft 365 Defender portal allow you to configure how user-reported phishing emails are handled. By enabling automatic submission to Microsoft for analysis, you ensure that reported messages are sent directly to the Microsoft security team for threat intelligence and policy tuning. This is the correct setting because it specifically controls the submission behavior for user-reported messages in Defender for Office 365.

Answer

Modify the anti-phishing policy to include user-reported submissions.

Answer

Use the Attack simulation training to collect user reports.

Answer

Enable Safe Attachments policy to automatically submit reported messages.

Question 10

Your Microsoft 365 tenant contains sensitive financial data that must be retained for 7 years. You configure a retention policy in Microsoft Purview compliance portal. After 7 years, the data is still accessible to users. What is the most likely reason?

Accepted Answer

The retention policy does not include a deletion action.. A retention policy in Microsoft Purview can be configured to only retain data without a deletion action. If the policy lacks a deletion action, data will be preserved for the specified period but will not be automatically removed after that period expires, leaving it accessible to users. The scenario describes data still being accessible after 7 years, which directly indicates that no deletion action was configured to remove the data at the end of the retention period.

Answer

A litigation hold is applied to the data.

Answer

The retention policy is configured to retain data for 7 years and then delete it.

Answer

The data is marked as a record and requires disposition review.

Question 11

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only compliant devices can access Microsoft 365 resources. What should you configure?

Accepted Answer

Create a conditional access policy in Microsoft Entra ID requiring compliant devices.. Conditional Access policies in Microsoft Entra ID (formerly Azure AD) are the mechanism that enforces access controls based on signals such as device compliance. By creating a policy that requires compliant devices, you ensure that only devices meeting your compliance standards can access Microsoft 365 resources. This works in conjunction with Intune compliance policies, but the enforcement point is the Conditional Access policy.

Answer

Configure an app protection policy in Intune.

Answer

Create a device compliance policy in Intune.

Answer

Configure a Windows Hello for Business policy in Intune.

Question 12

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP) policies to protect sensitive data in Microsoft Teams. You need to ensure that DLP policies apply to both chat and channel messages. What should you configure?

Accepted Answer

Create a single DLP policy with the Teams location selected.. Microsoft Purview DLP policies can be configured to include the Teams location, which automatically covers both chat and channel messages. When you select the Teams location in a single DLP policy, it applies to all Teams communications, including 1:1 chats, group chats, and channel conversations, without needing separate policies.

Answer

Configure a DLP policy for Exchange Online to cover Teams messages.

Answer

Assign a sensitivity label to the Teams with a DLP policy attached.

Answer

Create two separate DLP policies: one for chat and one for channels.

Question 13

Which TWO actions are required to configure a custom domain for your Microsoft 365 tenant?

Accepted Answer

Add the domain name in the Microsoft 365 admin center.. Adding the custom domain name in the Microsoft 365 admin center is the first step to register the domain with the tenant. Option E is correct because Microsoft requires you to prove ownership of the domain by adding a specific TXT record (or sometimes a CNAME or MX record) to the public DNS zone; this verification step ensures only the domain owner can configure it for the tenant.

Answer

Add an SPF TXT record in the public DNS zone.

Answer

Add a CNAME record for autodiscover.

Answer

Add an MX record in the public DNS zone.

Question 14

Which THREE factors are considered when Microsoft Entra ID evaluates a conditional access policy?

Accepted Answer

User or group membership. Microsoft Entra ID evaluates conditional access policies based on signals from the user, device, and location. User or group membership (Option A) is a primary signal because policies are typically assigned to specific users or groups to control access. Location (Option D) is evaluated using IP ranges or country codes to enforce restrictions like blocking access from untrusted networks. Device platform (Option E) allows policies to target specific operating systems (e.g., Windows, iOS) to enforce compliance requirements like requiring Intune enrollment.

Answer

Mailbox size

Answer

User's department attribute in Microsoft Entra ID

Question 15

The exhibit shows a DLP policy configuration. A user reports that they cannot share a document containing a credit card number from OneDrive for Business. However, the document was shared successfully last week. What is the most likely reason for the change?

Accepted Answer

The DLP policy was recently deployed or updated.. The most likely reason is that the DLP policy was recently deployed or updated. DLP policies in Microsoft 365 are evaluated in near real-time, and a newly deployed or modified policy will immediately enforce its rules on content sharing. Since the document was shared successfully last week, the policy change is the most plausible cause for the sudden block.

Answer

The DLP policy requires administrator override for sharing.

Answer

The DLP policy is applied only to SharePoint Online, not OneDrive.

Answer

The DLP policy does not include Microsoft Teams.