MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 13 — 15 Questions

Question 1

Your organization is planning to deploy Microsoft 365 for 500 users. You need to ensure that all users can authenticate using their on-premises Active Directory credentials while also enabling self-service password reset (SSPR) in the cloud. Which configuration should you implement?

Accepted Answer

Password hash synchronization with Microsoft Entra Connect and SSPR enabled. Password hash synchronization (PHS) with Microsoft Entra Connect synchronizes on-premises AD password hashes to Microsoft Entra ID, enabling users to authenticate with their on-premises credentials in the cloud. When SSPR is enabled in Microsoft Entra ID, users can reset their cloud passwords, and with password writeback enabled, the new password is written back to on-premises AD, ensuring both environments remain in sync. This combination meets the requirement for on-premises authentication and cloud SSPR without the complexity of federation.

Answer

Pass-through authentication with Microsoft Entra Connect

Answer

Cloud-only identities with Microsoft Entra ID

Answer

Federated identity with Active Directory Federation Services (ADFS)

Question 2

A company has a Microsoft 365 E5 tenant with 10,000 users. You need to delegate the ability to manage Microsoft Entra ID roles to a group of support engineers. The solution must follow the principle of least privilege and allow engineers to assign only specific roles to users. What should you do?

Accepted Answer

Create a custom role in Microsoft Entra ID with permissions to assign specific roles, and use PIM to enable just-in-time access. Option D is correct because it follows the principle of least privilege by creating a custom role that grants only the specific permissions needed to assign designated roles, and using Privileged Identity Management (PIM) for just-in-time (JIT) access ensures engineers are elevated only when required. This approach avoids granting standing administrative privileges and allows granular control over which roles can be assigned, meeting the requirement to delegate role management without over-provisioning.

Answer

Assign the engineers the Privileged Role Administrator role

Answer

Add the engineers to the Global Administrator role in Microsoft Entra ID

Answer

Create a group in Microsoft Entra ID and assign it the User Administrator role, then use PIM to elevate

Question 3

Your organization uses Microsoft 365 Business Premium. You need to ensure that when a user is assigned an Intune license, the device automatically enrolls in Microsoft Intune. What should you configure?

Accepted Answer

Configure Microsoft Entra ID device settings to enable MDM automatic enrollment. Microsoft Entra ID (formerly Azure AD) device settings include an option to enable automatic MDM enrollment for users assigned an Intune license. When enabled, any device that signs in with a licensed user account will automatically enroll in Microsoft Intune, satisfying the requirement without additional configuration.

Answer

Create a device compliance policy to require enrollment

Answer

Create a device enrollment restriction in Intune to block personal devices

Answer

Deploy a device configuration profile with enrollment settings

Question 4

A user reports that they cannot access Microsoft Teams from their mobile device. Other Microsoft 365 services work fine. You verify that the device is compliant with Intune policies. What is the most likely cause?

Accepted Answer

A Conditional Access policy requires an approved client app for Teams. Option C is correct because a Conditional Access policy requiring an approved client app for Microsoft Teams would block access from a mobile device even if the device is Intune-compliant, as the policy specifically checks for the use of an approved app (e.g., the official Microsoft Teams app) rather than just device compliance. Since the user can access other Microsoft 365 services, the issue is isolated to Teams, and the device compliance status rules out broader device-level blocks.

Answer

The user's authentication method is not registered for Microsoft Entra ID

Answer

The Microsoft Teams service is degraded

Answer

The device is not enrolled in Microsoft Intune

Question 5

Your organization has a hybrid identity with Microsoft Entra Connect. You need to migrate from federation to password hash synchronization with seamless single sign-on (SSO). The migration must have minimal user impact. Which tool should you use?

Accepted Answer

Microsoft Entra Connect migration tool (Convert domain from federated to managed). The Microsoft Entra Connect migration tool (Convert domain from federated to managed) is the correct choice because it automates the conversion of federated domains to managed domains while enabling password hash synchronization (PHS) and seamless SSO. This tool minimizes user impact by allowing a staged migration where users can continue authenticating via federation until the conversion is complete, and it handles the necessary configuration changes in Azure AD and on-premises Active Directory.

Answer

IdFix tool

Answer

AD FS Management console

Answer

Azure AD Connect wizard

Question 6

You need to ensure that only users from your organization can access a SharePoint Online site. Which setting should you configure?

Accepted Answer

Set the SharePoint Online external sharing setting to 'Only people in your organization'. Option A is correct because the SharePoint Online external sharing setting 'Only people in your organization' explicitly restricts all sharing and access to users who have a valid identity in your Microsoft Entra ID tenant. This setting prevents any external user (including guests) from accessing the site, regardless of how they were invited or authenticated. It is the most direct and effective control for limiting access to internal users only.

Answer

Create a Conditional Access policy to block external users

Answer

Configure the Microsoft Entra ID external collaboration settings

Answer

Modify the site permissions to remove external users

Question 7

Your organization is implementing Microsoft 365 Copilot. You need to ensure that users' data is protected from being used for training the underlying AI models. What should you configure?

Accepted Answer

Configure the Microsoft 365 Copilot data protection policy to prevent data from being used for training. Option D is correct because Microsoft 365 Copilot includes a data protection policy specifically designed to prevent organizational data from being used to train the underlying AI models. This policy, configured in the Microsoft 365 admin center under Copilot settings, ensures that user prompts, responses, and associated data are not retained or used by Microsoft for model improvement, aligning with the data residency and privacy commitments outlined in the Microsoft Data Protection Addendum (DPA).

Answer

Disable Microsoft 365 Copilot for all users

Answer

Apply Microsoft Purview sensitivity labels to all documents

Answer

Enable Conditional Access policies to require compliant devices

Question 8

You have a Microsoft 365 E5 tenant with Microsoft Defender for Cloud Apps. You need to discover unsanctioned cloud apps used by users. What should you configure?

Accepted Answer

Microsoft Defender for Cloud Apps Cloud Discovery. Microsoft Defender for Cloud Apps Cloud Discovery is the correct feature for identifying unsanctioned cloud apps used in your environment. It analyzes traffic logs from your network or endpoints to discover all cloud app usage, categorizes them by risk, and allows you to sanction or unsanction them. This directly fulfills the requirement to discover unsanctioned cloud apps.

Answer

Conditional Access App Control

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Defender for Endpoint App Control

Question 9

Your organization needs to enforce multi-factor authentication (MFA) for all users. You want to use a security default policy. What is the prerequisite?

Accepted Answer

The Microsoft Entra ID tenant must be on the Free tier or higher. Option A is correct because security defaults are available for all Microsoft Entra ID tenants, including Free tier. Option B is wrong because PIM is not required. Option C is wrong because Azure AD Premium P2 is not required. Option D is wrong because Conditional Access is not used with security defaults.

Answer

Microsoft Entra ID Privileged Identity Management (PIM) must be enabled

Answer

Conditional Access policies must be disabled

Answer

Azure AD Premium P2 licenses must be assigned

Question 10

Your organization is using Microsoft 365 Business Premium. You need to ensure that devices are automatically enrolled in Microsoft Intune when users sign in with their work account. Which TWO configurations are required?

Accepted Answer

Enable MDM automatic enrollment in Microsoft Entra ID. Option A is correct because Microsoft Entra ID (formerly Azure AD) provides the MDM automatic enrollment feature that, when enabled, automatically enrolls Windows 10/11 and other supported devices into Intune when a user signs in with their work account. This is the core configuration that triggers the enrollment process at sign-in, leveraging the MDM discovery URL and the user's Entra ID token.

Answer

Create a device compliance policy in Intune

Answer

Set device enrollment restrictions to allow all platforms

Answer

Assign device categories to users

Question 11

You are planning a Microsoft 365 tenant migration from another tenant. You need to migrate email, OneDrive, and SharePoint content. Which THREE tools or methods can you use to migrate data?

Accepted Answer

Microsoft 365 Migration Manager. Microsoft 365 Migration Manager is a native tool within the Microsoft 365 admin center that provides a centralized, guided experience for migrating email, documents, and files from on-premises or other cloud sources. It supports end-to-end migration scenarios, including cross-tenant migrations for Exchange Online, OneDrive, and SharePoint, making it a correct choice for this tenant-to-tenant migration requirement.

Answer

Microsoft Teams admin center

Answer

Exchange Admin Center migration tools

Question 12

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP). You need to ensure that sensitive data such as credit card numbers cannot be shared externally via email. Which THREE components should you configure?

Accepted Answer

Define sensitive information types for credit card numbers. A is correct because sensitive information types (SITs) are predefined or custom patterns that detect specific data like credit card numbers (e.g., regex matching major credit card formats). Defining the SIT for credit card numbers allows the DLP policy to identify this sensitive content in emails, which is the first step before any action can be taken.

Answer

Enable Microsoft Purview Insider Risk Management

Answer

Configure a retention policy for email

Question 13

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. What is the effect of this policy?

Accepted Answer

All users on iOS or Android devices accessing Office 365 must use MFA and a compliant device. Option C is correct because the policy shown in the exhibit explicitly targets 'All users' and 'Office 365' as the cloud app, with conditions for 'iOS' and 'Android' device platforms. The grant controls require both 'Require multi-factor authentication' and 'Require device to be marked as compliant', meaning any user on an iOS or Android device accessing Office 365 must satisfy both MFA and device compliance. This is a common Conditional Access policy to enforce secure access from mobile devices.

Answer

All users accessing all cloud apps are required to use MFA

Answer

Access to Office 365 from iOS and Android is blocked

Answer

Users on mobile devices are required to use hybrid Azure AD joined devices

Question 14

Refer to the exhibit. You are creating a custom role in Microsoft Entra ID for helpdesk staff. What can users assigned this role do?

Accepted Answer

Read user properties and reset passwords. The custom role shown in the exhibit includes only the 'Users' > 'Basic' > 'Read' permission and the 'Authentication' > 'Passwords' > 'Reset password' permission. This combination allows helpdesk staff to read basic user properties (such as display name, user principal name, and job title) and reset user passwords. It does not grant write access to other user attributes, security groups, or license assignments.

Answer

Read security groups and reset passwords

Answer

Create new users and reset passwords

Answer

Read user properties and assign licenses

Question 15

Refer to the exhibit. You run this PowerShell command in your Microsoft 365 tenant. What is the purpose of the command?

Accepted Answer

To list all unlicensed users in the tenant. The PowerShell command `Get-MgUser -Filter 'assignedLicenses/$count eq 0' -ConsistencyLevel eventual` retrieves all users in the Microsoft 365 tenant who have no licenses assigned. The `assignedLicenses/$count eq 0` filter checks that the count of assigned licenses is zero, and `-ConsistencyLevel eventual` is required for advanced queries on directory objects. This directly corresponds to listing all unlicensed users in the tenant.

Answer

To list all users with sign-in blocked

Answer

To list all unlicensed users with a specific usage location

Answer

To list all users who have a license assigned