MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 14 — 15 Questions

Question 1

The exhibit shows the output of a PowerShell command for a user. The user reports that they cannot access Microsoft Teams, although they have an E3 license (ENTERPRISEPACK). What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Teams service plan is disabled in the user's license.. The PowerShell output shows the user has an E3 license (ENTERPRISEPACK) assigned, but the Teams service plan is disabled. Even with an active E3 license, if the Teams service plan is explicitly turned off in the license assignment, the user cannot access Microsoft Teams. This is a common configuration where an admin disables specific service plans to control feature access.

Answer

The user's license is suspended.

Answer

The user's license has expired.

Answer

The user does not have a license assigned.

Question 2

The exhibit shows a KQL query used in Microsoft 365 Defender. The query returns no results for admin@contoso.com. What is the most likely reason?

Accepted Answer

Microsoft Defender for Identity is not enabled for the tenant.. The KQL query uses the `IdentityLogonEvents` table, which is populated by Microsoft Defender for Identity (MDI). If MDI is not enabled for the tenant, this table contains no data, so the query returns no results regardless of the user's role or query syntax. The query itself is syntactically correct and the role name 'GlobalAdministrator' is valid, but without MDI being provisioned, the table is empty.

Answer

The user does not have the Global Administrator role.

Answer

The KQL query syntax is invalid.

Answer

The role name in the query is misspelled.

Question 3

Your organization has a Microsoft 365 tenant configured with a custom domain. You need to verify domain ownership using a TXT record. Where in the Microsoft 365 admin center would you initiate this process?

Accepted Answer

Settings > Domains. To verify domain ownership in Microsoft 365, you must add a TXT record provided by Microsoft to your domain's DNS zone. The process is initiated in the Microsoft 365 admin center under Settings > Domains, where you select the domain and click 'Start setup' to receive the verification TXT record value. This is the only location in the admin center that directly manages domain verification and DNS record validation for custom domains.

Answer

Setup > Org-wide settings

Answer

Users > Active Users

Answer

Admin centers > Azure Active Directory

Question 4

A company has recently acquired a smaller organization and needs to consolidate both Microsoft 365 tenants. They want to minimize user disruption and retain existing email addresses. Which approach should they use?

Accepted Answer

Perform a cross-tenant mailbox migration. Cross-tenant mailbox migration allows you to move mailboxes between two Microsoft 365 tenants while preserving the users' existing email addresses and minimizing disruption. This approach uses the Microsoft 365 native migration capabilities, specifically the cross-tenant mailbox migration feature, which supports moving mailboxes with their primary SMTP addresses and associated data without requiring on-premises Exchange Server.

Answer

Configure a hybrid deployment with Exchange Server

Answer

Delete all users from the acquired tenant and recreate them in the parent tenant

Answer

Set up a federation trust between the tenants

Question 5

You are a Microsoft 365 administrator for a multinational company. The security team reports that a large number of failed sign-in attempts are originating from unexpected IP ranges. The company uses Microsoft Entra ID for identity. What should you configure to automatically block these malicious sign-ins?

Accepted Answer

Create a Conditional Access policy to block access from those IP ranges. A Conditional Access policy can explicitly block sign-ins from specific IP ranges. By creating a policy that targets all users or specific users and includes a condition for the named location (the unexpected IP ranges), you can automatically deny authentication requests from those addresses at the Entra ID level, effectively blocking malicious sign-ins before they reach any application.

Answer

Enable Security defaults in the tenant

Answer

Configure Identity Protection user risk policy to block high-risk users

Answer

Enable Azure AD Multi-Factor Authentication for all users

Question 6

Your organization uses Microsoft 365 and wants to ensure that only compliant devices can access Exchange Online. You have Microsoft Intune for device management. What should you configure?

Accepted Answer

Create a Conditional Access policy with 'Require device to be marked as compliant'. To enforce that only compliant devices can access Exchange Online, you need a Conditional Access policy that includes the 'Require device to be marked as compliant' grant control. This policy evaluates the device compliance status reported by Intune and blocks or grants access accordingly. Without this Conditional Access policy, even compliant devices are not forced to meet compliance requirements before accessing Exchange Online.

Answer

Configure devices to be Azure AD Joined

Answer

Create an app protection policy in Intune

Answer

Create a device compliance policy in Intune

Question 7

A user reports that they cannot access their Microsoft 365 mailbox via Outlook on the web. Other users can access their mailboxes. What is the most likely cause?

Accepted Answer

The user does not have an Exchange Online license assigned. The most likely cause is that the user does not have an Exchange Online license assigned. Without a valid license, the user's mailbox is not provisioned, and Outlook on the Web (OWA) cannot access it. Other users can access their mailboxes because they have licenses, ruling out a service-wide issue.

Answer

The user's password has expired

Answer

The Exchange Online service is experiencing an outage

Answer

The user's browser cache needs to be cleared

Question 8

Your company is planning to adopt Microsoft Copilot for Microsoft 365. The security team is concerned about data leakage. What must you implement to ensure that Copilot respects your organization's sensitivity labels and data classification?

Accepted Answer

Deploy Microsoft Purview Information Protection with sensitivity labels. Microsoft Purview Information Protection with sensitivity labels is the correct answer because Copilot for Microsoft 365 uses these labels to enforce data governance at the content level. When a sensitivity label is applied to a document or email, Copilot respects that label's encryption, marking, and access restrictions, preventing the model from generating responses that leak classified data. This is the foundational mechanism for ensuring Copilot adheres to your organization's data classification policies.

Answer

Use Microsoft Defender for Cloud Apps to control Copilot

Answer

Configure Data Loss Prevention (DLP) policies

Answer

Enable Customer Lockbox

Question 9

Your organization has a Microsoft 365 E5 subscription. You want to enable Microsoft Defender for Office 365 to protect against malicious attachments in email. Which policy should you configure?

Accepted Answer

Safe Attachments policy. Safe Attachments policy is the correct choice because Microsoft Defender for Office 365's Safe Attachments feature specifically protects against malicious attachments in email by detonating them in a virtual sandbox environment before delivery. This policy allows you to configure actions for detected malware, such as blocking, replacing, or dynamically delivering attachments based on threat analysis.

Answer

Anti-phishing policy

Answer

Anti-malware policy

Answer

Safe Links policy

Question 10

Your company is required to retain all emails sent to and from executives for 7 years due to regulatory compliance. You need to implement this with minimal administrative overhead. What should you use?

Accepted Answer

Create a Microsoft Purview retention policy for the executive mailboxes. A Microsoft Purview retention policy applied to the executive mailboxes retains all emails for 7 years with minimal administrative overhead. It is a centralized, policy-based solution that does not require per-mailbox configuration or external systems. This meets the regulatory requirement efficiently.

Answer

Configure Exchange journaling to export to an external system

Answer

Place each executive mailbox on Litigation Hold

Answer

Enable the archive mailbox for each executive

Question 11

Your organization uses Microsoft 365 and wants to implement a passwordless authentication strategy. Which THREE methods are supported natively in Microsoft Entra ID for passwordless sign-in?

Accepted Answer

Microsoft Authenticator app (phone sign-in). Microsoft Entra ID natively supports three passwordless authentication methods: Windows Hello, FIDO2 security keys, and the Microsoft Authenticator app (phone sign-in), so option B is correct because Authenticator phone sign-in lets users sign in by approving a notification with a biometric or PIN instead of a password. Option C is correct because Temporary Access Pass is a native passwordless method that issues a time-limited passcode used to register other passwordless methods or recover access. Option E is correct because FIDO2 security keys are native passwordless credentials that use WebAuthn for phishing-resistant sign-in. Options A and D are not correct because smart cards and certificate-based authentication, while supported for authentication in Entra ID, are not classified as native passwordless sign-in methods in the passwordless authentication strategy.

Answer

Smart cards (physical or virtual)

Answer

Certificate-based authentication

Question 12

Your company uses Microsoft Defender for Endpoint and wants to perform a live response on a device. Which THREE prerequisites must be met?

Accepted Answer

The user must be assigned a role that includes live response permissions. Live response in Microsoft Defender for Endpoint requires the user to be assigned a role that includes specific live response permissions, such as 'Live response' or 'Live response advanced' under the Microsoft 365 Defender role-based access control (RBAC). Without these permissions, the user cannot initiate a live response session, regardless of other configurations.

Answer

The device must be managed by Microsoft Intune

Answer

The device must have Microsoft Defender Antivirus as the primary antivirus solution

Question 13

You need to configure Microsoft Purview Data Loss Prevention (DLP) to prevent sensitive data from being shared via email. Which THREE elements can you use to define the policy?

Accepted Answer

Actions. Actions are a required element in a Microsoft Purview DLP policy because they define what happens when sensitive data is detected—such as blocking the email, sending a notification, or applying encryption. Without specifying actions, the policy would have no enforcement mechanism to prevent data sharing.

Answer

Sensitivity labels

Answer

Exceptions

Question 14

Refer to the exhibit. You are reviewing the service principal for Microsoft Graph in your tenant. The passwordCredentials array is empty. What does this indicate?

Accepted Answer

No client secret is configured for the service principal.. The passwordCredentials array being empty indicates that no client secret (password) has been configured for the service principal. Client secrets are one method of authentication for service principals, and their absence means that this particular authentication method is not set up. This does not imply the service principal is disabled or that other authentication methods like certificates or federated credentials are in use.

Answer

The service principal is using federated credentials.

Answer

The service principal uses certificate-based authentication.

Answer

The Microsoft Graph application is disabled.

Question 15

Refer to the exhibit. An administrator runs the KQL query in Microsoft Defender for Endpoint. The result set is empty. What is the most likely reason?

Accepted Answer

No logon events with the account name 'admin' exist in the past 7 days.. The KQL query filters for logon events where the AccountName equals 'admin' (lowercase). If no such events occurred in the last 7 days, the result set will be empty. This is the most likely reason because the query explicitly restricts the time range and account name, and an empty result does not indicate a broader issue with onboarding or case sensitivity.

Answer

The device is not onboarded to Microsoft Defender for Endpoint.

Answer

The query is case-sensitive and the account name is 'Admin' with a capital A.

Answer

There are no logon events in the last 7 days.