MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 14 — 15 Questions

Question 1

Your organization is preparing to deploy Microsoft 365 for 5,000 users. You need to ensure that all users can authenticate using their existing on-premises Active Directory credentials while minimizing infrastructure changes. You also need to support self-service password reset (SSPR) for cloud-only users. Which authentication method should you recommend?

Accepted Answer

Password Hash Synchronization (PHS). Password Hash Synchronization (PHS) is the correct choice because it synchronizes password hashes from on-premises Active Directory to Microsoft Entra ID, allowing users to authenticate with their existing credentials without additional infrastructure. It also enables cloud-only users to use self-service password reset (SSPR) independently, as SSPR relies on cloud-stored hashes and does not require on-premises write-back for cloud-only accounts.

Answer

Cloud-only authentication with Microsoft Entra ID

Answer

Pass-through Authentication (PTA)

Answer

Federation with AD FS

Question 2

Your organization has a Microsoft 365 E5 tenant. You need to ensure that users are prompted to register for multifactor authentication (MFA) the first time they sign in. Which Microsoft Entra ID policy should you configure?

Accepted Answer

Create a Conditional Access policy requiring MFA and enable Microsoft Entra ID Identity Protection to enforce MFA registration. Option B is correct because combining a Conditional Access policy that requires MFA with Identity Protection's MFA registration policy ensures users are prompted to register for MFA at first sign-in. The MFA registration policy in Identity Protection specifically enforces that users must register their authentication methods before accessing applications, which triggers the registration prompt on initial authentication.

Answer

Enable Security defaults

Answer

Enable combined registration for SSPR and MFA

Answer

Configure MFA service settings per-user

Question 3

Your company recently acquired a subsidiary that uses a different Microsoft 365 tenant. You are tasked with merging the two tenants into one. The subsidiary has 1,500 users with unique email domains. You need to migrate all users, mailboxes, and SharePoint data while minimizing downtime and preserving data integrity. You have access to both tenants as global admin. What should you do first?

Accepted Answer

Use a third-party migration tool such as BitTitan MigrationWiz to perform the migration. Option C is correct because Microsoft does not provide a native tool for merging two tenants; third-party tools like BitTitan MigrationWiz are designed specifically for cross-tenant migrations, supporting mailbox, SharePoint, and user data migration with minimal downtime and data integrity. These tools handle directory synchronization, mailbox rehydration, and SharePoint content mapping, which are critical for a 1,500-user migration with unique domains.

Answer

Add the subsidiary's domain to the primary tenant, then delete the subsidiary tenant and recreate users

Answer

Use the Microsoft 365 Merger Center in the admin portal

Answer

Use Microsoft's native tenant-to-tenant migration by moving mailboxes via PowerShell and exporting SharePoint content

Question 4

Your organization uses Microsoft 365 Copilot for Sales. You need to ensure that only licensed users can access Copilot features, and that usage is monitored for compliance. What should you configure?

Accepted Answer

Assign Copilot licenses to users in the Microsoft 365 admin center and monitor usage via the Reports dashboard. Option D is correct because licensing for Microsoft 365 Copilot for Sales is controlled through the Microsoft 365 admin center by assigning Copilot licenses to individual users. Usage monitoring is then available via the Reports dashboard, which provides adoption and usage metrics for licensed users. This ensures only licensed users access Copilot features and allows compliance monitoring without additional configuration.

Answer

Assign the Copilot Administrator role to users in Microsoft Entra ID

Answer

Configure a Microsoft Purview compliance policy for Copilot

Answer

Use PowerShell to assign Copilot licenses and enable audit logging in Microsoft Sentinel

Question 5

Your company has a Microsoft 365 E3 tenant. You need to enable Microsoft Purview Data Loss Prevention (DLP) to prevent sensitive data from being shared externally via email. What must you do first?

Accepted Answer

Upgrade to Microsoft 365 E5 or purchase a DLP add-on. Microsoft 365 E3 does not include the advanced DLP capabilities required to prevent sensitive data from being shared externally via email. The correct first step is to upgrade to Microsoft 365 E5 or purchase a DLP add-on license, as DLP policies for Exchange Online in E3 are limited to basic rule-based protection and cannot enforce the full Purview DLP policy set. Without the appropriate license, any attempt to create or apply a DLP policy will fail or be non-functional.

Answer

Create a DLP policy in Microsoft Defender XDR

Answer

Navigate to the Microsoft Purview compliance portal and create a DLP policy

Answer

Use Exchange Online PowerShell to configure DLP rules

Question 6

Your organization has a Microsoft 365 tenant with 10,000 users. You are configuring Microsoft Entra ID Identity Protection to detect risky sign-ins. You need to ensure that when a sign-in risk level of 'High' is detected, the user is blocked from signing in and an administrator is notified. What should you configure?

Accepted Answer

Create a Conditional Access policy with 'Sign-in risk' condition set to 'High' and 'Block access', and configure alert notifications in Identity Protection. Option A is correct because it combines a Conditional Access policy that blocks access when the sign-in risk level is 'High' with an alert notification configured in Identity Protection. The Conditional Access policy enforces the block at the authentication level, while the Identity Protection alert ensures administrators are notified of the high-risk sign-in event. This directly meets the requirement to both block the user and notify an admin.

Answer

Create a user risk policy in Identity Protection to block high-risk users

Answer

Create an MFA registration policy in Identity Protection

Answer

Enable Security defaults and configure notifications

Question 7

Your organization uses Microsoft Intune for mobile device management (MDM). You need to enforce that all iOS and Android devices must have a screen lock password of at least 6 characters before they can access corporate email. What should you configure?

Accepted Answer

Create an app protection policy in Microsoft Intune targeting iOS and Android with a minimum PIN length of 6. Option A is correct because an app protection policy (APP) in Microsoft Intune can enforce a minimum PIN length of 6 characters at the application layer, specifically for accessing corporate email in apps like Outlook. This policy applies regardless of device enrollment status and works on both iOS and Android, meeting the requirement to control access to corporate email without needing device-level management.

Answer

Create a Conditional Access policy requiring compliant devices

Answer

Create a device configuration profile to set a passcode policy of 6 characters

Answer

Create a device compliance policy requiring a password length of 6

Question 8

Your company is implementing Microsoft 365 Copilot for Microsoft 365. You need to ensure that Copilot can access data from across the organization, but only for users who have the appropriate permissions. What is the primary security boundary for Copilot data access?

Accepted Answer

Microsoft 365 permissions and sensitivity labels. Option B is correct because Copilot uses the existing Microsoft 365 permissions model. Users can only access data they have permissions to see. Option A is wrong because there is no separate Copilot security group. Option C is wrong because Copilot does not use Azure Information Protection labels as the primary boundary. Option D is wrong because Copilot respects user permissions, not data location.

Answer

A dedicated Copilot security group in Microsoft Entra ID

Answer

Microsoft Purview Information Protection labels

Answer

The geographic location of the data

Question 9

Your organization recently deployed Microsoft Defender for Office 365. Users report that some legitimate external emails are being quarantined as phishing attempts. You need to reduce false positives without compromising security. What should you do?

Accepted Answer

Add the sender domains to the allowed senders list in the anti-phishing policy. Option C is correct because adding the sender domains to the allowed senders list in the anti-phishing policy explicitly whitelists those domains for phishing checks, reducing false positives while still scanning for other threats. This approach preserves security by not lowering the overall spam filtering threshold or disabling protections, and it targets only the specific domains that are being incorrectly flagged.

Answer

Increase the Spam Confidence Level (SCL) threshold to 9

Answer

Disable the anti-phishing policy and use a custom mail flow rule

Answer

Change the spam filtering action to 'Move message to Junk Email folder' instead of quarantine

Question 10

Your organization has a Microsoft 365 E5 tenant with Microsoft Defender for Cloud Apps. You need to discover and control the use of unsanctioned cloud apps. Which TWO actions should you take? (Choose two.)

Accepted Answer

Define sanctioned and unsanctioned app categories in Microsoft Defender for Cloud Apps. Option A is correct because Microsoft Defender for Cloud Apps allows you to define sanctioned and unsanctioned app categories within the Cloud Discovery dashboard. By categorizing apps, you can apply governance actions such as blocking or monitoring, which directly controls the use of unsanctioned cloud apps. This is a foundational step in managing app usage, as it enables automated policies to enforce your organization's cloud app governance.

Answer

Deploy Microsoft Purview Data Loss Prevention policies

Answer

Configure Microsoft Entra ID App Registrations to log app usage

Answer

Create a Conditional Access policy to block all unsanctioned apps

Question 11

Your organization uses Microsoft Sentinel for security operations. You need to ensure that Sentinel can ingest logs from Microsoft 365 Defender (XDR) and Microsoft Entra ID. Which THREE data connectors should you enable? (Choose three.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint is a correct data connector because it ingests endpoint detection and response (EDR) logs from Windows, macOS, and Linux devices into Microsoft Sentinel. This integration allows security operations to correlate endpoint alerts with other signals, enabling advanced hunting and automated incident response across the Microsoft 365 Defender ecosystem.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Intune

Question 12

Your company is planning to use Microsoft 365 Copilot for Microsoft 365. Which THREE prerequisites are required for Copilot to function? (Choose three.)

Accepted Answer

Microsoft Entra ID (formerly Azure AD). Microsoft Entra ID (formerly Azure AD) is required because Copilot for Microsoft 365 relies on Entra ID for authentication, identity management, and policy enforcement. Without Entra ID, Copilot cannot verify user identities, apply conditional access policies, or access Microsoft Graph to retrieve user and organizational data.

Answer

Microsoft Sentinel for security monitoring

Answer

Microsoft Intune for mobile device management

Question 13

Refer to the exhibit. You are reviewing an app registration in Microsoft Entra ID for the Microsoft Teams Admin Center. The permission shown is for another resource. What is the consequence of this permission configuration?

Accepted Answer

The app can access Microsoft Graph data without a signed-in user, and admin consent is required. The exhibit shows an application permission (not a delegated permission) for Microsoft Graph, which means the app can access data without a signed-in user. Admin consent is required because application permissions grant tenant-wide access and cannot be consented to by individual users. This is why option A is correct.

Answer

The app can only be used by users who have consented to the permission

Answer

The app can access Teams data but not other Microsoft 365 data

Answer

The app can access Microsoft Graph on behalf of the signed-in user only

Question 14

Refer to the exhibit. You run the PowerShell commands shown. The output displays 10 mailboxes with various RecipientTypeDetails, including UserMailbox, SharedMailbox, and RoomMailbox. You need to ensure that only user mailboxes are returned. What should you modify?

Accepted Answer

Add the parameter -Filter "RecipientTypeDetails -eq 'UserMailbox'". The correct answer is C because the Get-Mailbox cmdlet returns all mailbox types by default. To filter only user mailboxes, you must use the -Filter parameter with the condition 'RecipientTypeDetails -eq 'UserMailbox''. This ensures that only mailboxes with RecipientTypeDetails set to UserMailbox are returned, excluding shared, room, and other mailbox types.

Answer

Use the -Properties parameter to specify additional attributes

Answer

Change RecipientTypeDetails to RecipientType in the Select-Object

Answer

Remove the -ShowProgress parameter

Question 15

You are a Microsoft 365 administrator for Contoso Corporation, a multinational company with 20,000 users. The company uses Microsoft 365 E5, Microsoft Entra ID P2, Microsoft Defender XDR, Microsoft Purview, and Microsoft Intune. The security team wants to implement a zero-trust access model. Requirements: 1. All access to corporate resources must require multifactor authentication (MFA) and device compliance. 2. Users must register for MFA before accessing any app. 3. Legacy authentication protocols must be blocked for all users. 4. External collaboration must be governed by identity governance. 5. Sensitive data in SharePoint Online must be protected by DLP. 6. All administrative actions must be audited. You need to design the configuration. Which combination of actions should you take?

Accepted Answer

Create Conditional Access policies requiring MFA and compliant devices, block legacy auth, enforce MFA registration via Identity Protection, set up Microsoft Entra ID Governance for external users, configure Purview DLP for SharePoint, and enable Purview Audit. Option C is correct. A Conditional Access policy requiring MFA and compliant devices, blocking legacy auth, and using Entra ID Identity Protection to enforce MFA registration meets requirements 1,2,3. Microsoft Entra ID Governance (Entitlement Management) handles external collaboration (requirement 4). Microsoft Purview DLP protects SharePoint (requirement 5). Microsoft Purview Audit (Standard or Premium) audits admin actions (requirement 6). Option A is wrong because Security defaults are less granular and may not block legacy auth for all users. Option B is wrong because Intune compliance policies alone do not enforce MFA. Option D is wrong because Microsoft Sentinel is for SIEM, not primary audit logging for admin actions (Purview Audit is correct).

Answer

Enable Security defaults, configure SharePoint DLP, and use Microsoft Purview Audit for admin actions

Answer

Create a Conditional Access policy requiring MFA, block legacy auth, and use Microsoft Defender for Cloud Apps to monitor admin actions

Answer

Use Microsoft Intune compliance policies, enable MFA per-user, and deploy Microsoft Sentinel for auditing