MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 14 — 15 Questions

Question 1

After adding a custom domain name to a Microsoft 365 tenant, what is the first step the administrator must complete before users can sign in using the custom domain?

Accepted Answer

Verify domain ownership by adding a DNS TXT record. Before a custom domain can be used for user sign-ins or email routing in Microsoft 365, the administrator must prove ownership of the domain. This is done by adding a specific DNS TXT record provided by the Microsoft 365 domain setup wizard. Until the TXT record is verified, the domain remains unverified and cannot be used for any Microsoft 365 services.

Answer

Add the domain as an accepted domain in Exchange Online

Answer

Set the custom domain as the default domain for new users

Answer

Create user accounts with usernames ending with the custom domain

Question 2

A company recently added the custom domain 'contoso.com' to their Microsoft 365 tenant. Users report that they cannot receive external email sent to their new domain addresses. The administrator confirmed that the domain status shows 'Active' in the Microsoft 365 admin center. What is the most likely cause of this issue?

Accepted Answer

The MX record for the domain is missing or points to an incorrect mail server.. The domain status 'Active' in the Microsoft 365 admin center indicates that the domain has been successfully verified and added to the tenant. However, for external email to be delivered to users at that domain, the public MX record in DNS must point to Microsoft 365's mail servers (e.g., contoso-com.mail.protection.outlook.com). If the MX record is missing or points to an incorrect server, external senders cannot route email to the tenant, even though the domain is verified and active.

Answer

The domain was not verified with a TXT record.

Answer

The SPF record for the domain is missing or incorrectly configured.

Answer

The custom domain was not added to the user's primary email address.

Question 3

A company with 200 on-premises Exchange mailboxes plans to migrate to Exchange Online. They want to use a Microsoft-provided tool that supports granular control over mailbox migrations, allows batch migrations, and provides detailed reporting. Which migration method should the administrator choose?

Accepted Answer

Exchange Admin Center (EAC) migration dashboard. The Exchange Admin Center (EAC) migration dashboard is the correct choice because it is a Microsoft-provided tool that supports granular control over mailbox migrations (e.g., selecting specific users, setting migration endpoints, and configuring throttling), allows batch migrations with the ability to start, stop, and monitor multiple batches simultaneously, and provides detailed reporting on migration status, errors, and sync progress. This method is specifically designed for migrating on-premises Exchange mailboxes to Exchange Online in a controlled, staged manner, making it ideal for the scenario described.

Answer

Azure AD Connect

Answer

Third-party migration tool (e.g., BitTitan MigrationWiz)

Answer

IMAP migration

Question 4

A company has 500 users across Sales, Marketing, and IT departments. User objects are synced from on-premises Active Directory to Microsoft Entra ID using Azure AD Connect. Each department requires different Microsoft 365 license plans (e.g., Sales needs E3, Marketing needs Business Premium, IT needs E5). The administrator wants to automatically assign the appropriate license based on the department attribute without manual intervention. Which approach should the administrator use?

Accepted Answer

Configure group-based licensing using Microsoft Entra dynamic groups with rules based on the department attribute.. Microsoft Entra ID supports group-based licensing, which allows automatic license assignment to users based on their membership in dynamic groups. By creating dynamic groups with rules that filter on the department attribute (e.g., 'user.department -eq "Sales"'), the administrator can assign the appropriate license plan (E3, Business Premium, E5) to each group, and licenses are automatically applied or removed as users are added or removed from the group, without any manual or scripted intervention.

Answer

Create a script that runs daily to sync department values and assign licenses using PowerShell.

Answer

Use Azure AD Connect to filter objects and assign licenses during sync.

Answer

Manually assign licenses to each user in the Microsoft 365 admin center.

Question 5

An administrator adds the custom domain 'fabrikam.com' to a new Microsoft 365 tenant. After adding the domain, the status shows 'Pending verification'. Which type of DNS record must be added to the public DNS zone to complete domain ownership verification?

Accepted Answer

TXT record. To verify domain ownership in Microsoft 365, you must add a TXT record with a specific verification value provided by the Microsoft 365 admin center to the public DNS zone. This proves you control the domain because only the domain owner can modify DNS records. Other record types like MX, CNAME, or SPF are used for mail routing or service configuration, not for ownership verification.

Answer

MX record

Answer

CNAME record

Answer

SPF record

Question 6

A new employee has been hired and their account already exists in the on-premises Active Directory. The administrator needs to provide the employee with access to Microsoft 365 services as quickly as possible. What is the most efficient way to enable the user?

Accepted Answer

Sync the on-premises user using Azure AD Connect and then assign the license.. The user already exists in on-premises Active Directory, and the fastest way to enable Microsoft 365 access is to synchronize that identity using Azure AD Connect. Once synchronized, the user object appears in Microsoft Entra ID (formerly Azure AD), and the administrator can immediately assign a license without re-creating the account. This avoids the delays of manual creation or guest invitations and leverages the existing identity lifecycle.

Answer

Create a new cloud-only user in the Microsoft 365 admin center and assign a license.

Answer

Manually create a user in Microsoft Entra ID with the same name and assign license.

Answer

Use Azure AD B2B collaboration to invite the on-premises user as a guest.

Question 7

An administrator is setting up a new Microsoft 365 tenant and has added the custom domain 'contoso.com'. The domain status shows 'Pending verification'. Which type of DNS record must the administrator add to the public DNS zone to complete domain ownership verification?

Accepted Answer

TXT record. To verify domain ownership in Microsoft 365, you must add a TXT record containing the unique verification string provided by the Microsoft 365 admin center to the public DNS zone. The TXT record proves you control the domain by allowing Microsoft to query the DNS and match the value. This is the standard method defined by RFC 1035 for domain validation.

Answer

MX record

Answer

CNAME record

Answer

SPF record

Question 8

A company has purchased 1000 Microsoft 365 E5 licenses and wants to automatically assign licenses to users based on their department attribute, which is synchronized from on-premises Active Directory. The department attribute is stored in Azure AD. Which automated method should the administrator use to achieve this?

Accepted Answer

Group-based licensing with dynamic groups. Group-based licensing with dynamic groups is the correct method because it allows automatic license assignment based on user attributes like department, which is synchronized from on-premises Active Directory via Azure AD Connect. Dynamic groups evaluate membership rules in Azure AD, and when a user's department attribute matches the rule, the group-based licensing policy automatically assigns or removes the Microsoft 365 E5 license without manual intervention.

Answer

scheduled PowerShell script that runs daily

Answer

Manual license assignment via the Microsoft 365 admin center

Answer

Bulk assign licenses using the admin center import feature

Question 9

A company recently acquired another company and needs to allow users from the acquired tenant to access its SharePoint Online sites as guest users, but only if those users already have accounts in the acquired Azure AD tenant. Which Microsoft 365 feature should be configured?

Accepted Answer

Cross-tenant access settings for B2B collaboration. Cross-tenant access settings for B2B collaboration allow you to configure inbound and outbound access between two Azure AD tenants. By enabling B2B collaboration with the acquired tenant and setting the appropriate cross-tenant access policies, you can invite users who already have accounts in that tenant as guest users to access SharePoint Online sites. This ensures that only authenticated users from the acquired tenant are granted access, meeting the requirement.

Answer

B2B direct connect

Answer

Multi-Geo

Answer

Tenant Restrictions

Question 10

An administrator needs to configure email notifications for Exchange Online service health incidents to be sent to a specific IT support mailbox. Where should the administrator configure these notifications in the Microsoft 365 admin center?

Accepted Answer

Health > Service health > Customize notifications. The 'Customize notifications' link under Health > Service health in the Microsoft 365 admin center is the dedicated interface for configuring email notifications for service health incidents, including Exchange Online. This allows administrators to specify which email addresses (such as an IT support mailbox) receive alerts for service incidents, advisories, and other health events, with granular control over which services and severity levels trigger notifications.

Answer

Organization profile > Notifications > Service health

Answer

Mail flow connectors

Answer

Settings > Service settings

Question 11

A user account was accidentally deleted 10 days ago. The administrator needs to restore the user's mailbox and OneDrive for Business content. Which method should the administrator use?

Accepted Answer

Restore the user from the 'Deleted users' page in the Microsoft 365 admin center.. Microsoft 365 retains deleted user objects, including their Exchange Online mailbox and OneDrive for Business data, for 30 days in the 'Deleted users' list. Restoring the user from this page within the retention period automatically recovers the associated mailbox and OneDrive content without requiring separate tools or support requests.

Answer

Recreate the user account with the same name, and the data will be automatically restored.

Answer

Use the Exchange admin center to recover the mailbox only.

Answer

Submit a support request to Microsoft to recover the deleted data.

Question 12

An organization uses a third-party SaaS application that supports SAML-based single sign-on. The application is not in the Azure AD gallery. What is the first step to configure SSO?

Accepted Answer

Create a new enterprise application from the 'Non-gallery application' option in Azure AD. The correct first step is to create a new enterprise application from the 'Non-gallery application' option in Azure AD. This allows you to configure SAML-based SSO for any third-party application that supports SAML 2.0, even if it is not listed in the Azure AD gallery. The non-gallery application template provides the necessary endpoints and metadata to establish trust between Azure AD and the SaaS application.

Answer

Configure Azure AD Connect to sync on-premises users

Answer

Add the application in the Microsoft 365 admin center under 'Integrated apps'

Answer

Create a custom role in Azure AD for the application

Question 13

An administrator has configured group-based licensing in Azure AD. After adding users to the group, some users do not receive licenses. The users are in the group and have an assigned usage location. What is a possible reason?

Accepted Answer

The users have conflicting license assignments from another source. Group-based licensing in Azure AD can fail when a user already has a license assigned from another source, such as direct assignment or another group. Azure AD's group-based licensing processes assignments in a deterministic order, and if a conflict arises (e.g., different service plans or SKUs), the system may skip the user and log an error in the audit logs. This is a common scenario when users are migrated from direct licensing to group-based licensing without removing the existing assignments.

Answer

The group is a mail-enabled security group, which is not supported for group-based licensing

Answer

The license product name in the group setting does not match the available licenses in the tenant

Answer

The users have not accepted the Microsoft Online Service Terms

Question 14

An administrator has added a custom domain 'contoso.com' to their Microsoft 365 tenant and verified ownership. However, users are unable to receive emails sent to their custom domain. Which type of DNS record must the administrator add in the public DNS zone to route emails to Exchange Online?

Accepted Answer

MX record. The MX (Mail Exchange) record is the DNS record type that directs email messages to a specific mail server. For Exchange Online, the MX record must point to the tenant's mail exchanger (e.g., contoso-com.mail.protection.outlook.com) with a priority value (typically 0). Without this record, sending mail servers cannot route inbound emails to the custom domain's mailbox store in Exchange Online.

Answer

TXT record

Answer

CNAME record

Answer

SPF record

Question 15

A company has an existing Microsoft 365 tenant with the verified custom domain 'contoso.com'. The administrator now wants to add a second custom domain, 'contoso-europe.com', to the same tenant. What is the first step the administrator should take?

Accepted Answer

Add the domain in the Microsoft 365 admin center.. The first step to add a second custom domain to an existing Microsoft 365 tenant is to initiate the domain addition process in the Microsoft 365 admin center. This triggers the system to generate the unique TXT verification record that must be added to the public DNS zone to prove ownership of the domain. Without first adding the domain in the admin center, the administrator would not know the specific verification value required for the DNS record.

Answer

Add a TXT verification record in the public DNS zone for 'contoso-europe.com'.

Answer

Add an MX record pointing to Exchange Online in the public DNS zone for 'contoso-europe.com'.

Answer

Contact Microsoft support to enable the domain addition feature.