MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 15 — 15 Questions

Question 1

Your organization uses Microsoft 365 E5 licenses. You need to ensure that all external sharing links for SharePoint Online expire after 30 days by default. You configure this in the SharePoint admin center. However, users report that links created before the change still do not have an expiration. What should you do?

Accepted Answer

Use the Set-SPOTenant -RequireAcceptingAccountMatchInvitedAccount parameter.. Option A is correct because the `Set-SPOTenant -RequireAcceptingAccountMatchInvitedAccount` parameter, when set to `$true`, forces all external sharing links to require the invited account to match the accepting account, which effectively invalidates any pre-existing links that do not meet this condition. This is the only way to enforce expiration on links created before the policy change, as the SharePoint admin center setting for default link expiration only applies to newly created links, not existing ones.

Answer

Reconfigure the setting in SharePoint admin center and save again.

Answer

Run Set-SPOTenant -DefaultSharingLinkExpirationInDays 30.

Answer

Create a data loss prevention (DLP) policy in Microsoft Purview to block unexpired links.

Question 2

You are deploying Microsoft 365 for a new subsidiary. The subsidiary has a single domain subsidiary.com. You need to configure a hybrid identity solution with Microsoft Entra ID. The on-premises Active Directory has a single domain and all user accounts are synchronized using Microsoft Entra Connect. You want to ensure that users can sign in to Microsoft 365 using their on-premises credentials without exposing the password hash to Microsoft. What should you do?

Accepted Answer

Enable pass-through authentication (PTA) with Microsoft Entra Connect.. Option D is correct because pass-through authentication (PTA) allows users to sign in to Microsoft 365 using their on-premises credentials without storing password hashes in Microsoft Entra ID. PTA validates passwords directly against on-premises Active Directory via an agent, ensuring no password hash is exposed to Microsoft, which meets the stated requirement.

Answer

Configure password hash synchronization.

Answer

Create cloud-only user accounts and disable on-premises authentication.

Answer

Implement Active Directory Federation Services (AD FS) with Microsoft Entra ID.

Question 3

Your company has a Microsoft 365 E5 subscription. You need to configure multi-factor authentication (MFA) for all users. However, the CEO insists that he should not be prompted for MFA when connecting from the corporate office. What should you do?

Accepted Answer

Create a Conditional Access policy that excludes the corporate office named location from requiring MFA.. Option D is correct because named locations in Microsoft Entra ID Conditional Access allow you to define trusted IP ranges (e.g., corporate office) and exclude them from MFA requirements. Option A is wrong because disabling MFA for the CEO violates the requirement to have MFA for all users. Option B is wrong because per-user MFA does not support location-based exclusions. Option C is wrong because trusted IPs in MFA settings apply to all users and cannot be scoped to a single user.

Answer

Use per-user MFA and set the CEO's account to bypass.

Answer

Disable MFA for the CEO's account.

Answer

Configure trusted IPs in the MFA service settings.

Question 4

Your organization has a Microsoft 365 tenant with a custom domain contoso.com. You have configured Exchange Online to accept emails for contoso.com. You now need to add a subdomain sales.contoso.com and ensure that email sent to sales.contoso.com is delivered to a specific shared mailbox. What should you do?

Accepted Answer

Add sales.contoso.com as an accepted domain in Exchange Online and create a transport rule to redirect emails to the shared mailbox.. Option B is correct because to route email for a subdomain to a specific mailbox, you must first add the subdomain as an accepted domain in Exchange Online (not as a custom domain in the admin center, since the parent domain is already verified). Then, you create a transport rule that matches recipients in that accepted domain and redirects the messages to the target shared mailbox. This ensures that all emails sent to sales.contoso.com are delivered to the designated mailbox without requiring additional MX records or domain verification.

Answer

Add sales.contoso.com as a custom domain in the Microsoft 365 admin center and verify ownership.

Answer

Configure an auto-expanding archive for the shared mailbox.

Answer

Create a distribution group named sales@contoso.com and add the shared mailbox as a member.

Question 5

You manage a Microsoft 365 tenant for a multinational corporation. You need to implement Microsoft Purview Information Protection to automatically classify and protect documents containing credit card numbers. The solution must apply encryption automatically when a document is saved to SharePoint Online. What should you do?

Accepted Answer

Create an auto-labeling policy in Microsoft Purview that uses a sensitivity label configured with encryption.. Option B is correct because auto-labeling policies in Microsoft Purview can scan documents for sensitive information types (e.g., credit card numbers) and automatically apply a sensitivity label with encryption. Option A is wrong because DLP policies can block sharing but do not label documents. Option C is wrong because the client-side labeling requires user interaction. Option D is wrong because the default label applies to all documents without specific conditions.

Answer

Create a DLP policy in Microsoft Purview that blocks sharing of documents containing credit card numbers.

Answer

Configure client-side labeling via Microsoft 365 Apps to prompt users to label documents.

Answer

Set a default sensitivity label for SharePoint Online document libraries.

Question 6

Your organization uses Microsoft 365 Business Premium. You need to ensure that all Windows 10 devices are enrolled in Microsoft Intune and comply with a device compliance policy that requires BitLocker encryption and a minimum OS version. What should you do first?

Accepted Answer

Configure automatic enrollment in Microsoft Entra ID for Windows 10 devices.. To enforce Intune compliance policies on Windows 10 devices, the devices must first be enrolled in Intune. Automatic enrollment in Microsoft Entra ID (formerly Azure AD) is the prerequisite step that enables Windows 10 devices to automatically enroll in Intune when they join or are registered with Entra ID. Without this enrollment configured, no Intune policies—including compliance policies—can be applied to the devices.

Answer

Install the Intune Connector for Active Directory on a domain controller.

Answer

Deploy a configuration profile to enable BitLocker.

Answer

Create a device compliance policy in Microsoft Intune.

Question 7

You have a Microsoft 365 E5 tenant. Users report that they cannot access the Microsoft 365 admin center (https://admin.microsoft.com). You verify that they have the Global Administrator role assigned. You check the sign-in logs in Microsoft Entra ID and see that the sign-in was blocked by a Conditional Access policy. The policy requires MFA and a compliant device. The users are using personal devices that are not enrolled. What should you do to allow access while maintaining security?

Accepted Answer

Modify the Conditional Access policy to exclude the Microsoft 365 admin center from the device compliance requirement, but keep MFA.. Option D is correct because it allows users to access the Microsoft 365 admin center by removing the device compliance requirement for that specific cloud app while still enforcing MFA. This maintains security through MFA and avoids blocking access for users on personal, unenrolled devices. Disabling the policy entirely or requiring enrollment would either weaken security or be impractical for personal devices.

Answer

Disable the Conditional Access policy.

Answer

Ask users to enroll their personal devices in Microsoft Intune.

Answer

Remove the Global Administrator role from the users and assign a lower privilege role.

Question 8

Your company is deploying Microsoft 365 Copilot. You need to ensure that users can use Copilot in Word, Excel, and PowerPoint. The licensing is in place. However, you are concerned about data leakage. You want to ensure that Copilot does not use sensitive organizational data when generating content. What should you configure in Microsoft 365?

Accepted Answer

Create and assign sensitivity labels with encryption to sensitive documents, and ensure Copilot respects these labels.. Option A is correct because Microsoft 365 Copilot respects sensitivity labels that are applied to documents. By creating and assigning sensitivity labels with encryption to sensitive documents, you can prevent Copilot from using that content as source material when generating responses. This is configured via Microsoft Purview Information Protection, where labels can include encryption settings that Copilot will honor, ensuring data leakage is mitigated without blocking Copilot functionality entirely.

Answer

Configure a data loss prevention (DLP) policy to block Copilot from accessing sensitive data.

Answer

Use the Microsoft Purview compliance portal to restrict Copilot data access.

Answer

Disable Copilot for users who handle sensitive data.

Question 9

Your organization has a Microsoft 365 E5 tenant. You need to set up a shared mailbox for the IT help desk (helpdesk@contoso.com). The help desk team needs to monitor the mailbox and respond to emails. What is the recommended way to grant access to the shared mailbox?

Accepted Answer

Add the help desk users as members of the shared mailbox from the Exchange admin center.. Option C is correct because the recommended method to grant access to a shared mailbox in Exchange Online is to add users as members directly from the Exchange admin center (EAC). This automatically assigns the necessary Full Access and Send As permissions without requiring licenses for each user, as shared mailboxes can be accessed by licensed users without needing a separate license for the mailbox itself.

Answer

Assign an Exchange Online license to each help desk user and grant them Full Access via PowerShell.

Answer

Create a security group and add it to the shared mailbox permissions.

Answer

Create a distribution group containing the help desk users and grant the group access to the mailbox.

Question 10

You are reviewing a Conditional Access policy in Microsoft Entra ID. The exhibit shows the policy configuration. You need to allow users to access Office 365 applications from personal devices that are not enrolled in Microsoft Intune. However, the policy currently blocks access because it requires a compliant device. Users are prompted for MFA but then blocked due to device compliance. What should you modify in the policy?

Accepted Answer

Remove "compliantDevice" from the builtInControls grant control list.. Option C is correct because the policy requires both MFA and compliant device (grantControls). To allow access from non-compliant devices, you can remove the compliantDevice requirement and only require MFA. Alternatively, you can add an exception for personal devices, but modifying the grant controls is straightforward. Option A is wrong because changing session controls does not affect grant requirements. Option B is wrong because cloud app security is a session control, not a grant control. Option D is wrong because sign-in frequency is a session control.

Answer

Add a session control for sign-in frequency.

Answer

Remove the cloudAppSecurity session control.

Answer

Change cloudAppSecurityType to "blockDownloads".

Question 11

Your organization is planning to migrate from on-premises Exchange to Exchange Online. You need to choose a migration strategy. Which TWO statements about migration methods are correct?

Accepted Answer

A minimal hybrid deployment allows you to manage mailboxes in both on-premises and Exchange Online.. Options A and D are correct. Option A: Minimal hybrid is a valid migration approach. Option D: Cutover migration is for fewer than 2000 mailboxes. Option B is wrong because staged migration not supported for Exchange 2019. Option C is wrong because IMAP migration does not migrate calendar data. Option E is wrong because hybrid migration requires AD synchronization.

Answer

A hybrid migration requires that you do not synchronize on-premises Active Directory with Microsoft Entra ID.

Answer

A staged migration can be used to migrate mailboxes from Exchange 2019 to Exchange Online.

Answer

An IMAP migration migrates email, contacts, and calendar data.

Question 12

You are implementing Microsoft Defender for Office 365. You need to configure anti-phishing policies to protect against user impersonation. Which THREE settings should you configure?

Accepted Answer

Enable impersonation protection for domains you own.. Option A is correct because enabling impersonation protection for domains you own allows Defender for Office 365 to detect and act on attempts to spoof your organization's domain in the From address. This setting ensures that emails claiming to be from your domain are inspected for impersonation patterns, such as lookalike domains or display name spoofing, and can be automatically quarantined or have safety tips applied.

Answer

Set the bulk email threshold.

Answer

Configure spoof intelligence to allow or block senders.

Question 13

Your company uses Microsoft 365 Business Premium. You need to configure Microsoft Entra ID Protection to automatically remediate risks. Which TWO risk remediation actions can be configured?

Accepted Answer

Block sign-in for users with high sign-in risk.. Option D is correct because Microsoft Entra ID Protection allows you to configure an automated policy to block sign-ins when the sign-in risk level is assessed as high. This policy directly remediates the risk by preventing the authentication attempt from succeeding, thereby protecting the account from potential compromise.

Answer

Block licensing assignments for users with high risk.

Answer

Configure session timeout for risky sessions.

Answer

Force password change for users with high user risk.

Question 14

You are the Microsoft 365 administrator for a large enterprise with 50,000 users. The company is deploying Microsoft 365 Copilot for all users. You need to ensure that the data used by Copilot is protected and that Copilot does not inadvertently expose sensitive information. The company has strict data residency requirements: all data must remain within the European Union (EU). You have already configured data boundaries in Microsoft 365 to keep data in the EU. However, you are concerned about Copilot's AI model training. You need to implement additional controls. The company uses Microsoft Purview Information Protection with sensitivity labels. You have created a sensitivity label "Highly Confidential" that applies encryption and a "Confidential" label that applies visual markings. You also have a DLP policy that prevents sharing of "Highly Confidential" data externally. You need to ensure that when a user uses Copilot with a document labeled "Highly Confidential", the Copilot response does not include any of the sensitive content from that document. What should you do?

Accepted Answer

Ensure that the Highly Confidential sensitivity label includes encryption when applied.. Option B is correct because the 'Highly Confidential' sensitivity label already applies encryption, which prevents Microsoft 365 Copilot from accessing the document's content. Copilot cannot process or include encrypted content in its responses, as encryption blocks the AI model from reading the underlying data. This ensures that sensitive information from encrypted documents is not inadvertently exposed in Copilot outputs.

Answer

Exclude users who handle Highly Confidential data from Copilot licensing.

Answer

Create a DLP policy that blocks Copilot from accessing documents labeled Highly Confidential.

Answer

Configure Microsoft 365 data boundaries to restrict Copilot data processing to the EU.

Question 15

Your organization has a hybrid identity deployment with Microsoft Entra Connect. You have synchronized all on-premises Active Directory users to Microsoft Entra ID. You need to enable Microsoft Entra ID Password Protection to automatically block weak passwords. You have installed the Password Protection proxy on a server and registered it. You also need to enforce the password protection policy for on-premises users. What additional step is required?

Accepted Answer

Install the Password Protection DC agent on each domain controller.. The Password Protection DC agent is required on each domain controller to intercept and validate password changes against the Microsoft Entra ID Password Protection policy. Without this agent, the proxy server alone cannot enforce the policy for on-premises users, as the DC agent is the component that applies the password filter during password change operations.

Answer

Install the Password Protection proxy on all domain controllers.

Answer

Enable the password filter in the Microsoft Entra Connect configuration.

Answer

Configure a Group Policy to require password complexity.