MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 15 — 15 Questions

Question 1

Refer to the exhibit. You have a Conditional Access policy configured as shown. What is the effect of this policy?

Accepted Answer

It blocks access from trusted IP addresses.. The policy is configured to 'Block access' for 'All users' and 'All cloud apps' when the location condition is set to 'Trusted IPs'. This means that when a user attempts to access from an IP address defined as trusted in the organization's named locations, access is explicitly blocked. The effect is that trusted IP addresses are blocked, not untrusted ones.

Answer

It requires multi-factor authentication for trusted IPs.

Answer

It blocks access from all locations.

Answer

It blocks access from untrusted IP addresses.

Question 2

Your organization has a Microsoft 365 E5 tenant with 10,000 users. You need to ensure that when a user is detected as high-risk by Microsoft Entra ID Protection, the user is automatically blocked from accessing sensitive SharePoint sites. The solution should minimize administrative overhead. What should you do?

Accepted Answer

Create a Conditional Access policy targeting high-risk users, apply to SharePoint, and set 'Block access' or 'Use app enforced restrictions'.. A Conditional Access (CA) policy can directly target 'High risk' users (via Microsoft Entra ID Protection risk detection) and apply to SharePoint. By setting the grant control to 'Block access' or 'Use app enforced restrictions', you automatically block or restrict access to sensitive SharePoint sites without manual intervention, minimizing administrative overhead. This integrates natively with Microsoft 365 and requires no additional services or custom scripting.

Answer

Create a session policy in Microsoft Defender for Cloud Apps to block high-risk users from accessing SharePoint.

Answer

Configure a user risk policy in Microsoft Entra ID Protection to block sign-ins for high-risk users.

Answer

Deploy Microsoft Sentinel and create a custom analytics rule to trigger an automated response via Logic App.

Question 3

Your company is deploying Microsoft 365 for a new subsidiary with 500 users. You need to configure the initial tenant with a custom domain (contoso.com) and verify ownership. What is the first step you must perform?

Accepted Answer

Add a TXT record provided by Microsoft 365 to the contoso.com DNS zone.. To verify ownership of a custom domain in Microsoft 365, you must prove you control the domain's DNS zone. Microsoft provides a unique TXT record value that you add to the public DNS zone of contoso.com. Once the TXT record propagates, Microsoft queries it and confirms ownership, allowing you to proceed with domain configuration.

Answer

Delegate the contoso.com zone to Microsoft 365 DNS servers.

Answer

Create user accounts with the custom domain before verification.

Answer

Set contoso.com as the default domain in the Microsoft 365 admin center.

Question 4

You are configuring Microsoft 365 tenant-to-tenant migration. Which THREE tasks must be completed before migrating users?

Accepted Answer

Obtain tenant consent for data migration (e.g., via admin consent). Option B is correct because tenant-to-tenant migrations require explicit authorization between the source and target tenants, typically granted through an admin consent URL that creates an enterprise application/service principal in the source tenant so the migration tool can read and write data. Option D is correct because you must add and verify the source domain (via a TXT record) in the target Microsoft 365 tenant before you can pre-stage or map users, mailboxes, and domains during migration. Option E is correct because directory synchronization (for example, using Microsoft Entra Connect or cross-tenant synchronization/Identity Manager) is needed to establish matching user identities and mail-enabled objects between tenants so migrated users retain proper object references. Option A is not required before migrating users; MX record changes are part of the final cutover and should occur only after mailboxes and mail flow are ready, otherwise mail delivery breaks. Option C is wrong because deleting source mailboxes before migration would destroy the data being migrated; source mailboxes must remain intact until the migration and cutover are complete.

Answer

Change MX records to point to the target tenant

Answer

Delete source tenant user mailboxes

Question 5

Refer to the exhibit. A Conditional Access policy is created in Microsoft Entra ID. The policy targets the Office 365 app (which includes Exchange Online). You have 1000 users assigned. What is the immediate effect of this policy on users who are currently signed in?

Accepted Answer

No immediate effect; users will be blocked on their next sign-in attempt.. Conditional Access policies in Microsoft Entra ID are evaluated at the time of sign-in. They do not terminate existing sessions. Therefore, users who are already signed in will not be affected until their next authentication attempt, at which point the policy's block action will be enforced.

Answer

All high-risk users are immediately blocked from accessing email.

Answer

The policy is invalid because the Office 365 app does not support block.

Answer

Only users with a sign-in risk of high are blocked.

Question 6

Refer to the exhibit. You are reviewing a Microsoft Entra ID Governance access review. The JSON shows an access review scope for a SharePoint site. What does the 'isExternallyAccessible': false setting indicate about the site?

Accepted Answer

External users cannot access the site.. The 'isExternallyAccessible': false setting in the access review scope JSON indicates that the SharePoint site is not configured to allow external sharing. This means external users cannot access the site, making option B correct. The setting directly controls whether the site is visible to external identities in the access review, not the review process itself.

Answer

The site's external sharing settings are not reviewed.

Answer

The site is configured to allow sharing with anyone.

Answer

External users are automatically granted access.

Question 7

You are a Microsoft 365 administrator. Your tenant has a Microsoft Entra ID P2 license. You need to create a dynamic group for all users whose department is 'Engineering' and who are located in the United States. Which rule syntax should you use?

Accepted Answer

user.department -eq "Engineering" and user.country -eq "United States". Dynamic group rules in Microsoft Entra ID require the use of lowercase 'and' as the logical operator, and the country attribute value must match the display name 'United States' as stored in the directory. The rule syntax must follow the property -operator 'value' format exactly, with no capitalization of 'and'.

Answer

user.department -eq "Engineering" and user.country -eq "US"

Answer

user.department -eq "Engineering" And user.country -eq "United States"

Answer

user.department -eq "Engineering" AND user.country -eq "United States"

Question 8

Your company has a Microsoft 365 E5 tenant. You need to ensure that all external emails are marked with a warning banner at the top of the email body. What should you configure?

Accepted Answer

A mail flow rule (transport rule) to add a disclaimer.. A mail flow rule (transport rule) in Exchange Online can be configured to prepend a disclaimer (warning banner) to the body of all external emails. This is the only mechanism that directly modifies the email body content for inbound or outbound messages based on sender/recipient criteria, such as when the sender is external to the organization.

Answer

A Safe Attachments policy in Microsoft Defender for Office 365.

Answer

External email tagging in the Microsoft 365 Defender portal.

Answer

A DLP policy with a sensitive information type.

Question 9

A company has a Microsoft 365 E5 tenant with 10,000 users. You need to delegate the ability to manage Microsoft Entra ID roles to a group of support engineers. The solution must follow the principle of least privilege and allow engineers to assign only specific roles to users. What should you do?

Accepted Answer

Create a custom role in Microsoft Entra ID with permissions to assign specific roles, and use PIM to enable just-in-time access. It follows the principle of least privilege by creating a custom role that grants only the specific permissions needed to assign designated roles, and using Privileged Identity Management (PIM) for just-in-time (JIT) access ensures engineers are elevated only when required. This approach avoids granting standing administrative privileges and allows granular control over which roles can be assigned, meeting the requirement to delegate role management without over-provisioning.

Answer

Assign the engineers the Privileged Role Administrator role

Answer

Add the engineers to the Global Administrator role in Microsoft Entra ID

Answer

Create a group in Microsoft Entra ID and assign it the User Administrator role, then use PIM to elevate

Question 10

Your organization uses Microsoft 365 Business Premium. You need to ensure that when a user is assigned an Intune license, the device automatically enrolls in Microsoft Intune. What should you configure?

Accepted Answer

Configure Microsoft Entra ID device settings to enable MDM automatic enrollment. Microsoft Entra ID (formerly Azure AD) device settings include an option to enable automatic MDM enrollment for users assigned an Intune license. When enabled, any device that signs in with a licensed user account will automatically enroll in Microsoft Intune, satisfying the requirement without additional configuration.

Answer

Create a device compliance policy to require enrollment

Answer

Create a device enrollment restriction in Intune to block personal devices

Answer

Deploy a device configuration profile with enrollment settings

Question 11

A user reports that they cannot access Microsoft Teams from their mobile device. Other Microsoft 365 services work fine. You verify that the device is compliant with Intune policies. What is the most likely cause?

Accepted Answer

A Conditional Access policy requires an approved client app for Teams. A Conditional Access policy requiring an approved client app for Microsoft Teams would block access from a mobile device even if the device is Intune-compliant, as the policy specifically checks for the use of an approved app (e.g., the official Microsoft Teams app) rather than just device compliance. Since the user can access other Microsoft 365 services, the issue is isolated to Teams, and the device compliance status rules out broader device-level blocks.

Answer

The user's authentication method is not registered for Microsoft Entra ID

Answer

The Microsoft Teams service is degraded

Answer

The device is not enrolled in Microsoft Intune

Question 12

Your organization has a hybrid identity with Microsoft Entra Connect. You need to migrate from federation to password hash synchronization with seamless single sign-on (SSO). The migration must have minimal user impact. Which tool should you use?

Accepted Answer

Microsoft Entra Connect migration tool (Convert domain from federated to managed). The Microsoft Entra Connect migration tool (Convert domain from federated to managed) is the correct choice because it automates the conversion of federated domains to managed domains while enabling password hash synchronization (PHS) and seamless SSO. This tool minimizes user impact by allowing a staged migration where users can continue authenticating via federation until the conversion is complete, and it handles the necessary configuration changes in Microsoft Entra ID and on-premises Active Directory.

Answer

IdFix tool

Answer

AD FS Management console

Answer

Azure AD Connect wizard

Question 13

You need to ensure that only users from your organization can access a SharePoint Online site. Which setting should you configure?

Accepted Answer

Set the SharePoint Online external sharing setting to 'Only people in your organization'. The SharePoint Online external sharing setting 'Only people in your organization' explicitly restricts all sharing and access to users who have a valid identity in your Microsoft Entra ID tenant. This setting prevents any external user (including guests) from accessing the site, regardless of how they were invited or authenticated. It is the most direct and effective control for limiting access to internal users only.

Answer

Create a Conditional Access policy to block external users

Answer

Configure the Microsoft Entra ID external collaboration settings

Answer

Modify the site permissions to remove external users

Question 14

You have a Microsoft 365 E5 tenant with Microsoft Defender for Cloud Apps. You need to discover unsanctioned cloud apps used by users. What should you configure?

Accepted Answer

Microsoft Defender for Cloud Apps Cloud Discovery. Microsoft Defender for Cloud Apps Cloud Discovery is the correct feature for identifying unsanctioned cloud apps used in your environment. It analyzes traffic logs from your network or endpoints to discover all cloud app usage, categorizes them by risk, and allows you to sanction or unsanction them. This directly fulfills the requirement to discover unsanctioned cloud apps.

Answer

Conditional Access App Control

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Defender for Endpoint App Control

Question 15

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP). You need to ensure that sensitive data such as credit card numbers cannot be shared externally via email. Which THREE components should you configure?

Accepted Answer

Define sensitive information types for credit card numbers. A is correct because sensitive information types (SITs) are predefined or custom patterns that detect specific data like credit card numbers (e.g., regex matching major credit card formats). Defining the SIT for credit card numbers allows the DLP policy to identify this sensitive content in emails, which is the first step before any action can be taken.

Answer

Enable Microsoft Purview Insider Risk Management

Answer

Configure a retention policy for email