MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 15 — 15 Questions

Question 1

An administrator wants to receive real-time notifications for service incidents in Microsoft 365. The notifications must be sent to a Microsoft Teams channel instead of email. Which configuration should the administrator set up?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a webhook connector in Microsoft Teams to subscribe to the Office 365 Service Communications API.. The Office 365 Service Communications API provides real-time webhook-based notifications for service incidents. By configuring a webhook connector in Microsoft Teams, the administrator can subscribe to this API and receive incident alerts directly in a Teams channel without polling or email forwarding.

Answer

Configure an email notification rule in the Microsoft 365 admin center and forward it to a Teams email address.

Answer

Use Power Automate to check service health and post to Teams every 5 minutes.

Answer

Configure a message center alert to email and then use a third-party integration to post to Teams.

Question 2

A global administrator wants to track service health issues and configure notifications for service incidents. Which portal should they use to view the current health status and set up email notifications?

Accepted Answer

Microsoft 365 admin center. The Microsoft 365 admin center provides the Service Health dashboard under Health > Service Health, which displays the current status of all Microsoft 365 services and allows administrators to configure email notifications for service incidents. This is the designated portal for managing tenant-wide service health and notifications, aligning with the role of a global administrator.

Answer

Azure portal

Answer

Microsoft 365 Defender portal

Answer

Microsoft Purview compliance portal

Question 3

A company has a Microsoft 365 tenant with the domain contoso.com. They acquire a subsidiary with the domain fabrikam.com and want to add it as an additional domain to the same tenant. The domain is already purchased and DNS management is available. What is the first step the administrator should take in the Microsoft 365 admin center?

Accepted Answer

Add the domain and verify ownership by adding a TXT record. To add an existing domain like fabrikam.com to a Microsoft 365 tenant, the first step is to add the domain in the Microsoft 365 admin center and then verify ownership by adding a TXT record to the domain's DNS zone. This verification proves the administrator controls the domain, which is a prerequisite for using it with Microsoft 365 services such as Exchange Online or SharePoint.

Answer

Create a new tenant for fabrikam.com

Answer

Set up email forwarding from contoso.com to fabrikam.com

Answer

Convert fabrikam.com to a federated domain

Question 4

A new administrator needs to automatically assign Microsoft 365 E5 licenses to all users in the Sales department. The Sales department is identified by the 'department' attribute in Azure AD. Which licensing method should the administrator use to minimize manual effort?

Accepted Answer

Group-based licensing using a dynamic group. Group-based licensing using a dynamic group is the correct method because it automatically assigns Microsoft 365 E5 licenses to all users in the Sales department based on the 'department' attribute in Azure AD. Dynamic groups evaluate membership rules in real time, so when a user's department attribute is set to 'Sales', the license is assigned without manual intervention. This minimizes administrative effort by eliminating the need for per-user or batch operations.

Answer

Manual license assignment per user

Answer

PowerShell script to assign licenses

Answer

Bulk license assignment via CSV file

Question 5

An administrator wants to add a custom domain 'contoso.com' to a new Microsoft 365 tenant. The domain is already registered and available. What is the first step the administrator should perform in the Microsoft 365 admin center?

Accepted Answer

Add the domain and verify ownership by creating a TXT record. The first step when adding a custom domain to a Microsoft 365 tenant is to add the domain in the admin center and then verify ownership by creating a TXT record in the domain's DNS zone. This proves you control the domain before any services (like email or SharePoint) can be configured. Without verification, Microsoft 365 will not allow further domain-related setup.

Answer

Create user accounts with the new domain

Answer

Configure email routing with MX records

Answer

Set up SharePoint Online with the new domain

Question 6

A company has a Microsoft 365 tenant with domain contoso.com. They own an additional domain fabrikam.com and have already added and verified it with a TXT record. Now they need to configure email to be routed to Exchange Online for fabrikam.com. Which DNS record must they create?

Accepted Answer

MX record pointing to contoso-com.mail.protection.outlook.com. To route email for fabrikam.com to Exchange Online, you must create an MX record that points to the Exchange Online mail exchanger. The correct target is contoso-com.mail.protection.outlook.com, where 'contoso-com' is the hashed version of the primary domain (contoso.com) used by Microsoft 365. This MX record tells the internet's mail servers to deliver messages addressed to @fabrikam.com into the tenant's Exchange Online environment.

Answer

CNAME record for autodiscover

Answer

TXT record for SPF

Answer

SRV record for SIP

Question 7

An administrator recently added a custom domain 'tailspintoys.com' to their Microsoft 365 tenant and verified it. They now need to configure the domain so that all recipient email addresses for 'info@tailspintoys.com' are delivered to a shared mailbox in Exchange Online. The domain is currently set as internal relay. What should the administrator do first to route email for this domain to Exchange Online?

Accepted Answer

Change the domain type from 'Internal relay' to 'Authoritative' in Exchange admin center. When a domain is set to 'Internal relay' in Exchange Online, the service expects to relay messages to an on-premises server for that domain. To have Exchange Online accept and deliver messages directly to a shared mailbox (or any hosted recipient), the domain must be changed to 'Authoritative'. This tells Exchange Online that it is the final destination for all recipients in that domain, enabling local delivery.

Answer

Update the MX record at the DNS registrar to point to Exchange Online

Answer

Create the shared mailbox 'info@tailspintoys.com' in Exchange Online

Answer

Disable the internal relay option for the domain in the Microsoft 365 admin center

Question 8

An administrator wants to verify ownership of a custom domain 'adatum.com' in their Microsoft 365 tenant. They have already added the domain and received the TXT record value. However, the administrator's DNS hosting provider does not support adding a TXT record. Which alternative record type can be used for domain verification?

Accepted Answer

MX record. When a DNS hosting provider does not support TXT records, Microsoft 365 allows the use of an MX record as an alternative for domain verification. The administrator creates an MX record with a specific subdomain (e.g., 'adatum-com.mail.protection.outlook.com') and a custom priority value provided in the TXT record value, which Microsoft's verification system checks to confirm domain ownership. This method is supported because MX records are widely available and can carry the necessary verification data in their format.

Answer

record

Answer

SRV record

Answer

NS record

Question 9

You are planning the initial deployment of a new Microsoft 365 tenant for Contoso Ltd. Which three of the following actions are required or recommended as part of the tenant provisioning and initial configuration process? (Choose three.)

Accepted Answer

Configure tenant-wide service settings such as external sharing for SharePoint and OneDrive.. Registering and verifying a custom domain (e.g., contoso.com) via a DNS TXT record is a required step to use your own domain for email and user identities instead of the default onmicrosoft.com domain. Creating the initial global administrator account with a strong password and enabling multi-factor authentication (MFA) is a critical security best practice and is recommended by Microsoft to protect the highest-privileged role. Configuring tenant-wide service settings, such as external sharing for SharePoint and OneDrive, is recommended during initial setup to align with organizational security and collaboration policies before users begin working.

Answer

Set up a secondary domain as the default email domain to avoid conflicts with the initial onmicrosoft.com domain.

Answer

Assign Microsoft 365 licenses to all user accounts before creating the accounts.

Answer

Configure the default tenant-level password expiration policy to 90 days using the Microsoft 365 admin center.

Question 10

Match each Microsoft 365 plan to its included services.

Accepted Answer

Microsoft 365 Business Basic: Includes Exchange Online, SharePoint, Teams, and web versions of Office apps.. Correct matches: Business Basic = web apps only, Business Standard = desktop apps added, Business Premium = security features added, E3 = enterprise compliance. Common mistakes: confusing Business Basic with Business Standard or attributing Intune to Business Standard.

Answer

Microsoft 365 Business Basic: Includes everything in Business Standard plus advanced security.

Answer

Microsoft 365 Business Standard: Includes Desktop Office apps and Intune.

Question 11

Your organization plans to migrate from on-premises Exchange to Exchange Online. You need to ensure minimal disruption during the migration. Which approach should you recommend?

Accepted Answer

Deploy a hybrid configuration and migrate mailboxes in batches.. A hybrid migration allows you to gradually move mailboxes while maintaining coexistence, minimizing disruption. Option B (cutover migration) is disruptive and only suitable for small organizations. Option C (IMAP migration) does not fully migrate calendar or contacts. Option D (third-party tool) is unnecessary for standard migrations.

Answer

Perform a cutover migration during a weekend.

Answer

Use IMAP migration to migrate all mailboxes in parallel.

Answer

Use a third-party migration tool for a one-time bulk migration.

Question 12

Your company recently deployed Microsoft 365 Copilot. Users report that Copilot occasionally generates responses based on sensitive internal documents that should not be shared broadly. What should you configure to restrict Copilot's access?

Accepted Answer

Apply sensitivity labels to the documents and configure label scopes to exclude Copilot.. Sensitivity labels can be configured with a label scope that excludes Copilot from accessing the labeled content. By applying a 'Confidential' sensitivity label with the 'Copilot' scope deselected, you instruct Microsoft 365 Copilot to ignore those documents during response generation, preventing it from surfacing sensitive internal information.

Answer

Create Data Loss Prevention (DLP) policies to block sharing.

Answer

Remove the sensitive documents from SharePoint Online.

Answer

Configure Microsoft Search to exclude the sensitive documents.

Question 13

Your company recently merged with another company that uses Microsoft 365. Both tenants have the same primary domain, contoso.com. You need to merge the two tenants into a single tenant while preserving user email addresses. What should you do?

Accepted Answer

Remove the domain from the source tenant and add it to the target tenant, then migrate users.. To merge two Microsoft 365 tenants with the same domain, you must remove the domain from the source tenant, add it to the target tenant, and then migrate users' data. This preserves user email addresses because the domain is added to the target tenant before migration. Option B is the correct approach.

Answer

Use cross-tenant collaboration settings to share the domain.

Answer

Configure a domain sharing agreement between both tenants.

Answer

Set up a federation trust between the two tenants.

Question 14

You need to ensure that all users in your Microsoft 365 tenant are automatically enrolled in Microsoft Intune when they sign up for Microsoft 365. You want to use the default enrollment policy. What should you do?

Accepted Answer

Set the MDM authority to Microsoft Intune and configure automatic MDM enrollment via Azure AD.. Setting the MDM authority to Microsoft Intune and configuring automatic MDM enrollment via Azure AD enables the default enrollment policy. This ensures that when users sign up for Microsoft 365, they are automatically enrolled in Intune without manual intervention, leveraging Azure AD's built-in MDM enrollment integration.

Answer

Create a conditional access policy that requires device compliance and block access if not enrolled.

Answer

Configure a PowerShell script to run daily that adds all users to Intune.

Answer

Ensure that the Microsoft Intune license is assigned to each user and enable the 'Enroll automatically' setting in the Microsoft 365 admin center.

Question 15

Your organization uses Microsoft Defender for Office 365. You have configured a safe attachment policy that should automatically detonate attachments in a sandbox before delivery. However, some users still receive malicious attachments. What should you check first?

Accepted Answer

Verify that the Safe Attachments policy is applied to the affected users and that the action is set to 'Dynamic Delivery' or 'Replace' (not 'Monitor').. Safe Attachments policies can be configured with actions like 'Dynamic Delivery' or 'Replace' to actively block or detonate attachments before delivery. If the action is set to 'Monitor', attachments are delivered first and only monitored, which can allow malicious attachments to reach users. Therefore, verifying the policy action is the first step to ensure detonation occurs before delivery.

Answer

Check whether a mail flow rule (transport rule) is bypassing Safe Attachments.

Answer

Check the Safe Links policy configuration.

Answer

Review the mailbox audit log for each affected user.