MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 16 — 15 Questions

Question 1

You are a Microsoft 365 administrator. A user reports that they cannot send emails to a specific external domain. You check the Exchange Admin Center and see that the domain is not blocked. What should you check next?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the mail flow rules (transport rules) in Exchange Online.. Mail flow rules (transport rules) in Exchange Online can block or redirect messages based on conditions like sender, recipient domain, or message content, even if the domain is not listed in any block list. Since the domain is not blocked in the spam filter or outbound policies, a transport rule is the most likely cause of the issue, as it can silently reject or quarantine messages without appearing in the standard block lists.

Answer

Verify that the user has a full mailbox and is not over the send limit.

Answer

Review the outbound spam filter policy.

Answer

Check the spam filter policy to see if the domain is on the blocked sender list.

Question 2

Your company has implemented Microsoft Entra ID tenant restrictions to prevent data exfiltration. You need to ensure that external users from a partner organization can access a SharePoint Online site without being blocked by tenant restrictions. What should you do?

Accepted Answer

Add the partner tenant ID to the AllowedTenants list in the tenant restrictions policy.. Tenant restrictions use the X-MS-Cloud-Extension header to block or allow access based on tenant IDs. To allow external users from a partner organization to access SharePoint Online, you must add the partner's tenant ID to the 'AllowedTenants' list in the tenant restrictions policy (Option A). Option B (Conditional Access) does not bypass tenant restrictions. Option C (Azure AD B2B) invites users but does not override tenant restrictions. Option D (cross-tenant access settings) controls inbound/outbound access but is separate from tenant restrictions.

Answer

Create a Conditional Access policy to exclude partner users from tenant restriction evaluation.

Answer

Configure Azure AD B2B collaboration and invite partner users as guests.

Answer

Configure cross-tenant access settings in Microsoft Entra ID to allow partner tenant.

Question 3

Your organization is planning to deploy Microsoft 365 Copilot. You need to ensure that all prerequisites are met. Which of the following is a mandatory prerequisite for enabling Microsoft 365 Copilot?

Accepted Answer

Microsoft Entra ID P2 licenses.. None of the listed options are mandatory prerequisites for Microsoft 365 Copilot. The actual mandatory requirements are a qualifying Microsoft 365 license (E3, E5, or Business Premium) and the Microsoft 365 Copilot add-on license. Microsoft Entra ID P2 is not required; a basic Entra ID (free) is sufficient. Purview DLP, an Azure subscription, and Exchange Online Plan 2 are also not mandatory.

Answer

Microsoft Purview Data Loss Prevention policies.

Answer

An active Azure subscription.

Answer

Exchange Online Plan 2 licenses.

Question 4

Your company uses Microsoft 365 and has recently deployed Microsoft Intune for mobile device management. You need to ensure that corporate data on iOS devices is protected by preventing users from copying data from managed apps to unmanaged apps. What should you configure?

Accepted Answer

App protection policies.. App protection policies (APP) are the correct choice because they provide mobile application management (MAM) controls that specifically prevent data transfer between managed and unmanaged apps on iOS devices. Unlike device-level policies, APP operates at the application layer, allowing you to restrict copy/paste, cut, and data sharing actions without requiring device enrollment. This directly addresses the requirement to protect corporate data on iOS devices by blocking data leakage to unmanaged apps.

Answer

Mobile application management (MAM) without enrollment.

Answer

Device compliance policies.

Answer

Conditional Access policies.

Question 5

You are planning a Microsoft 365 tenant migration from an on-premises Exchange environment. You need to minimize the impact on end users during the migration. Which migration approach should you use?

Accepted Answer

Perform a staged migration to move mailboxes in batches.. A staged migration allows you to move mailboxes in batches, which minimizes end-user disruption by spreading the migration workload over time and enabling you to test and validate each batch before proceeding. This approach is ideal for organizations with many mailboxes that need to maintain continuity, as users in later batches remain fully functional in the on-premises environment until their turn.

Answer

Deploy a hybrid Exchange configuration.

Answer

Perform a cutover migration to move all mailboxes at once.

Answer

Use an IMAP migration to migrate only email data.

Question 6

Your Microsoft 365 tenant contains sensitive financial data that must be retained for 7 years. You configure a retention policy in Microsoft Purview compliance portal. After 7 years, the data is still accessible to users. What is the most likely reason?

Accepted Answer

The retention policy does not include a deletion action.. A retention policy in Microsoft Purview can be configured to only retain data without a deletion action. If the policy lacks a deletion action, data will be preserved for the specified period but will not be automatically removed after that period expires, leaving it accessible to users. The scenario describes data still being accessible after 7 years, which directly indicates that no deletion action was configured to remove the data at the end of the retention period.

Answer

A litigation hold is applied to the data.

Answer

The retention policy is configured to retain data for 7 years and then delete it.

Answer

The data is marked as a record and requires disposition review.

Question 7

The exhibit shows a KQL query used in Microsoft 365 Defender. The query returns no results for admin@contoso.com. What is the most likely reason?

Accepted Answer

Microsoft Defender for Identity is not enabled for the tenant.. The KQL query uses the `IdentityLogonEvents` table, which is populated by Microsoft Defender for Identity (MDI). If MDI is not enabled for the tenant, this table contains no data, so the query returns no results regardless of the user's role or query syntax. The query itself is syntactically correct and the role name 'GlobalAdministrator' is valid, but without MDI being provisioned, the table is empty.

Answer

The user does not have the Global Administrator role.

Answer

The KQL query syntax is invalid.

Answer

The role name in the query is misspelled.

Question 8

Your organization has a Microsoft 365 tenant configured with a custom domain. You need to verify domain ownership using a TXT record. Where in the Microsoft 365 admin center would you initiate this process?

Accepted Answer

Settings > Domains. To verify domain ownership in Microsoft 365, you must add a TXT record provided by Microsoft to your domain's DNS zone. The process is initiated in the Microsoft 365 admin center under Settings > Domains, where you select the domain and click 'Start setup' to receive the verification TXT record value. This is the only location in the admin center that directly manages domain verification and DNS record validation for custom domains.

Answer

Setup > Org-wide settings

Answer

Users > Active Users

Answer

Admin centers > Azure Active Directory

Question 9

Your organization uses Microsoft 365 and wants to ensure that only compliant devices can access Exchange Online. You have Microsoft Intune for device management. What should you configure?

Accepted Answer

Create a Conditional Access policy with 'Require device to be marked as compliant'. To enforce that only compliant devices can access Exchange Online, you need a Conditional Access policy that includes the 'Require device to be marked as compliant' grant control. This policy evaluates the device compliance status reported by Intune and blocks or grants access accordingly. Without this Conditional Access policy, even compliant devices are not forced to meet compliance requirements before accessing Exchange Online.

Answer

Configure devices to be Azure AD Joined

Answer

Create an app protection policy in Intune

Answer

Create a device compliance policy in Intune

Question 10

Refer to the exhibit. An administrator runs the KQL query in Microsoft Defender for Endpoint. The result set is empty. What is the most likely reason?

Accepted Answer

No logon events with the account name 'admin' exist in the past 7 days.. The KQL query filters for logon events where the AccountName equals 'admin' (lowercase). If no such events occurred in the last 7 days, the result set will be empty. This is the most likely reason because the query explicitly restricts the time range and account name, and an empty result does not indicate a broader issue with onboarding or case sensitivity.

Answer

The device is not onboarded to Microsoft Defender for Endpoint.

Answer

The query is case-sensitive and the account name is 'Admin' with a capital A.

Answer

There are no logon events in the last 7 days.

Question 11

Your organization has a Microsoft 365 E5 tenant with 10,000 users. You need to ensure that when a user is detected as high-risk by Microsoft Entra ID Protection, the user is automatically blocked from accessing sensitive SharePoint sites. The solution should minimize administrative overhead. What should you do?

Accepted Answer

Create a Conditional Access policy targeting high-risk users, apply to SharePoint, and set 'Block access' or 'Use app enforced restrictions'.. A Conditional Access (CA) policy can directly target 'High risk' users (via Microsoft Entra ID Protection risk detection) and apply to SharePoint. By setting the grant control to 'Block access' or 'Use app enforced restrictions', you automatically block or restrict access to sensitive SharePoint sites without manual intervention, minimizing administrative overhead. This integrates natively with Microsoft 365 and requires no additional services or custom scripting.

Answer

Create a session policy in Microsoft Defender for Cloud Apps to block high-risk users from accessing SharePoint.

Answer

Configure a user risk policy in Microsoft Entra ID Protection to block sign-ins for high-risk users.

Answer

Deploy Microsoft Sentinel and create a custom analytics rule to trigger an automated response via Logic App.

Question 12

Your Microsoft 365 tenant has 50,000 users. You are planning to migrate mailboxes from on-premises Exchange Server 2019 to Exchange Online using a full hybrid configuration. During the migration, you must ensure that free/busy information is synchronized between on-premises and Exchange Online. Which component is required for free/busy synchronization in a hybrid deployment?

Accepted Answer

Exchange Hybrid Server (or Hybrid Agent). In a full hybrid configuration, free/busy synchronization between on-premises Exchange and Exchange Online is handled by the Exchange Hybrid Server (or the newer Hybrid Agent). This component acts as a bridge, using the Exchange Web Services (EWS) and Autodiscover service to securely relay free/busy data between the two organizations. Without it, the Availability service cannot query the remote forest for calendar information.

Answer

Azure AD Connect

Answer

Exchange Online connector (Outbound to on-premises)

Answer

Hybrid Configuration Wizard

Question 13

Your organization is planning to deploy Microsoft 365 for 500 users. You need to ensure that all users can authenticate using their on-premises Active Directory credentials while also enabling self-service password reset (SSPR) in the cloud. Which configuration should you implement?

Accepted Answer

Password hash synchronization with Microsoft Entra Connect and SSPR enabled. Password hash synchronization (PHS) with Microsoft Entra Connect synchronizes on-premises AD password hashes to Microsoft Entra ID, enabling users to authenticate with their on-premises credentials in the cloud. When SSPR is enabled in Microsoft Entra ID, users can reset their cloud passwords, and with password writeback enabled, the new password is written back to on-premises AD, ensuring both environments remain in sync. This combination meets the requirement for on-premises authentication and cloud SSPR without the complexity of federation.

Answer

Pass-through authentication with Microsoft Entra Connect

Answer

Cloud-only identities with Microsoft Entra ID

Answer

Federated identity with Active Directory Federation Services (ADFS)

Question 14

Your organization has a hybrid identity with Microsoft Entra Connect. You need to migrate from federation to password hash synchronization with seamless single sign-on (SSO). The migration must have minimal user impact. Which tool should you use?

Accepted Answer

Microsoft Entra Connect migration tool (Convert domain from federated to managed). The Microsoft Entra Connect migration tool (Convert domain from federated to managed) is the correct choice because it automates the conversion of federated domains to managed domains while enabling password hash synchronization (PHS) and seamless SSO. This tool minimizes user impact by allowing a staged migration where users can continue authenticating via federation until the conversion is complete, and it handles the necessary configuration changes in Azure AD and on-premises Active Directory.

Answer

IdFix tool

Answer

AD FS Management console

Answer

Azure AD Connect wizard

Question 15

You are planning a Microsoft 365 tenant migration from another tenant. You need to migrate email, OneDrive, and SharePoint content. Which THREE tools or methods can you use to migrate data?

Accepted Answer

Microsoft 365 Migration Manager. Microsoft 365 Migration Manager (A) is a native tool in the admin center that supports cross-tenant migrations for Exchange Online, OneDrive, and SharePoint, making it suitable for this scenario. Third-party tools like BitTitan MigrationWiz (C) are widely used for tenant-to-tenant migrations and can handle all three workloads. PowerShell scripts using Microsoft Graph API (E) allow custom migration scripts to migrate email, OneDrive, and SharePoint data, providing flexibility. Option B (Microsoft Teams admin center) is incorrect because it is for managing Teams settings, not migrating content. Option D (Exchange Admin Center migration tools) is incorrect because those tools are limited to mailbox migrations and do not cover OneDrive or SharePoint.

Answer

Microsoft Teams admin center

Answer

Exchange Admin Center migration tools