MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 16 — 15 Questions

Question 1

You are a Microsoft 365 administrator for a small business with 50 users. The company is using Microsoft 365 Business Basic. You need to configure email for the custom domain contoso.com. You have added the domain in the Microsoft 365 admin center and verified ownership. Users currently have onmicrosoft.com email addresses. You need to change the primary email address for all users to their custom domain (e.g., user@contoso.com). What should you do?

Accepted Answer

Change the primary email address for each user to user@contoso.com in the admin center.. Option C is correct because in Microsoft 365, after adding and verifying a custom domain, you must manually update each user's primary email address (User Principal Name and primary SMTP address) from the default onmicrosoft.com domain to the custom domain. This is done in the Microsoft 365 admin center under Users > Active Users, by editing the username and email fields. Simply adding the domain does not automatically change existing user addresses.

Answer

Remove the onmicrosoft.com domain from the tenant.

Answer

Convert all mailboxes to shared mailboxes and reassign licenses.

Answer

Configure the MX record for contoso.com to point to Exchange Online.

Question 2

Contoso recently acquired a company with an existing Microsoft 365 tenant. You need to migrate their user accounts and mailboxes to the Contoso tenant. The acquired company uses a custom domain for email. You must ensure minimal disruption and maintain email flow during migration. What should you do first?

Accepted Answer

Add the custom domain to the Contoso tenant and verify ownership.. Before any migration can proceed, the custom domain used by the acquired company must be added and verified in the Contoso tenant. This is a prerequisite for cross-tenant mailbox migrations because the target domain must be recognized and owned by the destination tenant to route email correctly and assign user principal names (UPNs). Without domain verification, migration tools cannot validate the domain and email flow will fail.

Answer

Perform a cross-tenant mailbox migration using Microsoft 365 migration tools.

Answer

Disable the acquired company's tenant to force all users to the Contoso tenant.

Answer

Create new user accounts in the Contoso tenant using the onmicrosoft.com domain.

Question 3

Your organization uses Microsoft Defender for Identity and has enabled Microsoft Secure Score. You notice that the Secure Score for Identity has dropped significantly after a recent configuration change. Which action is most likely to have caused the decrease?

Accepted Answer

Disabling password hash synchronization in Microsoft Entra Connect.. Disabling password hash synchronization (PHS) in Microsoft Entra Connect removes the ability for Microsoft Defender for Identity to correlate on-premises Active Directory credential exposure events with cloud authentication attempts. Without PHS, Defender for Identity cannot detect when leaked credentials are used against Azure AD, causing the Secure Score for Identity to drop because key detection capabilities are no longer available.

Answer

Changing password expiration policy to 180 days.

Answer

Enabling MFA for all users.

Answer

Implementing a conditional access policy blocking legacy authentication.

Question 4

A user reports that they cannot access their Microsoft 365 mailbox from the Outlook desktop client, but they can access it via Outlook on the web. Other users in the same tenant are not experiencing issues. What is the most likely cause?

Accepted Answer

The user's Outlook profile is corrupted or needs to be re-created.. If a user can access via OWA but not Outlook desktop, it often indicates an authentication or client configuration issue rather than a service outage. Disabled MFA would affect both. A service incident would affect many users. License issues would also affect OWA. The most likely cause is that the user's profile is corrupted or authentication token has expired.

Answer

There is a service incident affecting only the Outlook desktop client.

Answer

The user's account has been disabled.

Answer

The user's Microsoft 365 license has expired.

Question 5

You are configuring Microsoft Purview Information Protection for your tenant. You need to ensure that documents containing credit card numbers are automatically labeled as 'Highly Confidential' and encrypted. Which two components must you configure?

Accepted Answer

A sensitive info type for credit card numbers.. Sensitive info types detect credit card numbers, and auto-labeling policies apply the label and encryption automatically. Option A is wrong because DLP policies alert but don't label. Option B is wrong because retention labels are for retention, not classification. Option D is wrong because the sensitivity label must be published first.

Answer

A data loss prevention (DLP) policy.

Answer

A retention label.

Question 6

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a custom Line-of-Business (LOB) app to a group of devices. The app is not in the Microsoft Store. What is the recommended method to deploy the app?

Accepted Answer

Upload the app package to Intune as a Line-of-Business app and assign it to the device group.. Option D is correct because Intune natively supports deploying custom Line-of-Business (LOB) apps by uploading the app package (e.g., .msi, .exe, .appx) directly into the Intune console and assigning it to a device group. This method is the recommended approach for apps not available in the Microsoft Store, as it leverages Intune's mobile device management (MDM) capabilities to push the app to Windows 10 devices without requiring external infrastructure like Group Policy or the Microsoft Store for Business.

Answer

Add the app as a Microsoft Store app (business) in Intune.

Answer

Use Group Policy to deploy the app via a network share.

Answer

Publish the app to the Microsoft Store for Business and assign it.

Question 7

You need to configure Microsoft Teams to allow external access for federation with another organization. The other organization uses a different domain. Which setting must you enable in the Teams admin center?

Accepted Answer

External access with the domain of the other organization.. Option D is correct because to enable federation with another organization that uses a different domain, you must configure External access (also known as federation) in the Teams admin center. Specifically, you need to add the external domain to the allowed domain list under Teams > External access. This allows users in your tenant to communicate with users in the other organization via Teams, using the Session Initiation Protocol (SIP) federation protocol.

Answer

Network roaming policy for the external users.

Answer

Guest access in Teams settings.

Answer

Emergency calling policies.

Question 8

Your organization has a Microsoft 365 E5 subscription. You need to enforce that all users must use multi-factor authentication (MFA) when accessing Microsoft 365 services. Which TWO components should you configure?

Accepted Answer

Security defaults.. Security defaults (option B) is correct because it provides a pre-configured set of security policies that enforce MFA for all users accessing Microsoft 365 services, including requiring MFA registration and blocking legacy authentication. Conditional Access policy (option E) is correct because it allows granular control to require MFA based on specific conditions such as user, location, or device state, which is the modern, recommended approach for enforcing MFA in a Microsoft 365 E5 subscription.

Answer

Microsoft Defender for Identity.

Answer

Azure AD Identity Protection user risk policy.

Answer

Per-user MFA (legacy).

Question 9

Your organization is deploying Windows 11 using Microsoft Intune. You need to ensure that devices are automatically enrolled in Intune when users sign in with their Microsoft Entra ID credentials. Which THREE prerequisites must be met?

Accepted Answer

Microsoft Entra ID P1 or P2 license.. Option C is correct because Microsoft Entra ID P1 or P2 licenses are required to enable automatic MDM enrollment via Intune. Without these licenses, the MDM authority cannot be set to Intune, and the automatic enrollment policy in Microsoft Entra ID will not function. This licensing requirement ensures that the tenant has the necessary features for conditional access and device management policies.

Answer

Devices must run Windows 10/11 Home edition.

Answer

Microsoft Configuration Manager must be deployed.

Question 10

You are implementing Microsoft Purview Data Lifecycle Management. You need to retain all emails for a minimum of 5 years but automatically delete them after 7 years. Which TWO actions should you configure?

Accepted Answer

Create a retention policy with 'Delete items after 7 years'.. A retention tag with 'Keep for 5 years' and a retention policy with 'Delete after 7 years' together define a minimum retention of 5 years and maximum of 7 years. Option C is wrong because litigation hold prevents deletion. Option D is wrong because this is not related to retention. Option E is wrong because MRM policies are for on-premises, not Purview.

Answer

Use Messaging Records Management (MRM) retention policies.

Answer

Configure a sensitivity label for the emails.

Answer

Place the mailbox on litigation hold.

Question 11

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that automatically blocks downloads of files containing sensitive information from SharePoint Online to unmanaged devices. What type of policy should you create?

Accepted Answer

Session policy. Session policies in Defender for Cloud Apps can monitor and control user sessions in real-time, including blocking downloads based on content inspection. Option A is wrong because file policies are for alerts and governance actions on files at rest. Option B is wrong because activity policies trigger on events but do not control sessions. Option D is wrong because this is a broader tool, not a specific policy type for this scenario.

Answer

Microsoft Purview Data Loss Prevention policy

Answer

Activity policy

Answer

File policy

Question 12

You need to ensure that only users from your organization's on-premises Active Directory can access Microsoft 365 services. You have Microsoft Entra Connect configured. What is the simplest way to prevent cloud-only user accounts from signing in?

Accepted Answer

Set the 'Block sign in' option to 'Yes' for all cloud-only users in the Microsoft Entra admin center.. Blocking cloud sign-in for cloud-only users through the user's Sign-in settings directly prevents them from accessing services. Option B is wrong because removing licenses doesn't block sign-in, only access to services. Option C is wrong because disabling the user is a manual process and not scalable. Option D is wrong because this would block all users.

Answer

Configure a conditional access policy that blocks all users.

Answer

Delete the cloud-only users from Microsoft Entra ID.

Answer

Remove all licenses from cloud-only users.

Question 13

Contoso is a multinational company with 50,000 users. They have a Microsoft 365 E5 subscription and use Microsoft Entra ID for identity. They recently deployed Microsoft Copilot for Microsoft 365 to 10,000 users. The security team wants to ensure that Copilot responses do not expose sensitive information. They also need to monitor Copilot usage for unusual activity. The company uses Microsoft Purview Information Protection and Microsoft Defender for Cloud Apps. You need to configure the environment to meet these requirements. Which action should you take?

Accepted Answer

Create a Microsoft Purview DLP policy that includes Copilot as a location.. Option A is correct because Microsoft Purview Data Loss Prevention (DLP) policies can include Microsoft Copilot for Microsoft 365 as a location, allowing the security team to detect and prevent sensitive information from being exposed in Copilot responses. This directly addresses the requirement to ensure Copilot responses do not expose sensitive data by scanning and blocking content based on sensitivity labels or sensitive info types.

Answer

Configure a Conditional Access policy to restrict Copilot to managed devices.

Answer

Enable session monitoring in Microsoft Defender for Cloud Apps for Copilot.

Answer

Create sensitivity labels and auto-labeling policies for Copilot.

Question 14

Your organization has 5,000 users and uses Microsoft 365 E3. You are planning to migrate from on-premises Exchange to Exchange Online. You have already synchronized identities using Microsoft Entra Connect. The CIO wants to ensure that users can continue to access their email if the internet connection to Microsoft 365 is temporarily lost. You need to recommend a solution that provides offline access while minimizing cost and administrative overhead. What should you recommend?

Accepted Answer

Configure Outlook to use Cached Exchange Mode.. Cached Exchange Mode (CEM) downloads a copy of the user's mailbox to a local .ost file, allowing full access to email, calendar, and contacts even when the internet connection to Microsoft 365 is temporarily lost. This meets the CIO's requirement for offline access with zero additional cost and no administrative overhead, as CEM is a built-in feature of Outlook that is already available with Microsoft 365 E3.

Answer

Implement a hybrid deployment and keep some mailboxes on-premises.

Answer

Deploy a VPN to ensure connectivity.

Answer

Enable Exchange Online Archiving for all users.

Question 15

You are a Microsoft 365 administrator for a small business with 50 users. The company uses Microsoft 365 Business Premium. You need to ensure that all users have multi-factor authentication (MFA) enabled. The company does not have any custom conditional access policies. You want to implement MFA as quickly as possible with minimal configuration. What should you do?

Accepted Answer

Enable security defaults in the Microsoft Entra admin center.. Security defaults provide a pre-configured set of security policies, including requiring MFA for all users, that can be enabled with a single toggle in the Microsoft Entra admin center. This is the fastest and simplest method for a small business with no existing conditional access policies, as it requires minimal configuration and immediately enforces MFA for every user.

Answer

Configure MFA registration campaign for all users.

Answer

Enable per-user MFA for each user.

Answer

Create a conditional access policy that requires MFA for all users.