MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 18 — 15 Questions

Question 1

Your organization is deploying Windows 11 using Microsoft Intune. You need to ensure that devices are automatically enrolled in Intune when users sign in with their Microsoft Entra ID credentials. Which THREE prerequisites must be met?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra ID P1 or P2 license.. Microsoft Entra ID P1 or P2 licenses are required to enable automatic MDM enrollment via Intune. Without these licenses, the MDM authority cannot be set to Intune, and the automatic enrollment policy in Microsoft Entra ID will not function. This licensing requirement ensures that the tenant has the necessary features for conditional access and device management policies.

Answer

Devices must run Windows 10/11 Home edition.

Answer

Microsoft Configuration Manager must be deployed.

Question 2

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that automatically blocks downloads of files containing sensitive information from SharePoint Online to unmanaged devices. What type of policy should you create?

Accepted Answer

Session policy. A session policy in Microsoft Defender for Cloud Apps is used to enforce real-time controls on user sessions, including blocking downloads of files with sensitive information from SharePoint Online to unmanaged devices. Session policies leverage Conditional Access App Control to proxy the session and apply DLP-like controls.

Answer

Microsoft Purview Data Loss Prevention policy

Answer

Activity policy

Answer

File policy

Question 3

You need to ensure that only users from your organization's on-premises Active Directory can access Microsoft 365 services. You have Microsoft Entra Connect configured. What is the simplest way to prevent cloud-only user accounts from signing in?

Accepted Answer

Set the 'Block sign in' option to 'Yes' for all cloud-only users in the Microsoft Entra admin center.. Setting the 'Block sign in' option to 'Yes' for cloud-only users in the Microsoft Entra admin center directly prevents those accounts from signing in without deleting them or affecting licensed users. This is the simplest and most targeted method. It does not require conditional access policies or license changes.

Answer

Configure a conditional access policy that blocks all users.

Answer

Delete the cloud-only users from Microsoft Entra ID.

Answer

Remove all licenses from cloud-only users.

Question 4

Contoso is a multinational company with 50,000 users. They have a Microsoft 365 E5 subscription and use Microsoft Entra ID for identity. They recently deployed Microsoft Copilot for Microsoft 365 to 10,000 users. The security team wants to ensure that Copilot responses do not expose sensitive information. They also need to monitor Copilot usage for unusual activity. The company uses Microsoft Purview Information Protection and Microsoft Defender for Cloud Apps. You need to configure the environment to meet these requirements. Which action should you take?

Accepted Answer

Create a Microsoft Purview DLP policy that includes Copilot as a location.. Microsoft Purview Data Loss Prevention (DLP) policies can include Microsoft Copilot for Microsoft 365 as a location, allowing the security team to detect and prevent sensitive information from being exposed in Copilot responses. This directly addresses the requirement to ensure Copilot responses do not expose sensitive data by scanning and blocking content based on sensitivity labels or sensitive info types.

Answer

Configure a Conditional Access policy to restrict Copilot to managed devices.

Answer

Enable session monitoring in Microsoft Defender for Cloud Apps for Copilot.

Answer

Create sensitivity labels and auto-labeling policies for Copilot.

Question 5

Your organization has 5,000 users and uses Microsoft 365 E3. You are planning to migrate from on-premises Exchange to Exchange Online. You have already synchronized identities using Microsoft Entra Connect. The CIO wants to ensure that users can continue to access their email if the internet connection to Microsoft 365 is temporarily lost. You need to recommend a solution that provides offline access while minimizing cost and administrative overhead. What should you recommend?

Accepted Answer

Configure Outlook to use Cached Exchange Mode.. Cached Exchange Mode (CEM) downloads a copy of the user's mailbox to a local .ost file, allowing full access to email, calendar, and contacts even when the internet connection to Microsoft 365 is temporarily lost. This meets the CIO's requirement for offline access with zero additional cost and no administrative overhead, as CEM is a built-in feature of Outlook that is already available with Microsoft 365 E3.

Answer

Implement a hybrid deployment and keep some mailboxes on-premises.

Answer

Deploy a VPN to ensure connectivity.

Answer

Enable Exchange Online Archiving for all users.

Question 6

You are a Microsoft 365 administrator for a small business with 50 users. The company uses Microsoft 365 Business Premium. You need to ensure that all users have multi-factor authentication (MFA) enabled. The company does not have any custom conditional access policies. You want to implement MFA as quickly as possible with minimal configuration. What should you do?

Accepted Answer

Enable security defaults in the Microsoft Entra admin center.. Security defaults provide a pre-configured set of security policies, including requiring MFA for all users, that can be enabled with a single toggle in the Microsoft Entra admin center. This is the fastest and simplest method for a small business with no existing conditional access policies, as it requires minimal configuration and immediately enforces MFA for every user.

Answer

Configure MFA registration campaign for all users.

Answer

Enable per-user MFA for each user.

Answer

Create a conditional access policy that requires MFA for all users.

Question 7

You are the Microsoft 365 administrator for a large enterprise. You need to ensure that only users with a valid business justification can access sensitive data stored in SharePoint Online. The solution must enforce access reviews and provide detailed reports for auditors. Which TWO actions should you take?

Accepted Answer

Configure access reviews in Microsoft Entra ID Governance for the SharePoint site.. Option A is correct because Microsoft Entra ID Governance access reviews are the native mechanism to periodically attest who still needs access to a SharePoint site, enforcing the requirement that only users with a valid business justification retain access. Option C is correct because enabling audit logging in Microsoft Purview captures SharePoint Online access and activity events, and the resulting audit log search and reports provide the detailed evidence auditors require. Option B is not correct because Defender for Cloud Apps session policies monitor and control sessions but do not enforce access reviews or produce the required auditor-facing access attestation reports. Option D is not correct because sensitivity labels with justification for label changes govern classification and labeling actions, not recurring access justification or review. Option E is not correct because a DLP policy prevents sharing of sensitive content but does not enforce access reviews or generate the detailed access reports for auditors.

Answer

Deploy Microsoft Defender for Cloud Apps and create a session policy to monitor access.

Answer

Apply a sensitivity label to the SharePoint site and require justification for label change.

Answer

Create a data loss prevention (DLP) policy to block unauthorized sharing.

Question 8

Your company is deploying Microsoft 365 Copilot for all users. You need to ensure that Copilot responses are grounded only in organizational data that users already have permission to access. Additionally, you must comply with data residency requirements in the European Union. Which THREE actions should you take?

Accepted Answer

Apply sensitivity labels to restrict Copilot from accessing specific files.. Sensitivity labels can be configured to block Copilot from accessing files with specific labels, ensuring that Copilot responses are grounded only in organizational data that users already have permission to access. This is done by using Microsoft Purview Information Protection to define label-based restrictions that Copilot respects, preventing it from surfacing content from labeled files even if the user has direct access.

Answer

Block Copilot for all users outside the EU using conditional access policies.

Answer

Enable Copilot caching in Microsoft Purview to control data storage locations.

Question 9

Your organization uses Microsoft 365 and has strict compliance requirements. The compliance officer has noticed that some users are able to access sensitive documents from unmanaged devices. You need to ensure that all access to sensitive data from unmanaged devices is blocked, while still allowing access from managed devices. The solution must be implemented using Microsoft Entra ID and Microsoft Intune. You have already deployed Microsoft Intune for mobile device management. What should you do?

Accepted Answer

Create a conditional access policy in Microsoft Entra ID that requires device to be marked as compliant, and apply it to all cloud apps.. A Conditional Access policy that requires the device to be marked as compliant enforces that only Intune-managed, compliant devices can access cloud apps. This blocks unmanaged devices because they cannot satisfy the compliance requirement, while managed devices that meet the compliance policy are allowed. This directly satisfies the requirement to block unmanaged device access using Entra ID and Intune.

Answer

Enable device compliance rules in Microsoft Entra ID and assign them to all users.

Answer

Create a device compliance policy in Microsoft Intune that requires a PIN and encryption.

Answer

Create an app protection policy in Microsoft Intune that requires managed apps to be used on unmanaged devices.

Question 10

You are the Microsoft 365 administrator for a multinational company. The company has deployed Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps. Recently, the security team detected that a user's credentials were compromised and used to access SharePoint Online from an unusual location. You need to investigate the incident and determine the full scope of the breach. The solution must use Microsoft 365 Defender to correlate events. What should you do first?

Accepted Answer

Use advanced hunting in Microsoft 365 Defender portal to query for events related to the user across workloads.. Advanced hunting in the Microsoft 365 Defender portal allows you to query raw, cross-workload telemetry (e.g., from Identity, Exchange Online, SharePoint Online, and Defender for Cloud Apps) in a single Kusto Query Language (KQL) query. This is the most efficient first step to correlate events such as sign-ins, mailbox access, file downloads, and app sessions related to the compromised user, enabling you to determine the full scope of the breach across all Microsoft 365 services.

Answer

Use the Microsoft Purview compliance portal to search for the user's activity in audit logs.

Answer

Use Microsoft Defender for Cloud Apps to investigate the user's activity log.

Answer

Use Microsoft Sentinel to query the user's events from the workspace.

Question 11

You are the Microsoft 365 administrator for a company with a hybrid identity configuration using Azure AD Connect. The company has a custom domain 'contoso.com' federated with Active Directory Federation Services (ADFS). All users are synced from on-premises Active Directory. The security team wants to implement Microsoft Entra ID Protection to detect risky sign-ins. However, they are concerned that federated authentication bypasses some risk detection capabilities. You need to ensure that Microsoft Entra ID Protection can evaluate risk for all sign-ins, including federated ones. What should you do?

Accepted Answer

Switch from federated authentication to Pass-through Authentication (PTA) or Password Hash Sync (PHS).. Microsoft Entra ID Protection relies on signals such as IP addresses, device information, and sign-in patterns to calculate risk. In a federated setup with ADFS, the authentication happens on-premises, and Microsoft Entra ID only receives a token—not the raw sign-in details needed for real-time risk evaluation. Switching to Pass-through Authentication (PTA) or Password Hash Sync (PHS) ensures that the authentication process flows through Microsoft Entra ID directly, allowing Entra ID Protection to capture and analyze all sign-in events, including those from federated users.

Answer

Configure the federated trust in Microsoft Entra ID to use the new claims.

Answer

Configure ADFS to send the ipaddr and xms_ep claims to Azure AD.

Answer

Enable Azure AD Application Proxy to publish ADFS internally.

Question 12

Your company uses Microsoft 365 Business Premium. You need to ensure that all company-owned Windows 10 devices are automatically enrolled in Microsoft Intune when users sign in with their work account. The devices are Azure AD joined. You have configured automatic enrollment in Intune. However, some devices are not enrolling. You need to troubleshoot the issue. What should you check first?

Accepted Answer

Verify that each user has an appropriate Microsoft Intune license assigned.. Automatic enrollment in Microsoft Intune requires each user to have an appropriate Intune license (e.g., Microsoft 365 Business Premium includes Intune). Without a license, the device will not be able to enroll even if all other prerequisites are met. The license is checked during the enrollment process, and if missing, enrollment fails silently.

Answer

Ensure that devices are Azure AD joined and not domain joined.

Answer

Check the Windows 10 version; version 1607 or later is required.

Answer

Check that the MDM authority is set to Microsoft Intune in Microsoft Entra ID.

Question 13

You are the Microsoft 365 administrator for a company that uses Microsoft Entra ID P1 and Microsoft 365 E3. A new security policy requires that when users sign in from outside the corporate network, they must use Microsoft Entra multifactor authentication. However, users signing in from the corporate office network must not be prompted for MFA. The corporate office has a public IP address range of 203.0.113.0/24. You create a named location called 'Corporate Office' with this IP range. What should you do next to meet the requirement?

Accepted Answer

Create a conditional access policy that targets all users and all cloud apps, set the condition to exclude the 'Corporate Office' named location, and require multifactor authentication.. A conditional access policy is the correct tool to enforce MFA based on network location. By excluding a named location containing the corporate IP range, the policy applies MFA only when users sign in from outside that range. This satisfies the security policy while avoiding unnecessary prompts for on-premises users.

Answer

Create a conditional access policy that targets all users and all cloud apps, set the condition to include the 'Corporate Office' named location, and require multifactor authentication.

Answer

Configure the 'Corporate Office' named location as trusted and enable security defaults.

Answer

Enable Microsoft Entra multifactor authentication per user for all users, and configure the corporate IP range as trusted IPs in the MFA service settings.

Question 14

You are the Microsoft 365 administrator for a company that uses Microsoft 365 E5. The company has a Microsoft Entra tenant with hybrid identity synchronized from on-premises Active Directory using Microsoft Entra Connect. You need to implement self-service password reset (SSPR) so that users can reset their passwords from the Azure portal. The solution must ensure that password changes are written back to on-premises Active Directory. Which two actions should you perform? (Choose two.)

Accepted Answer

Enable self-service password reset for all users in the Microsoft Entra admin center.. Enabling SSPR in Microsoft Entra ID allows users to reset their passwords, and enabling password writeback in Microsoft Entra Connect ensures those new passwords are synchronized back to on-premises Active Directory. Together, these actions provide a seamless self-service password reset experience that keeps on-premises and cloud passwords in sync.

Answer

Configure the on-premises Active Directory domain to use fine-grained password policies.

Answer

Enable password hash synchronization and seamless single sign-on.

Answer

Configure Microsoft Entra Connect to use password hash synchronization.

Question 15

You are the Microsoft 365 administrator for a company that uses Microsoft 365 E5. The company has a hybrid identity environment with Microsoft Entra Connect Sync. You need to implement Microsoft Entra Password Protection to prevent users from using weak passwords. You must ensure that the on-premises Active Directory Domain Services (AD DS) environment enforces the same password policies as Microsoft Entra ID. What should you do? (Choose two.)

Accepted Answer

Install the Microsoft Entra Password Protection proxy service on a server in the on-premises network.. To enforce Microsoft Entra Password Protection on-premises, you must deploy both the proxy service and the DC agent. The proxy service enables communication with Microsoft Entra ID to retrieve the password policies, and the DC agent on each domain controller enforces those policies during password changes. Password hash synchronization is not required, and the proxy service must not be installed on a domain controller. These two components work together to extend Microsoft Entra Password Protection to the on-premises AD DS environment.

Answer

Enable password hash synchronization in Microsoft Entra Connect.

Answer

Configure the on-premises domain controllers to use the Microsoft Entra Password Protection proxy service as a forwarder.

Answer

Install the Microsoft Entra Password Protection proxy service on a domain controller.