MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 2 — 15 Questions

Question 1

A company wants to ensure that all new users created in Microsoft 365 are automatically assigned a specific set of licenses based on their department. The company has 200 users across Sales, Marketing, and IT departments. Each department uses different Microsoft 365 license plans. Which approach should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

C: Use Azure AD Dynamic Groups to automatically add users to groups based on department, and then assign licenses to those groups.. Azure AD Dynamic Groups can automatically add users to groups based on their department attribute (e.g., using a rule like `user.department -eq "Sales"`), and group-based licensing can then assign the appropriate Microsoft 365 license plan to each dynamic group. This ensures that any new user created with the correct department attribute is automatically added to the corresponding group and receives the license without manual intervention or scheduled scripts.

Answer

A: Create a PowerShell script that runs on a schedule to assign licenses based on department attribute.

Answer

B: Use group-based licensing and assign each department's users to a security group with the appropriate license.

Answer

D: Manually assign licenses to each user after creation.

Question 2

A company wants to migrate from on-premises Exchange to Exchange Online. They need to synchronize user mailboxes. Which tool should they use?

Accepted Answer

C: Exchange Online Hybrid Configuration Wizard. The Exchange Online Hybrid Configuration Wizard (HCW) is the correct tool for migrating on-premises Exchange mailboxes to Exchange Online because it configures the hybrid deployment settings, including the necessary connectors, federation trust, and OAuth authentication, enabling mailbox moves via the New-MigrationBatch cmdlet or the EAC. It orchestrates the synchronization of mailbox data between the on-premises environment and Exchange Online, leveraging the MRS (Mailbox Replication Service) proxy for secure, seamless migration.

Answer

A: Microsoft 365 admin center

Answer

B: Exchange Admin Center

Answer

D: Azure AD Connect

Question 3

An administrator adds the custom domain 'contoso.com' to a new Microsoft 365 tenant and needs to verify domain ownership. Which type of DNS record must be added to the public DNS zone to complete verification?

Accepted Answer

TXT record. To verify domain ownership in Microsoft 365, you must add a TXT record with a specific verification string provided by the Microsoft 365 admin center to the public DNS zone. The TXT record is used because it can store arbitrary text data, which the Microsoft 365 domain verification service queries to confirm that you control the domain. This is the standard method defined in RFC 1035 for domain ownership verification.

Answer

MX record

Answer

CNAME record

Answer

record

Question 4

An administrator needs to open a Microsoft 365 support request because all users are experiencing intermittent service outages for Exchange Online. Before contacting support, which two pieces of information should the administrator have ready to ensure efficient troubleshooting? (Choose two.)

Accepted Answer

Tenant ID (or Microsoft 365 tenant domain name). The Tenant ID (or Microsoft 365 tenant domain name) is required by Microsoft Support to uniquely identify your tenant in their systems, enabling them to pull up your service configuration, subscription details, and relevant health data. This identifier is essential for routing the support request to the correct engineering team and for correlating the issue with backend telemetry.

Answer

Number of affected users

Answer

Network bandwidth graph from the past 24 hours

Question 5

An administrator wants to prevent users from inviting guest users from the domain 'contoso.com' to the tenant. The administrator needs to block all invitations for that specific domain while allowing invitations from all other external domains. Which setting in Microsoft Entra ID should be configured?

Accepted Answer

External collaboration settings. External collaboration settings in Microsoft Entra ID (formerly Azure AD) allow administrators to configure domain-based restrictions for B2B collaboration invitations. By adding 'contoso.com' to the 'Deny list' under 'Cross-tenant access settings' or specifically within the 'External collaboration settings' blade, invitations to that domain are blocked while all other external domains remain allowed. This setting directly controls the guest invitation behavior at the domain level.

Answer

Cross-tenant access settings

Answer

User settings

Answer

Domain federation

Question 6

An administrator adds the custom domain 'adatum.com' to a new Microsoft 365 tenant. In the Microsoft 365 admin center, the domain status shows 'Pending verification'. Which type of DNS record must the administrator add to the public DNS zone to complete the domain ownership verification?

Accepted Answer

TXT record. To verify domain ownership in Microsoft 365, you must add a TXT record containing a unique verification string provided by the Microsoft 365 admin center to the public DNS zone. The DNS provider checks for this TXT record, and when found, Microsoft 365 confirms you control the domain. This is a standard domain verification method defined in RFC 1035 and used by many cloud services.

Answer

MX record

Answer

CNAME record

Answer

SPF record

Question 7

An administrator wants to configure the company's organization profile in Microsoft 365, including the display name, technical contact, and privacy settings. Where should the administrator go in the Microsoft 365 admin center?

Accepted Answer

Org settings > Organization profile. The organization profile, which includes the display name, technical contact, and privacy settings, is managed under 'Org settings' in the Microsoft 365 admin center. Specifically, the 'Organization profile' tab within 'Org settings' provides the interface to update these tenant-wide properties, such as the organization's display name (used in Microsoft 365 services and notifications) and the technical contact email (used for service communications). This is the correct location because these settings are tenant-level configurations, not user-specific or billing-related.

Answer

User management > Active users

Answer

Setup > Onboarding

Answer

Billing > Licenses

Question 8

A company has registered the custom domain 'contoso.com' and wants to host email for the subdomain 'sales.contoso.com' in Exchange Online. They have already verified the root domain. What additional step is required?

Accepted Answer

Add 'sales.contoso.com' as a custom domain and verify ownership by adding a DNS TXT record.. When a parent domain (e.g., contoso.com) is verified, all of its subdomains are automatically considered verified. Therefore, sales.contoso.com does not require another TXT record for verification. To host email on the subdomain, you must add sales.contoso.com as a custom domain in the Microsoft 365 admin center and configure the necessary DNS records (MX, SPF, etc.). The verification step is unnecessary because the parent domain is already verified.

Answer

No additional step; subdomains are automatically verified after the root domain is verified.

Answer

Create a subdomain in Exchange Online using the Exchange admin center.

Answer

Modify the SPF record for the root domain to include 'sales.contoso.com'.

Question 9

An administrator needs to update the organization's display name, technical contact, and privacy statement URL in the Microsoft 365 admin center. Which page should they navigate to?

Accepted Answer

Settings > Org settings > Organization profile. The 'Settings > Org settings > Organization profile' page in the Microsoft 365 admin center is the dedicated location for modifying tenant-wide metadata, including the organization's display name, technical contact email, and privacy statement URL. These settings are stored in the Microsoft 365 tenant's directory properties and are distinct from user-level or billing-level configurations.

Answer

Users > Active users > More actions > Edit contact info

Answer

Billing > Billing accounts > Edit organization info

Answer

Admin centers > Azure AD > Properties

Question 10

A company has just purchased Microsoft 365 E3 licenses. They want to configure the default mailbox storage limit for all new users. Which setting should they modify?

Accepted Answer

Microsoft 365 admin center -> Org settings -> Mailbox storage. The correct setting to configure the default mailbox storage limit for all new users in Microsoft 365 is found in the Microsoft 365 admin center under Org settings > Mailbox storage. This allows administrators to set a default storage limit that applies to all new mailboxes. Option C is incorrect because Set-OrganizationConfig -DefaultMailboxSize is not a valid parameter in Exchange Online; mailbox plans are used instead, but the simplest method is via the admin center.

Answer

Exchange admin center -> recipients -> mailboxes -> default mailbox quota

Answer

Microsoft 365 admin center -> Users -> Active users -> default storage limit

Answer

Exchange Online PowerShell: Set-OrganizationConfig -DefaultMailboxSize

Question 11

A company needs to migrate several shared mailboxes from on-premises Exchange 2016 to Exchange Online. The company plans to keep some user mailboxes on-premises for now. Which migration strategy should they use for the shared mailboxes?

Accepted Answer

Hybrid migration. A hybrid migration is the correct choice because it allows the coexistence of on-premises Exchange 2016 and Exchange Online mailboxes, enabling the selective migration of shared mailboxes while keeping some user mailboxes on-premises. This approach uses the Hybrid Configuration Wizard to establish a secure connection and synchronize directory objects via Azure AD Connect, supporting mailbox moves with the New-MoveRequest cmdlet.

Answer

Cutover migration

Answer

Staged migration

Answer

IMAP migration

Question 12

An administrator wants to add a second custom domain, 'contoso-europe.com', to their existing Microsoft 365 tenant. The domain 'contoso.com' is already verified. What is the first step the administrator should take?

Accepted Answer

Add the domain in the Microsoft 365 admin center. To add a new domain, the administrator must first add it in the Microsoft 365 admin center under Setup > Domains. After adding it, verification steps (like adding a TXT record) are required. Updating UPN suffixes is done after verification. Creating a new tenant is unnecessary.

Answer

Create a DNS TXT verification record

Answer

Update the UPN suffixes for users

Answer

Create a new Microsoft 365 tenant

Question 13

An administrator wants to add a custom domain 'fabrikam.com' to a new Microsoft 365 tenant. What is the first step the administrator should perform?

Accepted Answer

Add the domain in the Microsoft 365 admin center.. The first step to add a custom domain to a Microsoft 365 tenant is to add the domain in the Microsoft 365 admin center. This initiates the domain verification process, where Microsoft provides a TXT record that the administrator must add to the domain's DNS hosting provider to prove ownership. Without completing this verification step, no other domain-related configurations (such as SPF, MX records, or user licensing) can proceed.

Answer

Create an SPF record for the domain.

Answer

Create a MX record pointing to Exchange Online.

Answer

Assign Microsoft 365 licenses to users with @fabrikam.com addresses.

Question 14

An administrator needs to configure the default anti-spam policy for all users in the Microsoft 365 Defender portal. Where should the administrator navigate to find these settings?

Accepted Answer

Email & collaboration > Policies & rules > Threat policies > Anti-spam. The default anti-spam policy is configured under Email & collaboration > Policies & rules > Threat policies > Anti-spam in the Microsoft 365 Defender portal. This is the correct location because anti-spam settings, including the default policy that applies to all users, are managed specifically within the Anti-spam section of Threat policies. The other options address different threat protection areas (anti-phishing, anti-malware, Safe Attachments) that do not contain spam filtering configurations.

Answer

Email & collaboration > Policies & rules > Threat policies > Anti-phishing

Answer

Email & collaboration > Policies & rules > Threat policies > Anti-malware

Answer

Email & collaboration > Policies & rules > Threat policies > Safe Attachments

Question 15

An administrator wants to restrict which users in the organization can create Microsoft 365 groups. The requirement is that only members of the IT department (identified by the department attribute in Azure AD) should be able to create groups. Which configuration should the administrator use?

Accepted Answer

Azure AD > Groups > Group settings > Group creation settings.. The Azure AD 'Group settings' blade includes a 'Group creation settings' option that allows administrators to restrict group creation to specific security groups. By configuring this setting, the administrator can limit group creation to only members of the IT department, identified by the department attribute in Azure AD, by placing those users into a designated security group.

Answer

Azure AD Identity Governance > Access reviews.

Answer

Azure AD > Groups > Naming policy.

Answer

Microsoft 365 admin center > Groups > Add group.