MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 3 — 15 Questions

Question 1

An administrator has added the custom domain 'contoso.co.uk' to their Microsoft 365 tenant and verified ownership. Users now need to receive email at @contoso.co.uk. Which DNS record must the administrator add in the public DNS zone to route emails to Exchange Online?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add an MX record pointing to .mail.protection.outlook.com. To route email for a custom domain to Exchange Online, you must add an MX record in the public DNS zone that points to the Exchange Online mail exchanger. The correct target is .mail.protection.outlook.com, where is your initial tenant name (e.g., contoso-com). This MX record tells sending mail servers to deliver messages for @contoso.co.uk to Microsoft's email infrastructure.

Answer

Add a CNAME record for autodiscover

Answer

Add an SPF record

Answer

Add a DKIM record

Question 2

An organization wants to receive email notifications for all service health incidents. Which role must an administrator have to configure service health notifications in the Microsoft 365 admin center?

Accepted Answer

Global Administrator. Only the Global Administrator role has the necessary permissions to access and modify the Service Health section in the Microsoft 365 admin center, including configuring email notifications for service health incidents. This is because the Global Administrator role is the highest privileged role and is required to manage tenant-wide settings such as service health alerts, which are not delegated to lower-level administrative roles.

Answer

Service Support Administrator

Answer

Helpdesk Administrator

Answer

Billing Administrator

Question 3

A newly hired Microsoft 365 administrator needs to receive email notifications for all service health incidents. The administrator wants to ensure they have the necessary permissions to configure these notifications. Which role is the minimum role required to manage service health notifications in the Microsoft 365 admin center?

Accepted Answer

Service Administrator. The Service Administrator role is the minimum built-in role that grants permission to manage service health notifications in the Microsoft 365 admin center. This role allows the administrator to view and configure service health alerts and notifications without the broader privileges of the Global Administrator role, aligning with the principle of least privilege.

Answer

Global Administrator

Answer

User Administrator

Answer

Security Reader

Question 4

An administrator has added the custom domain 'contoso.co.uk' to their Microsoft 365 tenant and verified ownership. Users now need to receive email at @contoso.co.uk. Which DNS record must the administrator add in the public DNS zone to route emails to Exchange Online?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

TXT record. To verify domain ownership in Microsoft 365, the administrator must create a TXT record in the public DNS zone containing a specific verification string provided by the Microsoft 365 admin center. The TXT record is the standard DNS record type used for domain ownership verification because it can store arbitrary text data without affecting email routing or other services, and Microsoft 365 checks for this record to confirm the domain is under the administrator's control.

Answer

MX record

Answer

CNAME record

Answer

record

Question 5

An administrator needs to add a custom domain 'contoso.org' to their Microsoft 365 tenant. They have already purchased the domain and have access to the DNS registrar. What is the first step the administrator should perform in the Microsoft 365 admin center?

Accepted Answer

Add the domain in the Microsoft 365 admin center. The first step to add a custom domain to a Microsoft 365 tenant is to initiate the domain addition process in the Microsoft 365 admin center. This triggers Microsoft to generate the unique verification TXT record that must be published in the public DNS zone. Without first adding the domain in the admin center, the administrator would not know the specific verification string required for the TXT record.

Answer

Add a TXT record in the public DNS zone

Answer

Configure email routing (MX record)

Answer

Create user accounts with the new domain

Question 6

An organization plans to automatically assign Microsoft 365 E3 licenses to all users in the 'Finance' department. The Finance department is identified by the 'Department' attribute in Azure AD. Which method should the administrator use to minimize manual effort?

Accepted Answer

Group-based licensing using a dynamic group with the rule 'user.department -eq "Finance"'. Group-based licensing allows assigning licenses to a security group. By using a dynamic group based on the 'Department' attribute, users are automatically added to the group and receive licenses when they meet the criteria. Manual assignment or bulk upload require ongoing administrative effort. Self-service portals do not automatically assign licenses.

Answer

Manual assignment using PowerShell

Answer

Bulk assignment using a CSV file

Answer

Self-service licensing portal

Question 7

An administrator is planning to migrate from on-premises Exchange to Exchange Online. The current on-premises environment is Exchange 2016. The company has a hybrid deployment with Azure AD Connect. They want to use the cutover migration method. What is a prerequisite for starting a cutover migration?

Accepted Answer

The on-premises Exchange server must be reachable from the Microsoft 365 migration service via a public endpoint. For a cutover migration from on-premises Exchange 2016 to Exchange Online, the Microsoft 365 migration service must be able to connect to the on-premises Exchange server via a public endpoint. This is because cutover migration uses IMAP or Exchange Web Services (EWS) over HTTPS, requiring the on-premises server to be accessible from the internet without a VPN or private connection. Without this public endpoint, the migration service cannot discover mailboxes or synchronize data.

Answer

The on-premises Exchange server must have the MRS Proxy service installed and running

Answer

TLS certificate must be bound to the on-premises Exchange server for migration authentication

Answer

The administrator executing the migration must have on-premises Exchange Organization Management role

Question 8

As a Microsoft 365 administrator, you need to manage tenant health and adoption effectively. Which three of the following tools or features should you use to monitor and improve your Microsoft 365 tenant's performance and user engagement? (Choose three.)

Accepted Answer

Microsoft 365 usage analytics in Power BI to gain deeper insights into adoption trends.. The Microsoft 365 admin center dashboard provides a centralized view of service health, message center posts, and usage reports, enabling administrators to monitor service availability, planned changes, and user activity. This is a core tool for maintaining tenant health and tracking adoption.

Answer

Microsoft Purview compliance portal to enforce data loss prevention policies.

Answer

Azure AD Identity Protection to detect sign-in risks and block compromised accounts.

Answer

Microsoft 365 network connectivity test tool to evaluate network performance for Microsoft 365 services.

Question 9

You are a Microsoft 365 Administrator for a multinational organization that is deploying a new Microsoft 365 tenant. The organization has strict compliance and security requirements. Which four of the following actions should you take to properly deploy and manage the tenant? Choose all that apply. (There are four correct answers.)

Accepted Answer

Configure a Microsoft 365 usage location for each user before assigning licenses to comply with regional licensing and data residency requirements.. The correct actions are: 1) Enable Microsoft Defender for Office 365 with Safe Attachments and Safe Links to protect against advanced threats—a critical security baseline. 2) Set a usage location for each user before assigning licenses to comply with regional licensing and data residency requirements. 3) Configure password hash synchronization (PHS) for hybrid identity, which synchronizes password hashes to Microsoft Entra ID and enables features like Identity Protection and leaked credential detection. 4) Create custom RBAC roles to delegate administrative tasks with least privilege, avoiding the need to grant global admin rights. Disabling MFA is incorrect because MFA must be enabled from day one, especially for privileged roles, and the admin center should never be used to manage on-premises AD objects directly; on-premises changes must be made in on-premises AD and synchronized.

Answer

Use the Microsoft 365 admin center to directly edit and manage all user objects in the on-premises Active Directory to ensure synchronization consistency.

Answer

Disable multi-factor authentication (MFA) for all users during the initial deployment to simplify onboarding, and enable it after 30 days.

Question 10

Drag and drop the steps to deploy Microsoft Defender for Office 365 policies in the correct order.

Accepted Answer

Create the policy, configure protection settings, specify recipients, enable the policy. Defender for Office 365 policies are created in the Defender portal, configured with threat protection settings, and applied to recipients.

Answer

Create the policy, specify recipients, configure protection settings, enable the policy

Answer

Configure protection settings, create the policy, specify recipients, enable the policy

Answer

Create the policy, enable the policy, configure protection settings, specify recipients

Question 11

Drag and drop the steps to configure role-based access control (RBAC) in Microsoft 365 Defender in the correct order.

Accepted Answer

Create or edit RBAC roles in Microsoft 365 Defender, then assign permissions to the roles, then assign the roles to users or groups.. RBAC roles are created/edited in Defender, permissions assigned, and then assigned to users/groups.

Answer

Assign permissions to the roles, then create or edit RBAC roles, then assign the roles to users or groups.

Answer

Create or edit RBAC roles, then assign the roles to users or groups, then assign permissions to the roles.

Answer

Assign the roles to users or groups, then create or edit RBAC roles, then assign permissions to the roles.

Question 12

A user reports they cannot access Microsoft Teams. They see a message: 'Your account is not enabled for Teams.' You verify the user has a valid Microsoft 365 E3 license assigned. What is the most likely cause?

Accepted Answer

The Teams service plan is disabled in the user's license.. The error 'Your account is not enabled for Teams' indicates that the Teams service plan is disabled within the user's assigned Microsoft 365 E3 license. Even with a valid license, each service plan (e.g., Teams, Exchange Online, SharePoint) can be individually toggled on or off via the Microsoft 365 admin center or PowerShell. Since the user has a valid license but cannot access Teams, the most likely cause is that the Teams service plan has been explicitly disabled.

Answer

The user does not have the correct Microsoft Entra ID role.

Answer

The user is not assigned a valid license.

Answer

The user is not a global administrator.

Question 13

Your organization uses Microsoft Entra ID. You want to enforce Multi-Factor Authentication (MFA) for all users. You have already configured Conditional Access policies. However, some users are still able to sign in without MFA. What should you check first?

Accepted Answer

Confirm that all users are included in the policy's user assignment.. The most common reason a Conditional Access policy fails to enforce MFA is that not all users are included in the policy's user assignment. If the policy targets only a subset of users (e.g., a test group), users outside that scope will bypass MFA entirely. The first troubleshooting step is to verify that the policy's 'Users and groups' assignment includes 'All users' or the specific groups covering all users.

Answer

Ensure all users have registered for MFA.

Answer

Verify that the Conditional Access policy is enabled.

Answer

Check if there are any exclusions configured.

Question 14

Your company is deploying Microsoft Defender for Office 365. The security team wants to automatically remove messages identified as malware from all mailboxes after delivery. What should you configure?

Accepted Answer

Enable Zero-hour auto purge (ZAP) in the anti-malware policy.. Zero-hour auto purge (ZAP) is the correct feature because it automatically detects and removes messages that are identified as malware after they have already been delivered to a user's mailbox. By enabling ZAP in the anti-malware policy, the system retroactively moves malicious messages to the user's Junk Email folder or quarantines them, ensuring post-delivery protection without manual intervention.

Answer

Configure an anti-malware policy with a high-confidence verdict.

Answer

Set up a mailbox intelligence policy.

Answer

Create an anti-phishing policy to block spoofed senders.

Question 15

You need to ensure that guest users who are invited to your Microsoft Entra ID tenant can access resources without needing to accept an invitation. What should you configure?

Accepted Answer

Enable 'Email one-time passcode for guests' and set 'Allow invitations to be sent to any user' to Yes.. Configuring the 'External collaboration settings' to allow invitations only to specific domains ensures that guest users from those trusted domains are automatically granted access without needing to accept an invitation. This bypasses the usual acceptance process for invited users from allowed domains.

Answer

Configure the 'External collaboration settings' to allow invitations to specific domains only.

Answer

Set the 'Guest invite settings' to 'Anyone in the organization can invite guest users'.

Answer

Set the 'Guest invite settings' to 'Only users assigned to specific admin roles can invite'.