MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 3 — 15 Questions

Question 1

Your company has implemented Microsoft Entra ID tenant restrictions to prevent data exfiltration. You need to ensure that external users from a partner organization can access a SharePoint Online site without being blocked by tenant restrictions. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the partner tenant ID to the AllowedTenants list in the tenant restrictions policy.. Tenant restrictions in Microsoft Entra ID work by blocking authentication to external tenants unless those tenants are explicitly permitted. The AllowedTenants list within the tenant restrictions policy is the mechanism that whitelists specific partner tenant IDs so their users can authenticate to your SharePoint Online resources without being blocked. Adding the partner tenant ID to this list directly satisfies the requirement while preserving the data exfiltration controls for all other tenants.

Answer

Create a Conditional Access policy to exclude partner users from tenant restriction evaluation.

Answer

Configure Azure AD B2B collaboration and invite partner users as guests.

Answer

Configure cross-tenant access settings in Microsoft Entra ID to allow partner tenant.

Question 2

Your organization has a Microsoft 365 tenant with 5,000 users. You need to plan for tenant migration from an on-premises Exchange environment. You have a limited maintenance window and want to minimize user impact. Which approach should you recommend?

Accepted Answer

Use a hybrid configuration.. A hybrid configuration allows you to migrate mailboxes in batches over an extended period, minimizing user impact and working within limited maintenance windows. Staged migration supports only up to 2,000 mailboxes total, not per batch, so it cannot handle 5,000 users. Cutover migration requires migrating all mailboxes at once and supports up to 5,000, but it has high user impact. IMAP migration does not migrate calendar/contacts and is not ideal for a full tenant migration.

Answer

Perform a staged migration.

Answer

Perform an IMAP migration.

Answer

Perform a cutover migration.

Question 3

An administrator creates a Conditional Access policy as shown in the exhibit. A user reports that they can still access Exchange Online using Outlook (modern authentication). Why does the policy not block the user?

Accepted Answer

The client app type for modern authentication is not specified in the policy.. The explanation incorrectly states that 'Modern authentication clients' must be explicitly enabled. In Microsoft Entra Conditional Access, the 'Client apps' condition includes 'Browser', 'Mobile apps and desktop clients', 'Exchange ActiveSync clients', and 'Other clients'. Modern authentication (OAuth 2.0) is part of 'Mobile apps and desktop clients'. If that is selected, the policy would apply. The policy might not block due to lack of user assignment (A), grant control set to allow/MFA (B), or other misconfiguration — but not because a non-existent toggle is missing.

Answer

The policy is not assigned to any users or groups.

Answer

The grant control is set to 'Require multi-factor authentication' instead of 'Block'.

Answer

Exchange ActiveSync is not included in the policy.

Question 4

Your organization uses Microsoft Purview to enforce data loss prevention (DLP) policies. You need to block users from sharing credit card numbers via email. Which THREE components are required to implement this policy?

Accepted Answer

The built-in 'Credit Card Number' sensitive info type.. Option A is correct because the built-in 'Credit Card Number' sensitive information type (SIT) is the detection mechanism that identifies credit card numbers in email content, which is exactly what the DLP policy needs to match. Option B is correct because a sensitivity label that identifies credit card information provides the classification context that DLP policies can use to detect and protect that data in email. Option E is correct because the DLP policy itself, configured in the Microsoft Purview compliance portal, defines the rule that blocks sharing of credit card numbers via email; without it, no enforcement occurs. Option C is incorrect because Microsoft Defender for Cloud Apps is a CASB for cloud app discovery and control, not a required component for email DLP enforcement. Option D is incorrect because Microsoft Entra ID P2 licenses provide identity protection and conditional access features, not the DLP policy engine or sensitive info types needed for this scenario.

Answer

Microsoft Defender for Cloud Apps.

Answer

Microsoft Entra ID P2 licenses.

Question 5

A Global Administrator signs in to the Microsoft 365 admin center but is not prompted for MFA. The policy in the exhibit is the only Conditional Access policy. What is the most likely reason?

Accepted Answer

The administrator is connecting from a trusted IP address that is excluded from MFA.. The policy includes all cloud apps and the Global Administrator role, and it is enabled. However, the policy allows exclusion of trusted IP addresses. If the Global Administrator connects from a trusted IP (e.g., the corporate office), MFA is not required. Option A is incorrect because the Microsoft 365 admin center is included via 'All cloud apps'. Option C is incorrect because the Global Administrator role is included in the policy. Option D is incorrect because the policy is enabled, not in report-only mode.

Answer

The Microsoft 365 admin center is not included in the policy.

Answer

The policy does not include the Global Administrator role.

Answer

The policy is in 'report-only' mode.

Question 6

Your organization has a Microsoft 365 tenant configured with a custom domain contoso.com. Users report they cannot receive email from external senders; internal email works fine. You verify the MX record for contoso.com points to the Microsoft 365 mail exchanger. What should you check next?

Accepted Answer

Verify that an SPF TXT record exists for contoso.com.. The most common cause of external email delivery failure after MX record configuration is a missing or incorrect SPF record. SPF is required to prevent spoofing and ensure delivery. Option B (Sender Policy Framework record) is correct. Option A is wrong because the MX record is already verified. Option C is wrong because DNS propagation typically completes within minutes to hours; waiting longer is not a diagnostic step. Option D is wrong because Exchange admin center settings do not affect inbound mail flow at the DNS level.

Answer

Check the Exchange admin center for connector configuration.

Answer

Wait 48 hours for DNS propagation.

Answer

Verify that the MX record has a priority of 0.

Question 7

Your Microsoft 365 tenant has been configured with Microsoft Entra ID Connect synchronization from on-premises Active Directory. Users are unable to log in to Microsoft 365 services. You check the synchronization status and see that the last sync was successful. What is the most likely cause?

Accepted Answer

The user principal name (UPN) suffix for users is not a verified domain in Microsoft Entra ID.. The most likely cause is that the UPN suffix for users is not a verified domain in Microsoft Entra ID. Even though password hash synchronization is enabled and the last sync was successful, if the UPN suffix (e.g., @contoso.local) does not match a custom domain verified in Entra ID, users cannot sign in because Entra ID cannot route authentication to the correct tenant. The sync process will complete without error, but login fails because the UPN is not recognized as a valid domain in the cloud.

Answer

The firewall is blocking authentication requests to Microsoft 365.

Answer

The on-premises Active Directory is not reachable from the sync server.

Answer

Password hash synchronization is disabled.

Question 8

You are planning a Microsoft 365 tenant migration from an on-premises Exchange environment. You need to minimize the impact on end users during the migration. Which migration approach should you use?

Accepted Answer

Perform a staged migration to move mailboxes in batches.. A staged migration allows you to move mailboxes in batches, which minimizes end-user disruption by spreading the migration workload over time and enabling you to test and validate each batch before proceeding. This approach is ideal for organizations with many mailboxes that need to maintain continuity, as users in later batches remain fully functional in the on-premises environment until their turn.

Answer

Deploy a hybrid Exchange configuration.

Answer

Perform a cutover migration to move all mailboxes at once.

Answer

Use an IMAP migration to migrate only email data.

Question 9

You are configuring Microsoft Entra ID for a new organization. You need to ensure that users can self-service reset their passwords. Which licensing is required?

Accepted Answer

Microsoft Entra ID P1. Microsoft Entra ID P1 is required for Self-Service Password Reset (SSPR) when you need capabilities like password writeback for on-premises synchronization or more granular control through conditional access. While Microsoft Entra ID Free does provide basic SSPR for cloud-only users without writeback, the question typically implies a scenario requiring the advanced features available in the P1 tier, such as group-based licensing and conditional access policies that underpin a comprehensive SSPR deployment. Microsoft Entra ID P2 also includes SSPR but is not necessary, as the P1 tier provides the required functionality.

Answer

Microsoft Entra ID Free

Answer

Microsoft Entra ID P2

Answer

Microsoft 365 Business Basic

Question 10

Which TWO are valid methods to add users to a Microsoft 365 tenant?

Accepted Answer

Add users individually in the Microsoft 365 admin center.. Option D is correct because the Microsoft 365 admin center provides a built-in 'Add a user' wizard (Users > Active users > Add a user) that creates the account in Microsoft Entra ID and assigns the required Microsoft 365 licenses and roles. Option E is correct because Microsoft Entra ID Connect (formerly Azure AD Connect) synchronizes user objects from on-premises Active Directory Domain Services to Microsoft Entra ID, provisioning them into the tenant without manual creation. Option A is incorrect because DNS records (such as MX, TXT, or CNAME) are used for domain verification and mail routing, not for creating user accounts. Option B is incorrect because the Azure portal is not the supported method for adding Microsoft 365 users to a tenant; user provisioning for Microsoft 365 is done through the Microsoft 365 admin center, Entra ID Connect, or PowerShell. Option C is incorrect because the Exchange admin center manages mailboxes, groups, and mail flow settings for existing recipients, but it does not create new Microsoft 365 tenant user accounts.

Answer

Create users by adding a DNS record.

Answer

Add users in the Azure portal.

Answer

Create users in the Exchange admin center.

Question 11

You need to delegate the ability to reset user passwords in Microsoft Entra ID to a helpdesk team. However, they should not be able to modify other user attributes. What role should you assign?

Accepted Answer

Helpdesk Administrator. The Helpdesk Administrator role is specifically designed to allow password resets and force password changes for non-administrator users and other helpdesk administrators, while explicitly preventing modifications to other user attributes like group membership or profile details. This role provides the least privilege necessary for the helpdesk team's task, aligning with the principle of role-based access control (RBAC) in Microsoft Entra ID.

Answer

User Administrator

Answer

Global Administrator

Answer

Password Administrator

Question 12

Your Microsoft 365 tenant has 50,000 users. You are planning to migrate mailboxes from on-premises Exchange Server 2019 to Exchange Online using a full hybrid configuration. During the migration, you must ensure that free/busy information is synchronized between on-premises and Exchange Online. Which component is required for free/busy synchronization in a hybrid deployment?

Accepted Answer

Exchange Hybrid Server (or Hybrid Agent). In a full hybrid configuration, free/busy synchronization between on-premises Exchange and Exchange Online is handled by the Exchange Hybrid Server (or the newer Hybrid Agent). This component acts as a bridge, using the Exchange Web Services (EWS) and Autodiscover service to securely relay free/busy data between the two organizations. Without it, the Availability service cannot query the remote forest for calendar information.

Answer

Azure AD Connect

Answer

Exchange Online connector (Outbound to on-premises)

Answer

Hybrid Configuration Wizard

Question 13

You are a Microsoft 365 administrator. You need to ensure that users can reset their own passwords without contacting the help desk. Which TWO components must be configured?

Accepted Answer

Microsoft Entra ID P1 or P2 licenses assigned to users. The correct answers are B and D. Self-Service Password Reset (SSPR) requires Microsoft Entra ID P1 or P2 licenses assigned to users (B). Additionally, the SSPR feature must be enabled in the Microsoft Entra admin center (D). Option A is incorrect because the user risk policy in Identity Protection is not required for SSPR. Option C is incorrect: password hash synchronization is not necessary for cloud-only users; SSPR works with cloud accounts. Option E is incorrect: password writeback is used to sync password changes back to on-premises Active Directory, but it is not required for cloud-only password resets.

Answer

Configure Microsoft Entra ID Protection user risk policy

Answer

Azure AD Connect with password hash synchronization

Answer

Enable password writeback in Azure AD Connect

Question 14

Your organization is deploying Microsoft 365 Copilot for 200 users. You need to ensure that Copilot can access user data from Microsoft Graph to provide personalized responses. Which THREE permissions must be granted?

Accepted Answer

Chat.ReadWrite (Microsoft Graph). Microsoft 365 Copilot relies on delegated Microsoft Graph permissions to surface personalized content, and the required set includes Chat.ReadWrite (A) so Copilot can read and act on Teams chats, Calendars.ReadWrite (B) so it can read and manage calendar events for scheduling and meeting context, and Files.ReadWrite.All (C) so it can access and work with SharePoint/OneDrive files that ground its responses. These three permissions map directly to the chat, calendar, and file data sources Copilot uses to generate contextual answers for the signed-in user. User.Read.All (D) is not required because Copilot reads the signed-in user's own profile via the basic User.Read delegated permission rather than tenant-wide directory access. Mail.Send (E) is not part of the baseline Copilot permission set, since Copilot does not need to send mail on the user's behalf to provide personalized responses.

Answer

User.Read.All (Microsoft Graph)

Answer

Mail.Send (Microsoft Graph)

Question 15

Refer to the exhibit. You run the PowerShell command in a Microsoft 365 tenant. What does the output indicate?

Accepted Answer

The email addresses that receive service health notifications.. The PowerShell command `Get-ExchangeNotification` retrieves the email addresses configured to receive service health notifications for the Microsoft 365 tenant. The output shown lists these notification recipients, which are separate from administrative roles or billing contacts. Option B correctly identifies this as the set of email addresses that receive service health alerts.

Answer

The users who have the Global Administrator role.

Answer

The members of the default Office 365 group.

Answer

The email addresses for billing inquiries.