MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 4 — 15 Questions

Question 1

Your organization uses Microsoft 365 Business Premium. You need to configure Windows 365 Cloud PCs for 10 users who require access to a custom line-of-business (LOB) application that is not compatible with Windows 11. The LOB app requires Windows 10 and 8 GB RAM. What is the most cost-effective Cloud PC configuration that meets the requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Windows 365 Business Standard license and a custom Windows 10 image.. Windows 365 Business Standard provides 8 GB RAM and supports custom Windows 10 images, meeting the LOB app's requirements. The Business Standard license is the most cost-effective tier that offers 8 GB RAM, while Basic only offers 4 GB RAM and would not satisfy the app's memory needs. A custom Windows 10 image is necessary since the app is incompatible with Windows 11.

Answer

Windows 365 Business Advanced license and a custom Windows 11 image.

Answer

Windows 365 Enterprise license with GPU.

Answer

Windows 365 Business Basic license and a custom Windows 10 image.

Question 2

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a custom PowerShell script that runs in the user context after every device restart. Which Intune policy type should you use?

Accepted Answer

Microsoft Intune PowerShell scripts (Devices > Scripts). Microsoft Intune PowerShell scripts (Devices > Scripts) allow you to deploy custom PowerShell scripts that run in the user context on Windows 10 devices. By configuring the script with 'Run this script using the logged on credentials' and setting the schedule to 'Run once per device' or 'Run on every device restart', you can ensure the script executes after every restart. This is the only Intune policy type designed specifically for deploying and managing custom PowerShell scripts with user context and restart-triggered execution.

Answer

Compliance policy

Answer

PowerShell script as a 'Run this script using the logged on credentials' assignment.

Answer

Device configuration profile

Question 3

Your Microsoft 365 tenant has a Microsoft Entra ID tenant with custom B2B collaboration settings. You need to allow external users from a specific domain (partner.com) to self-service sign up, but block all other external domains. What should you configure?

Accepted Answer

Configure cross-tenant access settings for partner.com with inbound access enabled and block other domains by default.. Cross-tenant access settings in Microsoft Entra ID allow you to configure inbound access for specific domains (partner.com) while blocking all others by default. This enables self-service sign-up for allowed domains and prevents unauthorized domains from signing up, directly meeting the requirement. Option B is incorrect because setting guest user access permissions to restricted does not allow domain-specific self-service sign-up; it limits guest permissions after invitation. Option A is incorrect because SharePoint external sharing controls content sharing, not identity-based sign-up. Option D is incorrect because there is no B2B collaboration allowlist; the correct approach is cross-tenant access settings.

Answer

Configure SharePoint Online external sharing settings to allow partner.com only.

Answer

Set guest user access permissions to 'Guest user access is restricted'.

Answer

Add partner.com to the B2B collaboration allowlist in Microsoft Entra ID.

Question 4

You need to ensure that all Microsoft 365 users in your organization have a consistent password policy that requires passwords to be at least 12 characters and include complexity requirements. What should you configure?

Accepted Answer

Password policy in Microsoft Entra ID. Microsoft Entra ID (formerly Azure AD) is the identity service that enforces tenant-wide password policies for cloud-only user accounts. Configuring the password policy in Entra ID allows you to set minimum length (e.g., 12 characters) and complexity requirements (e.g., must include uppercase, lowercase, digits, and special characters) that apply to all Microsoft 365 users. This is the correct location because Entra ID is the authoritative source for authentication policies in a Microsoft 365 tenant.

Answer

Device compliance policy in Microsoft Intune

Answer

Outlook on the web mailbox policy

Answer

Data loss prevention policy in Microsoft Purview

Question 5

Your organization is planning to deploy Microsoft 365 for 500 users. You need to ensure that all users can authenticate using their on-premises Active Directory credentials while also enabling self-service password reset (SSPR) in the cloud. Which configuration should you implement?

Accepted Answer

Password hash synchronization with Microsoft Entra Connect and SSPR enabled. Password hash synchronization (PHS) with Microsoft Entra Connect synchronizes on-premises AD password hashes to Microsoft Entra ID, enabling users to authenticate with their on-premises credentials in the cloud. When SSPR is enabled in Microsoft Entra ID, users can reset their cloud passwords, and with password writeback enabled, the new password is written back to on-premises AD, ensuring both environments remain in sync. This combination meets the requirement for on-premises authentication and cloud SSPR without the complexity of federation.

Answer

Pass-through authentication with Microsoft Entra Connect

Answer

Cloud-only identities with Microsoft Entra ID

Answer

Federated identity with Active Directory Federation Services (ADFS)

Question 6

Your organization is implementing Microsoft 365 Copilot. You need to ensure that users' data is protected from being used for training the underlying AI models. What should you configure?

Accepted Answer

Configure the Microsoft 365 Copilot data protection policy to prevent data from being used for training. Microsoft 365 Copilot includes a data protection policy specifically designed to prevent organizational data from being used to train the underlying AI models. This policy, configured in the Microsoft 365 admin center under Copilot settings, ensures that user prompts, responses, and associated data are not retained or used by Microsoft for model improvement, aligning with the data residency and privacy commitments outlined in the Microsoft Data Protection Addendum (DPA).

Answer

Disable Microsoft 365 Copilot for all users

Answer

Apply Microsoft Purview sensitivity labels to all documents

Answer

Enable Conditional Access policies to require compliant devices

Question 7

Your organization needs to enforce multi-factor authentication (MFA) for all users. You want to use a security default policy. What is the prerequisite?

Accepted Answer

The Microsoft Entra ID tenant must be on the Free tier or higher. Security defaults are available for all Microsoft Entra ID tenants, including the Free tier. Option A is incorrect because PIM is not required for security defaults. Option C is incorrect because security defaults require that Conditional Access policies are disabled; they are an alternative to Conditional Access. Option D is incorrect because Microsoft Entra ID P2 licenses are not required; security defaults are included with the Free tier.

Answer

Microsoft Entra ID Privileged Identity Management (PIM) must be enabled

Answer

Conditional Access policies must be disabled

Answer

Azure AD Premium P2 licenses must be assigned

Question 8

Your organization is using Microsoft 365 Business Premium. You need to ensure that devices are automatically enrolled in Microsoft Intune when users sign in with their work account. Which TWO configurations are required?

Accepted Answer

Enable MDM automatic enrollment in Microsoft Entra ID. Option A is correct because enabling MDM automatic enrollment in Microsoft Entra ID (formerly Azure AD) is the foundational setting that tells the tenant to enroll a user's device into Intune when they sign in with their work account, using the MDM user scope to define which users are covered. Option E is correct because, in addition to the Entra ID MDM user scope, automatic enrollment must be configured through the appropriate mechanism — Microsoft Entra ID for Windows BYOD scenarios or Group Policy for domain-joined/hybrid devices — so that the device actually triggers enrollment at sign-in. Option B is incorrect because a compliance policy only evaluates already-enrolled devices and does not cause enrollment. Option C is incorrect because enrollment restrictions control which platforms or device types may enroll, not whether automatic enrollment occurs. Option D is incorrect because device categories are optional metadata used for organization and reporting, not a requirement for automatic enrollment.

Answer

Create a device compliance policy in Intune

Answer

Set device enrollment restrictions to allow all platforms

Answer

Assign device categories to users

Question 9

You are planning a Microsoft 365 tenant migration from another tenant. You need to migrate email, OneDrive, and SharePoint content. Which THREE tools or methods can you use to migrate data?

Accepted Answer

Microsoft 365 Migration Manager. Microsoft 365 Migration Manager (A) is a native tool in the admin center that supports cross-tenant migrations for Exchange Online, OneDrive, and SharePoint, making it suitable for this scenario. Third-party tools like BitTitan MigrationWiz (C) are widely used for tenant-to-tenant migrations and can handle all three workloads. PowerShell scripts using Microsoft Graph API (E) allow custom migration scripts to migrate email, OneDrive, and SharePoint data, providing flexibility. Option B (Microsoft Teams admin center) is incorrect because it is for managing Teams settings, not migrating content. Option D (Exchange Admin Center migration tools) is incorrect because those tools are limited to mailbox migrations and do not cover OneDrive or SharePoint.

Answer

Microsoft Teams admin center

Answer

Exchange Admin Center migration tools

Question 10

Your organization is preparing to deploy Microsoft 365 for 5,000 users. You need to ensure that all users can authenticate using their existing on-premises Active Directory credentials while minimizing infrastructure changes. You also need to support self-service password reset (SSPR) for cloud-only users. Which authentication method should you recommend?

Accepted Answer

Password Hash Synchronization (PHS). Password Hash Synchronization (PHS) is the correct choice because it synchronizes password hashes from on-premises Active Directory to Microsoft Entra ID, allowing users to authenticate with their existing credentials without additional infrastructure. It also enables cloud-only users to use self-service password reset (SSPR) independently, as SSPR relies on cloud-stored hashes and does not require on-premises write-back for cloud-only accounts.

Answer

Cloud-only authentication with Microsoft Entra ID

Answer

Pass-through Authentication (PTA)

Answer

Federation with AD FS

Question 11

Your organization uses Microsoft 365 Copilot for Sales. You need to ensure that only licensed users can access Copilot features, and that usage is monitored for compliance. What should you configure?

Accepted Answer

Assign Copilot licenses to users in the Microsoft 365 admin center and monitor usage via the Reports dashboard. Licensing for Microsoft 365 Copilot for Sales is controlled through the Microsoft 365 admin center by assigning Copilot licenses to individual users. Usage monitoring is then available via the Reports dashboard, which provides adoption and usage metrics for licensed users. This ensures only licensed users access Copilot features and allows compliance monitoring without additional configuration.

Answer

Assign the Copilot Administrator role to users in Microsoft Entra ID

Answer

Configure a Microsoft Purview compliance policy for Copilot

Answer

Use PowerShell to assign Copilot licenses and enable audit logging in Microsoft Sentinel

Question 12

Your organization uses Microsoft Intune for mobile device management (MDM). You need to enforce that all iOS and Android devices must have a screen lock password of at least 6 characters before they can access corporate email. What should you configure?

Accepted Answer

Create a device configuration profile to set a passcode policy of 6 characters. A device configuration profile (or device restrictions policy) in Microsoft Intune enforces device-level passcode requirements on iOS and Android. By setting the passcode length to at least 6 characters, the policy enforces the screen lock password on the device itself. This is a device-level setting, not an app-level PIN, so it directly meets the requirement for a screen lock password. To access corporate email, the device must have the required screen lock password enforced via configuration.

Answer

Create an app protection policy in Microsoft Intune targeting iOS and Android with a minimum PIN length of 6

Answer

Create a Conditional Access policy requiring compliant devices

Answer

Create a device compliance policy requiring a password length of 6

Question 13

You are a Microsoft 365 administrator for Contoso Corporation, a multinational company with 20,000 users. The company uses Microsoft 365 E5, Microsoft Entra ID P2, Microsoft Defender XDR, Microsoft Purview, and Microsoft Intune. The security team wants to implement a zero-trust access model. Requirements: 1. All access to corporate resources must require multifactor authentication (MFA) and device compliance. 2. Users must register for MFA before accessing any app. 3. Legacy authentication protocols must be blocked for all users. 4. External collaboration must be governed by identity governance. 5. Sensitive data in SharePoint Online must be protected by DLP. 6. All administrative actions must be audited. You need to design the configuration. Which combination of actions should you take?

Accepted Answer

Create Conditional Access policies requiring MFA and compliant devices, block legacy auth, enforce MFA registration via Identity Protection, set up Microsoft Entra ID Governance for external users, configure Purview DLP for SharePoint, and enable Purview Audit. It correctly combines Conditional Access policies requiring MFA and compliant devices, blocking legacy auth, using Identity Protection to enforce MFA registration, Microsoft Entra ID Governance for external users, Purview DLP for SharePoint, and Purview Audit for admin actions, meeting all requirements. Option A is wrong because Security defaults are less granular and may not block legacy auth for all users. Option B is wrong because Intune compliance policies alone do not enforce MFA. Option C is wrong because per-user MFA is less secure and Microsoft Sentinel is not the primary audit log for admin actions (Purview Audit is correct).

Answer

Enable Security defaults, configure SharePoint DLP, and use Microsoft Purview Audit for admin actions

Answer

Create a Conditional Access policy requiring MFA, block legacy auth, and use Microsoft Defender for Cloud Apps to monitor admin actions

Answer

Use Microsoft Intune compliance policies, enable MFA per-user, and deploy Microsoft Sentinel for auditing

Question 14

Your organization uses Microsoft 365 E5 licenses. You need to ensure that all external sharing links for SharePoint Online expire after 30 days by default. You configure this in the SharePoint admin center. However, users report that links created before the change still do not have an expiration. What should you do?

Accepted Answer

Run Set-SPOTenant -DefaultSharingLinkExpirationInDays 30.. The `Set-SPOTenant -DefaultSharingLinkExpirationInDays 30` command sets the default expiration for newly created sharing links to 30 days. However, this setting does not apply retroactively to existing links. Users reporting that pre-existing links lack expiration is expected behavior. To enforce expiration on existing links, you would need to use a PowerShell script to update each link individually. Option A (`-RequireAcceptingAccountMatchInvitedAccount`) immediately invalidates anonymous links by requiring account matching, which is not the same as adding a 30-day expiration. Option B is ineffective, and Option D does not manage link expiration.

Answer

Use the Set-SPOTenant -RequireAcceptingAccountMatchInvitedAccount parameter.

Answer

Reconfigure the setting in SharePoint admin center and save again.

Answer

Create a data loss prevention (DLP) policy in Microsoft Purview to block unexpired links.

Question 15

Your company is deploying Microsoft 365 Copilot. You need to ensure that users can use Copilot in Word, Excel, and PowerPoint. The licensing is in place. However, you are concerned about data leakage. You want to ensure that Copilot does not use sensitive organizational data when generating content. What should you configure in Microsoft 365?

Accepted Answer

Create and assign sensitivity labels with encryption to sensitive documents, and ensure Copilot respects these labels.. Microsoft 365 Copilot respects sensitivity labels that are applied to documents. By creating and assigning sensitivity labels with encryption to sensitive documents, you can prevent Copilot from using that content as source material when generating responses. This is configured via Microsoft Purview Information Protection, where labels can include encryption settings that Copilot will honor, ensuring data leakage is mitigated without blocking Copilot functionality entirely.

Answer

Configure a data loss prevention (DLP) policy to block Copilot from accessing sensitive data.

Answer

Use the Microsoft Purview compliance portal to restrict Copilot data access.

Answer

Disable Copilot for users who handle sensitive data.