MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 4 — 15 Questions

Question 1

Your organization wants to use Microsoft Intune to manage devices. You need to ensure that only corporate-owned devices can enroll. What configuration should you use?

Accepted Answer

Configure enrollment restrictions to block personally owned devices.. Enrollment restrictions in Microsoft Intune allow you to block personally owned devices by setting the 'Allow personally owned devices' option to 'No' for the platform. This ensures that only corporate-owned devices, which are identified by their corporate enrollment token or IMEI/MEID numbers, can enroll. This is the direct and intended method to restrict enrollment to corporate-owned devices only.

Answer

Use a conditional access policy to require device compliance.

Answer

Set a compliance policy requiring devices to be marked as corporate.

Answer

Create a device type restriction for iOS and Android.

Question 2

Your company has a Microsoft 365 tenant with a custom domain (contoso.com). You need to verify domain ownership before enabling email routing. Which DNS record type should you add?

Accepted Answer

Add an MX record pointing to contoso-com.mail.protection.outlook.com.. When you add a custom domain to Microsoft 365 and need to enable email routing, you must prove domain ownership and configure mail flow. The MX record with the value 'contoso-com.mail.protection.outlook.com' is the specific record that Microsoft 365 requires to route incoming email for your domain to Exchange Online. This record is added after domain ownership is verified (usually via a TXT record), but the question asks which record type enables email routing, which is the MX record.

Answer

Add a TXT record with the verification code.

Answer

Add a CNAME record pointing to autodiscover.outlook.com.

Answer

Add an SPF record for contoso.com.

Question 3

Your organization uses Microsoft Purview Information Protection. You need to ensure that when a user applies a sensitivity label to a document in SharePoint, the label is automatically applied to the document when it is downloaded. What should you configure?

Accepted Answer

Create an auto-labeling policy in Microsoft Purview.. Auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels to documents based on conditions, including when a user has manually applied a label. To ensure that the label is applied when the document is downloaded, configure an auto-labeling policy that triggers on download. Option D is correct. Option A is incorrect because DLP policies do not apply labels; they enforce protection rules. Option B is incorrect because Conditional Access policies govern access, not labeling. Option C is incorrect because client-side labeling only applies the label in the application, not as a persistent marking when downloaded.

Answer

Use a Data Loss Prevention (DLP) policy to enforce labeling.

Answer

Create a Conditional Access policy requiring label application.

Answer

Configure a sensitivity label with client-side labeling.

Question 4

Which TWO actions are required to enable Microsoft 365 Copilot for your organization?

Accepted Answer

Ensure users have a Microsoft 365 E3 or E5 license with the Copilot add-on.. Microsoft 365 Copilot requires users to have a qualifying license such as Microsoft 365 E3 or E5, plus the Copilot add-on license. Without this specific licensing, the Copilot features cannot be activated or used within the tenant. Enabling Microsoft Graph connectivity is not a prerequisite action; it is typically already enabled by default and not a step users need to take to activate Copilot. Therefore, only option D is a required action.

Answer

Deploy a third-party AI gateway.

Answer

Assign the Global Administrator role to all users.

Answer

Disable legacy authentication protocols.

Answer

Enable Microsoft Graph connectivity for the tenant.

Question 5

Which TWO settings must be configured to set up a hybrid identity deployment using password hash synchronization?

Accepted Answer

Install and configure Microsoft Entra Connect.. To set up a hybrid identity deployment using password hash synchronization (PHS), two essential components are required: installing and configuring Microsoft Entra Connect, and enabling the password hash synchronization feature within Entra Connect. While configuring Seamless SSO is a common additional step, it is not mandatory for PHS to function; PHS alone provides password synchronization without SSO. Options D and E (AD FS and Pass-Through Authentication) represent alternative authentication methods, not requirements for PHS.

Answer

Configure Seamless Single Sign-On (SSO).

Answer

Deploy Active Directory Federation Services (AD FS).

Answer

Configure Pass-Through Authentication.

Question 6

Which TWO tools can be used to manage Microsoft 365 tenant settings and configurations?

Accepted Answer

Microsoft 365 admin center. The Microsoft 365 admin center is the primary web-based portal for managing tenant-wide settings such as user licensing, domain management, service health, and security policies. It provides a unified dashboard for configuring core tenant configurations without requiring role-specific consoles.

Answer

Exchange admin center (EAC)

Answer

SharePoint admin center

Answer

Microsoft Intune admin center

Question 7

Your organization plans to use Microsoft 365 Copilot. To ensure compliance, you need to prevent Copilot from accessing sensitive content in SharePoint Online document libraries that are labeled as 'Highly Confidential'. What should you configure?

Accepted Answer

Configure a sensitivity label with encryption and apply it to the documents.. Sensitivity labels with encryption can restrict access to documents based on their classification. When a document is labeled 'Highly Confidential' and encrypted, Microsoft 365 Copilot cannot process it because Copilot respects the encryption applied by the label, effectively preventing it from accessing the sensitive content. This is the only configuration that directly controls Copilot's ability to read the content at the file level.

Answer

Configure a retention policy to prevent Copilot from accessing older content.

Answer

Create a conditional access policy to block Copilot from accessing SharePoint.

Answer

Create a DLP policy to block Copilot from processing 'Highly Confidential' content.

Question 8

Your organization uses Microsoft 365 E5 licenses. You need to implement a secure score improvement plan. After reviewing the Secure Score, you notice a recommendation to 'Enable sign-in risk policy' in Microsoft Entra ID. However, you want to ensure that users who sign in from trusted locations are not challenged. What should you configure?

Accepted Answer

Create a conditional access policy that targets sign-in risk: medium and above, require MFA, and exclude trusted named locations.. It creates a Conditional Access policy that targets sign-in risk at medium and above, requiring MFA, while excluding trusted named locations. This ensures users from trusted IPs are not challenged, directly addressing the requirement to avoid unnecessary prompts for trusted sign-ins while still enforcing risk-based policies.

Answer

Configure named locations in Microsoft Entra ID for trusted IPs.

Answer

Enable the 'Sign-in risk' policy in Identity Protection and set 'Exclude trusted locations'.

Answer

Enable the 'Require MFA for all users' conditional access policy.

Question 9

You are deploying a new Microsoft 365 tenant for a company that has a single domain, contoso.com. You need to verify domain ownership to enable email routing. Which DNS record type must you add to the public DNS zone?

Accepted Answer

TXT record with a verification code provided by Microsoft 365.. To verify domain ownership in Microsoft 365, you must add a TXT record containing a unique verification code provided by the Microsoft 365 admin center to your public DNS zone. This proves you control the domain, enabling email routing and other services. Other DNS records like CNAME, SPF, or MX are used for service configuration, not ownership verification.

Answer

CNAME record with 'autodiscover' pointing to 'autodiscover.outlook.com'.

Answer

SPF record including Microsoft 365 IP addresses.

Answer

MX record pointing to Microsoft 365.

Question 10

Your organization's Microsoft Intune environment enforces device compliance policies for iOS devices. You need to ensure that only devices with a passcode that is at least 6 characters and have jailbreak detection enabled are considered compliant. What should you configure?

Accepted Answer

Create a device compliance policy for iOS with required passcode length and jailbreak detection.. Device compliance policies in Microsoft Intune define the rules that devices must meet to be considered compliant, such as minimum OS version, passcode length, and jailbreak detection. Option D correctly specifies creating a compliance policy for iOS that requires a passcode of at least 6 characters and enables jailbreak detection, which directly enforces the stated requirements. Compliance policies are evaluated before granting access, and non-compliant devices can be blocked or marked for remediation.

Answer

Configure a conditional access policy to require compliant devices.

Answer

Create a device configuration profile for iOS with the required settings.

Answer

Create an app protection policy for iOS to require passcode.

Question 11

You are configuring Microsoft Purview for your organization. You need to ensure that all external emails are automatically tagged with an 'External' label in the subject line. Which feature should you configure?

Accepted Answer

Mail flow rule (transport rule) to prepend '[External]' to subject lines.. To automatically prepend a text tag like '[External]' to the subject line of all incoming external emails, you must use a Mail flow rule (also known as a transport rule) in Exchange Online. This rule can be configured with the condition 'The sender is located outside the organization' and the action 'Prepend the subject line with the string [External]'. This is the only mechanism that directly modifies the subject line of emails in transit.

Answer

Anti-phishing policy in Defender for Office 365.

Answer

Sensitivity label policy to automatically apply an 'External' label.

Answer

Data loss prevention (DLP) policy for external emails.

Question 12

Your organization uses Microsoft Defender for Office 365. You need to configure a policy that automatically redirects emails containing malicious attachments to a quarantine folder for admin review. What type of policy should you create?

Accepted Answer

Anti-malware policy.. B is correct because the Anti-malware policy in Microsoft Defender for Office 365 is specifically designed to handle malware detected in email messages, including attachments. When configured, it can automatically redirect messages containing malicious attachments to a quarantine folder for admin review, providing a controlled remediation workflow.

Answer

Safe Attachments policy.

Answer

Anti-spam policy.

Answer

Safe Links policy.

Question 13

Your organization uses Microsoft 365 and has enabled Microsoft Entra ID P2 licenses. You need to configure automatic user provisioning for a third-party SaaS application that supports SCIM 2.0. What should you do first in the Microsoft Entra admin center?

Accepted Answer

Add the application from the gallery, then configure provisioning.. To configure automatic user provisioning for a third-party SaaS application that supports SCIM 2.0, you must first add the application from the Microsoft Entra gallery. This action creates an enterprise application object in your tenant, which is required to access the provisioning configuration blade. Only after adding the gallery application can you configure the provisioning settings, including the SCIM endpoint URL and token, to enable automated user lifecycle management.

Answer

Configure provisioning in 'App registrations'.

Answer

Navigate to 'Enterprise applications' and create a new application.

Answer

Use the 'App registrations' blade to register the app.

Question 14

Your organization is migrating from on-premises Exchange to Exchange Online. You need to ensure that users can access their mailboxes during the migration with minimal interruption. Which migration method should you use?

Accepted Answer

Minimal hybrid migration.. A minimal hybrid migration is the correct choice because it allows you to synchronize on-premises mailboxes with Exchange Online using the Hybrid Configuration Wizard (HCW) and then move mailboxes in batches with minimal downtime. Users retain access to their existing mailboxes during the migration, and once a mailbox is moved, Outlook automatically reconfigures via Autodiscover, ensuring a seamless transition.

Answer

Cutover migration.

Answer

Staged migration.

Answer

IMAP migration.

Question 15

Your organization uses Microsoft 365 E5 licenses. You need to implement a solution to protect against ransomware attacks. Which TWO features should you configure?

Accepted Answer

Configure Microsoft Defender for Office 365 policies.. Microsoft Defender for Office 365 includes anti-phishing, anti-spam, anti-malware, and Safe Attachments/Safe Links policies that directly block ransomware delivery vectors such as malicious email attachments and URLs. Option D is correct because Microsoft Defender for Cloud Apps provides visibility into cloud app usage, anomaly detection, and the ability to apply session policies (e.g., block download of sensitive files) to prevent ransomware from exfiltrating or encrypting data stored in SaaS apps.

Answer

Enable Microsoft Entra ID Protection.

Answer

Implement Microsoft Purview Information Protection.

Answer

Use Microsoft Intune to enforce device compliance.