MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 5 — 15 Questions

Question 1

An administrator wants to restrict which users in the organization can create Microsoft 365 groups. The requirement is that only members of the IT department (identified by the department attribute in Azure AD) should be able to create groups. Which configuration should the administrator use?

Accepted Answer

Azure AD > Groups > Group settings > Group creation settings.. Option A is correct because the Azure AD 'Group settings' blade includes a 'Group creation settings' option that allows administrators to restrict group creation to specific security groups. By configuring this setting, the administrator can limit group creation to only members of the IT department, identified by the department attribute in Azure AD, by placing those users into a designated security group.

Answer

Azure AD Identity Governance > Access reviews.

Answer

Azure AD > Groups > Naming policy.

Answer

Microsoft 365 admin center > Groups > Add group.

Question 2

An administrator has added the custom domain 'contoso.co.uk' to their Microsoft 365 tenant and verified ownership. Users now need to receive email at @contoso.co.uk. Which DNS record must the administrator add in the public DNS zone to route emails to Exchange Online?

Accepted Answer

Add an MX record pointing to .mail.protection.outlook.com. To route email for a custom domain to Exchange Online, you must add an MX record in the public DNS zone that points to the Exchange Online mail exchanger. The correct target is .mail.protection.outlook.com, where is your initial tenant name (e.g., contoso-com). This MX record tells sending mail servers to deliver messages for @contoso.co.uk to Microsoft's email infrastructure.

Answer

Add a CNAME record for autodiscover

Answer

Add an SPF record

Answer

Add a DKIM record

Question 3

A global administrator wants to track service health issues and configure notifications for service incidents. Which portal should they use to view the current health status and set up email notifications?

Accepted Answer

Microsoft 365 admin center. The Microsoft 365 admin center provides the Service Health dashboard under Health > Service Health, which displays the current status of all Microsoft 365 services and allows administrators to configure email notifications for service incidents. This is the designated portal for managing tenant-wide service health and notifications, aligning with the role of a global administrator.

Answer

Azure portal

Answer

Microsoft 365 Defender portal

Answer

Microsoft Purview compliance portal

Question 4

A company has a Microsoft 365 tenant with the domain contoso.com. They acquire a subsidiary with the domain fabrikam.com and want to add it as an additional domain to the same tenant. The domain is already purchased and DNS management is available. What is the first step the administrator should take in the Microsoft 365 admin center?

Accepted Answer

Add the domain and verify ownership by adding a TXT record. To add an existing domain like fabrikam.com to a Microsoft 365 tenant, the first step is to add the domain in the Microsoft 365 admin center and then verify ownership by adding a TXT record to the domain's DNS zone. This verification proves the administrator controls the domain, which is a prerequisite for using it with Microsoft 365 services such as Exchange Online or SharePoint.

Answer

Create a new tenant for fabrikam.com

Answer

Set up email forwarding from contoso.com to fabrikam.com

Answer

Convert fabrikam.com to a federated domain

Question 5

A new administrator needs to automatically assign Microsoft 365 E5 licenses to all users in the Sales department. The Sales department is identified by the 'department' attribute in Azure AD. Which licensing method should the administrator use to minimize manual effort?

Accepted Answer

Group-based licensing using a dynamic group. Group-based licensing using a dynamic group is the correct method because it automatically assigns Microsoft 365 E5 licenses to all users in the Sales department based on the 'department' attribute in Azure AD. Dynamic groups evaluate membership rules in real time, so when a user's department attribute is set to 'Sales', the license is assigned without manual intervention. This minimizes administrative effort by eliminating the need for per-user or batch operations.

Answer

Manual license assignment per user

Answer

PowerShell script to assign licenses

Answer

Bulk license assignment via CSV file

Question 6

An organization wants to receive email notifications for all service health incidents. Which role must an administrator have to configure service health notifications in the Microsoft 365 admin center?

Accepted Answer

Global Administrator. Only the Global Administrator role has the necessary permissions to access and modify the Service Health section in the Microsoft 365 admin center, including configuring email notifications for service health incidents. This is because the Global Administrator role is the highest privileged role and is required to manage tenant-wide settings such as service health alerts, which are not delegated to lower-level administrative roles.

Answer

Service Support Administrator

Answer

Helpdesk Administrator

Answer

Billing Administrator

Question 7

A newly hired Microsoft 365 administrator needs to receive email notifications for all service health incidents. The administrator wants to ensure they have the necessary permissions to configure these notifications. Which role is the minimum role required to manage service health notifications in the Microsoft 365 admin center?

Accepted Answer

Service Administrator. The Service Administrator role is the minimum built-in role that grants permission to manage service health notifications in the Microsoft 365 admin center. This role allows the administrator to view and configure service health alerts and notifications without the broader privileges of the Global Administrator role, aligning with the principle of least privilege.

Answer

Global Administrator

Answer

User Administrator

Answer

Security Reader

Question 8

An administrator has added the custom domain 'fabrikam.com' to their Microsoft 365 tenant and is now ready to verify ownership. Which type of DNS record should the administrator create in the public DNS zone to complete the verification?

Accepted Answer

TXT record. To verify domain ownership in Microsoft 365, the administrator must create a TXT record in the public DNS zone containing a specific verification string provided by the Microsoft 365 admin center. The TXT record is the standard DNS record type used for domain ownership verification because it can store arbitrary text data without affecting email routing or other services, and Microsoft 365 checks for this record to confirm the domain is under the administrator's control.

Answer

MX record

Answer

CNAME record

Answer

record

Question 9

An administrator wants to add a custom domain 'contoso.com' to a new Microsoft 365 tenant. The domain is already registered and available. What is the first step the administrator should perform in the Microsoft 365 admin center?

Accepted Answer

Add the domain and verify ownership by creating a TXT record. The first step when adding a custom domain to a Microsoft 365 tenant is to add the domain in the admin center and then verify ownership by creating a TXT record in the domain's DNS zone. This proves you control the domain before any services (like email or SharePoint) can be configured. Without verification, Microsoft 365 will not allow further domain-related setup.

Answer

Create user accounts with the new domain

Answer

Configure email routing with MX records

Answer

Set up SharePoint Online with the new domain

Question 10

A company has a Microsoft 365 tenant with domain contoso.com. They own an additional domain fabrikam.com and have already added and verified it with a TXT record. Now they need to configure email to be routed to Exchange Online for fabrikam.com. Which DNS record must they create?

Accepted Answer

MX record pointing to contoso-com.mail.protection.outlook.com. To route email for fabrikam.com to Exchange Online, you must create an MX record that points to the Exchange Online mail exchanger. The correct target is contoso-com.mail.protection.outlook.com, where 'contoso-com' is the hashed version of the primary domain (contoso.com) used by Microsoft 365. This MX record tells the internet's mail servers to deliver messages addressed to @fabrikam.com into the tenant's Exchange Online environment.

Answer

CNAME record for autodiscover

Answer

TXT record for SPF

Answer

SRV record for SIP

Question 11

An administrator needs to add a custom domain 'contoso.org' to their Microsoft 365 tenant. They have already purchased the domain and have access to the DNS registrar. What is the first step the administrator should perform in the Microsoft 365 admin center?

Accepted Answer

Add the domain in the Microsoft 365 admin center. The first step to add a custom domain to a Microsoft 365 tenant is to initiate the domain addition process in the Microsoft 365 admin center. This triggers Microsoft to generate the unique verification TXT record that must be published in the public DNS zone. Without first adding the domain in the admin center, the administrator would not know the specific verification string required for the TXT record.

Answer

Add a TXT record in the public DNS zone

Answer

Configure email routing (MX record)

Answer

Create user accounts with the new domain

Question 12

An organization plans to automatically assign Microsoft 365 E3 licenses to all users in the 'Finance' department. The Finance department is identified by the 'Department' attribute in Azure AD. Which method should the administrator use to minimize manual effort?

Accepted Answer

Group-based licensing using a dynamic group with the rule 'user.department -eq "Finance"'. Group-based licensing allows assigning licenses to a security group. By using a dynamic group based on the 'Department' attribute, users are automatically added to the group and receive licenses when they meet the criteria. Manual assignment or bulk upload require ongoing administrative effort. Self-service portals do not automatically assign licenses.

Answer

Manual assignment using PowerShell

Answer

Bulk assignment using a CSV file

Answer

Self-service licensing portal

Question 13

An administrator recently added a custom domain 'tailspintoys.com' to their Microsoft 365 tenant and verified it. They now need to configure the domain so that all recipient email addresses for 'info@tailspintoys.com' are delivered to a shared mailbox in Exchange Online. The domain is currently set as internal relay. What should the administrator do first to route email for this domain to Exchange Online?

Accepted Answer

Change the domain type from 'Internal relay' to 'Authoritative' in Exchange admin center. Option B is correct because when a domain is set to 'Internal relay' in Exchange Online, the service expects to relay messages to an on-premises server for that domain. To have Exchange Online accept and deliver messages directly to a shared mailbox (or any hosted recipient), the domain must be changed to 'Authoritative'. This tells Exchange Online that it is the final destination for all recipients in that domain, enabling local delivery.

Answer

Update the MX record at the DNS registrar to point to Exchange Online

Answer

Create the shared mailbox 'info@tailspintoys.com' in Exchange Online

Answer

Disable the internal relay option for the domain in the Microsoft 365 admin center

Question 14

An administrator is planning to migrate from on-premises Exchange to Exchange Online. The current on-premises environment is Exchange 2016. The company has a hybrid deployment with Azure AD Connect. They want to use the cutover migration method. What is a prerequisite for starting a cutover migration?

Accepted Answer

The on-premises Exchange server must be reachable from the Microsoft 365 migration service via a public endpoint. For a cutover migration from on-premises Exchange 2016 to Exchange Online, the Microsoft 365 migration service must be able to connect to the on-premises Exchange server via a public endpoint. This is because cutover migration uses IMAP or Exchange Web Services (EWS) over HTTPS, requiring the on-premises server to be accessible from the internet without a VPN or private connection. Without this public endpoint, the migration service cannot discover mailboxes or synchronize data.

Answer

The on-premises Exchange server must have the MRS Proxy service installed and running

Answer

TLS certificate must be bound to the on-premises Exchange server for migration authentication

Answer

The administrator executing the migration must have on-premises Exchange Organization Management role

Question 15

An administrator wants to verify ownership of a custom domain 'adatum.com' in their Microsoft 365 tenant. They have already added the domain and received the TXT record value. However, the administrator's DNS hosting provider does not support adding a TXT record. Which alternative record type can be used for domain verification?

Accepted Answer

MX record. When a DNS hosting provider does not support TXT records, Microsoft 365 allows the use of an MX record as an alternative for domain verification. The administrator creates an MX record with a specific subdomain (e.g., 'adatum-com.mail.protection.outlook.com') and a custom priority value provided in the TXT record value, which Microsoft's verification system checks to confirm domain ownership. This method is supported because MX records are widely available and can carry the necessary verification data in their format.

Answer

record

Answer

SRV record

Answer

NS record