MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 5 — 15 Questions

Question 1

Your organization has a Microsoft 365 E5 tenant. You need to set up a shared mailbox for the IT help desk (helpdesk@contoso.com). The help desk team needs to monitor the mailbox and respond to emails. What is the recommended way to grant access to the shared mailbox?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the help desk users as members of the shared mailbox from the Exchange admin center.. The recommended method to grant access to a shared mailbox in Exchange Online is to add users as members directly from the Exchange admin center (EAC). This automatically assigns the necessary Full Access and Send As permissions without requiring licenses for each user, as shared mailboxes can be accessed by licensed users without needing a separate license for the mailbox itself.

Answer

Assign an Exchange Online license to each help desk user and grant them Full Access via PowerShell.

Answer

Create a security group and add it to the shared mailbox permissions.

Answer

Create a distribution group containing the help desk users and grant the group access to the mailbox.

Question 2

Your company uses Microsoft 365 Business Premium. You need to configure Microsoft Entra ID Protection to automatically remediate risks. Which TWO risk remediation actions can be configured?

Accepted Answer

Block sign-in for users with high sign-in risk.. Option D is correct because Entra ID Protection's sign-in risk policy can be configured to block access entirely when the sign-in risk level reaches High, which is one of the built-in remediation controls for risky sign-ins. Option E is correct because the sign-in risk policy can require multifactor authentication (MFA) when the risk level meets or exceeds a configured threshold (Low, Medium, or High), forcing the user to prove identity before access is granted. These two actions are the standard grant controls available in risk policies for automatic remediation. Option A is incorrect because Entra ID Protection does not remediate risk by blocking licensing assignments; licensing is a separate Microsoft 365 administrative function. Option B is incorrect because session timeout is controlled through Conditional Access session controls, not through ID Protection risk remediation actions. Option C is incorrect because forcing a password change is not a supported automatic remediation action in Entra ID Protection risk policies; user risk remediation is handled via requiring a secure password change through Conditional Access, not a standalone ID Protection action.

Answer

Block licensing assignments for users with high risk.

Answer

Configure session timeout for risky sessions.

Answer

Force password change for users with high user risk.

Question 3

You are the Microsoft 365 administrator for a large enterprise with 50,000 users. The company is deploying Microsoft 365 Copilot for all users. You need to ensure that the data used by Copilot is protected and that Copilot does not inadvertently expose sensitive information. The company has strict data residency requirements: all data must remain within the European Union (EU). You have already configured data boundaries in Microsoft 365 to keep data in the EU. However, you are concerned about Copilot's AI model training. You need to implement additional controls. The company uses Microsoft Purview Information Protection with sensitivity labels. You have created a sensitivity label "Highly Confidential" that applies encryption and a "Confidential" label that applies visual markings. You also have a DLP policy that prevents sharing of "Highly Confidential" data externally. You need to ensure that when a user uses Copilot with a document labeled "Highly Confidential", the Copilot response does not include any of the sensitive content from that document. What should you do?

Accepted Answer

Ensure that the Highly Confidential sensitivity label includes encryption when applied.. The 'Highly Confidential' sensitivity label already applies encryption, which prevents Microsoft 365 Copilot from accessing the document's content. Copilot cannot process or include encrypted content in its responses, as encryption blocks the AI model from reading the underlying data. This ensures that sensitive information from encrypted documents is not inadvertently exposed in Copilot outputs.

Answer

Exclude users who handle Highly Confidential data from Copilot licensing.

Answer

Create a DLP policy that blocks Copilot from accessing documents labeled Highly Confidential.

Answer

Configure Microsoft 365 data boundaries to restrict Copilot data processing to the EU.

Question 4

Contoso recently acquired a company with an existing Microsoft 365 tenant. You need to migrate their user accounts and mailboxes to the Contoso tenant. The acquired company uses a custom domain for email. You must ensure minimal disruption and maintain email flow during migration. What should you do first?

Accepted Answer

Add the custom domain to the Contoso tenant and verify ownership.. Before any migration can proceed, the custom domain used by the acquired company must be added and verified in the Contoso tenant. This is a prerequisite for cross-tenant mailbox migrations because the target domain must be recognized and owned by the destination tenant to route email correctly and assign user principal names (UPNs). Without domain verification, migration tools cannot validate the domain and email flow will fail.

Answer

Perform a cross-tenant mailbox migration using Microsoft 365 migration tools.

Answer

Disable the acquired company's tenant to force all users to the Contoso tenant.

Answer

Create new user accounts in the Contoso tenant using the onmicrosoft.com domain.

Question 5

Your organization has a Microsoft 365 E5 subscription. You need to enforce that all users must use multi-factor authentication (MFA) when accessing Microsoft 365 services. Which TWO components should you configure?

Accepted Answer

Security defaults.. Option B (Security defaults) is correct because it is a Microsoft-managed baseline that enforces MFA for all users when accessing Microsoft 365 services, and it is available at no extra cost for tenants that do not need granular, per-user control. Option E (Conditional Access policy) is correct because with a Microsoft 365 E5 subscription (which includes Microsoft Entra ID P2), you can create a Conditional Access policy that requires MFA for all users and all cloud apps, giving you the flexible, granular enforcement that Security defaults cannot provide. Option A (Microsoft Defender for Identity) is incorrect because it is a threat-detection service for on-premises identity signals, not an MFA enforcement mechanism. Option C (Microsoft Entra ID Protection user risk policy) is incorrect because it only triggers MFA when a user is flagged at risk, so it does not enforce MFA for all users at all times. Option D (Per-user MFA) is incorrect because it is the legacy per-user MFA setting, which is being deprecated in favor of Conditional Access and does not meet the requirement as a recommended, scalable enforcement component.

Answer

Microsoft Defender for Identity.

Answer

Azure AD Identity Protection user risk policy.

Answer

Per-user MFA (legacy).

Question 6

You are implementing Microsoft Purview Data Lifecycle Management. You need to retain all emails for a minimum of 5 years but automatically delete them after 7 years. Which TWO actions should you configure?

Accepted Answer

Create a retention policy with 'Delete items after 7 years'.. Option B is correct because a Microsoft Purview retention policy can be scoped to Exchange email and configured with a retention period of 7 years plus a 'Delete items after' action, which satisfies the requirement to automatically delete emails after 7 years. Option C is correct because a retention tag (retention policy tag) applied to email can specify a retention period of 5 years with a 'Keep' action, ensuring emails are retained for the required minimum of 5 years before the 7-year deletion occurs. Together, the retention policy's delete-after-7-years setting and the retention tag's keep-for-5-years setting implement the minimum-retain/maximum-delete lifecycle. Option A is not correct because MRM retention policies alone do not provide the Purview Data Lifecycle Management retention/delete behavior described; MRM uses retention tags and policies but the scenario specifically requires Purview retention configuration. Option D is not correct because sensitivity labels classify and protect content but do not by themselves enforce a 5-year retain and 7-year delete lifecycle. Option E is not correct because litigation hold preserves content indefinitely and prevents deletion, which contradicts the requirement to automatically delete emails after 7 years.

Answer

Use Messaging Records Management (MRM) retention policies.

Answer

Configure a sensitivity label for the emails.

Answer

Place the mailbox on litigation hold.

Question 7

You are the Microsoft 365 administrator for Contoso, a company with 5,000 users. The company recently acquired a subsidiary, Fabrikam, which has 2,000 users currently using on-premises Exchange and Active Directory. The goal is to migrate Fabrikam users to Microsoft 365 and merge their identities into the existing Contoso tenant. The migration must minimize user password changes and preserve existing email addresses. You need to plan the identity migration. What should you do first?

Accepted Answer

Create a new Active Directory forest for Fabrikam and configure Azure AD Connect to sync to the existing Contoso tenant.. Creating a new Active Directory forest for Fabrikam and configuring Microsoft Entra Connect to sync to the existing Contoso tenant allows you to merge identities without disrupting the existing Contoso directory. This approach preserves Fabrikam users' existing email addresses (via SMTP matching or custom domain verification) and minimizes password changes by syncing their on-premises passwords to Microsoft Entra ID. It also avoids the complexity of extending the existing Contoso AD forest, which could cause namespace conflicts or schema issues.

Answer

Create a new Microsoft 365 tenant for Fabrikam and then perform a cross-tenant migration.

Answer

Extend the existing Contoso Active Directory to include Fabrikam objects and use a single Azure AD Connect instance.

Answer

Export Fabrikam users to a CSV and use PowerShell to bulk create users in Microsoft Entra ID.

Question 8

Your organization is planning to deploy Microsoft 365 Copilot for all users. The compliance team has concerns about data leakage through Copilot responses. Specifically, they want to ensure that Copilot does not generate responses based on highly confidential data labeled with the 'Highly Confidential' sensitivity label. Additionally, users must be able to use Copilot for general productivity tasks. You need to configure Microsoft 365 Copilot to meet these requirements. The solution must use Microsoft Purview Information Protection. What should you do?

Accepted Answer

Configure sensitivity labels to apply encryption to 'Highly Confidential' data and use Microsoft Purview DLP to prevent Copilot from using that content.. It uses Microsoft Purview Information Protection to apply encryption via sensitivity labels to 'Highly Confidential' data, and then leverages Microsoft Purview Data Loss Prevention (DLP) policies to block Copilot from accessing or generating responses based on that encrypted content. This ensures that Copilot cannot use the protected data as a source for its responses, while still allowing users to use Copilot for general productivity tasks with non-protected data.

Answer

Remove the 'Highly Confidential' label from data that needs to be accessed by Copilot.

Answer

Block Copilot for all users who have access to 'Highly Confidential' data.

Answer

Create a conditional access policy to require multi-factor authentication for Copilot access.

Question 9

You are the Microsoft 365 administrator for a company that uses Microsoft Entra ID P1. The security team requires that when users sign in from an unmanaged device, they must be prompted to register for multi-factor authentication (MFA) before they can access Microsoft 365 services. You create a conditional access policy that targets all users and all cloud apps, and set the grant control to require MFA. However, testing shows that users on unmanaged devices are not prompted for MFA. What should you do to meet the requirement?

Accepted Answer

Under Conditions, set Device state to Include: All device states, and then under Access controls, select Require multi-factor authentication. Then, exclude devices that are compliant or hybrid Azure AD joined.. To require MFA only for unmanaged devices, the conditional access policy must include all device states and then exclude devices that are compliant or hybrid Microsoft Entra ID joined. This way, managed devices are exempt, and only unmanaged devices trigger the MFA requirement. The policy targets users and cloud apps, with conditions and access controls working together to enforce the desired behavior.

Answer

Add a condition to the policy that includes any device platform and set the client apps to include browser and mobile apps and desktop clients.

Answer

Configure the policy to target all users and all cloud apps, and under Conditions, set Device state to Include: All device states, and then under Access controls, select Require multi-factor authentication.

Answer

Create a dynamic device group for unmanaged devices and assign the conditional access policy to that group.

Question 10

You are the Microsoft 365 administrator for a company that uses Microsoft Entra ID P1. The security team wants to ensure that when users sign in from an unmanaged device, they are required to use multi-factor authentication (MFA) but are not blocked from accessing Microsoft 365 services. They also want to allow users on managed devices to sign in without MFA. You need to configure a Conditional Access policy. What should you do?

Accepted Answer

Create a Conditional Access policy that targets all users and all cloud apps. Set the device state condition to 'Configure: Yes' and 'Include: All device states'. Exclude 'Device state: Hybrid Azure AD joined' and 'Device state: Compliant'. Grant access with 'Require multi-factor authentication'. Enable the policy.. The correct configuration uses a single Conditional Access policy that targets all users and cloud apps, includes all device states, but excludes Hybrid Microsoft Entra ID joined and Compliant devices. This ensures that only unmanaged devices are required to use MFA, while managed devices are exempt. This aligns with the security team's requirement to require MFA for unmanaged devices without blocking access and to allow managed devices without MFA. The device state condition must be configured to evaluate device states.

Answer

Create a Conditional Access policy that targets all users and all cloud apps. Set the device state condition to 'Include: All device states' and 'Exclude: Hybrid Azure AD joined and Compliant'. Grant access with 'Require multi-factor authentication'. Enable the policy.

Answer

Create a Conditional Access policy that targets all users and all cloud apps. Set the device state condition to 'Include: All device states' and grant access with 'Require multi-factor authentication'. Enable the policy.

Answer

Create a Conditional Access policy that targets all users and all cloud apps. Set the device state condition to 'Include: All device states' and grant access with 'Require multi-factor authentication'. Then create a second policy that targets all users and all cloud apps, excludes Hybrid Azure AD joined and Compliant devices, and blocks access. Enable both policies.

Question 11

You are the Microsoft 365 administrator for a company that has a Microsoft 365 E3 subscription. The company wants to ensure that all users can access Microsoft 365 services even if the on-premises Active Directory becomes unavailable. The company currently uses password hash synchronization with Microsoft Entra Connect. What should you do to meet this requirement?

Accepted Answer

Enable password hash synchronization and ensure that users are synchronized to Microsoft Entra ID.. Password hash synchronization is the only authentication method that allows users to authenticate entirely in the cloud. It synchronizes a hash of the user's password to Microsoft Entra ID, so even if on-premises Active Directory is unavailable, users can sign in to Microsoft 365 services. This provides the required resilience.

Answer

Configure Microsoft Entra Connect to use pass-through authentication with a backup authentication agent.

Answer

Configure Microsoft Entra Connect to use seamless single sign-on with password hash synchronization.

Answer

Deploy Active Directory Federation Services (AD FS) with a farm of at least two servers.

Question 12

You are the Microsoft 365 administrator for a company that uses Microsoft 365 E5. The company has a hybrid deployment with Exchange Server 2019 on-premises. You need to ensure that when an on-premises mailbox is moved to Exchange Online, the user's Outlook profile automatically reconfigures to connect to the cloud mailbox without any user intervention. What should you configure?

Accepted Answer

Enable the Microsoft Exchange Hybrid Configuration Wizard to configure the hybrid deployment and ensure that the Autodiscover and MRS Proxy endpoints are properly set.. The Hybrid Configuration Wizard sets up the required components for a hybrid deployment, including the MRS Proxy and Autodiscover. It also enables the automatic Outlook profile update, which reconfigures Outlook to connect to Exchange Online when a mailbox is moved. This provides a seamless experience for users.

Answer

Configure the Autodiscover service to return the correct Exchange Online endpoint for moved mailboxes.

Answer

Enable MAPI over HTTP on the on-premises Exchange servers.

Answer

Deploy the Microsoft 365 Apps for enterprise and configure the Outlook profile to use the new authentication.

Question 13

You are the Microsoft 365 administrator for a company that uses Microsoft 365 E5. The company has a requirement that all email messages sent to external recipients must be encrypted if they contain sensitive information. You need to implement a solution that automatically encrypts messages based on sensitive information types. What should you do?

Accepted Answer

Create a sensitivity label that applies encryption and configure auto-labeling for Exchange Online to detect sensitive information types.. Sensitivity labels with auto-labeling for Exchange Online can detect sensitive information types and automatically apply encryption to emails. This ensures that messages containing sensitive data are encrypted when sent externally. Auto-labeling policies evaluate email content and apply the label, which enforces encryption. This is the most direct and integrated method within Microsoft Purview to meet the encryption requirement.

Answer

Configure a transport rule to apply rights management protection using Azure Information Protection when a sensitive information type is found.

Answer

Create a data loss prevention (DLP) policy in Microsoft Purview that detects sensitive information types and applies the Encrypt action.

Answer

Create a mail flow rule in Exchange Online that applies Office 365 Message Encryption (OME) when a sensitive information type is detected.

Question 14

You are the Microsoft 365 administrator for a company that uses Microsoft 365 E5. The company wants to ensure that all users are protected against phishing attacks that use malicious links in email messages. You need to configure Microsoft Defender for Office 365 to provide this protection. Which two actions should you perform? (Choose two.)

Accepted Answer

Configure a Safe Links policy to track user clicks and block malicious URLs.. To protect against phishing attacks that use malicious links, you must implement Safe Links in Microsoft Defender for Office 365. Creating and applying a Safe Links policy to all users ensures that URLs are scanned and blocked if malicious. Configuring the policy to track user clicks and block malicious URLs enhances protection and provides visibility. These two actions together provide the required link protection.

Answer

Enable Zero-hour Auto Purge (ZAP) for phishing messages.

Answer

Create a Safe Attachments policy and apply it to all users.

Answer

Configure an anti-phishing policy to enable impersonation protection for all users.

Question 15

Your organization's Microsoft 365 tenant has the default role groups unchanged. A new security analyst must be able to view all sign-in logs and audit logs across Exchange Online, SharePoint Online, and Microsoft Entra ID, but must not be able to modify any configuration or reset user passwords. You need to assign the least-privileged built-in role. What should you do?

Accepted Answer

Assign the Security Reader role in the Microsoft 365 Defender portal.. Security Reader is purpose-built for personnel who must inspect security telemetry without changing anything. It surfaces sign-in and audit information through Microsoft 365 Defender while withholding configuration and password management capabilities. Global Reader is broader than necessary, Security Administrator includes write actions, and Reports Reader lacks raw log access, so only the Security Reader assignment satisfies least privilege for this monitoring-only role.

Answer

Assign the Reports Reader role in the Microsoft 365 admin center.

Answer

Assign the Global Reader role in the Microsoft Entra admin center.

Answer

Assign the Security Administrator role in the Microsoft 365 Defender portal.