MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 5 — 15 Questions

Question 1

You are designing a Microsoft 365 tenant for a multinational organization. You need to ensure compliance with data residency requirements. Which THREE actions should you take?

Accepted Answer

Set data location preferences in the Microsoft 365 admin center.. Setting data location preferences in the Microsoft 365 admin center (under Settings > Org Settings > Organization Information) allows you to specify the primary data residency region for your tenant. This ensures that core data at rest, such as Exchange Online mailboxes and SharePoint sites, is stored in the selected geographic location to meet compliance requirements.

Answer

Disable cross-region replication in Exchange Online.

Answer

Create data loss prevention policies for each region.

Question 2

Your organization needs to manage guest access to Microsoft Teams. Which TWO methods can you use to control guest access?

Accepted Answer

Enable guest access in the Teams admin center.. Enabling guest access in the Teams admin center is a required step to allow guest users to join Teams. Without this toggle enabled, guest access is blocked at the Teams level regardless of other settings. This setting works in conjunction with Microsoft Entra ID external collaboration settings to control guest access.

Answer

Use sensitivity labels to restrict guest access.

Answer

Configure SharePoint Online external sharing settings.

Answer

Set conditional access policies for guest users.

Question 3

Your organization is deploying Microsoft 365 and needs to ensure that all new users are automatically assigned a Microsoft 365 Business Basic license. You want to use a group-based licensing strategy with an Azure AD security group. What should you do first?

Accepted Answer

Create a new Azure AD security group and assign the license to the group.. Group-based licensing in Azure AD requires you to first create a security group (which can be cloud-only or synced) and then assign the Microsoft 365 Business Basic license directly to that group. Once the license is assigned to the group, all members automatically receive the license, including new users added to the group. This approach centralizes license management and ensures automatic assignment without manual intervention.

Answer

Configure directory synchronization and create the group in on-premises Active Directory.

Answer

Create a dynamic Azure AD group with a rule for user attributes and enable self-service group management.

Answer

Assign the license directly to each user via the Microsoft 365 admin center.

Question 4

You are a Microsoft 365 administrator. Users report that they cannot access Microsoft Teams. You check the Microsoft 365 admin center and see that the service health for Microsoft Teams shows a 'Service degradation' incident. What is the most appropriate initial action?

Accepted Answer

Review the incident details in the service health dashboard for an estimated resolution time and workaround.. The most appropriate initial action when a service degradation incident is already visible in the Microsoft 365 admin center is to review the incident details in the service health dashboard. This provides the estimated resolution time, current status, and any available workarounds published by Microsoft, allowing you to inform users and mitigate impact without immediately escalating or opening a support request.

Answer

Contact the Microsoft regional escalation engineer immediately.

Answer

Open a support request with Microsoft to report the outage.

Answer

Restart the Microsoft Teams service on all client machines.

Question 5

Your company is migrating from on-premises Exchange to Exchange Online. You have configured a hybrid deployment. During testing, you notice that free/busy information is not being shared between on-premises and cloud users. All other hybrid features work. What is the most likely cause?

Accepted Answer

The organization relationship between the on-premises and cloud tenants is missing or misconfigured.. The organization relationship defines the trust and sharing settings between on-premises Exchange and Exchange Online tenants, specifically for free/busy information. Since all other hybrid features (e.g., mail flow, mailbox moves) work, the issue is isolated to the organization relationship, which must be configured on both sides to enable cross-premises calendar availability queries.

Answer

Azure AD Connect has not been configured with the correct synchronization scope.

Answer

The on-premises firewall is blocking traffic to the Exchange Online endpoints.

Answer

OAuth authentication is not configured between on-premises and Exchange Online.

Question 6

You are a Microsoft 365 administrator. You need to allow external users to access a SharePoint Online site without requiring them to sign in. Which sharing setting should you enable?

Accepted Answer

Set the sharing option to 'Anyone' (Anonymous) for the site.. Setting the SharePoint Online site sharing option to 'Anyone' (Anonymous) allows external users to access the site without signing in. This creates an anonymous access link that bypasses authentication, meeting the requirement of no sign-in for external users.

Answer

Set the sharing option to 'Existing guests' and send an invitation.

Answer

Set the sharing option to 'Only people in your organization' and use a direct link.

Answer

Set the sharing option to 'New and existing guests' and require guest sign-in.

Question 7

Your company is using Microsoft 365 Business Premium. You want to ensure that all company-owned Windows 10 devices are automatically upgraded to Windows 11 when it becomes available through Windows Update. What should you configure?

Accepted Answer

Create a feature update policy for Windows 10 devices in Intune, targeting the Windows 11 version.. A feature update policy in Intune is specifically designed to upgrade Windows devices from one version to another, such as from Windows 10 to Windows 11. By targeting the Windows 11 version in this policy, you ensure that eligible Windows 10 devices automatically receive the upgrade when it becomes available via Windows Update. This is the correct mechanism for controlling OS version upgrades in a Microsoft 365 Business Premium environment.

Answer

Create a Windows 10 update ring policy in Intune that deploys quality updates.

Answer

Create a device compliance policy in Intune that requires Windows 11.

Answer

Configure a Windows 11 readiness assessment in Microsoft Intune.

Question 8

Your organization has a Microsoft 365 E5 tenant. You want to ensure that all users are automatically signed in to Microsoft 365 apps using single sign-on (SSO) when they are on the corporate network. You have Azure AD joined the devices. What additional configuration is required?

Accepted Answer

No additional configuration is required; Azure AD joined devices provide SSO automatically.. Azure AD joined devices are already registered with Azure AD and use the Primary Refresh Token (PRT) to enable seamless SSO for Microsoft 365 apps without any additional configuration. When a user signs into a Windows 10/11 device that is Azure AD joined, the PRT is obtained during the initial authentication and is automatically used for browser and app sign-ins on the corporate network. Therefore, no extra steps like enabling Seamless SSO or deploying certificates are needed.

Answer

Enable Azure AD Seamless Single Sign-On.

Answer

Configure Azure AD Application Proxy for each app.

Answer

Deploy a trusted certificate for the corporate network.

Question 9

Which TWO actions are required to enable Microsoft 365 Copilot for all users in your tenant?

Accepted Answer

Ensure users have a qualifying Microsoft 365 license (e.g., E3, E5, Business Standard).. Microsoft 365 Copilot requires users to have a qualifying base license such as Microsoft 365 E3, E5, or Business Standard. Without one of these base licenses, the Copilot add-on license cannot be assigned or function properly, as Copilot relies on the underlying Microsoft 365 services (e.g., Exchange Online, SharePoint, Teams) that these plans provide.

Answer

Run a PowerShell script to enable Copilot in the tenant.

Answer

Ensure the tenant is on a Microsoft 365 E5 plan.

Answer

Provision an Azure subscription for Copilot services.

Question 10

Which THREE conditions must be met for a tenant-to-tenant migration of SharePoint Online content?

Accepted Answer

The destination site collection or OneDrive must already exist in the target tenant.. SharePoint Online tenant-to-tenant migration requires the destination site collection or OneDrive to already exist in the target tenant. The migration process copies content into a pre-provisioned container; it does not create the site or OneDrive automatically. This ensures that the target structure is ready to receive the migrated data without requiring dynamic provisioning during the migration.

Answer

The source user performing the migration must be a global admin in the target tenant.

Answer

Both tenants must have at least one user with PowerShell access.

Question 11

Which TWO are valid methods for adding custom domains to Microsoft 365?

Accepted Answer

Using the New-MsolDomain PowerShell cmdlet.. The `New-MsolDomain` PowerShell cmdlet is a valid method for adding a custom domain to Microsoft 365. This cmdlet, part of the Azure Active Directory Module for Windows PowerShell, registers the domain in the tenant's directory, which is a prerequisite for verifying ownership and configuring services like Exchange Online or SharePoint Online.

Answer

Using the Exchange admin center (EAC).

Answer

Using the Azure AD B2C tenant configuration.

Answer

Using the Windows DNS Manager console.

Question 12

You are reviewing a conditional access policy in Microsoft Entra ID. The policy is intended to block legacy authentication. However, users are still able to connect using Exchange ActiveSync without modern authentication. What is the most likely reason?

Accepted Answer

The policy does not include the 'All' client apps condition; it only includes specific client app types.. Conditional Access policies that block legacy authentication must include the 'All' client apps condition to cover Exchange ActiveSync (EAS). If the policy only targets specific client app types (e.g., browser or mobile apps and desktop clients) but omits 'All', EAS traffic using legacy authentication bypasses the policy. EAS is a separate client app type that requires explicit inclusion via the 'All' option to enforce blocking.

Answer

The policy is not assigned to the affected users.

Answer

The grant control 'Block' is not supported for legacy authentication.

Answer

The policy is in report-only mode.

Question 13

You run the PowerShell command shown in the exhibit for a Microsoft 365 tenant. The output shows DisplayName as 'Contoso', DefaultDomainName as 'contoso.onmicrosoft.com', and InitialDomain as 'contoso.onmicrosoft.com'. What does this indicate about the tenant?

Accepted Answer

The tenant is using the initial .onmicrosoft.com domain as the default domain.. The output shows DefaultDomainName and InitialDomain both set to 'contoso.onmicrosoft.com', which means the tenant is using its initial Microsoft-provided domain as the default domain. The Get-MgDomain cmdlet retrieves domain objects, and the DefaultDomainName property indicates which domain is used by default for new users and services. Since no custom domain is set as default, the initial .onmicrosoft.com domain remains the default.

Answer

The command requires global admin privileges.

Answer

The tenant has not been verified.

Answer

The tenant has a custom domain set as the default.

Question 14

You are reviewing an ARM template that will be used to deploy a storage account for a Microsoft 365 migration project. The template includes 'supportsHttpsTrafficOnly': true. What is the primary benefit of this setting?

Accepted Answer

It enforces secure transfer (HTTPS) for all requests to the storage account.. Setting 'supportsHttpsTrafficOnly' to true enforces secure transfer by requiring all requests to the storage account to use HTTPS (TLS). This ensures data in transit is encrypted, protecting against man-in-the-middle attacks and eavesdropping. It is a critical security control for compliance with standards like PCI-DSS and HIPAA.

Answer

It reduces latency by enabling CDN integration.

Answer

It enables geo-redundant storage.

Answer

It minimizes storage costs by reducing bandwidth usage.

Question 15

Your organization uses Microsoft 365 E5 licenses for all users. You need to configure role-based access control (RBAC) so that helpdesk staff can reset passwords and manage licenses, but cannot modify user principal names (UPNs) or delete users. Which role assignment should you use?

Accepted Answer

Helpdesk Administrator. The Helpdesk Administrator role is correct because it grants the specific permissions needed to reset passwords and manage licenses, while explicitly preventing modifications to user principal names (UPNs) and user deletions. This role is designed for tier-1 support staff who require these capabilities without elevated user management rights.

Answer

License Administrator

Answer

Password Administrator

Answer

User Administrator