MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 6 — 15 Questions

Question 1

You are planning the initial deployment of a new Microsoft 365 tenant for Contoso Ltd. Which three of the following actions are required or recommended as part of the tenant provisioning and initial configuration process? (Choose three.)

Accepted Answer

Create the initial global administrator account with a strong, unique password and enable multi-factor authentication.. Registering and verifying a custom domain (e.g., contoso.com) via a DNS TXT record is a required step to use your own domain for email and user identities instead of the default onmicrosoft.com domain. Creating the initial global administrator account with a strong password and enabling multi-factor authentication (MFA) is a critical security best practice and is recommended by Microsoft to protect the highest-privileged role. Configuring tenant-wide service settings, such as external sharing for SharePoint and OneDrive, is recommended during initial setup to align with organizational security and collaboration policies before users begin working.

Answer

Configure the default tenant-level password expiration policy to 90 days using the Microsoft 365 admin center.

Answer

Assign Microsoft 365 licenses to all user accounts before creating the accounts.

Answer

Set up a secondary domain as the default email domain to avoid conflicts with the initial onmicrosoft.com domain.

Question 2

As a Microsoft 365 administrator, you need to manage tenant health and adoption effectively. Which three of the following tools or features should you use to monitor and improve your Microsoft 365 tenant's performance and user engagement? (Choose three.)

Accepted Answer

Microsoft 365 Adoption Score (formerly Productivity Score) to track user engagement with Microsoft 365 apps.. The Microsoft 365 admin center dashboard provides a centralized view of service health, message center posts, and usage reports, enabling administrators to monitor service availability, planned changes, and user activity. This is a core tool for maintaining tenant health and tracking adoption.

Answer

Microsoft Purview compliance portal to enforce data loss prevention policies.

Answer

Microsoft 365 network connectivity test tool to evaluate network performance for Microsoft 365 services.

Answer

Azure AD Identity Protection to detect sign-in risks and block compromised accounts.

Question 3

You are a Microsoft 365 Administrator for a multinational organization that is deploying a new Microsoft 365 tenant. The organization has strict compliance and security requirements. Which four of the following actions should you take to properly deploy and manage the tenant? Choose all that apply. (There are four correct answers.)

Accepted Answer

Configure password hash synchronization (PHS) from the on-premises Active Directory to Microsoft Entra ID to enable Hybrid Identity.. Configuring password hash synchronization (PHS) from on-premises Active Directory to Microsoft Entra ID is a foundational step for hybrid identity. It synchronizes user password hashes, enabling users to use the same credentials for cloud and on-premises resources, and is required for features like Identity Protection and leaked credential detection.

Answer

Use the Microsoft 365 admin center to directly edit and manage all user objects in the on-premises Active Directory to ensure synchronization consistency.

Answer

Disable multi-factor authentication (MFA) for all users during the initial deployment to simplify onboarding, and enable it after 30 days.

Question 4

Drag and drop the steps to deploy Microsoft Defender for Office 365 policies in the correct order.

Question 5

Drag and drop the steps to configure role-based access control (RBAC) in Microsoft 365 Defender in the correct order.

Question 6

Match each Microsoft 365 plan to its included services.

Question 7

Your organization plans to migrate from on-premises Exchange to Exchange Online. You need to ensure minimal disruption during the migration. Which approach should you recommend?

Accepted Answer

Deploy a hybrid configuration and migrate mailboxes in batches.. A hybrid migration allows you to gradually move mailboxes while maintaining coexistence, minimizing disruption. Option A is wrong because a cutover migration is disruptive and only suitable for small orgs. Option B is wrong because IMAP migration does not migrate calendar/contacts fully. Option D is wrong because a third-party tool is unnecessary for standard migrations.

Answer

Perform a cutover migration during a weekend.

Answer

Use IMAP migration to migrate all mailboxes in parallel.

Answer

Use a third-party migration tool for a one-time bulk migration.

Question 8

Your company recently deployed Microsoft 365 Copilot. Users report that Copilot occasionally generates responses based on sensitive internal documents that should not be shared broadly. What should you configure to restrict Copilot's access?

Accepted Answer

Apply sensitivity labels to the documents and configure label scopes to exclude Copilot.. Option C is correct because sensitivity labels can be configured with a label scope that excludes Copilot from accessing the labeled content. By applying a 'Confidential' sensitivity label with the 'Copilot' scope deselected, you instruct Microsoft 365 Copilot to ignore those documents during response generation, preventing it from surfacing sensitive internal information.

Answer

Create Data Loss Prevention (DLP) policies to block sharing.

Answer

Remove the sensitive documents from SharePoint Online.

Answer

Configure Microsoft Search to exclude the sensitive documents.

Question 9

A user reports they cannot access Microsoft Teams. They see a message: 'Your account is not enabled for Teams.' You verify the user has a valid Microsoft 365 E3 license assigned. What is the most likely cause?

Accepted Answer

The Teams service plan is disabled in the user's license.. The error 'Your account is not enabled for Teams' indicates that the Teams service plan is disabled within the user's assigned Microsoft 365 E3 license. Even with a valid license, each service plan (e.g., Teams, Exchange Online, SharePoint) can be individually toggled on or off via the Microsoft 365 admin center or PowerShell. Since the user has a valid license but cannot access Teams, the most likely cause is that the Teams service plan has been explicitly disabled.

Answer

The user does not have the correct Microsoft Entra ID role.

Answer

The user is not assigned a valid license.

Answer

The user is not a global administrator.

Question 10

Your organization uses Microsoft Entra ID. You want to enforce Multi-Factor Authentication (MFA) for all users. You have already configured Conditional Access policies. However, some users are still able to sign in without MFA. What should you check first?

Accepted Answer

Confirm that all users are included in the policy's user assignment.. Option C is correct because the most common reason a Conditional Access policy fails to enforce MFA is that not all users are included in the policy's user assignment. If the policy targets only a subset of users (e.g., a test group), users outside that scope will bypass MFA entirely. The first troubleshooting step is to verify that the policy's 'Users and groups' assignment includes 'All users' or the specific groups covering all users.

Answer

Ensure all users have registered for MFA.

Answer

Verify that the Conditional Access policy is enabled.

Answer

Check if there are any exclusions configured.

Question 11

Your company is deploying Microsoft Defender for Office 365. The security team wants to automatically remove messages identified as malware from all mailboxes after delivery. What should you configure?

Accepted Answer

Enable Zero-hour auto purge (ZAP) in the anti-malware policy.. Zero-hour auto purge (ZAP) is the correct feature because it automatically detects and removes messages that are identified as malware after they have already been delivered to a user's mailbox. By enabling ZAP in the anti-malware policy, the system retroactively moves malicious messages to the user's Junk Email folder or quarantines them, ensuring post-delivery protection without manual intervention.

Answer

Configure an anti-malware policy with a high-confidence verdict.

Answer

Set up a mailbox intelligence policy.

Answer

Create an anti-phishing policy to block spoofed senders.

Question 12

You need to ensure that guest users who are invited to your Microsoft Entra ID tenant can access resources without needing to accept an invitation. What should you configure?

Accepted Answer

Enable 'Email one-time passcode for guests' and set 'Allow invitations to be sent to any user' to Yes.. Option D is correct because enabling 'Email one-time passcode for guests' and setting 'Allow invitations to be sent to any user' to Yes allows guest users to redeem an invitation without needing to accept it interactively. This configuration leverages the email one-time passcode (OTP) authentication flow, which bypasses the need for the guest to click an acceptance link, enabling direct resource access after the OTP is verified.

Answer

Configure the 'External collaboration settings' to allow invitations to specific domains only.

Answer

Set the 'Guest invite settings' to 'Anyone in the organization can invite guest users'.

Answer

Set the 'Guest invite settings' to 'Only users assigned to specific admin roles can invite'.

Question 13

Your organization wants to use Microsoft Intune to manage devices. You need to ensure that only corporate-owned devices can enroll. What configuration should you use?

Accepted Answer

Configure enrollment restrictions to block personally owned devices.. Option B is correct because enrollment restrictions in Microsoft Intune allow you to block personally owned devices by setting the 'Allow personally owned devices' option to 'No' for the platform. This ensures that only corporate-owned devices, which are identified by their corporate enrollment token or IMEI/MEID numbers, can enroll. This is the direct and intended method to restrict enrollment to corporate-owned devices only.

Answer

Use a conditional access policy to require device compliance.

Answer

Set a compliance policy requiring devices to be marked as corporate.

Answer

Create a device type restriction for iOS and Android.

Question 14

Your company has a Microsoft 365 tenant with a custom domain (contoso.com). You need to verify domain ownership before enabling email routing. Which DNS record type should you add?

Accepted Answer

Add an MX record pointing to contoso-com.mail.protection.outlook.com.. Option C is correct because when you add a custom domain to Microsoft 365 and need to enable email routing, you must prove domain ownership and configure mail flow. The MX record with the value 'contoso-com.mail.protection.outlook.com' is the specific record that Microsoft 365 requires to route incoming email for your domain to Exchange Online. This record is added after domain ownership is verified (usually via a TXT record), but the question asks which record type enables email routing, which is the MX record.

Answer

Add a TXT record with the verification code.

Answer

Add a CNAME record pointing to autodiscover.outlook.com.

Answer

Add an SPF record for contoso.com.

Question 15

Your organization uses Microsoft Purview Information Protection. You need to ensure that when a user applies a sensitivity label to a document in SharePoint, the label is automatically applied to the document when it is downloaded. What should you configure?

Accepted Answer

Create an auto-labeling policy in Microsoft Purview.. Auto-labeling policies in Purview can apply labels based on conditions. Option C is correct. Option A is wrong because client-side labeling is manual. Option B is wrong because conditional access does not apply labels. Option D is wrong because DLP policies do not apply labels.

Answer

Use a Data Loss Prevention (DLP) policy to enforce labeling.

Answer

Create a Conditional Access policy requiring label application.

Answer

Configure a sensitivity label with client-side labeling.