MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 6 — 15 Questions

Question 1

An administrator runs the PowerShell command shown in the exhibit. What is the immediate effect on the user?

Accepted Answer

The user is blocked from signing in immediately.. The PowerShell command `Set-MgUser -UserId user@domain.com -BlockCredential $true` immediately blocks the user from signing in by setting the `BlockCredential` property to true. This prevents any new authentication attempts, effectively locking the account without changing the password or deleting the user.

Answer

The user is disabled after 90 days of inactivity.

Answer

The user is deleted after 90 days of inactivity.

Answer

The user's password is reset.

Question 2

Your organization has a Microsoft 365 tenant with 5,000 users. You need to plan for tenant migration from an on-premises Exchange environment. You have a limited maintenance window and want to minimize user impact. Which approach should you recommend?

Accepted Answer

Use a hybrid configuration.. A hybrid configuration allows you to migrate mailboxes in batches over an extended period, minimizing user impact and working within limited maintenance windows. Staged migration supports only up to 2,000 mailboxes total, not per batch, so it cannot handle 5,000 users. Cutover migration requires migrating all mailboxes at once and supports up to 5,000, but it has high user impact. IMAP migration does not migrate calendar/contacts and is not ideal for a full tenant migration.

Answer

Perform a staged migration.

Answer

Perform an IMAP migration.

Answer

Perform a cutover migration.

Question 3

You are a Microsoft 365 administrator. Users report that they cannot create Microsoft Teams meetings using the Teams desktop client. They receive an error: 'Meeting creation is disabled by your IT administrator.' You need to enable meeting creation. You check the Teams admin center and find that meeting policies are set to 'Off' for 'Allow private meeting scheduling'. However, after changing it to 'On', users still get the error. What is the most likely cause?

Accepted Answer

The user's mailbox is still on-premises and not migrated to Exchange Online.. The error persists because the user's mailbox is still on-premises and not migrated to Exchange Online. Microsoft Teams relies on Exchange Online for scheduling features, including private meeting creation. Even with the meeting policy set to 'On', if the mailbox is on-premises, the Teams client cannot communicate with Exchange Online to create the meeting, resulting in the error.

Answer

The user does not have an OAuth 2.0 token.

Answer

The global meeting policy is overriding the user-level policy.

Answer

The user does not have a Microsoft Teams license assigned.

Question 4

An administrator creates a Conditional Access policy as shown in the exhibit. A user reports that they can still access Exchange Online using Outlook (modern authentication). Why does the policy not block the user?

Accepted Answer

The client app type for modern authentication is not specified in the policy.. The explanation incorrectly states that 'Modern authentication clients' must be explicitly enabled. In Azure AD Conditional Access, the 'Client apps' condition includes 'Browser', 'Mobile apps and desktop clients', 'Exchange ActiveSync clients', and 'Other clients'. Modern authentication (OAuth 2.0) is part of 'Mobile apps and desktop clients'. If that is selected, the policy would apply. The policy might not block due to lack of user assignment (A), grant control set to allow/MFA (B), or other misconfiguration — but not because a non-existent toggle is missing.

Answer

The policy is not assigned to any users or groups.

Answer

The grant control is set to 'Require multi-factor authentication' instead of 'Block'.

Answer

Exchange ActiveSync is not included in the policy.

Question 5

Your organization needs to create a custom domain in Microsoft 365. You have added the domain 'contoso.com' to the tenant. What is the next step to verify domain ownership?

Accepted Answer

Add a TXT record to the public DNS zone.. After adding a custom domain to a Microsoft 365 tenant, the next mandatory step is to prove ownership of the domain by adding a specific TXT record provided by Microsoft to the domain's public DNS zone. Microsoft queries this TXT record to verify that you control the domain before allowing you to use it for services like email or user accounts. This verification step is required by Microsoft's domain onboarding process and must succeed before any other configuration can proceed.

Answer

Create user accounts with the custom domain.

Answer

Configure the email exchange (MX) record.

Answer

Assign licenses to users with the custom domain.

Question 6

Your organization is planning to migrate from on-premises Active Directory to Microsoft Entra ID using Azure AD Connect. You need to ensure that password synchronization is enabled. Which TWO components are required for password synchronization to work?

Accepted Answer

Azure AD Connect with password hash synchronization selected.. Azure AD Connect with password hash synchronization (PHS) selected is the component that hashes the on-premises Active Directory password and synchronizes it to Microsoft Entra ID. Option E is correct because the Microsoft Entra ID service must process the incoming password hashes and store them in the cloud directory, enabling authentication against Entra ID. Without both the local sync engine (Azure AD Connect) and the cloud-side service, password synchronization cannot function.

Answer

Active Directory Federation Services (AD FS).

Answer

Password Writeback enabled.

Answer

Microsoft Identity Manager (MIM).

Question 7

Your organization uses Microsoft Purview to enforce data loss prevention (DLP) policies. You need to block users from sharing credit card numbers via email. Which THREE components are required to implement this policy?

Accepted Answer

The built-in 'Credit Card Number' sensitive info type.. To implement a DLP policy that blocks sharing credit card numbers via email in Microsoft Purview, three components are required: (A) The built-in 'Credit Card Number' sensitive info type detects credit card patterns using regex and checksums. (B) A sensitivity label identifies and classifies credit card information, enabling consistent protection and audit. (E) A DLP policy configured in the Microsoft Purview compliance portal ties the detection and action together. While sensitivity labels are not strictly required for basic DLP detection, they are necessary in this context to apply the block action and ensure policy coverage across the organization.

Answer

Microsoft Defender for Cloud Apps.

Answer

Microsoft Entra ID P2 licenses.

Question 8

Your organization is deploying Microsoft 365 Copilot. You need to ensure that data security is maintained. Which THREE actions should you take?

Accepted Answer

Enable audit logging in Microsoft 365.. Enabling audit logging in Microsoft 365 is essential for tracking user interactions with Microsoft 365 Copilot, including prompts, responses, and data access events. This provides a forensic trail to detect unauthorized data exposure or misuse, which is a foundational requirement for maintaining data security in AI-powered workloads.

Answer

Disable Microsoft 365 Copilot for all users.

Answer

Block all external sharing for SharePoint and OneDrive.

Question 9

A Global Administrator signs in to the Microsoft 365 admin center but is not prompted for MFA. The policy in the exhibit is the only Conditional Access policy. What is the most likely reason?

Accepted Answer

The administrator is connecting from a trusted IP address that is excluded from MFA.. The policy includes all cloud apps and the Global Administrator role, and it is enabled. However, the policy allows exclusion of trusted IP addresses. If the Global Administrator connects from a trusted IP (e.g., the corporate office), MFA is not required. Option A is incorrect because the Microsoft 365 admin center is included via 'All cloud apps'. Option C is incorrect because the Global Administrator role is included in the policy. Option D is incorrect because the policy is enabled, not in report-only mode.

Answer

The Microsoft 365 admin center is not included in the policy.

Answer

The policy does not include the Global Administrator role.

Answer

The policy is in 'report-only' mode.

Question 10

Your organization has a hybrid identity setup with Azure AD Connect. You need to ensure that users can reset their passwords from the cloud and have the changes synchronized back to on-premises Active Directory. Which feature must you enable?

Accepted Answer

Password writeback.. Password writeback is the Azure AD Connect feature that enables password changes performed in the cloud (e.g., via Azure AD SSPR) to be written back to on-premises Active Directory. This ensures the on-premises password stays synchronized with the cloud, which is required for hybrid identity scenarios where users reset passwords from the cloud.

Answer

Seamless single sign-on.

Answer

Pass-through authentication.

Answer

Password hash synchronization.

Question 11

Your organization wants to use Microsoft Defender for Office 365 to protect against malicious links and attachments in email. Which Defender plan is required?

Accepted Answer

Microsoft Defender for Office 365 Plan 1.. Microsoft Defender for Office 365 Plan 1 includes Safe Links and Safe Attachments, which are the specific features required to protect against malicious links and attachments in email. These features scan URLs and attachments in real time to block malicious content before it reaches users.

Answer

Exchange Online Protection.

Answer

Microsoft Defender for Endpoint.

Answer

Microsoft Defender for Office 365 Plan 2.

Question 12

Your organization has a Microsoft 365 tenant configured with a custom domain contoso.com. Users report they cannot receive email from external senders; internal email works fine. You verify the MX record for contoso.com points to the Microsoft 365 mail exchanger. What should you check next?

Accepted Answer

Verify that an SPF TXT record exists for contoso.com.. The most common cause of external email delivery failure after MX record configuration is a missing or incorrect SPF record. SPF is required to prevent spoofing and ensure delivery. Option B (Sender Policy Framework record) is correct. Option A is wrong because the MX record is already verified. Option C is wrong because DNS propagation typically completes within minutes to hours; waiting longer is not a diagnostic step. Option D is wrong because Exchange admin center settings do not affect inbound mail flow at the DNS level.

Answer

Check the Exchange admin center for connector configuration.

Answer

Wait 48 hours for DNS propagation.

Answer

Verify that the MX record has a priority of 0.

Question 13

Your organization is deploying Microsoft 365 for a multinational company. You need to ensure users in different regions authenticate against the nearest Microsoft Entra ID endpoint for performance. What should you configure?

Accepted Answer

No additional configuration is required; Microsoft Entra ID automatically routes to the nearest endpoint.. Microsoft Entra ID (formerly Azure AD) uses a global anycast network to automatically route authentication requests to the nearest available endpoint based on DNS resolution and network latency. No additional configuration is required because Entra ID's infrastructure is designed to provide optimal performance globally without manual traffic management.

Answer

Add the appropriate regional subdomain (e.g., us.contoso.com) as a custom domain.

Answer

Create a conditional access policy to route authentication to the nearest region.

Answer

Configure a traffic manager profile in Azure to route authentication requests.

Question 14

Your Microsoft 365 tenant has been configured with Microsoft Entra ID Connect synchronization from on-premises Active Directory. Users are unable to log in to Microsoft 365 services. You check the synchronization status and see that the last sync was successful. What is the most likely cause?

Accepted Answer

The user principal name (UPN) suffix for users is not a verified domain in Microsoft Entra ID.. The most likely cause is that the UPN suffix for users is not a verified domain in Microsoft Entra ID. Even though password hash synchronization is enabled and the last sync was successful, if the UPN suffix (e.g., @contoso.local) does not match a custom domain verified in Entra ID, users cannot sign in because Entra ID cannot route authentication to the correct tenant. The sync process will complete without error, but login fails because the UPN is not recognized as a valid domain in the cloud.

Answer

The firewall is blocking authentication requests to Microsoft 365.

Answer

The on-premises Active Directory is not reachable from the sync server.

Answer

Password hash synchronization is disabled.

Question 15

Your organization uses Microsoft 365 Defender for Office 365. You need to ensure that phishing emails reported by users are automatically submitted for analysis in Microsoft Defender XDR. What should you configure?

Accepted Answer

Configure the User-reported messages settings in the Microsoft 365 Defender portal.. The User-reported messages settings in the Microsoft 365 Defender portal allow you to configure how user-reported phishing emails are handled. By enabling automatic submission to Microsoft for analysis, you ensure that reported messages are sent directly to the Microsoft security team for threat intelligence and policy tuning. This is the correct setting because it specifically controls the submission behavior for user-reported messages in Defender for Office 365.

Answer

Modify the anti-phishing policy to include user-reported submissions.

Answer

Use the Attack simulation training to collect user reports.

Answer

Enable Safe Attachments policy to automatically submit reported messages.