MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 6 — 15 Questions

Question 1

A Microsoft 365 tenant has Microsoft Entra Connect sync enabled. The security team wants to implement password protection to block weak passwords in the cloud and on-premises. They also want to ensure that users can reset their own passwords in the cloud. Which two actions should the administrator perform? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable self-service password reset (SSPR) in Microsoft Entra ID and scope it to all users.. The security team wants to block weak passwords in both cloud and on-premises environments, and enable cloud SSPR. Microsoft Entra Password Protection extends the banned password list to on-premises AD, and SSPR allows cloud password resets. These two actions directly satisfy the requirements. Password writeback is not required unless on-premises password changes are needed.

Answer

Configure password writeback in Microsoft Entra Connect.

Answer

Enable pass-through authentication in Microsoft Entra Connect.

Answer

Configure password hash synchronization in Microsoft Entra Connect.

Question 2

You are the Microsoft 365 administrator for a company that has a Microsoft 365 E5 tenant. A security audit reveals that several users have been assigned the Security Reader role at the tenant scope, but the company now requires that these users can only view security data for the devices in the 'Marketing' device group in Microsoft Intune. You need to implement the least privileged access. What should you do?

Accepted Answer

Assign the Security Reader role to the users at the 'Marketing' device group scope in Microsoft Intune.. Intune role-based access control allows assigning built-in or custom roles with scope groups, which can be device groups. Assigning the Security Reader role at the Marketing device group scope ensures the users can only view security data for those devices. This is the least privileged approach because it limits permissions to exactly the required devices without granting tenant-wide access.

Answer

Move the users to a new administrative unit in Microsoft Entra ID that contains only the Marketing device group.

Answer

Create a custom role in Microsoft Entra ID that includes only the permissions to read security data for the Marketing group.

Answer

Configure a conditional access policy that restricts the users to only access security data from devices in the Marketing group.

Question 3

A Microsoft 365 tenant has a default role group called 'Helpdesk Administrator'. A new helpdesk employee needs to reset passwords for users who are not administrators, but should not be able to modify licenses or delete users. Which role should be assigned?

Accepted Answer

Password Administrator. The Password Administrator role is specifically designed to allow resetting passwords for non-administrator users and managing password policies, without granting permissions to modify licenses or delete users. It is the least privileged role that meets the stated requirements. Other roles either grant excessive permissions or include unnecessary capabilities.

Answer

Global Administrator

Answer

User Administrator

Answer

Helpdesk Administrator

Question 4

Your organization's Microsoft 365 tenant has Microsoft Entra Connect Sync running on a single server. The identity team wants a second Entra Connect server in staging mode so they can validate configuration changes before they reach production. After installing Microsoft Entra Connect on the second server and enabling staging mode, which additional step is required for the staging server to receive and process synchronization changes?

Accepted Answer

Ensure the staging server can reach the Microsoft Entra ID endpoints and has outbound connectivity, then let the scheduler run automatically.. A Microsoft Entra Connect server in staging mode imports and synchronizes from on-premises directories but never exports to Microsoft Entra ID, allowing safe validation of pending changes. The only prerequisite for it to process those cycles is outbound connectivity to the Microsoft 365 and Entra ID endpoints. It does not need production credentials, an initial sync trigger, or the production scheduler to be paused.

Answer

Configure the Microsoft Entra Connect Sync service account on the staging server with the same credentials used by the production server.

Answer

Run Start-ADSyncSyncCycle -PolicyType Initial on the staging server to seed the metaverse.

Answer

Disable the production server's scheduler temporarily so the staging server can take over synchronization.

Question 5

You are the Microsoft 365 administrator for Contoso, Ltd. The company has a Microsoft 365 E5 tenant. A new security policy requires that all administrators use phishing-resistant authentication and that any authentication attempt from an unmanaged device be denied, even if the user has valid credentials. You must implement this with the least administrative effort. What should you do?

Accepted Answer

Create a Microsoft Entra Conditional Access policy that targets the Microsoft Admin Portals cloud app, requires an authentication strength of Phishing-resistant MFA, and uses a device filter to include only devices that are not compliant or not Microsoft Entra joined.. The requirement combines a specific authentication strength with a device-state restriction for administrative access. A Conditional Access policy scoped to the Microsoft Admin Portals cloud app applies directly to the Microsoft 365 admin centers, and phishing-resistant authentication strength enforces FIDO2 or Windows Hello for Business. Adding a device filter that includes only non-compliant and non-Entra-joined devices ensures unmanaged endpoints are denied.

Answer

Create a Microsoft Entra Conditional Access policy that targets the Office 365 cloud app and requires multi-factor authentication, then configure a named location for the corporate network.

Answer

Configure a Microsoft Entra authentication method policy that enables only FIDO2 security keys, and assign it to a group containing all administrators.

Answer

Create a Microsoft Entra Conditional Access policy that targets the Windows Azure Service Management API cloud app and requires the Authentication strength of Phishing-resistant MFA and a device filter that excludes compliant devices.

Question 6

You are the Microsoft 365 administrator for a company that uses Microsoft 365 E3 and Microsoft Entra ID P1. The company wants to implement self-service password reset (SSPR) for all users. You need to ensure that when users reset their passwords, they are required to use two methods for authentication. Which two actions should you perform? (Choose two.)

Accepted Answer

In the Microsoft Entra admin center, configure the Password reset policy to require two methods for reset.. To require two authentication methods for SSPR, you must configure the number of methods required for reset. This can be done in the Password reset policy in the Microsoft Entra admin center, which is the dedicated location for SSPR settings. Alternatively, the Authentication methods policy also includes a setting for the number of methods required for reset, but the Password reset policy is the primary place for SSPR configuration.

Answer

Assign the User Administrator role to all users who need to reset their passwords.

Answer

Enable password writeback in Microsoft Entra Connect.

Answer

Configure a conditional access policy that requires multi-factor authentication for all users.

Question 7

A Microsoft 365 tenant has a hybrid Exchange deployment. The administrator needs to ensure that when a user is deleted on-premises, their mailbox is retained in Exchange Online for 30 days before permanent deletion. Which action should the administrator take?

Accepted Answer

Modify the deleted mailbox retention period in the Exchange admin center to 30 days.. The deleted mailbox retention period in Exchange Online controls how long a soft-deleted mailbox is retained after the user object is deleted. This is configured in the Exchange admin center or via Set-OrganizationConfig. Setting it to 30 days meets the requirement. Item retention policies and tags do not affect mailbox lifecycle.

Answer

Configure a retention policy in Exchange Online that keeps deleted items for 30 days.

Answer

Set the mailbox retention period to 30 days using the Set-OrganizationConfig cmdlet.

Answer

Create a retention tag and assign it to the mailbox database.

Question 8

Your organization's Microsoft 365 tenant uses Microsoft Purview. Compliance officers must be able to search the unified audit log and place litigation holds on Exchange Online mailboxes without being able to modify retention policies or delete content. You need to assign built-in role groups in the Microsoft Purview compliance portal. Which two role groups should you assign? (Choose two.)

Accepted Answer

Audit Reader. The two capabilities required are unified audit log search and litigation hold placement on Exchange Online mailboxes. Audit Reader supplies read-only audit log visibility, and eDiscovery Manager supplies case-based search and hold authority. Records Management and Compliance Administrator both introduce retention configuration rights that the officers must not have, and Organization Management is far broader than the task requires.

Answer

Compliance Administrator

Answer

Organization Management

Answer

Records Management

Question 9

You are the Microsoft 365 administrator for a company that has a hybrid deployment with Microsoft Entra Connect. The company wants to ensure that when a user is deleted on-premises, their Microsoft 365 mailbox is retained for 30 days before being permanently deleted. You need to configure the appropriate setting. What should you do?

Accepted Answer

In Exchange Online, configure the mailbox retention period for deleted mailboxes to 30 days using PowerShell.. To control how long a deleted user's mailbox is retained in Exchange Online, you configure the mailbox retention period using the Set-OrganizationConfig cmdlet with the -MailboxRetentionPeriod parameter. This setting applies to all deleted mailboxes in the organization and can be set to 30 days to meet the requirement.

Answer

In Microsoft Entra Connect, configure the 'Soft delete' option to retain deleted users for 30 days.

Answer

In Exchange Online, create a retention policy that keeps the mailbox for 30 days after user deletion.

Answer

In the Microsoft 365 admin center, set the deleted user retention period to 30 days.

Question 10

You are the Microsoft 365 administrator for a company that has a Microsoft 365 E3 tenant. The company has a policy that all users must use multi-factor authentication (MFA) when accessing Microsoft 365 services. You need to ensure that MFA is enforced for all users, but you also want to allow users to remember MFA on trusted devices for 30 days. What should you do?

Accepted Answer

In the Microsoft Entra admin center, configure the per-user MFA settings for all users and enable the option to remember multi-factor authentication on trusted devices for 30 days.. The per-user MFA settings in the Microsoft Entra admin center include the 'Remember multi-factor authentication on trusted devices' option, which can be set to a number of days. Enabling this for all users enforces MFA and allows them to skip MFA on trusted devices for 30 days. While Conditional Access is the recommended method for MFA, it does not provide this specific remember MFA duration feature.

Answer

Configure a conditional access policy that requires MFA for all users and all cloud apps, and set the 'Remember multi-factor authentication on trusted devices' option to 30 days.

Answer

Enable security defaults in the Microsoft Entra admin center and configure the option to remember MFA for 30 days.

Answer

Configure a conditional access policy that requires MFA for all users and set the sign-in frequency to 30 days.

Question 11

You administer a Microsoft 365 tenant that uses Microsoft Entra Connect cloud sync to synchronize users from an on-premises Active Directory Domain Services domain. You must ensure that when an on-premises user account is disabled, the corresponding Microsoft Entra ID user is blocked from signing in within 30 minutes, without deleting the cloud user or removing the license. What should you configure?

Accepted Answer

Configure a Microsoft Entra Connect cloud sync attribute mapping that maps the on-premises userAccountControl value to the cloud accountEnabled attribute.. The disabled state in Active Directory is represented in the userAccountControl attribute, and Microsoft Entra Connect cloud sync controls which attributes reach Microsoft Entra ID through its attribute mappings. Mapping userAccountControl to accountEnabled makes the cloud account reflect the on-premises disabled flag. Cloud sync's two-minute synchronization cycle then blocks sign-in quickly while preserving the user object and its license.

Answer

Enable soft match on the synchronization rule and set the cloud user's accountEnabled attribute to false in the metaverse.

Answer

Create a dynamic membership group that contains disabled on-premises users and assign a Conditional Access policy that blocks sign-in for that group.

Answer

Set the on-premises user account to expire and configure Microsoft Entra Connect cloud sync to synchronize the accountExpires attribute to the cloud accountEnabled attribute.

Question 12

You are the Microsoft 365 administrator for a company that has a Microsoft 365 E5 tenant. The company uses Microsoft Defender for Office 365. You need to configure a policy that will quarantine any email message that contains a specific set of sensitive information types and is sent to an external recipient. The policy must also allow users to report false positives. What should you do?

Accepted Answer

Create a data loss prevention (DLP) policy in Microsoft Purview that uses the sensitive information types and sets the action to quarantine the message, and enable user notifications for false positives.. A DLP policy in Microsoft Purview is the correct solution because it can detect sensitive information types and take actions such as quarantining the message. It also supports user notifications that allow users to report false positives. DLP policies are designed for data loss prevention and can be scoped to external recipients, making them ideal for this scenario.

Answer

Create a mail flow rule in Exchange Online that blocks messages containing the sensitive information types and sends a non-delivery report to the sender.

Answer

Create a Microsoft Defender for Office 365 safe attachments policy that quarantines messages with sensitive information types.

Answer

Create a Microsoft Defender for Office 365 anti-phishing policy that quarantines messages containing sensitive information types.

Question 13

An administrator is onboarding a new custom domain for email in a Microsoft 365 tenant. Which step should be performed first?

Accepted Answer

Add the domain in the Microsoft 365 admin center. Before you can use a custom domain for email or any other service in Microsoft 365, you must first add the domain to the tenant in the Microsoft 365 admin center. This creates the domain object in Microsoft Entra ID and initiates the verification process. Only after the domain is added can you proceed to verify ownership and configure DNS records.

Answer

Verify domain ownership by adding a TXT record

Answer

Configure DNS records for Microsoft services

Answer

Set the domain as the primary email domain

Question 14

A company wants to prevent their Microsoft 365 tenant from allowing external users to be invited by default. Only specific administrators should be able to invite guests. Which setting should be changed?

Accepted Answer

External Identities – External collaboration settings. The correct setting is under External Identities – External collaboration settings, specifically the 'Guest invite settings' option. By default, this is set to 'Anyone in the organization can invite guest users including guests and non-admins'. Changing it to 'Only users assigned to specific admin roles can invite guest users' restricts guest invitations to designated administrators, meeting the requirement to prevent default external user invitations.

Answer

Conditional Access policy to block external users

Answer

Tenant restrictions

Answer

B2B direct connect

Question 15

A company is planning to migrate from on-premises Exchange to Exchange Online and needs to ensure that mail flow can coexist between the two environments during the transition. Which tool should the administrator use to configure this hybrid deployment?

Accepted Answer

Exchange Hybrid Configuration Wizard. The Exchange Hybrid Configuration Wizard (HCW) is the correct tool because it automates the configuration of coexistence features between on-premises Exchange and Exchange Online, including mail flow routing, free/busy sharing, and OAuth authentication. It generates the necessary connectors and settings to support a hybrid deployment, ensuring seamless mail flow during migration.

Answer

Azure AD Connect

Answer

Microsoft 365 Admin Center

Answer

Exchange Admin Center