MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 7 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only compliant devices can access Microsoft 365 resources. What should you configure?

Accepted Answer

Create a conditional access policy in Microsoft Entra ID requiring compliant devices.. Conditional Access policies in Microsoft Entra ID (formerly Azure AD) are the mechanism that enforces access controls based on signals such as device compliance. By creating a policy that requires compliant devices, you ensure that only devices meeting your compliance standards can access Microsoft 365 resources. This works in conjunction with Intune compliance policies, but the enforcement point is the Conditional Access policy.

Answer

Configure an app protection policy in Intune.

Answer

Create a device compliance policy in Intune.

Answer

Configure a Windows Hello for Business policy in Intune.

Question 2

You are configuring Microsoft Entra ID for a new organization. You need to ensure that users can self-service reset their passwords. Which licensing is required?

Accepted Answer

Microsoft Entra ID P1. Microsoft Entra ID P1 is required for Self-Service Password Reset (SSPR) when you need capabilities like password writeback for on-premises synchronization or more granular control through conditional access. While Microsoft Entra ID Free does provide basic SSPR for cloud-only users without writeback, the question typically implies a scenario requiring the advanced features available in the P1 tier, such as group-based licensing and conditional access policies that underpin a comprehensive SSPR deployment. Microsoft Entra ID P2 also includes SSPR but is not necessary, as the P1 tier provides the required functionality.

Answer

Microsoft Entra ID Free

Answer

Microsoft Entra ID P2

Answer

Microsoft 365 Business Basic

Question 3

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP) policies to protect sensitive data in Microsoft Teams. You need to ensure that DLP policies apply to both chat and channel messages. What should you configure?

Accepted Answer

Create a single DLP policy with the Teams location selected.. Microsoft Purview DLP policies can be configured to include the Teams location, which automatically covers both chat and channel messages. When you select the Teams location in a single DLP policy, it applies to all Teams communications, including 1:1 chats, group chats, and channel conversations, without needing separate policies.

Answer

Configure a DLP policy for Exchange Online to cover Teams messages.

Answer

Assign a sensitivity label to the Teams with a DLP policy attached.

Answer

Create two separate DLP policies: one for chat and one for channels.

Question 4

Which TWO actions are required to configure a custom domain for your Microsoft 365 tenant?

Accepted Answer

Add the domain name in the Microsoft 365 admin center.. Adding the custom domain name in the Microsoft 365 admin center is the first step to register the domain with the tenant. Option E is correct because Microsoft requires you to prove ownership of the domain by adding a specific TXT record (or sometimes a CNAME or MX record) to the public DNS zone; this verification step ensures only the domain owner can configure it for the tenant.

Answer

Add an SPF TXT record in the public DNS zone.

Answer

Add a CNAME record for autodiscover.

Answer

Add an MX record in the public DNS zone.

Question 5

Which THREE factors are considered when Microsoft Entra ID evaluates a conditional access policy?

Accepted Answer

User or group membership. Microsoft Entra ID evaluates conditional access policies based on signals from the user, device, and location. User or group membership (Option A) is a primary signal because policies are typically assigned to specific users or groups to control access. Location (Option D) is evaluated using IP ranges or country codes to enforce restrictions like blocking access from untrusted networks. Device platform (Option E) allows policies to target specific operating systems (e.g., Windows, iOS) to enforce compliance requirements like requiring Intune enrollment.

Answer

Mailbox size

Answer

User's department attribute in Microsoft Entra ID

Question 6

Which TWO are valid methods to add users to a Microsoft 365 tenant?

Accepted Answer

Add users individually in the Microsoft 365 admin center.. The Microsoft 365 admin center provides a native web interface to add users individually, which is the most straightforward method for small-scale user provisioning. Option E is correct because synchronizing users from on-premises Active Directory using Microsoft Entra ID Connect (formerly Azure AD Connect) is the standard hybrid identity method for large-scale user management, ensuring directory objects are replicated to Azure AD.

Answer

Create users by adding a DNS record.

Answer

Add users in the Azure portal.

Answer

Create users in the Exchange admin center.

Question 7

The exhibit shows a DLP policy configuration. A user reports that they cannot share a document containing a credit card number from OneDrive for Business. However, the document was shared successfully last week. What is the most likely reason for the change?

Accepted Answer

The DLP policy was recently deployed or updated.. The most likely reason is that the DLP policy was recently deployed or updated. DLP policies in Microsoft 365 are evaluated in near real-time, and a newly deployed or modified policy will immediately enforce its rules on content sharing. Since the document was shared successfully last week, the policy change is the most plausible cause for the sudden block.

Answer

The DLP policy requires administrator override for sharing.

Answer

The DLP policy is applied only to SharePoint Online, not OneDrive.

Answer

The DLP policy does not include Microsoft Teams.

Question 8

The exhibit shows the output of a PowerShell command for a user. The user reports that they cannot access Microsoft Teams, although they have an E3 license (ENTERPRISEPACK). What is the most likely cause?

Accepted Answer

The Teams service plan is disabled in the user's license.. The PowerShell output shows the user has an E3 license (ENTERPRISEPACK) assigned, but the Teams service plan is disabled. Even with an active E3 license, if the Teams service plan is explicitly turned off in the license assignment, the user cannot access Microsoft Teams. This is a common configuration where an admin disables specific service plans to control feature access.

Answer

The user's license is suspended.

Answer

The user's license has expired.

Answer

The user does not have a license assigned.

Question 9

A company has recently acquired a smaller organization and needs to consolidate both Microsoft 365 tenants. They want to minimize user disruption and retain existing email addresses. Which approach should they use?

Accepted Answer

Perform a cross-tenant mailbox migration. Cross-tenant mailbox migration allows you to move mailboxes between two Microsoft 365 tenants while preserving the users' existing email addresses and minimizing disruption. This approach uses the Microsoft 365 native migration capabilities, specifically the cross-tenant mailbox migration feature, which supports moving mailboxes with their primary SMTP addresses and associated data without requiring on-premises Exchange Server.

Answer

Configure a hybrid deployment with Exchange Server

Answer

Delete all users from the acquired tenant and recreate them in the parent tenant

Answer

Set up a federation trust between the tenants

Question 10

You are a Microsoft 365 administrator for a multinational company. The security team reports that a large number of failed sign-in attempts are originating from unexpected IP ranges. The company uses Microsoft Entra ID for identity. What should you configure to automatically block these malicious sign-ins?

Accepted Answer

Create a Conditional Access policy to block access from those IP ranges. A Conditional Access policy can explicitly block sign-ins from specific IP ranges. By creating a policy that targets all users or specific users and includes a condition for the named location (the unexpected IP ranges), you can automatically deny authentication requests from those addresses at the Entra ID level, effectively blocking malicious sign-ins before they reach any application.

Answer

Enable Security defaults in the tenant

Answer

Configure Identity Protection user risk policy to block high-risk users

Answer

Enable Azure AD Multi-Factor Authentication for all users

Question 11

A user reports that they cannot access their Microsoft 365 mailbox via Outlook on the web. Other users can access their mailboxes. What is the most likely cause?

Accepted Answer

The user does not have an Exchange Online license assigned. The most likely cause is that the user does not have an Exchange Online license assigned. Without a valid license, the user's mailbox is not provisioned, and Outlook on the Web (OWA) cannot access it. Other users can access their mailboxes because they have licenses, ruling out a service-wide issue.

Answer

The user's password has expired

Answer

The Exchange Online service is experiencing an outage

Answer

The user's browser cache needs to be cleared

Question 12

Your company is planning to adopt Microsoft Copilot for Microsoft 365. The security team is concerned about data leakage. What must you implement to ensure that Copilot respects your organization's sensitivity labels and data classification?

Accepted Answer

Deploy Microsoft Purview Information Protection with sensitivity labels. Microsoft Purview Information Protection with sensitivity labels is the correct answer because Copilot for Microsoft 365 uses these labels to enforce data governance at the content level. When a sensitivity label is applied to a document or email, Copilot respects that label's encryption, marking, and access restrictions, preventing the model from generating responses that leak classified data. This is the foundational mechanism for ensuring Copilot adheres to your organization's data classification policies.

Answer

Use Microsoft Defender for Cloud Apps to control Copilot

Answer

Configure Data Loss Prevention (DLP) policies

Answer

Enable Customer Lockbox

Question 13

You need to delegate the ability to reset user passwords in Microsoft Entra ID to a helpdesk team. However, they should not be able to modify other user attributes. What role should you assign?

Accepted Answer

Helpdesk Administrator. The Helpdesk Administrator role is specifically designed to allow password resets and force password changes for non-administrator users and other helpdesk administrators, while explicitly preventing modifications to other user attributes like group membership or profile details. This role provides the least privilege necessary for the helpdesk team's task, aligning with the principle of role-based access control (RBAC) in Microsoft Entra ID.

Answer

User Administrator

Answer

Global Administrator

Answer

Password Administrator

Question 14

Your organization has a Microsoft 365 E5 subscription. You want to enable Microsoft Defender for Office 365 to protect against malicious attachments in email. Which policy should you configure?

Accepted Answer

Safe Attachments policy. Safe Attachments policy is the correct choice because Microsoft Defender for Office 365's Safe Attachments feature specifically protects against malicious attachments in email by detonating them in a virtual sandbox environment before delivery. This policy allows you to configure actions for detected malware, such as blocking, replacing, or dynamically delivering attachments based on threat analysis.

Answer

Anti-phishing policy

Answer

Anti-malware policy

Answer

Safe Links policy

Question 15

Your company is required to retain all emails sent to and from executives for 7 years due to regulatory compliance. You need to implement this with minimal administrative overhead. What should you use?

Accepted Answer

Create a Microsoft Purview retention policy for the executive mailboxes. Microsoft Purview retention policies and retention labels can automatically retain emails for a specified period. Option A is the correct choice as it centrally manages retention without additional infrastructure. Option B (Exchange journaling) exports emails to an external system, adding complexity and administrative overhead. Option C (Litigation Hold) is a manual process per mailbox and does not enforce time-based retention automatically. Option D (archive mailbox) provides storage but does not enforce retention periods. Therefore, a retention policy is the most efficient solution.

Answer

Configure Exchange journaling to export to an external system

Answer

Place each executive mailbox on Litigation Hold

Answer

Enable the archive mailbox for each executive