MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 8 — 15 Questions

Question 1

Your organization is deploying Microsoft 365 and needs to ensure that all new users are automatically assigned a Microsoft 365 Business Basic license. You want to use a group-based licensing strategy with an Azure AD security group. What should you do first?

Accepted Answer

Create a new Azure AD security group and assign the license to the group.. Option D is correct because group-based licensing in Azure AD requires you to first create a security group (which can be cloud-only or synced) and then assign the Microsoft 365 Business Basic license directly to that group. Once the license is assigned to the group, all members automatically receive the license, including new users added to the group. This approach centralizes license management and ensures automatic assignment without manual intervention.

Answer

Configure directory synchronization and create the group in on-premises Active Directory.

Answer

Create a dynamic Azure AD group with a rule for user attributes and enable self-service group management.

Answer

Assign the license directly to each user via the Microsoft 365 admin center.

Question 2

You are a Microsoft 365 administrator. Users report that they cannot access Microsoft Teams. You check the Microsoft 365 admin center and see that the service health for Microsoft Teams shows a 'Service degradation' incident. What is the most appropriate initial action?

Accepted Answer

Review the incident details in the service health dashboard for an estimated resolution time and workaround.. Option C is correct because the most appropriate initial action when a service degradation incident is already visible in the Microsoft 365 admin center is to review the incident details in the service health dashboard. This provides the estimated resolution time, current status, and any available workarounds published by Microsoft, allowing you to inform users and mitigate impact without immediately escalating or opening a support request.

Answer

Contact the Microsoft regional escalation engineer immediately.

Answer

Open a support request with Microsoft to report the outage.

Answer

Restart the Microsoft Teams service on all client machines.

Question 3

Your company is migrating from on-premises Exchange to Exchange Online. You have configured a hybrid deployment. During testing, you notice that free/busy information is not being shared between on-premises and cloud users. All other hybrid features work. What is the most likely cause?

Accepted Answer

The organization relationship between the on-premises and cloud tenants is missing or misconfigured.. The organization relationship defines the trust and sharing settings between on-premises Exchange and Exchange Online tenants, specifically for free/busy information. Since all other hybrid features (e.g., mail flow, mailbox moves) work, the issue is isolated to the organization relationship, which must be configured on both sides to enable cross-premises calendar availability queries.

Answer

Azure AD Connect has not been configured with the correct synchronization scope.

Answer

The on-premises firewall is blocking traffic to the Exchange Online endpoints.

Answer

OAuth authentication is not configured between on-premises and Exchange Online.

Question 4

You need to ensure that all users in your Microsoft 365 tenant are automatically enrolled in Microsoft Intune when they sign up for Microsoft 365. You want to use the default enrollment policy. What should you do?

Accepted Answer

Set the MDM authority to Microsoft Intune and configure automatic MDM enrollment via Azure AD.. Option A is correct because setting the MDM authority to Microsoft Intune and configuring automatic MDM enrollment via Azure AD enables the default enrollment policy. This ensures that when users sign up for Microsoft 365, they are automatically enrolled in Intune without manual intervention, leveraging Azure AD's built-in MDM enrollment integration.

Answer

Create a conditional access policy that requires device compliance and block access if not enrolled.

Answer

Configure a PowerShell script to run daily that adds all users to Intune.

Answer

Ensure that the Microsoft Intune license is assigned to each user and enable the 'Enroll automatically' setting in the Microsoft 365 admin center.

Question 5

Your organization uses Microsoft Defender for Office 365. You have configured a safe attachment policy that should automatically detonate attachments in a sandbox before delivery. However, some users still receive malicious attachments. What should you check first?

Accepted Answer

Verify that the Safe Attachments policy is applied to the affected users and that the action is set to 'Dynamic Delivery' or 'Replace' (not 'Monitor').. Safe Attachments require the policy to be enabled and applied to the correct recipients. Option C is correct because the policy might not be applied to all users, or it may be set to 'Monitor' which does not detonate. Option A is incorrect because Safe Links is a different feature. Option B is incorrect because the mailbox audit log does not show policy configuration. Option D is incorrect because a transport rule could override, but first check the policy itself.

Answer

Check whether a mail flow rule (transport rule) is bypassing Safe Attachments.

Answer

Check the Safe Links policy configuration.

Answer

Review the mailbox audit log for each affected user.

Question 6

You are a Microsoft 365 administrator. You need to allow external users to access a SharePoint Online site without requiring them to sign in. Which sharing setting should you enable?

Accepted Answer

Set the sharing option to 'Anyone' (Anonymous) for the site.. Option D is correct because setting the SharePoint Online site sharing option to 'Anyone' (Anonymous) allows external users to access the site without signing in. This creates an anonymous access link that bypasses authentication, meeting the requirement of no sign-in for external users.

Answer

Set the sharing option to 'Existing guests' and send an invitation.

Answer

Set the sharing option to 'Only people in your organization' and use a direct link.

Answer

Set the sharing option to 'New and existing guests' and require guest sign-in.

Question 7

Your company is using Microsoft 365 Business Premium. You want to ensure that all company-owned Windows 10 devices are automatically upgraded to Windows 11 when it becomes available through Windows Update. What should you configure?

Accepted Answer

Create a feature update policy for Windows 10 devices in Intune, targeting the Windows 11 version.. A feature update policy in Intune is specifically designed to upgrade Windows devices from one version to another, such as from Windows 10 to Windows 11. By targeting the Windows 11 version in this policy, you ensure that eligible Windows 10 devices automatically receive the upgrade when it becomes available via Windows Update. This is the correct mechanism for controlling OS version upgrades in a Microsoft 365 Business Premium environment.

Answer

Create a Windows 10 update ring policy in Intune that deploys quality updates.

Answer

Create a device compliance policy in Intune that requires Windows 11.

Answer

Configure a Windows 11 readiness assessment in Microsoft Intune.

Question 8

Your organization has a Microsoft 365 E5 tenant. You want to ensure that all users are automatically signed in to Microsoft 365 apps using single sign-on (SSO) when they are on the corporate network. You have Azure AD joined the devices. What additional configuration is required?

Accepted Answer

No additional configuration is required; Azure AD joined devices provide SSO automatically.. Azure AD joined devices are already registered with Azure AD and use the Primary Refresh Token (PRT) to enable seamless SSO for Microsoft 365 apps without any additional configuration. When a user signs into a Windows 10/11 device that is Azure AD joined, the PRT is obtained during the initial authentication and is automatically used for browser and app sign-ins on the corporate network. Therefore, no extra steps like enabling Seamless SSO or deploying certificates are needed.

Answer

Enable Azure AD Seamless Single Sign-On.

Answer

Configure Azure AD Application Proxy for each app.

Answer

Deploy a trusted certificate for the corporate network.

Question 9

You are a Microsoft 365 administrator. A user reports that they cannot send emails to a specific external domain. You check the Exchange Admin Center and see that the domain is not blocked. What should you check next?

Accepted Answer

Check the mail flow rules (transport rules) in Exchange Online.. Mail flow rules (transport rules) in Exchange Online can block or redirect messages based on conditions like sender, recipient domain, or message content, even if the domain is not listed in any block list. Since the domain is not blocked in the spam filter or outbound policies, a transport rule is the most likely cause of the issue, as it can silently reject or quarantine messages without appearing in the standard block lists.

Answer

Verify that the user has a full mailbox and is not over the send limit.

Answer

Review the outbound spam filter policy.

Answer

Check the spam filter policy to see if the domain is on the blocked sender list.

Question 10

Which TWO actions are required to enable Microsoft 365 Copilot for all users in your tenant?

Accepted Answer

Ensure users have a qualifying Microsoft 365 license (e.g., E3, E5, Business Standard).. Option C is correct because Microsoft 365 Copilot requires users to have a qualifying base license such as Microsoft 365 E3, E5, or Business Standard. Without one of these base licenses, the Copilot add-on license cannot be assigned or function properly, as Copilot relies on the underlying Microsoft 365 services (e.g., Exchange Online, SharePoint, Teams) that these plans provide.

Answer

Run a PowerShell script to enable Copilot in the tenant.

Answer

Ensure the tenant is on a Microsoft 365 E5 plan.

Answer

Provision an Azure subscription for Copilot services.

Question 11

Which THREE conditions must be met for a tenant-to-tenant migration of SharePoint Online content?

Accepted Answer

The destination site collection or OneDrive must already exist in the target tenant.. Option A is correct because SharePoint Online tenant-to-tenant migration requires the destination site collection or OneDrive to already exist in the target tenant. The migration process copies content into a pre-provisioned container; it does not create the site or OneDrive automatically. This ensures that the target structure is ready to receive the migrated data without requiring dynamic provisioning during the migration.

Answer

The source user performing the migration must be a global admin in the target tenant.

Answer

Both tenants must have at least one user with PowerShell access.

Question 12

Which TWO are valid methods for adding custom domains to Microsoft 365?

Accepted Answer

Using the New-MsolDomain PowerShell cmdlet.. Option A is correct because the `New-MsolDomain` PowerShell cmdlet is a valid method for adding a custom domain to Microsoft 365. This cmdlet, part of the Azure Active Directory Module for Windows PowerShell, registers the domain in the tenant's directory, which is a prerequisite for verifying ownership and configuring services like Exchange Online or SharePoint Online.

Answer

Using the Exchange admin center (EAC).

Answer

Using the Azure AD B2C tenant configuration.

Answer

Using the Windows DNS Manager console.

Question 13

You are reviewing a conditional access policy in Microsoft Entra ID. The policy is intended to block legacy authentication. However, users are still able to connect using Exchange ActiveSync without modern authentication. What is the most likely reason?

Accepted Answer

The policy does not include the 'All' client apps condition; it only includes specific client app types.. Option A is correct because Conditional Access policies that block legacy authentication must include the 'All' client apps condition to cover Exchange ActiveSync (EAS). If the policy only targets specific client app types (e.g., browser or mobile apps and desktop clients) but omits 'All', EAS traffic using legacy authentication bypasses the policy. EAS is a separate client app type that requires explicit inclusion via the 'All' option to enforce blocking.

Answer

The policy is not assigned to the affected users.

Answer

The grant control 'Block' is not supported for legacy authentication.

Answer

The policy is in report-only mode.

Question 14

You run the PowerShell command shown in the exhibit for a Microsoft 365 tenant. The output shows DisplayName as 'Contoso', DefaultDomainName as 'contoso.onmicrosoft.com', and InitialDomain as 'contoso.onmicrosoft.com'. What does this indicate about the tenant?

Accepted Answer

The tenant is using the initial .onmicrosoft.com domain as the default domain.. The output shows DefaultDomainName and InitialDomain both set to 'contoso.onmicrosoft.com', which means the tenant is using its initial Microsoft-provided domain as the default domain. The Get-MgDomain cmdlet retrieves domain objects, and the DefaultDomainName property indicates which domain is used by default for new users and services. Since no custom domain is set as default, the initial .onmicrosoft.com domain remains the default.

Answer

The command requires global admin privileges.

Answer

The tenant has not been verified.

Answer

The tenant has a custom domain set as the default.

Question 15

You are reviewing an ARM template that will be used to deploy a storage account for a Microsoft 365 migration project. The template includes 'supportsHttpsTrafficOnly': true. What is the primary benefit of this setting?

Accepted Answer

It enforces secure transfer (HTTPS) for all requests to the storage account.. Setting 'supportsHttpsTrafficOnly' to true enforces secure transfer by requiring all requests to the storage account to use HTTPS (TLS). This ensures data in transit is encrypted, protecting against man-in-the-middle attacks and eavesdropping. It is a critical security control for compliance with standards like PCI-DSS and HIPAA.

Answer

It reduces latency by enabling CDN integration.

Answer

It enables geo-redundant storage.

Answer

It minimizes storage costs by reducing bandwidth usage.