MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 8 — 15 Questions

Question 1

Your organization uses Microsoft 365 and wants to implement a passwordless authentication strategy. Which THREE methods are supported natively in Microsoft Entra ID for passwordless sign-in?

Accepted Answer

Microsoft Authenticator app (phone sign-in). Microsoft Entra ID supports three native passwordless authentication methods: Microsoft Authenticator app (phone sign-in), FIDO2 security keys, and Temporary Access Pass (TAP). TAP is a time-limited passcode issued by an admin that allows users to sign in without a password, making it a fully native cloud-only method. The other options (smart cards, certificate-based authentication) require additional on-premises or hybrid components.

Answer

Smart cards (physical or virtual)

Answer

Certificate-based authentication

Question 2

Your company uses Microsoft Defender for Endpoint and wants to perform a live response on a device. Which THREE prerequisites must be met?

Accepted Answer

The user must be assigned a role that includes live response permissions. Live response in Microsoft Defender for Endpoint requires the user to be assigned a role that includes specific live response permissions, such as 'Live response' or 'Live response advanced' under the Microsoft 365 Defender role-based access control (RBAC). Without these permissions, the user cannot initiate a live response session, regardless of other configurations.

Answer

The device must be managed by Microsoft Intune

Answer

The device must have Microsoft Defender Antivirus as the primary antivirus solution

Question 3

You need to configure Microsoft Purview Data Loss Prevention (DLP) to prevent sensitive data from being shared via email. Which THREE elements can you use to define the policy?

Accepted Answer

Actions. Actions are a required element in a Microsoft Purview DLP policy because they define what happens when sensitive data is detected—such as blocking the email, sending a notification, or applying encryption. Without specifying actions, the policy would have no enforcement mechanism to prevent data sharing.

Answer

Sensitivity labels

Answer

Exceptions

Question 4

Refer to the exhibit. You are reviewing the service principal for Microsoft Graph in your tenant. The passwordCredentials array is empty. What does this indicate?

Accepted Answer

No client secret is configured for the service principal.. The passwordCredentials array being empty indicates that no client secret (password) has been configured for the service principal. Client secrets are one method of authentication for service principals, and their absence means that this particular authentication method is not set up. This does not imply the service principal is disabled or that other authentication methods like certificates or federated credentials are in use.

Answer

The service principal is using federated credentials.

Answer

The service principal uses certificate-based authentication.

Answer

The Microsoft Graph application is disabled.

Question 5

Refer to the exhibit. You have a Conditional Access policy configured as shown. What is the effect of this policy?

Accepted Answer

It blocks access from trusted IP addresses.. The policy is configured to 'Block access' for 'All users' and 'All cloud apps' when the location condition is set to 'Trusted IPs'. This means that when a user attempts to access from an IP address defined as trusted in the organization's named locations, access is explicitly blocked. The effect is that trusted IP addresses are blocked, not untrusted ones.

Answer

It requires multi-factor authentication for trusted IPs.

Answer

It blocks access from all locations.

Answer

It blocks access from untrusted IP addresses.

Question 6

Your company is deploying Microsoft 365 for a new subsidiary with 500 users. You need to configure the initial tenant with a custom domain (contoso.com) and verify ownership. What is the first step you must perform?

Accepted Answer

Add a TXT record provided by Microsoft 365 to the contoso.com DNS zone.. To verify ownership of a custom domain in Microsoft 365, you must prove you control the domain's DNS zone. Microsoft provides a unique TXT record value that you add to the public DNS zone of contoso.com. Once the TXT record propagates, Microsoft queries it and confirms ownership, allowing you to proceed with domain configuration.

Answer

Delegate the contoso.com zone to Microsoft 365 DNS servers.

Answer

Create user accounts with the custom domain before verification.

Answer

Set contoso.com as the default domain in the Microsoft 365 admin center.

Question 7

You are a Microsoft 365 administrator. You need to ensure that users can reset their own passwords without contacting the help desk. Which TWO components must be configured?

Accepted Answer

Microsoft Entra ID P1 or P2 licenses assigned to users. The correct answers are B and D. Self-Service Password Reset (SSPR) requires Microsoft Entra ID P1 or P2 licenses assigned to users (B). Additionally, the SSPR feature must be enabled in the Microsoft Entra admin center (D). Option A is incorrect because the user risk policy in Identity Protection is not required for SSPR. Option C is incorrect: password hash synchronization is not necessary for cloud-only users; SSPR works with cloud accounts. Option E is incorrect: password writeback is used to sync password changes back to on-premises Active Directory, but it is not required for cloud-only password resets.

Answer

Configure Microsoft Entra ID Protection user risk policy

Answer

Azure AD Connect with password hash synchronization

Answer

Enable password writeback in Azure AD Connect

Question 8

Your organization is deploying Microsoft 365 Copilot for 200 users. You need to ensure that Copilot can access user data from Microsoft Graph to provide personalized responses. Which THREE permissions must be granted?

Accepted Answer

Chat.ReadWrite (Microsoft Graph). Chat.ReadWrite is required for Microsoft 365 Copilot to access and process user chat data from Microsoft Graph, enabling personalized responses based on chat history and context. This permission allows Copilot to read and write chat messages, which is essential for generating context-aware replies.

Answer

User.Read.All (Microsoft Graph)

Answer

Mail.Send (Microsoft Graph)

Question 9

You are configuring Microsoft 365 tenant-to-tenant migration. Which THREE tasks must be completed before migrating users?

Accepted Answer

Obtain tenant consent for data migration (e.g., via admin consent). Tenant consent (admin consent) is required to authorize the migration tool (e.g., Microsoft 365 Migration API or third-party tools) to access and move mailbox data between tenants. Without this consent, the migration service cannot authenticate or read/write data in either tenant, blocking the migration process.

Answer

Change MX records to point to the target tenant

Answer

Delete source tenant user mailboxes

Question 10

Refer to the exhibit. A Conditional Access policy is created in Microsoft Entra ID. The policy targets the Office 365 app (which includes Exchange Online). You have 1000 users assigned. What is the immediate effect of this policy on users who are currently signed in?

Accepted Answer

No immediate effect; users will be blocked on their next sign-in attempt.. Conditional Access policies in Microsoft Entra ID are evaluated at the time of sign-in. They do not terminate existing sessions. Therefore, users who are already signed in will not be affected until their next authentication attempt, at which point the policy's block action will be enforced.

Answer

All high-risk users are immediately blocked from accessing email.

Answer

The policy is invalid because the Office 365 app does not support block.

Answer

Only users with a sign-in risk of high are blocked.

Question 11

Refer to the exhibit. You run the PowerShell command in a Microsoft 365 tenant. What does the output indicate?

Accepted Answer

The email addresses that receive service health notifications.. The PowerShell command `Get-ExchangeNotification` retrieves the email addresses configured to receive service health notifications for the Microsoft 365 tenant. The output shown lists these notification recipients, which are separate from administrative roles or billing contacts. Option B correctly identifies this as the set of email addresses that receive service health alerts.

Answer

The users who have the Global Administrator role.

Answer

The members of the default Office 365 group.

Answer

The email addresses for billing inquiries.

Question 12

Refer to the exhibit. You are reviewing a Microsoft Entra ID Governance access review. The JSON shows an access review scope for a SharePoint site. What does the 'isExternallyAccessible': false setting indicate about the site?

Accepted Answer

External users cannot access the site.. The 'isExternallyAccessible': false setting in the access review scope JSON indicates that the SharePoint site is not configured to allow external sharing. This means external users cannot access the site, making option B correct. The setting directly controls whether the site is visible to external identities in the access review, not the review process itself.

Answer

The site's external sharing settings are not reviewed.

Answer

The site is configured to allow sharing with anyone.

Answer

External users are automatically granted access.

Question 13

Your organization uses Microsoft 365 Business Premium. You need to configure Windows 365 Cloud PCs for 10 users who require access to a custom line-of-business (LOB) application that is not compatible with Windows 11. The LOB app requires Windows 10 and 8 GB RAM. What is the most cost-effective Cloud PC configuration that meets the requirements?

Accepted Answer

Windows 365 Business Standard license and a custom Windows 10 image.. Windows 365 Business Standard provides 8 GB RAM and supports custom Windows 10 images, meeting the LOB app's requirements. The Business Standard license is the most cost-effective tier that offers 8 GB RAM, while Basic only offers 4 GB RAM and would not satisfy the app's memory needs. A custom Windows 10 image is necessary since the app is incompatible with Windows 11.

Answer

Windows 365 Business Advanced license and a custom Windows 11 image.

Answer

Windows 365 Enterprise license with GPU.

Answer

Windows 365 Business Basic license and a custom Windows 10 image.

Question 14

You are a Microsoft 365 administrator. Your tenant has a Microsoft Entra ID P2 license. You need to create a dynamic group for all users whose department is 'Engineering' and who are located in the United States. Which rule syntax should you use?

Accepted Answer

user.department -eq "Engineering" and user.country -eq "United States". Dynamic group rules in Microsoft Entra ID require the use of lowercase 'and' as the logical operator, and the country attribute value must match the display name 'United States' as stored in the directory. The rule syntax must follow the property -operator 'value' format exactly, with no capitalization of 'and'.

Answer

user.department -eq "Engineering" and user.country -eq "US"

Answer

user.department -eq "Engineering" And user.country -eq "United States"

Answer

user.department -eq "Engineering" AND user.country -eq "United States"

Question 15

Your company has a Microsoft 365 E5 tenant. You need to ensure that all external emails are marked with a warning banner at the top of the email body. What should you configure?

Accepted Answer

A mail flow rule (transport rule) to add a disclaimer.. A mail flow rule (transport rule) in Exchange Online can be configured to prepend a disclaimer (warning banner) to the body of all external emails. This is the only mechanism that directly modifies the email body content for inbound or outbound messages based on sender/recipient criteria, such as when the sender is external to the organization.

Answer

A Safe Attachments policy in Microsoft Defender for Office 365.

Answer

External email tagging in the Microsoft 365 Defender portal.

Answer

A DLP policy with a sensitive information type.