MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 9 — 15 Questions

Question 1

A company recently acquired another company and needs to allow users from the acquired tenant to access its SharePoint Online sites as guest users, but only if those users already have accounts in the acquired Azure AD tenant. Which Microsoft 365 feature should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cross-tenant access settings for B2B collaboration. Cross-tenant access settings for B2B collaboration allow you to configure inbound and outbound access between two Microsoft Entra ID tenants. By enabling B2B collaboration with the acquired tenant and setting the appropriate cross-tenant access policies, you can invite users who already have accounts in that tenant as guest users to access SharePoint Online sites. This ensures that only authenticated users from the acquired tenant are granted access, meeting the requirement.

Answer

B2B direct connect

Answer

Multi-Geo

Answer

Tenant Restrictions

Question 2

An administrator needs to configure email notifications for Exchange Online service health incidents to be sent to a specific IT support mailbox. Where should the administrator configure these notifications in the Microsoft 365 admin center?

Accepted Answer

Health > Service health > Customize notifications. The 'Customize notifications' link under Health > Service health in the Microsoft 365 admin center is the dedicated interface for configuring email notifications for service health incidents, including Exchange Online. This allows administrators to specify which email addresses (such as an IT support mailbox) receive alerts for service incidents, advisories, and other health events, with granular control over which services and severity levels trigger notifications.

Answer

Organization profile > Notifications > Service health

Answer

Mail flow connectors

Answer

Settings > Service settings

Question 3

An administrator wants to configure the company's organization profile in Microsoft 365, including the display name, technical contact, and privacy settings. Where should the administrator go in the Microsoft 365 admin center?

Accepted Answer

Org settings > Organization profile. The organization profile, which includes the display name, technical contact, and privacy settings, is managed under 'Org settings' in the Microsoft 365 admin center. Specifically, the 'Organization profile' tab within 'Org settings' provides the interface to update these tenant-wide properties, such as the organization's display name (used in Microsoft 365 services and notifications) and the technical contact email (used for service communications). This is the correct location because these settings are tenant-level configurations, not user-specific or billing-related.

Answer

User management > Active users

Answer

Setup > Onboarding

Answer

Billing > Licenses

Question 4

A user account was accidentally deleted 10 days ago. The administrator needs to restore the user's mailbox and OneDrive for Business content. Which method should the administrator use?

Accepted Answer

Restore the user from the 'Deleted users' page in the Microsoft 365 admin center.. Microsoft 365 retains deleted user objects, including their Exchange Online mailbox and OneDrive for Business data, for 30 days in the 'Deleted users' list. Restoring the user from this page within the retention period automatically recovers the associated mailbox and OneDrive content without requiring separate tools or support requests.

Answer

Recreate the user account with the same name, and the data will be automatically restored.

Answer

Use the Exchange admin center to recover the mailbox only.

Answer

Submit a support request to Microsoft to recover the deleted data.

Question 5

An administrator needs to update the organization's display name, technical contact, and privacy statement URL in the Microsoft 365 admin center. Which page should they navigate to?

Accepted Answer

Settings > Org settings > Organization profile. The 'Settings > Org settings > Organization profile' page in the Microsoft 365 admin center is the dedicated location for modifying tenant-wide metadata, including the organization's display name, technical contact email, and privacy statement URL. These settings are stored in the Microsoft 365 tenant's directory properties and are distinct from user-level or billing-level configurations.

Answer

Users > Active users > More actions > Edit contact info

Answer

Billing > Billing accounts > Edit organization info

Answer

Admin centers > Azure AD > Properties

Question 6

An organization uses a third-party SaaS application that supports SAML-based single sign-on. The application is not in the Azure AD gallery. What is the first step to configure SSO?

Accepted Answer

Create a new enterprise application from the 'Non-gallery application' option in Azure AD. The correct first step is to create a new enterprise application from the 'Non-gallery application' option in Microsoft Entra ID. This allows you to configure SAML-based SSO for any third-party application that supports SAML 2.0, even if it is not listed in the Microsoft Entra ID gallery. The non-gallery application template provides the necessary endpoints and metadata to establish trust between Microsoft Entra ID and the SaaS application.

Answer

Configure Azure AD Connect to sync on-premises users

Answer

Add the application in the Microsoft 365 admin center under 'Integrated apps'

Answer

Create a custom role in Azure AD for the application

Question 7

An administrator has configured group-based licensing in Azure AD. After adding users to the group, some users do not receive licenses. The users are in the group and have an assigned usage location. What is a possible reason?

Accepted Answer

The users have conflicting license assignments from another source. Group-based licensing in Microsoft Entra ID can fail when a user already has a license assigned from another source, such as direct assignment or another group. Microsoft Entra ID's group-based licensing processes assignments in a deterministic order, and if a conflict arises (e.g., different service plans or SKUs), the system may skip the user and log an error in the audit logs. This is a common scenario when users are migrated from direct licensing to group-based licensing without removing the existing assignments.

Answer

The group is a mail-enabled security group, which is not supported for group-based licensing

Answer

The license product name in the group setting does not match the available licenses in the tenant

Answer

The users have not accepted the Microsoft Online Service Terms

Question 8

An administrator has added a custom domain 'contoso.com' to their Microsoft 365 tenant and verified ownership. However, users are unable to receive emails sent to their custom domain. Which type of DNS record must the administrator add in the public DNS zone to route emails to Exchange Online?

Accepted Answer

MX record. The MX (Mail Exchange) record is the DNS record type that directs email messages to a specific mail server. For Exchange Online, the MX record must point to the tenant's mail exchanger (e.g., contoso-com.mail.protection.outlook.com) with a priority value (typically 0). Without this record, sending mail servers cannot route inbound emails to the custom domain's mailbox store in Exchange Online.

Answer

TXT record

Answer

CNAME record

Answer

SPF record

Question 9

A company needs to migrate several shared mailboxes from on-premises Exchange 2016 to Exchange Online. The company plans to keep some user mailboxes on-premises for now. Which migration strategy should they use for the shared mailboxes?

Accepted Answer

Hybrid migration. A hybrid migration is the correct choice because it allows the coexistence of on-premises Exchange 2016 and Exchange Online mailboxes, enabling the selective migration of shared mailboxes while keeping some user mailboxes on-premises. This approach uses the Hybrid Configuration Wizard to establish a secure connection and synchronize directory objects via Microsoft Entra Connect, supporting mailbox moves with the New-MoveRequest cmdlet.

Answer

Cutover migration

Answer

Staged migration

Answer

IMAP migration

Question 10

An administrator wants to add a second custom domain, 'contoso-europe.com', to their existing Microsoft 365 tenant. The domain 'contoso.com' is already verified. What is the first step the administrator should take?

Accepted Answer

Add the domain in the Microsoft 365 admin center. Before any DNS records can be created or users can be assigned the new domain, the domain must first be added to the tenant in the Microsoft 365 admin center (or via the Microsoft Graph/Exchange admin center). This step registers the domain in the tenant and generates the required verification TXT record values. Only after the domain is added can the administrator proceed to DNS verification and then configure services.

Answer

Create a DNS TXT verification record

Answer

Update the UPN suffixes for users

Answer

Create a new Microsoft 365 tenant

Question 11

A company has an existing Microsoft 365 tenant with the verified custom domain 'contoso.com'. The administrator now wants to add a second custom domain, 'contoso-europe.com', to the same tenant. What is the first step the administrator should take?

Accepted Answer

Add the domain in the Microsoft 365 admin center.. The first step to add a second custom domain to an existing Microsoft 365 tenant is to initiate the domain addition process in the Microsoft 365 admin center. This triggers the system to generate the unique TXT verification record that must be added to the public DNS zone to prove ownership of the domain. Without first adding the domain in the admin center, the administrator would not know the specific verification value required for the DNS record.

Answer

Add a TXT verification record in the public DNS zone for 'contoso-europe.com'.

Answer

Add an MX record pointing to Exchange Online in the public DNS zone for 'contoso-europe.com'.

Answer

Contact Microsoft support to enable the domain addition feature.

Question 12

An administrator wants to receive real-time notifications for service incidents in Microsoft 365. The notifications must be sent to a Microsoft Teams channel instead of email. Which configuration should the administrator set up?

Accepted Answer

Configure a webhook connector in Microsoft Teams to subscribe to the Office 365 Service Communications API.. The Office 365 Service Communications API provides real-time webhook-based notifications for service incidents. By configuring a webhook connector in Microsoft Teams, the administrator can subscribe to this API and receive incident alerts directly in a Teams channel without polling or email forwarding.

Answer

Configure an email notification rule in the Microsoft 365 admin center and forward it to a Teams email address.

Answer

Use Power Automate to check service health and post to Teams every 5 minutes.

Answer

Configure a message center alert to email and then use a third-party integration to post to Teams.

Question 13

An administrator needs to configure the default anti-spam policy for all users in the Microsoft 365 Defender portal. Where should the administrator navigate to find these settings?

Accepted Answer

Email & collaboration > Policies & rules > Threat policies > Anti-spam. The default anti-spam policy is configured under Email & collaboration > Policies & rules > Threat policies > Anti-spam in the Microsoft 365 Defender portal. This is the correct location because anti-spam settings, including the default policy that applies to all users, are managed specifically within the Anti-spam section of Threat policies. The other options address different threat protection areas (anti-phishing, anti-malware, Safe Attachments) that do not contain spam filtering configurations.

Answer

Email & collaboration > Policies & rules > Threat policies > Anti-phishing

Answer

Email & collaboration > Policies & rules > Threat policies > Anti-malware

Answer

Email & collaboration > Policies & rules > Threat policies > Safe Attachments

Question 14

An administrator wants to restrict which users in the organization can create Microsoft 365 groups. The requirement is that only members of the IT department (identified by the department attribute in Azure AD) should be able to create groups. Which configuration should the administrator use?

Accepted Answer

Azure AD > Groups > Group settings > Group creation settings.. The Microsoft Entra ID 'Group settings' blade includes a 'Group creation settings' option that allows administrators to restrict group creation to specific security groups. By configuring this setting, the administrator can limit group creation to only members of the IT department, identified by the department attribute in Microsoft Entra ID, by placing those users into a designated security group.

Answer

Azure AD Identity Governance > Access reviews.

Answer

Azure AD > Groups > Naming policy.

Answer

Microsoft 365 admin center > Groups > Add group.

Question 15

An administrator has added the custom domain 'contoso.co.uk' to their Microsoft 365 tenant and verified ownership. Users now need to receive email at @contoso.co.uk. Which DNS record must the administrator add in the public DNS zone to route emails to Exchange Online?

Accepted Answer

Add an MX record pointing to .mail.protection.outlook.com. To route email for a custom domain to Exchange Online, you must add an MX record in the public DNS zone that points to the Exchange Online mail exchanger. The correct target is .mail.protection.outlook.com, where is your initial tenant name (e.g., contoso-com). This MX record tells sending mail servers to deliver messages for @contoso.co.uk to Microsoft's email infrastructure.

Answer

Add a CNAME record for autodiscover

Answer

Add an SPF record

Answer

Add a DKIM record