MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 9 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a custom PowerShell script that runs in the user context after every device restart. Which Intune policy type should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Intune PowerShell scripts (Devices > Scripts). Microsoft Intune PowerShell scripts (Devices > Scripts) allow you to deploy custom PowerShell scripts that run in the user context on Windows 10 devices. By configuring the script with 'Run this script using the logged on credentials' and setting the schedule to 'Run once per device' or 'Run on every device restart', you can ensure the script executes after every restart. This is the only Intune policy type designed specifically for deploying and managing custom PowerShell scripts with user context and restart-triggered execution.

Answer

Compliance policy

Answer

PowerShell script as a 'Run this script using the logged on credentials' assignment.

Answer

Device configuration profile

Question 2

Your Microsoft 365 tenant has a Microsoft Entra ID tenant with custom B2B collaboration settings. You need to allow external users from a specific domain (partner.com) to self-service sign up, but block all other external domains. What should you configure?

Accepted Answer

Configure cross-tenant access settings for partner.com with inbound access enabled and block other domains by default.. Cross-tenant access settings in Microsoft Entra ID allow you to configure inbound access for specific domains (partner.com) while blocking all others by default. This enables self-service sign-up for allowed domains and prevents unauthorized domains from signing up, directly meeting the requirement. Option B is incorrect because setting guest user access permissions to restricted does not allow domain-specific self-service sign-up; it limits guest permissions after invitation. Option A is incorrect because SharePoint external sharing controls content sharing, not identity-based sign-up. Option D is incorrect because there is no B2B collaboration allowlist; the correct approach is cross-tenant access settings.

Answer

Configure SharePoint Online external sharing settings to allow partner.com only.

Answer

Set guest user access permissions to 'Guest user access is restricted'.

Answer

Add partner.com to the B2B collaboration allowlist in Microsoft Entra ID.

Question 3

You need to ensure that all Microsoft 365 users in your organization have a consistent password policy that requires passwords to be at least 12 characters and include complexity requirements. What should you configure?

Accepted Answer

Password policy in Microsoft Entra ID. Microsoft Entra ID (formerly Azure AD) is the identity service that enforces tenant-wide password policies for cloud-only user accounts. Configuring the password policy in Entra ID allows you to set minimum length (e.g., 12 characters) and complexity requirements (e.g., must include uppercase, lowercase, digits, and special characters) that apply to all Microsoft 365 users. This is the correct location because Entra ID is the authoritative source for authentication policies in a Microsoft 365 tenant.

Answer

Device compliance policy in Microsoft Intune

Answer

Outlook on the web mailbox policy

Answer

Data loss prevention policy in Microsoft Purview

Question 4

A company has a Microsoft 365 E5 tenant with 10,000 users. You need to delegate the ability to manage Microsoft Entra ID roles to a group of support engineers. The solution must follow the principle of least privilege and allow engineers to assign only specific roles to users. What should you do?

Accepted Answer

Create a custom role in Microsoft Entra ID with permissions to assign specific roles, and use PIM to enable just-in-time access. It follows the principle of least privilege by creating a custom role that grants only the specific permissions needed to assign designated roles, and using Privileged Identity Management (PIM) for just-in-time (JIT) access ensures engineers are elevated only when required. This approach avoids granting standing administrative privileges and allows granular control over which roles can be assigned, meeting the requirement to delegate role management without over-provisioning.

Answer

Assign the engineers the Privileged Role Administrator role

Answer

Add the engineers to the Global Administrator role in Microsoft Entra ID

Answer

Create a group in Microsoft Entra ID and assign it the User Administrator role, then use PIM to elevate

Question 5

Your organization uses Microsoft 365 Business Premium. You need to ensure that when a user is assigned an Intune license, the device automatically enrolls in Microsoft Intune. What should you configure?

Accepted Answer

Configure Microsoft Entra ID device settings to enable MDM automatic enrollment. Microsoft Entra ID (formerly Azure AD) device settings include an option to enable automatic MDM enrollment for users assigned an Intune license. When enabled, any device that signs in with a licensed user account will automatically enroll in Microsoft Intune, satisfying the requirement without additional configuration.

Answer

Create a device compliance policy to require enrollment

Answer

Create a device enrollment restriction in Intune to block personal devices

Answer

Deploy a device configuration profile with enrollment settings

Question 6

A user reports that they cannot access Microsoft Teams from their mobile device. Other Microsoft 365 services work fine. You verify that the device is compliant with Intune policies. What is the most likely cause?

Accepted Answer

A Conditional Access policy requires an approved client app for Teams. A Conditional Access policy requiring an approved client app for Microsoft Teams would block access from a mobile device even if the device is Intune-compliant, as the policy specifically checks for the use of an approved app (e.g., the official Microsoft Teams app) rather than just device compliance. Since the user can access other Microsoft 365 services, the issue is isolated to Teams, and the device compliance status rules out broader device-level blocks.

Answer

The user's authentication method is not registered for Microsoft Entra ID

Answer

The Microsoft Teams service is degraded

Answer

The device is not enrolled in Microsoft Intune

Question 7

You need to ensure that only users from your organization can access a SharePoint Online site. Which setting should you configure?

Accepted Answer

Set the SharePoint Online external sharing setting to 'Only people in your organization'. The SharePoint Online external sharing setting 'Only people in your organization' explicitly restricts all sharing and access to users who have a valid identity in your Microsoft Entra ID tenant. This setting prevents any external user (including guests) from accessing the site, regardless of how they were invited or authenticated. It is the most direct and effective control for limiting access to internal users only.

Answer

Create a Conditional Access policy to block external users

Answer

Configure the Microsoft Entra ID external collaboration settings

Answer

Modify the site permissions to remove external users

Question 8

Your organization is implementing Microsoft 365 Copilot. You need to ensure that users' data is protected from being used for training the underlying AI models. What should you configure?

Accepted Answer

Configure the Microsoft 365 Copilot data protection policy to prevent data from being used for training. Microsoft 365 Copilot includes a data protection policy specifically designed to prevent organizational data from being used to train the underlying AI models. This policy, configured in the Microsoft 365 admin center under Copilot settings, ensures that user prompts, responses, and associated data are not retained or used by Microsoft for model improvement, aligning with the data residency and privacy commitments outlined in the Microsoft Data Protection Addendum (DPA).

Answer

Disable Microsoft 365 Copilot for all users

Answer

Apply Microsoft Purview sensitivity labels to all documents

Answer

Enable Conditional Access policies to require compliant devices

Question 9

You have a Microsoft 365 E5 tenant with Microsoft Defender for Cloud Apps. You need to discover unsanctioned cloud apps used by users. What should you configure?

Accepted Answer

Microsoft Defender for Cloud Apps Cloud Discovery. Microsoft Defender for Cloud Apps Cloud Discovery is the correct feature for identifying unsanctioned cloud apps used in your environment. It analyzes traffic logs from your network or endpoints to discover all cloud app usage, categorizes them by risk, and allows you to sanction or unsanction them. This directly fulfills the requirement to discover unsanctioned cloud apps.

Answer

Conditional Access App Control

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Defender for Endpoint App Control

Question 10

Your organization needs to enforce multi-factor authentication (MFA) for all users. You want to use a security default policy. What is the prerequisite?

Accepted Answer

The Microsoft Entra ID tenant must be on the Free tier or higher. Security defaults are available for all Microsoft Entra ID tenants, including the Free tier. Option A is incorrect because PIM is not required for security defaults. Option C is incorrect because security defaults require that Conditional Access policies are disabled; they are an alternative to Conditional Access. Option D is incorrect because Azure AD Premium P2 licenses are not required; security defaults are included with the Free tier.

Answer

Microsoft Entra ID Privileged Identity Management (PIM) must be enabled

Answer

Conditional Access policies must be disabled

Answer

Azure AD Premium P2 licenses must be assigned

Question 11

Your organization is using Microsoft 365 Business Premium. You need to ensure that devices are automatically enrolled in Microsoft Intune when users sign in with their work account. Which TWO configurations are required?

Accepted Answer

Enable MDM automatic enrollment in Microsoft Entra ID. To automatically enroll devices in Intune when users sign in with their work account, two configurations are required. Option A enables MDM automatic enrollment in Microsoft Entra ID, which establishes the MDM authority and allows Intune to enroll devices at sign-in. Option E configures the actual auto-enrollment policy, which can be done via Group Policy for hybrid domain-joined devices or via Microsoft Entra ID for Azure AD joined devices. Both settings are necessary to trigger enrollment for all device types. Option A sets up the backend service, while Option E defines the enrollment scope and method.

Answer

Create a device compliance policy in Intune

Answer

Set device enrollment restrictions to allow all platforms

Answer

Assign device categories to users

Question 12

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP). You need to ensure that sensitive data such as credit card numbers cannot be shared externally via email. Which THREE components should you configure?

Accepted Answer

Define sensitive information types for credit card numbers. A is correct because sensitive information types (SITs) are predefined or custom patterns that detect specific data like credit card numbers (e.g., regex matching major credit card formats). Defining the SIT for credit card numbers allows the DLP policy to identify this sensitive content in emails, which is the first step before any action can be taken.

Answer

Enable Microsoft Purview Insider Risk Management

Answer

Configure a retention policy for email

Question 13

Refer to the exhibit. You are creating a custom role in Microsoft Entra ID for helpdesk staff. What can users assigned this role do?

Accepted Answer

Read user properties and reset passwords. The custom role shown in the exhibit includes only the 'Users' > 'Basic' > 'Read' permission and the 'Authentication' > 'Passwords' > 'Reset password' permission. This combination allows helpdesk staff to read basic user properties (such as display name, user principal name, and job title) and reset user passwords. It does not grant write access to other user attributes, security groups, or license assignments.

Answer

Read security groups and reset passwords

Answer

Create new users and reset passwords

Answer

Read user properties and assign licenses

Question 14

Refer to the exhibit. You run this PowerShell command in your Microsoft 365 tenant. What is the purpose of the command?

Accepted Answer

To list all unlicensed users in the tenant. The PowerShell command `Get-MgUser -Filter 'assignedLicenses/$count eq 0' -ConsistencyLevel eventual` retrieves all users in the Microsoft 365 tenant who have no licenses assigned. The `assignedLicenses/$count eq 0` filter checks that the count of assigned licenses is zero, and `-ConsistencyLevel eventual` is required for advanced queries on directory objects. This directly corresponds to listing all unlicensed users in the tenant.

Answer

To list all users with sign-in blocked

Answer

To list all unlicensed users with a specific usage location

Answer

To list all users who have a license assigned

Question 15

Your organization is preparing to deploy Microsoft 365 for 5,000 users. You need to ensure that all users can authenticate using their existing on-premises Active Directory credentials while minimizing infrastructure changes. You also need to support self-service password reset (SSPR) for cloud-only users. Which authentication method should you recommend?

Accepted Answer

Password Hash Synchronization (PHS). Password Hash Synchronization (PHS) is the correct choice because it synchronizes password hashes from on-premises Active Directory to Microsoft Entra ID, allowing users to authenticate with their existing credentials without additional infrastructure. It also enables cloud-only users to use self-service password reset (SSPR) independently, as SSPR relies on cloud-stored hashes and does not require on-premises write-back for cloud-only accounts.

Answer

Cloud-only authentication with Microsoft Entra ID

Answer

Pass-through Authentication (PTA)

Answer

Federation with AD FS