MS-102 Deploy and manage a Microsoft 365 tenant Practice Test 9 — 15 Questions

Question 1

Your organization uses Microsoft 365 E5 licenses for all users. You need to configure role-based access control (RBAC) so that helpdesk staff can reset passwords and manage licenses, but cannot modify user principal names (UPNs) or delete users. Which role assignment should you use?

Accepted Answer

Helpdesk Administrator. The Helpdesk Administrator role is correct because it grants the specific permissions needed to reset passwords and manage licenses, while explicitly preventing modifications to user principal names (UPNs) and user deletions. This role is designed for tier-1 support staff who require these capabilities without elevated user management rights.

Answer

License Administrator

Answer

Password Administrator

Answer

User Administrator

Question 2

Your company has implemented Microsoft Entra ID tenant restrictions to prevent data exfiltration. You need to ensure that external users from a partner organization can access a SharePoint Online site without being blocked by tenant restrictions. What should you do?

Accepted Answer

Add the partner tenant ID to the AllowedTenants list in the tenant restrictions policy.. Tenant restrictions use the X-MS-Cloud-Extension header to allow or block access. To allow partner users, you need to add their tenant ID to the 'AllowedTenants' list in the tenant restrictions policy. Option D is the correct approach. Option A (Azure AD B2B) is about inviting external users but does not bypass tenant restrictions. Option B (cross-tenant access settings) is for inbound/outbound access but not for tenant restrictions. Option C (Conditional Access) can be used to control access but does not override tenant restrictions.

Answer

Create a Conditional Access policy to exclude partner users from tenant restriction evaluation.

Answer

Configure Azure AD B2B collaboration and invite partner users as guests.

Answer

Configure cross-tenant access settings in Microsoft Entra ID to allow partner tenant.

Question 3

An administrator runs the PowerShell command shown in the exhibit. What is the immediate effect on the user?

Accepted Answer

The user is blocked from signing in immediately.. The PowerShell command `Set-MgUser -UserId user@domain.com -BlockCredential $true` immediately blocks the user from signing in by setting the `BlockCredential` property to true. This prevents any new authentication attempts, effectively locking the account without changing the password or deleting the user.

Answer

The user is disabled after 90 days of inactivity.

Answer

The user is deleted after 90 days of inactivity.

Answer

The user's password is reset.

Question 4

Your organization has a Microsoft 365 tenant with 5,000 users. You need to plan for tenant migration from an on-premises Exchange environment. You have a limited maintenance window and want to minimize user impact. Which approach should you recommend?

Accepted Answer

Perform a staged migration.. A staged migration is the best choice because it allows you to move mailboxes in batches over a limited maintenance window, minimizing user impact by keeping the majority of users on-premises until their specific batch is migrated. This approach supports up to 2,000 mailboxes per batch and requires a cutover period of only a few hours per batch, making it ideal for an organization with 5,000 users where a single cutover window is not feasible.

Answer

Perform an IMAP migration.

Answer

Perform a cutover migration.

Answer

Use a hybrid configuration.

Question 5

You are a Microsoft 365 administrator. Users report that they cannot create Microsoft Teams meetings using the Teams desktop client. They receive an error: 'Meeting creation is disabled by your IT administrator.' You need to enable meeting creation. You check the Teams admin center and find that meeting policies are set to 'Off' for 'Allow private meeting scheduling'. However, after changing it to 'On', users still get the error. What is the most likely cause?

Accepted Answer

The user's mailbox is still on-premises and not migrated to Exchange Online.. The error persists because the user's mailbox is still on-premises and not migrated to Exchange Online. Microsoft Teams relies on Exchange Online for scheduling features, including private meeting creation. Even with the meeting policy set to 'On', if the mailbox is on-premises, the Teams client cannot communicate with Exchange Online to create the meeting, resulting in the error.

Answer

The user does not have an OAuth 2.0 token.

Answer

The global meeting policy is overriding the user-level policy.

Answer

The user does not have a Microsoft Teams license assigned.

Question 6

Your organization is planning to deploy Microsoft 365 Copilot. You need to ensure that all prerequisites are met. Which of the following is a mandatory prerequisite for enabling Microsoft 365 Copilot?

Accepted Answer

Microsoft Entra ID P2 licenses.. Microsoft Entra ID P2 licenses are mandatory because Microsoft 365 Copilot requires Azure AD P2 (now Entra ID P2) for features like identity protection, privileged identity management, and conditional access policies that govern Copilot's data access and security. Without P2, the tenant cannot enforce the necessary identity-based controls for Copilot's AI-driven data retrieval and summarization.

Answer

Microsoft Purview Data Loss Prevention policies.

Answer

An active Azure subscription.

Answer

Exchange Online Plan 2 licenses.

Question 7

An administrator creates a Conditional Access policy as shown in the exhibit. A user reports that they can still access Exchange Online using Outlook (modern authentication). Why does the policy not block the user?

Accepted Answer

The client app type for modern authentication is not specified in the policy.. Option C is correct because the Conditional Access policy does not include the 'Modern authentication clients' client app type. Without this selection, the policy does not apply to modern authentication protocols like OAuth 2.0, which Outlook (modern authentication) uses. The policy only targets the default 'Browser' and 'Mobile apps and desktop clients' categories, but the specific 'Modern authentication clients' toggle must be enabled to enforce controls on apps using modern auth.

Answer

The policy is not assigned to any users or groups.

Answer

The grant control is set to 'Require multi-factor authentication' instead of 'Block'.

Answer

Exchange ActiveSync is not included in the policy.

Question 8

Your company uses Microsoft 365 and has recently deployed Microsoft Intune for mobile device management. You need to ensure that corporate data on iOS devices is protected by preventing users from copying data from managed apps to unmanaged apps. What should you configure?

Accepted Answer

App protection policies.. App protection policies (APP) are the correct choice because they provide mobile application management (MAM) controls that specifically prevent data transfer between managed and unmanaged apps on iOS devices. Unlike device-level policies, APP operates at the application layer, allowing you to restrict copy/paste, cut, and data sharing actions without requiring device enrollment. This directly addresses the requirement to protect corporate data on iOS devices by blocking data leakage to unmanaged apps.

Answer

Mobile application management (MAM) without enrollment.

Answer

Device compliance policies.

Answer

Conditional Access policies.

Question 9

Your organization needs to create a custom domain in Microsoft 365. You have added the domain 'contoso.com' to the tenant. What is the next step to verify domain ownership?

Accepted Answer

Add a TXT record to the public DNS zone.. After adding a custom domain to a Microsoft 365 tenant, the next mandatory step is to prove ownership of the domain by adding a specific TXT record provided by Microsoft to the domain's public DNS zone. Microsoft queries this TXT record to verify that you control the domain before allowing you to use it for services like email or user accounts. This verification step is required by Microsoft's domain onboarding process and must succeed before any other configuration can proceed.

Answer

Create user accounts with the custom domain.

Answer

Configure the email exchange (MX) record.

Answer

Assign licenses to users with the custom domain.

Question 10

Your organization is planning to migrate from on-premises Active Directory to Microsoft Entra ID using Azure AD Connect. You need to ensure that password synchronization is enabled. Which TWO components are required for password synchronization to work?

Accepted Answer

Azure AD Connect with password hash synchronization selected.. Option A is correct because Azure AD Connect with password hash synchronization (PHS) selected is the component that hashes the on-premises Active Directory password and synchronizes it to Microsoft Entra ID. Option E is correct because the Microsoft Entra ID service must process the incoming password hashes and store them in the cloud directory, enabling authentication against Entra ID. Without both the local sync engine (Azure AD Connect) and the cloud-side service, password synchronization cannot function.

Answer

Active Directory Federation Services (AD FS).

Answer

Password Writeback enabled.

Answer

Microsoft Identity Manager (MIM).

Question 11

Your organization uses Microsoft Purview to enforce data loss prevention (DLP) policies. You need to block users from sharing credit card numbers via email. Which THREE components are required to implement this policy?

Accepted Answer

The built-in 'Credit Card Number' sensitive info type.. The built-in 'Credit Card Number' sensitive info type is required because Microsoft Purview DLP policies rely on predefined or custom sensitive information types to detect specific data patterns, such as credit card numbers, using regular expressions and checksums. Without this type, the DLP policy would not know what content to scan for in emails.

Answer

Microsoft Defender for Cloud Apps.

Answer

Microsoft Entra ID P2 licenses.

Question 12

Your organization is deploying Microsoft 365 Copilot. You need to ensure that data security is maintained. Which THREE actions should you take?

Accepted Answer

Enable audit logging in Microsoft 365.. Option C is correct because enabling audit logging in Microsoft 365 is essential for tracking user interactions with Microsoft 365 Copilot, including prompts, responses, and data access events. This provides a forensic trail to detect unauthorized data exposure or misuse, which is a foundational requirement for maintaining data security in AI-powered workloads.

Answer

Disable Microsoft 365 Copilot for all users.

Answer

Block all external sharing for SharePoint and OneDrive.

Question 13

A Global Administrator signs in to the Microsoft 365 admin center but is not prompted for MFA. The policy in the exhibit is the only Conditional Access policy. What is the most likely reason?

Accepted Answer

The administrator is connecting from a trusted IP address that is excluded from MFA.. The policy targets 'All' applications, but the Microsoft 365 admin center might be considered a 'browser' app, which should be covered. However, if the administrator has configured trusted IPs or location-based exclusion, MFA might be skipped. Option D is a common reason. Option A is incorrect because the policy includes Global Administrator. Option B is incorrect because the policy is enabled. Option C is incorrect because the admin center is included via 'All' applications.

Answer

The Microsoft 365 admin center is not included in the policy.

Answer

The policy does not include the Global Administrator role.

Answer

The policy is in 'report-only' mode.

Question 14

Your organization has a hybrid identity setup with Azure AD Connect. You need to ensure that users can reset their passwords from the cloud and have the changes synchronized back to on-premises Active Directory. Which feature must you enable?

Accepted Answer

Password writeback.. Password writeback is the Azure AD Connect feature that enables password changes performed in the cloud (e.g., via Azure AD SSPR) to be written back to on-premises Active Directory. This ensures the on-premises password stays synchronized with the cloud, which is required for hybrid identity scenarios where users reset passwords from the cloud.

Answer

Seamless single sign-on.

Answer

Pass-through authentication.

Answer

Password hash synchronization.

Question 15

Your organization wants to use Microsoft Defender for Office 365 to protect against malicious links and attachments in email. Which Defender plan is required?

Accepted Answer

Microsoft Defender for Office 365 Plan 1.. Microsoft Defender for Office 365 Plan 1 includes Safe Links and Safe Attachments, which are the specific features required to protect against malicious links and attachments in email. These features scan URLs and attachments in real time to block malicious content before it reaches users.

Answer

Exchange Online Protection.

Answer

Microsoft Defender for Endpoint.

Answer

Microsoft Defender for Office 365 Plan 2.