MS-102 Implement and manage Microsoft Entra identity and access Practice Test 1 — 15 Questions

Question 1

A company uses Microsoft Entra ID for identity management. The security team wants to ensure that users cannot register applications in the tenant to prevent potential data leakage. Which setting should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set 'Users can register applications' to 'No' in User settings. Setting 'Users can register applications' to 'No' in the Microsoft Entra ID User settings explicitly prevents non-admin users from creating application registrations in the tenant. This directly addresses the security team's goal of blocking users from registering apps, which could otherwise expose tenant data through misconfigured or malicious applications.

Answer

Set the 'Admin consent requests' setting to 'Allow'

Answer

Enable the 'Admin consent workflow'

Answer

Set 'Users can consent to apps accessing company data' to 'No'

Question 2

Your organization is migrating from on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can use their existing on-premises passwords to log in to cloud services, while maintaining password policy enforcement on-premises. Which feature should you implement?

Accepted Answer

Pass-through Authentication with Seamless SSO. Pass-through Authentication (PTA) validates passwords directly against on-premises Active Directory, ensuring that on-premises password policies (complexity, expiration, lockout) are enforced for cloud sign-ins. PHS merely synchronizes password hashes to Entra ID and cannot enforce on-premises lockout or account state at authentication time.

Answer

Password Hash Synchronization (PHS)

Answer

Active Directory Federation Services (AD FS)

Answer

Install Azure AD Connect with default settings

Question 3

A multinational company uses Microsoft Entra ID with Conditional Access policies. They have a policy that requires multi-factor authentication (MFA) for all users when accessing the company's custom SaaS application. However, users from the European branch are reporting that they are prompted for MFA every time, even though they have already authenticated via a compliant device. What is the most likely cause?

Accepted Answer

The Conditional Access policy has a session control that requires sign-in frequency. The Conditional Access policy includes a session control that requires sign-in frequency, which forces users to re-authenticate with MFA at a specified interval regardless of device compliance or previous authentication. Even if the device is compliant and the user has already authenticated, the sign-in frequency control overrides session persistence and prompts for MFA again based on the configured time period (e.g., every hour). This explains why European branch users are repeatedly prompted for MFA despite having authenticated via a compliant device.

Answer

The user's device is not marked as compliant

Answer

The user has per-user MFA enabled

Answer

The policy includes a location condition that is not met

Question 4

You are configuring Microsoft Entra ID Protection. You want to automatically respond to a specific risk level by requiring the user to change their password. Which risk policy should you configure?

Accepted Answer

User risk policy. The user risk policy in Microsoft Entra ID Protection can be configured to automatically respond to elevated user risk by requiring a password change. The sign-in risk policy (Option B) typically triggers MFA or blocks access based on sign-in risk, not user risk. The session risk policy (Option C) is not a standard risk policy. The MFA registration policy (Option A) is unrelated to risk-based password changes. Therefore, the correct policy for requiring a password change based on user risk is the user risk policy.

Answer

MFA registration policy

Answer

Sign-in risk policy

Answer

Session risk policy

Question 5

An organization is implementing Microsoft Entra Verified ID for verifiable credentials. They want to issue credentials to employees that can be used to prove employment status to third parties. Which component must be created first?

Accepted Answer

A credential manifest in the Microsoft Entra admin center. The credential manifest defines the rules for issuing a verifiable credential, including the claims schema, display information, and issuance policies. In Microsoft Entra Verified ID, you must create the credential manifest in the Entra admin center before any credentials can be issued, as it serves as the template that governs the credential's structure and validation. Without a manifest, there is no definition for what the credential contains or how it should be presented.

Answer

A presentation request policy

Answer

A distributed ledger network

Answer

A decentralized identifier (DID) for the organization

Question 6

Your company uses Microsoft Entra ID and has a hybrid identity with PHS. You need to ensure that when an on-premises user account is disabled, the corresponding cloud user is also blocked from signing in within 5 minutes. What should you configure?

Accepted Answer

Deploy Azure AD Connect cloud sync. Azure AD Connect cloud sync can be configured to synchronize the on-premises Active Directory 'userAccountControl' attribute, which includes the 'ACCOUNTDISABLE' flag. When an on-premises user account is disabled, this flag changes, and cloud sync can trigger a block on the corresponding cloud user's sign-in within a few minutes (typically under 5 minutes) due to its near-real-time sync cycle. This meets the requirement without relying on the slower default sync interval of Azure AD Connect.

Answer

Enable password writeback

Answer

Configure Azure AD Connect to sync the 'userAccountControl' attribute

Answer

Configure Microsoft Entra Connect Sync to use filtered synchronization

Question 7

A company uses Microsoft Entra ID and has enabled self-service password reset (SSPR). Users are required to register for SSPR. Management wants to ensure that users from the HR department, who handle sensitive data, must use two methods for authentication during SSPR, while other users can use one method. What is the best way to achieve this?

Accepted Answer

This is not possible because SSPR authentication method requirements are tenant-wide. SSPR authentication method requirements in Microsoft Entra ID are configured at the tenant level, not per user or group. This means you cannot specify that one group of users must use two methods while others use one; the number of methods required applies uniformly to all users enabled for SSPR. Therefore, option D is correct because the requirement cannot be differentiated by department or group.

Answer

Create a separate SSPR policy for the HR department using PowerShell

Answer

Use Microsoft Entra ID Governance to create an access package that requires two methods

Answer

Assign the HR users to a group and configure the SSPR policy for that group in the Entra admin center

Question 8

Your organization uses Microsoft Defender for Cloud Apps. You want to set up a policy that automatically suspends a user if they download more than 100 files from SharePoint Online within 10 minutes. Which type of policy should you create?

Accepted Answer

Activity policy. An Activity policy in Microsoft Defender for Cloud Apps monitors user activities across connected apps and can trigger automated actions, such as suspending a user, when a specific threshold of downloads from SharePoint Online is exceeded within a defined time window. This policy type is designed to detect anomalous behavior patterns like mass file downloads, making it the correct choice for this scenario.

Answer

Session policy

Answer

File policy

Answer

App discovery policy

Question 9

You are configuring Microsoft Entra ID for a new organization. The CIO wants to ensure that all external users who are invited to collaborate via Microsoft Entra B2B must go through an approval process before gaining access. Which setting should you configure?

Accepted Answer

Set 'External collaboration settings' to restrict invitations to specific admins. The 'External collaboration settings' in Microsoft Entra ID allow you to restrict who can invite external users. By setting the invitation restriction to 'Only users assigned to specific admin roles can invite', you ensure that all B2B collaboration invitations must be initiated by authorized admins, effectively requiring an approval process before external users gain access.

Answer

Create a Conditional Access policy requiring approval for external users

Answer

Enable guest self-service sign-up via user flows

Answer

Enable Identity Protection for guest users

Question 10

Which TWO of the following are valid authentication methods in Microsoft Entra ID that can be used as part of a Conditional Access policy? (Select two.)

Accepted Answer

Password. Password is a valid authentication method in Microsoft Entra ID that can be used as part of a Conditional Access policy. Conditional Access policies evaluate signals including user and group membership, location, device state, and the authentication method used. Password authentication is a primary method that can be controlled or restricted via Conditional Access, for example by requiring a stronger method when a password is used from an untrusted location.

Answer

SMS sign-in

Answer

Hardware OATH token

Answer

FIDO2 security key

Question 11

Which THREE of the following are required to configure Microsoft Entra ID Governance for automated user provisioning to a third-party SaaS application? (Select three.)

Accepted Answer

Assign the access package to a catalog. To configure automated user provisioning to a third-party SaaS application via Microsoft Entra ID Governance, the essential steps are creating an access package that includes the application (Option B) and assigning that access package to a catalog (Option A). The catalog serves as a container for grouping resources and access policies. Options C and D involve directory synchronization tools that are not required for provisioning to cloud SaaS apps; provisioning works from the cloud directory directly. Option E is for on-premises applications, not cloud SaaS apps. Therefore, only A and B are correct. Note that the question asks for three, but in practice only two are strictly required; the third common step (configuring automatic provisioning on the app side) is not listed among the options.

Answer

Set up Microsoft Entra Connect Sync for the application

Answer

Migrate from Azure AD Connect to Azure AD Connect cloud sync

Answer

Install and configure a provisioning agent in your on-premises environment

Question 12

Which TWO of the following are valid methods to enforce device compliance in a Conditional Access policy? (Select two.)

Accepted Answer

Require Microsoft Entra hybrid joined device. Requiring a Microsoft Entra hybrid joined device ensures the device is joined to both on-premises Active Directory and Microsoft Entra ID, which allows Conditional Access to enforce compliance based on the device's identity and configuration. Option E is correct because requiring the device to be marked as compliant relies on Microsoft Intune (or another MDM) to evaluate device health and policy adherence, and then Conditional Access blocks access if the device is not compliant.

Answer

Require Microsoft Authenticator

Answer

Require session persistence

Answer

Require approved client app

Question 13

You are reviewing a Conditional Access policy in JSON format. The policy is applied to all users accessing Office 365 from trusted locations. What is the intended behavior of this policy?

Accepted Answer

Users must provide MFA or use a compliant device. The policy grants access when users are in a trusted location and either provide MFA or use a compliant device. The 'OR' condition between MFA and device compliance means that satisfying either requirement is sufficient, not both. This is the standard behavior when multiple controls are assigned with 'Require one of the selected controls' in Conditional Access.

Answer

Users are blocked if they are not using a compliant device

Answer

Users must provide MFA and use a compliant device

Answer

Users only need to provide MFA regardless of device

Question 14

You are reviewing directory settings for Microsoft 365 Groups. Based on the exhibit, which statement is true?

Accepted Answer

All users in the tenant can create Microsoft 365 Groups. The exhibit shows that under 'Group creation settings,' the option 'Set which users can create Microsoft 365 Groups' is configured to 'Everyone.' This means all users in the tenant are permitted to create groups, regardless of membership in any security group. Therefore, option D is correct because the setting explicitly allows all users to create Microsoft 365 Groups.

Answer

Only users in a specific security group can create Microsoft 365 Groups

Answer

A naming policy is enforced for new groups

Answer

Groups must have a classification label

Question 15

An administrator runs the Azure CLI command shown in the exhibit. What is the result of this command?

Accepted Answer

A new application registration is created with requested permissions to Graph. The Azure CLI command `az ad app create --display-name 'MyApp' --required-resource-accesses '[{"resourceAppId":"00000003-0000-0000-c000-000000000000","resourceAccess":[{"id":"e1fe6dd8-ba31-4d61-89e7-88639da4923c","type":"Scope"}]}]'` creates a new application registration in Microsoft Entra ID. The `--required-resource-accesses` parameter specifies the Microsoft Graph (resourceAppId `00000003-0000-0000-c000-000000000000`) and the permission with ID `e1fe6dd8-ba31-4d61-89e7-88639da4923c` (which corresponds to the `User.Read` delegated permission). This registers the app with requested permissions to Microsoft Graph, but does not grant admin consent or configure sign-in audience.

Answer

An existing application registration is updated

Answer

The application is configured with single-tenant sign-in audience

Answer

An admin consent is granted for the Microsoft Graph permissions