MS-102 Implement and manage Microsoft Entra identity and access Practice Test 10 — 15 Questions

Question 1

Which THREE are valid methods to protect against password spray attacks in Microsoft Entra ID? (Choose three.)

Accepted Answer

Enable password protection to block common passwords. Microsoft Entra ID Password Protection blocks weak and common passwords (e.g., 'Password123') by comparing them against a global banned password list and an optional custom banned list. This directly prevents users from choosing passwords that are likely to be guessed in a password spray attack, where attackers try a few common passwords across many accounts.

Answer

Configure smart lockout to lock accounts after failed attempts

Answer

Require multi-factor authentication for all users

Question 2

Which TWO are prerequisites for implementing Microsoft Entra ID Identity Protection? (Choose two.)

Accepted Answer

Microsoft Entra ID P2 license. Microsoft Entra ID Identity Protection requires a Microsoft Entra ID P2 license because it uses advanced risk detection and automated remediation capabilities (e.g., risk-based Conditional Access policies, user risk and sign-in risk policies) that are only available in the P2 tier. The P1 license provides basic Conditional Access but lacks the risk detection engine and adaptive policies that Identity Protection relies on.

Answer

Microsoft Entra ID P1 license

Answer

Audit logs enabled for sign-in events

Answer

Self-service password reset configured

Question 3

Which THREE are features of Microsoft Entra ID Governance? (Choose three.)

Accepted Answer

Entitlement management. Entitlement management is a core feature of Microsoft Entra ID Governance that enables organizations to manage the lifecycle of access for internal and external users through access packages, catalogs, and policies. It automates access requests, approvals, and assignments, ensuring users have the right access to resources like groups, apps, and SharePoint sites.

Answer

Password protection

Answer

Conditional access policies

Question 4

You are the identity administrator for Contoso Ltd., a multinational company with 10,000 employees. The company uses Microsoft Entra ID P2 licenses for all users. The security team has mandated the following requirements: 1) All users must use multi-factor authentication (MFA) when accessing any cloud app from untrusted networks. 2) Users who are detected as high risk by Identity Protection must be automatically blocked from signing in until an administrator reviews the risk. 3) Guest users from partner organizations must have their access reviewed every 90 days. 4) The IT department must be able to grant temporary administrative access to specific roles for up to 4 hours without requiring approval from a manager. You need to design a solution that meets all requirements with minimal administrative effort. Which combination of actions should you take?

Accepted Answer

Create a conditional access policy requiring MFA from untrusted networks, create a user risk policy to block high-risk users, schedule quarterly access reviews for guests, and configure PIM for time-bound role assignments. It combines conditional access for MFA, user risk policy for blocking, access reviews for guests, and PIM for temporary assignments. Option A is wrong because sign-in risk policy is not for user risk. Option C is wrong because entitlement management is for access packages, not temporary admin roles. Option D is wrong because identity Protection alone cannot block high-risk users and does not cover guest reviews.

Answer

Create a conditional access policy requiring MFA from untrusted networks, create a sign-in risk policy to block high-risk users, schedule quarterly access reviews for guests, and configure PIM for time-bound role assignments

Answer

Enable Identity Protection to automatically block high-risk users, schedule quarterly access reviews for guests, configure PIM for temporary admin access, and enforce MFA via conditional access

Answer

Create a conditional access policy requiring MFA from untrusted networks, create a user risk policy to block high-risk users, schedule quarterly access reviews for guests, and configure entitlement management for temporary admin access

Question 5

Your organization, Contoso, has a Microsoft Entra ID tenant with 50,000 users. You are implementing a zero-trust security model. The following requirements must be met: 1) All access to SaaS applications must be restricted based on user, device, and location. 2) Users accessing from unmanaged devices must only be allowed browser-based access and must accept terms of use. 3) The IT team must be able to grant temporary access to the Global Administrator role for up to 8 hours. 4) All external users must have their access reviewed every 6 months. Which combination of Microsoft Entra features should you use?

Accepted Answer

Conditional access policies, Privileged Identity Management (PIM), access reviews, and terms of use. It combines Conditional Access policies to enforce user, device, and location restrictions; Terms of Use to require acceptance for browser-based access from unmanaged devices; Privileged Identity Management (PIM) to grant time-limited Global Administrator access for up to 8 hours; and Access Reviews to ensure external users are reviewed every 6 months. This set directly addresses all four requirements without introducing unnecessary or conflicting features.

Answer

Conditional access policies, entitlement management, Privileged Identity Management (PIM), and access reviews

Answer

Conditional access policies, Microsoft Entra B2B, Privileged Identity Management (PIM), and access reviews

Answer

Conditional access policies, Identity Protection user risk policy, Privileged Identity Management (PIM), and access reviews

Question 6

Your company, Alpine Ski House, uses Microsoft Entra ID P2. You have the following requirements: 1) Users in the Finance department must be required to use MFA when accessing the financial application, but only if they are not on the corporate network. 2) All users must be automatically blocked if Identity Protection detects their account as compromised (high user risk). 3) You need to ensure that the password change process after a high-risk detection does not allow users to reuse the last 5 passwords. 4) The solution must minimize false positives and allow users to self-remediate if they believe a risk detection is incorrect. Which configuration should you implement?

Accepted Answer

Create a conditional access policy for Finance requiring MFA from non-corporate networks, create a user risk policy to block high-risk users with user feedback enabled, and configure password protection to enforce the last 5 password history. It correctly combines three components: a conditional access policy for Finance users requiring MFA from non-corporate networks (requirement 1), a user risk policy to block high-risk users with user feedback enabled (requirement 2 and 4), and custom password protection to enforce the last 5 password history (requirement 3). User feedback allows users to dismiss false positives. Option A is wrong because sign-in risk policy is for sign-in risk, not user risk. Option C is wrong because it omits password history enforcement. Option D is wrong because it uses a password change policy instead of blocking, which doesn't automatically block compromised accounts.

Answer

Create a conditional access policy for Finance requiring MFA from non-corporate networks, create a sign-in risk policy to block high-risk users, and configure password protection to enforce password history

Answer

Create a conditional access policy for Finance requiring MFA from non-corporate networks, create a user risk policy to block high-risk users, and enable user feedback for risk detections

Answer

Create a conditional access policy for Finance requiring MFA from non-corporate networks, create a user risk policy to require password change, and configure password protection to enforce password history

Question 7

Your organization uses Microsoft Entra ID P2 licenses. You need to configure a Conditional Access policy that requires phishing-resistant authentication for all users when accessing the Azure Management application. Which TWO authentication methods satisfy the requirement?

Accepted Answer

Windows Hello for Business. Windows Hello for Business is a phishing-resistant authentication method because it uses a key pair bound to the device, requiring a biometric or PIN gesture that cannot be intercepted or replayed. It satisfies the Conditional Access requirement for phishing-resistant authentication when accessing the Azure Management application.

Answer

SMS one-time passcode

Answer

Microsoft Authenticator with number matching

Answer

Voice call verification code

Question 8

Refer to the exhibit. You have a Conditional Access policy as shown. A Global Administrator reports that they are not prompted for MFA when accessing the Azure portal. Which is the most likely reason?

Accepted Answer

The policy is in Report-only mode.. The policy is set to 'Report-only' mode, which means it evaluates sign-ins and logs results but does not enforce any controls like MFA. Even though the policy targets Microsoft Azure Management (which includes the Azure portal), the enforcement mode must be 'On' to require MFA. Since it is in Report-only mode, the Global Administrator is not prompted for MFA.

Answer

The Global Administrator role is not included in the policy.

Answer

The user is accessing from a trusted IP address.

Answer

The policy does not include the Azure portal as a target cloud app.

Question 9

Your organization uses Microsoft Entra ID P2 and Microsoft Defender for Cloud Apps. You need to protect a custom SaaS application that uses SAML-based SSO. The application does not support Conditional Access. You want to enforce session controls such as blocking downloads of sensitive files. What should you implement?

Accepted Answer

Deploy Microsoft Defender for Cloud Apps Conditional Access App Control and route the application through Defender for Cloud Apps.. Microsoft Defender for Cloud Apps Conditional Access App Control acts as a reverse proxy that can enforce session policies—such as blocking downloads of sensitive files—on any SAML-based SaaS application, even if the application itself does not support Conditional Access. By routing the application's traffic through Defender for Cloud Apps, you can apply granular session controls at the proxy layer without modifying the application.

Answer

Implement a reverse proxy from a third-party vendor.

Answer

Create a custom application registration and set app roles.

Answer

Configure the application to use Microsoft Entra ID as the identity provider and enable Conditional Access policies.

Question 10

You are troubleshooting a user who cannot sign in to Microsoft Teams. Sign-in logs show error code 53003 with additional details 'Blocked by Conditional Access'. The user is a member of a group that is excluded from the Conditional Access policy. What is the most likely cause?

Accepted Answer

The user is a member of an included group via nested group membership.. The most likely cause is that the user is a member of an included group via nested group membership. Conditional Access policies evaluate direct and nested group memberships at runtime, but the exclusion list does not automatically resolve nested groups unless explicitly configured. If the user is excluded via a group that is a parent of their actual group, the policy may still apply, causing error 53003.

Answer

The Conditional Access policy is in Report-only mode.

Answer

The user's group membership has not yet been updated in the token.

Answer

The user's device is not compliant.

Question 11

Your organization, Contoso Ltd., has a Microsoft 365 E5 tenant with Microsoft Entra ID P2. You have 10,000 users and 500 applications. You are planning to implement a comprehensive identity security strategy. Your requirements are:
1. All users must use phishing-resistant MFA for accessing business-critical applications.
2. Users accessing sensitive HR data must be required to use a compliant device.
3. Any authentication attempt from an anonymous IP address or from a country where Contoso has no business operations must be blocked.
4. All external collaboration must be governed by access reviews that require sponsor approval.
5. You need to monitor and respond to identity risks in real time.

You need to design a solution using Microsoft Entra ID features. Which combination of features should you implement?

Accepted Answer

Deploy Microsoft Entra ID authentication strengths for phishing-resistant MFA. Create Conditional Access policies requiring compliant device for HR apps and blocking anonymous IPs and non-business countries. Use Microsoft Entra Identity Protection for risk detection and automated response. Implement entitlement management with connected organizations and access reviews requiring sponsor approval.. The correct solution. It uses authentication strengths for phishing-resistant MFA (requirement 1), Conditional Access policies with device condition for compliant device (requirement 2), location condition in Conditional Access to block anonymous IPs and non-business countries (requirement 3), and entitlement management with connected organizations and access reviews requiring sponsor approval for external collaboration governance (requirement 4). Identity Protection provides real-time risk detection and automated response (requirement 5). Option B lacks phishing-resistant MFA (uses default MFA) and group owner approval is not sponsor approval. Option C uses security defaults, which do not enforce phishing-resistant MFA or device compliance. Option D uses certificate-based authentication (not necessarily phishing-resistant) and self-service access reviews (no sponsor approval).

Answer

Configure Conditional Access policies with MFA and trusted locations. Use Identity Protection for risk monitoring. Set up access reviews with group owner approval.

Answer

Enable security defaults for all users. Use Microsoft Defender for Cloud Apps to block anonymous IPs. Configure Azure AD access reviews for external users.

Answer

Use certificate-based authentication for all users. Create Conditional Access policies for device compliance. Set up identity protection. Use self-service access reviews for external users.

Question 12

You are the identity administrator for a multinational company with 50,000 users. The company uses Microsoft Entra ID P2 and has recently acquired a small subsidiary with 300 users that uses a different identity provider (Okta). You need to integrate the subsidiary's identities into your Microsoft Entra tenant. Requirements:
- The subsidiary's users must be able to access Microsoft 365 applications using their existing Okta credentials.
- You must minimize changes to the subsidiary's existing infrastructure.
- All access to Microsoft 365 must be governed by your Conditional Access policies.
- Passwords must not be stored in Microsoft Entra ID.

What should you implement?

Accepted Answer

Configure federation between Microsoft Entra ID and Okta so that the subsidiary users authenticate with Okta.. Configure federation between Microsoft Entra ID and Okta. This allows subsidiary users to authenticate using their existing Okta credentials, avoids storing passwords in Microsoft Entra ID, and enables the application of Conditional Access policies. Option A (B2B collaboration) creates guest accounts, which are less suitable for full employees and may require invitation management. Option C (password hash sync) would store password hashes in the cloud, violating the requirement not to store passwords. Option D (MIM) requires on-premises infrastructure and introduces complexity, contradicting the goal of minimizing changes.

Answer

Create B2B collaboration invitations for each subsidiary user.

Answer

Set up password hash synchronization from Okta to Microsoft Entra ID using provisioning agents.

Answer

Deploy Microsoft Identity Manager (MIM) to sync identities from Okta to on-premises AD and then to Microsoft Entra ID.

Question 13

Your organization uses Microsoft 365 Business Premium with Microsoft Entra ID P1. You have 200 users. You need to enforce multi-factor authentication (MFA) for all users accessing the company's CRM application, which is a third-party SaaS app integrated via SAML. The CRM app does not support modern authentication protocols. You want to use a Microsoft solution that does not require additional licenses. What should you use?

Accepted Answer

Create a Conditional Access policy targeting the CRM application and require MFA.. Conditional Access policies in Microsoft Entra ID P1 allow you to target specific cloud applications (including third-party SAML-integrated SaaS apps) and enforce MFA. Since the CRM app does not support modern authentication protocols, Conditional Access can still enforce MFA by requiring a compliant domain-joined device or by using app-enforced restrictions; however, the key is that Conditional Access works at the authentication plane and can require MFA even for legacy apps when combined with a capable authentication method like a one-time passcode or Microsoft Authenticator. This solution uses existing Microsoft Entra ID P1 licensing without additional costs.

Answer

Enable security defaults in Microsoft Entra ID.

Answer

Deploy Microsoft Entra application proxy for the CRM app.

Answer

Configure per-user MFA for users of the CRM app.

Question 14

Your company has a Microsoft 365 E5 tenant with Microsoft Entra ID P2. You are the security administrator. You need to implement a solution that automatically detects and remediates identity risks. Requirements:
- Risky sign-ins (e.g., from anonymous IP addresses) should be automatically blocked.
- Users with confirmed compromised credentials should be forced to reset their password at next sign-in.
- You need to receive alerts when high-risk events occur.
- The solution must minimize false positives.

Which Microsoft Entra ID features should you combine?

Accepted Answer

Enable Microsoft Entra Identity Protection, configure a sign-in risk policy to block high-risk sign-ins, and a user risk policy to require password reset for high-risk users. Set up alerts for risk events.. Uses Identity Protection's risk policies for sign-in risk (block) and user risk (password reset), along with risk detection alerts. Option A (CA policies with generic conditions) does not use risk detection. Option B (identity governance) is about access reviews. Option D (Defender for Cloud Apps) is more for cloud app discovery.

Answer

Set up Microsoft Entra Identity Governance access reviews and enable self-service password reset.

Answer

Configure Conditional Access policies to block sign-ins from anonymous IP addresses and require password reset for all users.

Answer

Deploy Microsoft Defender for Cloud Apps to detect risky sign-ins and configure session policies.

Question 15

Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM) to manage administrative roles. You need to ensure that when a user activates the Global Administrator role, they must provide a justification and the activation is time-bound. Additionally, you want to require approval from the security team for this activation. What should you configure?

Accepted Answer

Modify the PIM role settings for Global Administrator to require justification, set maximum activation duration, and require approval. Privileged Identity Management (PIM) role settings allow you to enforce activation requirements such as justification, maximum activation duration, and approval. These settings are configured directly in the PIM role settings for the Global Administrator role, ensuring that every activation request is justified, time-bound, and requires approval from designated approvers (e.g., the security team).

Answer

Configure an Identity Protection user risk policy for Global Administrators

Answer

Create an Access Review for Global Administrator role

Answer

Configure a Conditional Access policy requiring MFA for Global Administrator activation