MS-102 Implement and manage Microsoft Entra identity and access Practice Test 10 — 15 Questions

Question 1

Your organization uses Microsoft Entra Connect Sync. You need to ensure that specific on-premises Active Directory groups are synchronized to Microsoft Entra ID. What should you configure?

Accepted Answer

Set the sync scope to 'Synchronize selected groups'. Microsoft Entra Connect Sync allows you to scope synchronization to specific groups by selecting 'Synchronize selected groups' in the Microsoft Entra Connect configuration. This setting, available during installation or via the 'Customize synchronization options' task, restricts synchronization to only the on-premises Active Directory groups you explicitly choose, ensuring that only those groups are synced to Microsoft Entra ID.

Answer

Configure attribute-based filtering in Microsoft Entra Connect

Answer

Create a security group in Microsoft Entra ID and add members

Answer

Use the Synchronization Service Manager to select groups

Question 2

You are implementing Microsoft Entra Identity Protection. You need to configure automated responses to medium and high user risk. Which policy should you create?

Accepted Answer

User risk policy. User risk policy in Microsoft Entra Identity Protection is specifically designed to automatically respond to user risk levels (low, medium, high) by triggering remediation actions such as requiring a password change or blocking sign-in. Since the question asks for automated responses to medium and high user risk, the correct policy is the User risk policy, which evaluates risk based on user behavior and leaked credentials.

Answer

Sign-in risk policy

Answer

Conditional Access policy with grant controls

Answer

MFA registration policy

Question 3

You need to configure Microsoft Entra ID to allow users to authenticate using their existing social media accounts. Which identity provider type should you add?

Accepted Answer

Google identity provider. To allow users to authenticate using their existing social media accounts, you need to add a Google identity provider in Microsoft Entra ID. Google is explicitly supported as a social identity provider (IdP) for B2B guest user scenarios, enabling users to sign in with their Gmail accounts. This is configured under External Identities > All identity providers, where you select Google and configure the OAuth 2.0 client ID and secret from the Google API Console.

Answer

OpenID Connect identity provider

Answer

Microsoft account identity provider

Answer

SAML/WS-Fed identity provider

Question 4

Which TWO permissions are required for a custom role to manage Conditional Access policies in Microsoft Entra ID?

Accepted Answer

microsoft.directory/conditionalAccessPolicies/read. To manage Conditional Access policies in Microsoft Entra ID, a custom role requires both the read and update permissions. The 'read' permission (option B) is necessary to view existing policies, while the 'update' permission (option D) is required to modify or configure policy settings. Without both, the role cannot effectively manage policies, as management implies the ability to change them.

Answer

microsoft.directory/conditionalAccessPolicies/allProperties/read

Answer

microsoft.directory/conditionalAccessPolicies/delete

Answer

microsoft.directory/conditionalAccessPolicies/create

Question 5

Which TWO Microsoft Entra ID features can be used to provide just-in-time (JIT) access to privileged roles?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) provides just-in-time (JIT) access by allowing users to activate eligible role assignments for a limited time, with approval workflows and auditing. Privileged Access Groups extend JIT capabilities by enabling time-bound membership in groups that grant access to Microsoft Entra ID roles or Azure resources, ensuring temporary elevation only when needed.

Answer

Identity Protection

Answer

Conditional Access

Answer

Access Reviews

Question 6

Which THREE are valid Microsoft Entra ID license plans that include Identity Protection?

Accepted Answer

Microsoft 365 E5 Security. Microsoft Entra ID Identity Protection is a premium feature that requires either a Microsoft Entra ID P2 license or inclusion in a suite like Microsoft 365 E5 or Microsoft 365 E5 Security. Option C (Microsoft 365 E5 Security) is correct because it includes Microsoft Entra ID P2, which provides full Identity Protection capabilities including risk-based conditional access and user risk policies.

Answer

Microsoft Entra ID P1

Answer

Microsoft 365 E3

Question 7

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their Google Workspace credentials without creating external identities. What should you configure?

Accepted Answer

Configure SAML/WS-Fed identity provider federation with Google Workspace. Configuring SAML/WS-Fed identity provider federation with Google Workspace allows users to sign in using their Google Workspace credentials directly, without creating external identities. This federation establishes a trust relationship between Microsoft Entra ID and Google Workspace as an identity provider, enabling seamless authentication for users who already have Google accounts.

Answer

Enable Microsoft Entra Verified ID for Google Workspace users

Answer

Configure Google as a social identity provider in Microsoft Entra External ID

Answer

Configure Microsoft Entra B2B collaboration with Google Workspace

Question 8

You are configuring Microsoft Entra ID provisioning for a SaaS application that supports SCIM 2.0. The app requires the 'manager' attribute to be mapped. However, the manager attribute is not populated for all users. What should you do to avoid provisioning failures?

Accepted Answer

Configure the attribute mapping to 'Ignore it if null' for the manager attribute. When the 'manager' attribute is not populated for all users, configuring the attribute mapping to 'Ignore it if null' prevents provisioning failures by allowing the provisioning service to skip the attribute when its value is null, rather than attempting to send an empty or invalid value that the SCIM 2.0 endpoint might reject. This setting ensures that only users with a manager value trigger the mapping, avoiding errors for users without a manager.

Answer

Modify the SCIM schema in the application to make manager optional

Answer

Use the expression language to set a default value for the manager attribute

Answer

Delete the manager attribute mapping from the provisioning configuration

Question 9

Your organization uses Microsoft Entra ID and has enabled Microsoft Entra ID Protection. You notice that the number of 'Leaked Credentials' detections is high. What action should you take to automatically remediate this risk?

Accepted Answer

Configure a user risk policy in Microsoft Entra ID Protection to require a password change for high-risk users. A user risk policy in Microsoft Entra ID Protection can be configured to automatically trigger a password change when a user is detected as high risk, such as when leaked credentials are identified. This policy directly remediates the risk by forcing the user to update their compromised credentials, effectively invalidating the leaked password. The other options either do not address the root cause or require manual intervention.

Answer

Use Microsoft Entra ID Protection to automatically reset passwords for all users with leaked credentials

Answer

Configure a conditional access policy to block access for users with high user risk

Answer

Enable Microsoft Entra ID Multifactor Authentication for all users

Question 10

Which TWO of the following are valid conditions that can be used in a Microsoft Entra ID conditional access policy? (Choose two.)

Accepted Answer

Sign-in risk. Sign-in risk (B) and user risk (D) are both valid conditions in Microsoft Entra ID Conditional Access policies. These risk levels are calculated by Microsoft Entra ID Protection using real-time signals such as anonymous IP addresses, atypical travel, or leaked credentials, and can be used to trigger policies like requiring multi-factor authentication or blocking access.

Answer

Network location

Answer

Application sensitivity label

Answer

Device manufacturer

Question 11

Which TWO of the following are benefits of using Microsoft Entra ID Provisioning for cloud HR applications like Workday? (Choose two.)

Accepted Answer

Support for attribute-based provisioning. Microsoft Entra ID Provisioning for cloud HR applications like Workday supports attribute-based provisioning, which allows mapping of HR attributes (e.g., department, location) to Entra ID user attributes using an expression-based mapping engine. This enables dynamic filtering and transformation of user data during synchronization, ensuring that only users meeting specific criteria (e.g., employment status) are provisioned.

Answer

Automatic license assignment

Answer

Automatic password reset for new users

Answer

Automatic creation of user mailboxes in Exchange Online

Question 12

Your organization uses Microsoft Entra ID to manage user identities. You need to ensure that users can reset their own passwords without administrator intervention, but only if they have registered for self-service password reset (SSPR). What should you configure?

Accepted Answer

Enable SSPR for a selected security group containing registered users. Enabling SSPR for a selected security group ensures that only users who have been explicitly added to that group (and thus have registered for SSPR) can reset their own passwords without administrator intervention. This meets the requirement of restricting self-service password reset to registered users only, while still allowing password changes without admin approval.

Answer

Configure a conditional access policy requiring admin approval for password changes

Answer

Configure Microsoft Entra ID Protection user risk policy

Answer

Enable SSPR for All users

Question 13

Your company uses Microsoft Entra ID with hybrid joined devices. You need to enforce multi-factor authentication (MFA) for all cloud app access but want to exclude specific locations (trusted IPs). What is the most efficient way to implement this?

Accepted Answer

Create a Conditional Access policy targeting all cloud apps, requiring MFA, with a condition to exclude trusted IPs. A Conditional Access policy scoped to 'All cloud apps' with a grant control of 'Require multi-factor authentication' and a location condition excluding trusted IPs is the most efficient and granular way to meet the requirement. Conditional Access is the modern, recommended policy engine in Entra ID and supports named locations (trusted IPs) as a first-class condition, so trusted locations bypass MFA while all other access is challenged. This satisfies both the enforcement and exclusion requirements in a single policy.

Answer

Use Microsoft Intune to enforce MFA for all corporate devices

Answer

Enable per-user MFA and exclude trusted IPs in the MFA service settings

Answer

Configure a user risk policy in Microsoft Entra ID Protection to require MFA when risk is medium or higher

Question 14

You are implementing Microsoft Entra ID Governance. You need to automate the creation of guest user accounts when employees submit a request through the company's HR system. What should you use?

Accepted Answer

Lifecycle Workflows. Lifecycle Workflows (D) is the correct choice because it is the Microsoft Entra ID Governance feature designed to automate identity lifecycle processes, including the creation of guest user accounts triggered by events such as HR system submissions. It uses built-in or custom workflows with tasks like 'Create user' and 'Send email' to handle the entire provisioning flow without manual intervention.

Answer

Microsoft Entra Verified ID

Answer

Access Reviews

Answer

Microsoft Entra ID Protection

Question 15

Your organization plans to use Microsoft Entra ID as the identity provider for a third-party SaaS application that supports SAML 2.0. You need to configure single sign-on (SSO) for the application. What should you create in Microsoft Entra ID?

Accepted Answer

An enterprise application with SAML-based sign-on. To configure SSO for a third-party SaaS application that supports SAML 2.0, you must create an enterprise application in Microsoft Entra ID and configure it with SAML-based sign-on. Enterprise applications are designed for integrating third-party applications, and SAML-based sign-on allows Entra ID to act as the identity provider, exchanging SAML assertions for authentication.

Answer

An Application Proxy connector group

Answer

A service principal for Microsoft Graph

Answer

An app registration with OpenID Connect