MS-102 Implement and manage Microsoft Entra identity and access Practice Test 11 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID and has strict security requirements. You need to implement a Zero Trust security model. Which THREE of the following are foundational principles of Zero Trust that should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use least privilege access. Least privilege access is a foundational principle of Zero Trust, ensuring users and devices are granted only the minimum permissions necessary to perform their tasks. In Microsoft Entra ID, this is implemented through features like Privileged Identity Management (PIM) and conditional access policies that restrict access based on role and context, reducing the attack surface.

Answer

Assume trust based on location

Answer

Segment access

Question 2

You are reviewing the following Conditional Access policy JSON in Microsoft Entra ID. What does this policy do?

Accepted Answer

Requires MFA for all users except Admin@contoso.com when accessing any app from mobile apps or desktop clients. The Conditional Access policy JSON targets all users except a specific group containing Admin@contoso.com, applies to all cloud apps, and requires MFA for the 'Browser' and 'Mobile apps and desktop clients' client app types. This effectively enforces MFA for all users except the excluded admin when accessing any app from either web browsers or native/mobile clients, as defined by the 'clientAppTypes' condition.

Answer

Requires MFA for all users accessing all apps from any client type

Answer

Blocks access for all users except Admin@contoso.com when accessing from mobile apps

Answer

Requires MFA for all users accessing all apps from any device

Question 3

Your company uses Microsoft Entra ID and has a custom line-of-business application that supports SAML-based SSO. You need to configure the application to use Microsoft Entra ID as the identity provider. Which enterprise application configuration should you use?

Accepted Answer

SAML-based Sign-on. The application supports SAML-based SSO, so the correct enterprise application configuration is SAML-based Sign-on. This allows Microsoft Entra ID to act as the identity provider by exchanging SAML assertions with the application, enabling federated authentication.

Answer

Linked Sign-on

Answer

Password-based Sign-on

Answer

OpenID Connect-based Sign-on

Question 4

Your organization uses Microsoft Entra ID and has strict security requirements. You need to implement a Zero Trust security model. Which THREE of the following are foundational principles of Zero Trust that should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure External Identities and add identity providers for social networks. Microsoft Entra ID supports External Identities, which allow you to add social identity providers (Microsoft, Google, Facebook) as external authentication sources. This enables users to sign in with their existing social accounts by configuring federation with those providers using OAuth 2.0 or OpenID Connect protocols, without needing to create separate Entra ID accounts.

Answer

Configure Conditional Access policies for social identity providers

Answer

Configure Microsoft Entra Connect to sync social account attributes

Answer

Configure self-service password reset (SSPR)

Question 5

Your organization uses Microsoft Entra Conditional Access. You need to block access from countries where your company does not operate. The list of blocked countries changes frequently. What is the most efficient way to manage this?

Accepted Answer

Create Named Locations for blocked countries and use them in Conditional Access. Named Locations in Microsoft Entra Conditional Access allow you to define countries by IP ranges and then use those locations in a policy to block access. This is the most efficient approach because you can update the list of blocked countries in the Named Locations configuration without modifying the Conditional Access policy itself, which is ideal when the list changes frequently.

Answer

Enable Microsoft Entra multifactor authentication for all users from blocked countries

Answer

Create a Conditional Access policy that blocks all locations except the allowed countries

Answer

Use IP ranges in Conditional Access to block specific country IPs

Question 6

Your organization uses Microsoft Entra ID. You need to implement a solution that allows users to sign in without a password using their smartphone. Which TWO authentication methods can be used?

Accepted Answer

Microsoft Authenticator app (phone sign-in). The Microsoft Authenticator app supports phone sign-in, which allows users to authenticate by approving a notification or entering a number displayed on the screen, eliminating the need for a password. FIDO2 security keys enable passwordless authentication using hardware-based public/private key cryptography, meeting the requirement for smartphone-based sign-in when the key is connected via USB or NFC. Both methods are supported by Microsoft Entra ID for passwordless authentication.

Answer

Temporary Access Pass

Answer

Windows Hello for Business

Answer

Text message (SMS) verification code

Question 7

You need to enforce multifactor authentication (MFA) for all users in a Microsoft Entra ID tenant. The solution must not require users to register security info if they already have it. Which approach should you use?

Accepted Answer

Create a Conditional Access policy that requires MFA for all users. A Conditional Access policy can require MFA for all users while respecting existing security info registration. The policy triggers MFA during sign-in but does not force re-registration if the user has already registered. This meets the requirement of not requiring users to register security info if they already have it.

Answer

Use identity protection to enforce MFA for risky sign-ins

Answer

Assign MFA per user in the Microsoft Entra admin center

Answer

Enable security defaults

Question 8

Your organization uses Microsoft Entra ID and has strict security requirements. You need to implement a Zero Trust security model. Which THREE of the following are foundational principles of Zero Trust that should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure SAML/WS-Fed identity provider federation with Google Workspace. Configuring SAML/WS-Fed identity provider federation with Google Workspace allows users to sign in using their Google Workspace credentials directly, without creating external identities. This federation establishes a trust relationship between Microsoft Entra ID and Google Workspace as an identity provider, enabling seamless authentication for users who already have Google accounts.

Answer

Enable Microsoft Entra Verified ID for Google Workspace users

Answer

Configure Google as a social identity provider in Microsoft Entra External ID

Answer

Configure Microsoft Entra B2B collaboration with Google Workspace

Question 9

You are configuring Microsoft Entra ID provisioning for a SaaS application that supports SCIM 2.0. The app requires the 'manager' attribute to be mapped. However, the manager attribute is not populated for all users. What should you do to avoid provisioning failures?

Accepted Answer

Configure the attribute mapping to 'Ignore it if null' for the manager attribute. When the 'manager' attribute is not populated for all users, configuring the attribute mapping to 'Ignore it if null' prevents provisioning failures by allowing the provisioning service to skip the attribute when its value is null, rather than attempting to send an empty or invalid value that the SCIM 2.0 endpoint might reject. This setting ensures that only users with a manager value trigger the mapping, avoiding errors for users without a manager.

Answer

Modify the SCIM schema in the application to make manager optional

Answer

Use the expression language to set a default value for the manager attribute

Answer

Delete the manager attribute mapping from the provisioning configuration

Question 10

You are deploying Microsoft Entra ID Governance. Which THREE capabilities should you include to meet compliance requirements for access recertification and lifecycle management?

Accepted Answer

Access Reviews. Access Reviews (B) are a core capability of Microsoft Entra ID Governance that directly enables compliance-driven access recertification. They allow administrators to create recurring reviews of group memberships, application assignments, and privileged roles, ensuring that only authorized users retain access. This satisfies regulatory requirements like SOX, GDPR, or HIPAA by providing attestation workflows and audit trails.

Answer

Identity Protection

Answer

B2B Collaboration

Question 11

You need to configure self-service password reset (SSPR) for users in Microsoft Entra ID. Which license is required?

Accepted Answer

Microsoft Entra ID P1. Self-service password reset (SSPR) requires a Microsoft Entra ID P1 or P2 license. Both Microsoft 365 F3 and Microsoft 365 E3 include Microsoft Entra ID P1 licenses, which support SSPR. However, the question directly asks which license is required for SSPR, and the correct answer is the standalone Microsoft Entra ID P1 license. While F3 and E3 include this license, they are suite licenses and not the specific license component being asked for.

Answer

Microsoft 365 F3

Answer

Microsoft 365 E3

Answer

Microsoft Entra ID Free

Question 12

Your company uses Microsoft Entra ID P2. You need to configure Identity Protection to automatically remediate high-risk users. Which THREE actions can you configure?

Accepted Answer

Require password change. Identity Protection's automated remediation for high-risk users can be configured to require a password change as a risk-based policy action. This forces the user to reset their password, which invalidates any compromised credentials and reduces the risk level. In Microsoft Entra ID P2, this is a native remediation action available in Conditional Access policies integrated with Identity Protection.

Answer

Send email to user

Answer

Require re-registration of MFA

Question 13

Refer to the exhibit. The conditional access policy JSON shown above is applied to all users. A user authenticates from a trusted location and wants to access a cloud app. Which combination of controls will be enforced?

Accepted Answer

MFA, terms of use acceptance, sign-in frequency of 1 hour, and persistent browser never. The conditional access policy JSON explicitly defines three grant controls: 'mfa' (require multi-factor authentication), 'termsOfUse' (require terms of use acceptance), and 'signInFrequency' (value 3600 seconds = 1 hour) combined with 'persistentBrowser' set to 'never'. Since the policy is applied to all users and the user authenticates from a trusted location, all specified controls are enforced simultaneously, as conditional access policies apply all grant controls in the 'grantControls' block unless overridden by session controls.

Answer

Terms of use acceptance and persistent browser never only

Answer

MFA and terms of use acceptance only

Answer

MFA and sign-in frequency of 1 hour only

Question 14

Your organization, Fabrikam Inc., uses Microsoft Entra ID with a hybrid identity configuration. You have 500 cloud-only users and 5,000 synced users from on-premises Active Directory. The company wants to implement a passwordless authentication strategy. The following requirements must be met: 1) All users must be able to sign in without a password on Windows 10/11 devices that are Microsoft Entra joined. 2) Users who are not assigned a mobile phone must be able to use a security key (FIDO2). 3) The solution must work for both cloud-only and synced users. 4) The passwordless method should require the lowest administrative overhead for enrollment. Which passwordless authentication method should you recommend?

Accepted Answer

FIDO2 security keys. FIDO2 security keys (option C) meet all requirements: they work on Microsoft Entra joined Windows 10/11 devices without a password, support both cloud-only and synced users, and provide a security key option for users without mobile phones as required. Enrollment is simple (plug in and register via Windows Settings) with low administrative overhead (can be pre-provisioned or self-enrolled). Option D (Windows Hello for Business) is incorrect because it uses PIN or biometric on the device, not a separate security key, so it fails requirement 2. Option A (certificate-based authentication) requires PKI infrastructure and certificate enrollment, increasing administrative overhead. Option B (Microsoft Authenticator app) requires a mobile phone, which conflicts with requirement 2.

Answer

Certificate-based authentication

Answer

Microsoft Authenticator app

Answer

Windows Hello for Business

Question 15

Your company, Northwind Traders, uses Microsoft Entra ID P1. You need to allow employees to reset their own passwords without help desk intervention. The company policy requires that password resets be secured with two verification methods. Additionally, users must not be able to reuse the last 10 passwords. The solution must minimize administrative effort. What should you configure?

Accepted Answer

Enable Microsoft Entra self-service password reset (SSPR) and configure the number of methods required to reset to 2, and set password history to enforce last 10 passwords. Microsoft Entra self-service password reset (SSPR) allows users to reset their own passwords without help desk intervention. By configuring the number of methods required to reset to 2, you meet the two-verification-method policy requirement. Setting the password history to enforce the last 10 passwords prevents reuse, and since SSPR is a cloud-native feature, it minimizes administrative effort by avoiding on-premises dependencies.

Answer

Enable Privileged Identity Management (PIM) for all users

Answer

Enable Microsoft Entra password protection and configure password history in the on-premises policy

Answer

Configure a conditional access policy to require MFA during password change