MS-102 Implement and manage Microsoft Entra identity and access Practice Test 2 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID to manage user identities. You need to ensure that users can sign in using their existing social media accounts, such as Google or Facebook. Which identity solution should you configure?

Accepted Answer

External identities. External identities in Microsoft Entra ID allow you to configure identity providers such as Google and Facebook, enabling users to sign in with their existing social media accounts. This is achieved by setting up federation with OAuth 2.0 and OpenID Connect protocols, which is the correct solution for the scenario described.

Answer

Microsoft Entra B2B collaboration

Answer

Managed identities

Answer

Microsoft Entra Identity Protection

Question 2

Your company has a Microsoft 365 E5 subscription and uses Microsoft Entra ID. Users report that they are frequently prompted for multi-factor authentication (MFA) even after signing in successfully. You want to minimize these prompts while maintaining security. What should you configure?

Accepted Answer

Configure Authentication Session Management. Option A is correct because configuring Authentication Session Management in a Conditional Access policy allows you to control how often users are prompted for MFA by setting the sign-in frequency (e.g., every 24 hours) or persistent browser session (e.g., 'Remember MFA for 14 days'). This directly addresses the user complaint of frequent MFA prompts while maintaining security by enforcing reauthentication at defined intervals.

Answer

Modify the Conditional Access policy to require MFA for all apps

Answer

Change the per-user MFA state to Disabled

Answer

Adjust Identity Protection user risk policy

Question 3

You are a Microsoft 365 administrator. Your organization uses Microsoft Entra ID and Microsoft Intune for device management. You need to ensure that only compliant devices can access corporate email via Microsoft Outlook on mobile devices. What should you configure?

Accepted Answer

Create a Conditional Access policy with 'Require device to be marked as compliant'. Option A is correct because Conditional Access policies in Microsoft Entra ID can enforce 'Require device to be marked as compliant' as a grant control. This ensures that only devices meeting your Intune compliance policies (e.g., encryption, OS version, threat level) are allowed to access corporate email via Outlook on mobile devices. The policy evaluates device compliance status reported by Intune and blocks access if the device is non-compliant.

Answer

Deploy app protection policies (MAM) for Outlook

Answer

Enable Microsoft Entra device registration

Answer

Create a device compliance policy in Intune

Question 4

Your organization is implementing a hybrid identity solution. You want to synchronize on-premises Active Directory users to Microsoft Entra ID. Which tool should you use?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect (formerly Azure AD Connect) is the correct tool for synchronizing on-premises Active Directory users to Microsoft Entra ID in a hybrid identity solution. It supports both password hash synchronization, pass-through authentication, and federation with Active Directory Federation Services (AD FS), making it the primary and most feature-rich sync tool for complex hybrid environments.

Answer

Microsoft Identity Manager

Answer

Microsoft Entra Cloud Sync

Answer

Microsoft Entra Connect Sync

Question 5

Your company has a Microsoft Entra tenant with 5,000 users. You need to delegate the ability to reset user passwords to the helpdesk team, but only for users in the Sales department. What is the most efficient way to achieve this?

Accepted Answer

Create an administrative unit for Sales, add Sales users, then assign a custom role scoped to that administrative unit. Option C is correct because administrative units allow scoping administrative roles to a subset of users, such as a department. Option A is wrong because assigning the global admin role grants too much permission. Option B is wrong because assigning a custom role without scope would apply to all users. Option D is wrong because creating a new group and assigning role to the group still applies to all users in the group, not scoped by department.

Answer

Create a security group for Sales, then assign a custom role to the group

Answer

Create a custom role with password reset permissions and assign it to helpdesk

Answer

Add helpdesk users to the Global Administrator role

Question 6

Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM) to manage administrative roles. You need to ensure that when a user activates the Global Administrator role, they must provide a justification and the activation is time-bound. Additionally, you want to require approval from the security team for this activation. What should you configure?

Accepted Answer

Modify the PIM role settings for Global Administrator to require justification, set maximum activation duration, and require approval. Option D is correct because Privileged Identity Management (PIM) role settings allow you to enforce activation requirements such as justification, maximum activation duration, and approval. These settings are configured directly in the PIM role settings for the Global Administrator role, ensuring that every activation request is justified, time-bound, and requires approval from designated approvers (e.g., the security team).

Answer

Configure an Identity Protection user risk policy for Global Administrators

Answer

Create an Access Review for Global Administrator role

Answer

Configure a Conditional Access policy requiring MFA for Global Administrator activation

Question 7

You are implementing Microsoft Entra Verified ID. Which technology does it use to create decentralized digital identities?

Accepted Answer

Decentralized Identifiers (DIDs). Microsoft Entra Verified ID uses Decentralized Identifiers (DIDs) as the core technology to create decentralized digital identities. DIDs are globally unique identifiers that are cryptographically verifiable and do not rely on a centralized registry, enabling self-sovereign identity scenarios where users control their own identity data.

Answer

OpenID Connect

Answer

OAuth 2.0

Answer

Security Assertion Markup Language (SAML)

Question 8

Your organization uses Microsoft Entra ID and has enabled Microsoft Entra Domain Services (Azure AD DS). You need to ensure that legacy applications that require NTLM authentication can still authenticate against the managed domain. What should you configure?

Accepted Answer

Enable NTLM v1 authentication on the managed domain. Legacy applications that require NTLM authentication must have NTLM v1 enabled on the managed domain because Azure AD DS, by default, disables NTLM v1 for security reasons. Enabling NTLM v1 allows these older applications to authenticate against the managed domain using the NTLM protocol, which is necessary when Kerberos is not supported.

Answer

Configure Kerberos delegation

Answer

Disable NTLM v1 authentication on the managed domain

Answer

Enable password hash synchronization for the managed domain

Question 9

Your company has a Microsoft 365 E5 subscription and uses Microsoft Entra ID. You have configured Microsoft Entra Identity Governance. You need to create an access review for all guest users in the tenant to ensure their access is still required. The review should be recurring every 90 days and should auto-remove guests if they are not approved. What should you configure?

Accepted Answer

Create an access review for all guest users with a recurrence of 90 days and auto-apply results. Option B is correct because creating an access review for all guest users with a recurrence of 90 days and auto-apply results directly meets the requirement: it reviews guest access every 90 days and automatically removes guests who are not approved. Access reviews in Microsoft Entra ID Governance allow you to scope reviews to guest users, set recurrence, and enable auto-apply to enforce removal without manual intervention.

Answer

Configure a Conditional Access policy to block guests after 90 days

Answer

Configure PIM settings for guest users

Answer

Create an access package in entitlement management for guest users

Question 10

You are configuring Microsoft Entra ID for your organization. You need to enable passwordless authentication for users. Which TWO authentication methods are passwordless and supported by Microsoft Entra ID?

Accepted Answer

Microsoft Authenticator app. The Microsoft Authenticator app supports passwordless authentication by allowing users to approve sign-in requests via a notification or a number match on their mobile device, eliminating the need for a password. FIDO2 security keys are also a passwordless method, using public-key cryptography to authenticate users without a password, and are fully supported by Microsoft Entra ID for both Azure AD joined and hybrid joined devices.

Answer

SMS-based one-time passcode (OTP)

Answer

Hardware OATH tokens

Answer

OAuth 2.0 device authorization grant

Question 11

Your organization uses Microsoft Entra ID and has strict security requirements. You need to implement a Zero Trust security model. Which THREE of the following are foundational principles of Zero Trust that should be implemented?

Accepted Answer

Use least privilege access. Option C is correct because least privilege access is a foundational principle of Zero Trust, ensuring users and devices are granted only the minimum permissions necessary to perform their tasks. In Microsoft Entra ID, this is implemented through features like Privileged Identity Management (PIM) and conditional access policies that restrict access based on role and context, reducing the attack surface.

Answer

Assume trust based on location

Answer

Segment access

Question 12

Your company uses Microsoft Entra ID for identity management. You are planning to implement Conditional Access policies. Which TWO components are required to create a Conditional Access policy?

Accepted Answer

Assignments (users, groups, cloud apps, conditions). A Conditional Access policy requires assignments (users/groups, cloud apps, conditions) and access controls (grant or block, session controls). Option B (assignments) and Option C (access controls) are the two main components. Option A (identity protection) is a separate service, not a required component. Option D (Azure AD roles) are not part of policy creation. Option E (MFA registration) is a prerequisite but not a component of the policy.

Answer

MFA registration status

Answer

Identity Protection risk policies

Answer

Azure AD roles

Question 13

You are reviewing the following Conditional Access policy JSON in Microsoft Entra ID. What does this policy do?

Accepted Answer

Requires MFA for all users except Admin@contoso.com when accessing any app from mobile apps or desktop clients. Option C is correct because the Conditional Access policy JSON targets all users except a specific group containing Admin@contoso.com, applies to all cloud apps, and requires MFA for the 'Browser' and 'Mobile apps and desktop clients' client app types. This effectively enforces MFA for all users except the excluded admin when accessing any app from either web browsers or native/mobile clients, as defined by the 'clientAppTypes' condition.

Answer

Requires MFA for all users accessing all apps from any client type

Answer

Blocks access for all users except Admin@contoso.com when accessing from mobile apps

Answer

Requires MFA for all users accessing all apps from any device

Question 14

You are a Microsoft 365 administrator. You run the Get-MgPolicyCrossTenantAccessPolicyDefault cmdlet and see the exhibit output. What does this configuration imply?

Accepted Answer

Your tenant will accept MFA claims from all external Microsoft Entra tenants. The Get-MgPolicyCrossTenantAccessPolicyDefault cmdlet retrieves the default cross-tenant access policy settings. The exhibit output shows that the InboundTrust property is configured to accept MFA claims from all external Microsoft Entra tenants, meaning your tenant will trust MFA claims made by users from any external Entra tenant without requiring them to re-authenticate.

Answer

Your tenant will accept compliant device claims from external tenants

Answer

Your tenant will accept MFA claims from a specific partner tenant

Answer

Your tenant blocks all inbound B2B collaboration

Question 15

You run the Azure CLI command shown in the exhibit. What does the output represent?

Accepted Answer

The application ID for Microsoft Graph. The Azure CLI command `az ad sp show --id 00000003-0000-0000-c000-000000000000` retrieves the service principal for the Microsoft Graph API. The GUID `00000003-0000-0000-c000-000000000000` is the well-known application ID for Microsoft Graph in Microsoft Entra ID (formerly Azure AD). This ID is used to grant permissions and consent for Microsoft Graph API access.

Answer

The application ID for Microsoft Entra ID

Answer

The application ID for Exchange Online

Answer

The application ID for SharePoint Online