MS-102 Implement and manage Microsoft Entra identity and access Practice Test 2 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID to manage user identities. You need to ensure that users can sign in using their existing social media accounts, such as Google or Facebook. Which identity solution should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

External identities. External identities in Microsoft Entra ID allow you to configure identity providers such as Google and Facebook, enabling users to sign in with their existing social media accounts. This is achieved by setting up federation with OAuth 2.0 and OpenID Connect protocols, which is the correct solution for the scenario described.

Answer

Microsoft Entra B2B collaboration

Answer

Managed identities

Answer

Microsoft Entra Identity Protection

Question 2

Your company has a Microsoft 365 E5 subscription and uses Microsoft Entra ID. Users report that they are frequently prompted for multi-factor authentication (MFA) even after signing in successfully. You want to minimize these prompts while maintaining security. What should you configure?

Accepted Answer

Configure Authentication Session Management. Configuring Authentication Session Management in a Conditional Access policy allows you to control how often users are prompted for MFA by setting the sign-in frequency (e.g., every 24 hours) or persistent browser session (e.g., 'Remember MFA for 14 days'). This directly addresses the user complaint of frequent MFA prompts while maintaining security by enforcing reauthentication at defined intervals.

Answer

Modify the Conditional Access policy to require MFA for all apps

Answer

Change the per-user MFA state to Disabled

Answer

Adjust Identity Protection user risk policy

Question 3

You are a Microsoft 365 administrator. Your organization uses Microsoft Entra ID and Microsoft Intune for device management. You need to ensure that only compliant devices can access corporate email via Microsoft Outlook on mobile devices. What should you configure?

Accepted Answer

Create a Conditional Access policy with 'Require device to be marked as compliant'. Conditional Access policies in Microsoft Entra ID can enforce 'Require device to be marked as compliant' as a grant control. This ensures that only devices meeting your Intune compliance policies (e.g., encryption, OS version, threat level) are allowed to access corporate email via Outlook on mobile devices. The policy evaluates device compliance status reported by Intune and blocks access if the device is non-compliant.

Answer

Deploy app protection policies (MAM) for Outlook

Answer

Enable Microsoft Entra device registration

Answer

Create a device compliance policy in Intune

Question 4

Your organization is implementing a hybrid identity solution. You want to synchronize on-premises Active Directory users to Microsoft Entra ID. Which tool should you use?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect (formerly Azure AD Connect) is the correct tool for synchronizing on-premises Active Directory users to Microsoft Entra ID in a hybrid identity solution. It supports both password hash synchronization, pass-through authentication, and federation with Active Directory Federation Services (AD FS), making it the primary and most feature-rich sync tool for complex hybrid environments.

Answer

Microsoft Identity Manager

Answer

Microsoft Entra Cloud Sync

Answer

Microsoft Entra Connect Sync

Question 5

Your company has a Microsoft Entra tenant with 5,000 users. You need to delegate the ability to reset user passwords to the helpdesk team, but only for users in the Sales department. What is the most efficient way to achieve this?

Accepted Answer

Create an administrative unit for Sales, add Sales users, then assign a custom role scoped to that administrative unit. Administrative units allow scoping administrative roles to a subset of users, such as a department. By creating an administrative unit for Sales, adding Sales users, and assigning a custom role with password reset permissions to the helpdesk team scoped to that administrative unit, you can delegate password resets for only Sales users. Option B is wrong because a security group alone does not provide scope; the role assignment would still apply to all group members but without department scope. Option C is wrong because assigning a custom role without scope would allow password resets for all users, not just Sales. Option D is wrong because Global Administrator has far too many permissions.

Answer

Create a security group for Sales, then assign a custom role to the group

Answer

Create a custom role with password reset permissions and assign it to helpdesk

Answer

Add helpdesk users to the Global Administrator role

Question 6

You are implementing Microsoft Entra Verified ID. Which technology does it use to create decentralized digital identities?

Accepted Answer

Decentralized Identifiers (DIDs). Microsoft Entra Verified ID uses Decentralized Identifiers (DIDs) as the core technology to create decentralized digital identities. DIDs are globally unique identifiers that are cryptographically verifiable and do not rely on a centralized registry, enabling self-sovereign identity scenarios where users control their own identity data.

Answer

OpenID Connect

Answer

OAuth 2.0

Answer

Security Assertion Markup Language (SAML)

Question 7

Your organization uses Microsoft Entra ID to manage user identities. You need to ensure that users can sign in using their existing social media accounts, such as Google or Facebook. Which identity solution should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable NTLM v1 authentication on the managed domain. Legacy applications that require NTLM authentication must have NTLM v1 enabled on the managed domain because Azure AD DS, by default, disables NTLM v1 for security reasons. Enabling NTLM v1 allows these older applications to authenticate against the managed domain using the NTLM protocol, which is necessary when Kerberos is not supported.

Answer

Configure Kerberos delegation

Answer

Disable NTLM v1 authentication on the managed domain

Answer

Enable password hash synchronization for the managed domain

Question 8

Your company has a Microsoft 365 E5 subscription and uses Microsoft Entra ID. You have configured Microsoft Entra Identity Governance. You need to create an access review for all guest users in the tenant to ensure their access is still required. The review should be recurring every 90 days and should auto-remove guests if they are not approved. What should you configure?

Accepted Answer

Create an access review for all guest users with a recurrence of 90 days and auto-apply results. Creating an access review for all guest users with a recurrence of 90 days and auto-apply results directly meets the requirement: it reviews guest access every 90 days and automatically removes guests who are not approved. Access reviews in Microsoft Entra ID Governance allow you to scope reviews to guest users, set recurrence, and enable auto-apply to enforce removal without manual intervention.

Answer

Configure a Conditional Access policy to block guests after 90 days

Answer

Configure PIM settings for guest users

Answer

Create an access package in entitlement management for guest users

Question 9

You are configuring Microsoft Entra ID for your organization. You need to enable passwordless authentication for users. Which TWO authentication methods are passwordless and supported by Microsoft Entra ID?

Accepted Answer

Microsoft Authenticator app. The Microsoft Authenticator app supports passwordless authentication by allowing users to approve sign-in requests via a notification or a number match on their mobile device, eliminating the need for a password. FIDO2 security keys are also a passwordless method, using public-key cryptography to authenticate users without a password, and are fully supported by Microsoft Entra ID for both Azure AD joined and hybrid joined devices.

Answer

SMS-based one-time passcode (OTP)

Answer

Hardware OATH tokens

Answer

OAuth 2.0 device authorization grant

Question 10

Your company uses Microsoft Entra ID for identity management. You are planning to implement Conditional Access policies. Which TWO components are required to create a Conditional Access policy?

Accepted Answer

Assignments (users, groups, cloud apps, conditions). A Conditional Access policy in Microsoft Entra ID requires two core components: Assignments and Access controls. Assignments define the scope of the policy by specifying users, groups, cloud apps, and conditions (e.g., location, device state). Access controls determine the enforcement action, such as granting access (optionally requiring MFA or compliant device) or blocking access, along with session controls like app-enforced restrictions. Without both components, the policy cannot be created.

Answer

MFA registration status

Answer

Identity Protection risk policies

Answer

Azure AD roles

Question 11

You are a Microsoft 365 administrator. You run the Get-MgPolicyCrossTenantAccessPolicyDefault cmdlet and see the exhibit output. What does this configuration imply?

Accepted Answer

Your tenant will accept MFA claims from all external Microsoft Entra tenants. The Get-MgPolicyCrossTenantAccessPolicyDefault cmdlet retrieves the default cross-tenant access policy settings. The exhibit output shows that the InboundTrust property is configured to accept MFA claims from all external Microsoft Entra tenants, meaning your tenant will trust MFA claims made by users from any external Entra tenant without requiring them to re-authenticate.

Answer

Your tenant will accept compliant device claims from external tenants

Answer

Your tenant will accept MFA claims from a specific partner tenant

Answer

Your tenant blocks all inbound B2B collaboration

Question 12

You run the Azure CLI command shown in the exhibit. What does the output represent?

Accepted Answer

The application ID for Microsoft Graph. The Azure CLI command `az ad sp show --id 00000003-0000-0000-c000-000000000000` retrieves the service principal for the Microsoft Graph API. The GUID `00000003-0000-0000-c000-000000000000` is the well-known application ID for Microsoft Graph in Microsoft Entra ID (formerly Azure AD). This ID is used to grant permissions and consent for Microsoft Graph API access.

Answer

The application ID for Microsoft Entra ID

Answer

The application ID for Exchange Online

Answer

The application ID for SharePoint Online

Question 13

Your organization uses Microsoft Entra ID to manage user identities. You need to ensure that users can sign in using their existing social media accounts, such as Google or Facebook. Which identity solution should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security keys (FIDO2). The Security keys (FIDO2) authentication method policy must be enabled to allow users to register and manage FIDO2 security keys through the My Security Info portal. This policy controls the registration, key restrictions, and user targeting for FIDO2 authentication in Microsoft Entra ID, directly enabling the self-service management experience.

Answer

Temporary Access Pass

Answer

Certificate-based authentication

Answer

Microsoft Authenticator

Question 14

Your company has a Microsoft 365 tenant with Microsoft Entra ID. You are configuring Conditional Access policies to enforce multifactor authentication (MFA) for all users. However, you want to exclude break-glass emergency access accounts from MFA. What is the recommended best practice for managing these emergency access accounts?

Accepted Answer

Configure the emergency access accounts with a long, complex password and exclude them from MFA policies. Microsoft's best practice for emergency access (break-glass) accounts is to configure them with a long, complex password and exclude them from Conditional Access MFA policies. This ensures they remain accessible even if MFA infrastructure fails, while still being secured by a strong password. Option A is incorrect because disabling sign-in would prevent use during emergencies. Option B is incorrect because enforcing MFA defeats the purpose of emergency access. Option D is incorrect because FIDO2 security keys require cloud authentication, which may be unavailable during an outage.

Answer

Disable sign-in for the emergency access accounts until needed

Answer

Make the emergency access accounts cloud-only and enforce MFA

Answer

Assign FIDO2 security keys to the emergency access accounts

Question 15

You are planning a migration from on-premises Active Directory to Microsoft Entra ID using cloud sync. You need to synchronize user passwords so that users can authenticate using their existing passwords. Which feature should you enable?

Accepted Answer

Password Hash Synchronization. Password Hash Synchronization (PHS) is the correct feature because it synchronizes the hash of a user's on-premises Active Directory password to Microsoft Entra ID, allowing users to authenticate with the same password without any additional on-premises infrastructure. Cloud sync specifically relies on PHS to replicate password hashes from AD to Entra ID, enabling seamless authentication for cloud-based services.

Answer

Pass-through Authentication

Answer

Federation with AD FS

Answer

Seamless Single Sign-On