MS-102 Implement and manage Microsoft Entra identity and access Practice Test 2 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID. You need to implement a solution that allows users to sign in without a password using their smartphone. Which TWO authentication methods can be used?

Accepted Answer

Microsoft Authenticator app (phone sign-in). Option D (Microsoft Authenticator app phone sign-in) is correct because passwordless phone sign-in lets users authenticate by approving a prompt in the Microsoft Authenticator app on their smartphone, using a registered credential tied to the device rather than a password. Option E (FIDO2 security keys) is correct because FIDO2 security keys are a supported passwordless authentication method in Microsoft Entra ID, using WebAuthn and public-key cryptography for phishing-resistant sign-in. Option A (Temporary Access Pass) is not correct because it is a time-limited passcode used for onboarding or recovery, not a smartphone-based passwordless sign-in method. Option B (Windows Hello for Business) is not correct because it is a passwordless method tied to a Windows device using PIN, biometrics, or a security key, not a smartphone. Option C (Text message SMS verification code) is not correct because SMS codes are a form of multi-factor authentication, not a passwordless authentication method.

Answer

Temporary Access Pass

Answer

Windows Hello for Business

Answer

Text message (SMS) verification code

Question 2

Refer to the exhibit. You have created a conditional access policy as shown. Users report that they can still access cloud apps from non-compliant devices. What is the most likely reason?

Accepted Answer

The policy uses session controls instead of grant controls. The policy uses session controls (e.g., 'Use app enforced restrictions') instead of grant controls (e.g., 'Require device to be marked as compliant'). Session controls only apply additional restrictions within the session but do not block access. Therefore, even non-compliant devices can still access cloud apps, though they may experience limited functionality. Grant controls are required to enforce device compliance and block access if the condition is not met.

Answer

The policy does not exclude specific users

Answer

The policy does not include all cloud apps

Answer

The grant control operator is set to "OR" with only one control, which requires no controls to be satisfied

Question 3

Refer to the exhibit. You run the KQL query in Microsoft Sentinel. The query returns zero results even though you know user@contoso.com has had failed sign-in attempts in the last 30 days. What is the most likely reason?

Accepted Answer

The query filters on UserPrincipalName incorrectly. The query filters on UserPrincipalName, but the actual field in the sign-in logs might be named differently (e.g., UserId) or the format may not match (e.g., email vs UPN). This causes the query to return zero results. Option A is incorrect because data retention in Sentinel can be configured for more than 7 days. Option B is incorrect because the summarize statement is syntactically correct. Option D is incorrect because the query does not filter out successful sign-ins; it likely targets failed sign-ins based on the context.

Answer

The query uses ago(30d) but the data retention is only 7 days

Answer

The summarize statement is incorrect

Answer

The query excludes successful sign-ins

Question 4

A company uses Microsoft Entra ID with group-based licensing. You assign a license to a group, but some members do not receive the license. There are no error messages in the audit logs. What is the most likely cause?

Accepted Answer

Users have the license directly assigned. When a user has a license directly assigned, group-based licensing skips that user because the direct assignment takes precedence. The group licensing engine detects the existing license and does not attempt to reassign it, so no error is logged. This is the most common cause of silent license assignment failures in Microsoft Entra ID.

Answer

The group has more than 500 members

Answer

The group is a dynamic group

Answer

The product license is out of stock

Question 5

You need to enforce multifactor authentication (MFA) for all users in a Microsoft Entra ID tenant. The solution must not require users to register security info if they already have it. Which approach should you use?

Accepted Answer

Create a Conditional Access policy that requires MFA for all users. A Conditional Access policy can require MFA for all users while respecting existing security info registration. The policy triggers MFA during sign-in but does not force re-registration if the user has already registered. This meets the requirement of not requiring users to register security info if they already have it.

Answer

Use identity protection to enforce MFA for risky sign-ins

Answer

Assign MFA per user in the Microsoft Entra admin center

Answer

Enable security defaults

Question 6

An administrator needs to grant a user the ability to reset passwords for other users in Microsoft Entra ID. Which role should be assigned?

Accepted Answer

Helpdesk Administrator. The Helpdesk Administrator role can reset passwords for non-administrators and limited administrators.

Answer

Password Administrator

Answer

Global Administrator

Answer

User Administrator

Question 7

A user is unable to sign in to Microsoft Teams because the account is locked. The administrator needs to unlock the account without resetting the password. What should the administrator do?

Accepted Answer

Disable and re-enable the user. When a user account is locked due to failed sign-in attempts, disabling and re-enabling the account in Microsoft Entra ID clears the lockout state without resetting the password. This toggles the account status and removes the lock, allowing the user to sign in again with their existing password. Enabling the account alone does not unlock it; the account must be disabled first to reset the lockout.

Answer

Reassign the user's license

Answer

Reset the user's password

Answer

Enable the user's account in Microsoft Entra ID

Question 8

Which THREE conditions can be used in a Microsoft Entra Conditional Access policy to target specific sign-in scenarios?

Accepted Answer

Device platform. Device platform (A) is a valid Conditional Access condition because it lets the policy target sign-ins from specific operating systems such as Windows, iOS, Android, macOS, or Linux. User risk (B) is valid because it targets sign-ins based on the level of risk associated with the user account, as calculated by Microsoft Entra ID Protection. Location (C) is valid because it targets sign-ins by named locations or IP ranges, including trusted locations and countries/regions. Sign-in risk (D) is not among the marked correct answers here, and client apps (E) is likewise not marked correct, so neither should be selected for this scenario.

Answer

Sign-in risk

Answer

Client apps

Question 9

Refer to the exhibit. You manage an application registration in Microsoft Entra ID. The JSON shows the current state of the app's password credentials. The application is used by a daemon to acquire tokens. The certificate used for authentication expires on 2025-12-31. The application is currently using a client secret. The security policy requires rotating secrets every 6 months. What is the best course of action?

Accepted Answer

Create a new client secret, update the daemon to use the new secret, then delete the old secret. The security policy requires rotating secrets every 6 months, and the current secret's endDateTime is set to 2025-12-31, which exceeds that interval. Creating a new client secret, updating the daemon to use it, and then deleting the old secret ensures compliance with the rotation policy while maintaining uninterrupted token acquisition. This approach follows the least-privilege and secret rotation best practices for application credentials in Microsoft Entra ID.

Answer

Switch the daemon to use certificate-based authentication and remove the secret

Answer

Do nothing; the secret does not expire until 2025-12-31

Answer

Extend the endDateTime of the existing secret to 2026-12-31

Question 10

Refer to the exhibit. You run this PowerShell script to disable high-risk users. However, some high-risk users remain enabled. What is the most likely reason?

Accepted Answer

The script does not have permission to read risky users. The Get-AzureADIdentityRiskyUser cmdlet does support the -Filter parameter, so the filter syntax is valid. The most likely reason high-risk users remain enabled is that the script's execution context lacks the necessary permissions to read risky users. Without permission, the cmdlet returns no users (or an error), and the subsequent Set-AzureADUser cmdlet never runs, leaving high-risk users enabled. The script may have partially worked due to scoping or delegation, but the primary cause is insufficient permissions to read the risky user list.

Answer

The Set-AzureADUser cmdlet fails for disabled users

Answer

High-risk users are protected by a Conditional Access policy

Answer

The Get-AzureADIdentityRiskyUser cmdlet does not support the -Filter parameter

Question 11

A company has Microsoft Entra ID P2 licenses. They need to implement a conditional access policy that requires multifactor authentication (MFA) when accessing the Microsoft Entra admin center from a non-compliant device. However, they want to allow access from compliant devices without MFA. What is the best approach?

Accepted Answer

Create one conditional access policy with grant controls set to 'Require one of the selected controls' and select both 'Require compliant device' and 'Require multifactor authentication'. The requirement can be met with a single policy by setting grant controls to 'Require one of the selected controls' and selecting both 'Require compliant device' and 'Require multifactor authentication'. A compliant device satisfies the 'Require compliant device' control, so access is granted without MFA. A non-compliant device does not satisfy that control, so the user is prompted for MFA, satisfying the requirement. Option C is incorrect because the policy for non-compliant devices would require 'Require compliant device' to be satisfied as well, which would block non-compliant devices entirely.

Answer

Create one conditional access policy with a grant control that combines 'Require compliant device' and 'Require multifactor authentication' as a single control

Answer

Create two conditional access policies: one for compliant devices requiring only compliant device, and one for non-compliant devices requiring MFA and compliant device

Answer

Create one conditional access policy with grant controls set to 'Require all the selected controls' and select both 'Require compliant device' and 'Require multifactor authentication', and include all devices

Question 12

You need to implement a solution that allows external partners to access specific SharePoint Online sites without creating guest user objects in Microsoft Entra ID. The partners will authenticate using their own identity provider. What should you use?

Accepted Answer

SharePoint Online external sharing with one-time passcode authentication. SharePoint Online external sharing with one-time passcode authentication allows external partners to access SharePoint sites without creating guest user objects in Microsoft Entra ID. When the partner's identity provider is not federated with Entra ID, the one-time passcode feature sends a code to their email for authentication, bypassing the need for a guest account. This meets the requirement of no guest user objects while enabling access from an external identity provider.

Answer

Microsoft Entra B2B collaboration with the partner's identity provider

Answer

Microsoft Entra B2B direct connect for SharePoint Online

Answer

Microsoft Entra External ID for the partner organization

Question 13

Your company uses Microsoft Entra ID and wants to enforce that all users register for MFA within 14 days of account creation. Which policy should you configure?

Accepted Answer

Authentication methods policy with 'Registration campaign' targeting users. The 'Registration campaign' in the Authentication methods policy is designed to nudge users to register for MFA within a specified time frame (e.g., 14 days) after account creation. This policy specifically targets the registration phase, not the authentication phase, making it the correct choice for enforcing MFA registration deadlines.

Answer

Conditional access policy with 'Require multifactor authentication'

Answer

Microsoft Entra ID Protection sign-in risk policy

Answer

Microsoft Entra ID Protection user risk policy

Question 14

You have a hybrid identity environment with Microsoft Entra ID and Active Directory Domain Services (AD DS). You need to ensure that user passwords are synchronized to Microsoft Entra ID without any hashing of passwords. Which tool should you use?

Accepted Answer

Microsoft Entra Connect Sync with password hash synchronization. Microsoft Entra Connect Sync with password hash synchronization (PHS) is the correct answer because it synchronizes a hash of the user's password hash from on-premises AD DS to Microsoft Entra ID, ensuring the plaintext password is never stored or transmitted. The phrase 'without any hashing' is misleading—PHS always hashes the password hash. While both Entra Connect Sync and Entra Cloud Sync support password hash synchronization, Entra Connect Sync with PHS is the standard full-featured tool. AD FS and MIM do not directly synchronize password hashes to Microsoft Entra ID.

Answer

Active Directory Federation Services (AD FS)

Answer

Microsoft Entra Cloud Sync

Answer

Microsoft Identity Manager

Question 15

Your organization uses Microsoft Entra ID. You need to implement a solution that allows users to sign in without a password using their smartphone. Which TWO authentication methods can be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom workbook in Microsoft Entra ID and schedule it to run weekly. Microsoft Entra ID custom workbooks can be configured with a scheduled refresh, allowing you to automatically generate and deliver a weekly report of risky sign-ins without manual intervention or additional infrastructure. This leverages the built-in reporting and scheduling capabilities of Entra ID, making it the most efficient solution for a recurring report.

Answer

Use the Microsoft Entra admin center to export the risky sign-ins report every week

Answer

Configure a Microsoft Sentinel analytics rule to generate incidents for risky sign-ins

Answer

Write a PowerShell script that uses the Microsoft Graph API to retrieve risky sign-ins and send an email weekly