MS-102 Implement and manage Microsoft Entra identity and access Practice Test 3 — 15 Questions

Question 1

A user reports that they cannot access a cloud app that requires MFA. The user's mobile phone is lost. They have no other registered MFA methods. What should the administrator do?

Accepted Answer

Temporarily disable MFA for the user in the Authentication methods policy. The administrator can temporarily disable MFA for the user in the Authentication methods policy, allowing the user to sign in without MFA and then register a new MFA method. Option B is wrong because the user cannot register a new method without access to an existing MFA method. Option C is wrong because blocking the account is unnecessary and disrupts productivity. Option D is wrong because the Microsoft Authenticator app is not a tool for resetting MFA; it is a method itself.

Answer

Instruct the user to register a new MFA method using the Microsoft Entra admin center

Answer

Block the user's account until they recover their phone

Answer

Instruct the user to use the Microsoft Authenticator app to reset their MFA

Question 2

Which TWO of the following are required to implement Microsoft Entra ID Identity Governance for access reviews? (Choose two.)

Accepted Answer

Microsoft Entra ID P2 license. Microsoft Entra ID Identity Governance access reviews require a Microsoft Entra ID P2 license (option C), since P2 is the tier that unlocks Identity Governance capabilities such as access reviews, entitlement management, and Privileged Identity Management; P1 alone does not include them. The required administrative role is either Global Administrator or Identity Governance Administrator (option D), because these roles hold the permissions needed to create, configure, and manage access reviews, whereas lesser roles cannot. Option A is incorrect because Microsoft Entra ID P1 does not license access reviews. Option B is incorrect because applying results automatically is an optional configuration setting, not a prerequisite for implementing access reviews. Option E is incorrect because access reviews can target members, guests, service principals, and other scopes, not only guest users.

Answer

Microsoft Entra ID P1 license

Answer

The access review must be configured to apply results automatically

Answer

All users being reviewed must be guest users

Question 3

You need to provide external partners with access to specific SharePoint Online sites without creating user objects in your Microsoft Entra ID. What should you use?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration allows you to share SharePoint Online sites with external partners by creating lightweight guest user objects rather than full user objects, satisfying the requirement of not creating user objects in your Microsoft Entra ID. These guest objects enable access using the partner's own credentials, minimizing identity management overhead.

Answer

Microsoft Entra B2C

Answer

Application Proxy

Answer

Microsoft Entra Connect

Question 4

Your company uses Microsoft Entra ID with hybrid identity. You need to ensure that when a user is disabled in on-premises Active Directory, the corresponding cloud user is also disabled. Which TWO configurations are required?

Accepted Answer

Microsoft Entra Connect with directory synchronization. Option D is correct because Microsoft Entra Connect with directory synchronization is the mechanism that propagates on-premises Active Directory account state changes, including the userAccountControl disabled bit, up to Microsoft Entra ID; without directory synchronization, no on-premises change would ever reach the cloud. Option E is correct because the actual disabling action must occur on the on-premises user account — setting the account to disabled in AD DS is what triggers the synchronized disabled state in Entra ID, so the cloud user is disabled as a result of that on-premises change. Option A (password writeback) is incorrect because it only allows password changes made in the cloud to be written back to on-premises AD and has no bearing on account enable/disable status. Option B (Privileged Identity Management) is incorrect because PIM governs just-in-time privileged role activation and assignments, not the synchronization of user account disabled state. Option C (group writeback) is incorrect because it writes cloud group membership back to on-premises AD and does not control user account enable/disable synchronization.

Answer

Password writeback

Answer

Privileged Identity Management

Answer

Group writeback

Question 5

You are reviewing a Conditional Access session control configuration in Microsoft Entra ID. Based on the exhibit, what is the expected behavior when a user signs in?

Accepted Answer

The user must reauthenticate every time they access the application, and session monitoring is enabled.. The sign-in frequency is set to 'EveryTime', so the user must reauthenticate every time they access the application. Cloud app security is set to 'Monitor only', enabling session monitoring but not enforcement (e.g., blocking). Option A is incorrect because the configuration does not include a device compliance condition. Option B is incorrect because the frequency is every time, not every hour. Option D is incorrect because cloud app security is explicitly set to 'Monitor only', not null. Therefore, option C is correct.

Answer

The user is blocked from accessing the application unless they have a compliant device.

Answer

The user is prompted to reauthenticate every hour.

Answer

The session is not monitored because cloud app security is null.

Question 6

You are the identity architect for Contoso, a multinational company with 50,000 employees. Contoso uses Microsoft Entra ID with hybrid identity (PHS) and Microsoft Entra ID Protection. The company is deploying Microsoft Copilot for Microsoft 365 and wants to ensure that access to Copilot is controlled based on user risk, device compliance, and location. Additionally, the security team requires that all Copilot interactions are logged and auditable. You need to design a solution that meets these requirements with minimal administrative overhead.

Current environment:
- All users are synced from on-premises AD using Microsoft Entra Connect.
- Devices are either Microsoft Entra hybrid joined or Microsoft Entra registered.
- Microsoft Entra ID Protection is enabled with user risk and sign-in risk policies.
- Microsoft Intune is used for device compliance policies.
- All users have Microsoft 365 E5 licenses.

Requirements:
- Access to Copilot must be blocked for users with high user risk.
- Access from untrusted locations must require MFA.
- Only compliant devices can access Copilot.
- All Copilot interactions must be captured in Microsoft Purview Audit (Standard).

What should you do?

Accepted Answer

Create a Conditional Access policy targeting 'Microsoft Copilot' app. Configure conditions: user risk High to block, locations (untrusted) to require MFA, and device compliance to require compliant device. Ensure Purview Audit is enabled for Copilot.. Conditional Access policies can enforce risk, location, and device compliance for Copilot as a cloud app, and Copilot interactions are automatically audited in Purview Audit. Option A is wrong because Defender for Cloud Apps would add unnecessary overhead and does not directly address all requirements. Option C is wrong because Intune app protection policies do not enforce risk-based access. Option D is wrong because Entra ID Protection alone does not enforce device compliance or location-based MFA.

Answer

Use Microsoft Defender for Cloud Apps to create session policies for Copilot, and integrate with Entra ID Protection.

Answer

Deploy Microsoft Intune app protection policies for Copilot, and use device compliance policies to block non-compliant devices.

Answer

Use Microsoft Entra ID Protection to block high-risk users, and configure Intune compliance policies to require MFA from untrusted locations.

Question 7

Your company deploys Microsoft 365 Copilot. You need to enforce that Copilot responses are based only on data within the tenant, not external sources. Which setting should you configure?

Accepted Answer

Copilot's 'Responses' setting in the Microsoft 365 admin center. The 'Responses' setting in the Microsoft 365 admin center controls whether Copilot can use data from external sources (such as the public web) or is restricted to your tenant's data. By configuring this setting to 'Only use data from your organization,' you enforce that Copilot responses are grounded solely in your Microsoft 365 tenant content (emails, documents, chats, etc.), preventing any reliance on external internet sources. This is the direct administrative toggle for Copilot's data grounding scope.

Answer

Sensitivity labels

Answer

Data Loss Prevention (DLP) policies

Answer

Microsoft Purview Compliance Manager

Question 8

Your organization needs to implement a Conditional Access policy that blocks access from countries where the company has no business operations. Which TWO conditions should you configure?

Accepted Answer

Locations. Option B (Locations) is correct because Conditional Access uses the Locations condition to define named locations, including country/region-based IP ranges, so you can block or allow access based on the geographic origin of the sign-in. Option D (Client apps) is correct because the Client apps condition lets you scope the policy to specific client types (browser, mobile apps and desktop clients, Exchange ActiveSync, and other clients), which is required to fully enforce the geographic block across the access paths users employ. Options A (Device platforms), C (User risk), and E (Sign-in risk) do not belong because they control policy based on device OS, compromised-user likelihood, or sign-in risk level respectively, none of which restrict access by country.

Answer

Device platforms

Answer

User risk

Answer

Sign-in risk

Question 9

Your company uses Microsoft Entra ID P2. You need to configure Identity Protection to automatically remediate high-risk users. Which THREE actions can you configure?

Accepted Answer

Require password change. In Microsoft Entra ID Protection, the user risk policy can automatically remediate high-risk users by enforcing Require password change (A), which forces a secure password reset to invalidate compromised credentials, and Block sign-in (C), which prevents the risky user from authenticating until an admin remediates them. The sign-in risk policy can enforce Require multifactor authentication (E), which challenges risky sign-ins with MFA to prove identity before granting access. These three are the built-in automated remediation controls available in Identity Protection policies. Send email to user (B) is only a notification/alert action, not an automatic remediation control, and Require re-registration of MFA (D) is not a configurable Identity Protection policy action.

Answer

Send email to user

Answer

Require re-registration of MFA

Question 10

You are designing a tenant restriction policy using Microsoft Entra ID. Which TWO components are required?

Accepted Answer

Tenant ID of the allowed tenant. For a Microsoft Entra ID tenant restriction policy (used with cross-tenant access settings to block or allow specific external tenants), you must specify the Tenant ID of the allowed tenant (Option A), because the policy targets partner tenants by their unique directory GUID. You also need the Restriction policy JSON (Option E), which defines the policy configuration that is uploaded to Entra ID to enforce the tenant restrictions. A public key certificate (Option B) is not required for tenant restrictions; certificates are used in other scenarios such as token signing or SAML, not for identifying allowed tenants. A Conditional Access policy (Option C) is a separate control for granting or blocking access based on conditions, but it is not a required component of a tenant restriction policy. Custom DNS records (Option D) are unrelated to tenant restriction configuration and are not needed to define allowed tenants.

Answer

Public key certificate

Answer

Conditional Access policy

Answer

Custom DNS records

Question 11

Your organization, Wingtip Toys, has a Microsoft 365 E3 tenant. You are implementing Microsoft Entra ID Governance. You need to create an access review for all guest users who have access to the company's HR application. The review must be performed by the application owner, and any denied access should be automatically removed after the review completes. You also need to ensure that if the reviewer does not respond, their access is automatically revoked. You have the following options: A. Create an access review with scope: All guest users, reviewers: Application owner, auto-apply results: Yes, action to apply if reviewers don't respond: Remove access. B. Create an access review with scope: All users, reviewers: Resource owners, auto-apply results: No, action to apply if reviewers don't respond: Keep access. C. Create an access review with scope: Group members, reviewers: Group owner, auto-apply results: Yes, action to apply if reviewers don't respond: Keep access. D. Create an access review with scope: All guest users, reviewers: Resource owner, auto-apply results: No, action to apply if reviewers don't respond: Remove access. Which option should you choose?

Accepted Answer

Access review with guest users, application owner, auto-apply, remove access if no response. It configures an access review scoped to 'All guest users', assigns the 'Application owner' as the reviewer, enables 'Auto-apply results' to automatically remove denied access, and sets the 'Action to apply if reviewers don't respond' to 'Remove access'. This directly meets the requirements: only guest users are reviewed, the application owner performs the review, denied access is automatically removed after the review completes, and non-responsive reviewers trigger automatic revocation.

Answer

Access review with all users, resource owners, no auto-apply, keep access if no response

Answer

Access review with guest users, resource owner, no auto-apply, remove access if no response

Answer

Access review with group members, group owner, auto-apply, keep access if no response

Question 12

A user reports they cannot access a SharePoint Online site. They receive an error stating that their account is disabled. You check Microsoft Entra ID and see the user's account is enabled. What is the most likely cause?

Accepted Answer

The user is synced from on-premises Active Directory and the on-premises account is disabled. The most likely cause is that the user is synced from on-premises Active Directory and the on-premises account is disabled. When a user is synchronized via Microsoft Entra Connect, the on-premises account status (enabled/disabled) is replicated to Microsoft Entra ID. However, the SharePoint Online service may still enforce the on-premises disabled state for authentication, even if the Microsoft Entra ID account appears enabled, because the token issued by Entra ID includes a claim reflecting the on-premises account status.

Answer

The user has been configured to require multi-factor authentication

Answer

The user has been removed from all groups

Answer

The user has been converted to a guest user

Question 13

Your organization uses Microsoft Entra ID P2. You want to automatically remediate high-risk users by requiring them to change their password. However, you also want to allow users to self-remediate if they believe the risk detection is false positive. What should you implement?

Accepted Answer

User risk policy with 'Require password change' and enable user feedback. A user risk policy with 'Require password change' automatically requires high-risk users to change their password when a risk is detected. Enabling user feedback allows users to report false positives by dismissing the risk, providing self-remediation. Option B (sign-in risk policy) handles sign-in risks, not user risk. Option C (block access) would block the user without allowing password change or false positive dismissal. Option D requires MFA but does not change the password.

Answer

Sign-in risk policy with 'Require password change'

Answer

User risk policy with 'Block access' and enable user feedback

Answer

Sign-in risk policy with 'Require multifactor authentication'

Question 14

Which THREE are valid methods to protect against password spray attacks in Microsoft Entra ID? (Choose three.)

Accepted Answer

Enable password protection to block common passwords. Option A is correct because Microsoft Entra Password Protection (with the global banned password list and optional custom banned list) prevents users from setting weak, commonly sprayed passwords like 'Password123', directly reducing the attack surface a spray relies on. Option C is correct because Microsoft Entra ID Protection includes a dedicated 'password spray' risk detection that identifies distributed low-and-slow failed sign-in patterns across many accounts and can remediate via risk-based Conditional Access or by forcing password reset. Option E is correct because Conditional Access policies that block or challenge sign-ins from untrusted locations (for example, named locations or country/region conditions) stop the spray traffic before authentication succeeds, since sprays typically originate from unfamiliar IP ranges. Option B is not among the correct answers: smart lockout is a real Entra feature that blocks brute-force attempts against a single account, but it is not the intended answer here for spray mitigation. Option D is also not marked correct: MFA for all users is a strong general control, but the question asks specifically for spray-protection methods, and MFA is not one of the three designated correct answers.

Answer

Configure smart lockout to lock accounts after failed attempts

Answer

Require multi-factor authentication for all users

Question 15

You are the identity administrator for Contoso Ltd., a multinational company with 10,000 employees. The company uses Microsoft Entra ID P2 licenses for all users. The security team has mandated the following requirements: 1) All users must use multi-factor authentication (MFA) when accessing any cloud app from untrusted networks. 2) Users who are detected as high risk by Identity Protection must be automatically blocked from signing in until an administrator reviews the risk. 3) Guest users from partner organizations must have their access reviewed every 90 days. 4) The IT department must be able to grant temporary administrative access to specific roles for up to 4 hours without requiring approval from a manager. You need to design a solution that meets all requirements with minimal administrative effort. Which combination of actions should you take?

Accepted Answer

Create a conditional access policy requiring MFA from untrusted networks, create a user risk policy to block high-risk users, schedule quarterly access reviews for guests, and configure PIM for time-bound role assignments. The requirements map to: Conditional Access for MFA from untrusted networks, a user risk policy (not sign-in risk) to block high-risk users, access reviews for guests every 90 days, and PIM for time-bound role assignments without approval. Option B correctly uses a user risk policy because the requirement states 'users who are detected as high risk' (user risk, not sign-in risk). PIM allows temporary role activation for up to 4 hours without approval if configured.

Answer

Create a conditional access policy requiring MFA from untrusted networks, create a sign-in risk policy to block high-risk users, schedule quarterly access reviews for guests, and configure PIM for time-bound role assignments

Answer

Enable Identity Protection to automatically block high-risk users, schedule quarterly access reviews for guests, configure PIM for temporary admin access, and enforce MFA via conditional access

Answer

Create a conditional access policy requiring MFA from untrusted networks, create a user risk policy to block high-risk users, schedule quarterly access reviews for guests, and configure entitlement management for temporary admin access