MS-102 Implement and manage Microsoft Entra identity and access Practice Test 3 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID Governance. You need to ensure that access reviews are automatically created for all guest users in the tenant and that reviews are sent to the guest users' managers for approval. You configure an access review policy. Which identity governance feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Entitlement Management. B is correct because Entitlement Management in Microsoft Entra ID Governance allows you to configure access review policies that automatically create reviews for guest users and assign them to the guest users' managers for approval. This feature integrates with access reviews to enforce governance over external identities, ensuring that guest access is periodically recertified by the appropriate authority.

Answer

Terms of Use

Answer

Access Reviews

Answer

Privileged Identity Management

Question 2

Your organization uses Microsoft Entra ID Governance. You need to ensure that access reviews are automatically created for all guest users in the tenant and that reviews are sent to the guest users' managers for approval. You configure an access review policy. Which identity governance feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the trust MFA for external users setting in cross-tenant access settings. The cross-tenant access settings in Microsoft Entra ID include a 'Trust MFA from external tenants' option. When enabled, this setting allows guest users who have already satisfied MFA in their home tenant to access resources in your tenant without being prompted for MFA again. This respects the partner's MFA claims and avoids redundant authentication, which directly resolves the blocking issue caused by the Conditional Access policy requiring MFA for all external users.

Answer

Disable MFA requirement for guest users in Conditional Access

Answer

Configure authentication methods policy to accept MFA from external identities

Answer

Use B2B direct connect instead of B2B collaboration

Question 3

Your organization has a Microsoft 365 E5 subscription and uses Microsoft Entra ID. You are implementing Privileged Identity Management (PIM) to manage access to Azure AD roles. You need to ensure that when a user activates a privileged role, the activation request must be approved by their manager and must include a ticket number. What should you configure?

Accepted Answer

Modify the role settings in PIM to require approval and justification with ticket number. PIM role settings allow you to configure activation requirements, including requiring approval and mandating a justification field. By enabling 'Require approval to activate' and configuring the approver as the user's manager, and by setting 'Require ticket information on activation', you enforce that every activation request includes a ticket number and is routed to the manager for approval.

Answer

Create an access review for the role

Answer

Configure an access package in Entitlement Management

Answer

Use Conditional Access policy with session controls

Question 4

Your company uses Microsoft Entra ID and wants to use Microsoft's recommendation to protect against password spray attacks. Which feature should you enable?

Accepted Answer

Smart Lockout. Smart Lockout is Microsoft's recommended feature to protect against password spray attacks because it intelligently locks out bad actors after a threshold of failed attempts while allowing legitimate users to continue. It uses adaptive logic to distinguish between real users and attackers by considering the sign-in pattern and IP address, making it the correct choice for this specific threat.

Answer

Identity Protection

Answer

Password Hash Synchronization

Answer

Multifactor Authentication

Question 5

Your organization uses Microsoft Entra ID Governance. You need to ensure that access reviews are automatically created for all guest users in the tenant and that reviews are sent to the guest users' managers for approval. You configure an access review policy. Which identity governance feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Device compliance policy. Device compliance policies define the rules that devices must meet to be considered compliant, such as requiring iOS devices to be jailbreak-detected or have a minimum OS version. When combined with a Conditional Access policy requiring compliant devices, only compliant iOS devices can access Exchange Online. Option A is incorrect because Device configuration policies manage device settings (e.g., Wi-Fi, VPN) and do not enforce compliance. Option C is incorrect because App protection policies manage app-level data protection, not device compliance. Option D is incorrect because Enrollment restrictions control which devices can enroll in Intune, not compliance.

Answer

Device configuration policy

Answer

App protection policy

Answer

Enrollment restrictions

Question 6

Your organization uses Microsoft Entra ID Governance. You need to ensure that access reviews are automatically created for all guest users in the tenant and that reviews are sent to the guest users' managers for approval. You configure an access review policy. Which identity governance feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Service Bus endpoints in Azure. Pass-through Authentication (PTA) requires the PTA Agent to be installed on-premises to validate user passwords against Active Directory. It also uses Azure Service Bus endpoints to establish a secure, persistent connection between the on-premises agent and Microsoft Entra ID, enabling authentication requests to flow without storing passwords in the cloud.

Answer

Password Hash Synchronization agent

Answer

Azure AD Connect Health agent

Answer

Seamless Single Sign-On

Question 7

Your organization uses Microsoft Entra ID and wants to implement Identity Protection to detect risky users. Which THREE risk types can be detected by Identity Protection? (Choose three.)

Accepted Answer

Impossible travel. Impossible travel is a risk detection in Microsoft Entra ID Identity Protection that identifies sign-ins originating from geographically distant locations within a time frame that makes physical travel between them impossible. This detection uses the user's previous sign-in locations and the time between sign-ins to calculate the probability of a compromised account being used from a different region.

Answer

Password spray

Answer

Malware

Question 8

Your organization uses Microsoft Entra ID and wants to implement a passwordless authentication strategy. Which TWO authentication methods are considered passwordless by Microsoft? (Choose two.)

Accepted Answer

Windows Hello for Business. Windows Hello for Business is a passwordless authentication method that uses biometric or PIN-based credentials tied to a user's device, leveraging asymmetric key pairs to authenticate against Microsoft Entra ID without transmitting a password. It satisfies Microsoft's definition of passwordless because the private key never leaves the device, and authentication is performed via a cryptographic challenge-response protocol.

Answer

Microsoft Authenticator with notification

Answer

Password Hash Synchronization

Answer

SMS-based one-time passcode

Question 9

Refer to the exhibit. You are reviewing a Conditional Access policy JSON. The policy is intended to block legacy authentication. However, users are still able to connect using Exchange ActiveSync. What is the most likely reason?

Accepted Answer

The policy is configured in 'report-only' mode instead of 'enforce'. The policy is configured in 'report-only' mode. In report-only mode, Conditional Access policies are evaluated but not enforced. Users can still connect using legacy authentication because the policy does not block access. To block legacy authentication, the policy must be set to 'enforce' mode. Additionally, the client apps condition should include 'Exchange ActiveSync clients' and 'Other clients' to specifically target legacy authentication protocols.

Answer

The policy is missing the 'browser' and 'mobileAppsAndDesktopClient' client app types

Answer

The grant control operator 'OR' should be 'AND'

Answer

The policy is missing a condition for 'device platforms' to target iOS and Android

Question 10

Your company is implementing a Zero Trust security model. You need to ensure that all user access requests to corporate resources are verified continuously, not just at the initial sign-in. Which Microsoft Entra ID feature should you use?

Accepted Answer

Continuous Access Evaluation (CAE). Continuous Access Evaluation (CAE) is the correct choice because it enforces real-time token validation and policy enforcement for every access request, not just at initial authentication. CAE works by having critical events (e.g., user disablement, IP address change, or risk elevation) trigger a revocation message to the resource provider, which then immediately blocks access—even if the token is still valid. This aligns directly with the Zero Trust principle of 'verify explicitly and continuously' rather than relying on a one-time sign-in.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra Verified ID

Question 11

Your organization has a hybrid identity environment with Microsoft Entra Connect. You are planning to migrate to cloud-only authentication using Microsoft Entra Cloud Sync. However, some legacy applications still require NTLM authentication. What should you do to ensure those applications can authenticate after the migration?

Accepted Answer

Use Microsoft Entra Application Proxy to publish the legacy applications. Microsoft Entra Application Proxy allows you to publish on-premises legacy applications that rely on NTLM authentication without requiring any changes to the application itself. It acts as a reverse proxy, terminating the external connection and then forwarding the request to the internal application using Kerberos or NTLM, thus enabling cloud-only authentication while preserving NTLM support for legacy apps.

Answer

Enable pass-through authentication (PTA)

Answer

Configure Microsoft Entra Cloud Sync with password hash sync

Answer

Deploy Microsoft Entra Password Protection

Question 12

You need to grant a vendor access to a specific SharePoint Online site for a limited time. The vendor does not have an account in your Microsoft Entra ID. What should you use?

Accepted Answer

Use Microsoft Entra B2B collaboration and set an expiration for the guest user. Microsoft Entra B2B collaboration allows you to invite external users (vendors) as guest users to access your organization's resources, including SharePoint Online sites, without requiring them to have an existing account in your tenant. You can configure an expiration policy for the guest user account to automatically remove access after a specified period, meeting the requirement for limited-time access.

Answer

Create a user account via Microsoft Entra Connect

Answer

Configure self-service sign-up user flow

Answer

Assign the vendor a guest user account with no expiration

Question 13

Your company uses Microsoft Intune for mobile device management. You need to ensure that only compliant devices can access corporate email in Microsoft 365. Which Microsoft Entra ID feature should you combine with Intune compliance policies?

Accepted Answer

Conditional Access. Conditional Access is the correct answer because it is the Microsoft Entra ID feature that enforces access controls based on signals such as device compliance. When combined with Intune compliance policies, Conditional Access can block or allow access to corporate email in Microsoft 365 based on whether the device is marked as compliant by Intune. This integration ensures that only devices meeting your organization's security requirements can access corporate resources.

Answer

Microsoft Entra Application Proxy

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Question 14

Your organization uses Microsoft Entra ID Governance. You need to ensure that access reviews are automatically created for all guest users in the tenant and that reviews are sent to the guest users' managers for approval. You configure an access review policy. Which identity governance feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra Lifecycle Workflows. Microsoft Entra Lifecycle Workflows is the correct choice because it is specifically designed to automate the entire identity lifecycle, including the removal of access when an employee leaves. It can trigger access reviews and automatically deprovision accounts and group memberships based on joiner, mover, and leaver scenarios, integrating with HR systems like Workday or SuccessFactors.

Answer

Microsoft Entra Entitlement Management

Answer

Microsoft Entra Access Reviews

Answer

Microsoft Entra Privileged Identity Management

Question 15

You need to prevent users from registering security information for Microsoft Entra self-service password reset (SSPR) if they are not in a specific group. What should you configure?

Accepted Answer

SSPR scope setting to require group membership. The SSPR scope setting allows you to restrict self-service password reset to members of a specific group, effectively preventing users not in that group from registering security information. Option A is incorrect because Identity Protection user risk policy is used to detect and respond to risky sign-ins, not to restrict SSPR registration. Option B is incorrect because combined registration is a feature that allows users to register for both SSPR and Microsoft Entra multifactor authentication in one step, but it does not restrict registration to a group. Option D is incorrect because while a Conditional Access policy could block registration, it is not the intended or straightforward method; the proper way to limit SSPR registration to a group is through the SSPR scope setting, not by creating a Conditional Access policy.

Answer

Microsoft Entra Identity Protection user risk policy

Answer

Combined registration for SSPR and Microsoft Entra multifactor authentication

Answer

Conditional Access policy to block registration for non-group members