MS-102 Implement and manage Microsoft Entra identity and access Practice Test 3 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID and requires users to authenticate using FIDO2 security keys. You need to ensure that users can register and manage their security keys through the My Security Info portal. Which authentication method policy setting should you enable?

Accepted Answer

Security keys (FIDO2). The Security keys (FIDO2) authentication method policy must be enabled to allow users to register and manage FIDO2 security keys through the My Security Info portal. This policy controls the registration, key restrictions, and user targeting for FIDO2 authentication in Microsoft Entra ID, directly enabling the self-service management experience.

Answer

Temporary Access Pass

Answer

Certificate-based authentication

Answer

Microsoft Authenticator

Question 2

Your company has a Microsoft 365 tenant with Microsoft Entra ID. You are configuring Conditional Access policies to enforce multifactor authentication (MFA) for all users. However, you want to exclude break-glass emergency access accounts from MFA. What is the recommended best practice for managing these emergency access accounts?

Accepted Answer

Configure the emergency access accounts with a long, complex password and exclude them from MFA policies. Option B is correct because Microsoft recommends that emergency access accounts be configured with a long, complex password and excluded from MFA policies to ensure access during outages. Option A is wrong because FIDO2 keys are not recommended for emergency accounts. Option C is wrong because emergency accounts should not be cloud-only; they should be cloud-only but not limited to cloud-only. Option D is wrong because disabling sign-in for emergency accounts would prevent their use.

Answer

Disable sign-in for the emergency access accounts until needed

Answer

Make the emergency access accounts cloud-only and enforce MFA

Answer

Assign FIDO2 security keys to the emergency access accounts

Question 3

You are planning a migration from on-premises Active Directory to Microsoft Entra ID using cloud sync. You need to synchronize user passwords so that users can authenticate using their existing passwords. Which feature should you enable?

Accepted Answer

Password Hash Synchronization. Password Hash Synchronization (PHS) is the correct feature because it synchronizes the hash of a user's on-premises Active Directory password to Microsoft Entra ID, allowing users to authenticate with the same password without any additional on-premises infrastructure. Cloud sync specifically relies on PHS to replicate password hashes from AD to Entra ID, enabling seamless authentication for cloud-based services.

Answer

Pass-through Authentication

Answer

Federation with AD FS

Answer

Seamless Single Sign-On

Question 4

Your organization uses Microsoft Entra ID Governance. You need to ensure that access reviews are automatically created for all guest users in the tenant and that reviews are sent to the guest users' managers for approval. You configure an access review policy. Which identity governance feature should you use?

Accepted Answer

Entitlement Management. B is correct because Entitlement Management in Microsoft Entra ID Governance allows you to configure access review policies that automatically create reviews for guest users and assign them to the guest users' managers for approval. This feature integrates with access reviews to enforce governance over external identities, ensuring that guest access is periodically recertified by the appropriate authority.

Answer

Terms of Use

Answer

Access Reviews

Answer

Privileged Identity Management

Question 5

Your company uses Microsoft Entra ID and has a custom line-of-business application that supports SAML-based SSO. You need to configure the application to use Microsoft Entra ID as the identity provider. Which enterprise application configuration should you use?

Accepted Answer

SAML-based Sign-on. The application supports SAML-based SSO, so the correct enterprise application configuration is SAML-based Sign-on. This allows Microsoft Entra ID to act as the identity provider by exchanging SAML assertions with the application, enabling federated authentication.

Answer

Linked Sign-on

Answer

Password-based Sign-on

Answer

OpenID Connect-based Sign-on

Question 6

Your organization uses Microsoft Entra ID and has a Conditional Access policy that requires MFA for all external users. However, guest users from a partner organization are being blocked when they try to access a SharePoint Online site. You need to ensure that guest users can access the site without being prompted for MFA if they have already satisfied MFA in their home tenant. What should you configure?

Accepted Answer

Enable the trust MFA for external users setting in cross-tenant access settings. Option C is correct because the cross-tenant access settings in Microsoft Entra ID include a 'Trust MFA from external tenants' option. When enabled, this setting allows guest users who have already satisfied MFA in their home tenant to access resources in your tenant without being prompted for MFA again. This respects the partner's MFA claims and avoids redundant authentication, which directly resolves the blocking issue caused by the Conditional Access policy requiring MFA for all external users.

Answer

Disable MFA requirement for guest users in Conditional Access

Answer

Configure authentication methods policy to accept MFA from external identities

Answer

Use B2B direct connect instead of B2B collaboration

Question 7

Your organization has a Microsoft 365 E5 subscription and uses Microsoft Entra ID. You are implementing Privileged Identity Management (PIM) to manage access to Azure AD roles. You need to ensure that when a user activates a privileged role, the activation request must be approved by their manager and must include a ticket number. What should you configure?

Accepted Answer

Modify the role settings in PIM to require approval and justification with ticket number. Option B is correct because PIM role settings allow you to configure activation requirements, including requiring approval and mandating a justification field. By enabling 'Require approval to activate' and configuring the approver as the user's manager, and by setting 'Require ticket information on activation', you enforce that every activation request includes a ticket number and is routed to the manager for approval.

Answer

Create an access review for the role

Answer

Configure an access package in Entitlement Management

Answer

Use Conditional Access policy with session controls

Question 8

Your company uses Microsoft Entra ID and wants to use Microsoft's recommendation to protect against password spray attacks. Which feature should you enable?

Accepted Answer

Smart Lockout. Smart Lockout is Microsoft's recommended feature to protect against password spray attacks because it intelligently locks out bad actors after a threshold of failed attempts while allowing legitimate users to continue. It uses adaptive logic to distinguish between real users and attackers by considering the sign-in pattern and IP address, making it the correct choice for this specific threat.

Answer

Identity Protection

Answer

Password Hash Synchronization

Answer

Multifactor Authentication

Question 9

Your organization uses Microsoft Entra ID and has a Conditional Access policy that requires compliant devices for access to corporate resources. You need to ensure that iOS devices are compliant before accessing Exchange Online. Which Microsoft Intune policy should you configure?

Accepted Answer

Device compliance policy. Option A is correct because Compliance policies define device compliance rules. Option B is wrong because Configuration policies are for settings. Option C is wrong because App protection policies are for app-level management. Option D is wrong because Enrollment restrictions control device enrollment.

Answer

Device configuration policy

Answer

App protection policy

Answer

Enrollment restrictions

Question 10

Your organization uses Microsoft Entra ID and has a hybrid identity configuration with Active Directory Federation Services (AD FS). You are migrating to cloud authentication using Pass-through Authentication (PTA). Which TWO components are required for a PTA deployment?

Accepted Answer

Service Bus endpoints in Azure. Pass-through Authentication (PTA) requires the PTA Agent to be installed on-premises to validate user passwords against Active Directory. It also uses Azure Service Bus endpoints to establish a secure, persistent connection between the on-premises agent and Microsoft Entra ID, enabling authentication requests to flow without storing passwords in the cloud.

Answer

Password Hash Synchronization agent

Answer

Azure AD Connect Health agent

Answer

Seamless Single Sign-On

Question 11

Your organization uses Microsoft Entra ID and wants to implement Identity Protection to detect risky users. Which THREE risk types can be detected by Identity Protection? (Choose three.)

Accepted Answer

Impossible travel. Impossible travel is a risk detection in Microsoft Entra ID Identity Protection that identifies sign-ins originating from geographically distant locations within a time frame that makes physical travel between them impossible. This detection uses the user's previous sign-in locations and the time between sign-ins to calculate the probability of a compromised account being used from a different region.

Answer

Password spray

Answer

Malware

Question 12

Your organization uses Microsoft Entra ID and wants to implement a passwordless authentication strategy. Which TWO authentication methods are considered passwordless by Microsoft? (Choose two.)

Accepted Answer

Windows Hello for Business. Windows Hello for Business is a passwordless authentication method that uses biometric or PIN-based credentials tied to a user's device, leveraging asymmetric key pairs to authenticate against Microsoft Entra ID without transmitting a password. It satisfies Microsoft's definition of passwordless because the private key never leaves the device, and authentication is performed via a cryptographic challenge-response protocol.

Answer

Microsoft Authenticator with notification

Answer

Password Hash Synchronization

Answer

SMS-based one-time passcode

Question 13

Refer to the exhibit. You are reviewing a Conditional Access policy JSON. The policy is intended to block legacy authentication. However, users are still able to connect using Exchange ActiveSync. What is the most likely reason?

Accepted Answer

The policy is missing the 'browser' and 'mobileAppsAndDesktopClient' client app types. The policy is missing the 'browser' and 'mobileAppsAndDesktopClient' client app types. Conditional Access policies that block legacy authentication must explicitly include these client app types because Exchange ActiveSync (EAS) uses the 'mobileAppsAndDesktopClient' type for modern authentication clients and falls back to legacy protocols if not properly targeted. Without these types, the policy does not apply to EAS traffic, allowing legacy connections to succeed.

Answer

The grant control operator 'OR' should be 'AND'

Answer

The policy is configured in 'report-only' mode instead of 'enforce'

Answer

The policy is missing a condition for 'device platforms' to target iOS and Android

Question 14

Your organization uses Microsoft Entra ID to manage user identities. You need to ensure that users can sign in using their existing social media accounts, such as Microsoft, Google, or Facebook. What should you configure?

Accepted Answer

Configure External Identities and add identity providers for social networks. Option B is correct because Microsoft Entra ID supports External Identities, which allow you to add social identity providers (Microsoft, Google, Facebook) as external authentication sources. This enables users to sign in with their existing social accounts by configuring federation with those providers using OAuth 2.0 or OpenID Connect protocols, without needing to create separate Entra ID accounts.

Answer

Configure Conditional Access policies for social identity providers

Answer

Configure Microsoft Entra Connect to sync social account attributes

Answer

Configure self-service password reset (SSPR)

Question 15

Your company is implementing a Zero Trust security model. You need to ensure that all user access requests to corporate resources are verified continuously, not just at the initial sign-in. Which Microsoft Entra ID feature should you use?

Accepted Answer

Continuous Access Evaluation (CAE). Continuous Access Evaluation (CAE) is the correct choice because it enforces real-time token validation and policy enforcement for every access request, not just at initial authentication. CAE works by having critical events (e.g., user disablement, IP address change, or risk elevation) trigger a revocation message to the resource provider, which then immediately blocks access—even if the token is still valid. This aligns directly with the Zero Trust principle of 'verify explicitly and continuously' rather than relying on a one-time sign-in.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra Verified ID