MS-102 Implement and manage Microsoft Entra identity and access Practice Test 4 — 15 Questions

Question 1

Your organization has a hybrid identity environment with Microsoft Entra Connect. You are planning to migrate to cloud-only authentication using Microsoft Entra Cloud Sync. However, some legacy applications still require NTLM authentication. What should you do to ensure those applications can authenticate after the migration?

Accepted Answer

Use Microsoft Entra Application Proxy to publish the legacy applications. Option C is correct because Microsoft Entra Application Proxy can provide secure access to legacy on-premises apps and support NTLM. Option A is wrong because cloud sync does not support NTLM. Option B is wrong because PHS supports modern auth, not NTLM. Option D is wrong because PTA does not support NTLM directly.

Answer

Enable pass-through authentication (PTA)

Answer

Configure Microsoft Entra Cloud Sync with password hash sync

Answer

Deploy Microsoft Entra Password Protection

Question 2

You need to grant a vendor access to a specific SharePoint Online site for a limited time. The vendor does not have an account in your Microsoft Entra ID. What should you use?

Accepted Answer

Use Microsoft Entra B2B collaboration and set an expiration for the guest user. Microsoft Entra B2B collaboration allows you to invite external users (vendors) as guest users to access your organization's resources, including SharePoint Online sites, without requiring them to have an existing account in your tenant. You can configure an expiration policy for the guest user account to automatically remove access after a specified period, meeting the requirement for limited-time access.

Answer

Create a user account via Microsoft Entra Connect

Answer

Configure self-service sign-up user flow

Answer

Assign the vendor a guest user account with no expiration

Question 3

Your company uses Microsoft Intune for mobile device management. You need to ensure that only compliant devices can access corporate email in Microsoft 365. Which Microsoft Entra ID feature should you combine with Intune compliance policies?

Accepted Answer

Conditional Access. Conditional Access is the correct answer because it is the Microsoft Entra ID feature that enforces access controls based on signals such as device compliance. When combined with Intune compliance policies, Conditional Access can block or allow access to corporate email in Microsoft 365 based on whether the device is marked as compliant by Intune. This integration ensures that only devices meeting your organization's security requirements can access corporate resources.

Answer

Microsoft Entra Application Proxy

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Question 4

Your organization uses Microsoft Entra ID Governance. You need to automate the removal of access when an employee leaves the company. The identity lifecycle should trigger access reviews and automatic deprovisioning. What should you configure?

Accepted Answer

Microsoft Entra Lifecycle Workflows. Option D is correct because Lifecycle Workflows automate joiner, mover, leaver processes. Option A is wrong because Entitlement Management manages access packages. Option B is wrong because Access Reviews are manual unless automated by Lifecycle Workflows. Option C is wrong because PIM is for privileged roles.

Answer

Microsoft Entra Entitlement Management

Answer

Microsoft Entra Access Reviews

Answer

Microsoft Entra Privileged Identity Management

Question 5

You need to prevent users from registering security information for Microsoft Entra self-service password reset (SSPR) if they are not in a specific group. What should you configure?

Accepted Answer

SSPR scope setting to require group membership. Option B is correct because the SSPR scope can be set to a specific group. Option A is wrong because combined registration is for both SSPR and MFA. Option C is wrong because Conditional Access can block registration but not scope it. Option D is wrong because Identity Protection is for risk.

Answer

Microsoft Entra Identity Protection user risk policy

Answer

Combined registration for SSPR and Microsoft Entra multifactor authentication

Answer

Conditional Access policy to block registration for non-group members

Question 6

Your organization uses Microsoft Entra Conditional Access. You need to block access from countries where your company does not operate. The list of blocked countries changes frequently. What is the most efficient way to manage this?

Accepted Answer

Create Named Locations for blocked countries and use them in Conditional Access. Named Locations in Microsoft Entra Conditional Access allow you to define countries by IP ranges and then use those locations in a policy to block access. This is the most efficient approach because you can update the list of blocked countries in the Named Locations configuration without modifying the Conditional Access policy itself, which is ideal when the list changes frequently.

Answer

Enable Microsoft Entra multifactor authentication for all users from blocked countries

Answer

Create a Conditional Access policy that blocks all locations except the allowed countries

Answer

Use IP ranges in Conditional Access to block specific country IPs

Question 7

Your company is deploying Microsoft Copilot for Microsoft 365. You need to ensure that only users who have completed a specific training course can use Copilot. What should you configure?

Accepted Answer

Create a Conditional Access policy that requires a custom attribute indicating training completion. Option C is correct because a Conditional Access policy can evaluate a custom security attribute assigned to a user or group to enforce access controls. By requiring a custom attribute that indicates training completion, you can block or grant access to Copilot for Microsoft 365 based on that attribute. This approach integrates directly with Microsoft Entra ID's policy engine, allowing granular, attribute-based access control without relying on license assignment or user acceptance.

Answer

Use Terms of Use to require acceptance of training policy

Answer

Configure Authentication strengths to require training certificate

Answer

Assign Copilot licenses only to users who completed training

Question 8

Your organization uses Microsoft Entra ID. You need to enable users to reset their own passwords without administrator intervention. Which TWO components must be configured?

Accepted Answer

Microsoft Entra self-service password reset (SSPR). Microsoft Entra self-service password reset (SSPR) is the core feature that allows users to reset their own passwords without administrator intervention. It must be enabled and configured at the tenant level, and it relies on users having registered authentication methods to verify their identity during the reset process.

Answer

Microsoft Entra Identity Protection

Answer

Conditional Access policies

Answer

Microsoft Entra Privileged Identity Management

Question 9

You are designing a Microsoft Entra ID governance strategy. Which THREE features should you use to implement the principle of least privilege for administrative roles?

Accepted Answer

Privileged Access Groups. Privileged Access Groups (B) enable you to grant just-in-time or time-bound access to Azure AD roles and other resources by assigning users to a group that is eligible for role activation, directly supporting the principle of least privilege by limiting standing administrative access.

Answer

Microsoft Entra Lifecycle Workflows

Answer

Microsoft Entra Entitlement Management

Question 10

Your company is implementing Microsoft Entra Conditional Access. You need to require multifactor authentication (MFA) for all users except those accessing from the corporate office. Which TWO components do you need?

Accepted Answer

Conditional Access policy configured with grant control requiring MFA and excluding Named Locations. To require MFA for all users except those accessing from the corporate office, you need a Conditional Access policy that grants access only if MFA is completed, and you must exclude the corporate office location. The 'Named Locations' configuration defines the corporate office IP ranges or trusted locations, and the Conditional Access policy uses that exclusion. Together, these two components enforce the requirement.

Answer

Microsoft Intune compliance policies

Answer

Microsoft Entra multifactor authentication registration policy

Answer

Microsoft Entra Identity Protection

Question 11

Your organization uses Microsoft Entra ID and requires that all guest users must have a mobile phone number registered for authentication. You need to enforce this requirement. What should you configure?

Accepted Answer

Configure the Authentication methods policy to require mobile phone registration for guests.. Option C is correct because the Authentication methods policy in Microsoft Entra ID allows you to define which authentication methods are available to users, including guest users. By configuring this policy to require mobile phone registration, you enforce that all guest users must register a mobile phone number for authentication, directly addressing the requirement.

Answer

Create a Terms of Use policy that guests must accept.

Answer

Configure a Conditional Access policy requiring multifactor authentication for guest users.

Answer

Create an access review for guest users in Identity Governance.

Question 12

Your company uses Microsoft Entra ID and has an app named App1 that requires permissions to read all user profiles. You need to grant admin consent for App1 to read profiles without requiring each user to consent. What should you do?

Accepted Answer

From Microsoft Entra ID, go to Enterprise applications, select App1, and grant admin consent.. Option C is correct because granting admin consent for an enterprise application in Microsoft Entra ID allows a tenant administrator to pre-approve permissions for all users, eliminating the need for individual user consent. This is done by navigating to Enterprise applications, selecting App1, and using the 'Grant admin consent' option, which sends an OAuth 2.0 authorization request with the required permissions (e.g., User.Read.All) on behalf of the entire organization.

Answer

Create a Conditional Access policy that requires consent for App1.

Answer

Register a new application in App registrations and assign the required permissions.

Answer

Configure the user consent settings to allow users to consent for themselves.

Question 13

Your organization uses Microsoft Entra ID and has a custom role that grants 'microsoft.directory/applications/credentials/update' permission. A security audit reveals that a user assigned this role has modified credentials for an application. You need to prevent such actions while allowing other application updates. What should you do?

Accepted Answer

Create a custom role that excludes the 'microsoft.directory/applications/credentials/update' permission and assign it to the user.. The custom role currently includes the 'microsoft.directory/applications/credentials/update' permission, which allows modifying application credentials. To prevent credential updates while still permitting other application updates, you must create a new custom role that explicitly excludes this permission and assign it to the user. This approach preserves granular control without granting unnecessary privileges, unlike built-in roles that would either over-scope or under-scope permissions.

Answer

Assign the user the built-in Application Administrator role instead.

Answer

Enable multi-factor authentication for the user.

Answer

Remove the user from the custom role and assign them another role with fewer permissions.

Question 14

Your organization uses Microsoft Entra ID and wants to allow users to reset their own passwords using self-service password reset (SSPR). What is the minimum licensing required?

Accepted Answer

Microsoft 365 Business Basic. Microsoft Entra ID Free includes self-service password reset (SSPR) for cloud-only users. Since the question does not specify hybrid or on-premises requirements, the minimum licensing needed is the free tier. Microsoft 365 Business Basic includes Entra ID Free, making it a valid minimum licensing option that provides SSPR for cloud users.

Answer

Microsoft Entra ID P2

Answer

Microsoft Entra ID Free

Answer

Microsoft Entra ID P1

Question 15

Your company uses Microsoft Entra ID and has an application that requires users to consent to permissions. You want to allow users to consent to low-risk permissions but require admin approval for high-risk permissions. What should you configure?

Accepted Answer

Configure the 'Admin consent settings' to allow user consent for low-risk permissions and require admin consent for high-risk permissions.. Option C is correct because Microsoft Entra ID's admin consent settings allow you to configure a policy that permits user consent for low-risk permissions (e.g., those with no admin-restricted scopes) while requiring admin approval for high-risk permissions (e.g., those requiring admin consent). This granular control is achieved through the 'Admin consent settings' blade, where you can enable 'Allow user consent for apps' and then define a permission classification policy to categorize permissions as low or high risk.

Answer

Set user consent to 'Do not allow user consent'.

Answer

Set user consent to 'Allow user consent for apps'.

Answer

Create a Conditional Access policy that blocks high-risk consent.