MS-102 Implement and manage Microsoft Entra identity and access Practice Test 4 — 15 Questions

Question 1

Your company is deploying Microsoft Copilot for Microsoft 365. You need to ensure that only users who have completed a specific training course can use Copilot. What should you configure?

Accepted Answer

Create a Conditional Access policy that requires a custom attribute indicating training completion. A Conditional Access policy can evaluate a custom security attribute assigned to a user or group to enforce access controls. By requiring a custom attribute that indicates training completion, you can block or grant access to Copilot for Microsoft 365 based on that attribute. This approach integrates directly with Microsoft Entra ID's policy engine, allowing granular, attribute-based access control without relying on license assignment or user acceptance.

Answer

Use Terms of Use to require acceptance of training policy

Answer

Configure Authentication strengths to require training certificate

Answer

Assign Copilot licenses only to users who completed training

Question 2

Your organization uses Microsoft Entra ID. You need to enable users to reset their own passwords without administrator intervention. Which TWO components must be configured?

Accepted Answer

Microsoft Entra self-service password reset (SSPR). Microsoft Entra self-service password reset (SSPR) is the core feature that allows users to reset their own passwords without administrator intervention. It must be enabled and configured at the tenant level, and it relies on users having registered authentication methods to verify their identity during the reset process.

Answer

Microsoft Entra Identity Protection

Answer

Conditional Access policies

Answer

Microsoft Entra Privileged Identity Management

Question 3

You are designing a Microsoft Entra ID governance strategy. Which THREE features should you use to implement the principle of least privilege for administrative roles?

Accepted Answer

Privileged Access Groups. Privileged Access Groups (B) enable you to grant just-in-time or time-bound access to Azure AD roles and other resources by assigning users to a group that is eligible for role activation, directly supporting the principle of least privilege by limiting standing administrative access.

Answer

Microsoft Entra Lifecycle Workflows

Answer

Microsoft Entra Entitlement Management

Question 4

Your company is implementing Microsoft Entra Conditional Access. You need to require multifactor authentication (MFA) for all users except those accessing from the corporate office. Which TWO components do you need?

Accepted Answer

Conditional Access policy configured with grant control requiring MFA and excluding Named Locations. To require MFA for all users except those accessing from the corporate office, you need a Conditional Access policy that grants access only if MFA is completed, and you must exclude the corporate office location. The 'Named Locations' configuration defines the corporate office IP ranges or trusted locations, and the Conditional Access policy uses that exclusion. Together, these two components enforce the requirement.

Answer

Microsoft Intune compliance policies

Answer

Microsoft Entra multifactor authentication registration policy

Answer

Microsoft Entra Identity Protection

Question 5

Your organization uses Microsoft Entra ID and requires that all guest users must have a mobile phone number registered for authentication. You need to enforce this requirement. What should you configure?

Accepted Answer

Configure the Authentication methods policy to require mobile phone registration for guests.. The Authentication methods policy in Microsoft Entra ID allows you to define which authentication methods are available to users, including guest users. By configuring this policy to require mobile phone registration, you enforce that all guest users must register a mobile phone number for authentication, directly addressing the requirement.

Answer

Create a Terms of Use policy that guests must accept.

Answer

Configure a Conditional Access policy requiring multifactor authentication for guest users.

Answer

Create an access review for guest users in Identity Governance.

Question 6

Your company uses Microsoft Entra ID and has an app named App1 that requires permissions to read all user profiles. You need to grant admin consent for App1 to read profiles without requiring each user to consent. What should you do?

Accepted Answer

From Microsoft Entra ID, go to Enterprise applications, select App1, and grant admin consent.. Granting admin consent for an enterprise application in Microsoft Entra ID allows a tenant administrator to pre-approve permissions for all users, eliminating the need for individual user consent. This is done by navigating to Enterprise applications, selecting App1, and using the 'Grant admin consent' option, which sends an OAuth 2.0 authorization request with the required permissions (e.g., User.Read.All) on behalf of the entire organization.

Answer

Create a Conditional Access policy that requires consent for App1.

Answer

Register a new application in App registrations and assign the required permissions.

Answer

Configure the user consent settings to allow users to consent for themselves.

Question 7

Your organization uses Microsoft Entra ID and has a custom role that grants 'microsoft.directory/applications/credentials/update' permission. A security audit reveals that a user assigned this role has modified credentials for an application. You need to prevent such actions while allowing other application updates. What should you do?

Accepted Answer

Create a custom role that excludes the 'microsoft.directory/applications/credentials/update' permission and assign it to the user.. The custom role currently includes the 'microsoft.directory/applications/credentials/update' permission, which allows modifying application credentials. To prevent credential updates while still permitting other application updates, you must create a new custom role that explicitly excludes this permission and assign it to the user. This approach preserves granular control without granting unnecessary privileges, unlike built-in roles that would either over-scope or under-scope permissions.

Answer

Assign the user the built-in Application Administrator role instead.

Answer

Enable multi-factor authentication for the user.

Answer

Remove the user from the custom role and assign them another role with fewer permissions.

Question 8

Your organization uses Microsoft Entra ID and wants to allow users to reset their own passwords using self-service password reset (SSPR). What is the minimum licensing required?

Accepted Answer

Microsoft Entra ID Free. Microsoft Entra ID Free includes self-service password reset (SSPR) for cloud-only users, making it the actual minimum licensing required. While Microsoft 365 Business Basic also includes Entra ID Free, it is not the minimum because the free tier alone is sufficient without any paid subscription.

Answer

Microsoft Entra ID P2

Answer

Microsoft 365 Business Basic

Answer

Microsoft Entra ID P1

Question 9

Your company uses Microsoft Entra ID and has an application that requires users to consent to permissions. You want to allow users to consent to low-risk permissions but require admin approval for high-risk permissions. What should you configure?

Accepted Answer

Configure the 'Admin consent settings' to allow user consent for low-risk permissions and require admin consent for high-risk permissions.. Microsoft Entra ID's admin consent settings allow you to configure a policy that permits user consent for low-risk permissions (e.g., those with no admin-restricted scopes) while requiring admin approval for high-risk permissions (e.g., those requiring admin consent). This granular control is achieved through the 'Admin consent settings' blade, where you can enable 'Allow user consent for apps' and then define a permission classification policy to categorize permissions as low or high risk.

Answer

Set user consent to 'Do not allow user consent'.

Answer

Set user consent to 'Allow user consent for apps'.

Answer

Create a Conditional Access policy that blocks high-risk consent.

Question 10

Your organization uses Microsoft Entra ID and has a hybrid identity setup with password hash synchronization. You need to ensure that when a user's on-premises Active Directory account is disabled, their Microsoft Entra ID account is also disabled within 30 minutes. What should you do?

Accepted Answer

Configure Azure AD Connect to sync the 'userAccountControl' attribute and set the sync frequency to 30 minutes.. Disabling an on-premises Active Directory account sets the 'userAccountControl' attribute (specifically the ACCOUNTDISABLE flag, bit 2). By configuring Azure AD Connect to sync this attribute and setting the sync frequency to 30 minutes, the disabled state is replicated to Microsoft Entra ID within that interval, ensuring the cloud account is also disabled.

Answer

Enable Azure AD Connect cloud sync.

Answer

Configure password hash synchronization to run every 30 minutes.

Answer

Enable password writeback.

Question 11

Your organization uses Microsoft Entra ID. You need to ensure that users cannot reuse their last 5 passwords when changing passwords. What should you configure?

Accepted Answer

Password protection policy - enforce password history.. The password history policy in Microsoft Entra ID (formerly Azure AD) enforces the number of unique passwords a user must use before they can reuse an old password. By setting the password history value to 5, users cannot reuse any of their last 5 passwords when changing their password. This directly meets the requirement to prevent reuse of the last 5 passwords.

Answer

Multi-factor authentication settings.

Answer

Account lockout threshold.

Answer

Smart lockout settings.

Question 12

Your organization uses Microsoft Entra ID and has an application that requires the 'User.Read.All' permission. You need to grant this permission to the application but ensure that only an administrator can consent, not users. What should you do?

Accepted Answer

Grant admin consent for the application from the Enterprise applications blade.. Granting admin consent from the Enterprise applications blade explicitly authorizes the application to access the 'User.Read.All' permission without requiring individual user consent. This is the only way to satisfy the requirement that only an administrator can consent, as admin consent bypasses user consent policies entirely and applies tenant-wide.

Answer

Enable user consent for this application in the enterprise application settings.

Answer

Configure the user consent settings to allow user consent for low-risk permissions.

Answer

Set the 'Consent and permissions' settings to block user consent.

Question 13

Your organization uses Microsoft Entra ID and has a custom role that includes the permission 'microsoft.directory/applications/credentials/update'. You need to create a new role that includes all permissions of the existing role except the credential update permission. What is the best approach?

Accepted Answer

Use the 'Copy role' option from the existing role and then remove the credential update permission.. The best approach is to copy the existing role and remove the unwanted permission. This allows you to start with all the existing permissions and then remove the credential update permission, ensuring you don't miss any permissions. Option B is incorrect because a Conditional Access policy cannot block specific permissions within a role; this is not feasible. Option C is incorrect because the Application Administrator role is a built-in role that includes many permissions beyond the original role and may include the credential update permission as well. Option D is incorrect because it would require manually adding all permissions, which is error-prone and less efficient than copying the role.

Answer

Assign the existing role to the user and create a Conditional Access policy that blocks credential update.

Answer

Assign the built-in Application Administrator role instead.

Answer

Create a new custom role and manually add all permissions except credential update.

Question 14

Which TWO of the following are required to configure Microsoft Entra ID self-service password reset (SSPR) for cloud-only users? (Choose two.)

Accepted Answer

Users must be assigned a license.. Each user must be assigned a Microsoft Entra ID license (such as P1 or P2) to be eligible for SSPR. Without a license assignment, the user cannot use the SSPR feature, even if the tenant has the required licenses available. Option D is correct because a paid Microsoft 365 license (e.g., Microsoft 365 Business Premium, E3, or E5) includes the necessary Microsoft Entra ID P1 or P2 functionality, which is required for SSPR. Cloud-only users do not require Azure AD Connect or MFA registration for basic SSPR, though MFA is recommended for stronger security.

Answer

Microsoft Entra ID P1 or P2 license.

Answer

Azure AD Connect synchronization.

Answer

Users must register for MFA.

Question 15

Which THREE of the following are valid permissions in Microsoft Entra ID custom roles? (Choose three.)

Accepted Answer

microsoft.directory/applications/delete. Options A, B, and C are valid permissions in Microsoft Entra ID custom roles. Option A, 'microsoft.directory/applications/delete', allows deletion of applications. Option B, 'microsoft.directory/applications/credentials/update', allows updating application credentials. Option C, 'microsoft.directory/users/update', allows updating user properties. Option D is invalid because role assignment permission is 'microsoft.directory/roleAssignments/assign', not 'microsoft.directory/roles/assign'. Option E, 'microsoft.directory/groups/members/update', is also a valid permission, but it is not one of the three correct answers for this question.

Answer

microsoft.directory/roles/assign

Answer

microsoft.directory/groups/members/update