MS-102 Implement and manage Microsoft Entra identity and access Practice Test 5 — 15 Questions

Question 1

Which TWO of the following are features of Microsoft Entra ID Identity Protection? (Choose two.)

Accepted Answer

Sign-in risk policy that can block risky sign-ins.. Microsoft Entra ID Identity Protection includes a sign-in risk policy that can automatically block risky sign-ins based on real-time risk levels (e.g., high, medium, low). This policy evaluates sign-in risk detections and enforces actions such as blocking access or requiring multi-factor authentication (MFA) without manual intervention.

Answer

Risk detections such as leaked credentials and anonymous IP address.

Answer

Conditional Access policies integration.

Answer

Advanced Threat Protection (ATP) for identities.

Question 2

Refer to the exhibit. You are configuring consent for the Microsoft Graph application. Which of the following statements is true based on the JSON?

Accepted Answer

The User.Read.All permission requires admin consent.. The JSON shows the User.Read.All permission has the 'AdminConsentRequired' property set to true, meaning it requires admin consent. The Mail.Read permission has 'AdminConsentRequired' set to false, so users can consent to it without admin involvement. Option D correctly identifies that User.Read.All requires admin consent.

Answer

Users can consent to the User.Read.All permission.

Answer

The Mail.Read permission requires admin consent.

Answer

No consent is required for either permission.

Question 3

Refer to the exhibit. You run the PowerShell command to check the authentication method policy registration campaign. Which of the following is true?

Accepted Answer

All users will be prompted to register authentication methods via email.. The exhibit shows the output of the `Get-MgPolicyAuthenticationMethodPolicyRegistrationEnforcement` cmdlet, which reveals that the `state` is `enabled` and the `targetType` is `allUsers`. This means the registration campaign is active and targets every user in the tenant. The `includeTargets` block confirms all users are included, and the `excludeTargets` array is empty, so no users are excluded. Therefore, all users will be prompted via email to register authentication methods, making option B correct.

Answer

Only administrators are targeted for registration.

Answer

Users in the ExcludeTargets group will be excluded.

Answer

The registration campaign is disabled.

Question 4

Refer to the exhibit. You are configuring permissions for a daemon application that runs without a user. Which permission should you request?

Accepted Answer

User.Read.All application permission with admin consent.. For a daemon application that runs without a user, you must request an application permission (not delegated) because there is no signed-in user to delegate permissions. User.Read.All application permission allows the app to read all users' full profiles without a user context, and admin consent is required because this permission grants access to data across the entire organization.

Answer

Mail.Read delegated permission with admin consent.

Answer

Delegated permission type for User.Read.All.

Answer

User.Read.All delegated permission with user consent.

Question 5

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can access internal applications using single sign-on (SSO) without storing passwords in the cloud. Which authentication method should you implement?

Accepted Answer

Windows Hello for Business. Windows Hello for Business is correct because it enables passwordless single sign-on (SSO) to internal applications using biometric or PIN credentials, with the private key stored on the user's device rather than in the cloud. This meets the requirement of no passwords stored in the cloud while still providing seamless SSO access.

Answer

Federation with AD FS

Answer

Password hash synchronization

Answer

Pass-through authentication

Question 6

Your company has a Microsoft 365 E5 subscription and uses Microsoft Entra ID. You need to configure a conditional access policy that blocks access from devices that are not compliant with your organization's device compliance policies, as defined by Microsoft Intune. Which assignment should you configure in the policy?

Accepted Answer

Grant > Require device to be marked as compliant. The 'Require device to be marked as compliant' grant control in a Conditional Access policy enforces access decisions based on the compliance status reported by Microsoft Intune. When a device is marked as non-compliant by Intune (e.g., missing required updates or having an unapproved app), the policy blocks access. This directly meets the requirement to block devices that do not meet the organization's device compliance policies.

Answer

Grant > Require hybrid Azure AD joined device

Answer

Grant > Require multifactor authentication

Answer

Grant > Require approved client app

Question 7

Your organization uses Microsoft Entra ID with P2 licenses. You need to identify and remediate users who are at risk due to leaked credentials or anomalous sign-in activity. You want to automate the response to high-risk users by requiring a password change. Which feature should you use?

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra Identity Protection provides risk-based conditional access policies that can automatically require a password change for high-risk users. Option B is wrong because Microsoft Defender for Cloud Apps focuses on cloud application security, not identity risk. Option C is wrong because Microsoft Entra Identity Governance handles access reviews and entitlement management. Option D is wrong because Microsoft Entra Privileged Identity Management (PIM) manages privileged roles, not user risk.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra Identity Governance

Answer

Microsoft Entra Privileged Identity Management (PIM)

Question 8

You are configuring Microsoft Entra ID to allow external users from a partner organization to access a specific SharePoint Online site. You need to ensure that the external users authenticate using their own corporate credentials and are automatically invited when they first access the resource. What should you configure?

Accepted Answer

Microsoft Entra entitlement management access packages. Microsoft Entra entitlement management access packages allow you to create a policy that automatically sends an invitation to external users when they request access to a resource, such as a SharePoint Online site. This policy can be configured to require that external users authenticate using their own corporate credentials (via their home tenant) and be automatically added to the resource upon first access, without manual invitation. Entitlement management integrates with B2B collaboration under the hood, but adds the automation and approval workflows needed for this scenario.

Answer

Microsoft Entra External ID (B2C)

Answer

Microsoft Entra B2B direct connect

Answer

Microsoft Entra B2B collaboration with manual invitation

Question 9

Your organization uses Microsoft Entra ID and plans to deploy Microsoft Copilot for Microsoft 365. You need to ensure that Copilot respects the conditional access policies you have configured for data access. What should you do?

Accepted Answer

Apply sensitivity labels to data and configure conditional access policies to require labels. Microsoft Copilot for Microsoft 365 respects conditional access policies only when those policies are configured to require sensitivity labels. Copilot uses Microsoft Purview Information Protection to enforce data access controls based on labels, ensuring that policies like location, device compliance, or sign-in risk are applied to Copilot interactions. Without label-based policies, Copilot may bypass standard conditional access conditions.

Answer

Use Microsoft Defender for Cloud Apps session controls

Answer

Configure Privileged Identity Management (PIM) for Copilot roles

Answer

Enable Identity Protection for Copilot users

Question 10

Your organization has a hybrid identity deployment using Microsoft Entra Connect Sync. You need to ensure that password writeback is enabled so that users can reset their own passwords from the cloud. Which prerequisite must be met?

Accepted Answer

Self-Service Password Reset (SSPR) must be enabled in Microsoft Entra ID. Password writeback requires that Self-Service Password Reset (SSPR) is enabled in Microsoft Entra ID because writeback is a feature of SSPR that allows password changes initiated in the cloud to be written back to the on-premises Active Directory. Without SSPR enabled, the cloud tenant has no mechanism to trigger the writeback operation, even if the Entra Connect Sync configuration is correct.

Answer

Password hash synchronization must be enabled

Answer

Azure MFA must be enabled for all users

Answer

Microsoft Entra ID P2 licenses must be assigned

Question 11

Your company uses Microsoft Entra ID. You need to restrict access to a critical application to only users who are in a specific security group and are signing in from a trusted location. You configure a conditional access policy with the following conditions: users (the security group), cloud apps (the critical application), conditions (locations: trusted IP ranges). However, users in the security group are still able to access the app from untrusted locations. What is the most likely reason?

Accepted Answer

The policy is in report-only mode. When a Conditional Access policy is in report-only mode, it evaluates the conditions and logs the result but does not enforce any access controls (grant or block). This explains why users in the security group can still access the app from untrusted locations—the policy is not actively blocking or requiring MFA/location compliance. Report-only mode is commonly used for testing before enabling enforcement.

Answer

The policy is configured as a block policy but is overridden by another policy

Answer

The cloud app is not correctly assigned to the policy

Answer

The policy uses session controls instead of grant controls

Question 12

You are implementing Microsoft Entra Verified ID to issue verifiable credentials to employees for proof of employment. Which component is required to issue and verify credentials?

Accepted Answer

A decentralized identifier (DID) and a trusted identity system. Microsoft Entra Verified ID uses a decentralized identity model where each issuer and verifier has a unique decentralized identifier (DID) and a trusted identity system (such as a blockchain-based ION network or a web-based DID method) to publish and resolve DID documents. The DID and the trusted identity system are the core components required to cryptographically sign verifiable credentials and verify them without relying on a central authority, making option D correct.

Answer

Microsoft Entra ID P2 licenses for all users

Answer

A certificate from a public certificate authority (CA)

Answer

An Azure AD B2C tenant

Question 13

Your organization uses Microsoft Entra ID with Application Proxy to publish on-premises web apps. Users report that they are prompted for credentials multiple times when accessing an app. You need to reduce the number of authentication prompts. What should you configure?

Accepted Answer

Enable Kerberos Constrained Delegation (KCD) for single sign-on. The multiple authentication prompts indicate that the Application Proxy is not passing the user's credentials seamlessly to the on-premises app. Enabling Kerberos Constrained Delegation (KCD) allows the Application Proxy connector to impersonate the user and obtain a Kerberos ticket for the backend application, enabling single sign-on (SSO) and eliminating repeated credential prompts.

Answer

Enable Azure MFA for the application

Answer

Disable pre-authentication for the application

Answer

Increase the session lifetime in conditional access

Question 14

Your company uses Microsoft Entra ID with P2 licenses. You need to configure Privileged Identity Management (PIM) for Azure AD roles. Which THREE actions are possible with PIM?

Accepted Answer

Schedule start and end times for role assignments. PIM allows you to configure time-bound role assignments with specific start and end dates, enabling just-in-time access and reducing standing privileges. This is a core feature of PIM for Azure AD roles, supporting both eligible and active assignments with scheduled durations.

Answer

Automatically assign a role to all users in a security group

Answer

Limit role activation to a specific device

Question 15

Your organization uses Microsoft Entra ID. You need to enable users to securely share documents with external partners. Which TWO features should you use?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is correct because it allows you to securely share documents and collaborate with external partners by inviting them as guest users in your Entra ID tenant. This feature leverages existing identities (e.g., Microsoft, Google, or SAML/WS-Fed providers) without requiring external users to create new accounts, enabling controlled access to resources like SharePoint or Teams.

Answer

Azure AD B2C

Answer

Microsoft Purview Information Protection

Answer

Microsoft Defender for Cloud Apps