MS-102 Implement and manage Microsoft Entra identity and access Practice Test 5 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID and has a hybrid identity setup with password hash synchronization. You need to ensure that when a user's on-premises Active Directory account is disabled, their Microsoft Entra ID account is also disabled within 30 minutes. What should you do?

Accepted Answer

Configure Azure AD Connect to sync the 'userAccountControl' attribute and set the sync frequency to 30 minutes.. Option D is correct because you need to enable password hash sync (which is already enabled) and also enable Azure AD Connect sync for account status changes. Option A is wrong because that only changes password behavior. Option B is wrong because that does not affect account status. Option C is wrong because that is for writing back password resets, not sync.

Answer

Enable Azure AD Connect cloud sync.

Answer

Configure password hash synchronization to run every 30 minutes.

Answer

Enable password writeback.

Question 2

Your organization uses Microsoft Entra ID. You need to ensure that users cannot reuse their last 5 passwords when changing passwords. What should you configure?

Accepted Answer

Password protection policy - enforce password history.. The password history policy in Microsoft Entra ID (formerly Azure AD) enforces the number of unique passwords a user must use before they can reuse an old password. By setting the password history value to 5, users cannot reuse any of their last 5 passwords when changing their password. This directly meets the requirement to prevent reuse of the last 5 passwords.

Answer

Multi-factor authentication settings.

Answer

Account lockout threshold.

Answer

Smart lockout settings.

Question 3

Your organization uses Microsoft Entra ID and has an application that requires the 'User.Read.All' permission. You need to grant this permission to the application but ensure that only an administrator can consent, not users. What should you do?

Accepted Answer

Grant admin consent for the application from the Enterprise applications blade.. Option A is correct because granting admin consent from the Enterprise applications blade explicitly authorizes the application to access the 'User.Read.All' permission without requiring individual user consent. This is the only way to satisfy the requirement that only an administrator can consent, as admin consent bypasses user consent policies entirely and applies tenant-wide.

Answer

Enable user consent for this application in the enterprise application settings.

Answer

Configure the user consent settings to allow user consent for low-risk permissions.

Answer

Set the 'Consent and permissions' settings to block user consent.

Question 4

Your organization uses Microsoft Entra ID and has a custom role that includes the permission 'microsoft.directory/applications/credentials/update'. You need to create a new role that includes all permissions of the existing role except the credential update permission. What is the best approach?

Accepted Answer

Use the 'Copy role' option from the existing role and then remove the credential update permission.. Option B is correct because you can copy the existing role and remove the unwanted permission. Option A is wrong because you would need to specify all permissions manually. Option C is wrong because you cannot assign a role and then deny a specific permission. Option D is wrong because there is no built-in role that matches.

Answer

Assign the existing role to the user and create a Conditional Access policy that blocks credential update.

Answer

Assign the built-in Application Administrator role instead.

Answer

Create a new custom role and manually add all permissions except credential update.

Question 5

Which TWO of the following are required to configure Microsoft Entra ID self-service password reset (SSPR) for cloud-only users? (Choose two.)

Accepted Answer

Users must be assigned a license.. Option C is correct because each user must be assigned a Microsoft Entra ID license (such as P1 or P2) to be eligible for SSPR. Without a license assignment, the user cannot use the SSPR feature, even if the tenant has the required licenses available. Option D is correct because a paid Microsoft 365 license (e.g., Microsoft 365 Business Premium, E3, or E5) includes the necessary Microsoft Entra ID P1 or P2 functionality, which is required for SSPR. Cloud-only users do not require Azure AD Connect or MFA registration for basic SSPR, though MFA is recommended for stronger security.

Answer

Microsoft Entra ID P1 or P2 license.

Answer

Azure AD Connect synchronization.

Answer

Users must register for MFA.

Question 6

Which THREE of the following are valid permissions in Microsoft Entra ID custom roles? (Choose three.)

Accepted Answer

microsoft.directory/applications/delete. Option A is correct because 'microsoft.directory/applications/delete' is a valid permission in Microsoft Entra ID custom roles. Custom roles allow granular permissions defined by the 'microsoft.directory' namespace, and deleting applications is a supported action under the 'applications' resource type.

Answer

microsoft.directory/applications/credentials/update

Answer

microsoft.directory/roles/assign

Answer

microsoft.directory/groups/members/update

Question 7

Which TWO of the following are features of Microsoft Entra ID Identity Protection? (Choose two.)

Accepted Answer

Sign-in risk policy that can block risky sign-ins.. Option A is correct because Microsoft Entra ID Identity Protection includes a sign-in risk policy that can automatically block risky sign-ins based on real-time risk levels (e.g., high, medium, low). This policy evaluates sign-in risk detections and enforces actions such as blocking access or requiring multi-factor authentication (MFA) without manual intervention.

Answer

Risk detections such as leaked credentials and anonymous IP address.

Answer

Conditional Access policies integration.

Answer

Advanced Threat Protection (ATP) for identities.

Question 8

Refer to the exhibit. You are configuring consent for the Microsoft Graph application. Which of the following statements is true based on the JSON?

Accepted Answer

The User.Read.All permission requires admin consent.. The JSON shows the User.Read.All permission has the 'AdminConsentRequired' property set to true, meaning it requires admin consent. The Mail.Read permission has 'AdminConsentRequired' set to false, so users can consent to it without admin involvement. Option D correctly identifies that User.Read.All requires admin consent.

Answer

Users can consent to the User.Read.All permission.

Answer

The Mail.Read permission requires admin consent.

Answer

No consent is required for either permission.

Question 9

Refer to the exhibit. You run the PowerShell command to check the authentication method policy registration campaign. Which of the following is true?

Accepted Answer

All users will be prompted to register authentication methods via email.. The exhibit shows the output of the `Get-MgPolicyAuthenticationMethodPolicyRegistrationEnforcement` cmdlet, which reveals that the `state` is `enabled` and the `targetType` is `allUsers`. This means the registration campaign is active and targets every user in the tenant. The `includeTargets` block confirms all users are included, and the `excludeTargets` array is empty, so no users are excluded. Therefore, all users will be prompted via email to register authentication methods, making option B correct.

Answer

Only administrators are targeted for registration.

Answer

Users in the ExcludeTargets group will be excluded.

Answer

The registration campaign is disabled.

Question 10

Refer to the exhibit. You are configuring permissions for a daemon application that runs without a user. Which permission should you request?

Accepted Answer

User.Read.All application permission with admin consent.. For a daemon application that runs without a user, you must request an application permission (not delegated) because there is no signed-in user to delegate permissions. User.Read.All application permission allows the app to read all users' full profiles without a user context, and admin consent is required because this permission grants access to data across the entire organization.

Answer

Mail.Read delegated permission with admin consent.

Answer

Delegated permission type for User.Read.All.

Answer

User.Read.All delegated permission with user consent.

Question 11

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can access internal applications using single sign-on (SSO) without storing passwords in the cloud. Which authentication method should you implement?

Accepted Answer

Windows Hello for Business. Windows Hello for Business is correct because it enables passwordless single sign-on (SSO) to internal applications using biometric or PIN credentials, with the private key stored on the user's device rather than in the cloud. This meets the requirement of no passwords stored in the cloud while still providing seamless SSO access.

Answer

Federation with AD FS

Answer

Password hash synchronization

Answer

Pass-through authentication

Question 12

Your company has a Microsoft 365 E5 subscription and uses Microsoft Entra ID. You need to configure a conditional access policy that blocks access from devices that are not compliant with your organization's device compliance policies, as defined by Microsoft Intune. Which assignment should you configure in the policy?

Accepted Answer

Grant > Require device to be marked as compliant. Option C is correct because the 'Require device to be marked as compliant' grant control in a Conditional Access policy enforces access decisions based on the compliance status reported by Microsoft Intune. When a device is marked as non-compliant by Intune (e.g., missing required updates or having an unapproved app), the policy blocks access. This directly meets the requirement to block devices that do not meet the organization's device compliance policies.

Answer

Grant > Require hybrid Azure AD joined device

Answer

Grant > Require multifactor authentication

Answer

Grant > Require approved client app

Question 13

Your organization uses Microsoft Entra ID with P2 licenses. You need to identify and remediate users who are at risk due to leaked credentials or anomalous sign-in activity. You want to automate the response to high-risk users by requiring a password change. Which feature should you use?

Accepted Answer

Microsoft Entra Identity Protection. Option B is correct because Identity Protection provides risk-based conditional access policies to automatically remediate high-risk users. Option A is wrong because Privileged Identity Management (PIM) manages privileged roles, not user risk. Option C is wrong because Identity Governance handles access reviews and entitlement management. Option D is wrong because Microsoft Defender for Cloud Apps focuses on cloud app security, not identity risk.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra Identity Governance

Answer

Microsoft Entra Privileged Identity Management (PIM)

Question 14

You are configuring Microsoft Entra ID to allow external users from a partner organization to access a specific SharePoint Online site. You need to ensure that the external users authenticate using their own corporate credentials and are automatically invited when they first access the resource. What should you configure?

Accepted Answer

Microsoft Entra entitlement management access packages. Option C is correct because Microsoft Entra entitlement management access packages allow you to create a policy that automatically sends an invitation to external users when they request access to a resource, such as a SharePoint Online site. This policy can be configured to require that external users authenticate using their own corporate credentials (via their home tenant) and be automatically added to the resource upon first access, without manual invitation. Entitlement management integrates with B2B collaboration under the hood, but adds the automation and approval workflows needed for this scenario.

Answer

Microsoft Entra External ID (B2C)

Answer

Microsoft Entra B2B direct connect

Answer

Microsoft Entra B2B collaboration with manual invitation

Question 15

Your organization uses Microsoft Entra ID and plans to deploy Microsoft Copilot for Microsoft 365. You need to ensure that Copilot respects the conditional access policies you have configured for data access. What should you do?

Accepted Answer

Apply sensitivity labels to data and configure conditional access policies to require labels. Option D is correct because Microsoft Copilot for Microsoft 365 respects conditional access policies only when those policies are configured to require sensitivity labels. Copilot uses Microsoft Purview Information Protection to enforce data access controls based on labels, ensuring that policies like location, device compliance, or sign-in risk are applied to Copilot interactions. Without label-based policies, Copilot may bypass standard conditional access conditions.

Answer

Use Microsoft Defender for Cloud Apps session controls

Answer

Configure Privileged Identity Management (PIM) for Copilot roles

Answer

Enable Identity Protection for Copilot users