MS-102 Implement and manage Microsoft Entra identity and access Practice Test 6 — 15 Questions

Question 1

Your organization has a hybrid identity deployment using Microsoft Entra Connect Sync. You need to ensure that password writeback is enabled so that users can reset their own passwords from the cloud. Which prerequisite must be met?

Accepted Answer

Self-Service Password Reset (SSPR) must be enabled in Microsoft Entra ID. Password writeback requires that Self-Service Password Reset (SSPR) is enabled in Microsoft Entra ID because writeback is a feature of SSPR that allows password changes initiated in the cloud to be written back to the on-premises Active Directory. Without SSPR enabled, the cloud tenant has no mechanism to trigger the writeback operation, even if the Entra Connect Sync configuration is correct.

Answer

Password hash synchronization must be enabled

Answer

Azure MFA must be enabled for all users

Answer

Microsoft Entra ID P2 licenses must be assigned

Question 2

Your company uses Microsoft Entra ID. You need to restrict access to a critical application to only users who are in a specific security group and are signing in from a trusted location. You configure a conditional access policy with the following conditions: users (the security group), cloud apps (the critical application), conditions (locations: trusted IP ranges). However, users in the security group are still able to access the app from untrusted locations. What is the most likely reason?

Accepted Answer

The policy is in report-only mode. When a Conditional Access policy is in report-only mode, it evaluates the conditions and logs the result but does not enforce any access controls (grant or block). This explains why users in the security group can still access the app from untrusted locations—the policy is not actively blocking or requiring MFA/location compliance. Report-only mode is commonly used for testing before enabling enforcement.

Answer

The policy is configured as a block policy but is overridden by another policy

Answer

The cloud app is not correctly assigned to the policy

Answer

The policy uses session controls instead of grant controls

Question 3

You are implementing Microsoft Entra Verified ID to issue verifiable credentials to employees for proof of employment. Which component is required to issue and verify credentials?

Accepted Answer

A decentralized identifier (DID) and a trusted identity system. Microsoft Entra Verified ID uses a decentralized identity model where each issuer and verifier has a unique decentralized identifier (DID) and a trusted identity system (such as a blockchain-based ION network or a web-based DID method) to publish and resolve DID documents. The DID and the trusted identity system are the core components required to cryptographically sign verifiable credentials and verify them without relying on a central authority, making option D correct.

Answer

Microsoft Entra ID P2 licenses for all users

Answer

A certificate from a public certificate authority (CA)

Answer

An Azure AD B2C tenant

Question 4

Your organization uses Microsoft Entra ID with Application Proxy to publish on-premises web apps. Users report that they are prompted for credentials multiple times when accessing an app. You need to reduce the number of authentication prompts. What should you configure?

Accepted Answer

Enable Kerberos Constrained Delegation (KCD) for single sign-on. Option B is correct because enabling Kerberos Constrained Delegation (KCD) with single sign-on allows the Application Proxy connector to authenticate users without additional prompts. Option A is wrong because pre-authentication with Entra ID already provides SSO if configured. Option C is wrong because MFA would increase prompts. Option D is wrong because session lifetime settings do not affect the number of prompts per session.

Answer

Enable Azure MFA for the application

Answer

Disable pre-authentication for the application

Answer

Increase the session lifetime in conditional access

Question 5

Your organization uses Microsoft Entra ID. You need to implement a solution that allows users to sign in without a password using their smartphone. Which TWO authentication methods can be used?

Accepted Answer

Microsoft Authenticator app (phone sign-in). The Microsoft Authenticator app supports phone sign-in, which allows users to authenticate by approving a notification or entering a number displayed on the screen, eliminating the need for a password. FIDO2 security keys enable passwordless authentication using hardware-based public/private key cryptography, meeting the requirement for smartphone-based sign-in when the key is connected via USB or NFC. Both methods are supported by Microsoft Entra ID for passwordless authentication.

Answer

Temporary Access Pass

Answer

Windows Hello for Business

Answer

Text message (SMS) verification code

Question 6

Your company uses Microsoft Entra ID with P2 licenses. You need to configure Privileged Identity Management (PIM) for Azure AD roles. Which THREE actions are possible with PIM?

Accepted Answer

Schedule start and end times for role assignments. Option B is correct because PIM allows you to configure time-bound role assignments with specific start and end dates, enabling just-in-time access and reducing standing privileges. This is a core feature of PIM for Azure AD roles, supporting both eligible and active assignments with scheduled durations.

Answer

Automatically assign a role to all users in a security group

Answer

Limit role activation to a specific device

Question 7

Your organization uses Microsoft Entra ID. You need to enable users to securely share documents with external partners. Which TWO features should you use?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is correct because it allows you to securely share documents and collaborate with external partners by inviting them as guest users in your Entra ID tenant. This feature leverages existing identities (e.g., Microsoft, Google, or SAML/WS-Fed providers) without requiring external users to create new accounts, enabling controlled access to resources like SharePoint or Teams.

Answer

Azure AD B2C

Answer

Microsoft Purview Information Protection

Answer

Microsoft Defender for Cloud Apps

Question 8

Refer to the exhibit. The Contoso tenant has a cross-tenant access policy configured for Fabrikam. Users from Fabrikam are unable to access resources in Contoso via B2B collaboration. What is the most likely reason?

Accepted Answer

The B2BCollaborationInbound setting for Fabrikam does not allow any identities or applications. Option C is correct because the B2BCollaborationInbound setting for Fabrikam controls which external users and applications are allowed to access Contoso resources via B2B collaboration. If this setting does not allow any identities or applications, all inbound B2B collaboration attempts from Fabrikam will be blocked, even if the default cross-tenant access policy is permissive.

Answer

The B2BCollaborationOutbound setting is blocking access

Answer

The default cross-tenant access policy is set to block all

Answer

The B2BDirectConnectInbound setting is empty

Question 9

Refer to the exhibit. You have created a conditional access policy as shown. Users report that they can still access cloud apps from non-compliant devices. What is the most likely reason?

Accepted Answer

The grant control operator is set to "OR" with only one control, which requires no controls to be satisfied. Option C is correct because the conditional access policy's grant control is set to 'OR' with only a single control selected (e.g., 'Require device to be marked as compliant'). When the operator is 'OR' and only one control is listed, the policy effectively requires that control to be satisfied. However, if the control is not enforced due to a misconfiguration or the device not being evaluated (e.g., the device platform is not specified), the 'OR' operator with a single control can be interpreted as granting access if any control is met—but since only one exists, it still must be met. The most likely reason users can still access cloud apps from non-compliant devices is that the policy's grant control operator is set to 'OR' with only one control, which means the policy does not actually block access if the control is not satisfied; instead, it allows access because the 'OR' condition is technically satisfied by the absence of a second control to fail against. In practice, this configuration is a common misconfiguration that results in the policy being ineffective.

Answer

The policy does not exclude specific users

Answer

The policy does not include all cloud apps

Answer

The policy uses session controls instead of grant controls

Question 10

Refer to the exhibit. You run the KQL query in Microsoft Sentinel. The query returns zero results even though you know user@contoso.com has had failed sign-in attempts in the last 30 days. What is the most likely reason?

Accepted Answer

The query filters on UserPrincipalName incorrectly. Option D is correct because the query filters by UserPrincipalName, which may not match the actual data field (e.g., it could be UserId or different format). Option A is wrong because the query uses ago(30d). Option B is wrong because the query includes all results. Option C is wrong because the query uses summarize correctly.

Answer

The query uses ago(30d) but the data retention is only 7 days

Answer

The summarize statement is incorrect

Answer

The query excludes successful sign-ins

Question 11

Contoso uses Microsoft Entra ID P2. Users report that password reset self-service does not work. You verify that the users have the required license. What should you check next?

Accepted Answer

Verify SSPR is enabled in Microsoft Entra ID. The users already have the required Microsoft Entra ID P2 license, which includes SSPR functionality. However, SSPR must be explicitly enabled at the tenant level in Microsoft Entra ID under 'Password reset' settings before users can use the self-service password reset feature. Without this tenant-wide enablement, even licensed users cannot reset their passwords.

Answer

Ensure the users are in a group scoped for SSPR

Answer

Check that the users have registered for SSPR

Answer

Confirm the users have Microsoft Entra ID P1 licenses

Question 12

Your organization plans to allow external users to access a SharePoint Online site using their own Microsoft Entra ID credentials. You need to ensure that external users can authenticate without creating a guest account in your tenant. Which solution should you use?

Accepted Answer

Configure B2B direct connect. B2B direct connect allows external users from trusted Microsoft Entra ID tenants to access your SharePoint Online sites using their own identities without requiring a guest user object in your tenant. This solution uses cross-tenant access settings and supports open authentication with their existing credentials, meeting the requirement to avoid guest account creation.

Answer

Configure B2B collaboration

Answer

Create external users as members

Answer

Use Microsoft Entra Verified ID

Question 13

A company uses Microsoft Entra ID with group-based licensing. You assign a license to a group, but some members do not receive the license. There are no error messages in the audit logs. What is the most likely cause?

Accepted Answer

Users have the license directly assigned. When a user has a license directly assigned, group-based licensing skips that user because the direct assignment takes precedence. The group licensing engine detects the existing license and does not attempt to reassign it, so no error is logged. This is the most common cause of silent license assignment failures in Microsoft Entra ID.

Answer

The group has more than 500 members

Answer

The group is a dynamic group

Answer

The product license is out of stock

Question 14

You need to enforce multifactor authentication (MFA) for all users in a Microsoft Entra ID tenant. The solution must not require users to register security info if they already have it. Which approach should you use?

Accepted Answer

Create a Conditional Access policy that requires MFA for all users. Option C is correct because a Conditional Access policy can require MFA for all users while respecting existing security info registration. The policy triggers MFA during sign-in but does not force re-registration if the user has already registered. This meets the requirement of not requiring users to register security info if they already have it.

Answer

Use identity protection to enforce MFA for risky sign-ins

Answer

Assign MFA per user in the Microsoft Entra admin center

Answer

Enable security defaults

Question 15

An administrator needs to grant a user the ability to reset passwords for other users in Microsoft Entra ID. Which role should be assigned?

Accepted Answer

Helpdesk Administrator. The Helpdesk Administrator role can reset passwords for non-administrators and limited administrators.

Answer

Password Administrator

Answer

Global Administrator

Answer

User Administrator