MS-102 Implement and manage Microsoft Entra identity and access Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. The Contoso tenant has a cross-tenant access policy configured for Fabrikam. Users from Fabrikam are unable to access resources in Contoso via B2B collaboration. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The B2BCollaborationInbound setting for Fabrikam does not allow any identities or applications. The B2BCollaborationInbound setting for Fabrikam controls which external users and applications are allowed to access Contoso resources via B2B collaboration. If this setting does not allow any identities or applications, all inbound B2B collaboration attempts from Fabrikam will be blocked, even if the default cross-tenant access policy is permissive.

Answer

The B2BCollaborationOutbound setting is blocking access

Answer

The default cross-tenant access policy is set to block all

Answer

The B2BDirectConnectInbound setting is empty

Question 2

Refer to the exhibit. You have created a conditional access policy as shown. Users report that they can still access cloud apps from non-compliant devices. What is the most likely reason?

Accepted Answer

The policy uses session controls instead of grant controls. The policy uses session controls (e.g., 'Use app enforced restrictions') instead of grant controls (e.g., 'Require device to be marked as compliant'). Session controls only apply additional restrictions within the session but do not block access. Therefore, even non-compliant devices can still access cloud apps, though they may experience limited functionality. Grant controls are required to enforce device compliance and block access if the condition is not met.

Answer

The policy does not exclude specific users

Answer

The policy does not include all cloud apps

Answer

The grant control operator is set to "OR" with only one control, which requires no controls to be satisfied

Question 3

Refer to the exhibit. You run the KQL query in Microsoft Sentinel. The query returns zero results even though you know user@contoso.com has had failed sign-in attempts in the last 30 days. What is the most likely reason?

Accepted Answer

The query filters on UserPrincipalName incorrectly. The query filters on UserPrincipalName, but the actual field in the sign-in logs might be named differently (e.g., UserId) or the format may not match (e.g., email vs UPN). This causes the query to return zero results. Option A is incorrect because data retention in Sentinel can be configured for more than 7 days. Option B is incorrect because the summarize statement is syntactically correct. Option D is incorrect because the query does not filter out successful sign-ins; it likely targets failed sign-ins based on the context.

Answer

The query uses ago(30d) but the data retention is only 7 days

Answer

The summarize statement is incorrect

Answer

The query excludes successful sign-ins

Question 4

Contoso uses Microsoft Entra ID P2. Users report that password reset self-service does not work. You verify that the users have the required license. What should you check next?

Accepted Answer

Verify SSPR is enabled in Microsoft Entra ID. The users already have the required Microsoft Entra ID P2 license, which includes SSPR functionality. However, SSPR must be explicitly enabled at the tenant level in Microsoft Entra ID under 'Password reset' settings before users can use the self-service password reset feature. Without this tenant-wide enablement, even licensed users cannot reset their passwords.

Answer

Ensure the users are in a group scoped for SSPR

Answer

Check that the users have registered for SSPR

Answer

Confirm the users have Microsoft Entra ID P1 licenses

Question 5

Your organization plans to allow external users to access a SharePoint Online site using their own Microsoft Entra ID credentials. You need to ensure that external users can authenticate without creating a guest account in your tenant. Which solution should you use?

Accepted Answer

Use Microsoft Entra Verified ID. Microsoft Entra Verified ID allows external users to authenticate using their own verifiable credentials without creating a guest account in your tenant. This solution uses decentralized identity standards and can be configured to grant access to SharePoint Online sites, meeting the requirement to avoid guest account creation. B2B direct connect is limited to Teams Connect shared channels and does not support SharePoint access. B2B collaboration and creating external users as members both require creating user objects in the tenant, which is not allowed.

Answer

Configure B2B collaboration

Answer

Create external users as members

Answer

Configure B2B direct connect

Question 6

A company uses Microsoft Entra ID with group-based licensing. You assign a license to a group, but some members do not receive the license. There are no error messages in the audit logs. What is the most likely cause?

Accepted Answer

Users have the license directly assigned. When a user has a license directly assigned, group-based licensing skips that user because the direct assignment takes precedence. The group licensing engine detects the existing license and does not attempt to reassign it, so no error is logged. This is the most common cause of silent license assignment failures in Microsoft Entra ID.

Answer

The group has more than 500 members

Answer

The group is a dynamic group

Answer

The product license is out of stock

Question 7

An administrator needs to grant a user the ability to reset passwords for other users in Microsoft Entra ID. Which role should be assigned?

Accepted Answer

Helpdesk Administrator. The Helpdesk Administrator role can reset passwords for non-administrators and limited administrators.

Answer

Password Administrator

Answer

Global Administrator

Answer

User Administrator

Question 8

Your organization uses Microsoft Entra Connect Sync. You need to ensure that specific on-premises Active Directory groups are synchronized to Microsoft Entra ID. What should you configure?

Accepted Answer

Set the sync scope to 'Synchronize selected groups'. Microsoft Entra Connect Sync allows you to scope synchronization to specific groups by selecting 'Synchronize selected groups' in the Azure AD Connect configuration. This setting, available during installation or via the 'Customize synchronization options' task, restricts synchronization to only the on-premises Active Directory groups you explicitly choose, ensuring that only those groups are synced to Microsoft Entra ID.

Answer

Configure attribute-based filtering in Microsoft Entra Connect

Answer

Create a security group in Microsoft Entra ID and add members

Answer

Use the Synchronization Service Manager to select groups

Question 9

You are implementing Microsoft Entra Identity Protection. You need to configure automated responses to medium and high user risk. Which policy should you create?

Accepted Answer

User risk policy. User risk policy in Microsoft Entra Identity Protection is specifically designed to automatically respond to user risk levels (low, medium, high) by triggering remediation actions such as requiring a password change or blocking sign-in. Since the question asks for automated responses to medium and high user risk, the correct policy is the User risk policy, which evaluates risk based on user behavior and leaked credentials.

Answer

Sign-in risk policy

Answer

Conditional Access policy with grant controls

Answer

MFA registration policy

Question 10

A user is unable to sign in to Microsoft Teams because the account is locked. The administrator needs to unlock the account without resetting the password. What should the administrator do?

Accepted Answer

Disable and re-enable the user. When a user account is locked due to failed sign-in attempts, disabling and re-enabling the account in Microsoft Entra ID clears the lockout state without resetting the password. This toggles the account status and removes the lock, allowing the user to sign in again with their existing password. Enabling the account alone does not unlock it; the account must be disabled first to reset the lockout.

Answer

Reassign the user's license

Answer

Reset the user's password

Answer

Enable the user's account in Microsoft Entra ID

Question 11

You need to configure Microsoft Entra ID to allow users to authenticate using their existing social media accounts. Which identity provider type should you add?

Accepted Answer

Google identity provider. To allow users to authenticate using their existing social media accounts, you need to add a Google identity provider in Microsoft Entra ID. Google is explicitly supported as a social identity provider (IdP) for B2B guest user scenarios, enabling users to sign in with their Gmail accounts. This is configured under External Identities > All identity providers, where you select Google and configure the OAuth 2.0 client ID and secret from the Google API Console.

Answer

OpenID Connect identity provider

Answer

Microsoft account identity provider

Answer

SAML/WS-Fed identity provider

Question 12

Which TWO permissions are required for a custom role to manage Conditional Access policies in Microsoft Entra ID?

Accepted Answer

microsoft.directory/conditionalAccessPolicies/read. To manage Conditional Access policies in Microsoft Entra ID, a custom role requires both the read and update permissions. The 'read' permission (option B) is necessary to view existing policies, while the 'update' permission (option D) is required to modify or configure policy settings. Without both, the role cannot effectively manage policies, as management implies the ability to change them.

Answer

microsoft.directory/conditionalAccessPolicies/allProperties/read

Answer

microsoft.directory/conditionalAccessPolicies/delete

Answer

microsoft.directory/conditionalAccessPolicies/create

Question 13

Which THREE conditions can be used in a Microsoft Entra Conditional Access policy to target specific sign-in scenarios?

Accepted Answer

Device platform. The three conditions that can be used in a Microsoft Entra Conditional Access policy to target specific sign-in scenarios are: Device platform (A), User risk (B), and Location (C). Device platform allows targeting by OS type, User risk uses Identity Protection signals to block risky users, and Location uses IP addresses or countries. Sign-in risk (D) and Client apps (E) are also valid conditions but are not among the three that are most directly targeting the sign-in scenario as defined in this context.

Answer

Sign-in risk

Answer

Client apps

Question 14

Which TWO Microsoft Entra ID features can be used to provide just-in-time (JIT) access to privileged roles?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) provides just-in-time (JIT) access by allowing users to activate eligible role assignments for a limited time, with approval workflows and auditing. Privileged Access Groups extend JIT capabilities by enabling time-bound membership in groups that grant access to Azure AD roles or Azure resources, ensuring temporary elevation only when needed.

Answer

Identity Protection

Answer

Conditional Access

Answer

Access Reviews

Question 15

Which THREE are valid Microsoft Entra ID license plans that include Identity Protection?

Accepted Answer

Microsoft 365 E5 Security. Microsoft Entra ID Identity Protection is a premium feature that requires either a Microsoft Entra ID P2 license or inclusion in a suite like Microsoft 365 E5 or Microsoft 365 E5 Security. Option C (Microsoft 365 E5 Security) is correct because it includes Microsoft Entra ID P2, which provides full Identity Protection capabilities including risk-based conditional access and user risk policies.

Answer

Microsoft Entra ID P1

Answer

Microsoft 365 E3