MS-102 Implement and manage Microsoft Entra identity and access Practice Test 7 — 15 Questions

Question 1

Your organization uses Microsoft Entra Connect Sync. You need to ensure that specific on-premises Active Directory groups are synchronized to Microsoft Entra ID. What should you configure?

Accepted Answer

Set the sync scope to 'Synchronize selected groups'. Option A is correct because Microsoft Entra Connect Sync allows you to scope synchronization to specific groups by selecting 'Synchronize selected groups' in the Azure AD Connect configuration. This setting, available during installation or via the 'Customize synchronization options' task, restricts synchronization to only the on-premises Active Directory groups you explicitly choose, ensuring that only those groups are synced to Microsoft Entra ID.

Answer

Configure attribute-based filtering in Microsoft Entra Connect

Answer

Create a security group in Microsoft Entra ID and add members

Answer

Use the Synchronization Service Manager to select groups

Question 2

You are implementing Microsoft Entra Identity Protection. You need to configure automated responses to medium and high user risk. Which policy should you create?

Accepted Answer

User risk policy. User risk policy in Microsoft Entra Identity Protection is specifically designed to automatically respond to user risk levels (low, medium, high) by triggering remediation actions such as requiring a password change or blocking sign-in. Since the question asks for automated responses to medium and high user risk, the correct policy is the User risk policy, which evaluates risk based on user behavior and leaked credentials.

Answer

Sign-in risk policy

Answer

Conditional Access policy with grant controls

Answer

MFA registration policy

Question 3

A user is unable to sign in to Microsoft Teams because the account is locked. The administrator needs to unlock the account without resetting the password. What should the administrator do?

Accepted Answer

Enable the user's account in Microsoft Entra ID. When a user account is locked due to failed sign-in attempts, the administrator can unlock it by enabling the account in Microsoft Entra ID (formerly Azure AD) without resetting the password. This action clears the lockout state while preserving the existing password, which is exactly what the scenario requires.

Answer

Disable and re-enable the user

Answer

Reassign the user's license

Answer

Reset the user's password

Question 4

You need to configure Microsoft Entra ID to allow users to authenticate using their existing social media accounts. Which identity provider type should you add?

Accepted Answer

Google identity provider. To allow users to authenticate using their existing social media accounts, you need to add a Google identity provider in Microsoft Entra ID. Google is explicitly supported as a social identity provider (IdP) for B2B guest user scenarios, enabling users to sign in with their Gmail accounts. This is configured under External Identities > All identity providers, where you select Google and configure the OAuth 2.0 client ID and secret from the Google API Console.

Answer

OpenID Connect identity provider

Answer

Microsoft account identity provider

Answer

SAML/WS-Fed identity provider

Question 5

Which TWO permissions are required for a custom role to manage Conditional Access policies in Microsoft Entra ID?

Accepted Answer

microsoft.directory/conditionalAccessPolicies/read. To manage Conditional Access policies in Microsoft Entra ID, a custom role requires both the read and update permissions. The 'read' permission (option B) is necessary to view existing policies, while the 'update' permission (option D) is required to modify or configure policy settings. Without both, the role cannot effectively manage policies, as management implies the ability to change them.

Answer

microsoft.directory/conditionalAccessPolicies/allProperties/read

Answer

microsoft.directory/conditionalAccessPolicies/delete

Answer

microsoft.directory/conditionalAccessPolicies/create

Question 6

Which THREE conditions can be used in a Microsoft Entra Conditional Access policy to target specific sign-in scenarios?

Accepted Answer

Device platform. Option A is correct because the 'Device platform' condition in a Microsoft Entra Conditional Access policy allows targeting specific operating systems (e.g., Windows, iOS, Android) to control access based on the device type. This is commonly used to enforce policies like requiring compliant devices for mobile platforms while allowing broader access from managed Windows devices.

Answer

User risk

Answer

Location

Question 7

Which TWO Microsoft Entra ID features can be used to provide just-in-time (JIT) access to privileged roles?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) provides just-in-time (JIT) access by allowing users to activate eligible role assignments for a limited time, with approval workflows and auditing. Privileged Access Groups extend JIT capabilities by enabling time-bound membership in groups that grant access to Azure AD roles or Azure resources, ensuring temporary elevation only when needed.

Answer

Identity Protection

Answer

Conditional Access

Answer

Access Reviews

Question 8

Which THREE are valid Microsoft Entra ID license plans that include Identity Protection?

Accepted Answer

Microsoft 365 E5 Security. Microsoft Entra ID Identity Protection is a premium feature that requires either a Microsoft Entra ID P2 license or inclusion in a suite like Microsoft 365 E5 or Microsoft 365 E5 Security. Option C (Microsoft 365 E5 Security) is correct because it includes Microsoft Entra ID P2, which provides full Identity Protection capabilities including risk-based conditional access and user risk policies.

Answer

Microsoft Entra ID P1

Answer

Microsoft 365 E3

Question 9

Refer to the exhibit. You manage an application registration in Microsoft Entra ID. The JSON shows the current state of the app's password credentials. The application is used by a daemon to acquire tokens. The certificate used for authentication expires on 2025-12-31. The application is currently using a client secret. The security policy requires rotating secrets every 6 months. What is the best course of action?

Accepted Answer

Create a new client secret, update the daemon to use the new secret, then delete the old secret. Option C is correct because the security policy requires rotating secrets every 6 months, and the current secret's endDateTime is set to 2025-12-31, which exceeds that interval. Creating a new client secret, updating the daemon to use it, and then deleting the old secret ensures compliance with the rotation policy while maintaining uninterrupted token acquisition. This approach follows the least-privilege and secret rotation best practices for application credentials in Microsoft Entra ID.

Answer

Switch the daemon to use certificate-based authentication and remove the secret

Answer

Do nothing; the secret does not expire until 2025-12-31

Answer

Extend the endDateTime of the existing secret to 2026-12-31

Question 10

Refer to the exhibit. You run this PowerShell script to disable high-risk users. However, some high-risk users remain enabled. What is the most likely reason?

Accepted Answer

The Get-AzureADIdentityRiskyUser cmdlet does not support the -Filter parameter. The Get-AzureADIdentityRiskyUser cmdlet does not support the -Filter parameter. This means the script's attempt to filter for high-risk users using -Filter "riskLevel eq high" will fail, returning no users or an error, so the subsequent Set-AzureADUser cmdlet never runs against the intended high-risk users, leaving them enabled.

Answer

The Set-AzureADUser cmdlet fails for disabled users

Answer

The script does not have permission to read risky users

Answer

High-risk users are protected by a Conditional Access policy

Question 11

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their Google Workspace credentials without creating external identities. What should you configure?

Accepted Answer

Configure SAML/WS-Fed identity provider federation with Google Workspace. Option D is correct because configuring SAML/WS-Fed identity provider federation with Google Workspace allows users to sign in using their Google Workspace credentials directly, without creating external identities. This federation establishes a trust relationship between Microsoft Entra ID and Google Workspace as an identity provider, enabling seamless authentication for users who already have Google accounts.

Answer

Enable Microsoft Entra Verified ID for Google Workspace users

Answer

Configure Google as a social identity provider in Microsoft Entra External ID

Answer

Configure Microsoft Entra B2B collaboration with Google Workspace

Question 12

A company has Microsoft Entra ID P2 licenses. They need to implement a conditional access policy that requires multifactor authentication (MFA) when accessing the Microsoft Entra admin center from a non-compliant device. However, they want to allow access from compliant devices without MFA. What is the best approach?

Accepted Answer

Create two conditional access policies: one for compliant devices requiring only compliant device, and one for non-compliant devices requiring MFA and compliant device. Option C is correct because the requirement is to allow access from compliant devices without MFA while requiring MFA from non-compliant devices. This conditional logic cannot be achieved in a single policy with a single grant block because 'Require compliant device' and 'Require multifactor authentication' are both satisfied by compliant devices (which are already compliant), but you need to differentiate behavior based on device compliance state. By creating two policies—one targeting compliant devices with only 'Require compliant device' as a grant, and another targeting non-compliant devices with both 'Require compliant device' and 'Require multifactor authentication'—you can enforce different access requirements based on the device's compliance status.

Answer

Create one conditional access policy with a grant control that combines 'Require compliant device' and 'Require multifactor authentication' as a single control

Answer

Create one conditional access policy with grant controls set to 'Require one of the selected controls' and select both 'Require compliant device' and 'Require multifactor authentication'

Answer

Create one conditional access policy with grant controls set to 'Require all the selected controls' and select both 'Require compliant device' and 'Require multifactor authentication', and include all devices

Question 13

You are configuring Microsoft Entra ID provisioning for a SaaS application that supports SCIM 2.0. The app requires the 'manager' attribute to be mapped. However, the manager attribute is not populated for all users. What should you do to avoid provisioning failures?

Accepted Answer

Configure the attribute mapping to 'Ignore it if null' for the manager attribute. Option A is correct because when the 'manager' attribute is not populated for all users, configuring the attribute mapping to 'Ignore it if null' prevents provisioning failures by allowing the provisioning service to skip the attribute when its value is null, rather than attempting to send an empty or invalid value that the SCIM 2.0 endpoint might reject. This setting ensures that only users with a manager value trigger the mapping, avoiding errors for users without a manager.

Answer

Modify the SCIM schema in the application to make manager optional

Answer

Use the expression language to set a default value for the manager attribute

Answer

Delete the manager attribute mapping from the provisioning configuration

Question 14

Your organization uses Microsoft Entra ID and has enabled Microsoft Entra ID Protection. You notice that the number of 'Leaked Credentials' detections is high. What action should you take to automatically remediate this risk?

Accepted Answer

Configure a user risk policy in Microsoft Entra ID Protection to require a password change for high-risk users. Option C is correct because a user risk policy in Microsoft Entra ID Protection can be configured to automatically trigger a password change when a user is detected as high risk, such as when leaked credentials are identified. This policy directly remediates the risk by forcing the user to update their compromised credentials, effectively invalidating the leaked password. The other options either do not address the root cause or require manual intervention.

Answer

Use Microsoft Entra ID Protection to automatically reset passwords for all users with leaked credentials

Answer

Configure a conditional access policy to block access for users with high user risk

Answer

Enable Microsoft Entra ID Multifactor Authentication for all users

Question 15

You need to implement a solution that allows external partners to access specific SharePoint Online sites without creating guest user objects in Microsoft Entra ID. The partners will authenticate using their own identity provider. What should you use?

Accepted Answer

SharePoint Online external sharing with one-time passcode authentication. Option D is correct because SharePoint Online external sharing with one-time passcode authentication allows external partners to access SharePoint sites without creating guest user objects in Microsoft Entra ID. When the partner's identity provider is not federated with Entra ID, the one-time passcode feature sends a code to their email for authentication, bypassing the need for a guest account. This meets the requirement of no guest user objects while enabling access from an external identity provider.

Answer

Microsoft Entra B2B collaboration with the partner's identity provider

Answer

Microsoft Entra B2B direct connect for SharePoint Online

Answer

Microsoft Entra External ID for the partner organization