MS-102 Implement and manage Microsoft Entra identity and access Practice Test 7 — 15 Questions

Question 1

Refer to the exhibit. You manage an application registration in Microsoft Entra ID. The JSON shows the current state of the app's password credentials. The application is used by a daemon to acquire tokens. The certificate used for authentication expires on 2025-12-31. The application is currently using a client secret. The security policy requires rotating secrets every 6 months. What is the best course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a new client secret, update the daemon to use the new secret, then delete the old secret. The security policy requires rotating secrets every 6 months, and the current secret's endDateTime is set to 2025-12-31, which exceeds that interval. Creating a new client secret, updating the daemon to use it, and then deleting the old secret ensures compliance with the rotation policy while maintaining uninterrupted token acquisition. This approach follows the least-privilege and secret rotation best practices for application credentials in Microsoft Entra ID.

Answer

Switch the daemon to use certificate-based authentication and remove the secret

Answer

Do nothing; the secret does not expire until 2025-12-31

Answer

Extend the endDateTime of the existing secret to 2026-12-31

Question 2

Refer to the exhibit. You run this PowerShell script to disable high-risk users. However, some high-risk users remain enabled. What is the most likely reason?

Accepted Answer

The script does not have permission to read risky users. The Get-AzureADIdentityRiskyUser cmdlet does support the -Filter parameter, so the filter syntax is valid. The most likely reason high-risk users remain enabled is that the script's execution context lacks the necessary permissions to read risky users. Without permission, the cmdlet returns no users (or an error), and the subsequent Set-AzureADUser cmdlet never runs, leaving high-risk users enabled. The script may have partially worked due to scoping or delegation, but the primary cause is insufficient permissions to read the risky user list.

Answer

The Set-AzureADUser cmdlet fails for disabled users

Answer

High-risk users are protected by a Conditional Access policy

Answer

The Get-AzureADIdentityRiskyUser cmdlet does not support the -Filter parameter

Question 3

A company has Microsoft Entra ID P2 licenses. They need to implement a conditional access policy that requires multifactor authentication (MFA) when accessing the Microsoft Entra admin center from a non-compliant device. However, they want to allow access from compliant devices without MFA. What is the best approach?

Accepted Answer

Create one conditional access policy with grant controls set to 'Require one of the selected controls' and select both 'Require compliant device' and 'Require multifactor authentication'. The requirement can be met with a single policy by setting grant controls to 'Require one of the selected controls' and selecting both 'Require compliant device' and 'Require multifactor authentication'. A compliant device satisfies the 'Require compliant device' control, so access is granted without MFA. A non-compliant device does not satisfy that control, so the user is prompted for MFA, satisfying the requirement. Option C is incorrect because the policy for non-compliant devices would require 'Require compliant device' to be satisfied as well, which would block non-compliant devices entirely.

Answer

Create one conditional access policy with a grant control that combines 'Require compliant device' and 'Require multifactor authentication' as a single control

Answer

Create two conditional access policies: one for compliant devices requiring only compliant device, and one for non-compliant devices requiring MFA and compliant device

Answer

Create one conditional access policy with grant controls set to 'Require all the selected controls' and select both 'Require compliant device' and 'Require multifactor authentication', and include all devices

Question 4

Your organization uses Microsoft Entra ID and has enabled Microsoft Entra ID Protection. You notice that the number of 'Leaked Credentials' detections is high. What action should you take to automatically remediate this risk?

Accepted Answer

Configure a user risk policy in Microsoft Entra ID Protection to require a password change for high-risk users. A user risk policy in Microsoft Entra ID Protection can be configured to automatically trigger a password change when a user is detected as high risk, such as when leaked credentials are identified. This policy directly remediates the risk by forcing the user to update their compromised credentials, effectively invalidating the leaked password. The other options either do not address the root cause or require manual intervention.

Answer

Use Microsoft Entra ID Protection to automatically reset passwords for all users with leaked credentials

Answer

Configure a conditional access policy to block access for users with high user risk

Answer

Enable Microsoft Entra ID Multifactor Authentication for all users

Question 5

You need to implement a solution that allows external partners to access specific SharePoint Online sites without creating guest user objects in Microsoft Entra ID. The partners will authenticate using their own identity provider. What should you use?

Accepted Answer

SharePoint Online external sharing with one-time passcode authentication. SharePoint Online external sharing with one-time passcode authentication allows external partners to access SharePoint sites without creating guest user objects in Microsoft Entra ID. When the partner's identity provider is not federated with Entra ID, the one-time passcode feature sends a code to their email for authentication, bypassing the need for a guest account. This meets the requirement of no guest user objects while enabling access from an external identity provider.

Answer

Microsoft Entra B2B collaboration with the partner's identity provider

Answer

Microsoft Entra B2B direct connect for SharePoint Online

Answer

Microsoft Entra External ID for the partner organization

Question 6

Your company uses Microsoft Entra ID and wants to enforce that all users register for MFA within 14 days of account creation. Which policy should you configure?

Accepted Answer

Authentication methods policy with 'Registration campaign' targeting users. The 'Registration campaign' in the Authentication methods policy is designed to nudge users to register for MFA within a specified time frame (e.g., 14 days) after account creation. This policy specifically targets the registration phase, not the authentication phase, making it the correct choice for enforcing MFA registration deadlines.

Answer

Conditional access policy with 'Require multifactor authentication'

Answer

Microsoft Entra ID Protection sign-in risk policy

Answer

Microsoft Entra ID Protection user risk policy

Question 7

You have a hybrid identity environment with Microsoft Entra ID and Active Directory Domain Services (AD DS). You need to ensure that user passwords are synchronized to Microsoft Entra ID without any hashing of passwords. Which tool should you use?

Accepted Answer

Microsoft Entra Connect Sync with password hash synchronization. Microsoft Entra Connect Sync with password hash synchronization (PHS) is the correct answer because it synchronizes a hash of the user's password hash from on-premises AD DS to Microsoft Entra ID, ensuring the plaintext password is never stored or transmitted. The phrase 'without any hashing' is misleading—PHS always hashes the password hash. While both Entra Connect Sync and Entra Cloud Sync support password hash synchronization, Entra Connect Sync with PHS is the standard full-featured tool. AD FS and MIM do not directly synchronize password hashes to Microsoft Entra ID.

Answer

Active Directory Federation Services (AD FS)

Answer

Microsoft Entra Cloud Sync

Answer

Microsoft Identity Manager

Question 8

Your organization uses Microsoft Entra ID P2 and has enabled Microsoft Entra ID Protection. You need to generate a weekly report of users who are at risk due to anomalous sign-in activity and send it to the security team. What is the most efficient way to achieve this?

Accepted Answer

Create a custom workbook in Microsoft Entra ID and schedule it to run weekly. Microsoft Entra ID custom workbooks can be configured with a scheduled refresh, allowing you to automatically generate and deliver a weekly report of risky sign-ins without manual intervention or additional infrastructure. This leverages the built-in reporting and scheduling capabilities of Entra ID, making it the most efficient solution for a recurring report.

Answer

Use the Microsoft Entra admin center to export the risky sign-ins report every week

Answer

Configure a Microsoft Sentinel analytics rule to generate incidents for risky sign-ins

Answer

Write a PowerShell script that uses the Microsoft Graph API to retrieve risky sign-ins and send an email weekly

Question 9

A user reports that they cannot access a cloud app that requires MFA. The user's mobile phone is lost. They have no other registered MFA methods. What should the administrator do?

Accepted Answer

Temporarily disable MFA for the user in the Authentication methods policy. The administrator can temporarily disable MFA for the user in the Authentication methods policy, allowing the user to sign in without MFA and then register a new MFA method. Option B is wrong because the user cannot register a new method without access to an existing MFA method. Option C is wrong because blocking the account is unnecessary and disrupts productivity. Option D is wrong because the Microsoft Authenticator app is not a tool for resetting MFA; it is a method itself.

Answer

Instruct the user to register a new MFA method using the Microsoft Entra admin center

Answer

Block the user's account until they recover their phone

Answer

Instruct the user to use the Microsoft Authenticator app to reset their MFA

Question 10

Which TWO of the following are valid conditions that can be used in a Microsoft Entra ID conditional access policy? (Choose two.)

Accepted Answer

Sign-in risk. Sign-in risk (B) and user risk (D) are both valid conditions in Microsoft Entra ID Conditional Access policies. These risk levels are calculated by Microsoft Entra ID Protection using real-time signals such as anonymous IP addresses, atypical travel, or leaked credentials, and can be used to trigger policies like requiring multi-factor authentication or blocking access.

Answer

Network location

Answer

Application sensitivity label

Answer

Device manufacturer

Question 11

Which TWO of the following are required to implement Microsoft Entra ID Identity Governance for access reviews? (Choose two.)

Accepted Answer

Microsoft Entra ID P2 license. To implement Microsoft Entra ID Identity Governance for access reviews, two key requirements are necessary: a Microsoft Entra ID P2 license and an appropriate administrative role (Global Administrator or Identity Governance Administrator). The P2 license is required because access reviews utilize premium identity governance features. Additionally, the administrator role is needed to configure and manage the reviews. Option B, applying results automatically, is optional and not a mandatory requirement; it can be enabled if desired but is not necessary for implementation. Option A (P1 license) is insufficient for access reviews. Option E (all users being reviewed must be guest users) is incorrect because access reviews can include internal users, not just guests.

Answer

Microsoft Entra ID P1 license

Answer

The access review must be configured to apply results automatically

Answer

All users being reviewed must be guest users

Question 12

Which TWO of the following are benefits of using Microsoft Entra ID Provisioning for cloud HR applications like Workday? (Choose two.)

Accepted Answer

Support for attribute-based provisioning. Microsoft Entra ID Provisioning for cloud HR applications like Workday supports attribute-based provisioning, which allows mapping of HR attributes (e.g., department, location) to Entra ID user attributes using an expression-based mapping engine. This enables dynamic filtering and transformation of user data during synchronization, ensuring that only users meeting specific criteria (e.g., employment status) are provisioned.

Answer

Automatic license assignment

Answer

Automatic password reset for new users

Answer

Automatic creation of user mailboxes in Exchange Online

Question 13

Your organization uses Microsoft Entra ID to manage user identities. You need to ensure that users can reset their own passwords without administrator intervention, but only if they have registered for self-service password reset (SSPR). What should you configure?

Accepted Answer

Enable SSPR for a selected security group containing registered users. Enabling SSPR for a selected security group ensures that only users who have been explicitly added to that group (and thus have registered for SSPR) can reset their own passwords without administrator intervention. This meets the requirement of restricting self-service password reset to registered users only, while still allowing password changes without admin approval.

Answer

Configure a conditional access policy requiring admin approval for password changes

Answer

Configure Microsoft Entra ID Protection user risk policy

Answer

Enable SSPR for All users

Question 14

Your company uses Microsoft Entra ID with hybrid joined devices. You need to enforce multi-factor authentication (MFA) for all cloud app access but want to exclude specific locations (trusted IPs). What is the most efficient way to implement this?

Accepted Answer

Create a Conditional Access policy targeting all cloud apps, requiring MFA, with a condition to exclude trusted IPs. Conditional Access is the correct approach to enforce MFA with location exclusions. Option D allows you to create a policy targeting all cloud apps requiring MFA, with a condition to exclude trusted IPs, making it the most efficient and flexible method. Option A is incorrect because Intune is for device management, not MFA enforcement. Option B is inefficient because per-user MFA does not support granular location exclusions like Conditional Access. Option C is incorrect because user risk policies are for risk-based MFA, not trusted IP exclusions.

Answer

Use Microsoft Intune to enforce MFA for all corporate devices

Answer

Enable per-user MFA and exclude trusted IPs in the MFA service settings

Answer

Configure a user risk policy in Microsoft Entra ID Protection to require MFA when risk is medium or higher

Question 15

You are implementing Microsoft Entra ID Governance. You need to automate the creation of guest user accounts when employees submit a request through the company's HR system. What should you use?

Accepted Answer

Lifecycle Workflows. Lifecycle Workflows (D) is the correct choice because it is the Microsoft Entra ID Governance feature designed to automate identity lifecycle processes, including the creation of guest user accounts triggered by events such as HR system submissions. It uses built-in or custom workflows with tasks like 'Create user' and 'Send email' to handle the entire provisioning flow without manual intervention.

Answer

Microsoft Entra Verified ID

Answer

Access Reviews

Answer

Microsoft Entra ID Protection