MS-102 Implement and manage Microsoft Entra identity and access Practice Test 7 — 15 Questions

Question 1

Your company uses Microsoft Entra ID for identity management. You are planning to implement Conditional Access policies. Which TWO components are required to create a Conditional Access policy?

Accepted Answer

Assignments (users, groups, cloud apps, conditions). A Conditional Access policy in Microsoft Entra ID requires two core components: Assignments and Access controls. Assignments define the scope of the policy by specifying users, groups, cloud apps, and conditions (e.g., location, device state). Access controls determine the enforcement action, such as granting access (optionally requiring MFA or compliant device) or blocking access, along with session controls like app-enforced restrictions. Without both components, the policy cannot be created.

Answer

MFA registration status

Answer

Identity Protection risk policies

Answer

Azure AD roles

Question 2

You are a Microsoft 365 administrator. You run the Get-MgPolicyCrossTenantAccessPolicyDefault cmdlet and see the exhibit output. What does this configuration imply?

Accepted Answer

Your tenant will accept MFA claims from all external Microsoft Entra tenants. The Get-MgPolicyCrossTenantAccessPolicyDefault cmdlet retrieves the default cross-tenant access policy settings. The exhibit output shows that the InboundTrust property is configured to accept MFA claims from all external Microsoft Entra tenants, meaning your tenant will trust MFA claims made by users from any external Entra tenant without requiring them to re-authenticate.

Answer

Your tenant will accept compliant device claims from external tenants

Answer

Your tenant will accept MFA claims from a specific partner tenant

Answer

Your tenant blocks all inbound B2B collaboration

Question 3

You run the Azure CLI command shown in the exhibit. What does the output represent?

Accepted Answer

The application ID for Microsoft Graph. The Azure CLI command `az ad sp show --id 00000003-0000-0000-c000-000000000000` retrieves the service principal for the Microsoft Graph API. The GUID `00000003-0000-0000-c000-000000000000` is the well-known application ID for Microsoft Graph in Microsoft Entra ID (formerly Azure AD). This ID is used to grant permissions and consent for Microsoft Graph API access.

Answer

The application ID for Microsoft Entra ID

Answer

The application ID for Exchange Online

Answer

The application ID for SharePoint Online

Question 4

Your organization uses Microsoft Entra ID and requires users to authenticate using FIDO2 security keys. You need to ensure that users can register and manage their security keys through the My Security Info portal. Which authentication method policy setting should you enable?

Accepted Answer

Security keys (FIDO2). The Security keys (FIDO2) authentication method policy must be enabled to allow users to register and manage FIDO2 security keys through the My Security Info portal. This policy controls the registration, key restrictions, and user targeting for FIDO2 authentication in Microsoft Entra ID, directly enabling the self-service management experience.

Answer

Temporary Access Pass

Answer

Certificate-based authentication

Answer

Microsoft Authenticator

Question 5

You are planning a migration from on-premises Active Directory to Microsoft Entra ID using cloud sync. You need to synchronize user passwords so that users can authenticate using their existing passwords. Which feature should you enable?

Accepted Answer

Password Hash Synchronization. Password Hash Synchronization (PHS) is the correct feature because it synchronizes the hash of a user's on-premises Active Directory password to Microsoft Entra ID, allowing users to authenticate with the same password without any additional on-premises infrastructure. Cloud sync specifically relies on PHS to replicate password hashes from AD to Entra ID, enabling seamless authentication for cloud-based services.

Answer

Pass-through Authentication

Answer

Federation with AD FS

Answer

Seamless Single Sign-On

Question 6

Your company uses Microsoft Entra ID and has a custom line-of-business application that supports SAML-based SSO. You need to configure the application to use Microsoft Entra ID as the identity provider. Which enterprise application configuration should you use?

Accepted Answer

SAML-based Sign-on. The application supports SAML-based SSO, so the correct enterprise application configuration is SAML-based Sign-on. This allows Microsoft Entra ID to act as the identity provider by exchanging SAML assertions with the application, enabling federated authentication.

Answer

Linked Sign-on

Answer

Password-based Sign-on

Answer

OpenID Connect-based Sign-on

Question 7

Your organization uses Microsoft Entra ID and has a Conditional Access policy that requires MFA for all external users. However, guest users from a partner organization are being blocked when they try to access a SharePoint Online site. You need to ensure that guest users can access the site without being prompted for MFA if they have already satisfied MFA in their home tenant. What should you configure?

Accepted Answer

Enable the trust MFA for external users setting in cross-tenant access settings. The cross-tenant access settings in Microsoft Entra ID include a 'Trust MFA from external tenants' option. When enabled, this setting allows guest users who have already satisfied MFA in their home tenant to access resources in your tenant without being prompted for MFA again. This respects the partner's MFA claims and avoids redundant authentication, which directly resolves the blocking issue caused by the Conditional Access policy requiring MFA for all external users.

Answer

Disable MFA requirement for guest users in Conditional Access

Answer

Configure authentication methods policy to accept MFA from external identities

Answer

Use B2B direct connect instead of B2B collaboration

Question 8

Your organization has a Microsoft 365 E5 subscription and uses Microsoft Entra ID. You are implementing Privileged Identity Management (PIM) to manage access to Azure AD roles. You need to ensure that when a user activates a privileged role, the activation request must be approved by their manager and must include a ticket number. What should you configure?

Accepted Answer

Modify the role settings in PIM to require approval and justification with ticket number. PIM role settings allow you to configure activation requirements, including requiring approval and mandating a justification field. By enabling 'Require approval to activate' and configuring the approver as the user's manager, and by setting 'Require ticket information on activation', you enforce that every activation request includes a ticket number and is routed to the manager for approval.

Answer

Create an access review for the role

Answer

Configure an access package in Entitlement Management

Answer

Use Conditional Access policy with session controls

Question 9

Your company uses Microsoft Entra ID and wants to use Microsoft's recommendation to protect against password spray attacks. Which feature should you enable?

Accepted Answer

Smart Lockout. Smart Lockout is Microsoft's recommended feature to protect against password spray attacks because it intelligently locks out bad actors after a threshold of failed attempts while allowing legitimate users to continue. It uses adaptive logic to distinguish between real users and attackers by considering the sign-in pattern and IP address, making it the correct choice for this specific threat.

Answer

Identity Protection

Answer

Password Hash Synchronization

Answer

Multifactor Authentication

Question 10

Your organization uses Microsoft Entra ID and has a Conditional Access policy that requires compliant devices for access to corporate resources. You need to ensure that iOS devices are compliant before accessing Exchange Online. Which Microsoft Intune policy should you configure?

Accepted Answer

Device compliance policy. A Device Compliance policy in Microsoft Intune defines the rules a device must meet (OS version, encryption, jailbreak/root detection, password requirements) to be marked compliant. Conditional Access then uses that compliance state as a grant control, so iOS devices must satisfy the compliance policy before accessing Exchange Online. This is the correct policy type to enforce device health for Conditional Access.

Answer

Device configuration policy

Answer

App protection policy

Answer

Enrollment restrictions

Question 11

Your organization uses Microsoft Entra ID and has a hybrid identity configuration with Active Directory Federation Services (AD FS). You are migrating to cloud authentication using Pass-through Authentication (PTA). Which TWO components are required for a PTA deployment?

Accepted Answer

Service Bus endpoints in Azure. Pass-through Authentication (PTA) requires the PTA Agent to be installed on-premises to validate user passwords against Active Directory. It also uses Azure Service Bus endpoints to establish a secure, persistent connection between the on-premises agent and Microsoft Entra ID, enabling authentication requests to flow without storing passwords in the cloud.

Answer

Password Hash Synchronization agent

Answer

Azure AD Connect Health agent

Answer

Seamless Single Sign-On

Question 12

Your organization uses Microsoft Entra ID and wants to implement a passwordless authentication strategy. Which TWO authentication methods are considered passwordless by Microsoft? (Choose two.)

Accepted Answer

Windows Hello for Business. Windows Hello for Business is a passwordless authentication method that uses biometric or PIN-based credentials tied to a user's device, leveraging asymmetric key pairs to authenticate against Microsoft Entra ID without transmitting a password. It satisfies Microsoft's definition of passwordless because the private key never leaves the device, and authentication is performed via a cryptographic challenge-response protocol.

Answer

Microsoft Authenticator with notification

Answer

Password Hash Synchronization

Answer

SMS-based one-time passcode

Question 13

Refer to the exhibit. You are reviewing a Conditional Access policy JSON. The policy is intended to block legacy authentication. However, users are still able to connect using Exchange ActiveSync. What is the most likely reason?

Accepted Answer

The policy is configured in 'report-only' mode instead of 'enforce'. The policy is configured in 'report-only' mode. In report-only mode, Conditional Access policies are evaluated but not enforced. Users can still connect using legacy authentication because the policy does not block access. To block legacy authentication, the policy must be set to 'enforce' mode. Additionally, the client apps condition should include 'Exchange ActiveSync clients' and 'Other clients' to specifically target legacy authentication protocols.

Answer

The policy is missing the 'browser' and 'mobileAppsAndDesktopClient' client app types

Answer

The grant control operator 'OR' should be 'AND'

Answer

The policy is missing a condition for 'device platforms' to target iOS and Android

Question 14

Your organization uses Microsoft Entra ID to manage user identities. You need to ensure that users can sign in using their existing social media accounts, such as Microsoft, Google, or Facebook. What should you configure?

Accepted Answer

Configure External Identities and add identity providers for social networks. Microsoft Entra ID supports External Identities, which allow you to add social identity providers (Microsoft, Google, Facebook) as external authentication sources. This enables users to sign in with their existing social accounts by configuring federation with those providers using OAuth 2.0 or OpenID Connect protocols, without needing to create separate Entra ID accounts.

Answer

Configure Conditional Access policies for social identity providers

Answer

Configure Microsoft Entra Connect to sync social account attributes

Answer

Configure self-service password reset (SSPR)

Question 15

Your company is implementing a Zero Trust security model. You need to ensure that all user access requests to corporate resources are verified continuously, not just at the initial sign-in. Which Microsoft Entra ID feature should you use?

Accepted Answer

Continuous Access Evaluation (CAE). Continuous Access Evaluation (CAE) is the correct choice because it enforces real-time token validation and policy enforcement for every access request, not just at initial authentication. CAE works by having critical events (e.g., user disablement, IP address change, or risk elevation) trigger a revocation message to the resource provider, which then immediately blocks access—even if the token is still valid. This aligns directly with the Zero Trust principle of 'verify explicitly and continuously' rather than relying on a one-time sign-in.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra Verified ID