MS-102 Implement and manage Microsoft Entra identity and access Practice Test 8 — 15 Questions

Question 1

Your company uses Microsoft Entra ID and wants to enforce that all users register for MFA within 14 days of account creation. Which policy should you configure?

Accepted Answer

Authentication methods policy with 'Registration campaign' targeting users. Option B is correct because the Authentication methods policy in Microsoft Entra ID can be used to set a registration campaign that requires users to register for MFA within a specified timeframe. Option A is wrong because conditional access policies enforce MFA during sign-in, not registration. Option C is wrong because Identity Protection policies address risk, not registration. Option D is wrong because the user risk policy is for risk-based remediation. Option E is wrong because MFA registration policy is part of Authentication methods policy.

Answer

Conditional access policy with 'Require multifactor authentication'

Answer

Microsoft Entra ID Protection sign-in risk policy

Answer

Microsoft Entra ID Protection user risk policy

Question 2

You have a hybrid identity environment with Microsoft Entra ID and Active Directory Domain Services (AD DS). You need to ensure that user passwords are synchronized to Microsoft Entra ID without any hashing of passwords. Which tool should you use?

Accepted Answer

Microsoft Entra Connect Sync with password hash synchronization. Microsoft Entra Connect Sync with password hash synchronization (PHS) is the correct choice because it synchronizes a hash of the user's password hash from on-premises AD DS to Microsoft Entra ID, not the plaintext password. The question states 'without any hashing of passwords,' which is technically impossible for password synchronization—PHS always hashes the password hash. However, among the options, only PHS performs password synchronization; the others do not synchronize passwords at all. The key nuance is that PHS synchronizes a hash of the hash (i.e., the password hash is hashed again), so the original plaintext password is never stored or transmitted.

Answer

Active Directory Federation Services (AD FS)

Answer

Microsoft Entra Cloud Sync

Answer

Microsoft Identity Manager

Question 3

Your organization uses Microsoft Entra ID P2 and has enabled Microsoft Entra ID Protection. You need to generate a weekly report of users who are at risk due to anomalous sign-in activity and send it to the security team. What is the most efficient way to achieve this?

Accepted Answer

Create a custom workbook in Microsoft Entra ID and schedule it to run weekly. Option C is correct because Microsoft Entra ID custom workbooks can be configured with a scheduled refresh, allowing you to automatically generate and deliver a weekly report of risky sign-ins without manual intervention or additional infrastructure. This leverages the built-in reporting and scheduling capabilities of Entra ID, making it the most efficient solution for a recurring report.

Answer

Use the Microsoft Entra admin center to export the risky sign-ins report every week

Answer

Configure a Microsoft Sentinel analytics rule to generate incidents for risky sign-ins

Answer

Write a PowerShell script that uses the Microsoft Graph API to retrieve risky sign-ins and send an email weekly

Question 4

A user reports that they cannot access a cloud app that requires MFA. The user's mobile phone is lost. They have no other registered MFA methods. What should the administrator do?

Accepted Answer

Temporarily disable MFA for the user in the Authentication methods policy. Option C is correct because an administrator can temporarily disable MFA for the user in the Authentication methods policy, allowing them to sign in without MFA until they register a new method. Option A is wrong because the user cannot reset MFA themselves without the authenticator app. Option B is wrong because the user cannot register a new method without access. Option D is wrong because the user should not be blocked permanently. Option E is wrong because resetting the user's password does not help with MFA.

Answer

Instruct the user to register a new MFA method using the Microsoft Entra admin center

Answer

Block the user's account until they recover their phone

Answer

Instruct the user to use the Microsoft Authenticator app to reset their MFA

Question 5

Which TWO of the following are valid conditions that can be used in a Microsoft Entra ID conditional access policy? (Choose two.)

Accepted Answer

Sign-in risk. Sign-in risk (B) and user risk (D) are both valid conditions in Microsoft Entra ID Conditional Access policies. These risk levels are calculated by Microsoft Entra ID Protection using real-time signals such as anonymous IP addresses, atypical travel, or leaked credentials, and can be used to trigger policies like requiring multi-factor authentication or blocking access.

Answer

Network location

Answer

Application sensitivity label

Answer

Device manufacturer

Question 6

Which THREE of the following are required to implement Microsoft Entra ID Identity Governance for access reviews? (Choose three.)

Accepted Answer

The access review must be configured to apply results automatically. Option B is correct because for an access review to enforce its decisions (e.g., removing a user's access), the review must be configured to 'Apply results automatically'. Without this setting, the review only generates recommendations, and an administrator must manually apply the results. This automatic application is a required step to complete the identity governance lifecycle.

Answer

Microsoft Entra ID P1 license

Answer

All users being reviewed must be guest users

Question 7

Which TWO of the following are benefits of using Microsoft Entra ID Provisioning for cloud HR applications like Workday? (Choose two.)

Accepted Answer

Support for attribute-based provisioning. Option B is correct because Microsoft Entra ID Provisioning for cloud HR applications like Workday supports attribute-based provisioning, which allows mapping of HR attributes (e.g., department, location) to Entra ID user attributes using an expression-based mapping engine. This enables dynamic filtering and transformation of user data during synchronization, ensuring that only users meeting specific criteria (e.g., employment status) are provisioned.

Answer

Automatic license assignment

Answer

Automatic password reset for new users

Answer

Automatic creation of user mailboxes in Exchange Online

Question 8

Your organization uses Microsoft Entra ID to manage user identities. You need to ensure that users can reset their own passwords without administrator intervention, but only if they have registered for self-service password reset (SSPR). What should you configure?

Accepted Answer

Enable SSPR for a selected security group containing registered users. Option A is correct because enabling SSPR for a selected security group ensures that only users who have been explicitly added to that group (and thus have registered for SSPR) can reset their own passwords without administrator intervention. This meets the requirement of restricting self-service password reset to registered users only, while still allowing password changes without admin approval.

Answer

Configure a conditional access policy requiring admin approval for password changes

Answer

Configure Microsoft Entra ID Protection user risk policy

Answer

Enable SSPR for All users

Question 9

Your company uses Microsoft Entra ID with hybrid joined devices. You need to enforce multi-factor authentication (MFA) for all cloud app access but want to exclude specific locations (trusted IPs). What is the most efficient way to implement this?

Accepted Answer

Create a Conditional Access policy targeting all cloud apps, requiring MFA, with a condition to exclude trusted IPs. Conditional Access is the correct approach to enforce MFA with location exclusions. Option B is wrong because per-user MFA does not support location exclusions. Option C is incorrect because Microsoft Entra ID Protection is for risk-based policies, not trusted IPs. Option D is not a valid MFA enforcement method.

Answer

Use Microsoft Intune to enforce MFA for all corporate devices

Answer

Enable per-user MFA and exclude trusted IPs in the MFA service settings

Answer

Configure a user risk policy in Microsoft Entra ID Protection to require MFA when risk is medium or higher

Question 10

You are implementing Microsoft Entra ID Governance. You need to automate the creation of guest user accounts when employees submit a request through the company's HR system. What should you use?

Accepted Answer

Lifecycle Workflows. Lifecycle Workflows (D) is the correct choice because it is the Microsoft Entra ID Governance feature designed to automate identity lifecycle processes, including the creation of guest user accounts triggered by events such as HR system submissions. It uses built-in or custom workflows with tasks like 'Create user' and 'Send email' to handle the entire provisioning flow without manual intervention.

Answer

Microsoft Entra Verified ID

Answer

Access Reviews

Answer

Microsoft Entra ID Protection

Question 11

Your organization plans to use Microsoft Entra ID as the identity provider for a third-party SaaS application that supports SAML 2.0. You need to configure single sign-on (SSO) for the application. What should you create in Microsoft Entra ID?

Accepted Answer

An enterprise application with SAML-based sign-on. To configure SSO for a third-party SaaS application that supports SAML 2.0, you must create an enterprise application in Microsoft Entra ID and configure it with SAML-based sign-on. Enterprise applications are designed for integrating third-party applications, and SAML-based sign-on allows Entra ID to act as the identity provider, exchanging SAML assertions for authentication.

Answer

An Application Proxy connector group

Answer

A service principal for Microsoft Graph

Answer

An app registration with OpenID Connect

Question 12

You are troubleshooting an issue where users from a partner organization cannot access a shared app in your Microsoft Entra ID tenant. The partner uses Microsoft Entra ID with a custom domain. You have configured cross-tenant access settings. Which setting is most likely misconfigured?

Accepted Answer

Default inbound cross-tenant access settings for the partner's tenant ID. The default inbound cross-tenant access settings control how external users from other tenants access your tenant's resources. Since the partner cannot access the shared app, the most likely misconfiguration is that the default inbound settings for the partner's tenant ID are set to block access, or the partner's tenant ID is not explicitly allowed in the inbound settings. This overrides any app-level permissions, as cross-tenant access settings act as a gate before user assignment is evaluated.

Answer

Outbound cross-tenant access settings for the partner's tenant ID

Answer

The app's user assignment and provisioning configuration

Answer

The partner's inbound cross-tenant access settings for your tenant

Question 13

Your organization requires that all administrators use phishing-resistant authentication methods. Which Microsoft Entra ID authentication method meets this requirement?

Accepted Answer

FIDO2 security key. FIDO2 security keys are phishing-resistant because they use public key cryptography and cannot be phished. Option A is wrong because SMS is vulnerable to phishing. Option B is wrong because push notifications can be phished. Option D is wrong because a temporary access pass is not a primary authentication method.

Answer

SMS-based verification

Answer

Microsoft Authenticator push notification

Answer

Temporary Access Pass

Question 14

You are designing a Microsoft Entra ID tenant for a new subsidiary. You need to ensure that users can authenticate using their existing on-premises Active Directory credentials without synchronizing password hashes to the cloud. Which identity model should you choose?

Accepted Answer

Pass-through authentication (PTA). Pass-through authentication (PTA) allows users to authenticate against on-premises Active Directory directly, without synchronizing password hashes to the cloud. When a user signs in to Microsoft Entra ID, the authentication request is forwarded to an on-premises PTA agent, which validates the credentials against the local domain controller. This meets the requirement of using existing on-premises credentials without storing password hashes in the cloud.

Answer

Federation with AD FS

Answer

Cloud-only identity

Answer

Password hash synchronization (PHS)

Question 15

Your company uses Microsoft Entra ID and has enabled Microsoft Entra ID Protection. You notice that a user's sign-in was blocked due to a medium user risk. However, the user claims the sign-in was legitimate. What should you do to allow future sign-ins without lowering security?

Accepted Answer

Use the Microsoft Entra ID Protection reports to confirm the user as safe. Option C is correct because when a user claims a blocked sign-in was legitimate, the proper action is to confirm the user as safe in the Microsoft Entra ID Protection reports. This action updates the risk state to 'confirmed safe', which resets the user's risk level and allows future sign-ins without lowering security. It also provides feedback to the risk detection algorithm to improve accuracy.

Answer

Create a conditional access policy to bypass MFA for this user

Answer

Suppress the alert in Microsoft Defender XDR

Answer

Dismiss the risk in the Risky users report