MS-102 Implement and manage Microsoft Entra identity and access Practice Test 8 — 15 Questions

Question 1

Your organization plans to use Microsoft Entra ID as the identity provider for a third-party SaaS application that supports SAML 2.0. You need to configure single sign-on (SSO) for the application. What should you create in Microsoft Entra ID?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An enterprise application with SAML-based sign-on. To configure SSO for a third-party SaaS application that supports SAML 2.0, you must create an enterprise application in Microsoft Entra ID and configure it with SAML-based sign-on. Enterprise applications are designed for integrating third-party applications, and SAML-based sign-on allows Entra ID to act as the identity provider, exchanging SAML assertions for authentication.

Answer

An Application Proxy connector group

Answer

A service principal for Microsoft Graph

Answer

An app registration with OpenID Connect

Question 2

You are troubleshooting an issue where users from a partner organization cannot access a shared app in your Microsoft Entra ID tenant. The partner uses Microsoft Entra ID with a custom domain. You have configured cross-tenant access settings. Which setting is most likely misconfigured?

Accepted Answer

Default inbound cross-tenant access settings for the partner's tenant ID. The default inbound cross-tenant access settings control how external users from other tenants access your tenant's resources. Since the partner cannot access the shared app, the most likely misconfiguration is that the default inbound settings for the partner's tenant ID are set to block access, or the partner's tenant ID is not explicitly allowed in the inbound settings. This overrides any app-level permissions, as cross-tenant access settings act as a gate before user assignment is evaluated.

Answer

Outbound cross-tenant access settings for the partner's tenant ID

Answer

The app's user assignment and provisioning configuration

Answer

The partner's inbound cross-tenant access settings for your tenant

Question 3

Your organization requires that all administrators use phishing-resistant authentication methods. Which Microsoft Entra ID authentication method meets this requirement?

Accepted Answer

FIDO2 security key. FIDO2 security keys are phishing-resistant because they use public-key cryptography and are bound to a specific website origin, preventing credential reuse on fake sites. This meets Microsoft's requirement for phishing-resistant authentication under Entra ID, as it satisfies the 'something you have' factor without exposing secrets to the relying party.

Answer

SMS-based verification

Answer

Microsoft Authenticator push notification

Answer

Temporary Access Pass

Question 4

You are designing a Microsoft Entra ID tenant for a new subsidiary. You need to ensure that users can authenticate using their existing on-premises Active Directory credentials without synchronizing password hashes to the cloud. Which identity model should you choose?

Accepted Answer

Pass-through authentication (PTA). Pass-through authentication (PTA) allows users to authenticate against on-premises Active Directory directly, without synchronizing password hashes to the cloud. When a user signs in to Microsoft Entra ID, the authentication request is forwarded to an on-premises PTA agent, which validates the credentials against the local domain controller. This meets the requirement of using existing on-premises credentials without storing password hashes in the cloud.

Answer

Federation with AD FS

Answer

Cloud-only identity

Answer

Password hash synchronization (PHS)

Question 5

Your company uses Microsoft Entra ID and has enabled Microsoft Entra ID Protection. You notice that a user's sign-in was blocked due to a medium user risk. However, the user claims the sign-in was legitimate. What should you do to allow future sign-ins without lowering security?

Accepted Answer

Use the Microsoft Entra ID Protection reports to confirm the user as safe. When a user claims a blocked sign-in was legitimate, the proper action is to confirm the user as safe in the Microsoft Entra ID Protection reports. This action updates the risk state to 'confirmed safe', which resets the user's risk level and allows future sign-ins without lowering security. It also provides feedback to the risk detection algorithm to improve accuracy.

Answer

Create a conditional access policy to bypass MFA for this user

Answer

Suppress the alert in Microsoft Defender XDR

Answer

Dismiss the risk in the Risky users report

Question 6

You need to provide external partners with access to specific SharePoint Online sites without creating user objects in your Microsoft Entra ID. What should you use?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration allows you to share SharePoint Online sites with external partners by creating lightweight guest user objects rather than full user objects, satisfying the requirement of not creating user objects in your Microsoft Entra ID. These guest objects enable access using the partner's own credentials, minimizing identity management overhead.

Answer

Microsoft Entra B2C

Answer

Application Proxy

Answer

Microsoft Entra Connect

Question 7

Your organization is implementing a zero-trust security model. Which TWO Microsoft Entra ID features should you enable to enforce least-privilege access and continuous verification?

Accepted Answer

Conditional Access. Conditional Access (A) is correct because it enforces least-privilege access by applying policies that require specific conditions (e.g., device compliance, location, risk level) before granting access to resources. It also enables continuous verification by evaluating signals in real time during each authentication request, ensuring that access is revoked if conditions change (e.g., user risk increases). This aligns directly with the zero-trust principle of 'never trust, always verify.'

Answer

Self-service password reset (SSPR)

Answer

Application Proxy

Answer

Microsoft Entra Join

Question 8

Your company uses Microsoft Entra ID with hybrid identity. You need to ensure that when a user is disabled in on-premises Active Directory, the corresponding cloud user is also disabled. Which TWO configurations are required?

Accepted Answer

Microsoft Entra Connect with directory synchronization. To ensure that disabling a user on-premises also disables the cloud user, two things are needed: first, directory synchronization via Microsoft Entra Connect (D) must be enabled to propagate changes from on-premises AD to Microsoft Entra ID. Second, the on-premises user account must be disabled (E); this is the action that triggers a change that will be synchronized. Password writeback (A) only synchronizes password changes, not account status. Privileged Identity Management (B) manages just-in-time privileged access, not synchronization. Group writeback (C) syncs cloud groups to on-premises, not user disable status.

Answer

Password writeback

Answer

Privileged Identity Management

Answer

Group writeback

Question 9

You are reviewing a Conditional Access session control configuration in Microsoft Entra ID. Based on the exhibit, what is the expected behavior when a user signs in?

Accepted Answer

The user must reauthenticate every time they access the application, and session monitoring is enabled.. The sign-in frequency is set to 'EveryTime', so the user must reauthenticate every time they access the application. Cloud app security is set to 'Monitor only', enabling session monitoring but not enforcement (e.g., blocking). Option A is incorrect because the configuration does not include a device compliance condition. Option B is incorrect because the frequency is every time, not every hour. Option D is incorrect because cloud app security is explicitly set to 'Monitor only', not null. Therefore, option C is correct.

Answer

The user is blocked from accessing the application unless they have a compliant device.

Answer

The user is prompted to reauthenticate every hour.

Answer

The session is not monitored because cloud app security is null.

Question 10

You are examining the default cross-tenant access policy for your Microsoft Entra ID tenant. Based on the exhibit, which statement is true?

Accepted Answer

External users must always reauthenticate even if their home tenant requires MFA.. The default cross-tenant access policy in Microsoft Entra ID includes a setting that, when enabled, requires external users to satisfy MFA requirements from their home tenant. However, the exhibit shows that the 'Trust MFA from external tenants' option is not selected, meaning Entra ID will not accept MFA claims from the external user's home tenant. As a result, external users must always reauthenticate with MFA, even if their home tenant already enforced MFA.

Answer

Your users can use their Microsoft Authenticator app to sign in to partner tenants.

Answer

B2B direct connect is enabled for all external organizations.

Answer

Compliant device claims from external tenants are trusted.

Question 11

You are the identity architect for Contoso, a multinational company with 50,000 employees. Contoso uses Microsoft Entra ID with hybrid identity (PHS) and Microsoft Entra ID Protection. The company is deploying Microsoft Copilot for Microsoft 365 and wants to ensure that access to Copilot is controlled based on user risk, device compliance, and location. Additionally, the security team requires that all Copilot interactions are logged and auditable. You need to design a solution that meets these requirements with minimal administrative overhead.

Current environment:
- All users are synced from on-premises AD using Microsoft Entra Connect.
- Devices are either Microsoft Entra hybrid joined or Microsoft Entra registered.
- Microsoft Entra ID Protection is enabled with user risk and sign-in risk policies.
- Microsoft Intune is used for device compliance policies.
- All users have Microsoft 365 E5 licenses.

Requirements:
- Access to Copilot must be blocked for users with high user risk.
- Access from untrusted locations must require MFA.
- Only compliant devices can access Copilot.
- All Copilot interactions must be captured in Microsoft Purview Audit (Standard).

What should you do?

Accepted Answer

Create a Conditional Access policy targeting 'Microsoft Copilot' app. Configure conditions: user risk High to block, locations (untrusted) to require MFA, and device compliance to require compliant device. Ensure Purview Audit is enabled for Copilot.. Conditional Access policies can enforce risk, location, and device compliance for Copilot as a cloud app, and Copilot interactions are automatically audited in Purview Audit. Option A is wrong because Defender for Cloud Apps would add unnecessary overhead and does not directly address all requirements. Option C is wrong because Intune app protection policies do not enforce risk-based access. Option D is wrong because Entra ID Protection alone does not enforce device compliance or location-based MFA.

Answer

Use Microsoft Defender for Cloud Apps to create session policies for Copilot, and integrate with Entra ID Protection.

Answer

Deploy Microsoft Intune app protection policies for Copilot, and use device compliance policies to block non-compliant devices.

Answer

Use Microsoft Entra ID Protection to block high-risk users, and configure Intune compliance policies to require MFA from untrusted locations.

Question 12

Your organization uses Microsoft Entra ID P2 licenses. You need to configure a Conditional Access policy that requires phishing-resistant multifactor authentication (MFA) for all users accessing sensitive applications. Which authentication strength should you select in the policy?

Accepted Answer

Phishing-resistant MFA. The scenario explicitly requires 'phishing-resistant multifactor authentication (MFA).' Microsoft Entra ID authentication strengths allow you to enforce specific authentication methods. The 'Phishing-resistant MFA' strength includes methods like FIDO2 security keys and certificate-based authentication (CBA), which are resistant to phishing attacks. Selecting this strength ensures that only phishing-resistant methods are accepted for the Conditional Access policy.

Answer

Passwordless MFA

Answer

Multifactor authentication

Answer

No authentication strength

Question 13

You are troubleshooting why a user cannot access a SharePoint Online site. The user is assigned a Conditional Access policy that requires compliant device, and the device is enrolled in Microsoft Intune but shows as non-compliant. What is the most likely cause?

Accepted Answer

The device is non-compliant due to missing security updates. The user's device is enrolled in Intune but marked as non-compliant, which directly blocks access because the Conditional Access policy requires a compliant device. The most common reason for non-compliance is missing security updates, as Intune evaluates compliance based on configured policies such as required patch levels, encryption status, or threat detection. Since the device is enrolled, the issue is not enrollment or licensing, but a specific compliance rule violation.

Answer

The device is not enrolled in Microsoft Intune

Answer

The Conditional Access policy is not applied to SharePoint Online

Answer

The user does not have an Intune license

Question 14

Your company has a hybrid identity configuration with Microsoft Entra Connect Sync. You need to enable password hash synchronization (PHS) for hybrid users. What is the prerequisite?

Accepted Answer

Hybrid Identity Administrator role in Microsoft Entra ID. The Hybrid Identity Administrator role in Microsoft Entra ID is required to enable password hash synchronization (PHS) because this role grants the necessary permissions to configure directory synchronization settings, including the PHS feature, within the Entra ID tenant. Without this role, the synchronization account used by Microsoft Entra Connect Sync cannot modify the tenant-level PHS toggle, even if the local service account has sufficient permissions on-premises.

Answer

Pass-through authentication agent installed

Answer

Password writeback enabled

Answer

Federation with AD FS

Question 15

Refer to the exhibit. You need to ensure that users accessing Exchange Online from unmanaged devices are blocked. What should you modify in the policy?

Accepted Answer

Change the operator from OR to AND. The exhibit shows a conditional access policy with two grant controls: 'Require multi-factor authentication' and 'Require device to be marked as compliant', connected by OR. With OR, users can satisfy either control, so unmanaged devices can still authenticate via MFA alone. Changing the operator to AND forces both MFA and device compliance, blocking access from unmanaged devices that cannot be compliant.

Answer

Remove the MFA control

Answer

Add the 'approvedClientApp' grant control with OR

Answer

Add a session control for app protection policies