MS-102 Implement and manage Microsoft Entra identity and access Practice Test 9 — 15 Questions

Question 1

You need to provide external partners with access to specific SharePoint Online sites without creating user objects in your Microsoft Entra ID. What should you use?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration allows you to share SharePoint Online sites with external partners without creating user objects in your Microsoft Entra ID. Instead, B2B collaboration creates lightweight guest user objects that represent external identities, enabling access via their own organizational or social credentials. This is the correct approach because it provides the necessary access while minimizing identity management overhead.

Answer

Microsoft Entra B2C

Answer

Application Proxy

Answer

Microsoft Entra Connect

Question 2

Your organization is implementing a zero-trust security model. Which TWO Microsoft Entra ID features should you enable to enforce least-privilege access and continuous verification?

Accepted Answer

Conditional Access. Conditional Access enables continuous verification, and Privileged Identity Management enforces just-in-time access. Option B is wrong because SSPR is for password reset. Option D is wrong because Microsoft Entra Join is a device identity method. Option E is wrong because Application Proxy is for remote access.

Answer

Self-service password reset (SSPR)

Answer

Application Proxy

Answer

Microsoft Entra Join

Question 3

You are deploying Microsoft Entra ID Governance. Which THREE capabilities should you include to meet compliance requirements for access recertification and lifecycle management?

Accepted Answer

Access Reviews. Access Reviews (B) are a core capability of Microsoft Entra ID Governance that directly enables compliance-driven access recertification. They allow administrators to create recurring reviews of group memberships, application assignments, and privileged roles, ensuring that only authorized users retain access. This satisfies regulatory requirements like SOX, GDPR, or HIPAA by providing attestation workflows and audit trails.

Answer

Identity Protection

Answer

B2B Collaboration

Question 4

Your company uses Microsoft Entra ID with hybrid identity. You need to ensure that when a user is disabled in on-premises Active Directory, the corresponding cloud user is also disabled. Which TWO configurations are required?

Accepted Answer

Microsoft Entra Connect with directory synchronization. Directory synchronization (Microsoft Entra Connect) propagates changes, and disabling the on-premises user will sync to cloud. Option B is wrong because password writeback is for password changes. Option E is wrong because PIM is for privileged access. Option C is wrong because group writeback is for cloud groups to on-premises. Option D is wrong because cloud sync is an alternative to Connect, but Connect is typically used.

Answer

Password writeback

Answer

Privileged Identity Management

Answer

Group writeback

Question 5

You are reviewing a Conditional Access session control configuration in Microsoft Entra ID. Based on the exhibit, what is the expected behavior when a user signs in?

Accepted Answer

The user must reauthenticate every time they access the application, and session monitoring is enabled.. The sign-in frequency is set to 'EveryTime', so the user must reauthenticate every time. The cloud app security is set to monitor only, so session monitoring is enabled but not enforced. Option B is wrong because the session is not blocked. Option C is wrong because frequency is every time, not every hour. Option D is wrong because cloud app security is explicitly enabled.

Answer

The user is blocked from accessing the application unless they have a compliant device.

Answer

The user is prompted to reauthenticate every hour.

Answer

The session is not monitored because cloud app security is null.

Question 6

You are examining the default cross-tenant access policy for your Microsoft Entra ID tenant. Based on the exhibit, which statement is true?

Accepted Answer

External users must always reauthenticate even if their home tenant requires MFA.. The default policy shows that MFA claims are not trusted from external tenants. Option A is wrong because the default policy can be modified, but as shown, MFA is not trusted. Option B is wrong because B2B direct connect inbound is empty, meaning no trust. Option D is wrong because compliant device is not trusted.

Answer

Your users can use their Microsoft Authenticator app to sign in to partner tenants.

Answer

B2B direct connect is enabled for all external organizations.

Answer

Compliant device claims from external tenants are trusted.

Question 7

You are the identity architect for Contoso, a multinational company with 50,000 employees. Contoso uses Microsoft Entra ID with hybrid identity (PHS) and Microsoft Entra ID Protection. The company is deploying Microsoft Copilot for Microsoft 365 and wants to ensure that access to Copilot is controlled based on user risk, device compliance, and location. Additionally, the security team requires that all Copilot interactions are logged and auditable. You need to design a solution that meets these requirements with minimal administrative overhead.

Current environment:
- All users are synced from on-premises AD using Microsoft Entra Connect.
- Devices are either Microsoft Entra hybrid joined or Microsoft Entra registered.
- Microsoft Entra ID Protection is enabled with user risk and sign-in risk policies.
- Microsoft Intune is used for device compliance policies.
- All users have Microsoft 365 E5 licenses.

Requirements:
- Access to Copilot must be blocked for users with high user risk.
- Access from untrusted locations must require MFA.
- Only compliant devices can access Copilot.
- All Copilot interactions must be captured in Microsoft Purview Audit (Standard).

What should you do?

Accepted Answer

Create a Conditional Access policy targeting 'Microsoft Copilot' app. Configure conditions: user risk High to block, locations (untrusted) to require MFA, and device compliance to require compliant device. Ensure Purview Audit is enabled for Copilot.. Option A is correct because Conditional Access policies can enforce risk, location, and device compliance for Copilot as a cloud app, and Copilot interactions are automatically audited in Purview Audit. Option B is wrong because Entra ID Protection does not control device compliance. Option C is wrong because Intune policies do not enforce risk-based access. Option D is wrong because Defender for Cloud Apps would be additional overhead and not directly address the requirements.

Answer

Use Microsoft Defender for Cloud Apps to create session policies for Copilot, and integrate with Entra ID Protection.

Answer

Deploy Microsoft Intune app protection policies for Copilot, and use device compliance policies to block non-compliant devices.

Answer

Use Microsoft Entra ID Protection to block high-risk users, and configure Intune compliance policies to require MFA from untrusted locations.

Question 8

Your organization uses Microsoft Entra ID P2 licenses. You need to configure a Conditional Access policy that requires phishing-resistant multifactor authentication (MFA) for all users accessing sensitive applications. Which authentication strength should you select in the policy?

Accepted Answer

Phishing-resistant MFA. Option B is correct because phishing-resistant MFA requires a certificate-based or FIDO2 security key. Option A is wrong because passwordless MFA with Microsoft Authenticator is not considered phishing-resistant. Option C is wrong because it is a weaker strength. Option D is wrong because it does not enforce phishing resistance.

Answer

Passwordless MFA

Answer

Multifactor authentication

Answer

No authentication strength

Question 9

You are troubleshooting why a user cannot access a SharePoint Online site. The user is assigned a Conditional Access policy that requires compliant device, and the device is enrolled in Microsoft Intune but shows as non-compliant. What is the most likely cause?

Accepted Answer

The device is non-compliant due to missing security updates. Option C is correct because the device is enrolled but non-compliant, which triggers the Conditional Access block. Option A is wrong because the device is enrolled. Option B is wrong because the user is licensed. Option D is wrong because the policy is correctly targeting SharePoint Online.

Answer

The device is not enrolled in Microsoft Intune

Answer

The Conditional Access policy is not applied to SharePoint Online

Answer

The user does not have an Intune license

Question 10

Your company has a hybrid identity configuration with Microsoft Entra Connect Sync. You need to enable password hash synchronization (PHS) for hybrid users. What is the prerequisite?

Accepted Answer

Hybrid Identity Administrator role in Microsoft Entra ID. Option A is correct because PHS requires the Hybrid Identity Administrator role to configure. Option B is wrong because PHS does not require federation. Option C is wrong because PHS does not require password writeback. Option D is wrong because PHS does not require pass-through authentication.

Answer

Pass-through authentication agent installed

Answer

Password writeback enabled

Answer

Federation with AD FS

Question 11

Refer to the exhibit. You need to ensure that users accessing Exchange Online from unmanaged devices are blocked. What should you modify in the policy?

Accepted Answer

Change the operator from OR to AND. The exhibit shows a conditional access policy with two grant controls: 'Require multi-factor authentication' and 'Require device to be marked as compliant', connected by OR. With OR, users can satisfy either control, so unmanaged devices can still authenticate via MFA alone. Changing the operator to AND forces both MFA and device compliance, blocking access from unmanaged devices that cannot be compliant.

Answer

Remove the MFA control

Answer

Add the 'approvedClientApp' grant control with OR

Answer

Add a session control for app protection policies

Question 12

Your organization uses Microsoft Entra ID Governance. You need to implement an access review for all users who have access to a critical application. The review must be recurring every quarter and require reviewers to provide a justification for their decisions. Which access review settings should you configure?

Accepted Answer

Frequency: Quarterly, Justification required: Yes. Option C is correct because quarterly recurrence with justification required matches the requirement. Option A is wrong because it is monthly, not quarterly. Option B is wrong because it does not require justification. Option D is wrong because it is annual.

Answer

Frequency: Quarterly, Justification required: No

Answer

Frequency: Annually, Justification required: Yes

Answer

Frequency: Monthly, Justification required: Yes

Question 13

You are implementing Microsoft Entra Verified ID. Which identity verification method uses a decentralized identity standard?

Accepted Answer

Decentralized identifiers (DIDs). Microsoft Entra Verified ID is built on open standards for decentralized identity, specifically using Decentralized Identifiers (DIDs) as defined by the W3C. DIDs enable verifiable, self-sovereign identity without relying on a central authority, which is the core requirement for a decentralized identity verification method. This allows users to control their own identifiers and present verifiable credentials that can be cryptographically verified.

Answer

SAML 2.0

Answer

OAuth 2.0

Answer

Federation with Azure AD

Question 14

Your organization uses Microsoft Entra ID. You need to ensure that users can only access company resources from trusted networks. Which Conditional Access condition should you configure?

Accepted Answer

Locations. Option C is correct because the locations condition allows targeting trusted networks. Option A is wrong because device platforms target OS types. Option B is wrong because client apps target app types. Option D is wrong because sign-in risk targets risky sign-ins.

Answer

Sign-in risk

Answer

Device platforms

Answer

Client apps

Question 15

Your company deploys Microsoft 365 Copilot. You need to enforce that Copilot responses are based only on data within the tenant, not external sources. Which setting should you configure?

Accepted Answer

Copilot's 'Responses' setting in the Microsoft 365 admin center. The 'Responses' setting in the Microsoft 365 admin center controls whether Copilot can use data from external sources (such as the public web) or is restricted to your tenant's data. By configuring this setting to 'Only use data from your organization,' you enforce that Copilot responses are grounded solely in your Microsoft 365 tenant content (emails, documents, chats, etc.), preventing any reliance on external internet sources. This is the direct administrative toggle for Copilot's data grounding scope.

Answer

Sensitivity labels

Answer

Data Loss Prevention (DLP) policies

Answer

Microsoft Purview Compliance Manager