MS-102 Implement and manage Microsoft Entra identity and access Practice Test 9 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID Governance. You need to implement an access review for all users who have access to a critical application. The review must be recurring every quarter and require reviewers to provide a justification for their decisions. Which access review settings should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Frequency: Quarterly, Justification required: Yes. The requirement specifies a quarterly recurring access review with mandatory justification. In Microsoft Entra ID Governance, the 'Frequency' setting controls the recurrence interval (e.g., Quarterly), and the 'Justification required' toggle enforces that reviewers must provide a reason for their decision. Setting 'Justification required' to 'Yes' ensures compliance with audit and governance policies.

Answer

Frequency: Quarterly, Justification required: No

Answer

Frequency: Annually, Justification required: Yes

Answer

Frequency: Monthly, Justification required: Yes

Question 2

You are implementing Microsoft Entra Verified ID. Which identity verification method uses a decentralized identity standard?

Accepted Answer

Decentralized identifiers (DIDs). Microsoft Entra Verified ID is built on open standards for decentralized identity, specifically using Decentralized Identifiers (DIDs) as defined by the W3C. DIDs enable verifiable, self-sovereign identity without relying on a central authority, which is the core requirement for a decentralized identity verification method. This allows users to control their own identifiers and present verifiable credentials that can be cryptographically verified.

Answer

SAML 2.0

Answer

OAuth 2.0

Answer

Federation with Azure AD

Question 3

Your organization uses Microsoft Entra ID. You need to ensure that users can only access company resources from trusted networks. Which Conditional Access condition should you configure?

Accepted Answer

Locations. The Locations condition in a Conditional Access policy allows you to define trusted network locations using named locations (IP ranges or country/region). By configuring a policy that grants access only from these trusted locations, you ensure users can only access company resources from networks you have explicitly approved, such as corporate offices or VPN egress IPs.

Answer

Sign-in risk

Answer

Device platforms

Answer

Client apps

Question 4

Your company deploys Microsoft 365 Copilot. You need to enforce that Copilot responses are based only on data within the tenant, not external sources. Which setting should you configure?

Accepted Answer

Copilot's 'Responses' setting in the Microsoft 365 admin center. The 'Responses' setting in the Microsoft 365 admin center controls whether Copilot can use data from external sources (such as the public web) or is restricted to your tenant's data. By configuring this setting to 'Only use data from your organization,' you enforce that Copilot responses are grounded solely in your Microsoft 365 tenant content (emails, documents, chats, etc.), preventing any reliance on external internet sources. This is the direct administrative toggle for Copilot's data grounding scope.

Answer

Sensitivity labels

Answer

Data Loss Prevention (DLP) policies

Answer

Microsoft Purview Compliance Manager

Question 5

Your organization needs to implement a Conditional Access policy that blocks access from countries where the company has no business operations. Which TWO conditions should you configure?

Accepted Answer

Locations. To block access from countries where the company has no business operations, you configure the Locations condition to define named locations based on IP ranges or countries. Additionally, you must configure the Client apps condition to specify which applications the policy applies to, such as all client apps or specific types like browser or mobile apps. This ensures the policy effectively blocks access from the specified countries across the intended applications.

Answer

Device platforms

Answer

User risk

Answer

Sign-in risk

Question 6

You are designing a tenant restriction policy using Microsoft Entra ID. Which TWO components are required?

Accepted Answer

Tenant ID of the allowed tenant. A tenant restriction policy requires two components: the Tenant ID of the allowed tenant, which identifies the tenant that is allowed, and the Restriction policy JSON, which defines the restrictions, including the list of allowed/blocked tenants and policy version. Together these are used by Microsoft Entra ID to enforce which tenant is authorized. Conditional Access policies, public key certificates, and custom DNS records are not required components of a tenant restriction policy.

Answer

Public key certificate

Answer

Conditional Access policy

Answer

Custom DNS records

Question 7

Your organization, Contoso Ltd., has a Microsoft 365 E5 tenant with Microsoft Entra ID P2. You are the Global Administrator. The security team reports that several users have been compromised due to weak passwords. You need to implement a solution that enforces strong password policies and blocks common passwords. The solution must also provide users with the ability to reset their own passwords securely if they forget them, without requiring help desk intervention. Additionally, you need to configure risk-based Conditional Access policies to block sign-ins from anonymous IP addresses and require MFA for high-risk sign-ins. You have the following options: A. Configure password protection in Microsoft Entra ID to enforce a custom banned password list and enable self-service password reset (SSPR) with MFA. Then create Conditional Access policies for sign-in risk and anonymous IP. B. Enable password hash sync and configure pass-through authentication. Create a Conditional Access policy to require MFA for all users. C. Implement Microsoft Entra ID Protection and enable MFA registration policy. Configure password expiration to 90 days. D. Use security defaults in Microsoft Entra ID and enable automatic password rollback. Which option should you choose?

Accepted Answer

Configure password protection with custom banned list, SSPR with MFA, and risk-based Conditional Access policies. It covers all requirements: custom banned password list, SSPR, and risk-based Conditional Access policies. Option B is wrong because it does not address common passwords or SSPR. Option C is wrong because password expiration is not effective and no SSPR. Option D is wrong because security defaults do not allow custom banned password list and risk-based policies.

Answer

Enable password hash sync, pass-through authentication, and require MFA for all

Answer

Implement Identity Protection, enable MFA registration policy, set password expiration to 90 days

Answer

Use security defaults and enable automatic password rollback

Question 8

Your company, Fabrikam Inc., uses Microsoft Entra ID with hybrid identity. You have an on-premises Active Directory and use Microsoft Entra Connect Sync to synchronize users. You need to configure Microsoft Entra ID Protection to detect leaked credentials and risky sign-ins. Additionally, you must ensure that when a user is detected as high risk, their access is automatically blocked and they are required to change their password. You also need to enable password writeback so that password changes are written back to on-premises AD. You have the following options: A. Enable Identity Protection, configure user risk policy to require password change, and enable password writeback in Microsoft Entra Connect. B. Enable Identity Protection, configure sign-in risk policy to block access, and enable password hash sync. C. Configure Conditional Access policy to require MFA for all users, and enable seamless SSO. D. Deploy Microsoft Defender for Identity and configure automatic remediation. Which option should you choose?

Accepted Answer

Enable Identity Protection, configure user risk policy to require password change, enable password writeback. It directly addresses all requirements: enabling Identity Protection allows detection of leaked credentials and risky sign-ins; configuring the user risk policy to require a password change automatically blocks high-risk users until they change their password; and enabling password writeback in Microsoft Entra Connect ensures that password changes performed in the cloud are written back to on-premises Active Directory, maintaining hybrid identity synchronization.

Answer

Enable Identity Protection, configure sign-in risk policy to block access, enable password hash sync

Answer

Deploy Microsoft Defender for Identity, configure automatic remediation

Answer

Configure Conditional Access policy to require MFA, enable seamless SSO

Question 9

Your organization, Wingtip Toys, has a Microsoft 365 E3 tenant. You are implementing Microsoft Entra ID Governance. You need to create an access review for all guest users who have access to the company's HR application. The review must be performed by the application owner, and any denied access should be automatically removed after the review completes. You also need to ensure that if the reviewer does not respond, their access is automatically revoked. You have the following options: A. Create an access review with scope: All guest users, reviewers: Application owner, auto-apply results: Yes, action to apply if reviewers don't respond: Remove access. B. Create an access review with scope: All users, reviewers: Resource owners, auto-apply results: No, action to apply if reviewers don't respond: Keep access. C. Create an access review with scope: Group members, reviewers: Group owner, auto-apply results: Yes, action to apply if reviewers don't respond: Keep access. D. Create an access review with scope: All guest users, reviewers: Resource owner, auto-apply results: No, action to apply if reviewers don't respond: Remove access. Which option should you choose?

Accepted Answer

Access review with guest users, application owner, auto-apply, remove access if no response. It configures an access review scoped to 'All guest users', assigns the 'Application owner' as the reviewer, enables 'Auto-apply results' to automatically remove denied access, and sets the 'Action to apply if reviewers don't respond' to 'Remove access'. This directly meets the requirements: only guest users are reviewed, the application owner performs the review, denied access is automatically removed after the review completes, and non-responsive reviewers trigger automatic revocation.

Answer

Access review with all users, resource owners, no auto-apply, keep access if no response

Answer

Access review with guest users, resource owner, no auto-apply, remove access if no response

Answer

Access review with group members, group owner, auto-apply, keep access if no response

Question 10

Your organization uses Microsoft Entra ID Governance. You need to implement an access review for all users who have access to a critical application. The review must be recurring every quarter and require reviewers to provide a justification for their decisions. Which access review settings should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign 'User risk policy' with grant 'Require password change'. The 'User risk policy' in Microsoft Entra ID Conditional Access is specifically designed to respond to user-level risk detections from Identity Protection. When a user's risk level is 'high', the policy can enforce a 'Require password change' grant, which forces the user to change their password at next sign-in to remediate the compromised account. This aligns with the requirement to automatically trigger a password change based on user risk.

Answer

Assign 'Sign-in risk policy' with session control 'Sign-in frequency'

Answer

Assign 'User risk policy' with grant 'Require multifactor authentication'

Answer

Assign 'User risk policy' with grant 'Block access'

Question 11

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You plan to use Microsoft Entra Connect Sync to synchronize user accounts. The security team requires that all cloud-only users must be blocked from syncing to on-premises AD. What should you do to meet this requirement?

Accepted Answer

Configure attribute mapping to filter out cloud-only users from writeback. Configuring attribute mapping to filter out cloud-only users from writeback directly prevents those users from being written back to on-premises Active Directory. In Microsoft Entra Connect Sync, attribute mapping rules can include scoping filters that exclude objects based on specific attributes, such as a custom attribute or the cloud-only user indicator. This ensures that only synchronized users are written back, meeting the security requirement without affecting other sync operations.

Answer

Use the cloudFilter attribute to mark cloud-only users as false

Answer

Disable directory writeback in Microsoft Entra Connect Sync

Answer

Configure Selective Password Hash Sync to exclude cloud-only users

Question 12

A user reports they cannot access a SharePoint Online site. They receive an error stating that their account is disabled. You check Microsoft Entra ID and see the user's account is enabled. What is the most likely cause?

Accepted Answer

The user is synced from on-premises Active Directory and the on-premises account is disabled. The most likely cause is that the user is synced from on-premises Active Directory and the on-premises account is disabled. When a user is synchronized via Microsoft Entra Connect, the on-premises account status (enabled/disabled) is replicated to Microsoft Entra ID. However, the SharePoint Online service may still enforce the on-premises disabled state for authentication, even if the Microsoft Entra ID account appears enabled, because the token issued by Entra ID includes a claim reflecting the on-premises account status.

Answer

The user has been configured to require multi-factor authentication

Answer

The user has been removed from all groups

Answer

The user has been converted to a guest user

Question 13

You need to allow external users from a specific partner organization to access a SharePoint Online site using their own Microsoft Entra ID credentials. Which feature should you configure?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is the correct feature because it allows you to invite external users from a partner organization to access your SharePoint Online site using their own Microsoft Entra ID (or other identity provider) credentials. B2B collaboration uses cross-tenant trust to authenticate the external user against their home tenant, enabling seamless access without creating local accounts.

Answer

Direct Federation

Answer

Self-service password reset

Answer

Microsoft Entra B2C

Question 14

Your organization uses Microsoft Entra ID Governance. You need to implement an access review for all users who have access to a critical application. The review must be recurring every quarter and require reviewers to provide a justification for their decisions. Which access review settings should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

User risk policy with 'Require password change' and enable user feedback. A user risk policy with 'Require password change' automatically requires high-risk users to change their password when a risk is detected. Enabling user feedback allows users to report false positives by dismissing the risk, providing self-remediation. Option B (sign-in risk policy) handles sign-in risks, not user risk. Option C (block access) would block the user without allowing password change or false positive dismissal. Option D requires MFA but does not change the password.

Answer

Sign-in risk policy with 'Require password change'

Answer

User risk policy with 'Block access' and enable user feedback

Answer

Sign-in risk policy with 'Require multifactor authentication'

Question 15

Which TWO actions can you perform using Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Automate user access reviews. Microsoft Entra ID Governance includes automated user access reviews, which allow organizations to periodically certify that users still need access to applications, groups, and roles. These reviews can be scheduled, recurring, and delegated to reviewers, with automated actions like removing access when a reviewer does not respond. This directly supports compliance and least-privilege principles.

Answer

Manage device compliance policies

Answer

Configure single sign-on for SaaS apps

Answer

Delegate administrative roles