MS-102 Hard Questions — 25 Difficult Questions

Question 1

A company uses Microsoft Entra ID Governance to automate the lifecycle of user access. They want to automatically remove a user's group membership for a critical application 30 days after the user's employment end date is captured from the HR system. Which feature should be configured to meet this requirement?

Accepted Answer

Lifecycle Workflows. Lifecycle Workflows (LCW) in Microsoft Entra ID Governance are specifically designed to automate joiner, mover, and leaver processes triggered by HR data. A 'leaver' workflow can be configured to remove group memberships a defined number of days after the employee's employment end date is captured from the HR system, meeting the 30-day requirement precisely.

Answer

Access Reviews

Answer

Entitlement management

Answer

Privileged Identity Management

Question 2

A company invites external partners as B2B guest users in Microsoft Entra ID. The partners' home tenants do not support MFA. The company wants to require MFA when guests access an internal application. What should the company configure?

Accepted Answer

Configure a Conditional Access policy that targets all guest users, require MFA, and enable MFA registration for guests in the resource tenant.. Option A is correct because when guest users' home tenants do not support MFA, the resource tenant must enforce MFA directly. A Conditional Access policy targeting all guest users with 'Require MFA' grant control, combined with enabling MFA registration for guests in the resource tenant, allows guests to register and use MFA methods (e.g., Microsoft Authenticator) within the resource tenant. This ensures MFA is enforced regardless of the home tenant's capabilities.

Answer

Ask the partners to configure MFA in their home tenant, then trust their MFA claims.

Answer

Use a Per-User MFA policy for guest users, but guests cannot register for MFA in the resource tenant.

Answer

Create a Conditional Access policy requiring MFA for all external users, but exclude guests from known networks.

Question 3

A security administrator needs to block users from running portable executable files (e.g., .exe, .scr) that were downloaded from the internet on Windows devices. Which Attack Surface Reduction (ASR) rule should the administrator enable to meet this requirement?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion. Option A is correct because the ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) specifically targets executable files (e.g., .exe, .scr) that have been downloaded from the internet by checking their Mark-of-the-Web (MoTW) attribute. When enabled, this rule prevents execution of such files unless they meet criteria like high prevalence, sufficient age, or inclusion in a trusted list, directly addressing the requirement to block internet-downloaded portable executables.

Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Answer

Block Adobe Reader from creating child processes

Answer

Block persistence through WMI event subscription

Question 4

A development team builds a background service that needs to read all users' calendars via Microsoft Graph without a signed-in user. The service will run on a server with a client secret. Which OAuth 2.0 grant flow should the application use?

Accepted Answer

Client credentials grant. The client credentials grant is designed for server-to-server, non-interactive scenarios where an application authenticates as itself (not on behalf of a user) to access resources. Since the background service runs with a client secret and needs to read all users' calendars without a signed-in user, this flow is the correct choice because it uses the application's own identity to obtain an access token from Microsoft Entra ID.

Answer

Authorization code grant

Answer

Device authorization grant

Answer

Implicit grant

Question 5

A security administrator needs to configure an automated investigation and response (AIR) playbook in Microsoft 365 Defender that will automatically isolate a device whenever a high-severity alert from Microsoft Defender for Endpoint is generated. The playbook must run without requiring manual approval. Which configuration must the administrator set to achieve automatic device isolation?

Accepted Answer

Set the automation level for device isolation to 'Full - automatically remediate threats' in the Advanced Features settings.. Option A is correct because the automation level for device isolation in Microsoft 365 Defender's Advanced Features settings controls whether the AIR playbook executes actions automatically. Setting it to 'Full - automatically remediate threats' ensures that when a high-severity alert triggers the playbook, device isolation is performed without requiring manual approval, meeting the requirement for fully automated response.

Answer

Create a custom detection rule that triggers on high-severity alerts and uses an automated action.

Answer

Configure the device isolation action to require approval in the automation level settings.

Answer

Enable automatic remediation only for medium severity and above.

Question 6

A security analyst wants to automatically create a Microsoft Teams message in a dedicated security channel whenever a Microsoft 365 Defender incident with severity 'High' is created. Which automation approach should the analyst use?

Accepted Answer

Power Automate. Power Automate is the correct choice because it provides a no-code/low-code workflow that can be triggered by Microsoft 365 Defender's 'When an incident is created or updated' connector, filter for severity 'High', and then post a message to a dedicated Teams channel via the 'Post a message in a chat or channel' action. This directly meets the requirement for automatic, event-driven notification without custom code.

Answer

Automation rules in Defender

Answer

Microsoft Graph API

Answer

Action Center

Question 7

A security administrator notices that users are receiving phishing emails that evade built-in anti-spam filters. The administrator wants to enable users to report these suspicious emails from Outlook and have them automatically trigger an investigation and block the sender. Which feature should be configured in Microsoft Defender for Office 365?

Accepted Answer

User reported settings in the Microsoft 365 Defender portal. User reported settings in the Microsoft 365 Defender portal allow administrators to configure how user-reported messages are handled. When enabled, users can report suspicious emails directly from Outlook, and these reports can automatically trigger an investigation and block the sender via automated investigation and response (AIR) policies. This directly addresses the requirement to have user-reported emails initiate security actions.

Answer

Attack simulation training

Answer

Threat Explorer

Answer

Safe Links

Question 8

A security administrator needs to discover which cloud apps are being used in the organization and then block usage of unsanctioned apps in real time using a reverse proxy. Which two Microsoft Defender for Cloud Apps features must be configured to meet these requirements? (Select all that apply.)

Accepted Answer

Cloud Discovery. Cloud Discovery (A) is correct because it analyzes traffic logs from your network to identify all cloud apps in use, providing visibility into sanctioned and unsanctioned apps. Conditional Access App Control (C) is correct because it enforces real-time access controls via a reverse proxy, allowing you to block unsanctioned apps as users attempt to access them.

Answer

App Connectors

Answer

API connectors

Question 9

A company wants to require approval for any activation of the Global Administrator role in Privileged Identity Management (PIM). The approvers are predefined as members of a security group named 'GA-Approvers'. Activations must require a business justification and expire after 4 hours. Which PIM configuration should the administrator modify to meet these requirements?

Accepted Answer

Edit the role settings of the Global Administrator role in PIM.. Option A is correct because the requirement to require approval, enforce a business justification, and set a 4-hour expiration for Global Administrator activations is configured in the role settings of the Global Administrator role within Privileged Identity Management (PIM). These settings control activation parameters such as approval requirements, justification, and maximum activation duration, which directly map to the stated needs.

Answer

Create an access review for the Global Administrator role.

Answer

Configure Azure AD Identity Protection to require MFA for Global Administrator.

Answer

Assign the Global Administrator role directly to the users temporarily.

Question 10

An organization has multiple Microsoft Entra ID tenants and wants to allow partner users to access internal applications using their own corporate credentials. Which feature should be used to enable this?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is the correct feature because it allows partner users to access internal applications using their own corporate credentials (their home tenant identity) without requiring any external accounts or local user management. B2B collaboration uses cross-tenant trust relationships, enabling seamless single sign-on (SSO) via SAML/WS-Fed or OIDC protocols, which aligns with the requirement to use existing partner credentials.

Answer

Microsoft Entra B2C

Answer

Azure AD Connect

Answer

Tenant-to-tenant migration

Question 11

An organization with Microsoft Entra ID P2 licenses needs to enforce that all users accessing the Azure portal must use FIDO2 security keys for multi-factor authentication. Which configuration should be implemented?

Accepted Answer

Configure an authentication strength policy that requires FIDO2 and assign it to a Conditional Access policy. Option C is correct because in Microsoft Entra ID, authentication strengths allow you to define a specific set of authentication methods (e.g., FIDO2 security keys) and then assign that strength to a Conditional Access policy. This ensures that only FIDO2 security keys are accepted for MFA when accessing the Azure portal, meeting the requirement precisely.

Answer

Create a Conditional Access policy that requires MFA and select FIDO2 as the authentication strength in the grant controls

Answer

Create a Conditional Access policy that requires MFA and set the grant control to require a specific device platform

Answer

Configure an authentication methods policy that allows only FIDO2 security keys

Question 12

A security administrator needs to block outbound network connections from a compromised Windows device to command-and-control servers. The solution must work at the network layer and be centrally managed via Microsoft 365 Defender. Which feature should the administrator enable?

Accepted Answer

Network Protection. Network Protection in Microsoft Defender for Endpoint blocks outbound connections to command-and-control (C2) servers at the network layer by inspecting traffic using the Windows Filtering Platform (WFP). It is centrally managed via Microsoft 365 Defender policies and does not require per-device firewall rule configuration, making it the correct choice for this scenario.

Answer

Attack Surface Reduction rules

Answer

Session control in Defender for Cloud Apps

Answer

Windows Firewall with Advanced Security

Question 13

A company uses Microsoft Entra ID P2 licenses and wants to implement just-in-time (JIT) privileged access for administrators. Security requirements state that Global Administrator role members must request approval and provide a business justification before their role activation expires after 4 hours. Which Microsoft Entra feature should be configured?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access, requiring approval and a business justification for role activation, with configurable maximum activation durations (e.g., 4 hours). This directly meets the security requirement for Global Administrator role members to request approval and provide justification before activation expires after 4 hours.

Answer

Conditional Access

Answer

Identity Protection

Answer

Self-Service Password Reset (SSPR)

Question 14

A user with an E5 license is unable to use Azure Information Protection (AIP). The admin confirms the license is assigned. What is the most likely cause?

Accepted Answer

AIP service plan is disabled in the license. Even with an E5 license assigned, the Azure Information Protection (AIP) service plan must be explicitly enabled for the user. By default, some service plans within an E5 license may be disabled, and the AIP service plan (commonly labeled as 'Azure Information Protection' or 'Information Protection for Office 365') must be toggled on in the user's license settings in the Microsoft 365 admin center. Without this, the user cannot activate AIP features regardless of license assignment.

Answer

AIP requires an additional subscription

Answer

AIP client is not installed

Answer

User account is blocked

Question 15

An organization needs to restrict access to Microsoft 365 admin center to only specific users. Which approach should be used?

Accepted Answer

Create a Conditional Access policy targeting the Microsoft Admin Portals cloud app. Option B is correct because a Conditional Access policy targeting the 'Microsoft Admin Portals' cloud app allows granular control over which users can access the Microsoft 365 admin center. This policy can enforce conditions such as user/group membership, device compliance, or location to restrict access, ensuring only specific authorized users can reach the admin portals.

Answer

Enable MFA for all admins

Answer

Assign Global Admin role only to required users

Answer

Use Privileged Identity Management

Question 16

Which THREE steps are required to enable group-based licensing?

Accepted Answer

Add members to the group. Option B is correct because group-based licensing in Azure AD requires that you add members to the security group that will have the license assigned. Without members, the license assignment has no effect, as the license is applied to all users in the group. This step ensures that the intended users receive the license automatically based on group membership.

Answer

Configure Azure AD Connect

Answer

Ensure group is mail-enabled

Question 17

You are a Microsoft 365 administrator for a medium-sized company with 500 users. The company uses Microsoft 365 E3 licenses. Recently, the company acquired a small subsidiary with 50 users who already have their own Microsoft 365 tenant with E3 licenses. You need to migrate the subsidiary's users to the main tenant while minimizing downtime and ensuring that users retain their existing email and OneDrive data. You plan to use cross-tenant migration. However, after setting up the migration, you notice that the subsidiary's users cannot access the main tenant's SharePoint Online sites. They receive an access denied error. You verify that the users have been added to the main tenant's Azure AD and are assigned licenses. What should you do to resolve the issue?

Accepted Answer

Configure cross-tenant access settings in Azure AD to allow the subsidiary's tenant to access the main tenant's resources.. Option D is correct because cross-tenant migration in Microsoft 365 requires explicit cross-tenant access settings in Azure AD to allow users from the subsidiary's tenant to access resources in the main tenant, such as SharePoint Online. Without configuring these settings, the subsidiary's users will receive access denied errors even after being added to the main tenant's Azure AD and assigned licenses, as SharePoint enforces tenant-level access policies.

Answer

Re-run the cross-tenant migration and select the option to convert users to mail-in-contact.

Answer

In the SharePoint admin center, add the subsidiary's domain as an allowed domain for sharing.

Answer

Assign the users a new license from the main tenant's subscription.

Question 18

You are troubleshooting a user who reports that they cannot access Microsoft Teams. The user has an E3 license assigned, but Teams is grayed out in the app launcher. You verify that the user is assigned the correct license and that the service plan for Teams is enabled. What is the most likely cause?

Accepted Answer

The user has been blocked from signing in to Microsoft Teams in the Microsoft 365 admin center.. Option A is correct because even if the license and service plan are enabled, the user might be blocked from the service via the admin center's user settings. Option B is wrong because the license is assigned. Option C is wrong because the service plan is enabled. Option D is wrong because the issue is specific to Teams, not all services.

Answer

The user does not have a valid email address.

Answer

The Teams service plan is disabled in the license.

Answer

The user's license has expired.

Question 19

A company has 500 users across Sales, Marketing, and IT departments. User objects are synced from on-premises Active Directory to Microsoft Entra ID using Azure AD Connect. Each department requires different Microsoft 365 license plans (e.g., Sales needs E3, Marketing needs Business Premium, IT needs E5). The administrator wants to automatically assign the appropriate license based on the department attribute without manual intervention. Which approach should the administrator use?

Accepted Answer

Configure group-based licensing using Microsoft Entra dynamic groups with rules based on the department attribute.. Option B is correct because Microsoft Entra ID supports group-based licensing, which allows automatic license assignment to users based on their membership in dynamic groups. By creating dynamic groups with rules that filter on the department attribute (e.g., 'user.department -eq "Sales"'), the administrator can assign the appropriate license plan (E3, Business Premium, E5) to each group, and licenses are automatically applied or removed as users are added or removed from the group, without any manual or scripted intervention.

Answer

Create a script that runs daily to sync department values and assign licenses using PowerShell.

Answer

Use Azure AD Connect to filter objects and assign licenses during sync.

Answer

Manually assign licenses to each user in the Microsoft 365 admin center.

Question 20

A company uses Microsoft Entra ID with conditional access policies. They need to ensure that all external users who are invited via B2B collaboration must perform multi-factor authentication (MFA) when accessing the corporate SharePoint Online site. Which two configurations are required? (Choose two.)

Accepted Answer

Create a conditional access policy targeting all guest users, requiring MFA, and scope to SharePoint Online.. Option A is correct because a conditional access policy in Microsoft Entra ID can be configured to target 'Guest or external users' (the 'All guest users' scope) and require multi-factor authentication (MFA) when accessing SharePoint Online. This directly enforces MFA for B2B collaboration users accessing the corporate SharePoint site, as the policy is evaluated at the resource tenant (the tenant hosting SharePoint).

Answer

Configure the SharePoint Online external sharing settings to require MFA for guest users.

Answer

Set the guest user access level in the SharePoint admin center to require MFA.