MS-102 Hard Questions — 25 Difficult Questions

Question 1

Your company uses Microsoft Entra ID and has a hybrid identity with PHS. You need to ensure that when an on-premises user account is disabled, the corresponding cloud user is also blocked from signing in within 5 minutes. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy Azure AD Connect cloud sync. Microsoft Entra Connect cloud sync can be configured to synchronize the on-premises Active Directory 'userAccountControl' attribute, which includes the 'ACCOUNTDISABLE' flag. When an on-premises user account is disabled, this flag changes, and cloud sync can trigger a block on the corresponding cloud user's sign-in within a few minutes (typically under 5 minutes) due to its near-real-time sync cycle. This meets the requirement without relying on the slower default sync interval of Microsoft Entra Connect.

Answer

Enable password writeback

Answer

Configure Azure AD Connect to sync the 'userAccountControl' attribute

Answer

Configure Microsoft Entra Connect Sync to use filtered synchronization

Question 2

Your company recently acquired a subsidiary that uses a different Microsoft 365 tenant. You are tasked with merging the two tenants into one. The subsidiary has 1,500 users with unique email domains. You need to migrate all users, mailboxes, and SharePoint data while minimizing downtime and preserving data integrity. You have access to both tenants as global admin. What should you do first?

Accepted Answer

Use a third-party migration tool such as BitTitan MigrationWiz to perform the migration. Microsoft does not provide a native tool for merging two tenants; third-party tools like BitTitan MigrationWiz are designed specifically for cross-tenant migrations, supporting mailbox, SharePoint, and user data migration with minimal downtime and data integrity. These tools handle directory synchronization, mailbox rehydration, and SharePoint content mapping, which are critical for a 1,500-user migration with unique domains.

Answer

Add the subsidiary's domain to the primary tenant, then delete the subsidiary tenant and recreate users

Answer

Use the Microsoft 365 Merger Center in the admin portal

Answer

Use Microsoft's native tenant-to-tenant migration by moving mailboxes via PowerShell and exporting SharePoint content

Question 3

A security analyst wants to create a custom detection rule in Microsoft Defender XDR that triggers when a user receives a phishing email and later clicks a link to a known malicious domain from their device. The rule will use advanced hunting queries. Which two tables should be joined to detect the click event from the device?

Accepted Answer

EmailUrlInfo and DeviceNetworkEvents. Detecting a user clicking a link to a known malicious domain from their device requires joining the email URL information (EmailUrlInfo) with the device-level network event (DeviceNetworkEvents). EmailUrlInfo contains the URLs from emails, and DeviceNetworkEvents records outbound network connections from devices, including the destination domain. Joining these tables on the URL or domain allows you to correlate the email link with the subsequent device click event. Option B (EmailEvents and DeviceNetworkEvents) is incorrect because EmailEvents does not provide the specific URL clicked; it only gives email-level metadata. The URL must come from EmailUrlInfo.

Answer

EmailEvents and EmailUrlInfo

Answer

EmailEvents and DeviceNetworkEvents

Answer

EmailAttachmentInfo and DeviceProcessEvents

Question 4

You are the Microsoft 365 administrator for a large enterprise with 50,000 users. The company is deploying Microsoft 365 Copilot for all users. You need to ensure that the data used by Copilot is protected and that Copilot does not inadvertently expose sensitive information. The company has strict data residency requirements: all data must remain within the European Union (EU). You have already configured data boundaries in Microsoft 365 to keep data in the EU. However, you are concerned about Copilot's AI model training. You need to implement additional controls. The company uses Microsoft Purview Information Protection with sensitivity labels. You have created a sensitivity label "Highly Confidential" that applies encryption and a "Confidential" label that applies visual markings. You also have a DLP policy that prevents sharing of "Highly Confidential" data externally. You need to ensure that when a user uses Copilot with a document labeled "Highly Confidential", the Copilot response does not include any of the sensitive content from that document. What should you do?

Accepted Answer

Ensure that the Highly Confidential sensitivity label includes encryption when applied.. The 'Highly Confidential' sensitivity label already applies encryption, which prevents Microsoft 365 Copilot from accessing the document's content. Copilot cannot process or include encrypted content in its responses, as encryption blocks the AI model from reading the underlying data. This ensures that sensitive information from encrypted documents is not inadvertently exposed in Copilot outputs.

Answer

Exclude users who handle Highly Confidential data from Copilot licensing.

Answer

Create a DLP policy that blocks Copilot from accessing documents labeled Highly Confidential.

Answer

Configure Microsoft 365 data boundaries to restrict Copilot data processing to the EU.

Question 5

You are the Microsoft 365 administrator for a company with a hybrid identity configuration using Azure AD Connect. The company has a custom domain 'contoso.com' federated with Active Directory Federation Services (ADFS). All users are synced from on-premises Active Directory. The security team wants to implement Microsoft Entra ID Protection to detect risky sign-ins. However, they are concerned that federated authentication bypasses some risk detection capabilities. You need to ensure that Microsoft Entra ID Protection can evaluate risk for all sign-ins, including federated ones. What should you do?

Accepted Answer

Switch from federated authentication to Pass-through Authentication (PTA) or Password Hash Sync (PHS).. Microsoft Entra ID Protection relies on signals such as IP addresses, device information, and sign-in patterns to calculate risk. In a federated setup with ADFS, the authentication happens on-premises, and Microsoft Entra ID only receives a token—not the raw sign-in details needed for real-time risk evaluation. Switching to Pass-through Authentication (PTA) or Password Hash Sync (PHS) ensures that the authentication process flows through Microsoft Entra ID directly, allowing Entra ID Protection to capture and analyze all sign-in events, including those from federated users.

Answer

Configure the federated trust in Microsoft Entra ID to use the new claims.

Answer

Configure ADFS to send the ipaddr and xms_ep claims to Azure AD.

Answer

Enable Azure AD Application Proxy to publish ADFS internally.

Question 6

Your organization uses Microsoft Entra ID P2 and Microsoft Defender for Cloud Apps. You need to protect a custom SaaS application that uses SAML-based SSO. The application does not support Conditional Access. You want to enforce session controls such as blocking downloads of sensitive files. What should you implement?

Accepted Answer

Deploy Microsoft Defender for Cloud Apps Conditional Access App Control and route the application through Defender for Cloud Apps.. Microsoft Defender for Cloud Apps Conditional Access App Control acts as a reverse proxy that can enforce session policies—such as blocking downloads of sensitive files—on any SAML-based SaaS application, even if the application itself does not support Conditional Access. By routing the application's traffic through Defender for Cloud Apps, you can apply granular session controls at the proxy layer without modifying the application.

Answer

Implement a reverse proxy from a third-party vendor.

Answer

Create a custom application registration and set app roles.

Answer

Configure the application to use Microsoft Entra ID as the identity provider and enable Conditional Access policies.

Question 7

Refer to the exhibit. You are reviewing the service principal for Microsoft Graph in your tenant. The passwordCredentials array is empty. What does this indicate?

Accepted Answer

No client secret is configured for the service principal.. The passwordCredentials array being empty indicates that no client secret (password) has been configured for the service principal. Client secrets are one method of authentication for service principals, and their absence means that this particular authentication method is not set up. This does not imply the service principal is disabled or that other authentication methods like certificates or federated credentials are in use.

Answer

The service principal is using federated credentials.

Answer

The service principal uses certificate-based authentication.

Answer

The Microsoft Graph application is disabled.

Question 8

Your Microsoft 365 tenant has 50,000 users. You are planning to migrate mailboxes from on-premises Exchange Server 2019 to Exchange Online using a full hybrid configuration. During the migration, you must ensure that free/busy information is synchronized between on-premises and Exchange Online. Which component is required for free/busy synchronization in a hybrid deployment?

Accepted Answer

Exchange Hybrid Server (or Hybrid Agent). In a full hybrid configuration, free/busy synchronization between on-premises Exchange and Exchange Online is handled by the Exchange Hybrid Server (or the newer Hybrid Agent). This component acts as a bridge, using the Exchange Web Services (EWS) and Autodiscover service to securely relay free/busy data between the two organizations. Without it, the Availability service cannot query the remote forest for calendar information.

Answer

Azure AD Connect

Answer

Exchange Online connector (Outbound to on-premises)

Answer

Hybrid Configuration Wizard

Question 9

Your organization uses Microsoft Defender for Office 365 and Microsoft Defender for Endpoint. A user receives an email with a link that leads to a malicious website. The user clicks the link, but the browser is protected by Microsoft Defender SmartScreen. However, the user is still able to download a file from the site. What should you configure to prevent this?

Accepted Answer

Enable Safe Links in Microsoft Defender for Office 365.. Safe Links in Microsoft Defender for Office 365 protects users by scanning URLs in emails and blocking malicious links at the time of click, preventing access to malicious websites. Option A is incorrect because Attack Surface Reduction rules are designed to block specific behaviors and processes, not web downloads from a browser after clicking a link. Option B is incorrect because network protection in Microsoft Defender for Endpoint blocks connections to malicious IPs or domains at the network level, but if the website is considered safe, network protection may not block the download. Option C is incorrect because Safe Attachments is designed to scan email attachments, not URLs or links. Option D is incorrect because Anti-Phishing policies primarily protect against impersonation and phishing attempts, not direct downloads from a website.

Answer

Enable Attack Surface Reduction rules.

Answer

Enable network protection in Microsoft Defender for Endpoint.

Answer

Enable Safe Attachments in Microsoft Defender for Office 365.

Answer

Configure an Anti-Phishing policy.

Question 10

Your company uses Microsoft Entra ID and has a hybrid identity with PHS. You need to ensure that when an on-premises user account is disabled, the corresponding cloud user is also blocked from signing in within 5 minutes. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Microsoft Entra ID Protection reports to confirm the user as safe. When a user claims a blocked sign-in was legitimate, the proper action is to confirm the user as safe in the Microsoft Entra ID Protection reports. This action updates the risk state to 'confirmed safe', which resets the user's risk level and allows future sign-ins without lowering security. It also provides feedback to the risk detection algorithm to improve accuracy.

Answer

Create a conditional access policy to bypass MFA for this user

Answer

Suppress the alert in Microsoft Defender XDR

Answer

Dismiss the risk in the Risky users report

Question 11

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that detects when a user signs in from an unknown IP address and then downloads a large number of files. Which THREE components should you configure?

Accepted Answer

Scope (users and groups). The policy must be scoped to specific users or groups to ensure that the anomaly detection rule (unknown IP followed by mass download) applies only to the intended set of accounts. Without scoping, the policy would evaluate all users, which may generate excessive noise or miss targeted monitoring. In Microsoft Defender for Cloud Apps, the Scope (users and groups) setting is a required component when creating an anomaly detection policy to define which identities are monitored.

Answer

IP address range category

Answer

Session policy

Question 12

You are a security administrator for a company that uses Microsoft Defender XDR. You need to integrate Microsoft Defender XDR with Microsoft Sentinel to create a unified incident view. You want to ensure that incidents from Defender XDR are automatically created in Sentinel. What should you do?

Accepted Answer

Enable the Microsoft Defender XDR connector in Microsoft Sentinel and turn on incident creation. Enabling the Microsoft Defender XDR connector in Microsoft Sentinel and turning on incident creation is the correct method to ensure incidents from Defender XDR are automatically created in Sentinel. This provides a unified incident view and enables Sentinel's SOAR capabilities on Defender XDR incidents.

Answer

In Microsoft Defender XDR settings, enable the Microsoft Sentinel integration and select the Sentinel workspace

Answer

Configure a custom detection rule in Defender XDR that calls the Microsoft Sentinel API

Answer

Install the Microsoft Sentinel solution for Microsoft Defender XDR from the Content Hub

Question 13

Refer to the exhibit. You are configuring an auto-labeling policy in Microsoft Purview. The policy is set to apply the 'Confidential' label to documents that contain a specific sensitive info type. However, when a document is auto-labeled, users report that the footer and header are not applied. The label 'Confidential' itself does not have marking configurations. What is the most likely reason?

Accepted Answer

The marking defaults are defined in the policy but the label does not have markings configured.. The label 'Confidential' does not have any marking configurations (footer/header), so even though the auto-labeling policy applies the label, the markings are not applied. Option A is incorrect because the label being published to users is irrelevant for auto-labeling. Option B is incorrect because the Microsoft 365 Apps client setting affects client-side labeling, not server-side auto-labeling. Option D is incorrect because policy settings do not override label settings; the policy simply applies the label, and if the label lacks markings, no markings are added.

Answer

The label is not published to users.

Answer

The Microsoft 365 Apps client is not configured to apply markings.

Answer

The policy settings override the label settings, causing markings to be ignored.

Question 14

Which THREE are features of Microsoft Entra ID Governance? (Choose three.)

Accepted Answer

Entitlement management. Entitlement management is a core feature of Microsoft Entra ID Governance that enables organizations to manage the lifecycle of access for internal and external users through access packages, catalogs, and policies. It automates access requests, approvals, and assignments, ensuring users have the right access to resources like groups, apps, and SharePoint sites.

Answer

Password protection

Answer

Conditional access policies

Question 15

Which THREE conditions can be used in a dynamic group rule for a device?

Accepted Answer

deviceModel. `deviceModel` is a valid attribute that can be used in a dynamic group rule for devices in Microsoft Entra ID (formerly Azure AD). Dynamic group rules for devices support attributes such as `deviceModel`, `deviceCategory`, and `deviceOSVersion` to automatically include or exclude devices based on their hardware or software characteristics.

Answer

lastLogonTimestamp

Answer

passwordLastSet

Question 16

A security analyst needs to create a custom detection rule in Microsoft 365 Defender that triggers when a suspicious PowerShell process (e.g., using -EncodedCommand) is detected on a device, and within 5 minutes, an outbound network connection to a known malicious IP address occurs. Which two advanced hunting tables must be joined?

Accepted Answer

DeviceProcessEvents and DeviceNetworkEvents. The custom detection rule requires correlating a suspicious PowerShell process event with a subsequent outbound network connection to a malicious IP within a 5-minute window. DeviceProcessEvents contains process creation data (e.g., command line, process name) for detecting encoded PowerShell commands, while DeviceNetworkEvents logs network connections (destination IP, port, protocol). Joining these two tables on DeviceId and a time range allows the rule to identify the sequence of a process event followed by a network event from the same device.

Answer

DeviceEvents and DeviceFileCertificateInfo

Answer

IdentityLogonEvents and CloudAppEvents

Answer

EmailEvents and EmailAttachmentInfo

Question 17

A compliance officer needs to automatically identify and label content that is conceptually similar to existing sensitive documents, such as internal strategy memos or proprietary technical specifications, without relying on explicit keywords or recognized sensitive information types. Which Microsoft Purview solution should the officer use to achieve this?

Accepted Answer

trainable classifier. A trainable classifier uses machine learning to identify content based on patterns and context learned from sample documents, making it ideal for recognizing conceptually similar content without relying on explicit keywords or predefined sensitive information types. This allows the compliance officer to automatically label internal strategy memos or proprietary technical specifications that share conceptual similarity with existing sensitive documents.

Answer

sensitive information type

Answer

An auto-labeling policy with a retention label

Answer

Data Loss Prevention (DLP) policy that blocks sharing

Question 18

A compliance officer needs to ensure that all emails containing payment card information (PCI) are automatically encrypted when sent to external recipients. The encryption should occur without user intervention. Which two features should be configured together? (Choose two.)

Accepted Answer

Data Loss Prevention (DLP) policy with encryption action. A compliance officer should configure a sensitivity label with encryption (option B) that defines the encryption settings, and a DLP policy (option A) that detects PCI data and automatically applies that sensitivity label. In the DLP policy, the action is to apply the sensitivity label, not a direct encryption action. The DLP rule uses built-in sensitive information types (e.g., Credit Card Number) to trigger the label application. The label then encrypts the message, satisfying the requirement without user intervention.

Answer

Microsoft Purview Message Encryption

Answer

Transport rule with encryption

Question 19

An organization has multiple Microsoft Entra ID tenants and wants to allow partner users to access internal applications using their own corporate credentials. Which feature should be used to enable this?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is the correct feature because it allows partner users to access internal applications using their own corporate credentials (their home tenant identity) without requiring any external accounts or local user management. B2B collaboration uses cross-tenant trust relationships, enabling seamless single sign-on (SSO) via SAML/WS-Fed or OIDC protocols, which aligns with the requirement to use existing partner credentials.

Answer

Microsoft Entra B2C

Answer

Azure AD Connect

Answer

Tenant-to-tenant migration

Question 20

A company uses Microsoft Entra ID P2 licenses and wants to implement just-in-time (JIT) privileged access for administrators. Security requirements state that Global Administrator role members must request approval and provide a business justification before their role activation expires after 4 hours. Which Microsoft Entra feature should be configured?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access, requiring approval and a business justification for role activation, with configurable maximum activation durations (e.g., 4 hours). This directly meets the security requirement for Global Administrator role members to request approval and provide justification before activation expires after 4 hours.

Answer

Conditional Access

Answer

Identity Protection

Answer

Self-Service Password Reset (SSPR)