MS-102 Implement and manage identity and access in Microsoft Entra ID Practice Test 2 — 15 Questions

Question 1

A company uses Microsoft Entra ID P2 licenses. They want to ensure that all users are forced to use MFA when accessing a SaaS application from non-corporate networks. Corporate networks are identified by a set of IP ranges. Service accounts must be excluded from this requirement. Which policy should be created?

Accepted Answer

Conditional Access policy with grant controls for MFA, targeting all users, with location condition to exclude trusted IPs, and exclude service accounts. A Conditional Access policy is the correct approach because it allows granular control over MFA enforcement based on network location and user exclusions. By targeting all users, excluding trusted IPs (corporate networks) via the location condition, and explicitly excluding service accounts, the policy ensures MFA is required only for non-corporate network access while bypassing service accounts. This aligns with the requirement to use Microsoft Entra ID P2 licenses, which include Conditional Access capabilities.

Answer

An Identity Protection user risk policy requiring MFA for medium and above risk users

Answer

An Identity Protection sign-in risk policy requiring MFA for medium and above risk sign-ins

Answer

Per-user MFA settings enabled for all users with trusted IPs configured in MFA service settings

Question 2

A company uses Microsoft Entra ID with Pass-through Authentication. The security team wants to block all sign-ins from countries that are not approved (e.g., high-risk regions). Which feature should they use?

Accepted Answer

Conditional Access policy with country location condition. Conditional Access policies in Microsoft Entra ID can include a location condition that uses IP addresses to determine the country of origin. By configuring a policy to block access from specific countries (e.g., high-risk regions), the security team can enforce this requirement. This is the correct feature because it directly evaluates the geographic location of the sign-in request and applies an access control (block) accordingly.

Answer

Identity Protection sign-in risk policy

Answer

Identity Protection user risk policy

Answer

Named locations with blocked countries

Question 3

A company has a hybrid identity with password hash synchronization. They want to ensure that any user whose account is disabled in on-premises Active Directory is automatically prevented from signing in to Microsoft 365. How can this be achieved?

Accepted Answer

Ensure Microsoft Entra Connect is configured to synchronize the disabled status; this happens automatically.. Option A is correct because Microsoft Entra Connect (formerly Azure AD Connect) by default synchronizes the `userAccountControl` attribute from on-premises Active Directory, which includes the disabled status (bit 2, ACCOUNTDISABLE). When an on-premises user account is disabled, the corresponding `accountEnabled` attribute in Microsoft Entra ID is set to `false`, preventing sign-in to Microsoft 365 without additional configuration.

Answer

Create a dynamic group based on accountEnabled attribute and apply a Conditional Access policy to block access.

Answer

Run a PowerShell script daily to disable matching accounts in Microsoft Entra ID.

Answer

Enable cloud HR provisioning.

Question 4

An organization uses Microsoft Entra ID P2 licenses. They need to require multi-factor authentication (MFA) for all users accessing a critical financial application, but they must exclude a set of service accounts that are members of the 'Service Accounts' group. Which policy should they create?

Accepted Answer

Conditional Access policy with a grant block requiring MFA and an exclude assignment for the 'Service Accounts' group.. Option A is correct because a Conditional Access policy allows you to grant access only when MFA is completed, and you can exclude specific groups like 'Service Accounts' from the policy. This ensures all users except the excluded service accounts are prompted for MFA when accessing the critical financial application. The grant block requiring MFA is the appropriate control for this scenario.

Answer

An Identity Protection user risk policy configured to require MFA for high-risk users.

Answer

Per-user MFA enforced on all users, then disabled for the service accounts individually.

Answer

Conditional Access sign-in risk policy requiring MFA for risky sign-ins.

Question 5

A company uses Password Hash Synchronization (PHS) to synchronize identities to Microsoft Entra ID. They want to enable users to access Microsoft 365 applications from their domain-joined work devices without being prompted to re-enter their credentials. Which feature should they enable in addition to PHS?

Accepted Answer

Seamless Single Sign-On. Seamless Single Sign-On (SSO) is the correct feature to enable alongside Password Hash Synchronization (PHS) because it allows users on domain-joined devices to automatically authenticate to Microsoft 365 applications without being prompted for credentials. It works by integrating with Kerberos authentication, using a computer account in the on-premises Active Directory to issue a Kerberos ticket that Microsoft Entra ID can validate, eliminating the need for re-authentication.

Answer

Pass-through Authentication

Answer

Azure AD Connect Health

Answer

Conditional Access

Question 6

A company uses Microsoft Entra ID P2 licenses. A security administrator needs to grant a user temporary elevation to the Global Administrator role for a specific task. The elevation should require approval from a designated group and be time-limited. Which Microsoft Entra feature should be configured?

Accepted Answer

Privileged Identity Management. Privileged Identity Management (PIM) in Microsoft Entra ID P2 provides just-in-time (JIT) privileged access with time-bound activation, approval workflows, and audit logging. This directly meets the requirement for temporary elevation to Global Administrator with approval from a designated group and a time limit.

Answer

Conditional Access

Answer

Identity Protection

Answer

Access Reviews

Question 7

A company (Contoso) frequently collaborates with a partner company (Fabrikam) via B2B collaboration. Contoso wants to require Fabrikam's guest users to perform MFA using Contoso's MFA policies, ignoring any MFA claims from the Fabrikam home tenant. However, Fabrikam's users already have MFA enabled in their home tenant. What should Contoso configure in their cross-tenant access settings?

Accepted Answer

Disable trust for MFA from the external tenant in the cross-tenant access settings. Option D is correct because Contoso wants to ignore MFA claims from Fabrikam's home tenant and enforce its own MFA policies on Fabrikam's guest users. In cross-tenant access settings, disabling trust for MFA from the external tenant ensures that Contoso does not honor any MFA claims issued by Fabrikam, thereby requiring Fabrikam's users to perform MFA again according to Contoso's conditional access policies.

Answer

Set the inbound trust settings to accept MFA claims from Fabrikam

Answer

Set the inbound trust settings to accept compliant device claims

Answer

Set the inbound trust settings to block MFA and require Contoso's MFA

Question 8

A company wants to reduce help desk calls by allowing users to reset their own passwords securely. Users should be able to reset their passwords using a mobile phone number or email as verification. Which Microsoft Entra ID feature should be enabled?

Accepted Answer

Self-Service Password Reset (SSPR). Self-Service Password Reset (SSPR) is the Microsoft Entra ID feature specifically designed to allow users to reset their own passwords without help desk intervention. It supports verification methods such as mobile phone number (via SMS or phone call) and email, meeting the company's requirement for secure, user-driven password resets.

Answer

Conditional Access

Answer

Password Protection

Answer

Identity Protection

Question 9

A company uses Microsoft Entra ID P2 licenses. They want to create a Conditional Access policy that requires MFA for all users, but the policy should only be enforced when the sign-in risk is medium or higher. Additionally, they need to exclude a group named 'Emergency Access' from this policy. Which configuration is correct?

Accepted Answer

Assign policy to 'All users', exclude 'Emergency Access' group, set 'Sign-in risk' condition to 'High and Medium'. Option A is correct because it assigns the Conditional Access policy to 'All users' (ensuring universal coverage), excludes the 'Emergency Access' group (to prevent lockout of break-glass accounts), and sets the 'Sign-in risk' condition to 'High and Medium' — which matches the requirement to enforce MFA only when sign-in risk is medium or higher. Sign-in risk is the correct condition for real-time risk during authentication, while user risk tracks historical compromise likelihood.

Answer

Assign policy to 'All users', exclude 'Emergency Access' group, set 'User risk' condition to 'High and Medium'

Answer

Assign policy to 'Emergency Access' group, set 'Device state' condition to 'All device states'

Answer

Assign policy to 'All users', exclude 'Emergency Access' group, set 'Locations' condition to 'All trusted locations'

Question 10

A company wants to allow users to reset their own forgotten passwords using a mobile app notification as the verification method. Which Microsoft Entra feature should be enabled and configured?

Accepted Answer

Self-service password reset. Self-service password reset (SSPR) is the Microsoft Entra feature that allows users to reset their own forgotten passwords. To use a mobile app notification as the verification method, the administrator must enable SSPR and configure the 'Mobile app notification' authentication method under the 'Authentication methods' policy. This satisfies the requirement for a password reset triggered by a mobile app notification.

Answer

Azure AD Password Protection

Answer

Privileged Identity Management

Answer

Identity Protection

Question 11

A company uses Microsoft Entra ID P2 licenses. They want to block all authentication attempts from an internal app that uses legacy authentication protocols (POP3, IMAP, SMTP) because these protocols cannot enforce multi-factor authentication. Which Conditional Access policy setting should be used?

Accepted Answer

Block access for apps using legacy authentication. Option B is correct because the scenario explicitly requires blocking authentication attempts from an internal app using legacy protocols (POP3, IMAP, SMTP) that cannot enforce multi-factor authentication. The 'Block access for apps using legacy authentication' Conditional Access setting targets client apps that use legacy authentication protocols, effectively preventing any authentication from those apps regardless of user or device compliance.

Answer

Grant access requiring multi-factor authentication

Answer

Require compliant device

Answer

Require approved client app

Question 12

A company uses Microsoft Entra ID P1 licenses. They want to enforce multi-factor authentication (MFA) for all users accessing a critical cloud application. However, they have a group of service accounts that cannot perform MFA and must be excluded. What is the recommended approach?

Accepted Answer

Create a Conditional Access policy that targets the application, requires MFA, and excludes the service account group. Conditional Access policies allow granular control by targeting specific cloud applications and requiring MFA, while excluding groups like service accounts that cannot perform MFA. This approach is the recommended method because it avoids the limitations of per-user MFA (which is deprecated) and Security Defaults (which cannot exclude specific accounts).

Answer

Enable per-user MFA for all users, then disable it for each service account

Answer

Enable Security Defaults

Answer

Use Identity Protection risk policies

Question 13

A company uses Microsoft Entra ID P2 licenses and wants to block all authentication attempts from an internal legacy application that uses POP3 and SMTP protocols. The application cannot be updated and must be blocked from accessing Exchange Online. Which Conditional Access policy setting should the administrator configure?

Accepted Answer

Under 'Conditions' > 'Client apps', configure to block 'Exchange ActiveSync clients and other clients'. Option B is correct because the legacy application uses POP3 and SMTP, which are non-modern authentication protocols. In Conditional Access, the 'Client apps' condition includes a setting to block 'Exchange ActiveSync clients and other clients', which specifically targets legacy authentication protocols like POP3, SMTP, and IMAP. This allows the administrator to block all authentication attempts from such clients without affecting modern authentication flows.

Answer

Under 'Grant', select 'Block access'

Answer

Under 'Conditions' > 'Device platforms', select 'Android' and 'iOS' and block them

Answer

Under 'Conditions' > 'Locations', select 'All trusted locations' and block

Question 14

Contoso frequently collaborates with a partner company (Fabrikam) via B2B collaboration. Contoso uses Microsoft Entra ID P2 licenses and wants to require Fabrikam's guest users to authenticate using Contoso's MFA policies, ignoring any MFA claims from the Fabrikam home tenant. Fabrikam already has MFA enabled for its users. What configuration should Contoso make in their cross-tenant access settings?

Accepted Answer

Configure inbound trust settings to uncheck 'Trust multi-factor authentication from Microsoft Entra tenants' for Fabrikam. Option B is correct because Contoso wants to ignore MFA claims from Fabrikam's home tenant and enforce its own MFA policies on Fabrikam guest users. In cross-tenant access settings, the 'Trust multi-factor authentication from Microsoft Entra tenants' checkbox controls whether inbound MFA claims from the external tenant are accepted. By unchecking this for Fabrikam, Contoso ensures that Fabrikam's MFA claims are ignored, and Contoso's Conditional Access policies (including MFA requirements) apply to those guest users.

Answer

Configure outbound access settings to require MFA for Fabrikam users

Answer

Create a Conditional Access policy targeting all guest users from Fabrikam that requires MFA

Answer

Configure B2B direct connect for Fabrikam and require MFA

Question 15

A company uses Microsoft Entra ID P2 licenses. They want to require multi-factor authentication (MFA) for all users when accessing the Azure Management portal, but only from devices that are not marked as compliant. Additionally, a group named 'BreakGlass' must be excluded from this requirement. Which Conditional Access policy configuration should be applied?

Accepted Answer

Assign to 'All users', condition: 'Device state (preview) is not compliant', grant: 'Require MFA', exclude: 'BreakGlass group'. Option A is correct because it directly maps the requirement: assign the policy to 'All users', use the 'Device state (preview) is not compliant' condition to target only non-compliant devices, grant 'Require MFA' for the Azure Management portal (selected via the 'Cloud apps' condition), and exclude the 'BreakGlass' group. This ensures MFA is enforced only when accessing the Azure Management portal from non-compliant devices, while break-glass accounts are exempt.

Answer

Assign to 'All users', condition: 'Sign-in risk is medium or higher', grant: 'Require MFA', exclude: 'BreakGlass group'

Answer

Assign to 'All users', condition: 'Client apps: Browser and Mobile apps', grant: 'Block access', exclude: 'BreakGlass group'

Answer

Assign to 'All users', condition: 'Device platform: Android, iOS, Windows, macOS', grant: 'Require MFA', exclude: 'BreakGlass group'