MS-102 Implement and manage identity and access in Microsoft Entra ID Practice Test 3 — 15 Questions

Question 1

A company uses Microsoft Entra ID P1 licenses. They want to allow access to a sensitive cloud application only from the company's trusted office IP ranges (10.0.0.0/24). However, the executive team (group "Execs") must be able to access the app from any location. Which Conditional Access policy configuration should the administrator use?

Accepted Answer

B: Include all users, exclude Execs group, and block access with condition 'Location not in trusted locations'.. Option B is correct because the requirement is to block access from untrusted locations for all users except the Execs group. By including all users, excluding the Execs group, and setting a block control with the condition 'Location not in trusted locations', the policy ensures that only non-Exec users are blocked when accessing from outside the trusted IP range, while Execs remain unrestricted. This aligns with the principle of explicitly blocking unwanted access rather than granting access with conditions that could be bypassed.

Answer

A: Include all users, exclude Execs group, and grant access with condition 'Location not in trusted locations'.

Answer

C: Include Execs group, exclude all others, and grant access with condition 'Location in trusted locations'.

Answer

D: Include all users, include Execs group as an additional condition, and grant access with condition 'Location in trusted locations'.

Question 2

A company wants to enable self-service password reset (SSPR) for all users. Which two configurations are mandatory to allow users to reset their own passwords? (Choose two.)

Accepted Answer

A: Enable SSPR for 'All' users.. Option A is correct because enabling SSPR for 'All' users is a mandatory configuration that ensures every user in the tenant is licensed and permitted to use self-service password reset. Without this setting, SSPR would not be activated for the intended user population, even if authentication methods are configured.

Answer

C: Configure a custom helpdesk URL.

Answer

D: Enforce registration after 30 days.

Question 3

A company wants to require MFA for all users when they access Office 365 from any network location that is not the company's trusted IP ranges. Which Conditional Access policy configuration should be applied?

Accepted Answer

A: Include all users, exclude none, grant access require MFA with condition 'Location not in trusted locations'.. Option A correctly configures a Conditional Access policy that targets all users and applies the 'Require MFA' grant control when the location condition is set to 'Any location' except the company's trusted IP ranges. This ensures MFA is enforced for all access attempts originating from outside the trusted network, meeting the requirement precisely.

Answer

B: Include all users, exclude none, block access with condition 'Location not in trusted locations'.

Answer

C: Include all users, exclude trusted locations as a group, grant access require MFA.

Answer

D: Include all users, exclude all locations, grant access require MFA.

Question 4

A company uses Microsoft Entra ID P2 licenses and wants to enforce multi-factor authentication (MFA) for all users when accessing corporate applications. However, a small group of break-glass accounts must be excluded from MFA requirements to ensure emergency access. The administrator creates a Conditional Access policy targeting all users. Which configuration should be applied to achieve the exclusion?

Accepted Answer

Under 'Assignments' > 'Users and groups', select 'Exclude' and choose the security group containing break-glass accounts.. Option B is correct because Conditional Access policies in Microsoft Entra ID allow administrators to exclude specific users or groups from policy enforcement. By excluding the security group containing break-glass accounts under 'Assignments' > 'Users and groups', the MFA requirement is applied to all other users while ensuring emergency access accounts remain unblocked. This is the standard and recommended approach for handling break-glass accounts in a Conditional Access policy targeting all users.

Answer

Set 'Grant' control to 'Require multi-factor authentication' and include all users including break-glass accounts.

Answer

Under 'Session' controls, configure 'Sign-in frequency' with a value of 0 to disable MFA for break-glass accounts.

Answer

Create a separate policy for break-glass accounts that does not impose MFA and assign it a lower priority.

Question 5

A company uses Microsoft Entra ID P2 licenses and wants to implement just-in-time (JIT) privileged access for administrators. Security requirements state that Global Administrator role members must request approval and provide a business justification before their role activation expires after 4 hours. Which Microsoft Entra feature should be configured?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access, requiring approval and a business justification for role activation, with configurable maximum activation durations (e.g., 4 hours). This directly meets the security requirement for Global Administrator role members to request approval and provide justification before activation expires after 4 hours.

Answer

Conditional Access

Answer

Identity Protection

Answer

Self-Service Password Reset (SSPR)

Question 6

A company has an on-premises Active Directory environment and wants to sync user identities to Microsoft Entra ID while avoiding storing password hashes in the cloud. The company wants to provide seamless single sign-on (SSO) for domain-joined devices. Which authentication method should be chosen?

Accepted Answer

Pass-Through Authentication (PTA) with Seamless SSO. Pass-Through Authentication (PTA) with Seamless SSO is the correct choice because it validates user passwords directly against on-premises Active Directory without storing any password hashes in the cloud. Seamless SSO provides automatic sign-in for domain-joined devices using Kerberos delegation, meeting the requirement for a seamless SSO experience without password hash storage.

Answer

Password Hash Synchronization (PHS)

Answer

Federation with Active Directory Federation Services (AD FS)

Answer

Cloud-only authentication

Question 7

A junior administrator needs permission to view sign-in logs, audit logs, and security recommendations in the Microsoft Entra admin center, but must not be able to reset passwords, modify settings, or manage roles. Which built-in Microsoft Entra role should the administrator assign?

Accepted Answer

Security Reader. The Security Reader role grants read-only access to security-related data, including sign-in logs, audit logs, and security recommendations, without permitting any write operations such as password resets, setting modifications, or role management. This aligns precisely with the junior administrator's required permissions.

Answer

Global Reader

Answer

Reports Reader

Answer

Security Administrator

Question 8

A company uses Microsoft Entra ID P2 licenses. The security team wants to automatically block sign-ins for users with high sign-in risk, but only when the sign-in originates from outside the corporate network. For sign-ins from the corporate network, they want to require a password change for medium sign-in risk. A group of emergency access accounts (break-glass) must be excluded from all policies. What should the administrator implement?

Accepted Answer

Two Conditional Access policies: one for external locations that blocks high risk, and one for internal locations that requires password change for medium risk. Both exclude the break-glass group.. Option B is correct because Conditional Access policies evaluate conditions like location and sign-in risk separately, and combining both conditions (external vs. internal) with different grant controls (block vs. require password change) in a single policy is not supported. Two separate policies are required: one for external locations with high risk to block, and one for internal locations with medium risk to require password change. Both must exclude the break-glass group to ensure emergency access is never blocked.

Answer

single Conditional Access policy that blocks access for high risk from external locations and requires password change for medium risk from internal locations, excluding the break-glass group.

Answer

An Identity Protection user risk policy that blocks high-risk users and prompts for password change for medium-risk users, configured to exclude the break-glass group.

Answer

Conditional Access policy that requires multi-factor authentication for all users except break-glass, and a separate sign-in risk policy for blocking high risk from external locations.

Question 9

A company uses Microsoft Entra ID P1 licenses. They want to enforce multi-factor authentication (MFA) for all users when accessing any cloud application from networks that are not trusted corporate locations. A group named 'Emergency' must be excluded from MFA requirements. Which Conditional Access policy configuration should the administrator use?

Accepted Answer

Assign the policy to all users, exclude the Emergency group, include all cloud apps, grant MFA, and set location condition to any network or location except trusted networks.. Option C is correct because the requirement is to enforce MFA for all users from untrusted networks, while excluding the Emergency group. The Conditional Access policy must be assigned to all users, exclude the Emergency group, include all cloud apps, require MFA as a grant control, and use a location condition set to 'any network or location except trusted networks' to target only untrusted locations. This configuration ensures MFA is triggered only when access originates from networks not defined as trusted corporate locations.

Answer

Assign the policy to all users, exclude the Emergency group, include all cloud apps, grant access (not MFA), and set location condition to trusted networks only.

Answer

Assign the policy to all users, exclude the Emergency group, include all cloud apps, grant MFA, and set location condition to any network or location.

Answer

Assign the policy to all users, exclude the Emergency group, include all cloud apps, grant MFA, and set location condition to trusted networks only.

Question 10

A security administrator needs to implement a just-in-time (JIT) privileged access solution for the Global Administrator role. Users must request activation and provide a business justification. The request must be approved by a separate group of approvers, and the role activation should expire after 4 hours. Which Microsoft Entra feature should be configured?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is the Microsoft Entra feature specifically designed for just-in-time (JIT) privileged access. It allows you to configure role activation with approval workflows, require a business justification, set a maximum activation duration (e.g., 4 hours), and designate specific approvers. This directly matches all requirements in the question.

Answer

Conditional Access

Answer

Azure AD Roles (default role settings)

Answer

Identity Protection

Question 11

A company uses Microsoft Entra ID P2 licenses. The security team wants to automatically require a password change for users with medium sign-in risk, but only when the sign-in originates from outside the corporate network. Users with high sign-in risk should be blocked entirely. A group of break-glass accounts must be excluded from all policies. Which feature should the administrator implement?

Accepted Answer

Conditional Access policies with sign-in risk and location conditions. Option A is correct because Conditional Access policies in Microsoft Entra ID allow combining sign-in risk conditions with location conditions (e.g., 'Not trusted IPs' or 'All trusted locations' set to false) to target only sign-ins from outside the corporate network. The policy can be configured to require a password change for medium risk and block access for high risk, while excluding break-glass accounts via the 'Exclude' tab using a dedicated group.

Answer

Identity Protection risk policies

Answer

Privileged Identity Management (PIM)

Answer

Azure AD Identity Governance

Question 12

A company uses password hash synchronization with Microsoft Entra Connect. The security team wants to enable self-service password reset (SSPR) so that users can reset their own passwords, and the password changes must be written back to the on-premises Active Directory. Which additional configuration is required to achieve password writeback?

Accepted Answer

Install Microsoft Entra Connect with password writeback enabled. Password writeback requires the installation of Microsoft Entra Connect with the password writeback feature explicitly enabled during setup. This allows password changes initiated via SSPR to be written back to on-premises Active Directory. Option C is correct because it directly addresses the necessary infrastructure component.

Answer

Configure SSPR to use federation with on-premises AD FS

Answer

Enable password hash synchronization in Microsoft Entra Connect

Answer

Set the SSPR property 'Password writeback' to 'Yes' in the Microsoft Entra admin center

Question 13

A company uses Microsoft Entra ID P2 licenses. The security team wants to require multi-factor authentication (MFA) for all users when accessing any cloud application from networks that are not trusted corporate locations. A group named 'BreakGlass' must be excluded from MFA requirements. Additionally, the company wants to block legacy authentication protocols. Which approach should the administrator use?

Accepted Answer

Create one Conditional Access policy for MFA (targeting all users, excluding BreakGlass, with location condition) and another policy to block legacy authentication (targeting all users, with client apps condition). Option A is correct because it separates the MFA requirement and legacy authentication block into two distinct Conditional Access policies, which is the recommended approach for granular control. The MFA policy targets all users except the BreakGlass group and uses the location condition to require MFA only from untrusted networks. The second policy blocks legacy authentication by targeting all users with the client apps condition set to 'Exchange ActiveSync clients' and 'Other clients', effectively preventing protocols like POP3, IMAP, and SMTP from bypassing modern authentication.

Answer

Create a single Conditional Access policy that grants access only if MFA is performed and block legacy client apps in the same policy

Answer

Enable Security defaults in Entra ID

Answer

Use baseline Conditional Access policies

Question 14

A company wants to implement just-in-time (JIT) privileged access for the Global Administrator role in Microsoft Entra ID. Users must request activation and provide a business justification. The request must be approved by a separate group of approvers, and the role activation should expire after 4 hours. Which Microsoft Entra feature should the administrator configure?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access by allowing users to activate roles like Global Administrator with a business justification, requiring approval from a designated group of approvers, and setting a configurable activation duration (e.g., 4 hours). This directly matches the company's requirements for time-bound, approved role activation.

Answer

Identity Protection

Answer

Conditional Access

Answer

Access Reviews

Question 15

A company wants to block access to Exchange Online from devices that are not compliant with Intune compliance policies. Which Conditional Access grant control should be used?

Accepted Answer

Require device to be marked as compliant. To block access to Exchange Online from non-compliant devices, you need to enforce a Conditional Access policy that evaluates device compliance status. The 'Require device to be marked as compliant' grant control checks the device's compliance state reported by Microsoft Intune before granting access. If the device is not compliant, access to Exchange Online is blocked, ensuring only managed and compliant devices can connect.

Answer

Require MFA

Answer

Require approved client app

Answer

Require all conditions