MS-102 Implement and manage identity and access in Microsoft Entra ID Practice Test 4 — 15 Questions

Question 1

An administrator who is not a Global Administrator needs to manage just-in-time privileged access to Azure resources using Microsoft Entra Privileged Identity Management (PIM). Which built-in role must be assigned to the administrator to allow PIM management for Azure resources?

Accepted Answer

Privileged Role Administrator. The Privileged Role Administrator role is the only built-in role that grants permissions to manage all aspects of Privileged Identity Management (PIM) for Azure resources, including configuring just-in-time access, managing role assignments, and approving activation requests. This role is specifically designed for administrators who need to oversee PIM without requiring Global Administrator privileges, as it provides full control over PIM policies and role settings across Azure AD and Azure resources.

Answer

User Administrator

Answer

Security Administrator

Answer

Application Administrator

Question 2

A company wants to require that all users accessing a critical cloud application for the first time must accept a company terms of use before they are granted access. Which Conditional Access policy grant control should be added?

Accepted Answer

Require terms of use. Option C is correct because the 'Require terms of use' grant control in a Conditional Access policy is specifically designed to force a user to accept a company's terms of use (TOU) before accessing a cloud application. When this control is enabled, Microsoft Entra ID presents the TOU document to the user on first access, and access is blocked until the user explicitly accepts the terms. This directly meets the requirement of requiring acceptance before granting access.

Answer

Require multi-factor authentication

Answer

Require device to be marked as compliant

Answer

Require approved client app

Question 3

A company uses Microsoft Entra ID Governance to automate the lifecycle of user access. They want to automatically remove a user's group membership for a critical application 30 days after the user's employment end date is captured from the HR system. Which feature should be configured to meet this requirement?

Accepted Answer

Lifecycle Workflows. Lifecycle Workflows (LCW) in Microsoft Entra ID Governance are specifically designed to automate joiner, mover, and leaver processes triggered by HR data. A 'leaver' workflow can be configured to remove group memberships a defined number of days after the employee's employment end date is captured from the HR system, meeting the 30-day requirement precisely.

Answer

Access Reviews

Answer

Entitlement management

Answer

Privileged Identity Management

Question 4

A development team builds a background service that needs to read all users' calendars via Microsoft Graph without a signed-in user. The service will run on a server with a client secret. Which OAuth 2.0 grant flow should the application use?

Accepted Answer

Client credentials grant. The client credentials grant is designed for server-to-server, non-interactive scenarios where an application authenticates as itself (not on behalf of a user) to access resources. Since the background service runs with a client secret and needs to read all users' calendars without a signed-in user, this flow is the correct choice because it uses the application's own identity to obtain an access token from Microsoft Entra ID.

Answer

Authorization code grant

Answer

Device authorization grant

Answer

Implicit grant

Question 5

A company uses Azure AD Identity Protection. The security team wants to automatically block sign-ins that are detected as coming from a known malicious IP address. Which policy should be configured?

Accepted Answer

Sign-in risk policy. The Sign-in risk policy in Azure AD Identity Protection is specifically designed to respond to risks detected during the authentication attempt, such as sign-ins from known malicious IP addresses. When a sign-in is flagged as having a high risk level (e.g., from a known malicious IP), the policy can be configured to automatically block the sign-in. This directly addresses the security team's requirement to block sign-ins from malicious IPs.

Answer

User risk policy

Answer

MFA registration policy

Answer

Identity Protection vulnerabilities policy

Question 6

A company wants to require that all users accessing a critical internal application must be on a compliant device (managed by Intune) and must have authenticated with multi-factor authentication in the last 30 minutes. Which Conditional Access configurations are needed?

Accepted Answer

Grant control 'Require multi-factor authentication' and 'Require device to be marked as compliant' with session control 'Sign-in frequency' set to 30 minutes. Option A is correct because it combines the required grant controls ('Require multi-factor authentication' and 'Require device to be marked as compliant') with the session control 'Sign-in frequency' set to 30 minutes. The sign-in frequency session control enforces reauthentication after the specified time window, ensuring MFA was performed within the last 30 minutes. The grant controls ensure both MFA and device compliance are satisfied simultaneously.

Answer

Grant control 'Require multi-factor authentication' and 'Require device to be marked as compliant' and 'Require all the selected controls'

Answer

Grant control 'Require multi-factor authentication' and 'Require hybrid Azure AD joined device' with session control 'App enforced restrictions'

Answer

Grant control 'Block access' for non-compliant devices and separate policy for MFA

Question 7

An administrator needs to allow external users from a partner company to sign up for access to a SharePoint Online site using their own Azure AD accounts. Which configuration should the administrator enable?

Accepted Answer

Enable 'External identities' > 'Self-service sign-up' in Azure AD. Option B is correct because enabling 'Self-service sign-up' in Azure AD External Identities allows external users to sign up for access to applications (including SharePoint Online sites) using their own Azure AD accounts without manual admin intervention. This feature creates guest user objects automatically when the external user completes the sign-up flow, which satisfies the requirement for partner users to sign up using their existing Azure AD credentials.

Answer

Enable 'Email one-time passcode authentication' for guests

Answer

Configure a cross-tenant access policy for the partner tenant

Answer

Create guest user accounts manually in Azure AD

Question 8

A company uses Azure AD Identity Protection. The security administrator wants to block user sign-ins when the sign-in risk level is detected as 'High' for a custom SaaS application. Which Conditional Access policy configuration should the administrator use?

Accepted Answer

Create a Conditional Access policy set to block access when sign-in risk is high. Option B is correct because the requirement is to block sign-ins when the sign-in risk level is 'High' for a custom SaaS application. In Microsoft Entra ID (formerly Azure AD), a Conditional Access policy can be configured with a 'Block access' grant control, which directly denies authentication when the specified condition (sign-in risk level equals High) is met. This is the most straightforward and secure approach to prevent access without relying on additional authentication factors or session controls.

Answer

Create a Conditional Access policy with a grant control to require MFA when sign-in risk is high

Answer

Configure a session control in Conditional Access to sign out users when risk is high

Answer

Enable Identity Protection risk policy to automatically block users

Question 9

A company wants to implement just-in-time (JIT) privileged access for the Security Administrator role. Users must be able to activate the role with a business justification, and the activation must be approved by a designated group of approvers. The role activation should expire after 4 hours. Which Privileged Identity Management (PIM) configuration should the administrator modify?

Accepted Answer

Role settings for the Security Administrator role. To configure just-in-time (JIT) privileged access with approval, expiration, and justification requirements, you must modify the Role settings for the Security Administrator role in Privileged Identity Management (PIM). Role settings control activation parameters such as maximum activation duration (4 hours), whether approval is required, and whether justification is mandatory. This is the only place where these activation policies are defined.

Answer

Assignments (Eligible) for the Security Administrator role

Answer

Assignments (Active) for the Security Administrator role

Answer

Notifications settings under PIM

Question 10

A company uses Azure AD and SharePoint Online. They want to allow users from a partner organization (which also uses Azure AD) to access a specific SharePoint Online site using their existing partner credentials. The partner users should not require new accounts to be created. Which Azure AD feature should be configured?

Accepted Answer

Azure AD B2B collaboration. Azure AD B2B collaboration allows you to invite external users from a partner organization to access your Azure AD-integrated applications, such as SharePoint Online, using their own existing Azure AD credentials. This feature leverages cross-tenant trust and does not require creating new user accounts in your tenant, fulfilling the requirement exactly.

Answer

Azure AD B2C

Answer

Azure AD Domain Services

Answer

Organizational Relationships

Question 11

A company uses Azure AD Identity Protection. The security team wants to automatically block users from signing in when the user risk level is 'High'. Which policy should they configure?

Accepted Answer

User risk policy. The User risk policy in Azure AD Identity Protection is specifically designed to automatically block sign-ins when the user risk level is 'High'. This policy evaluates the probability that a user's identity has been compromised based on signals like leaked credentials or anomalous behavior, and can enforce actions such as blocking access or requiring password change. Option C is correct because it directly targets user risk, not sign-in risk or other conditions.

Answer

Conditional Access policy with user risk condition

Answer

Sign-in risk policy

Answer

MFA registration policy

Question 12

A company wants to automatically assign Microsoft 365 E5 licenses to all users in the Sales department. The department is identified by the department attribute in Microsoft Entra ID. The administrator needs to configure a method where licenses are assigned based on group membership, and the group membership is automatically updated based on user attributes. Which licensing approach should the administrator use?

Accepted Answer

Group-based licensing with a dynamic group that uses the department attribute.. Option B is correct because group-based licensing in Microsoft Entra ID allows automatic license assignment based on group membership, and a dynamic group can automatically update its membership using the department attribute rule (e.g., `user.department -eq "Sales"`). This meets the requirement for both automated license assignment and attribute-driven membership updates without manual intervention.

Answer

Per-user licensing with a PowerShell script.

Answer

Subscription-based licensing via the Microsoft 365 admin center.

Answer

Group-based licensing with an assigned group that must be manually updated.

Question 13

A company wants to require approval for any activation of the Global Administrator role in Privileged Identity Management (PIM). The approvers are predefined as members of a security group named 'GA-Approvers'. Activations must require a business justification and expire after 4 hours. Which PIM configuration should the administrator modify to meet these requirements?

Accepted Answer

Edit the role settings of the Global Administrator role in PIM.. Option A is correct because the requirement to require approval, enforce a business justification, and set a 4-hour expiration for Global Administrator activations is configured in the role settings of the Global Administrator role within Privileged Identity Management (PIM). These settings control activation parameters such as approval requirements, justification, and maximum activation duration, which directly map to the stated needs.

Answer

Create an access review for the Global Administrator role.

Answer

Configure Azure AD Identity Protection to require MFA for Global Administrator.

Answer

Assign the Global Administrator role directly to the users temporarily.

Question 14

A company plans to enable Self-Service Password Reset (SSPR) for all users. The administrator needs to ensure that users are required to register at least two authentication methods before they can use SSPR. Which configuration setting should the administrator modify?

Accepted Answer

Set the 'Number of methods required to reset' to 2 in the SSPR authentication methods settings.. Option A is correct because the 'Number of methods required to reset' setting directly controls how many authentication methods a user must provide during the SSPR reset process. By setting this value to 2, the administrator ensures that users must register at least two methods (e.g., phone and email) before they can reset their password, as SSPR requires the registered methods to match the reset requirement.

Answer

Enable combined registration for SSPR and Microsoft Entra ID Multi-Factor Authentication.

Answer

Configure a Conditional Access policy requiring MFA registration for SSPR.

Answer

Set the 'Number of questions required to register' to 2 in the security questions settings.

Question 15

A company uses Azure AD Conditional Access. The security team wants to require multi-factor authentication (MFA) for all users when accessing the Azure portal, except when they are connecting from the corporate network (which is defined as a trusted location). How should the Conditional Access policy be configured?

Accepted Answer

Create a Conditional Access policy with all users, cloud apps = Microsoft Azure Management, Conditions > Locations = all locations, exclude the corporate network, Grant = Require multi-factor authentication.. Option A is correct because it targets only the Azure Portal (Microsoft Azure Management cloud app), applies MFA to all locations except the trusted corporate network, and excludes the corporate network from the policy. This ensures MFA is required for all access attempts from untrusted locations while allowing direct access from the corporate network without MFA.

Answer

Create a Conditional Access policy with all users, cloud apps = All cloud apps, Conditions > Locations = all locations, exclude the corporate network, Grant = Require multi-factor authentication.

Answer

Create a Conditional Access policy with all users, cloud apps = Microsoft Azure Management, Conditions > Locations = Corporate network, Grant = Block.

Answer

Create a Conditional Access policy with all users, cloud apps = Microsoft Azure Management, Conditions > Locations = Corporate network, Grant = Require multi-factor authentication.