MS-102 Implement and manage identity and access in Microsoft Entra ID Practice Test 5 — 15 Questions

Question 1

An organization wants to configure Self-Service Password Reset (SSPR) for all users. The administrator must ensure that users register two authentication methods: one from the mobile app category (e.g., notification or code) and one from the phone call category (e.g., office phone or mobile phone). Which combination of methods should the administrator select in the SSPR settings?

Accepted Answer

Mobile app notification and Office phone. Option A is correct because the SSPR policy requires users to register two authentication methods from distinct categories. The mobile app notification (from the mobile app category) and office phone (from the phone call category) satisfy this requirement. This combination ensures that users have one method from the mobile app category and one from the phone call category, as specified in the question.

Answer

Mobile app code and Security questions

Answer

Email and Mobile phone

Answer

Security questions and Office phone

Question 2

A company plans to enable Self-Service Password Reset (SSPR) for all users. The administrator must ensure that users are required to register at least two authentication methods: one from the 'mobile app' category and one from the 'phone call' category. Which combination of methods should the administrator select in the SSPR registration settings?

Accepted Answer

Mobile app notification and office phone. Option A is correct because the SSPR registration policy requires users to select at least two distinct authentication methods from the allowed list. By choosing 'Mobile app notification' (from the mobile app category) and 'Office phone' (from the phone call category), the administrator satisfies the requirement of one method from each specified category. The 'Office phone' option is classified under the 'phone call' category in Microsoft Entra ID SSPR settings.

Answer

Mobile app notification and mobile app code

Answer

Office phone and mobile phone

Answer

Mobile phone and email

Question 3

A company wants to allow users to reset their own passwords without administrator intervention. They need to configure Self-Service Password Reset (SSPR) for all cloud-only users. Which Azure AD license is required for all users to enable SSPR?

Accepted Answer

Azure AD Premium P1. Azure AD Premium P1 includes the Self-Service Password Reset (SSPR) capability for cloud-only users. Azure AD Free only supports SSPR for cloud users if the tenant has at least one Azure AD Premium P1 license assigned, but the feature itself is a Premium P1 benefit. Microsoft 365 Business Basic does not include SSPR; it provides basic identity features without password reset self-service. Azure AD Premium P2 includes all P1 features plus Identity Protection and Privileged Identity Management, but SSPR does not require P2.

Answer

Azure AD Free

Answer

Microsoft 365 Business Basic

Answer

Azure AD Premium P2

Question 4

Administrators want to enforce multi-factor authentication (MFA) for all users when accessing cloud applications from untrusted networks. They plan to use Azure AD Conditional Access with named locations. Which two components must be configured to meet this requirement? (Select two.)

Accepted Answer

named location for the corporate network. Option B is correct because named locations in Azure AD Conditional Access allow administrators to define trusted network boundaries, such as the corporate network's public IP range. By marking this named location as a trusted location, the Conditional Access policy can then require MFA when users access cloud applications from any network that is not the corporate network, effectively enforcing MFA from untrusted networks.

Answer

location policy

Answer

Conditional Access policy targeting MFA registration

Question 5

The security team wants to require approval for any activation of the Global Administrator role in Azure AD Privileged Identity Management (PIM). The approvers must be members of a security group named 'GA-Approvers'. Activations must require a business justification and expire after 4 hours. Which PIM configuration should the administrator modify?

Accepted Answer

Both A and C. Option D is correct because configuring PIM role settings for Global Administrator requires both enabling approval (with the 'GA-Approvers' group as designated approvers) and setting the activation parameters (maximum duration of 4 hours and justification requirement). Option A alone only sets the role settings but does not specify which group serves as approvers; Option C alone adds the approvers group but does not configure the activation duration or justification. Both A and C together fulfill the full requirement.

Answer

Role settings for Global Administrator: require approval, set maximum activation duration to 4 hours, and require justification

Answer

Role settings for Global Administrator: require MFA, set maximum activation duration to 4 hours, and require justification

Answer

In the eligible assignments for Global Administrator, add 'GA-Approvers' as approvers

Question 6

Contoso wants to require multi-factor authentication (MFA) for all users when accessing cloud applications from any network except the corporate headquarters (trusted IP range). They plan to use Azure AD Conditional Access. Which two components must be configured to achieve this requirement? (Select all that apply.)

Accepted Answer

Conditional Access policy targeting all users and cloud apps, with conditions for locations. Option A is correct because a Conditional Access policy must be created to enforce MFA based on location conditions. The policy targets all users and cloud apps, and uses the 'locations' condition to exclude the trusted IP range (corporate headquarters) while requiring MFA for all other locations. This ensures MFA is triggered only when access originates from outside the trusted network.

Answer

An Identity Protection user risk policy

Answer

An MFA registration policy requiring users to register for MFA

Question 7

The security team at Contoso wants to require that any activation of the Global Administrator role in Azure AD Privileged Identity Management (PIM) must be approved by members of a security group named 'GA-Approvers'. Activations must require a business justification and expire after 4 hours. Which PIM configuration should the administrator modify to achieve this?

Accepted Answer

The role settings for Global Administrator, on the Activation tab. Option A is correct because the Activation tab in the role settings for Global Administrator allows you to configure approval requirements, justification, and maximum activation duration. By setting 'Require approval to activate' to 'Enabled' and specifying the 'GA-Approvers' group as the approver, requiring a business justification, and setting the activation maximum duration to 4 hours, you meet all the stated requirements.

Answer

The role settings for Global Administrator, on the Assignment tab

Answer

The role settings for Global Administrator, on the Notification tab

Answer

The role settings for Global Administrator, on the Alert tab

Question 8

A company with Azure AD Premium P2 licenses wants to enforce that all activations of the Global Administrator role require approval from a designated security group. The activation must also require a business justification and expire after 4 hours. Which Azure AD feature should the administrator configure?

Accepted Answer

Azure AD Privileged Identity Management (PIM). Azure AD Privileged Identity Management (PIM) provides time-bound and approval-based role activation. It allows you to require approval from a designated security group, mandate a business justification, and set a maximum activation duration (e.g., 4 hours) for privileged roles like Global Administrator. This directly matches all the requirements in the question.

Answer

Azure AD Identity Protection

Answer

Azure AD Conditional Access

Answer

Azure AD Multi-Factor Authentication

Question 9

A company uses Azure AD Connect with password hash synchronization. They want to enable Azure AD Seamless Single Sign-On (SSO) for users accessing Microsoft 365 from domain-joined devices on the corporate network. Which configuration is required on the on-premises Active Directory?

Accepted Answer

Create a computer account named AZUREADSSOACC in each AD forest. Azure AD Seamless SSO requires a computer account named AZUREADSSOACC to be created in each on-premises AD forest. This account is used by Azure AD to sign Kerberos tickets for users accessing Microsoft 365 resources, enabling automatic sign-in without password prompts. The account must be created in the root domain of each forest and its password is managed automatically by Azure AD Connect.

Answer

Install Azure AD Connect on a separate server

Answer

Enable Passthrough Authentication

Answer

Set the service connection point in Active Directory

Question 10

A company uses hybrid identity with Azure AD Connect and password hash synchronization. They want to enable Self-Service Password Reset (SSPR) with password writeback so that users can reset their on-premises Active Directory passwords. Which Azure AD license is required?

Accepted Answer

Azure AD Premium P1. Azure AD Premium P1 is required for Self-Service Password Reset (SSPR) with password writeback. Password writeback is a premium feature that enables password changes in Azure AD to be written back to on-premises Active Directory via Azure AD Connect. Azure AD Free does not include SSPR with writeback, and Azure AD Premium P2 includes additional features like Identity Protection but is not necessary for this scenario.

Answer

Azure AD Free

Answer

Azure AD Premium P2

Answer

Microsoft 365 E3

Question 11

A company uses Azure AD Privileged Identity Management (PIM) for role activation. They want to require that any activation of the Security Administrator role be approved by a designated group of approvers called 'Security Approvers'. Activations must include a ticket number and expire after 8 hours. Which PIM configuration should the administrator modify?

Accepted Answer

Role settings for Security Administrator. Option A is correct because Azure AD PIM role settings for a specific role, such as Security Administrator, control activation requirements including approval workflow, justification (ticket number), and maximum activation duration. By modifying the role settings, the administrator can require approval from the 'Security Approvers' group, mandate a ticket number, and set an 8-hour expiration.

Answer

Role assignments for Security Administrator

Answer

Access reviews for Security Administrator

Answer

Alerts for Security Administrator

Question 12

A company uses Azure AD Connect with password hash synchronization. They want to allow users to reset their on-premises Active Directory passwords from the cloud Self-Service Password Reset (SSPR) portal. Which additional configuration is required in Azure AD Connect?

Accepted Answer

Enable password writeback. Password writeback is the specific feature in Azure AD Connect that enables password changes performed in the cloud (via SSPR) to be written back to the on-premises Active Directory. Without this feature enabled and configured, the SSPR portal can only reset cloud-only passwords, not synchronized on-premises passwords. Therefore, enabling password writeback is the additional configuration required beyond the existing password hash synchronization.

Answer

Enable self-service password reset in Azure AD

Answer

Configure Federation Services (AD FS)

Answer

Install Azure AD Application Proxy

Question 13

A company uses Azure AD Privileged Identity Management (PIM) to manage role activations. They have an Azure AD Premium P2 license. The security team wants to require that any activation of the Exchange Administrator role must be approved by a specific group named 'Exchange Approvers'. Additionally, activations must require a ticket number and expire after 6 hours. Which PIM configuration should the administrator modify?

Accepted Answer

Configure the 'Role settings' for the Exchange Administrator role to require approval and set the approvers group. Option A is correct because in Azure AD PIM, the 'Role settings' for a specific role (like Exchange Administrator) allow you to configure activation requirements, including requiring approval, specifying approvers (such as the 'Exchange Approvers' group), requiring a ticket number, and setting a maximum activation duration (e.g., 6 hours). This directly meets all the security team's requirements.

Answer

Add the Exchange Administrator role to the 'Exchange Approvers' group's eligible assignments

Answer

Create a PIM alert for activations without a ticket number and set a 6-hour alert threshold

Answer

Define an access review for the Exchange Administrator role with a 6-hour review duration

Question 14

A company uses Azure AD Conditional Access to enforce MFA for all cloud apps. They have some users who are physically located in countries that are considered high-risk by the security team. The team wants to require device compliance (as defined by Intune) for sign-ins from those specific countries, while still requiring MFA from all other locations. How should the administrator configure the Conditional Access policy?

Accepted Answer

Create two Conditional Access policies: one for the high-risk countries requiring MFA and device compliance, and another for all other locations requiring only MFA. Option A is correct because Conditional Access policies are evaluated independently, and each policy can target specific conditions with distinct grant controls. By creating two separate policies—one for high-risk countries requiring both MFA and device compliance, and another for all other locations requiring only MFA—the administrator can enforce the exact requirements per location group. This approach avoids conflicts and ensures that users in high-risk countries are subject to stricter controls while others are not.

Answer

Create a single Conditional Access policy that includes both conditions (locations) and grant controls (MFA and device compliance) with an 'OR' operator

Answer

Use Azure AD Identity Protection to automatically evaluate location risk, and let Conditional Access apply the same policy to all users

Answer

Configure a single Conditional Access policy with multiple location conditions and multiple grant controls using an 'AND' operator

Question 15

A company wants to use Azure AD Identity Protection features such as user risk policies and sign-in risk policies to automatically respond to risky behavior. Which Azure AD license is required to enable these capabilities?

Accepted Answer

Azure AD Premium P2. Azure AD Identity Protection features like user risk policies and sign-in risk policies require Azure AD Premium P2. This is because P2 includes Identity Protection, which provides risk-based conditional access policies that automatically respond to detected risks. Azure AD Premium P1 supports Conditional Access but lacks the risk detection and automated remediation capabilities of Identity Protection.

Answer

Azure AD Free

Answer

Azure AD Premium P1

Answer

Microsoft 365 E3