MS-102 Implement and manage identity and access in Microsoft Entra ID — Timed 10 Questions

Question 1

An organization has Microsoft Entra ID P2 licenses and wants to configure a Conditional Access policy to restrict access to Microsoft 365 services. Which of the following can be used as conditions in the policy? (Choose two that apply)

Accepted Answer

Device platform. Device platform is a valid condition in Microsoft Entra Conditional Access policies, allowing administrators to target specific operating systems such as Windows, macOS, iOS, or Android. This enables granular control over access based on the device type, which is essential for enforcing security requirements like requiring compliant devices on certain platforms.

Answer

Authentication strength

Answer

Application ID

Question 2

An organization with Microsoft Entra ID P2 licenses wants to require multi-factor authentication (MFA) for all users but allow them to register their authentication methods before being forced to use MFA. Which configuration should they implement?

Accepted Answer

Conditional Access policy with MFA grant and a registration campaign. Conditional Access policies can include a registration campaign for combined security info registration, allowing users to preregister MFA methods before the policy requiring MFA is enforced. This provides a smooth user experience. Security defaults enforce MFA immediately without a pre-registration period. Per-user MFA requires enabling MFA per user and does not include a registration campaign. Identity Protection user risk policy triggers MFA based on risk, not a blanket requirement.

Answer

Security defaults

Answer

Per-user MFA

Answer

Identity Protection user risk policy

Question 3

An organization wants to enforce that all administrators use a phishing-resistant authentication method (e.g., FIDO2 security keys or Windows Hello for Business) when accessing Microsoft 365 admin portals. Which Microsoft Entra ID feature should be used?

Accepted Answer

Conditional Access authentication strength. Option A is correct because Conditional Access authentication strength allows administrators to define and enforce specific authentication methods, such as FIDO2 security keys or Windows Hello for Business, which are phishing-resistant. By creating a policy that targets admin roles and requires an authentication strength policy that mandates these methods, the organization can ensure that only phishing-resistant credentials are accepted when accessing Microsoft 365 admin portals. This granular control goes beyond simple MFA enforcement by specifying the exact authentication method required.

Answer

Security defaults

Answer

Per-user MFA

Answer

Identity Protection

Question 4

An organization with Microsoft Entra ID P2 licenses needs to enforce that all users accessing the Azure portal must use FIDO2 security keys for multi-factor authentication. Which configuration should be implemented?

Accepted Answer

Configure an authentication strength policy that requires FIDO2 and assign it to a Conditional Access policy. Option C is correct because in Microsoft Entra ID, authentication strengths allow you to define a specific set of authentication methods (e.g., FIDO2 security keys) and then assign that strength to a Conditional Access policy. This ensures that only FIDO2 security keys are accepted for MFA when accessing the Azure portal, meeting the requirement precisely.

Answer

Create a Conditional Access policy that requires MFA and select FIDO2 as the authentication strength in the grant controls

Answer

Create a Conditional Access policy that requires MFA and set the grant control to require a specific device platform

Answer

Configure an authentication methods policy that allows only FIDO2 security keys

Question 5

An organization wants to enable users to reset their own passwords using the Microsoft Authenticator app and to prevent reuse of the last five passwords. Which Microsoft Entra ID features should be configured?

Accepted Answer

Self-Service Password Reset (SSPR) and Password Protection. The requirement to enable users to reset their own passwords via the Microsoft Authenticator app is fulfilled by Self-Service Password Reset (SSPR), which supports the Authenticator app as an authentication method. The requirement to prevent reuse of the last five passwords is fulfilled by Password Protection, specifically the password reuse policy within the custom banned password list or the enforcement of password history via on-premises integration. Option B correctly pairs these two features.

Answer

Microsoft Entra ID Protection and SSPR

Answer

Conditional Access and SSPR

Answer

Identity Governance and SSPR

Question 6

A company wants to ensure that all new users register for multi-factor authentication (MFA) within 14 days of account creation. Which Microsoft Entra ID feature should be used?

Accepted Answer

MFA registration campaign. The MFA registration campaign in Microsoft Entra ID is specifically designed to enforce user registration for MFA within a defined time frame, such as 14 days. It targets new users and sends them reminders to register, blocking access until registration is completed, which directly meets the company's requirement.

Answer

Conditional Access policy

Answer

Identity Protection

Answer

Access Reviews

Question 7

An organization has multiple Microsoft Entra ID tenants and wants to allow partner users to access internal applications using their own corporate credentials. Which feature should be used to enable this?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is the correct feature because it allows partner users to access internal applications using their own corporate credentials (their home tenant identity) without requiring any external accounts or local user management. B2B collaboration uses cross-tenant trust relationships, enabling seamless single sign-on (SSO) via SAML/WS-Fed or OIDC protocols, which aligns with the requirement to use existing partner credentials.

Answer

Microsoft Entra B2C

Answer

Azure AD Connect

Answer

Tenant-to-tenant migration

Question 8

An organization uses Microsoft Entra ID. They want to ensure that users cannot install browser extensions from the Microsoft Edge Add-ons store on managed devices. Which Microsoft Entra ID feature should they use to enforce this policy?

Accepted Answer

Microsoft Entra ID device management with MDM/MAM policies. Microsoft Entra ID device management with MDM/MAM policies (Option C) is correct because browser extension restrictions for Microsoft Edge on managed devices are enforced through device compliance or app protection policies configured in Microsoft Intune, which is the core MDM/MAM service integrated with Entra ID. These policies can block installation from the Edge Add-ons store by using the 'Allow extensions from other stores' setting or by creating a custom OMA-URI policy to restrict extension installation. Conditional Access policies (Option A) control access based on signals like device compliance but cannot directly enforce device-level settings like browser extension installation.

Answer

Conditional Access policy

Answer

Microsoft Entra ID Identity Protection

Answer

Privileged Identity Management

Question 9

An organization uses Microsoft Entra ID P2 licenses. They want to implement a policy that forces users to perform multi-factor authentication (MFA) only when they sign in from an untrusted location. The trusted locations include the corporate office IP range. Which type of policy should they create?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID allow administrators to enforce MFA based on conditions like location. By configuring a policy that targets all users and cloud apps, with a condition excluding trusted IP ranges (corporate office), MFA is only triggered when sign-ins originate from untrusted locations. This is the precise mechanism for location-based MFA enforcement.

Answer

Identity Protection user risk policy

Answer

MFA registration policy

Answer

Authentication methods policy

Question 10

An organization uses Microsoft Entra ID with Pass-through Authentication (PTA) and Seamless Single Sign-On (SSO). They notice that password changes in on-premises Active Directory are not reflecting immediately in Microsoft Entra ID for some users. What is the most likely cause?

Accepted Answer

The user's password change has not replicated to all domain controllers. In a Pass-through Authentication environment, password changes are processed by on-premises Active Directory. The password change must replicate to all domain controllers before Microsoft Entra ID can authenticate the new password via the PTA agent. If replication is incomplete, the PTA agent may contact a domain controller that still has the old password, causing the delay.

Answer

The PTA agents are overloaded

Answer

The Seamless SSO feature is disabled

Answer

Microsoft Entra ID has a password hash sync delay