MS-102 Implement and manage identity and access in Microsoft Entra ID — Timed 15 Questions

Question 1

An organization has Microsoft Entra ID P2 licenses and wants to configure a Conditional Access policy to restrict access to Microsoft 365 services. Which of the following can be used as conditions in the policy? (Choose two that apply)

Accepted Answer

Device platform. Device platform is a valid condition in Microsoft Entra Conditional Access policies, allowing administrators to target specific operating systems such as Windows, macOS, iOS, or Android. This enables granular control over access based on the device type, which is essential for enforcing security requirements like requiring compliant devices on certain platforms.

Answer

Authentication strength

Answer

Application ID

Question 2

An organization with Microsoft Entra ID P2 licenses wants to require multi-factor authentication (MFA) for all users but allow them to register their authentication methods before being forced to use MFA. Which configuration should they implement?

Accepted Answer

Conditional Access policy with MFA grant and a registration campaign. Conditional Access policies can include a registration campaign for combined security info registration, allowing users to preregister MFA methods before the policy requiring MFA is enforced. This provides a smooth user experience. Security defaults enforce MFA immediately without a pre-registration period. Per-user MFA requires enabling MFA per user and does not include a registration campaign. Identity Protection user risk policy triggers MFA based on risk, not a blanket requirement.

Answer

Security defaults

Answer

Per-user MFA

Answer

Identity Protection user risk policy

Question 3

An organization wants to enforce that all administrators use a phishing-resistant authentication method (e.g., FIDO2 security keys or Windows Hello for Business) when accessing Microsoft 365 admin portals. Which Microsoft Entra ID feature should be used?

Accepted Answer

Conditional Access authentication strength. Option A is correct because Conditional Access authentication strength allows administrators to define and enforce specific authentication methods, such as FIDO2 security keys or Windows Hello for Business, which are phishing-resistant. By creating a policy that targets admin roles and requires an authentication strength policy that mandates these methods, the organization can ensure that only phishing-resistant credentials are accepted when accessing Microsoft 365 admin portals. This granular control goes beyond simple MFA enforcement by specifying the exact authentication method required.

Answer

Security defaults

Answer

Per-user MFA

Answer

Identity Protection

Question 4

An organization with Microsoft Entra ID P2 licenses needs to enforce that all users accessing the Azure portal must use FIDO2 security keys for multi-factor authentication. Which configuration should be implemented?

Accepted Answer

Configure an authentication strength policy that requires FIDO2 and assign it to a Conditional Access policy. Option C is correct because in Microsoft Entra ID, authentication strengths allow you to define a specific set of authentication methods (e.g., FIDO2 security keys) and then assign that strength to a Conditional Access policy. This ensures that only FIDO2 security keys are accepted for MFA when accessing the Azure portal, meeting the requirement precisely.

Answer

Create a Conditional Access policy that requires MFA and select FIDO2 as the authentication strength in the grant controls

Answer

Create a Conditional Access policy that requires MFA and set the grant control to require a specific device platform

Answer

Configure an authentication methods policy that allows only FIDO2 security keys

Question 5

An organization wants to enable users to reset their own passwords using the Microsoft Authenticator app and to prevent reuse of the last five passwords. Which Microsoft Entra ID features should be configured?

Accepted Answer

Self-Service Password Reset (SSPR) and Password Protection. The requirement to enable users to reset their own passwords via the Microsoft Authenticator app is fulfilled by Self-Service Password Reset (SSPR), which supports the Authenticator app as an authentication method. The requirement to prevent reuse of the last five passwords is fulfilled by Password Protection, specifically the password reuse policy within the custom banned password list or the enforcement of password history via on-premises integration. Option B correctly pairs these two features.

Answer

Microsoft Entra ID Protection and SSPR

Answer

Conditional Access and SSPR

Answer

Identity Governance and SSPR

Question 6

A company wants to ensure that all new users register for multi-factor authentication (MFA) within 14 days of account creation. Which Microsoft Entra ID feature should be used?

Accepted Answer

MFA registration campaign. The MFA registration campaign in Microsoft Entra ID is specifically designed to enforce user registration for MFA within a defined time frame, such as 14 days. It targets new users and sends them reminders to register, blocking access until registration is completed, which directly meets the company's requirement.

Answer

Conditional Access policy

Answer

Identity Protection

Answer

Access Reviews

Question 7

An organization has multiple Microsoft Entra ID tenants and wants to allow partner users to access internal applications using their own corporate credentials. Which feature should be used to enable this?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is the correct feature because it allows partner users to access internal applications using their own corporate credentials (their home tenant identity) without requiring any external accounts or local user management. B2B collaboration uses cross-tenant trust relationships, enabling seamless single sign-on (SSO) via SAML/WS-Fed or OIDC protocols, which aligns with the requirement to use existing partner credentials.

Answer

Microsoft Entra B2C

Answer

Azure AD Connect

Answer

Tenant-to-tenant migration

Question 8

An organization uses Microsoft Entra ID. They want to ensure that users cannot install browser extensions from the Microsoft Edge Add-ons store on managed devices. Which Microsoft Entra ID feature should they use to enforce this policy?

Accepted Answer

Microsoft Entra ID device management with MDM/MAM policies. Microsoft Entra ID device management with MDM/MAM policies (Option C) is correct because browser extension restrictions for Microsoft Edge on managed devices are enforced through device compliance or app protection policies configured in Microsoft Intune, which is the core MDM/MAM service integrated with Entra ID. These policies can block installation from the Edge Add-ons store by using the 'Allow extensions from other stores' setting or by creating a custom OMA-URI policy to restrict extension installation. Conditional Access policies (Option A) control access based on signals like device compliance but cannot directly enforce device-level settings like browser extension installation.

Answer

Conditional Access policy

Answer

Microsoft Entra ID Identity Protection

Answer

Privileged Identity Management

Question 9

An organization uses Microsoft Entra ID P2 licenses. They want to implement a policy that forces users to perform multi-factor authentication (MFA) only when they sign in from an untrusted location. The trusted locations include the corporate office IP range. Which type of policy should they create?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID allow administrators to enforce MFA based on conditions like location. By configuring a policy that targets all users and cloud apps, with a condition excluding trusted IP ranges (corporate office), MFA is only triggered when sign-ins originate from untrusted locations. This is the precise mechanism for location-based MFA enforcement.

Answer

Identity Protection user risk policy

Answer

MFA registration policy

Answer

Authentication methods policy

Question 10

An organization uses Microsoft Entra ID with Pass-through Authentication (PTA) and Seamless Single Sign-On (SSO). They notice that password changes in on-premises Active Directory are not reflecting immediately in Microsoft Entra ID for some users. What is the most likely cause?

Accepted Answer

The user's password change has not replicated to all domain controllers. In a Pass-through Authentication environment, password changes are processed by on-premises Active Directory. The password change must replicate to all domain controllers before Microsoft Entra ID can authenticate the new password via the PTA agent. If replication is incomplete, the PTA agent may contact a domain controller that still has the old password, causing the delay.

Answer

The PTA agents are overloaded

Answer

The Seamless SSO feature is disabled

Answer

Microsoft Entra ID has a password hash sync delay

Question 11

A company uses Microsoft Entra ID with conditional access policies. They need to ensure that all external users who are invited via B2B collaboration must perform multi-factor authentication (MFA) when accessing the corporate SharePoint Online site. Which two configurations are required? (Choose two.)

Accepted Answer

Create a conditional access policy targeting all guest users, requiring MFA, and scope to SharePoint Online.. Option A is correct because a conditional access policy in Microsoft Entra ID can be configured to target 'Guest or external users' (the 'All guest users' scope) and require multi-factor authentication (MFA) when accessing SharePoint Online. This directly enforces MFA for B2B collaboration users accessing the corporate SharePoint site, as the policy is evaluated at the resource tenant (the tenant hosting SharePoint).

Answer

Configure the SharePoint Online external sharing settings to require MFA for guest users.

Answer

Set the guest user access level in the SharePoint admin center to require MFA.

Question 12

An organization wants to allow users to sign in to Microsoft 365 using their on-premises Active Directory credentials but does not want to synchronize password hashes to the cloud. They also want to eliminate the need for users to re-enter their credentials when accessing cloud resources from domain-joined devices. Which combination of authentication methods should they implement?

Accepted Answer

Pass-through Authentication (PTA) with Seamless Single Sign-On (SSO). Pass-through Authentication (PTA) validates user passwords directly against on-premises Active Directory without storing password hashes in the cloud, satisfying the requirement to avoid hash synchronization. Seamless SSO eliminates the need for users to re-enter credentials on domain-joined devices by using Kerberos delegation to silently authenticate against Microsoft Entra ID, meeting both stated needs.

Answer

Federation with Active Directory Federation Services (AD FS)

Answer

Password Hash Sync (PHS) with Seamless SSO

Answer

Cloud-only authentication with MFA

Question 13

Contoso uses Microsoft Entra ID P1 licenses and has a dedicated corporate office with static public IP addresses. The company wants to require MFA for all users, but exempt users when they connect from the corporate office. Which configuration should the administrator implement?

Accepted Answer

Create a Conditional Access policy that targets all users, grant access requiring MFA, and exclude the corporate office location from the policy.. Option B is correct because a Conditional Access policy can target all users, require MFA as a grant control, and exclude the corporate office location (defined by static public IP addresses as a named location). This ensures MFA is enforced for all connections except those originating from the trusted corporate network, aligning with the requirement to exempt users at the office.

Answer

Create a Conditional Access policy that targets all users, grant access requiring MFA, and include the corporate office location as a condition.

Answer

Configure a Per-User MFA policy and add the corporate office IPs to a list of trusted IPs in the MFA settings.

Answer

Create a Conditional Access policy that targets the corporate office location and grant access with MFA for all other locations.

Question 14

A company invites external partners as B2B guest users in Microsoft Entra ID. The partners' home tenants do not support MFA. The company wants to require MFA when guests access an internal application. What should the company configure?

Accepted Answer

Configure a Conditional Access policy that targets all guest users, require MFA, and enable MFA registration for guests in the resource tenant.. Option A is correct because when guest users' home tenants do not support MFA, the resource tenant must enforce MFA directly. A Conditional Access policy targeting all guest users with 'Require MFA' grant control, combined with enabling MFA registration for guests in the resource tenant, allows guests to register and use MFA methods (e.g., Microsoft Authenticator) within the resource tenant. This ensures MFA is enforced regardless of the home tenant's capabilities.

Answer

Ask the partners to configure MFA in their home tenant, then trust their MFA claims.

Answer

Use a Per-User MFA policy for guest users, but guests cannot register for MFA in the resource tenant.

Answer

Create a Conditional Access policy requiring MFA for all external users, but exclude guests from known networks.

Question 15

A company uses Microsoft Entra ID with password hash synchronization. The security team wants to prevent users from setting passwords that include their username or common terms from a custom dictionary (e.g., company name, product names). Which feature should be configured?

Accepted Answer

Configure a custom banned passwords list in Microsoft Entra ID Password Protection.. Option B is correct because Microsoft Entra ID Password Protection allows administrators to enforce custom banned password lists that prevent users from including specific terms (e.g., company name, product names) or their username in passwords. This feature works with password hash synchronization to block weak passwords at the cloud level, directly addressing the security team's requirement.

Answer

Enable Azure AD Identity Protection with user risk policies.

Answer

Set a fine-grained password policy in on-premises Active Directory and sync it to Azure AD.

Answer

Enable MFA registration campaign to force users to register for MFA.