MS-102 Multiple Select — 10 Questions

Question 1

Administrators want to enforce multi-factor authentication (MFA) for all users when accessing cloud applications from untrusted networks. They plan to use Azure AD Conditional Access with named locations. Which two components must be configured to meet this requirement? (Select two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

named location for the corporate network. Option B is correct because a named location must be defined to represent the trusted corporate network, allowing the Conditional Access policy to distinguish trusted from untrusted networks and apply MFA only when users connect from outside that location. Option C is correct because a Conditional Access policy scoped to all cloud apps is required to enforce the MFA requirement across every cloud application users access. Together, the named location and the Conditional Access policy targeting all cloud apps satisfy the scenario's requirement to enforce MFA from untrusted networks. Option A is not a valid Microsoft Entra ID component; location-based conditions are configured within a Conditional Access policy using named locations, not as a standalone 'location policy.' Option D is incorrect because a policy targeting MFA registration addresses the registration experience for authentication methods, not the enforcement of MFA when accessing cloud applications.

Answer

location policy

Answer

Conditional Access policy targeting MFA registration

Question 2

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that detects when a user signs in from an unknown IP address and then downloads a large number of files. Which THREE components should you configure?

Accepted Answer

Scope (users and groups). The policy must be scoped to specific users or groups to ensure that the anomaly detection rule (unknown IP followed by mass download) applies only to the intended set of accounts. Without scoping, the policy would evaluate all users, which may generate excessive noise or miss targeted monitoring. In Microsoft Defender for Cloud Apps, the Scope (users and groups) setting is a required component when creating an anomaly detection policy to define which identities are monitored.

Answer

IP address range category

Answer

Session policy

Question 3

Your organization is planning to migrate from on-premises Exchange to Exchange Online. You need to choose a migration strategy. Which TWO statements about migration methods are correct?

Accepted Answer

A minimal hybrid deployment allows you to manage mailboxes in both on-premises and Exchange Online.. A minimal hybrid deployment uses Microsoft Entra Connect to synchronize on-premises Active Directory with Microsoft Entra ID, enabling centralized management of mailboxes across both environments. This allows administrators to manage on-premises and Exchange Online mailboxes from a single Exchange admin center, making option B correct.

Answer

A hybrid migration requires that you do not synchronize on-premises Active Directory with Microsoft Entra ID.

Answer

A staged migration can be used to migrate mailboxes from Exchange 2019 to Exchange Online.

Answer

An IMAP migration migrates email, contacts, and calendar data.

Question 4

Your organization uses Microsoft Defender for Endpoint. You need to configure advanced hunting to query device information. Which TWO tables contain device-related data?

Accepted Answer

DeviceInfo. DeviceInfo is correct because it is the primary table in Microsoft Defender for Endpoint advanced hunting that stores comprehensive device metadata, including OS version, device name, and sensor health. This table is essential for querying device-related information such as device inventory, onboarding status, and configuration details.

Answer

AlertInfo

Answer

EmailEvents

Answer

IdentityLogonEvents

Question 5

Which THREE features are part of Microsoft Defender XDR? (Select THREE.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender XDR is a unified security solution that integrates signals from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and others. The correct answers are B, C, and E. Option A (Microsoft Purview) is a data governance and compliance solution, not part of Defender XDR. Option D (Microsoft Sentinel) is a separate cloud-native SIEM and SOAR solution.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Question 6

Which THREE are features of Microsoft Entra ID Governance? (Choose three.)

Accepted Answer

Entitlement management. Entitlement management is a core feature of Microsoft Entra ID Governance that enables organizations to manage the lifecycle of access for internal and external users through access packages, catalogs, and policies. It automates access requests, approvals, and assignments, ensuring users have the right access to resources like groups, apps, and SharePoint sites.

Answer

Password protection

Answer

Conditional access policies

Question 7

Which THREE conditions can be used in a dynamic group rule for a device?

Accepted Answer

deviceModel. `deviceModel` is a valid attribute that can be used in a dynamic group rule for devices in Microsoft Entra ID (formerly Azure AD). Dynamic group rules for devices support attributes such as `deviceModel`, `deviceCategory`, and `deviceOSVersion` to automatically include or exclude devices based on their hardware or software characteristics.

Answer

lastLogonTimestamp

Answer

passwordLastSet

Question 8

You are the Microsoft 365 Administrator for a multinational organization that must comply with various regulatory requirements, including GDPR, SOX, and internal data retention policies. You are deploying Microsoft Purview compliance solutions. Which four of the following actions are valid steps when managing compliance using Microsoft Purview? (Choose all that apply. There are four correct answers.)

Accepted Answer

Create a DLP policy that prevents users from sharing credit card numbers via email with external recipients.. Creating a DLP policy that prevents sharing credit card numbers via email with external recipients is a valid step because Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive information types (e.g., credit card numbers) and enforce actions such as blocking external sharing. This directly supports compliance with regulations like GDPR and SOX by preventing unauthorized data exfiltration.

Answer

Assign a retention policy to a user's mailbox that deletes all emails immediately after they are sent.

Answer

Apply a sensitivity label to a SharePoint site that blocks all external sharing of documents stored in that site.

Question 9

You are planning the initial deployment of a new Microsoft 365 tenant for Contoso Ltd. Which three of the following actions are required or recommended as part of the tenant provisioning and initial configuration process? (Choose three.)

Accepted Answer

Create the initial global administrator account with a strong, unique password and enable multi-factor authentication.. Registering and verifying a custom domain (e.g., contoso.com) via a DNS TXT record is a required step to use your own domain for email and user identities instead of the default onmicrosoft.com domain. Creating the initial global administrator account with a strong password and enabling multi-factor authentication (MFA) is a critical security best practice and is recommended by Microsoft to protect the highest-privileged role. Configuring tenant-wide service settings, such as external sharing for SharePoint and OneDrive, is recommended during initial setup to align with organizational security and collaboration policies before users begin working.

Answer

Assign Microsoft 365 licenses to all user accounts before creating the accounts.

Answer

Configure the default tenant-level password expiration policy to 90 days using the Microsoft 365 admin center.

Answer

Set up a secondary domain as the default email domain to avoid conflicts with the initial onmicrosoft.com domain.

Question 10

Which TWO are valid methods for adding custom domains to Microsoft 365?

Accepted Answer

Using the New-MsolDomain PowerShell cmdlet.. Option A is correct because the New-MsolDomain cmdlet from the MSOnline PowerShell module is a supported programmatic way to add a custom domain to a Microsoft 365/Microsoft Entra ID tenant, specifying parameters such as -Name for the domain. Option D is correct because the 'Add domain' wizard in the Microsoft 365 admin center is the primary GUI method for adding a custom domain, after which it provides the required DNS TXT or MX records for verification. Option B is incorrect because the Exchange admin center manages Exchange Online recipients, mailboxes, and accepted domains for mail flow, but it is not the supported tool for adding a new custom domain to the tenant. Option C is incorrect because Azure AD B2C is a separate customer identity service with its own tenant configuration and is unrelated to adding domains to a standard Microsoft 365 tenant. Option E is incorrect because Windows DNS Manager only manages DNS zones and records on a DNS server; it cannot add a domain to Microsoft 365, though it may be used to create the verification records if the domain is hosted on that DNS server.

Answer

Using the Exchange admin center (EAC).

Answer

Using the Azure AD B2C tenant configuration.

Answer

Using the Windows DNS Manager console.