MS-102 Multiple Select — 10 Questions

Question 1

Which THREE steps are required to enable group-based licensing?

Accepted Answer

Add members to the group. Group-based licensing in Azure AD requires that you add members to the security group that will have the license assigned. Without members, the license assignment has no effect, as the license is applied to all users in the group. This step ensures that the intended users receive the license automatically based on group membership.

Answer

Configure Azure AD Connect

Answer

Ensure group is mail-enabled

Question 2

Your organization uses Microsoft Entra ID. You need to implement a solution that allows users to sign in without a password using their smartphone. Which TWO authentication methods can be used?

Accepted Answer

Microsoft Authenticator app (phone sign-in). The Microsoft Authenticator app supports phone sign-in, which allows users to authenticate by approving a notification or entering a number displayed on the screen, eliminating the need for a password. FIDO2 security keys enable passwordless authentication using hardware-based public/private key cryptography, meeting the requirement for smartphone-based sign-in when the key is connected via USB or NFC. Both methods are supported by Microsoft Entra ID for passwordless authentication.

Answer

Temporary Access Pass

Answer

Windows Hello for Business

Answer

Text message (SMS) verification code

Question 3

Your organization has a Microsoft 365 E5 tenant with Microsoft Defender for Cloud Apps. You need to discover and control the use of unsanctioned cloud apps. Which TWO actions should you take? (Choose two.)

Accepted Answer

Define sanctioned and unsanctioned app categories in Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps allows you to define sanctioned and unsanctioned app categories within the Cloud Discovery dashboard. By categorizing apps, you can apply governance actions such as blocking or monitoring, which directly controls the use of unsanctioned cloud apps. This is a foundational step in managing app usage, as it enables automated policies to enforce your organization's cloud app governance.

Answer

Deploy Microsoft Purview Data Loss Prevention policies

Answer

Configure Microsoft Entra ID App Registrations to log app usage

Answer

Create a Conditional Access policy to block all unsanctioned apps

Question 4

You are the Microsoft 365 Administrator for a multinational organization that must comply with various regulatory requirements, including GDPR, SOX, and internal data retention policies. You are deploying Microsoft Purview compliance solutions. Which four of the following actions are valid steps when managing compliance using Microsoft Purview? (Choose all that apply. There are four correct answers.)

Accepted Answer

Enable auditing in the Microsoft 365 compliance portal to track user activities such as file downloads and mailbox access.. Creating a DLP policy that prevents sharing credit card numbers via email with external recipients is a valid step because Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive information types (e.g., credit card numbers) and enforce actions such as blocking external sharing. This directly supports compliance with regulations like GDPR and SOX by preventing unauthorized data exfiltration.

Answer

Assign a retention policy to a user's mailbox that deletes all emails immediately after they are sent.

Answer

Apply a sensitivity label to a SharePoint site that blocks all external sharing of documents stored in that site.

Question 5

A global administrator at Fabrikam Inc. plans to implement Microsoft Purview to manage compliance for sensitive information. The solution must include the ability to discover, classify, and protect sensitive data across Microsoft 365 services. Which three of the following should the administrator configure? (Choose three.)

Accepted Answer

Create a sensitive information type to detect custom data patterns, such as employee IDs.. Creating a sensitive information type is correct because it allows the administrator to define custom patterns (e.g., employee IDs) that Microsoft Purview can use to discover and classify sensitive data across Microsoft 365 services. This is a foundational step for building compliance policies tailored to the organization's specific data.

Answer

Set up a data loss prevention (DLP) policy to block external sharing of files labeled as 'Highly Confidential'.

Answer

Enable Microsoft Purview Insider Risk Management to scan and label all historical email data.

Answer

Deploy Microsoft Purview eDiscovery to automatically classify all content in Microsoft Teams chats.

Question 6

You are configuring Microsoft Defender for Office 365. Which TWO actions should you take to protect users from phishing attacks that use impersonation?

Accepted Answer

Configure anti-phishing policies to protect users from impersonation of custom domains.. Options C and D are correct because anti-phishing policies can be configured to protect against impersonation of custom domains and internal users. Option A is wrong because DLP policies prevent sharing of sensitive data, not phishing. Option B is wrong because anti-spam policies handle spam, not impersonation. Option E is wrong because Safe Attachments scans files for malware, not phishing impersonation.

Answer

Create a data loss prevention (DLP) policy to prevent sharing of credentials.

Answer

Configure anti-spam policies to increase the spam confidence level.

Answer

Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams.

Question 7

You are planning the initial deployment of a new Microsoft 365 tenant for Contoso Ltd. Which three of the following actions are required or recommended as part of the tenant provisioning and initial configuration process? (Choose three.)

Accepted Answer

Register a custom domain name (e.g., contoso.com) and verify ownership via DNS TXT record.. Registering and verifying a custom domain (e.g., contoso.com) via a DNS TXT record is a required step to use your own domain for email and user identities instead of the default onmicrosoft.com domain. Creating the initial global administrator account with a strong password and enabling multi-factor authentication (MFA) is a critical security best practice and is recommended by Microsoft to protect the highest-privileged role. Configuring tenant-wide service settings, such as external sharing for SharePoint and OneDrive, is recommended during initial setup to align with organizational security and collaboration policies before users begin working.

Answer

Set up a secondary domain as the default email domain to avoid conflicts with the initial onmicrosoft.com domain.

Answer

Assign Microsoft 365 licenses to all user accounts before creating the accounts.

Answer

Configure the default tenant-level password expiration policy to 90 days using the Microsoft 365 admin center.

Question 8

Which TWO Microsoft Purview solutions can be used to detect and prevent the unauthorized sharing of sensitive information in Microsoft Teams messages?

Accepted Answer

Communication Compliance. DLP policies can scan Teams messages for sensitive content and block sharing. Communication Compliance can monitor messages for policy violations and take action. Sensitivity labels are for classification, not detection. Information Barriers restrict communication between groups. eDiscovery is for investigation after the fact.

Answer

eDiscovery (Premium)

Answer

Sensitivity labels

Answer

Information Barriers

Question 9

You are investigating an alert in Microsoft Defender XDR that indicates a user clicked a malicious link in an email. You need to gather additional information to determine the scope of the attack. Which three sources should you examine?

Accepted Answer

Email entity page. To fully investigate a phishing incident, you should examine the alert timeline for related events, the email entity page for email details, and the user entity page for user actions. Device timeline may not be relevant if the user only clicked a link without further action. The incidents page provides a summary but not detailed scope.

Answer

Incidents page

Answer

Device timeline

Question 10

Which THREE features are included in Microsoft Defender for Office 365 Plan 2 but NOT in Plan 1? (Choose three.)

Accepted Answer

Automated Investigation and Response (AIR). Options C, D, and E are correct. Plan 2 includes Automated Investigation and Response (AIR), Threat Explorer, and Attack Simulation Training. Plan 1 includes anti-phishing policies (A) and Safe Links (B), so they are not correct.

Answer

Anti-phishing policies

Answer

Safe Links