MS-102 Multiple Select — 30 Questions

Question 1

A security administrator needs to block unsanctioned cloud apps in real time using a reverse proxy. Which two Microsoft Defender for Cloud Apps components must be configured?

Accepted Answer

Conditional Access App Control. Conditional Access App Control (B) is the reverse proxy component in Microsoft Defender for Cloud Apps that enforces real-time session-level monitoring and control of cloud app access. Session control policies (D) are the specific policy objects that define the actions (e.g., block download, block access) applied through that reverse proxy. Together, they enable blocking unsanctioned cloud apps in real time by intercepting user traffic via the reverse proxy architecture.

Answer

Cloud Discovery

Answer

App governance

Question 2

Administrators want to enforce multi-factor authentication (MFA) for all users when accessing cloud applications from untrusted networks. They plan to use Azure AD Conditional Access with named locations. Which two components must be configured to meet this requirement? (Select two.)

Accepted Answer

named location for the corporate network. Option B is correct because named locations in Azure AD Conditional Access allow administrators to define trusted network boundaries, such as the corporate network's public IP range. By marking this named location as a trusted location, the Conditional Access policy can then require MFA when users access cloud applications from any network that is not the corporate network, effectively enforcing MFA from untrusted networks.

Answer

location policy

Answer

Conditional Access policy targeting MFA registration

Question 3

A security administrator needs to discover which cloud apps are being used in the organization and then block usage of unsanctioned apps in real time using a reverse proxy. Which two Microsoft Defender for Cloud Apps features must be configured to meet these requirements? (Select all that apply.)

Accepted Answer

Cloud Discovery. Cloud Discovery (A) is correct because it analyzes traffic logs from your network to identify all cloud apps in use, providing visibility into sanctioned and unsanctioned apps. Conditional Access App Control (C) is correct because it enforces real-time access controls via a reverse proxy, allowing you to block unsanctioned apps as users attempt to access them.

Answer

App Connectors

Answer

API connectors

Question 4

Which THREE steps are required to enable group-based licensing?

Accepted Answer

Add members to the group. Option B is correct because group-based licensing in Azure AD requires that you add members to the security group that will have the license assigned. Without members, the license assignment has no effect, as the license is applied to all users in the group. This step ensures that the intended users receive the license automatically based on group membership.

Answer

Configure Azure AD Connect

Answer

Ensure group is mail-enabled

Question 5

A compliance officer needs to automatically apply a retention label to documents in a SharePoint Online document library that contain the exact phrase 'Project Alpha'. The label must retain the documents for 5 years and then delete them. Which two Microsoft Purview components must be configured to achieve this? (Choose two.)

Accepted Answer

retention label configured with a retention action. Option A is correct because a retention label configured with a retention action (retain for 5 years, then delete) defines the specific retention and disposition behavior required by the compliance officer. This label is the policy object that enforces the lifecycle rule on documents in SharePoint Online.

Answer

sensitivity label configured with a retention marking

Answer

Data Loss Prevention (DLP) policy with a condition matching 'Project Alpha'

Question 6

Your organization uses Microsoft Entra ID and wants to implement least-privilege administrative access for managing Microsoft 365 services. Which three of the following should you configure? (Choose three.)

Accepted Answer

Enable Microsoft Entra ID Privileged Identity Management (PIM) for eligible role activations. Null is correct because creating custom administrative units (AUs) allows you to delegate scoped administrative permissions to specific subsets of users, devices, or groups within a single Microsoft Entra ID tenant. Assigning Microsoft 365 built-in roles via Microsoft Entra ID role-based access control (RBAC) provides granular, least-privilege permissions without granting full global admin access. Enabling Microsoft Entra ID Privileged Identity Management (PIM) for eligible role activations ensures that administrative roles are activated only when needed, with time-bound approvals and just-in-time access, reducing standing privileges.

Answer

Configure Microsoft Intune to enforce mobile device management (MDM) for all admin devices

Answer

Use Microsoft Entra ID Conditional Access to block all external access for admins

Answer

Implement Microsoft 365 Defender for Cloud Apps session policies for admins

Question 7

You are implementing Microsoft Entra ID governance for a large enterprise. Which three of the following can be used to enforce access recertification and lifecycle management for users and groups? (Choose three.)

Accepted Answer

Microsoft Entra ID Identity Governance entitlement management. Microsoft Entra ID Governance access reviews are correct because they enable administrators to create recurring reviews for group memberships, application access, and role assignments, ensuring that only authorized users retain access. Entitlement management is correct as it automates the lifecycle of access packages, including expiration and recertification policies for groups and applications. Lifecycle workflows are correct because they automate user lifecycle events (e.g., onboarding, offboarding, group membership changes) based on triggers like time-based conditions, enforcing recertification and lifecycle management.

Answer

Microsoft Entra ID Privileged Identity Management (PIM) activation settings

Answer

Microsoft Entra ID Conditional Access policies

Answer

Microsoft Entra ID multi-factor authentication (MFA) registration campaign

Question 8

You are the Microsoft 365 Administrator for a multinational organization. You need to manage user accounts, groups, licensing, and support. Which four of the following actions are valid and recommended practices? (Choose four.)

Accepted Answer

Assign licenses to a security group to automatically license all current and future members.. Assigning licenses to a security group is a valid and recommended practice because it automates license assignment for all current and future members of the group, reducing manual overhead and ensuring compliance. This leverages group-based licensing in Microsoft Entra ID, which supports both direct and dynamic group membership.

Answer

Permanently delete a user account immediately after the user leaves the company to free up the license.

Answer

Convert a distribution group to a security group by editing its properties in the Microsoft 365 admin center.

Question 9

As a security administrator, you are tuning automated investigation and response (AIR) capabilities in Microsoft Defender XDR. You need to ensure that the system can automatically remediate threats while minimizing false positives. Which three of the following actions can be taken by automated investigation and response in Microsoft Defender XDR? (Choose three.)

Accepted Answer

Quarantine a file detected as malicious on a device. Automated investigation and response (AIR) in Microsoft Defender XDR can quarantine a file detected as malicious on a device by using built-in remediation actions that isolate the file from the operating system. It can also disable a compromised user account temporarily through integration with Microsoft Entra ID, applying a conditional account disable action to prevent further access. Additionally, AIR can delete an email message from a user's mailbox that was identified as phishing by leveraging Exchange Online Protection (EOP) and Microsoft Defender for Office 365 to perform mailbox-level remediation.

Answer

Modify a Conditional Access policy to block all external access

Answer

Uninstall an application from all devices in a tenant

Answer

Reset a user's password without administrator approval

Question 10

A company uses Microsoft Entra ID with conditional access policies. They need to ensure that all external users who are invited via B2B collaboration must perform multi-factor authentication (MFA) when accessing the corporate SharePoint Online site. Which two configurations are required? (Choose two.)

Accepted Answer

Create a conditional access policy targeting all guest users, requiring MFA, and scope to SharePoint Online.. Option A is correct because a conditional access policy in Microsoft Entra ID can be configured to target 'Guest or external users' (the 'All guest users' scope) and require multi-factor authentication (MFA) when accessing SharePoint Online. This directly enforces MFA for B2B collaboration users accessing the corporate SharePoint site, as the policy is evaluated at the resource tenant (the tenant hosting SharePoint).

Answer

Configure the SharePoint Online external sharing settings to require MFA for guest users.

Answer

Set the guest user access level in the SharePoint admin center to require MFA.

Question 11

A compliance officer wants to automatically apply a 'Confidential' sensitivity label to documents in SharePoint Online that contain credit card numbers. Which two Microsoft Purview features must be configured together? (Choose two.)

Accepted Answer

Data Loss Prevention (DLP) policy. To automatically apply a 'Confidential' sensitivity label to documents containing credit card numbers in SharePoint Online, you must configure a sensitivity label with auto-labeling (client-side or service-side) to detect the sensitive content, and a Data Loss Prevention (DLP) policy to enforce the labeling action. The DLP policy can be set to automatically apply the sensitivity label when credit card patterns are matched, using the same sensitive info types as auto-labeling. Together, they ensure that content is both classified and protected at rest.

Answer

Retention label policy

Answer

Microsoft Purview Information Protection scanner

Question 12

A Microsoft Purview auto-labeling policy for sensitivity labels is matching too many SharePoint documents after simulation. Which two changes would most directly reduce false positives before enabling automatic labeling? (Choose two.)

Accepted Answer

Increase the confidence level or instance-count requirement for the sensitive information type. Increasing the confidence level or instance-count requirement for the sensitive information type (SIT) directly reduces false positives by raising the threshold for what qualifies as a match. A higher confidence level means the classification engine requires stronger evidence (e.g., more keywords or a closer proximity to a pattern), while a higher instance count requires the sensitive data to appear multiple times in the document. Both adjustments make the auto-labeling rule more selective, ensuring only documents with a high likelihood of containing the specified sensitive content are labeled.

Answer

Turn on automatic labeling immediately and wait for users to report problems

Answer

Replace the sensitivity label with a retention label

Question 13

A company wants to enable self-service password reset (SSPR) for all users. Which two configurations are mandatory to allow users to reset their own passwords? (Choose two.)

Accepted Answer

A: Enable SSPR for 'All' users.. Option A is correct because enabling SSPR for 'All' users is a mandatory configuration that ensures every user in the tenant is licensed and permitted to use self-service password reset. Without this setting, SSPR would not be activated for the intended user population, even if authentication methods are configured.

Answer

C: Configure a custom helpdesk URL.

Answer

D: Enforce registration after 30 days.

Question 14

A security administrator is configuring Microsoft Defender for Cloud Apps. The administrator needs to discover which cloud apps are being used in the organization and then block usage of unsanctioned apps in real time using a reverse proxy. Which two Defender for Cloud Apps features must be configured? (Select the two correct options.)

Accepted Answer

Cloud Discovery. Cloud Discovery is the correct feature because it identifies which cloud apps are in use by analyzing traffic logs from the organization's network. This provides the visibility needed to determine which apps are unsanctioned. Conditional Access App Control is the correct feature because it uses a reverse proxy to enforce real-time access controls, blocking unsanctioned apps at the session level.

Answer

App governance

Answer

OAuth app permissions

Question 15

Contoso wants to require multi-factor authentication (MFA) for all users when accessing cloud applications from any network except the corporate headquarters (trusted IP range). They plan to use Azure AD Conditional Access. Which two components must be configured to achieve this requirement? (Select all that apply.)

Accepted Answer

Conditional Access policy targeting all users and cloud apps, with conditions for locations. Option A is correct because a Conditional Access policy must be created to enforce MFA based on location conditions. The policy targets all users and cloud apps, and uses the 'locations' condition to exclude the trusted IP range (corporate headquarters) while requiring MFA for all other locations. This ensures MFA is triggered only when access originates from outside the trusted network.

Answer

An Identity Protection user risk policy

Answer

An MFA registration policy requiring users to register for MFA

Question 16

An organization has Microsoft Entra ID P2 licenses and wants to configure a Conditional Access policy to restrict access to Microsoft 365 services. Which of the following can be used as conditions in the policy? (Choose two that apply)

Accepted Answer

Device platform. Device platform is a valid condition in Microsoft Entra Conditional Access policies, allowing administrators to target specific operating systems such as Windows, macOS, iOS, or Android. This enables granular control over access based on the device type, which is essential for enforcing security requirements like requiring compliant devices on certain platforms.

Answer

Authentication strength

Answer

Application ID

Question 17

Which TWO actions can an admin take to reduce the number of passwords in use for end users?

Accepted Answer

Enable Windows Hello for Business. Windows Hello for Business replaces traditional password authentication with strong two-factor authentication tied to a user's device, using biometrics or a PIN. This directly reduces the reliance on passwords for end users by enabling passwordless sign-in to Windows devices and integrated applications.

Answer

Enforce complex password policies

Answer

Configure self-service password reset

Answer

Implement password hash sync

Question 18

Which THREE conditions can be used in a dynamic group rule for a device?

Accepted Answer

deviceModel. Option A is correct because `deviceModel` is a valid attribute that can be used in a dynamic group rule for devices in Microsoft Entra ID (formerly Azure AD). Dynamic group rules for devices support attributes such as `deviceModel`, `deviceCategory`, and `deviceOSVersion` to automatically include or exclude devices based on their hardware or software characteristics.

Answer

lastLogonTimestamp

Answer

passwordLastSet

Question 19

Which TWO roles can manage user licenses without being able to create users?

Accepted Answer

License Administrator. The License Administrator role in Microsoft 365 is specifically designed to allow users to manage licenses assigned to users and groups without having permissions to create new user accounts. This role grants access to the Microsoft 365 admin center's Billing > Licenses section and the Azure AD Licenses blade, enabling license assignment, removal, and consumption monitoring, but it explicitly excludes user creation or deletion capabilities.

Answer

Global Administrator

Answer

User Administrator

Answer

Helpdesk Administrator

Question 20

Which TWO actions can a Microsoft 365 global administrator perform in the Microsoft 365 admin center to manage user accounts? (Choose two.)

Accepted Answer

Assign admin roles to a user.. In the Microsoft 365 admin center, a global administrator can assign admin roles to a user by navigating to Active users, selecting the user, and choosing 'Manage roles'. This is a core identity management task that allows delegation of administrative privileges within the tenant. Option C is also correct because resetting a user's password is a standard user management action available in the same interface.

Answer

Recover a deleted user account.

Answer

Manage the service health of Microsoft 365.

Answer

Create mailbox delegation permissions.