MS-102 Timed Practice Test 1 — 10 Questions

Question 1

A company has a hybrid identity with password hash synchronization. They want to ensure that any user whose account is disabled in on-premises Active Directory is automatically prevented from signing in to Microsoft 365. How can this be achieved?

Accepted Answer

Ensure Microsoft Entra Connect is configured to synchronize the disabled status; this happens automatically.. Option A is correct because Microsoft Entra Connect (formerly Azure AD Connect) by default synchronizes the `userAccountControl` attribute from on-premises Active Directory, which includes the disabled status (bit 2, ACCOUNTDISABLE). When an on-premises user account is disabled, the corresponding `accountEnabled` attribute in Microsoft Entra ID is set to `false`, preventing sign-in to Microsoft 365 without additional configuration.

Answer

Create a dynamic group based on accountEnabled attribute and apply a Conditional Access policy to block access.

Answer

Run a PowerShell script daily to disable matching accounts in Microsoft Entra ID.

Answer

Enable cloud HR provisioning.

Question 2

A company is deploying Microsoft 365 and wants to ensure that users in the finance department have access to only the apps they need. You need to recommend a licensing strategy that minimizes administrative overhead while enforcing access restrictions. What should you do?

Accepted Answer

Create a dynamic Azure AD group based on department attribute and assign licenses using group-based licensing.. Option B is correct because using a dynamic Azure AD group based on the department attribute automates membership updates as users change departments, and group-based licensing assigns the appropriate licenses to all members without manual intervention. This minimizes administrative overhead by eliminating the need to manually add or remove users from the group or assign licenses individually, while enforcing access restrictions by ensuring only finance users receive the licensed apps.

Answer

Create a security group with explicit membership and assign licenses to the group.

Answer

Assign licenses to users one by one in the Microsoft 365 admin center.

Answer

Use PowerShell to assign licenses based on user department attribute.

Question 3

An administrator wants to add a custom domain 'fabrikam.com' to a new Microsoft 365 tenant. What is the first step the administrator should perform?

Accepted Answer

Add the domain in the Microsoft 365 admin center.. The first step to add a custom domain to a Microsoft 365 tenant is to add the domain in the Microsoft 365 admin center. This initiates the domain verification process, where Microsoft provides a TXT record or MX record that the administrator must add to the domain's DNS hosting provider to prove ownership. Without completing this verification step, no other domain-related configurations (such as SPF, MX records, or user licensing) can proceed.

Answer

Create an SPF record for the domain.

Answer

Create a MX record pointing to Exchange Online.

Answer

Assign Microsoft 365 licenses to users with @fabrikam.com addresses.

Question 4

A company wants to implement just-in-time (JIT) privileged access for the Global Administrator role in Microsoft Entra ID. Users must request activation and provide a business justification. The request must be approved by a separate group of approvers, and the role activation should expire after 4 hours. Which Microsoft Entra feature should the administrator configure?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access by allowing users to activate roles like Global Administrator with a business justification, requiring approval from a designated group of approvers, and setting a configurable activation duration (e.g., 4 hours). This directly matches the company's requirements for time-bound, approved role activation.

Answer

Identity Protection

Answer

Conditional Access

Answer

Access Reviews

Question 5

A company recently added the custom domain 'contoso.com' to their Microsoft 365 tenant. Users report that they cannot receive external email sent to their new domain addresses. The administrator confirmed that the domain status shows 'Active' in the Microsoft 365 admin center. What is the most likely cause of this issue?

Accepted Answer

The MX record for the domain is missing or points to an incorrect mail server.. The domain status 'Active' in the Microsoft 365 admin center indicates that the domain has been successfully verified and added to the tenant. However, for external email to be delivered to users at that domain, the public MX record in DNS must point to Microsoft 365's mail servers (e.g., contoso-com.mail.protection.outlook.com). If the MX record is missing or points to an incorrect server, external senders cannot route email to the tenant, even though the domain is verified and active.

Answer

The domain was not verified with a TXT record.

Answer

The SPF record for the domain is missing or incorrectly configured.

Answer

The custom domain was not added to the user's primary email address.

Question 6

A company uses Azure AD Connect with password hash synchronization. They want to enable Azure AD Seamless Single Sign-On (SSO) for users accessing Microsoft 365 from domain-joined devices on the corporate network. Which configuration is required on the on-premises Active Directory?

Accepted Answer

Create a computer account named AZUREADSSOACC in each AD forest. Azure AD Seamless SSO requires a computer account named AZUREADSSOACC to be created in each on-premises AD forest. This account is used by Azure AD to sign Kerberos tickets for users accessing Microsoft 365 resources, enabling automatic sign-in without password prompts. The account must be created in the root domain of each forest and its password is managed automatically by Azure AD Connect.

Answer

Install Azure AD Connect on a separate server

Answer

Enable Passthrough Authentication

Answer

Set the service connection point in Active Directory

Question 7

A company uses Microsoft Entra ID P1 licenses. They want to enforce multi-factor authentication (MFA) for all users accessing a critical cloud application. However, they have a group of service accounts that cannot perform MFA and must be excluded. What is the recommended approach?

Accepted Answer

Create a Conditional Access policy that targets the application, requires MFA, and excludes the service account group. Conditional Access policies allow granular control by targeting specific cloud applications and requiring MFA, while excluding groups like service accounts that cannot perform MFA. This approach is the recommended method because it avoids the limitations of per-user MFA (which is deprecated) and Security Defaults (which cannot exclude specific accounts).

Answer

Enable per-user MFA for all users, then disable it for each service account

Answer

Enable Security Defaults

Answer

Use Identity Protection risk policies

Question 8

A company uses Azure AD Identity Protection. The security team wants to automatically block sign-ins that are detected as coming from a known malicious IP address. Which policy should be configured?

Accepted Answer

Sign-in risk policy. The Sign-in risk policy in Azure AD Identity Protection is specifically designed to respond to risks detected during the authentication attempt, such as sign-ins from known malicious IP addresses. When a sign-in is flagged as having a high risk level (e.g., from a known malicious IP), the policy can be configured to automatically block the sign-in. This directly addresses the security team's requirement to block sign-ins from malicious IPs.

Answer

User risk policy

Answer

MFA registration policy

Answer

Identity Protection vulnerabilities policy

Question 9

A company uses Microsoft Entra ID P1 licenses. They want to allow access to a sensitive cloud application only from the company's trusted office IP ranges (10.0.0.0/24). However, the executive team (group "Execs") must be able to access the app from any location. Which Conditional Access policy configuration should the administrator use?

Accepted Answer

B: Include all users, exclude Execs group, and block access with condition 'Location not in trusted locations'.. Option B is correct because the requirement is to block access from untrusted locations for all users except the Execs group. By including all users, excluding the Execs group, and setting a block control with the condition 'Location not in trusted locations', the policy ensures that only non-Exec users are blocked when accessing from outside the trusted IP range, while Execs remain unrestricted. This aligns with the principle of explicitly blocking unwanted access rather than granting access with conditions that could be bypassed.

Answer

A: Include all users, exclude Execs group, and grant access with condition 'Location not in trusted locations'.

Answer

C: Include Execs group, exclude all others, and grant access with condition 'Location in trusted locations'.

Answer

D: Include all users, include Execs group as an additional condition, and grant access with condition 'Location in trusted locations'.

Question 10

A company plans to enable Self-Service Password Reset (SSPR) for all users. The administrator must ensure that users are required to register at least two authentication methods: one from the 'mobile app' category and one from the 'phone call' category. Which combination of methods should the administrator select in the SSPR registration settings?

Accepted Answer

Mobile app notification and office phone. Option A is correct because the SSPR registration policy requires users to select at least two distinct authentication methods from the allowed list. By choosing 'Mobile app notification' (from the mobile app category) and 'Office phone' (from the phone call category), the administrator satisfies the requirement of one method from each specified category. The 'Office phone' option is classified under the 'phone call' category in Microsoft Entra ID SSPR settings.

Answer

Mobile app notification and mobile app code

Answer

Office phone and mobile phone

Answer

Mobile phone and email