MS-102 Timed Practice Test 1 — 10 Questions

Question 1

Your company uses Microsoft Entra ID and has a hybrid identity with PHS. You need to ensure that when an on-premises user account is disabled, the corresponding cloud user is also blocked from signing in within 5 minutes. What should you configure?

10 minute time limit — choose an answer to begin.

Accepted Answer

Deploy Azure AD Connect cloud sync. Microsoft Entra Connect cloud sync can be configured to synchronize the on-premises Active Directory 'userAccountControl' attribute, which includes the 'ACCOUNTDISABLE' flag. When an on-premises user account is disabled, this flag changes, and cloud sync can trigger a block on the corresponding cloud user's sign-in within a few minutes (typically under 5 minutes) due to its near-real-time sync cycle. This meets the requirement without relying on the slower default sync interval of Microsoft Entra Connect.

Answer

Enable password writeback

Answer

Configure Azure AD Connect to sync the 'userAccountControl' attribute

Answer

Configure Microsoft Entra Connect Sync to use filtered synchronization

Question 2

An administrator adds the custom domain 'fabrikam.com' to a new Microsoft 365 tenant. After adding the domain, the status shows 'Pending verification'. Which type of DNS record must be added to the public DNS zone to complete domain ownership verification?

Accepted Answer

TXT record. To verify domain ownership in Microsoft 365, you must add a TXT record with a specific verification value provided by the Microsoft 365 admin center to the public DNS zone. This proves you control the domain because only the domain owner can modify DNS records. Other record types like MX, CNAME, or SPF are used for mail routing or service configuration, not for ownership verification.

Answer

MX record

Answer

CNAME record

Answer

SPF record

Question 3

Your company recently acquired a subsidiary that uses a different Microsoft 365 tenant. You are tasked with merging the two tenants into one. The subsidiary has 1,500 users with unique email domains. You need to migrate all users, mailboxes, and SharePoint data while minimizing downtime and preserving data integrity. You have access to both tenants as global admin. What should you do first?

Accepted Answer

Use a third-party migration tool such as BitTitan MigrationWiz to perform the migration. Microsoft does not provide a native tool for merging two tenants; third-party tools like BitTitan MigrationWiz are designed specifically for cross-tenant migrations, supporting mailbox, SharePoint, and user data migration with minimal downtime and data integrity. These tools handle directory synchronization, mailbox rehydration, and SharePoint content mapping, which are critical for a 1,500-user migration with unique domains.

Answer

Add the subsidiary's domain to the primary tenant, then delete the subsidiary tenant and recreate users

Answer

Use the Microsoft 365 Merger Center in the admin portal

Answer

Use Microsoft's native tenant-to-tenant migration by moving mailboxes via PowerShell and exporting SharePoint content

Question 4

You need to configure self-service password reset (SSPR) for users in Microsoft Entra ID. Which license is required?

Accepted Answer

Microsoft Entra ID P1. Self-service password reset (SSPR) requires a Microsoft Entra ID P1 or P2 license. Both Microsoft 365 F3 and Microsoft 365 E3 include Microsoft Entra ID P1 licenses, which support SSPR. However, the question directly asks which license is required for SSPR, and the correct answer is the standalone Microsoft Entra ID P1 license. While F3 and E3 include this license, they are suite licenses and not the specific license component being asked for.

Answer

Microsoft 365 F3

Answer

Microsoft 365 E3

Answer

Microsoft Entra ID Free

Question 5

You are deploying a new Microsoft 365 tenant for a company that has a single domain, contoso.com. You need to verify domain ownership to enable email routing. Which DNS record type must you add to the public DNS zone?

Accepted Answer

TXT record with a verification code provided by Microsoft 365.. To verify domain ownership in Microsoft 365, you must add a TXT record containing a unique verification code provided by the Microsoft 365 admin center to your public DNS zone. This proves you control the domain, enabling email routing and other services. Other DNS records like CNAME, SPF, or MX are used for service configuration, not ownership verification.

Answer

CNAME record with 'autodiscover' pointing to 'autodiscover.outlook.com'.

Answer

SPF record including Microsoft 365 IP addresses.

Answer

MX record pointing to Microsoft 365.

Question 6

Your organization uses Microsoft 365 E5 licenses for all users. You need to configure role-based access control (RBAC) so that helpdesk staff can reset passwords and manage licenses, but cannot modify user principal names (UPNs) or delete users. Which role assignment should you use?

Accepted Answer

Helpdesk Administrator. The Helpdesk Administrator role is correct because it grants the specific permissions needed to reset passwords and manage licenses, while explicitly preventing modifications to user principal names (UPNs) and user deletions. This role is designed for tier-1 support staff who require these capabilities without elevated user management rights.

Answer

License Administrator

Answer

Password Administrator

Answer

User Administrator

Question 7

A company needs to ensure that only users from specific IP ranges can access Exchange Online. Which tool should be used?

Accepted Answer

Azure AD Conditional Access with Named Locations. Microsoft Entra Conditional Access with Named Locations is the correct tool because it allows administrators to define trusted IP ranges as named locations and then enforce access policies that restrict Exchange Online access to only those IP ranges. This integrates directly with Microsoft Entra ID authentication, evaluating the user's IP address during sign-in to grant or block access based on the policy.

Answer

Security & Compliance Center

Answer

Multi-factor authentication

Answer

Azure AD Connect

Question 8

An admin needs to provide a vendor with temporary access to a SharePoint site. What should the admin create?

Accepted Answer

Guest user in Azure AD. A is correct because creating a guest user in Microsoft Entra ID is the proper method to grant external users access to SharePoint Online resources with controlled permissions. Guest users are invited via Microsoft Entra B2B collaboration, which allows the admin to assign specific SharePoint site permissions while maintaining oversight and the ability to revoke access. This approach ensures the vendor has a distinct identity for auditing and conditional access policies.

Answer

Anonymous sharing link

Answer

Security group

Answer

New user in your domain

Question 9

You are the Microsoft 365 administrator for a company with a hybrid identity configuration using Azure AD Connect. The company has a custom domain 'contoso.com' federated with Active Directory Federation Services (ADFS). All users are synced from on-premises Active Directory. The security team wants to implement Microsoft Entra ID Protection to detect risky sign-ins. However, they are concerned that federated authentication bypasses some risk detection capabilities. You need to ensure that Microsoft Entra ID Protection can evaluate risk for all sign-ins, including federated ones. What should you do?

Accepted Answer

Switch from federated authentication to Pass-through Authentication (PTA) or Password Hash Sync (PHS).. Microsoft Entra ID Protection relies on signals such as IP addresses, device information, and sign-in patterns to calculate risk. In a federated setup with ADFS, the authentication happens on-premises, and Microsoft Entra ID only receives a token—not the raw sign-in details needed for real-time risk evaluation. Switching to Pass-through Authentication (PTA) or Password Hash Sync (PHS) ensures that the authentication process flows through Microsoft Entra ID directly, allowing Entra ID Protection to capture and analyze all sign-in events, including those from federated users.

Answer

Configure the federated trust in Microsoft Entra ID to use the new claims.

Answer

Configure ADFS to send the ipaddr and xms_ep claims to Azure AD.

Answer

Enable Azure AD Application Proxy to publish ADFS internally.

Question 10

Your organization uses Microsoft Entra ID P2 and Microsoft Defender for Cloud Apps. You need to protect a custom SaaS application that uses SAML-based SSO. The application does not support Conditional Access. You want to enforce session controls such as blocking downloads of sensitive files. What should you implement?

Accepted Answer

Deploy Microsoft Defender for Cloud Apps Conditional Access App Control and route the application through Defender for Cloud Apps.. Microsoft Defender for Cloud Apps Conditional Access App Control acts as a reverse proxy that can enforce session policies—such as blocking downloads of sensitive files—on any SAML-based SaaS application, even if the application itself does not support Conditional Access. By routing the application's traffic through Defender for Cloud Apps, you can apply granular session controls at the proxy layer without modifying the application.

Answer

Implement a reverse proxy from a third-party vendor.

Answer

Create a custom application registration and set app roles.

Answer

Configure the application to use Microsoft Entra ID as the identity provider and enable Conditional Access policies.