How many Refer to the Exhibit Practice Questions questions are on this page?

This page has 8 Refer to the Exhibit Practice Questions scenario questions for the MS-102 exam, each with detailed explanations and wrong-answer analysis.

How should I approach MS-102 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Microsoft 365 Administrator MS-102 questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Microsoft 365 Administrator MS-102 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

MS-102

exam code

Microsoft

vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

You are reviewing a Conditional Access policy in Microsoft Entra ID. The exhibit shows the policy configuration. You need to allow users to access Office 365 applications from personal devices that are not enrolled in Microsoft Intune. However, the policy currently blocks access because it requires a compliant device. Users are prompted for MFA but then blocked due to device compliance. What should you modify in the policy?

Exhibit

Refer to the exhibit.

```json
{
  "conditions": {
    "applications": {
      "includeApplications": ["Office365"]
    },
    "users": {
      "includeUsers": ["All"]
    },
    "locations": {
      "includeLocations": ["All"]
    }
  },
  "grantControls": {
    "builtInControls": ["mfa", "compliantDevice"]
  },
  "sessionControls": {
    "applicationEnforcedRestrictions": null,
    "cloudAppSecurity": {
      "cloudAppSecurityType": "monitorOnly"
    }
  }
}
```

A
Add a session control for sign-in frequency.
Why wrong: This does not remove the device compliance requirement.
B
Remove "compliantDevice" from the builtInControls grant control list.
Removing the compliant device requirement allows access from any device.
C
Remove the cloudAppSecurity session control.
Why wrong: This does not remove the device compliance requirement.
D
Change cloudAppSecurityType to "blockDownloads".
Why wrong: This is a session control, not a grant control.

Full breakdown with real-world context →

Question 2mediummultiple choice

Full question →

The exhibit shows a KQL query used in Microsoft 365 Defender. The query returns no results for admin@contoso.com. What is the most likely reason?

Exhibit

Refer to the exhibit.

```kusto
IdentityInfo
| where UserPrincipalName == "admin@contoso.com"
| project UserPrincipalName, AssignedRoles, LastPasswordChangeDateTime
| where AssignedRoles contains "Global Administrator"
```

A
The user does not have the Global Administrator role.
Why wrong: This option mistakes a filter result for an entitlement fact. In Microsoft 365 Defender, the IdentityInfo table contains one normalized record per discovered identity, including role memberships collected from Active Directory and Azure AD. If the user were present but lacked the Global Administrator role, the row would still exist (with other roles or an empty role list); the query's role filter would simply not select it. An empty result therefore indicates that no identity record for this user reached the table, not that the user lacks the role.
B
The KQL query syntax is invalid.
Why wrong: If the query were syntactically invalid, KQL would return an error banner and the investigation page would not display an empty results set. The syntax shown—using `let` to define a variable followed by a pipeline of operators—is structurally valid and runs successfully. An empty result set proves the query was accepted by the parser; otherwise the tool would have raised a syntax error before returning any data. Thus syntax is definitely not the cause of the missing results.
C
The role name in the query is misspelled.
Why wrong: The literal 'Global Administrator' is the exact display name stored in the role property of IdentityInfo and matches the role name used in Azure AD, so it is not misspelled. Even if a typo existed, the query would still return an empty result, but the underlying identity record would remain in the table; the correct diagnostic distinction is whether IdentityInfo has any rows at all. If the table were populated, a typo would yield no matches, yet you could still see the user by querying without the role filter. Since no user is returned even in a broader query, the spelling is a red herring.
D
Microsoft Defender for Identity is not enabled for the tenant.
IdentityInfo is not derived from the Microsoft Graph or role directory alone; it is continuously synchronized by Microsoft Defender for Identity (MDI) sensors from on-premises Active Directory and Azure AD. MDI enriches identities with role, group, and resource access data. When MDI is not onboarded or properly licensed, the IdentityInfo table remains empty or contains only incomplete data, so any query filtering it returns no rows. This is the root cause consistent with an empty result set and a valid query, making it the only correct answer here.

Full breakdown with real-world context →

Question 3mediummultiple choice

Full question →

Refer to the exhibit. An administrator runs the KQL query in Microsoft Defender for Endpoint. The result set is empty. What is the most likely reason?

Exhibit

Refer to the exhibit.

```kql
DeviceLogonEvents
| where Timestamp > ago(7d)
| where AccountName == "admin"
| project Timestamp, DeviceName, AccountName, IPAddress
| order by Timestamp desc
```

A
The device is not onboarded to Microsoft Defender for Endpoint.
Why wrong: This is incorrect because the query is not scoped to a single device; it would return rows for any onboarded device that matches the AccountName filter. If a device were not onboarded to Microsoft Defender for Endpoint, it would simply not contribute data to the Advanced Hunting tables, but the presence of other onboarded devices would still produce results if they had matching logon events. Moreover, if the query were specifically targeting an unresponsive device, the query would need a DeviceName filter to isolate it. Therefore, the empty result set cannot be attributed to a single device's onboarding status.
B
The query is case-sensitive and the account name is 'Admin' with a capital A.
Why wrong: KQL's '==' operator is case-sensitive, so if the actual account name were 'Admin' with a capital A, the filter would indeed exclude those events. However, the query is explicitly searching for the exact string 'admin', and the correct interpretation of an empty result is that no logon events with that exact account name exist in the given time window. While case sensitivity could theoretically cause a false negative, it is not the most probable reason unless there is evidence that an 'Admin' account is active. The default assumption for an empty set should be that the data simply does not match the query criteria.
C
No logon events with the account name 'admin' exist in the past 7 days.
This is correct because the KQL query filters logon events by AccountName == 'admin' and a time range of the last 7 days. When the query executes, it scans the events table and returns only rows where the account name matches exactly and the timestamp falls within the period. An empty result set directly indicates that no logon events with the account name 'admin' occurred in those 7 days. It does not imply that no logon events happened at all, only that none matched the specified account and time filter.
D
There are no logon events in the last 7 days.
Why wrong: This is incorrect because the query includes a specific filter on AccountName, so the absence of results only tells us that no events matched that filter, not that the entire events table is empty. In fact, logon events from other accounts would be excluded by the filter and would not appear in the output. Additionally, on an active device or environment, logon events are abundant, so a complete absence of logon events over 7 days would be highly unusual and would require a separate investigation. The correct conclusion is limited to the account 'admin', not all logon activity.

Full breakdown with real-world context →

Question 4hardmultiple choice

Full question →

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. What is the effect of this policy?

Exhibit

Refer to the exhibit.
```json
{
  "conditions": {
    "applications": {
      "includeApplications": ["Office365"]
    },
    "users": {
      "includeUsers": ["All"]
    },
    "platforms": {
      "includePlatforms": ["iOS", "Android"]
    }
  },
  "grantControls": {
    "builtInControls": ["mfa", "compliantDevice"]
  }
}
```

A
All users accessing all cloud apps are required to use MFA
Why wrong: The policy only applies to Office 365 apps.
B
Access to Office 365 from iOS and Android is blocked
Why wrong: The policy grants access with conditions, not blocks.
C
All users on iOS or Android devices accessing Office 365 must use MFA and a compliant device
The policy includes both MFA and compliantDevice controls.
D
Users on mobile devices are required to use hybrid Azure AD joined devices
Why wrong: The policy does not require hybrid join.

Full breakdown with real-world context →

Question 5hardmulti select

Full question →

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should fire when a Windows device exhibits this sequence of events within 3 minutes: 1) A PowerShell process runs with an encoded command, 2) A service is created with a random name, and 3) An outbound network connection to a suspicious IP address is observed. Which three Advanced Hunting tables must be joined in the KQL query to create this detection?

A
DeviceProcessEvents, DeviceRegistryEvents, DeviceNetworkEvents
Why wrong: Incorrect. DeviceRegistryEvents does not directly capture service creation events; it captures registry modifications. While services have registry keys, the specific event of service creation is logged as a security event in DeviceEvents (Event ID 4697). Therefore, this combination would miss the required event.
B
DeviceProcessEvents, DeviceFileEvents, DeviceNetworkEvents
Why wrong: Incorrect. DeviceFileEvents captures file creation events, such as when a service executable is created, but it does not capture the service creation event itself. Service creation is logged in DeviceEvents. Thus, this combination is insufficient.
C
DeviceProcessEvents, DeviceEvents, DeviceNetworkEvents
Correct. DeviceProcessEvents captures PowerShell process execution, DeviceEvents captures service creation events (Event ID 4697), and DeviceNetworkEvents captures outbound network connections. This combination covers all three required events.
D
DeviceProcessEvents, DeviceLogonEvents, DeviceNetworkEvents
Why wrong: Incorrect. DeviceLogonEvents captures logon events, which are not required for this detection rule. It does not cover service creation or network connections.

Full breakdown with real-world context →

Question 6hardmultiple choice

Full question →

Refer to the exhibit. The conditional access policy JSON shown above is applied to all users. A user authenticates from a trusted location and wants to access a cloud app. Which combination of controls will be enforced?

Exhibit

{
  "conditions": {
    "users": {
      "includeUsers": ["All"]
    },
    "applications": {
      "includeApplications": ["All"]
    },
    "locations": {
      "includeLocations": ["AllTrusted"]
    },
    "clientAppTypes": ["browser", "mobileAppsAndDesktopClients"]
  },
  "grantControls": {
    "builtInControls": ["mfa"],
    "termsOfUse": ["termsOfUseId1"]
  },
  "sessionControls": {
    "signInFrequency": {
      "value": 1,
      "type": "hours"
    },
    "persistentBrowser": {
      "mode": "never"
    }
  }
}

A
MFA, terms of use acceptance, sign-in frequency of 1 hour, and persistent browser never
Despite the user authenticating from a trusted location, the conditional access policy's configuration dictates the enforced controls. The policy must explicitly include Multi-Factor Authentication (MFA) and terms of use acceptance within its grant controls, meaning these are required regardless of the trusted location status. Furthermore, the policy's session controls specify a sign-in frequency of 1 hour and persistent browser set to 'never', ensuring re-authentication and session termination after the specified period.
B
Terms of use acceptance and persistent browser never only
Why wrong: MFA is also required.
C
MFA and terms of use acceptance only
Why wrong: Session controls are also enforced.
D
MFA and sign-in frequency of 1 hour only
Why wrong: Terms of use acceptance is also required.

Full breakdown with real-world context →

Question 7hardmultiple choice

Full question →

Refer to the exhibit. You run the KQL query in advanced hunting. What is the primary purpose of this query?

Exhibit

Refer to the exhibit.

```kusto
// KQL query in Microsoft Defender XDR advanced hunting
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "cmd.exe")
| where ProcessCommandLine contains "-EncodedCommand"
| project Timestamp, DeviceName, FileName, ProcessCommandLine
| summarize Count = count() by DeviceName
| where Count > 10
```

A
Identify devices with outbound connections to malicious IPs
Why wrong: The query does not look at network connections.
B
Identify devices with PowerShell execution policy set to bypass
Why wrong: The query does not filter by execution policy.
C
Identify devices where a user deleted system files using cmd
Why wrong: The query does not look for file deletions.
D
Identify devices with high use of encoded commands, which may indicate malicious activity
Encoded commands are often used to hide malicious intent.

Full breakdown with real-world context →

Question 8easymultiple choice

Full question →

You run the KQL query shown in the exhibit in Microsoft Defender XDR advanced hunting. What is the primary purpose of this query?

Exhibit

Refer to the exhibit.
```kusto
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName == "powershell.exe"
| where ProcessCommandLine has "-EncodedCommand"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| take 10
```

A
Identify all PowerShell activity from a specific user
Why wrong: The query is built around command-line text matching for encoded or obfuscated PowerShell parameters, not around user identity. It contains no filter on AccountName, UserId, or InitiatingProcessAccountName, so it cannot isolate a single user's activity. Moreover, ordinary PowerShell actions from a user would not appear unless they specifically include the encoded-command indicator, so it fails the 'all activity' goal.
B
Detect potentially malicious PowerShell commands that are obfuscated
This query deliberately searches for PowerShell processes launched with the -EncodedCommand parameter, which causes the payload to be passed as a Base64 string. Encoded commands are a hallmark of obfuscation because attackers use them to hide malicious code from casual log inspection and signature-based detection. The presence of an encoded PowerShell command is therefore a valid trigger point for investigating potentially malicious behavior.
C
Find PowerShell processes running on a specific device
Why wrong: The query has no DeviceName, DeviceId, or similar device-scoped predicate in its logic. It returns every PowerShell process event that matches the encoded-command condition across all machines reporting into Microsoft Defender unless the UI applies a device filter externally. As a result, it is not designed to find processes on one specific device; doing so would require adding a device identifier to the KQL statement.
D
List all PowerShell executions in the last 7 days
Why wrong: Because the query specifically filters for PowerShell command lines containing an encoded command parameter, it omits the vast majority of PowerShell executions that use normal, human-readable arguments. Even if a time range is applied in the portal, the result is a narrow subset of all PowerShell activity rather than a complete execution log. A true last-7-days list would need to remove the encoded-command filter and aggregate on FileName == 'powershell.exe' or 'pwsh.exe'.

Full breakdown with real-world context →

These MS-102 practice questions are part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style MS-102 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Refer to the Exhibit Practice Questions

How to approach refer to the exhibit practice questions

Quick answer

Related MS-102 topic practice pages

Deploy and manage a Microsoft 365 tenant practice questions

Implement and manage Microsoft Entra identity and access practice questions

Manage security and threats by using Microsoft Defender XDR practice questions

Manage compliance by using Microsoft Purview practice questions

MS-102 fundamentals practice questions

MS-102 scenario practice questions

MS-102 troubleshooting practice questions

Practice scenarios

Exhibit

The exhibit shows a KQL query used in Microsoft 365 Defender. The query returns no results for admin@contoso.com. What is the most likely reason?

Exhibit

Refer to the exhibit. An administrator runs the KQL query in Microsoft Defender for Endpoint. The result set is empty. What is the most likely reason?

Exhibit

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. What is the effect of this policy?

Exhibit

Refer to the exhibit. The conditional access policy JSON shown above is applied to all users. A user authenticates from a trusted location and wants to access a cloud app. Which combination of controls will be enforced?

Exhibit

Refer to the exhibit. You run the KQL query in advanced hunting. What is the primary purpose of this query?

Exhibit

You run the KQL query shown in the exhibit in Microsoft Defender XDR advanced hunting. What is the primary purpose of this query?

Exhibit