Microsoft 365 Administrator396 questions across 40 pages are complete and free, with no account or card.
396 questions in this bank
Free access · progress saved on this device
You have a Microsoft 365 subscription. You need to receive a notification each time a user in the service desk department grants Full Access permissions for a user mailbox. What should you configure?
Answer: B
The answer is B. an alert policy. An alert policy is used to send notifications when certain events occur, such as when a user grants Full Access permissions for a user mailbox.
Source: Adapted from community discussion — Hard1k
Overview - Fabrikam, Inc. is an electronics company that produces consumer products. Fabrikam has 10,000 employees worldwide. Fabrikam has a main office in London and branch offices in major cities in Europe, Asia, and the United States. Existing Environment - Active Directory Environment - The network contains an Active Directory forest named fabrikam.com. The forest contains all the identities used for user and computer authentication. Each department is represented by a top-level organizational unit (OU) that contains several child OUs for user accounts and computer accounts. All users authenticate to on-premises applications by signing in to their device by using a UPN format of username@fabrikam.com. Fabrikam does NOT plan to implement identity federation. Network Infrastructure - Each office has a high-speed connection to the Internet. Each office contains two domain controllers. All domain controllers are configured as DNS servers. The public zone for fabrikam.com is managed by an external DNS server. All users connect to an on-premises Microsoft Exchange Server 2016 organization. The users access their email by using Outlook Anywhere, Outlook on the web, or the Microsoft Outlook app for iOS. All the Exchange servers have the latest cumulative updates installed. All shared company documents are stored on a Microsoft SharePoint Server farm. Requirements - Planned Changes - Fabrikam plans to implement a Microsoft 365 Enterprise subscription and move all email and shared documents to the subscription. Fabrikam plans to implement two pilot projects: Project1: During Project1, the mailboxes of 100 users in the sales department will be moved to Microsoft 365. Project2: After the successful completion of Project1, Microsoft Teams will be enabled in Microsoft 365 for the sales department users. Fabrikam plans to create a group named UserLicenses that will manage the allocation of all Microsoft 365 bulk licenses. Technical Requirements - Fabrikam identifies the following technical requirements: All users must be able to exchange email messages successfully during Project1 by using their current email address. Users must be able to authenticate to cloud services if Active Directory becomes unavailable. A user named User1 must be able to view all DLP reports from the Microsoft Purview compliance portal. Microsoft 365 Apps for enterprise applications must be installed from a network share only. Disruptions to email access must be minimized. Application Requirements - Fabrikam identifies the following application requirements: An on-premises web application named App1 must allow users to complete their expense reports online. App1 must be available to users from the My Apps portal. The installation of feature updates for Microsoft 365 Apps for enterprise must be minimized. Security Requirements - Fabrikam identifies the following security requirements: After the planned migration to Microsoft 365, all users must continue to authenticate to their mailbox and to SharePoint sites by using their UPN. The membership of the UserLicenses group must be validated monthly. Unused user accounts must be removed from the group automatically. After the planned migration to Microsoft 365, all users must be signed in to on-premises and cloud-based applications automatically. The principle of least privilege must be used. You need to ensure that all the sales department users can authenticate successfully during Project1 and Project2. Which authentication strategy should you implement for the pilot projects?
Answer: C
"Users must be able to authenticate to cloud services if Active Directory becomes unavailable." That would be hash sync. Pass-though with failback is also possible but more work to implement and maintain. "After the planned migration to Microsoft 365, all users must be signed in to on-premises and cloud-based applications automatically." that's the SSO.
Source: Adapted from community discussion — osxzvkwpfcfxobqjby
You have a Microsoft 365 E5 subscription. You need to compare the current Safe Links configuration to the Microsoft recommended configurations. What should you use?
Answer: D
It should be answer D. The goal of the configuration analyzer is to compare Exchange Online Protection policies (aka Threat Policies) currently configured with MS recommendations. There is two tabs named "Standard recommendations" & "Strict recommendations" that give the gap between current configuration & MS recommendations. https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/configuration-analyzer-for-security-policies?view=o365-worldwide#use-the-configuration-analyzer-in-the-microsoft-365-defender-portal
Source: Adapted from community discussion — certma2023
You have a Microsoft 365 E5 subscription. You need to be alerted when Microsoft 365 Defender detects high-severity incidents. What should you use?
Answer: D
D: notification rule Why? I have tried to configure it with an alert policy and have not found a way to find an activity based on an incident. You can find activities in the alert policy like: Common user activities (e.g. document sharing) Common endpoint user activities (e.g. printing) File and folder activities (delete file) File sharing activities (e.g. Share File, Folder Site) Filtering events (e.g. Malicious email detected) Common tenant activities (e.g. Insight generated) and so on. So this is about events/activities by users and not about an event caused by an incident. Just try it out for yourself.
Source: Adapted from community discussion — nils241
HOTSPOT - You have a Microsoft 365 E5 subscription. All corporate Windows 11 devices are managed by using Microsoft Intune and onboarded to Microsoft Defender for Endpoint. You need to meet the following requirements: • View an assessment of the device configurations against the Center for Internet Security (CIS) v1.0.0 benchmark. • Protect a folder named C:\Folder1 from being accessed by untrusted applications on the devices. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
You have a Microsoft 365 subscription that contains the alerts shown in the following table.
Which properties of the alerts can you modify?
Answer: B
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint. All the devices in your organization are onboarded to Microsoft Defender for Endpoint. You need to ensure that an alert is generated if malicious activity was detected on a device during the last 24 hours. What should you do?
Answer: C
C. From Advanced hunting, create a query and a detection rule. Advanced hunting allows you to create custom queries to search for specific events in your environment. You can then use these queries to create detection rules that will generate alerts when certain events occur.
Source: Adapted from community discussion — Hard1k
HOTSPOT - You have a Microsoft 365 E5 tenant that connects to Microsoft Defender for Endpoint. You have devices enrolled in Microsoft Intune as shown in the following table.
You plan to use risk levels in Microsoft Defender for Endpoint to identify whether a device is compliant. Noncompliant devices must be blocked from accessing corporate resources. You need to identify which devices can be onboarded to Microsoft Defender for Endpoint, and which Endpoint security policies must be configured. What should you identify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
Yup: Configuration policy, so it will know how configure Compliance policy, so it will know what de device must meet. Conditional Access Policy, so you can block if needed
Source: Adapted from community discussion — imlearningstuffagain
HOTSPOT - You have a Microsoft 365 E5 subscription. You configure a new alert policy as shown in the following exhibit.
You need to identify the following: • How many days it will take to establish a baseline for unusual activity • Whether alerts will be triggered during the establishment of the baseline What should you identify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
You have a Microsoft 365 E5 tenant. You create a retention label named Retention1 as shown in the following exhibit.
You apply Retention1 to all the Microsoft OneDrive content. On January 1, 2020, a user stores a file named File1 in OneDrive. On January 10, 2020, the user modifies File1. On February 1, 2020, the user deletes File1. When will File1 be removed permanently and unrecoverable from OneDrive?
Answer: B
Half the answer is provided in the screengrab, "Based on", which states "based on when its created" Created on Jan 1, 2020. Add 6 months i.e. July 1, 2020. Simple math!
Source: Adapted from community discussion — Khattak3143
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
MS-102 practice, question 111. 396 questions available.
Version 1.0.0. How we source questions
