MS-102 practice questions 161–170

1. Question 161 · 396 in bank

   Your network contains an Active Directory domain. You have an Azure AD tenant that has Security defaults disabled. Azure AD Connect is configured for directory synchronization. Password hash synchronization and pass-through authentication are disabled. You need to enable Azure AD Identity Protection to detect leaked credentials. What should you do first?

   • AFrom Azure AD Connect, enable password hash synchronization.
   • BFrom the Microsoft Entra admin center, enable Security defaults.
   • CFrom the Microsoft Entra admin center, configure verifiable credentials.
   • DFrom Azure AD Connect, enable pass-through authentication.

   Show answer

   Answer: A

   Explanation

   All though the answer is right, there is no Azure AD Connect, its Microsoft Entra Connect Sync, so be careful on the exam because they use Azure AD Connect as a wrong answer when it comes to setting up SSPR

   Source: Adapted from community discussion — de0e20a

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 162 · 396 in bank

   Select 3

   Your network contains an on-premises Active Directory domain. You have a Microsoft 365 subscription. You implement a directory synchronization solution that uses pass-through authentication. You configure Azure AD smart lockout as shown in the following exhibit.

   

   You discover that Active Directory users can use the passwords in the custom banned passwords list. You need to ensure that banned passwords are banned for all users. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AFrom a domain controller, install the Azure AD Password Protection Proxy.
   • BFrom Active Directory, modify the Default Domain Policy.
   • CFrom a domain controller, install the Azure AD Application Proxy connector.
   • DFrom all the domain controllers, install the Azure AD Password Protection DC Agent.
   • EFrom Password protection for Windows Server Active Directory, modify the Mode setting.
   • FFrom Custom banned passwords, modify the Enforce custom list setting.

   Show answer

   Answer: ADE

   Explanation

   missing option in response: the steps to setup password protection are: 1. install password protection proxy in 1 or 2 member server 2. install DC agent on all domain controllers 3. set force mode

   Source: Adapted from community discussion — martinods

   Next question

3. Question 163 · 396 in bank

   Your network contains an Active Directory domain and an Azure AD tenant. The network uses a firewall that contains a list of allowed outbound domains. You begin to implement directory synchronization. You discover that the firewall configuration contains only the following domain names in the list of allowed domains: • *.microsoft.com • *.office.com Directory synchronization fails. You need to ensure that directory synchronization completes successfully. What is the best approach to achieve the goal? More than one answer choice may achieve the goal. Select the BEST answer.

   • AFrom the firewall, modify the list of allowed outbound domains.
   • BFrom Azure AD Connect, modify the Customize synchronization options task.
   • CFrom the firewall, create a list of allowed inbound domains.
   • DDeploy an Azure AD Connect sync server in staging mode.
   • EFrom the firewall, allow the IP address range of the Azure data center for outbound communication.

   Show answer

   Answer: A

   Explanation

   Answer is A A. By modifying the list of allowed outbound domains to include the necessary domains for Azure AD Connect, you ensure that the synchronization can complete successfully. B. This option deals with configuration within Azure AD Connect, not addressing firewall restrictions that are causing the sync to fail. C Inbound rules are not typically the issue for directory synchronization; outbound access is necessary for Azure AD Connect to communicate with Azure AD services. D. Staging mode is used for testing and disaster recovery, not for resolving firewall issues. E. While allowing IP ranges could work, it's more practical and secure to allow specific domain names due to the dynamic nature of cloud service IP addresses.

   Source: Adapted from community discussion — Khattak3143

   Next question

4. Question 164 · 396 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Office 365. The subscription has the default inbound anti-spam policy and a custom Safe Attachments policy. You need to identify the following information: The number of email messages quarantined by zero-hour auto purge (ZAP) The number of times users clicked a malicious link in an email message Which Email & collaboration report should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 165 · 396 in bank

   You have a Microsoft 365 E5 subscription that contains users in the United States, Europe, and Asia. You use Azure AD Identity Protection. You have a virtual desktop infrastructure (VDI). All VDI servers are located in the United States. Users connect to Microsoft 365 from laptops and the VDI. Some VDI users report that they are blocked from signing in to Microsoft 365 due to a high sign-in risk. You need to reduce the likelihood that the VDI users will be erroneously blocked from signing in to Microsoft 365. The solution must ensure that sign-ins from the VDI environment are protected by using Identity Protection. What should you configure?

   • AExpressRoute for Microsoft 365
   • Ba trusted location
   • Ca Satellite Geography location
   • Da Conditional Access policy

   Show answer

   Answer: B

   References

   • Microsoft Learn

   Next question

6. Question 166 · 396 in bank

   HOTSPOT - You have a Microsoft 365 subscription. From Azure AD Privileged Identity Management (PIM), you configure Role settings for the Global Administrator role as shown in the following exhibit.

   

   You make a user named admin1@contoso.com eligible for the Global Administrator role. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   2nd part - duration and justification. When assigning a role, you choose either active or eligible, then duration is mandatory or tick permanent (in this question permanent eligible is NOT allowe) then you need justification to complete it.

   Source: Adapted from community discussion — Xive

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 167 · 396 in bank

   You have a Microsoft 365 subscription that contains more than 2,000 guest users. You need to ensure that when guest users are added to Microsoft 365 groups in the subscription, their membership is validated by the group owner every 30 days. What should you configure?

   • Agroup expiration policies
   • Bretention policies
   • Caccess reviews
   • DConditional Access policies

   Show answer

   Answer: C

   Explanation

   C. access reviews. Access reviews are designed specifically for the purpose of regularly reviewing and re-validating user access, including guest user access, to Microsoft 365 groups. You can set them up to recur at a defined interval (like 30 days) and require group owners to confirm that each guest user still needs access. Here's why the other options are not the best fit: Group expiration policies: These are used to automatically expire and delete groups after a certain period of inactivity. This doesn't address the specific need to validate guest user membership. Retention policies: These are focused on preserving or deleting data, not on managing user access. Conditional Access policies: These are used to control access to resources based on conditions like location, device, and user risk. While they can be part of a security strategy, they don't directly address the requirement for periodic guest user validation. https://learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview

   Source: Adapted from community discussion — Krayzr

   References

   • Microsoft Learn

   Next question

8. Question 168 · 396 in bank

   HOTSPOT - You have a Microsoft 365 subscription that uses a domain name of adatum.com. In Azure AD, you set Guest invite restrictions to Only users assigned to specific admin roles can invite guest users. A user named user1@adatum.com reports that they can no longer invite external users from a domain named contoso.com to collaborate in Microsoft Teams. You need to modify the Azure AD configuration to meet the following requirements: • Ensure that User1 can invite the contoso.com users to Teams. • Ensure that only the contoso.com users can be invited as guests to the Azure AD tenant. • Follow the principle of least privilege. What should you do for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box1: Correct Only users assigned to specific admin roles can invite guest users: To allow only those users with administrator roles to invite guests, select this radio button. • The administrator roles include ○ Global Administrator ○ User Administrator ○ Guest Inviter Box 2: Correct Under Collaboration restrictions, you can choose whether to allow or deny invitations to the domains you specify and enter specific domain names in the text boxes. https://learn.microsoft.com/en-us/entra/external-id/external-collaboration-settings-configure#configure-settings-in-the-portal

   Source: Adapted from community discussion — sergioandreslq

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 169 · 396 in bank

   HOTSPOT - Your network contains an on-premises Active Directory domain that is synced to Azure AD as shown in the following exhibit.

   

   An on-premises Active Directory user account named Allan Yoo is synchronized to Azure AD. You view Allan’s account from Microsoft 365 and notice that his username is set to Allan@adatum.onmicrosoft.com. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   NNY Allan Yoo's user account is synchronized from the on-premise Active Directory. This means that most user account settings have to be configured in the on- premise Active Directory. In the exhibit, Password Writeback is disabled. Therefore, you cannot reset the password of Allan Yoo from the Azure portal. You also cannot change Allan Yoo's job title in the Azure portal because his account is synchronized from the on-premise Active Directory. One setting that you can configure for synchronized user accounts I the usage location. The usage location must be configured on a user account before you can assign licenses to the user. Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-writeback

   Source: Adapted from community discussion — coyoteee

   References

   • Microsoft Learn

   

   Next question

10. Question 170 · 396 in bank

    Your network contains an on-premises Active Directory domain. The domain contains 2,000 computers that run Windows 10. You purchase a Microsoft 365 subscription. You implement password hash synchronization and Azure AD Seamless Single Sign-On (Seamless SSO). You need to ensure that users can use Seamless SSO from the Windows 10 computers. What should you do?

    • AJoin the computers to Azure AD.
    • BCreate a conditional access policy in Azure AD.
    • CModify the Intranet zone settings by using Group Policy.
    • DDeploy an Azure AD Connect staging server.

    Show answer

    Answer: C

    Explanation

    C: Correct: a. Open the Group Policy Management Editor tool. b. Edit the group policy that's applied to some or all your users. This example uses Default Domain Policy. c. Go to User Configuration > Policies > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page. Select Site to Zone Assignment List. https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-sso-quick-start#group-policy-detailed-steps

    Source: Adapted from community discussion — sergioandreslq

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

MS-102 practice, question 161. 396 questions available.