MS-102 practice questions 181–190

1. Question 181 · 396 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains the security groups shown in the following table.

   

   The subscription contains the users shown in the following table.

   

   You have a Conditional Access policy that has the following settings: • Assignments o Users Include: Group1 Exclude: Group2, Group3 o Target resources Cloud apps App1 Access controls Grant Block access For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I believe it is NYN Here is why: User 1 is in group1 and group 2 User 2 is not in a group User 3 is in group1 and group 3 User 1 = N -> Block always wins (because of membership group1) User 2 = y -> policy does not apply User 3 = N -> Block always wins (because of membership group1)

   Source: Adapted from community discussion — JMB7448

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 182 · 396 in bank

   Your company has a Microsoft Entra tenant named contoso.com and a Microsoft 365 subscription. All users use Windows 10 devices to access Microsoft Office 365 apps. All the devices are in a workgroup. You plan to implement password less sign-in to contoso.com. You need to recommend changes to the infrastructure for the planned implementation. What should you include in the recommendation?

   • AJoin all the devices to contoso.com.
   • BDeploy Microsoft Entra Application Proxy.
   • CDeploy X.509.3 certificates to all the users.
   • DDeploy the Microsoft Authenticator app.

   Show answer

   Answer: A

   Explanation

   The best recommendation to implement passwordless sign-in for your scenario is: A. Join all the devices to contoso.com Here's why the other options are not ideal: B. Deploy Microsoft Entra Application Proxy: This is not necessary for passwordless sign-in. Application Proxy publishes on-premises applications to Azure Active Directory (Azure AD) but doesn't directly affect passwordless login functionality. C. Deploy X.509.3 certificates to all the users: While certificates can be used for passwordless authentication, it's a more complex solution compared to Azure AD joined devices. D. Deploy the Microsoft Authenticator app: While the Microsoft Authenticator app can be used for multi-factor authentication (MFA) which can be part of a passwordless solution, it requires Azure AD joined devices to leverage Windows Hello for passwordless sign-in. Since your users are already using Windows 10 devices and you want passwordless sign-in, joining the devices to the Azure AD domain (contoso.com) allows them to leverage Windows Hello for passwordless login with features like fingerprint or facial recognition. This is a simpler and more efficient approach for your scenario.

   Source: Adapted from community discussion — TonyManero

   Next question

3. Question 183 · 396 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains two security groups named Group1 and Group2. You need to enable multi-factor authentication (MFA) for the members of Group1 and Group2. The solution must meet the following requirements: • The Group1 members must be prompted for MFA only when authenticating to Microsoft Entra ID from Android devices. • The Group2 members must be prompted for MFA only when accessing Microsoft Exchange Online from outside the corporate network. • Administrative effort must be minimized. What should you configure for each group? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. Group1: Conditional Access: This allows you to specify conditions (like the device platform) under which MFA is required, ensuring that Group1 members are prompted for MFA only on Android devices. 2. Group2: Conditional Access: This enables you to require MFA based on access scenarios, such as accessing Exchange Online from outside the corporate network.

   Source: Adapted from community discussion — Tr619899

   

   Next question

4. Question 184 · 396 in bank

   Select 3

   Your network contains an on-premises Active Directory domain named contoso.local. The domain contains five domain controllers. Your company purchases Microsoft 365 and creates an Azure AD tenant named contoso.onmicrosoft.com. You plan to install Azure AD Connect on a member server and implement pass-through authentication. You need to prepare the environment for the planned implementation of pass-through authentication. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AFrom a domain controller, install an Authentication Agent.
   • BFrom the Microsoft Entra admin center, configure an authentication method.
   • CFrom Active Directory Domains and Trusts, add a UPN suffix.
   • DModify the email address attribute for each user account.
   • EFrom the Microsoft Entra admin center, add a custom domain name.
   • FModify the User logon name for each user account.

   Show answer

   Answer: CEF

   Explanation

   I Agree. As the local ADDS name is "contoso.local", we need to make some few steps/prerequisites before being able to set up account synchronization: -> Add a custom domain name on the Azure AD / MS Entra portal (ex. contoso.com) -> Add a local UPN suffix at the ADDS Forest level (contoso.com) -> Modify all user account UPN from username@contoso.local to username@contoso.com Then comes the Azure AD Connect deployment & the PTA configuration.

   Source: Adapted from community discussion — certma2023

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 185 · 396 in bank

   HOTSPOT - You have a Microsoft 365 subscription that contains the users shown in the following table.

   

   The Global Administrator role has the Privileged Identity Management (PIM) settings shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I work with PIM configured similarly in my production environment and when the activation expires you can immediately re-activate. After the 15 day eligibility expires the role can not be activated unless requested again. I therefore think the answer is no, like Tony stated above, after 8 hours User 3 can activate again immediately.

   Source: Adapted from community discussion — SBGM

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 186 · 396 in bank

   DRAG DROP - You have an Azure subscription that is linked to a hybrid Microsoft Entra tenant. All users sync from Active Directory Domain Services (AD DS) to the tenant by using Express Settings in Microsoft Entra Connect. You plan to implement self-service password reset (SSPR). You need to ensure that when a user resets or changes a password, the password syncs with AD DS. Which actions should you perform in sequence? To answer, drag the appropriate actions to the correct order. Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   This is the sequence: Select Password writeback in Microsoft Entra Connect: This step enables the core functionality of synchronizing password changes initiated through SSPR back to your on-premises AD DS. From the Microsoft Entra admin center, configure the registration settings for SSPR: This allows users to register for SSPR by specifying their preferred contact methods (email, phone) for receiving password reset instructions. From the Microsoft Entra admin center, configure the authentication methods for SSPR: This step defines the methods users can employ to verify their identity during the SSPR process (e.g., security questions, verification codes sent to registered methods).

   Source: Adapted from community discussion — TonyManero

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 187 · 396 in bank

   You have a Microsoft 365 subscription that uses Microsoft 365 Defender. You need to compare your company's security configurations to Microsoft best practices and review improvement actions to increase the security posture. What should you use?

   • AMicrosoft Secure Score
   • BCloud discovery
   • CExposure distribution
   • DThreat tracker
   • EExposure score

   Show answer

   Answer: A

   References

   • Microsoft Learn

   Next question

8. Question 188 · 396 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Office 365. You need to automate Attack simulation training for users when a phishing campaign is detected in real-time. Which type of automation should you use, and which condition should you configure for the Attack simulation training? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

9. Question 189 · 396 in bank

   You have two Microsoft 365 tenants. Users have accounts in both tenants. You plan to deploy a single device to each user. Each device will contain the Microsoft Authenticator app. You need to ensure that the users can use their device to authenticate to both tenants by using passwordless authentication. Which platform should you provide?

   • AiOS
   • BAndroid
   • CWindows
   • DmacOS

   Show answer

   Answer: A

   Explanation

   You can enable passwordless phone sign-in for multiple accounts in Microsoft Authenticator on any supported Android or iOS device this Q is obsolete

   Source: Adapted from community discussion — belyo

   References

   • Microsoft Learn

   Next question

10. Question 190 · 396 in bank

    Your network contains an Active Directory domain named adatum.com that is synced to a Microsoft Entra tenant. The domain contains 100 user accounts. The city attribute for all the users is set to the city where the user resides. You need to modify the value of the city attribute to the three-letter airport code of each city. What should you do?

    • AFrom Windows PowerShell on a domain controller, run the Get-ADUser and Set-ADUser cmdlets.
    • BFrom Azure Cloud Shell, run the Get-MgUser and Update-MgUser cmdlets.
    • CFrom the Microsoft Entra admin center, select all the Microsoft Entra users, and then use the User settings blade.
    • DFrom the Microsoft 365 admin center, select the users, and then use the Bulk actions option.

    Show answer

    Answer: A

    Explanation

    A final answer! It is because the user was synced from on-premise domain, we need to modify the user attribute at on-premise domain.

    Source: Adapted from community discussion — Khattak3143

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

MS-102 practice, question 181. 396 questions available.