MS-102 practice questions 201–210

1. Question 201 · 396 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains two groups named Group1 and Group2. You plan to configure a data loss prevention (DLP) strategy that meets the following requirements: • Members of Group1 must be prevented from sharing documents that contain credit card numbers. • Members of Group2 must be prevented from sharing documents that are classified as internal by Microsoft Purview Information Protection. • The solution must minimize administrative effort. You need to create a DLP policy for each group. Which condition should you add to each DIP policy rule for each group? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Answer is correct Group1: Set contents contains sensitive info. These are predefined or custom patterns in Microsoft 365 that help identify specific types of sensitive information, such as credit card numbers, social security numbers, or other personally identifiable information (PII) Group2: Set Content contains to Sensitivity labels These are used to classify and protect content based on sensitivity. While they can integrate with DLP policies, sensitivity labels are more about applying protection and classification rather than defining detection conditions.

   Source: Adapted from community discussion — Khanbaba43

   

   Next question

2. Question 202 · 396 in bank

   Your network contains an on-premises Active Directory domain named contoso.com. The domain contains the objects shown in the following table.

   

   You configure Azure AD Connect to sync contoso.com to Azure AD. Which objects will sync to Azure AD?

   • AGroup1 only
   • BUser1 and User2 only
   • CGroup1 and User1 only
   • DGroup1, User1, and User2

   Show answer

   Answer: D

   Explanation

   It is D. Global security groups from your on-premises AD are synchronized to Azure AD, and they retain their membership and other attributes during the synchronization process. This means that if you have global security groups defined in your on-premises AD and these groups contain users or other groups, the membership information will be replicated to Azure AD. Disabled user accounts are also synchronized: https://learn.microsoft.com/en-us/answers/questions/233667/will-azure-ad-connect-sync-disabled-user-accounts

   Source: Adapted from community discussion — Haso

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 203 · 396 in bank

   You have a Microsoft 365 E5 subscription. You create a data loss prevention (DLP) policy named DLP1. You need to ensure that endpoint rule actions are available in the advanced DLP rules for DLP1. To which location should you apply DLP1?

   • AInstances
   • BOneDrive accounts
   • COn-premises repositories
   • DDevices

   Show answer

   Answer: D

   Explanation

   Endpoint DLP specifically focuses on controlling and monitoring sensitive data on user devices (Windows, macOS). This includes actions like blocking the copying of sensitive data to USB drives or cloud storage. https://learn.microsoft.com/en-us/purview/endpoint-dlp-getting-started

   Source: Adapted from community discussion — Krayzr

   References

   • Microsoft Learn

   Next question

4. Question 204 · 396 in bank

   You have a Microsoft 365 E5 subscription that contains a domain named contoso.com. You deploy a new Microsoft Defender for Office 365 anti-phishing policy named Policy1 that has user impersonation protection enabled for a user named user1@contoso.com. You discover that Policy1 blocks email messages from a regular contact named user1@fabnkam.com. You need to ensure that the messages are delivered successfully. What should you do for Policy1?

   • ASelect Enable domains to protect.
   • BConfigure the Phishing email threshold setting.
   • CConfigure which users to protect.
   • DSelect Enable mailbox intelligence.

   Show answer

   Answer: D

   Next question

5. Question 205 · 396 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription. You have devices onboarded to Microsoft Defender for Endpoint as shown in the following table.

   

   You create the device groups shown in the following table.

   

   IP address indicators are defined as shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Defender for Endpoint blocks access to IP address 20.30.40.50 from Device1. Device1 is in Group1 because its name starts with "Dev". Group1 has a block action for IP 20.30.40.50. Answer: Yes Defender for Endpoint blocks access to IP address 2.23.10.15 from Computer2. Computer2 is in Group2 because it is running Windows 11. Group2 does not have a block action for IP 2.23.10.15. Answer: No Defender for Endpoint blocks access to IP address 131.107.10.50 from Device3. Device3 is not in Group1 (name does not start with "Dev") and not in Group2 (OS is Android), so it falls under Ungrouped devices. Ungrouped devices have no specific rule blocking 131.107.10.50. Answer: No

   Source: Adapted from community discussion — Gim99

   

   Next question

6. Question 206 · 396 in bank

   You have a Microsoft 365 E5 subscription. You plan to implement an authentication policy that will user FIDO2 security key as a user authentication method. You need to ensure that during enrollment, each FIDO2 security key is verified by using the FIDO Alliance Metadata Service. Which setting should you enable?

   • AAllow self-service setup
   • BRestrict specific keys
   • CEnforce attestation
   • DEnforce key restrictions

   Show answer

   Answer: C

   Explanation

   https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-passkey-fido2 Set Enforce attestation to Yes if your organization wants to be assured that a FIDO2 security key model or passkey provider is genuine and comes from the legitimate vendor: For FIDO2 security keys, we require security key metadata to be published and verified with the FIDO Alliance Metadata Service, and also pass Microsoft's another set of validation testing.

   Source: Adapted from community discussion — justITtopics

   References

   • Microsoft Learn

   Next question

7. Question 207 · 396 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription. You are investigating a suspicious email message that generated alerts in the Microsoft Defender portal. You need to examine the email message header and submit the message to Microsoft for review. Which two settings should you use? To answer, select the appropriate settings in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   You are correct. Analysis allows you to see the header information Take action allows you to "Submit to Microsoft for Review"

   Source: Adapted from community discussion — Ody

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 208 · 396 in bank

   You have a Microsoft 365 E5 subscription. You create the users shown in the following table.

   

   You plan to use Microsoft Entra ID Protection. Which users will be added automatically to the User at risk detected alerts list?

   • AAdmin1 only
   • BAdmin2 only
   • CAdmin1 and Admin2 only
   • DAdmin1 and Admin3 only
   • EAdmin1, Admin2, and Admin3

   Show answer

   Answer: D

   References

   • Microsoft Learn

   Next question

9. Question 209 · 396 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

   

   The subscription contains the groups shown in the following table.

   

   Which users and groups can you delete? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   You can't directly delete a group that's been assigned licenses. You'd need to first unassign the licenses from the group. After that, you can proceed with deleting the group. This ensures that the licenses are properly managed and reassigned if necessary before the group is removed.

   Source: Adapted from community discussion — 0b29bdf

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 210 · 396 in bank

    Overview - Fabrikam, Inc. is an electronics company that produces consumer products. Fabrikam has 10,000 employees worldwide. Fabrikam has a main office in London and branch offices in major cities in Europe, Asia, and the United States. Existing Environment - Active Directory Environment - The network contains an Active Directory forest named fabrikam.com. The forest contains all the identities used for user and computer authentication. Each department is represented by a top-level organizational unit (OU) that contains several child OUs for user accounts and computer accounts. All users authenticate to on-premises applications by signing in to their device by using a UPN format of username@fabrikam.com. Fabrikam does NOT plan to implement identity federation. Network Infrastructure - Each office has a high-speed connection to the Internet. Each office contains two domain controllers. All domain controllers are configured as DNS servers. The public zone for fabrikam.com is managed by an external DNS server. All users connect to an on-premises Microsoft Exchange Server 2016 organization. The users access their email by using Outlook Anywhere, Outlook on the web, or the Microsoft Outlook app for iOS. All the Exchange servers have the latest cumulative updates installed. All shared company documents are stored on a Microsoft SharePoint Server farm. Requirements - Planned Changes - Fabrikam plans to implement a Microsoft 365 Enterprise subscription and move all email and shared documents to the subscription. Fabrikam plans to implement two pilot projects: Project1: During Project1, the mailboxes of 100 users in the sales department will be moved to Microsoft 365. Project2: After the successful completion of Project1, Microsoft Teams will be enabled in Microsoft 365 for the sales department users. Fabrikam plans to create a group named UserLicenses that will manage the allocation of all Microsoft 365 bulk licenses. Technical Requirements - Fabrikam identifies the following technical requirements: All users must be able to exchange email messages successfully during Project1 by using their current email address. Users must be able to authenticate to cloud services if Active Directory becomes unavailable. A user named User1 must be able to view all DLP reports from the Microsoft Purview compliance portal. Microsoft 365 Apps for enterprise applications must be installed from a network share only. Disruptions to email access must be minimized. Application Requirements - Fabrikam identifies the following application requirements: An on-premises web application named App1 must allow users to complete their expense reports online. App1 must be available to users from the My Apps portal. The installation of feature updates for Microsoft 365 Apps for enterprise must be minimized. Security Requirements - Fabrikam identifies the following security requirements: After the planned migration to Microsoft 365, all users must continue to authenticate to their mailbox and to SharePoint sites by using their UPN. The membership of the UserLicenses group must be validated monthly. Unused user accounts must be removed from the group automatically. After the planned migration to Microsoft 365, all users must be signed in to on-premises and cloud-based applications automatically. The principle of least privilege must be used. Which role should you assign to User1?

    • AHygiene Management
    • BSecurity Reader
    • CSecurity Administrator
    • DRecords Management

    Show answer

    Answer: B

    Explanation

    The Security Reader role in Microsoft 365 provides permissions to read security information and reports. The main task for User1 as per the scenario is to view DLP reports, and this role provides the necessary permissions for that task without granting extra, potentially unnecessary, permissions.

    Source: Adapted from community discussion — Nilz76

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

MS-102 practice, question 201. 396 questions available.