MS-102 practice questions 211–220

1. Question 211 · 396 in bank

   You have a Microsoft 365 E5 subscription. You need to create Conditional Access policies to meet the following requirements: All users must use multi-factor authentication (MFA) when they sign in from outside the corporate network. Users must only be able to sign in from outside the corporate network if the sign-in originates from a compliant device. All users must be blocked from signing in from outside the United States and Canada. Only users in the R&D department must be blocked from signing in from both Android and iOS devices. Only users in the finance department must be able to sign in to an Azure AD enterprise application named App1. All other users must be blocked from signing in to App1. What is the minimum number of Conditional Access policies you should create?

   • A3
   • B4
   • C5
   • D6
   • E7
   • F8

   Show answer

   Answer: B

   Explanation

   I would go for B answer. 4 rules configured like that : -> One rule that target all users & all location except a custom trusted location (Public IP Ranges of the company). This rule grant access with MFA + Compliant device. -> One rule that target all users & all location except US & Canada. This rule block access. -> One rule that target R&D Users only & Android+IOS Devices. This rule block access. -> One rule that target all users except Finance users. The rule target only App1. This rule block access. For me, it should meet the goals.

   Source: Adapted from community discussion — certma2023

   Next question

2. Question 212 · 396 in bank

   You have a Microsoft 365 E5 subscription. You create a user named Admin1. You need to ensure that Admin1 can view Endpoint security policies from the Microsoft Defender portal. The solution must follow the principle of least privilege. Which Microsoft Entra role should you assign to Admin1?

   • ACloud Device Administrator
   • BSecurity Reader
   • CGlobal Reader
   • DSecurity Administrator
   • ESecurity Operator

   Show answer

   Answer: B

   References

   • Microsoft Learn

   Next question

3. Question 213 · 396 in bank

   You have a Microsoft 365 E5 subscription. You plan to configure multi-factor authentication (MFA). You need to select an authentication method for users. The solution must ensure that each time a user is prompted for MFA, the application name that requires MFA is provided. What should you select?

   • ASMS
   • BMicrosoft Authenticator
   • Ca voice call
   • Demail OTP
   • Ea FIDO2 security key

   Show answer

   Answer: B

   References

   • Microsoft Learn

   Next question

4. Question 214 · 396 in bank

   You have a Microsoft 365 E5 subscription. You plan to use Microsoft Entra ID Protection. You need to ensure that account passwords must be changed if account credentials are leaked. What should you configure?

   • Aa user risk policy
   • BPassword protection
   • Ca sign-in risk policy
   • Dself-service password reset (SSPR)

   Show answer

   Answer: A

   Explanation

   https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-risk-based-sspr-mfa#enable-user-risk-policy-for-password-change Enable user risk policy for password change: When one of these pairs matches an account in your environment, a risk-based password change can be requested

   Source: Adapted from community discussion — justITtopics

   References

   • Microsoft Learn

   Next question

5. Question 215 · 396 in bank

   HOTSPOT - You have a Microsoft Entra tenant that has security defaults enabled. You create a user named Admin1. You need to ensure that Admin1 can create and apply Conditional Access policies. Which two settings should you configure? To answer, select the appropriate settings in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   No, the correct answer is Roles and administrators and Properties. First, you assign the role "Conditional Access Administrator" to Admin1. Second, you need the license (at least Entra ID P1) in order to create Conditional Access, but first, you have to disable security defaults, otherwise, you will not be able to. https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults#move-from-security-defaults-to-conditional-access "After administrators disable security defaults, organizations should immediately enable Conditional Access policies to protect their organization"

   Source: Adapted from community discussion — justITtopics

   References

   • Microsoft Learn

   

   Next question

6. Question 216 · 396 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription and use Microsoft Defender for Cloud Apps. You have a cloud app named App1. You need to implement a security solution for App1 that meets the following requirements: • Enables the real-time monitoring of user activities • Blocks specific activities as needed What should you include in the solution for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. Enables the real-time monitoring of user activities: Conditional Access App Control 2. Blocks specific activities as needed: A session policy Explanation: Conditional Access App Control: This feature allows for real-time monitoring of user activities within cloud apps. It enables you to see what users are doing in the app as they use it, making it suitable for real-time monitoring. A session policy: This type of policy can be configured to block or restrict specific activities in real time, such as downloading files, copying data, or accessing certain features within the app, based on conditions that you set.

   Source: Adapted from community discussion — Tr619899

   

   Next question

7. Question 217 · 396 in bank

   Select 2

   You have a Microsoft 365 E5 subscription. You plan to ingest syslog data from a supported firewall device to Microsoft Defender for Cloud Apps. You need to configure automatic log upload. Which two components should you configure for the log collector? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • Athe receiver type
   • Bthe data source
   • Cthe username and password
   • Da connection string
   • Ethe host IP address or FQDN

   Show answer

   Answer: BE

   Explanation

   The Answer is correct: B and E The two components are Data sources and Log collectors. Under Log collectors you configure: Name Host IP address or FQDN Data source(s)

   Source: Adapted from community discussion — Ody

   References

   • Microsoft Learn

   Next question

8. Question 218 · 396 in bank

   Select 2

   You have a Microsoft 365 subscription that uses Microsoft Defender XDR. From Automatic remediation in the Microsoft Defender portal, you set Automation level to Semi – require approval for non-temp folders for the endpoints. You need to identify the impact of the Automation level setting on the endpoints. Which two actions will occur based on the remediation settings? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • ADevices will be remediated only after end-user approval.
   • BDevices will be remediated automatically if a threat is detected in the \program files (X86)\* folder
   • CDevices will be remediated automatically if a threat is detected in the \windows\ folder.
   • DDevices will be remediated automatically if a threat is detected in the \users\*\downloads\* folder.

   Show answer

   Answer: AD

   Explanation

   B. Devices will be remediated automatically if a threat is detected in the \program files (X86)* folder. The \program files (X86)\* folder is classified as a temporary folder under the automation level definitions. This means threats detected in this folder are remediated automatically without requiring approval. D. Devices will be remediated automatically if a threat is detected in the \users*\downloads* folder. The \users\*\downloads\* folder is also classified as a temporary folder, so threats in this location are remediated automatically. C. is the \windows\ directory is not classified as a temporary folder, but its subdirectory \windows\temp\* is. Since the question specifically references \windows\, it would require approval under the "Semi – require approval for non-temp folders" setting.

   Source: Adapted from community discussion — BigO76

   References

   • Microsoft Learn

   Next question

9. Question 219 · 396 in bank

   You have a Microsoft 365 E5 subscription that contains devices onboarded to Microsoft Defender for Endpoint. You integrate Microsoft Defender for Cloud Apps with Defender for Endpoint. You need identify which cloud apps and services were used most during the last 30 days. What should you do?

   • AGenerate a monthly security summary report.
   • BGenerate a Cloud Discovery snapshot report.
   • CCreate a threat analytics alert notification.
   • DGenerate a Cloud Discovery executive report.

   Show answer

   Answer: B

   Explanation

   To identify which cloud apps and services were used most during the last 30 days in Microsoft Defender for Cloud Apps, you should generate a Cloud Discovery snapshot report (Option B). This report provides ad-hoc visibility on a specific set of traffic logs that you manually upload from your network. It allows you to analyze your organization's cloud app usage against Microsoft's catalog of cloud apps, which can give insights into usage patterns and potential security risks https://learn.microsoft.com/en-us/defender-cloud-apps/create-snapshot-cloud-discovery-reports

   Source: Adapted from community discussion — Tr619899

   References

   • Microsoft Learn

   Next question

10. Question 220 · 396 in bank

    You have a Microsoft 365 E5 subscription that contains a user named User1. You create an outbound anti-spam policy named Policy1 as shown in the following exhibit.

    

    You assign Policy1 to User1. What is the maximum number of email messages that User1 can send in a 24-hour period?

    • A30
    • B720
    • C1000
    • D1030

    Show answer

    Answer: B

    Explanation

    Because 10 + 20 = 30 messages per hour is the maximum the user can send without triggering the hourly block, over 24 hours that totals 30 × 24 = 720. Although the daily limit is set to 1000, the stricter hourly caps prevent reaching 1000. Therefore, the maximum number of messages User1 can send in a 24-hour period is 720.

    Source: Adapted from community discussion — hwoccurrence

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

MS-102 practice, question 211. 396 questions available.