MS-102 practice questions 281–290

1. Question 281 · 396 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

   

   You configure a Multifactor authentication registration policy that has the following settings: • Assignments: o Include: Group1 o Exclude: Group2 • Controls: Require Microsoft Entra ID multifactor authentication registration • Policy enforcement: Enabled You create a conditional access policy that has the following settings: • Name: Policy1 • Assignments: o Include: Group2 o Exclude: Group1 • Grant: Require multifactor authentication • Enable policy: On For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   This question is identical to question 247 No: He gets a registration prompt next time. BUT he can postpone registration No: He is excluded from both policies (exclude overrules include) Yes: He is included in the Conditional Access Policy

   Source: Adapted from community discussion — JohnDoe47

   References

   • Microsoft Learn

   

   Next question

2. Question 282 · 396 in bank

   HOTSPOT - Your company has offices in Montreal, Seattle, and New York City. You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

   

   The offices have the IP addresses shown in the following table.

   

   From Microsoft Defender for Cloud Apps, you create the activity policy shown in the following exhibit.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   N-Y-N Montreal is a "maybe" because of the subnet mask mismatch in the config. Policy matches Seattle IP. 1 download per second for 2 mins surpasses the 30 threshold in the policy for 1 min. NY doesn't match policy anywhere.

   Source: Adapted from community discussion — hola1010

   

   Next question

3. Question 283 · 396 in bank

   You have a Microsoft 365 E5 subscription that contains a user named User1. You create an anti-phishing policy named Policy1 that has the following settings: • Include these users, groups and domains: User1 • Phishing email threshold: 3 - More Aggressive User1 receives the email messages shown in the following table.

   

   Which messages are phishing email?

   • AMail4 only
   • BMail3 and Mail4 only
   • CMail2, Mail3, and Mail4 only
   • DMail1, Mail2, Mail3, and Mail4

   Show answer

   Answer: C

   Explanation

   it is C. 3 - More aggressive: Messages that are identified as phishing with a medium or high degree of confidence are treated as if they were identified with a very high degree of confidence. https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about#advanced-phishing-thresholds-in-anti-phishing-policies-in-microsoft-defender-for-office-365

   Source: Adapted from community discussion — makonmakon

   References

   • Microsoft Learn

   Next question

4. Question 284 · 396 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription and use Microsoft Defender for Endpoint. The subscription contains Windows 11 devices. You need to create a policy to restrict users from accessing the Device security settings and the Account protection settings in Windows Defender Security Center on the devices. Which type of policy should you create, and which template should you use? To answer, select the appropriate options in the answer area.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Policy type: Endpoint security policy This type of policy is used to configure security-related settings for devices. Template: Windows Security Experience The "Windows Security Experience" template is specifically designed to manage access to and control the experience within the Windows Defender Security Center.

   Source: Adapted from community discussion — JoskeVr

   

   Next question

5. Question 285 · 396 in bank

   You have a Microsoft 365 E5 subscription. You plan to implement Microsoft Purview policies to meet the following requirements: Identify documents that are stored in Microsoft Teams and SharePoint that contain Personally Identifiable Information (PII). Report on shared documents that contain PII. What should you create?

   • Aa data loss prevention (DLP) policy
   • Ba retention policy
   • Can alert policy
   • Da Microsoft Defender for Cloud Apps policy

   Show answer

   Answer: A

   Explanation

   To meet the requirements, you should choose option A: a data loss prevention (DLP) policy. The Data Loss Prevention (DLP) policy in Microsoft 365 enables you to identify, monitor, and protect sensitive data. You can configure rules to search for personally identifiable information (PII) in documents stored in Microsoft Teams and SharePoint. You can also generate custom reports to notify about shared documents that contain personal information

   Source: Adapted from community discussion — Wazery

   Next question

6. Question 286 · 396 in bank

   Select 2

   You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint and Microsoft Intune. All devices run Windows 11 and are Microsoft Entra joined. You are alerted to a zero-day attack. You need to identify which devices were affected by the attack and send a request to Intune administrators to update the affected devices. Which two actions should you perform in the Microsoft Defender portal? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AFrom Threat analytics, view the list of vulnerable devices.
   • BFrom Incidents & alerts, select the latest incident.
   • CFrom Vulnerability management, open the security recommendation.
   • DSelect the affected devices and request remediation.

   Show answer

   Answer: AD

   Explanation

   A. From Threat analytics, view the list of vulnerable devices. Go to Microsoft Defender portal. Navigate to Threat hunting > Advanced hunting. Run a Kusto Query Language (KQL) query to identify affected devices based on indicators of compromise (IOCs), suspicious processes, or exploit activity. D. Select the affected devices and request remediation. for example by tagging devices and notifying Intune Administrators

   Source: Adapted from community discussion — makonmakon

   Next question

7. Question 287 · 396 in bank

   Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have a Microsoft 365 E5 subscription and use Microsoft Defender for Office 365. You need to implement a threat policy that will apply a balanced baseline protection profile to protect against spam, phishing, and malware. Solution: You create an anti-phishing policy. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Next question

8. Question 288 · 396 in bank

   HOTSPOT - You have an on-premises server named Server1 that runs Windows Server. Server1 is used to access a software as a service (SaaS) app named App1. You have a Microsoft 365 E5 subscription and use Microsoft Defender for Cloud Apps, Microsoft Defender XDR, Microsoft Defender for Endpoint, and Microsoft Defender for Identity. You configure Cloud Discovery for App1 and Server1. You need to meet the following requirements: • Tag Server1 as a high-value device. • Ensure that an alert is triggered when App1 is accessed. What should you do for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

9. Question 289 · 396 in bank

   You have a Microsoft 365 E5 subscription and use Microsoft Defender for Cloud Apps. You are reviewing the activity log of the subscription. You need to ensure that events originating from the on-premises network are categorized automatically as Administrative. What should you create?

   • Aa critical asset classification
   • Ban indicator for IP addresses
   • Can IP address range
   • Da named location

   Show answer

   Answer: D

   Next question

10. Question 290 · 396 in bank

    You have an on-premises server named Server1 that runs Windows Server. You have a Microsoft 365 E5 subscription and use Microsoft Defender for Cloud Apps. You plan to configure Cloud Discovery and enable automatic log upload. You need to ensure that you can run the log collector on Server1. What should you install on Server1?

    • Athe Microsoft Graph PowerShell SDK
    • B.NET Framework 4.8
    • CDocker
    • Dthe Azure Connected Machine agent

    Show answer

    Answer: C

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

MS-102 practice, question 281. 396 questions available.