MS-102 practice questions 351–360

1. Question 351 · 396 in bank

   Your on-premises network contains an Active Directory domain. You have a Microsoft 365 subscription. You need to sync the domain with the subscription. The solution must meet the following requirements: On-premises Active Directory password complexity policies must be enforced. Users must be able to use self-service password reset (SSPR) in Azure AD. What should you use?

   • Apassword hash synchronization
   • BAzure AD Identity Protection
   • CAzure AD Seamless Single Sign-On (Azure AD Seamless SSO)
   • Dpass-through authentication

   Show answer

   Answer: D

   Explanation

   The most probably correct answer is D. PTA is 100% enforced authentication using AD settings. however, PHS: When password hash synchronization is enabled, the password complexity policies in your on-premises Active Directory instance override complexity policies in the cloud for synchronized users. You can use all of the valid passwords from your on-premises Active Directory instance to access Microsoft Entra services. https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-password-hash-synchronization#password-complexity-policy So, PTA or PHS comply with the requirements: Inherited from local AD: On-premises Active Directory password complexity policies must be enforced. PTA and PHS: support password writeback. both PTA and PHS comply with the requirements, however, I will bo with answer D which is the cleanest answer as all the authentication is executed in local AD.

   Source: Adapted from community discussion — sergioandreslq

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 352 · 396 in bank

   You have a Microsoft 365 E5 subscription. Users access Microsoft 365 from both their laptop and a corporate Virtual Desktop Infrastructure (VDI) solution. From Azure AD Identity Protection, you enable a sign-in risk policy. Users report that when they use the VDI solution, they are regularly blocked when they attempt to access Microsoft 365. What should you configure?

   • Athe Tenant restrictions settings in Azure AD
   • Ba trusted location
   • Ca Conditional Access policy exclusion
   • Dthe Microsoft 365 network connectivity settings

   Show answer

   Answer: B

   Explanation

   B. a trusted location By configuring a trusted location, you can exempt the VDI solution from the risk policy's scrutiny. This way, users accessing Microsoft 365 through the VDI solution won't trigger the risk policy and won't be regularly blocked when using it.

   Source: Adapted from community discussion — sherifhamed

   References

   • Microsoft Learn

   Next question

3. Question 353 · 396 in bank

   You have a Microsoft 365 subscription. You view the Service health Overview as shown in the following exhibit.

   

   You need to ensure that a user named User1 can view the advisories to investigate service health issues. Which role should you assign to User1?

   • AMessage Center Reader
   • BReports Reader
   • CService Support Administrator
   • DCompliance Administrator

   Show answer

   Answer: C

   Explanation

   https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/about-admin-roles?view=o365-worldwide#commonly-used-microsoft-365-admin-center-roles Service Support Admin - Assign the Service Support admin role as an additional role to admins or users who need to do the following in addition to their usual admin role: - Open and manage service requests - View and share message center posts - Monitor service health

   Source: Adapted from community discussion — letters1234

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 354 · 396 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains a user named User1. Azure AD Password Protection is configured as shown in the following exhibit.

   

   User1 attempts to update their password to the following passwords: F@lcon - Project22 - T4il$pin45dg4 - Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Answers are correct Only T4il$pin45dg4 will be allowed to change, the other two have an exact or within 1 character match to the banned passwords: https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad#fuzzy-matching-behavior Lockout period is 10 minutes (600 seconds) meaning on the 11th minute, the count starts again from 1 and would need another 15 bad passwords within the next 9 minutes to lock the user out.

   Source: Adapted from community discussion — letters1234

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 355 · 396 in bank

   You have a hybrid deployment of Microsoft 365 that contains the users shown in the following table.

   

   Azure AD Connect has the following settings: Password Hash Sync: Enabled - Pass-through authentication: Enabled You need to identify which users will be able to authenticate by using Azure AD if connectivity between on-premises Active Directory and the internet is lost. Which users should you identify?

   • Anone
   • BUser1 only
   • CUser1 and User2 only
   • DUser1, User2, and User3

   Show answer

   Answer: B

   Explanation

   B. Cloud user won't be affected. Why? Because Pass-through auth is ON for the on-prem soured users. Password Hash Sync is not an auto-fallback kind of a thing. Therefore, those users cannot authenticate without some work on the configuration to enable it, since the authentication happens on-prem.

   Source: Adapted from community discussion — amurp35

   References

   • Microsoft Learn

   Next question

6. Question 356 · 396 in bank

   You have a Microsoft 365 subscription that includes Microsoft Defender XDR. From the Microsoft Defender portal, you review the Microsoft Secure Score improvement actions shown in the following table.

   

   You plan to update the status of the improvement actions as shown in the following table.

   

   How many points will the Secure Score increase after the update?

   • A0
   • B4
   • C7
   • D13
   • E16

   Show answer

   Answer: B

   Next question

7. Question 357 · 396 in bank

   Your network contains an on-premises Active Directory domain named contoso.com. For all user accounts, the Logon Hours settings are configured to prevent sign-ins outside of business hours. You plan to sync contoso.com to an Azure AD tenant You need to recommend a solution to ensure that the logon hour restrictions apply when synced users sign in to Azure AD. What should you include in the recommendation?

   • Apass-through authentication
   • Bconditional access policies
   • Cpassword synchronization
   • DAzure AD Identity Protection policies

   Show answer

   Answer: A

   Explanation

   This requirement can be achieved only if you have Pass through Authentication configured as a sign in option with Azure AD and with Logon hours setting configured in on-premise AD. Other solution it´s PIM but not valid in that question

   Source: Adapted from community discussion — Casticod

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 358 · 396 in bank

   Your network contains three Active Directory forests. There are forests trust relationships between the forests. You create an Azure AD tenant. You plan to sync the on-premises Active Directory to Azure AD. You need to recommend a synchronization solution. The solution must ensure that the synchronization can complete successfully and as quickly as possible if a single server fails. What should you include in the recommendation?

   • Aone Azure AD Connect sync server and one Azure AD Connect sync server in staging mode
   • Bthree Azure AD Connect sync servers and one Azure AD Connect sync server in staging mode
   • Csix Azure AD Connect sync servers and three Azure AD Connect sync servers in staging mode
   • Dthree Azure AD Connect sync servers and three Azure AD Connect sync servers in staging mode

   Show answer

   Answer: A

   Explanation

   "Microsoft Entra Connect supports syncing from multiple forests. It supports only one instance of Microsoft Entra Connect syncing to Microsoft Entra ID. In cases where Microsoft Entra ID is already installed in one forest, the existing instance of Microsoft Entra Connect must be updated to sync from the other forest." https://learn.microsoft.com/en-us/skypeforbusiness/hybrid/cloud-consolidation-aad-connect

   Source: Adapted from community discussion — nordbymikael

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 359 · 396 in bank

   You have a Microsoft 365 subscription. You have the retention policies shown in the following table.

   

   Both policies are applied to a Microsoft SharePoint site named Site1 that contains a file named File1.docx. File1.docx was created on January 1, 2022 and last modified on January 31,2022. The file was NOT modified again. When will File1.docx be deleted automatically?

   • AJanuary 1, 2023
   • BJanuary 1, 2024
   • CJanuary 31, 2023
   • DJanuary 31, 2024
   • Enever

   Show answer

   Answer: D

   Explanation

   D is correct. Source: https://learn.microsoft.com/en-us/purview/retention?tabs=table-overriden#the-principles-of-retention-or-what-takes-precedence quote: "Example for this first principle: An email message is subject to a retention policy for Exchange that is configured to delete items three years after they are created, and it also has a retention label applied that is configured to retain items five years after they are created. The email message is retained for five years because this retention action takes precedence over deletion. The email message is permanently deleted at the end of the five years because of the delete action that was suspended while the retention action was in effect.

   Source: Adapted from community discussion — amurp35

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 360 · 396 in bank

    You have a Microsoft 365 E5 subscription that contains the groups shown in the following table.

    

    You plan to publish a sensitivity label named Label1. To which groups can you publish Label1?

    • AGroup1 only
    • BGroup1 and Group2 only
    • CGroup1 and Group4 only
    • DGroup1, Group2, and Group3 only
    • EGroup1, Group2, Group3, and Group4

    Show answer

    Answer: D

    Explanation

    The correct answer is D. You can apply sensitivity labels to Microsoft 365 Groups, SharePoint sites, Distribution Groups, and Mail-enabled Security Groups but not regular Security Groups. https://learn.microsoft.com/en-us/purview/sensitivity-labels#what-label-policies-can-do

    Source: Adapted from community discussion — amurp35

    References

    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

MS-102 practice, question 351. 396 questions available.