MS-102 practice questions 51–60

1. Question 51 · 396 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription. You have an Azure AD tenant named contoso.com that contains the following users: • Admin1 • Admin2 • User1 Contoso.com contains an administrative unit named AU1 that has no role assignments. User1 is a member of AU1. You create an administrative unit named AU2 that does NOT have any members or role assignments. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Since the question stated "You create an administrative unit named AU2 that does NOT have any members or role assignments." --> to be able to create AU, you have to be "Global Admin or Privilege Role Admin". So it is safe to assume, "You" in this question has one of those role. https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-manage?tabs=ms-powershell

   Source: Adapted from community discussion — e6d6bf4

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 52 · 396 in bank

   HOTSPOT - Your company has a Microsoft 365 subscription that contains the users shown in the following table.

   

   External collaboration settings have default configuration. You need to identify which users can perform the following administrative tasks: • Modify the password protection policy. • Create guest user accounts. Which users should you identify for each task? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Wait wait wait... https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/about-guest-users?view=o365-worldwide Before you begin: You must be a global administrator to perform this task. So 1: User1 and User2 2. User1

   Source: Adapted from community discussion — Frippy

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 53 · 396 in bank

   You have a Microsoft 365 subscription that contains the users shown in the following table.

   

   You plan to use Exchange Online to manage email for a DNS domain. An administrator adds the DNS domain to the subscription. The DNS domain has a status of Incomplete setup. You need to identify which user can complete the setup of the DNS domain. The solution must use the principle of least privilege. Which user should you identify?

   • AUser1
   • BUser2
   • CUser3
   • DUser4

   Show answer

   Answer: A

   Explanation

   Mi vote for User 1: Global Admin https://learn.microsoft.com/en-us/microsoft-365/admin/setup/add-domain?view=o365-worldwide#before-you-begin Global Administrator or Domain Name Administrator https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#domain-name-administrator Organization Management is a role of Exchange Online https://learn.microsoft.com/en-us/exchange/permissions-exo/permissions-exo#:~:text=domains%2C%20and%20connectors.-,Organization%20Management,-Reset%20Password

   Source: Adapted from community discussion — justITtopics

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 54 · 396 in bank

   You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

   

   You plan to create a Conditional Access policy that will use GPS-based named locations. Which users can the policy protect?

   • AUser2 and User4 only
   • BUser1, User2, User3, and User4
   • CUser1 only
   • DUser1 and User3 only

   Show answer

   Answer: C

   Explanation

   GPS location doesn't work with passwordless authentication methods and when the location condition of a Conditional Access policy is configured, users will be prompted by the Authenticator app to share their GPS location.

   Source: Adapted from community discussion — Vincent1966

   References

   • Microsoft Learn

   Next question

5. Question 55 · 396 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

   

   You enable self-service password reset (SSPR) for Group1. You configure security questions as the only authentication method for SSPR. Which users can use SSPR, and which users must answer security questions to reset their password? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: 1,2 and 4 - Admins are always enabled for self-service password reset Box 2: 2 - Admins are required to use two authentication methods to reset their password.

   Source: Adapted from community discussion — Vincent1966

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 56 · 396 in bank

   Your network contains an Active Directory forest named contoso.local. You have a Microsoft 365 subscription. You plan to implement a directory synchronization solution that will use password hash synchronization. From the Microsoft 365 admin center, you successfully verify the contoso.com domain name. You need to prepare the environment for the planned directory synchronization solution. What should you do first?

   • AFrom the Microsoft 365 admin center, verify the contoso.local domain name.
   • BFrom the public DNS zone of contoso.com, add a new mail exchanger (MX) record.
   • CFrom Active Directory Domains and Trusts, add contoso.com as a UPN suffix.
   • DFrom Active Directory Users and Computers, modify the UPN suffix for all users.

   Show answer

   Answer: C

   References

   • Microsoft Learn

   Next question

7. Question 57 · 396 in bank

   Your network contains an on-premises Active Directory domain named contoso.com. The domain contains 1,000 Windows 10 devices. You perform a proof of concept (PoC) deployment of Microsoft Defender for Endpoint for 10 test devices. During the onboarding process, you configure Microsoft Defender for Endpoint-related data to be stored in the United States. You plan to onboard all the devices to Microsoft Defender for Endpoint. You need to store the Microsoft Defender for Endpoint data in Europe. What should you do first?

   • ADelete the workspace.
   • BCreate a workspace.
   • COnboard a new device.
   • DOffboard the test devices.

   Show answer

   Answer: D

   Explanation

   D. Offboard the test devices Offboarding the test devices as a first step, followed by setting up/creating a new workspace in Europe. If the data storage location is tied to the workspace and cannot be changed once set, then it would make sense to offboard the test devices from the current workspace before creating a new workspace in the data storage location of Europe.

   Source: Adapted from community discussion — Nilz76

   References

   • Microsoft Learn

   Next question

8. Question 58 · 396 in bank

   You have a Microsoft 365 ES subscription. On Monday, you create a new user named User1. On Tuesday, User1 signs in for the first time and perform the following actions: • Signs in to Microsoft Exchange Online from an anonymous IP address. • Signs in to Microsoft SharePoint Online from a device in New York City. • Establishes Remote Desktop connections to hosts in Berlin and Hong Kong, and then signs in to SharePoint Online from the Remote Desktop connections. Which types of sign-in risks will Azure AD Identity Protection detect for User1?

   • Aanonymous IP address and atypical travel only
   • Banonymous IP address only
   • Cunfamiliar sign-in properties and atypical travel only
   • Danonymous IP address and unfamiliar sign-in properties only
   • Eanonymous IP address, atypical travel, and unfamiliar sign-in properties

   Show answer

   Answer: B

   Explanation

   Correct answer. Atypical travel and Unfamiliar sign-in properties have learning period. The system has an initial learning period of the earliest of 14 days or 10 logins, during which it learns a new user's sign-in behavior.

   Source: Adapted from community discussion — Demonster

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 59 · 396 in bank

   HOTSPOT - You have a Microsoft 365 subscription that contains the users shown in the following table.

   

   You have the named locations shown in the following table.

   

   You create a conditional access policy that has the following configurations: • Users or workload identities: • Include: Group1 • Exclude: Group2 • Cloud apps or actions: Include all cloud apps • Conditions: • Include: Any location • Exclude: Montreal • Access control: Grant access, Require multi-factor authentication User1 is on the multi-factor authentication (MFA) blocked users list. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Y = User1 is on the MFA block list BUT IP range 133.107.10.20 is Montreal which is EXLUDED from MFA so user1 can access N = User1 is on the MFA block list AND IP range 193.77.10.15 is Toronto which is INCLUDED in MFA so User cannot access Y = User2 is not in the MFA block list and and member of Group2 which is excluded from the conditional acces policy and therefore can access from 193.77.10.20 Toronto. User2 is even allowed to access M365 from Montreal because the policy is noit applied to User2.

   Source: Adapted from community discussion — aleksdj

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 60 · 396 in bank

    HOTSPOT - You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

    

    Each user has an Android device with the Microsoft Authenticator app installed and has set up phone sign-in. The subscription has the following Conditional Access policy: • Name: Policy1 • Assignments • Users and groups: Group1, Group2 • Cloud apps or actions: All cloud apps • Access controls • Grant: Require multi-factor authentication • Enable policy: On From Microsoft Authenticator settings for the subscription, the Enable and Target settings are configured as shown in the exhibit. (Click the Exhibit tab.)

    

    For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    How does multifactor authentication work? Let's say you're going to sign into your Microsoft account or work or school account, and you enter your username and password. If that's all you need then anybody who knows your username and password can sign in as you from anywhere in the world! But if you have multifactor authentication enabled, things get more interesting. The first time you sign in on a device or app you enter your username and password as usual, then you get prompted to enter your second factor to verify your identity. https://support.microsoft.com/en-gb/topic/what-is-multifactor-authentication-e5e39437-121c-be60-d123-eda06bddf661 User2: It doesn`t specify that they "only" enter a username and password? With passwordless MFA optional, I`d say User2 could sign in.

    Source: Adapted from community discussion — Scotte2023

    References

    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

MS-102 practice, question 51. 396 questions available.