MS-102 practice questions 81–90

1. Question 81 · 396 in bank

   HOTSPOT - You have an Azure AD tenant that contains the users shown in the following table.

   

   You enable self-service password reset for all users. You set Number of methods required to reset to 1, and you set Methods available to users to Security questions only. What information must be configured for each user before the user can perform a self-service password reset? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Correct By default, administrator accounts are enabled for self-service password reset, and a strong default two-gate password reset policy is enforced. This policy may be different from the one you have defined for your users, and this policy can't be changed. You should always test password reset functionality as a user without any Azure administrator roles assigned. With a two-gate policy, administrators don't have the ability to use security questions. The two-gate policy requires two pieces of authentication data, such as an email address, authenticator app, or a phone number. https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-password-policy-differences

   Source: Adapted from community discussion — Casticod

   References

   • Microsoft Learn

   

   Next question

2. Question 82 · 396 in bank

   Select 2

   Your on-premises network contains an Active Directory domain. You have a Microsoft 365 E5 subscription. You plan to implement a hybrid configuration that has the following requirements: • Minimizes the number of times users are prompted for credentials when they access Microsoft 365 resources • Supports the use of Azure AD Identity Protection You need to configure Azure AD Connect to support the planned implementation. Which two options should you select? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • APassword Hash Synchronization
   • BPassword writeback
   • CDirectory extension attribute sync
   • DEnable single sign-on
   • EPass-through authentication

   Show answer

   Answer: AD

   Explanation

   A. Password Hash Synchronization: This option minimizes the number of times users are prompted for credentials when they access Microsoft 365 resources by synchronizing password hashes to Azure AD. D. Enable single sign-on: This option helps minimize the number of times users are prompted for credentials by providing single sign-on capabilities. Options B (Password writeback), C (Directory extension attribute sync), and E (Pass-through authentication) do not directly address the specific requirements mentioned in the scenario. So, the correct options are A and D.

   Source: Adapted from community discussion — poesklap

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 83 · 396 in bank

   HOTSPOT - Your network contains an Active Directory domain and an Azure AD tenant. You implement directory synchronization for all 10,000 users in the organization. You automate the creation of 100 new user accounts. You need to ensure that the new user accounts synchronize to Azure AD as quickly as possible. Which command should you run? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The answer given is correct. This cmdlet forces Entra Connect sync to create the new users (Delta = What changed since the last sync) in the Entra ID tenant.

   Source: Adapted from community discussion — Vaerox

   References

   • Microsoft Learn

   

   Next question

4. Question 84 · 396 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

   

   Each user has a device with the Microsoft Authenticator app installed. From Microsoft Authenticator settings for the subscription, the Enable and Target settings are configured as shown in the exhibit. (Click the Exhibit tab.)

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   This has got to be 1 - Y Authenticator App Installed and in scope 2 - Y Authenticator App Installed and as per the banner ALL users of Authenticator can have number matching NOT JUST PASSWORDLESS 3 - N Authenticator App Not Installed. Think people are getting confused by the mentioning of Passwordless.

   Source: Adapted from community discussion — Jamesat

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 85 · 396 in bank

   HOTSPOT - Overview - Litware, Inc. is a consulting company that has a main office in Montreal and a branch office in Seattle. Litware collaborates with a third-party company named A. Datum Corporation. Environment - On-Premises Environment - The network of Litware contains an Active Directory domain named litware.com. The domain contains three organizational units (OUs) named LitwareAdmins, Montreal Users, and Seattle Users and the users shown in the following table.

   

   The domain contains 2,000 Windows 10 Pro devices and 100 servers that run Windows Server 2019. Cloud Environment - Litware has a pilot Microsoft 365 subscription that includes Microsoft Office 365 Enterprise E3 licenses and Azure AD Premium P2 licenses. The subscription contains a verified DNS domain named litware.com. Azure AD Connect is installed and has the following configurations: • Password hash synchronization is enabled. • Synchronization is enabled for the LitwareAdmins OU only. Users are assigned the roles shown in the following table.

   

   Self-service password reset (SSPR) is enabled. The Azure AD tenant has Security defaults enabled. Problem Statements - Litware identifies the following issues: • Admin1 cannot create conditional access policies. • Admin4 receives an error when attempting to use SSPR. • Users access new Office 365 service and feature updates before the updates are reviewed by Admin2. Requirements - Planned Changes - Litware plans to implement the following changes: • Implement Microsoft Intune. • Implement Microsoft Teams. • Implement Microsoft Defender for Office 365. • Ensure that users can install Office 365 apps on their device. • Convert all the Windows 10 Pro devices to Windows 10 Enterprise ES. • Configure Azure AD Connect to sync the Montreal Users OU and the Seattle Users OU. Technical Requirements - Litware identifies the following technical requirements: • Administrators must be able to specify which version of an Office 365 desktop app will be available to users and to roll back to previous versions. • Only Admin2 must have access to new Office 365 service and feature updates before they are released to the company. • Litware users must be able to invite A. Datum users to participate in the following activities: • Join Microsoft Teams channels. • Join Microsoft Teams chats. • Access shared files. • Just in time access to critical administrative roles must be required. • Microsoft 365 incidents and advisories must be reviewed monthly. • Office 365 service status notifications must be sent to Admin2. • The principle of least privilege must be used. You need to ensure that the Microsoft 365 incidents and advisories are reviewed monthly. Which users can review the incidents and advisories, and which blade should the users use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Note People who are assigned the global admin role can view service health, as well as people assigned to other admin roles such as Service Support admin and Helpdesk admin. For more information about roles that can view service health, see About admin roles. https://learn.microsoft.com/en-us/microsoft-365/enterprise/view-service-health?view=o365-worldwide

   Source: Adapted from community discussion — mickey88

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 86 · 396 in bank

   You have a Microsoft 365 tenant that contains a Windows 10 device. The device is onboarded to Microsoft Defender for Endpoint. From Microsoft 365 Defender portal, you perform a security investigation. You need to run a PowerShell script on the device to collect forensic information. Which action should you select on the device page?

   • ACollect investigation package
   • BGo hunt
   • CInitiate Live Response Session
   • DInitiate Automated Investigation

   Show answer

   Answer: C

   Explanation

   C: Live response is designed to enhance investigations by enabling you to collect forensic data, run scripts, send suspicious entities for analysis, remediate threats, and proactively hunt for emerging threats. https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/respond-machine-alerts?view=o365-worldwide

   Source: Adapted from community discussion — Vincent1966

   References

   • Microsoft Learn

   Next question

7. Question 87 · 396 in bank

   HOTSPOT - You configure an anti-phishing policy as shown in the following exhibit.

   

   Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   If you look closely at the image, you can see that Anti-spoofing protection is already set to "On". The best answer I think is still to enable Mailbox Intelligence (because it is not turned on).

   Source: Adapted from community discussion — Vaerox

   References

   • Microsoft Learn

   

   Next question

8. Question 88 · 396 in bank

   You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365. You notice that it takes several days to notify email recipients when an incoming email message is marked as spam, and then quarantined. You need to ensure that the email recipients are notified within 24 hours. What should you do?

   • AModify the default inbound anti-spam policy.
   • BModify the DefaultFullAccessPolicy quarantine policy.
   • CAdd a custom quarantine policy.
   • DModify the global settings for quarantine policies.

   Show answer

   Answer: D

   Explanation

   Answer is correct. Quarantine policy, Global Settings (Defender portal -> Email & Collaboration -> Policies & rules -> Threat policies -> Quarantine policy). Change 'Send end-user spam notifications' to Daily.

   Source: Adapted from community discussion — cb0900

   References

   • Microsoft Learn

   Next question

9. Question 89 · 396 in bank

   You have a Microsoft 365 E5 subscription. You need to ensure that administrators receive an email when Microsoft 365 Defender detects a sign-in from a risky IP address. What should you create?

   • Aa vulnerability notification rule
   • Ban alert
   • Can incident assignment filter
   • Dan incident notification rule

   Show answer

   Answer: B

   Explanation

   Answer is correct, tested in lab environment. see: https://www.examtopics.com/discussions/microsoft/view/93909-exam-ms-101-topic-2-question-119-discussion/ Defender for Cloud Apps > Control > Policies > select "Activity from suspicious IP addresses" policy > go to Alerts section and set up email alert.

   Source: Adapted from community discussion — JMB7448

   Next question

10. Question 90 · 396 in bank

    HOTSPOT - You have an Azure AD tenant that contains the users shown in the following table.

    

    Your company uses Microsoft Defender for Endpoint. Microsoft Defender for Endpoint contains the roles shown in the following table.

    

    Microsoft Defender for Endpoint contains the device groups shown in the following table.

    

    For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Here are my thoughts. No, No, Yes Q: User 1 can run an antivirus scan on device 2. A: No. User 1 belongs to Group 1 and has the permission to "View data, alerts investigations" under role 1. Running an antivirus scan would typically require additional permissions which are not listed here for User 1. Q: User 2 can collect an investigation package from device 2. A: No. User 2 belongs to Group 2 and has the permission to "View data" under role 2. Collecting an investigation package would likely require additional permissions which are not listed for User 2. Q: User 3 can isolate device 2. A: Yes. User 3 belongs to Group 3 and has the role of Microsoft Defender for Endpoint Administrator which includes permissions to "View data, alerts investigations, active remediations, manage security settings." These permissions encompass the ability to take actions such as isolating a device.

    Source: Adapted from community discussion — Nilz76

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

MS-102 practice, question 81. 396 questions available.