10 free Microsoft MS-102 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 460 questions. Work through them, then open each answer to check your reasoning.
Get all 460 questions (US$39) · Download these 10 as a PDF
Question 1
Show the case study this question is based on
Overview
Fabrikam, Inc. is an electronics company that produces consumer products. Fabrikam has 10,000 employees worldwide.
Fabrikam has a main office in London and branch offices in major cities in Europe, Asia, and the United States.
Existing Environment
Active Directory Environment
The network contains an Active Directory forest named fabrikam.com. The forest contains all the identities used for user and computer authentication. Each department is represented by a top-level organizational unit (OU) that contains several child OUs for user accounts and computer accounts.
All users authenticate to on-premises applications by signing in to their device by using a UPN format of username@fabrikam.com.
Fabrikam does NOT plan to implement identity federation.
Network Infrastructure
Each office has a high-speed connection to the Internet.
Each office contains two domain controllers. All domain controllers are configured as DNS servers.
The public zone for fabrikam.com is managed by an external DNS server.
All users connect to an on-premises Microsoft Exchange Server 2016 organization. The users access their email by using Outlook Anywhere, Outlook on the web, or the Microsoft Outlook app for iOS. All the Exchange servers have the latest cumulative updates installed.
All shared company documents are stored on a Microsoft SharePoint Server farm.
Requirements
Planned Changes
Fabrikam plans to implement a Microsoft 365 Enterprise subscription and move all email and shared documents to the subscription.
Fabrikam plans to implement two pilot projects:
Project1: During Project1, the mailboxes of 100 users in the sales department will be moved to Microsoft 365.
Project2: After the successful completion of Project1, Microsoft Teams will be enabled in Microsoft 365 for the sales department users.
Fabrikam plans to create a group named UserLicenses that will manage the allocation of all Microsoft 365 bulk licenses.
Technical Requirements
Fabrikam identifies the following technical requirements:
All users must be able to exchange email messages successfully during Project1 by using their current email address.
Users must be able to authenticate to cloud services if Active Directory becomes unavailable.
A user named User1 must be able to view all DLP reports from the Microsoft Purview compliance portal.
Microsoft 365 Apps for enterprise applications must be installed from a network share only.
Disruptions to email access must be minimized.
Application Requirements
Fabrikam identifies the following application requirements:
An on-premises web application named App1 must allow users to complete their expense reports online. App1 must be available to users from the My Apps portal.
The installation of feature updates for Microsoft 365 Apps for enterprise must be minimized.
Security Requirements
Fabrikam identifies the following security requirements:
After the planned migration to Microsoft 365, all users must continue to authenticate to their mailbox and to SharePoint sites by using their UPN.
The membership of the UserLicenses group must be validated monthly. Unused user accounts must be removed from the group automatically.
After the planned migration to Microsoft 365, all users must be signed in to on-premises and cloud-based applications automatically.
The principle of least privilege must be used.
You are evaluating the required processes for Project1.
You need to recommend which DNS record must be created while adding a domain name for the project.
Which DNS record should you recommend?
Show answer and explanation
Correct answer: C. text (TXT)
Adding a domain to Microsoft 365 starts with proving ownership, and Microsoft supplies a TXT record value that you publish in the public DNS zone for fabrikam.com. Verification completes once that TXT record is detected. SPF and DMARC also use TXT records, while DKIM is published as two CNAME records.
Why the other options are wrong
- A. Host (A) records map names to IP addresses and are not used to verify domain ownership in Microsoft 365.
- B. HINFO records describe host hardware and software and play no part in the Microsoft 365 domain setup process.
- D. PTR records support reverse DNS lookups and are not requested when you add a domain to Microsoft 365.
Question 2
Show the case study this question is based on
Overview
Fabrikam, Inc. is an electronics company that produces consumer products. Fabrikam has 10,000 employees worldwide.
Fabrikam has a main office in London and branch offices in major cities in Europe, Asia, and the United States.
Existing Environment
Active Directory Environment
The network contains an Active Directory forest named fabrikam.com. The forest contains all the identities used for user and computer authentication. Each department is represented by a top-level organizational unit (OU) that contains several child OUs for user accounts and computer accounts.
All users authenticate to on-premises applications by signing in to their device by using a UPN format of username@fabrikam.com.
Fabrikam does NOT plan to implement identity federation.
Network Infrastructure
Each office has a high-speed connection to the Internet.
Each office contains two domain controllers. All domain controllers are configured as DNS servers.
The public zone for fabrikam.com is managed by an external DNS server.
All users connect to an on-premises Microsoft Exchange Server 2016 organization. The users access their email by using Outlook Anywhere, Outlook on the web, or the Microsoft Outlook app for iOS. All the Exchange servers have the latest cumulative updates installed.
All shared company documents are stored on a Microsoft SharePoint Server farm.
Requirements
Planned Changes
Fabrikam plans to implement a Microsoft 365 Enterprise subscription and move all email and shared documents to the subscription.
Fabrikam plans to implement two pilot projects:
Project1: During Project1, the mailboxes of 100 users in the sales department will be moved to Microsoft 365.
Project2: After the successful completion of Project1, Microsoft Teams will be enabled in Microsoft 365 for the sales department users.
Fabrikam plans to create a group named UserLicenses that will manage the allocation of all Microsoft 365 bulk licenses.
Technical Requirements
Fabrikam identifies the following technical requirements:
All users must be able to exchange email messages successfully during Project1 by using their current email address.
Users must be able to authenticate to cloud services if Active Directory becomes unavailable.
A user named User1 must be able to view all DLP reports from the Microsoft Purview compliance portal.
Microsoft 365 Apps for enterprise applications must be installed from a network share only.
Disruptions to email access must be minimized.
Application Requirements
Fabrikam identifies the following application requirements:
An on-premises web application named App1 must allow users to complete their expense reports online. App1 must be available to users from the My Apps portal.
The installation of feature updates for Microsoft 365 Apps for enterprise must be minimized.
Security Requirements
Fabrikam identifies the following security requirements:
After the planned migration to Microsoft 365, all users must continue to authenticate to their mailbox and to SharePoint sites by using their UPN.
The membership of the UserLicenses group must be validated monthly. Unused user accounts must be removed from the group automatically.
After the planned migration to Microsoft 365, all users must be signed in to on-premises and cloud-based applications automatically.
The principle of least privilege must be used.
You need to ensure that all the sales department users can authenticate successfully during Project1 and Project2.
Which authentication strategy should you implement for the pilot projects?
Show answer and explanation
Correct answer: C. password hash synchronization and seamless SSO
Password hash synchronization combined with seamless SSO is the optimal strategy for this scenario. It meets the requirement for authentication when Active Directory becomes unavailable (password hash provides fallback authentication) while seamless SSO ensures automatic sign-in to both on-premises and cloud applications. This combination provides both resilience and user experience requirements without requiring identity federation.
Why the other options are wrong
- A. Pass-through authentication alone does not provide fallback authentication if Active Directory becomes unavailable.
- B. Pass-through authentication cannot function if AD is unavailable, failing the requirement for continuous authentication during AD outages.
- D. Password hash synchronization alone does not provide the seamless SSO experience required for automatic sign-in to all applications.
Question 3
Show the case study this question is based on
Overview
Fabrikam, Inc. is an electronics company that produces consumer products. Fabrikam has 10,000 employees worldwide.
Fabrikam has a main office in London and branch offices in major cities in Europe, Asia, and the United States.
Existing Environment
Active Directory Environment
The network contains an Active Directory forest named fabrikam.com. The forest contains all the identities used for user and computer authentication. Each department is represented by a top-level organizational unit (OU) that contains several child OUs for user accounts and computer accounts.
All users authenticate to on-premises applications by signing in to their device by using a UPN format of username@fabrikam.com.
Fabrikam does NOT plan to implement identity federation.
Network Infrastructure
Each office has a high-speed connection to the Internet.
Each office contains two domain controllers. All domain controllers are configured as DNS servers.
The public zone for fabrikam.com is managed by an external DNS server.
All users connect to an on-premises Microsoft Exchange Server 2016 organization. The users access their email by using Outlook Anywhere, Outlook on the web, or the Microsoft Outlook app for iOS. All the Exchange servers have the latest cumulative updates installed.
All shared company documents are stored on a Microsoft SharePoint Server farm.
Requirements
Planned Changes
Fabrikam plans to implement a Microsoft 365 Enterprise subscription and move all email and shared documents to the subscription.
Fabrikam plans to implement two pilot projects:
Project1: During Project1, the mailboxes of 100 users in the sales department will be moved to Microsoft 365.
Project2: After the successful completion of Project1, Microsoft Teams will be enabled in Microsoft 365 for the sales department users.
Fabrikam plans to create a group named UserLicenses that will manage the allocation of all Microsoft 365 bulk licenses.
Technical Requirements
Fabrikam identifies the following technical requirements:
All users must be able to exchange email messages successfully during Project1 by using their current email address.
Users must be able to authenticate to cloud services if Active Directory becomes unavailable.
A user named User1 must be able to view all DLP reports from the Microsoft Purview compliance portal.
Microsoft 365 Apps for enterprise applications must be installed from a network share only.
Disruptions to email access must be minimized.
Application Requirements
Fabrikam identifies the following application requirements:
An on-premises web application named App1 must allow users to complete their expense reports online. App1 must be available to users from the My Apps portal.
The installation of feature updates for Microsoft 365 Apps for enterprise must be minimized.
Security Requirements
Fabrikam identifies the following security requirements:
After the planned migration to Microsoft 365, all users must continue to authenticate to their mailbox and to SharePoint sites by using their UPN.
The membership of the UserLicenses group must be validated monthly. Unused user accounts must be removed from the group automatically.
After the planned migration to Microsoft 365, all users must be signed in to on-premises and cloud-based applications automatically.
The principle of least privilege must be used.
Which role should you assign to User1?
Show answer and explanation
Correct answer: B. Security Reader
The Security Reader role provides the minimum necessary permissions to view all DLP reports from the Microsoft Purview compliance portal without granting unnecessary administrative privileges. This aligns with the principle of least privilege specified in the security requirements.
Why the other options are wrong
- A. Hygiene Management role is designed for managing mail hygiene and threat policies, not for viewing DLP reports.
Question 4
Your company has a Microsoft 365 subscription.
You need to identify all the users in the subscription who are licensed for Office 365 through a group membership. The solution must include the name of the group used to assign the license.
What should you use?
Show answer and explanation
Correct answer: C. the Licenses blade in the Microsoft Entra admin center
The Licenses blade in the Microsoft Entra admin center provides a view of all users licensed through group membership and displays which specific group is assigned to each license. This is the dedicated tool for identifying users with group-based licensing and their associated groups.
Why the other options are wrong
- A. Active users in the Microsoft 365 admin center shows user licensing status but does not specifically identify group-based licensing or the group names used.
- B. Reports in Microsoft Purview compliance portal focus on compliance and security matters, not licensing information.
- D. Reports in the Microsoft 365 admin center provide general license usage but lack the specific group membership details shown in the Licenses blade.
Question 5
You have a Microsoft 365 subscription that contains the users shown in the following table.
You need to configure group-based licensing to meet the following requirements:
To all users, deploy an Office 365 E3 license without the Power Automate license option.
To all users, deploy an Enterprise Mobility + Security E5 license.
To the users in the research department only, deploy a Power BI Pro license.
To the users in the marketing department only, deploy a Visio Plan 2 license.
What is the minimum number of deployment groups required?
Show answer and explanation
Correct answer: C. 3
To meet all requirements with group-based licensing, you need to identify the minimum number of distinct license combinations. Group 1: All users (User1, User2, User3, User4) receive Office 365 E3 (without Power Automate) and Enterprise Mobility + Security E5. Group 2: Research department users (User2) receive Power BI Pro in addition to Group 1 licenses. Group 3: Marketing department users (User4) receive Visio Plan 2 in addition to Group 1 licenses. User3 (Human resources) receives only the licenses from Group 1. This requires a minimum of 3 groups because the licensing requirements diverge: all users share two licenses, but Research and Marketing departments each need unique additional licenses that cannot be combined into a single group without giving inappropriate licenses to other users.
Why the other options are wrong
- A. One group cannot satisfy the requirement since Research and Marketing departments need different additional licenses (Power BI Pro vs. Visio Plan 2).
- B. Two groups would leave User3 in Human resources without a clear licensing path, as you'd need to handle the base licenses plus two separate department-specific groups.
- D. Four groups would be unnecessary; you don't need separate groups for Human resources users since they only require the base licenses shared by all users.
- E. Five groups would be excessive; there's no scenario where you need a group for each individual user when departments can be consolidated.
Question 6
You have a Microsoft 365 subscription.
You view the Service health Overview as shown in the following exhibit.
You need to ensure that a user named User1 can view the advisories to investigate service health issues.
Which role should you assign to User1?
Show answer and explanation
Correct answer: C. Service Support Administrator
Service Support Administrator is the role that grants users access to view and manage service health advisories in the Microsoft 365 admin center. This role allows User1 to view the Service health page, including all active issues and advisories (such as the 3 advisories for Exchange Online, 2 for Microsoft 365 suite, etc.) that are displayed in the exhibit. This role is specifically designed for users who need to investigate and respond to service health issues affecting their organization.
Why the other options are wrong
- A. Message Center Reader only allows viewing messages in the Message Center; it does not grant access to the Service health dashboard with advisories and issue details.
- B. Reports Reader provides access to view usage reports and analytics in Microsoft 365 but does not grant permission to view service health advisories or investigate service issues.
- D. Compliance Administrator focuses on managing compliance-related tasks and policies; it does not specifically grant access to the Service health page for investigating advisories.
Question 7
You have a Microsoft 365 subscription.
You have an Azure AD tenant that contains the users shown in the following table.
You configure Tenant properties as shown in the following exhibit.
Which users will be contacted by Microsoft if the tenant experiences a data breach?
Show answer and explanation
Correct answer: B. User2 only
In Azure AD, the Technical contact field is used for internal Azure notifications, while the Global privacy contact is the designated recipient for data breach and security incident notifications from Microsoft. User1@contoso.com is configured as the Technical contact, but the Global privacy contact field is empty (only showing a checkmark indicating the field is present but not filled). Since User2 has the Global Administrator role and no Global privacy contact is explicitly set, Microsoft will contact User2 as the default contact for data breach notifications, as Global Administrators are the fallback recipients for critical security communications when no specific privacy contact is designated.
Why the other options are wrong
- A. User1 is the Technical contact, not the Global privacy contact; Technical contacts receive operational notifications, not breach notifications.
- C. User3 is a Service Support Administrator with no special designation in the tenant properties that would make them a breach notification recipient.
- D. User1 is the Technical contact (not responsible for breach notifications) and User2 is the correct contact, but including User1 is incorrect.
- E. User3 has no role or tenant property configuration that designates them as a breach contact; User2 alone is correct.
Question 8
Your network contains an Active Directory forest named contoso.local.
You purchase a Microsoft 365 subscription.
You plan to move to Microsoft 365 and to implement a hybrid deployment solution for the next 12 months.
You need to prepare for the planned move to Microsoft 365.
What is the best action to perform before you implement directory synchronization? More than one answer choice may achieve the goal.
Select the BEST answer.
Show answer and explanation
Correct answer: D. Purchase a custom domain name.
Purchasing a custom domain name is the best preparatory action before implementing directory synchronization. Microsoft 365 requires a routable domain, and having this in place ensures proper UPN formatting and mail flow configuration. While on-premises forest is contoso.local, the Microsoft 365 tenant will use a public domain like contoso.com.
Why the other options are wrong
- A. X.509 certificates are used for specific scenarios like certificate-based authentication but are not required before directory synchronization.
- B. External forest trusts are not necessary for hybrid Microsoft 365 deployments using directory synchronization.
- C. Renaming the Active Directory forest is not required or recommended before implementing hybrid Microsoft 365 solutions.
Question 9
You have a Microsoft 365 subscription.
You configure a new Azure AD enterprise application named App1. App1 requires that a user be assigned the Reports Reader role.
Which type of group should you use to assign the Reports Reader role and to access App1?
Show answer and explanation
Correct answer: C. a security group that has assigned membership
A group used to assign a Microsoft Entra role must be role-assignable and must have assigned membership, because dynamic membership is not supported for role assignment. A security group with assigned membership can hold the Reports Reader role and can also be used for group-based assignment to App1.
Why the other options are wrong
- A. A Microsoft 365 group adds a mailbox and collaboration resources that are not needed to grant a role and app access.
- B. Dynamic membership is not supported for groups used to assign Microsoft Entra roles, and no mailbox is needed here.
- D. Groups used for Microsoft Entra role assignment must be created with assigned membership; dynamic membership is not supported for this purpose.
Question 10
You have a new Microsoft 365 E5 tenant.
You need to enable an alert policy that will be triggered when an elevation of Microsoft Exchange Online administrative privileges is detected.
What should you do first?
Show answer and explanation
Correct answer: A. Enable auditing.
Auditing must be enabled first before alert policies can function in Microsoft 365. Alert policies rely on the audit log to detect and trigger on specific activities such as elevation of Exchange Online administrative privileges. Without auditing enabled, the system cannot capture the events needed to trigger alerts.
Why the other options are wrong
- B. Microsoft 365 usage analytics are not prerequisites for creating alert policies.
- C. Insider risk management policies are a separate compliance feature and are not required before enabling basic alert policies.
- D. Communication compliance policies are distinct from alert policies and are not necessary prerequisites for privilege elevation alerts.
That was 10 of 460.
The full Microsoft MS-102 pack has all 460 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.